Hello everyone. 1
Let us start analyzing a bunch of malicious PDF files. 2
So again we'll be coming back to our FLARE suite of tools collection. 3
You can see there is a folder for PDF. When you go inside you will find that there is a tool called PDF 4
parser which is critical in parsing the complete PDF file and extracting malicious artifacts artifact. 5
Then there is a shortcut for PDF-parser and there is a shortcut for PDfid. 6
So these are basically the compiled executables of the actual program. 7
If you go inside PDf-parser, you'll see that it's simply a python file. 8
You we can run it just like we ran the other OLE file analysis tools in the previous videos. 9
So Pdfid's original tool is not here. So we can just click on the properties of the shortcut and we 10
can see that where exactly this shortcut is pointing to. 11
They can see that it's in Program Files/pdfid 12
So I don't really enjoy running the shortcuts. It's better to always run the python program directly 13
so that in case there is any error you can look at it and try and resolve. 14
So let's quickly go to program files. 15
Pdfid and just copy it and move it to the FLARE folder. 16
So you now have both pdf-parser and pdfid in the same FLARE directory. 17
So pdfid is more of a 18
meta information tool which gives you a bunch of information about the PDF file. 19
For example how many page numbers are there, are there any javascripts inside it and things like that. 20
Whereas PDF-parser is more of a dynamic parsing of the PDF file. 21
So let's begin with using pdfid. 22
For the first 23
So I will come to my pdfid directory and my files are stored in course files/PDF files/PDF examples 24
I have three examples here. 25
So we'll be using them one on one 26
We Will pass >python pdfid.py followed by the location of the file. 27
So once you press enter it will give us a bunch of information. 28
For example this PDF file has 26 objects inside it. 29
If you remember from our previous discussion we talked about how PDF file is basically.....the body of PDF file 30
consists of different objects and all those objects will begin with. 31
'obj' and end with 'endobj'. 32
So there are 26 objects and 26 end-objects so it is ending all the objects properly 33
There are nine streams. Again the body of for the PDF files contain streams and these teams have the 34
data. 35
Then there is one cross-reference. 36
There is one trailer one start xref 37
There are three page numbers. 38
There is one javascript as well. 39
/JS tag and it has been picked up by PDfid 40
well. 41
There is an open action as well. 42
So what I mean by open action here is that once you launch the PDf file, whatever is 43
marked as open action will be immediately executed. 44
So it's very important to understand all these meta properties that we have got from PDfid 45
We already know a bunch of them but there are some of them which are new and the important ones are things 46
like JS, Javascript, AA, openaction 47
XFA, URI 48
So URI again tells us is there is any URI that is present inside the PDF. The embedded file 49
tells us. 50
Is there any embedded file for example an executable or a Flash file that is inside the PDF. So the interesting 51
parts here are javascript's. 52
We know that this file contains javascript and there is an open action that is performed as well which 53
means that as soon as we are launching the PDF ,the PDF is trying to do something without you know giving 54
you any kind of permission or something. 55
All you have to do is just from that PDF itself. let us run for our second file as well 56
file we get something similar. 57
There are 12 objects two streams it has two pages. 58
And again it has javascript inside it and it performs open action as well and there is no embedded file 59
and there is no URI inside that PDF file 60
Let us try with our third example 61
We have eight objects one stream one page. 62
There is no javascript. 63
In this case and that is one xfa, no URI. That's it. 64
So this is how we first collect some kind of static information of the PDF file using pdfid and 65
this can help us in making again some heuristic analysis of the PDF file by looking at the number 66
of pages, whether it has some javascript's or not with it or its performing some open action or not and 67
things like that. 68
So once we have some kind of static heuristics about the PDF file, the next thing that we can do 69
is we can start using PDF parser to actually look into these elements.