Hello and welcome back.
In this video, we are going to take a look at video analysis tools when we are analyzing PDAF documents,
what we are looking for, suspicious keywords, for example, or action or the abbreviated a JavaScript
or the abbreviation.
Yes, we can also look for encoded data and we can also use YAARA to scan for patterns we have in the
database.
For Yaara, a useful tool to use for first preliminary investigation is a PDF.
I'd be it.
I'd identify the PDF object types as well as you got any filters in the file.
It is useful for triaging PDF documents.
Triaging here means preliminary scan where we try to identify whether the file is suspicious before
embarking into a more detailed analysis.
The two can be found in this site here as listed here.
One disadvantage, or providea is that it only tells you what is in the document and not where it is.
So this too is not completing the PDI parser, but it was kind of fun to look for certain keywords,
allowing you to identify PDAF documents that contain, for example, JavaScript or execute an action
and open PDAF also handle the obfuscation.
The idea is to use this to first to try PDF documents and then analyze suspicious ones with the PDF
parser.
Bereft parser we use in the second stage of the analysis, after having used PDF, I'd first bedecked
bus passes, searcher's and a stress data from PDF documents.
It is also altered by the same creator Deedes Stevens in this website is the same author who created
video ID.
Some of the command line options that we can use, we believe Parsa is as followed by the term.
So if we search for the term Daesh or for ENVIRON No, we will cause it to search for the object.
No.
That often will decode the object, that absorption will display the results output in raw form, it
so believed it allows you to extract all the objects which are obfuscated and like PIDF Heidi.
This is the website where you can download the PDF, ID as well as PDF passa.
The screenshot here shows a page from this website, it is called PDF Tu's, so this particular output
is the output for PDF, Buzzer Beater Password and HP.
Why is a Python script?
And these are some of the common options that are available when you are writing the script.
Another useful tool which can do both what Idee and PDAF parser do is call a PDF.
PDF combines multiple tools into one.
You can find suspicious objects, decode data and as well as identify JavaScript.
And this can be downloaded from this website.
Some of the command line options that are available is Dashi, which is to run in Limor and Deshu,
which is to update the program when it starts the eye in line.
What is useful if you wanted to decode certain objects that you have found who are doing a full scan?
So these are tools that will be looking at in the particular session that is coming up in the next few
videos.
So this brings us to the end of this video.
Thank you for watching.