Hello and welcome back.
In this video, we are going to do that particular on analyzing PDF document, which you have already
downloaded from an earlier lesson called that PDF, that period.
And we are going to use three tools, which we looked at in the previous lesson.
That is PDF idee, PDF Passa and be PDF.
So the first thing we do is to run PDAF I.D., so I typedef.
I'd tell you why, because this is a Python script, followed by the name of the video that I want to
get into, and it shows the result of the analysis.
The first line shows that there is a prayer here with this string percentage PDAF dash one point three,
and this means the version of it within one point three.
And 13 objects, 14 objects altogether and two streams going down.
We will see that these are all the objects that has been detected.
Of particular interest will be the ocean object.
The open ocean object is the.
Directive, the object will cost PDF to execute something when the PDAF is open.
And then if you looked up further, we will see that there are JavaScript embedded in these files,
so most probably the operation will run the JavaScript that is listed here.
So these are the important objects that we have found from this preliminary analysis using PDF, Heidi.
The next to that, we will form a PDF parser.
So let's open a new terminal.
And navigate to the folder that contains our malicious PDA file.
Now will run BTX Pusser.
Don't be shy and we will use the search option and we will search for one of the objects that has been
found by PDF, which is the open ocean object.
So here we specify open ocean, not that it is case in sensitive.
And followed by the name of the father and hit Enter.
And from here, we see that he has found the open ocean, which is having the object is one of ocean
zero and it is of a type catalogue.
And inside here, these are details of the open ocean object.
And between the left and right arrows, he shows what object, what is the content of the open ocean.
And we see Dave is a JavaScript, G.S. JavaScript, and he also shows us part of the string that is
found in the JavaScript.
So this tells us that when this PDF is open, he will use the open ocean object to execute a JavaScript
which is having this function.
Now, the fundi JavaScript, we have found that it is present within this file and confirm the next
thing we do is we will use parser to search for the JavaScript object.
JavaScript is, if you remember, was also found in PDF, Heidi, so let us clear the screen and repeat
the same.
Come on, just move your Ibaraki press on it and then here we change the name of the object that we
wish to search for gain javascript and hit enter.
And now you will see that there are three JavaScript that has been found.
The first one is the object, one we have just seen.
The second one is object seven.
And then the third one is subject to all these three are referencing JavaScript and objects seven inside
it you will see that it is referencing four objects which is listed for here, which is JavaScript then.
So Objects Seven refers to Object Ten.
I.A. is also making a further reference to an object 13 and 13 is also JavaScript.
So now we need to dig further into object segment and object to since Objects seven is referring to
Object 10, we need to investigate Object 10.
And since Object Job is also referring to object, I think we also need to reference objective.
So that is now open at the terminal.
Go to the folder containing our malware.
And we are going to repeat the scan brief passer by, and this time we are going to search for objects.
So we need to change the option to object.
And we specify Object 10, which is listed here, followed by the name of their player.
And also here you find an object.
Tengu refers to object, which has codenames object, and it is not calling you script.
So object your as you can see from here in the previous scan, previous search refers to object 13.
So ultimately move object 10.
Now, an object here refers to object hitting this suggest, which is actually in object 13, so we
should go to object 13.
So we repeat the search this time to object to object 13.
And finally, we found out JavaScript and the object that in itself has a filter with barometer flattened
content, which means it is easily compressed and he has a line or one thousand one hundred eighty three
bytes.
So by default, PDAF pastor does not filter or play any of the of the parameters in the filter, but
we can tell it to do so so we can repeat the same command.
But this time we will tell the pastor to use the filter that we have and also to DSW to output the raw
format without any formatting.
So you press enter now and you see this is the output after it has applied the filter to Uncompress
it and you can see here the JavaScript code and you can also see the carriage return new line which
is in Turkey and some function and escape function.
And if you scroll down you can see some very interesting function Colletta info as well.
So now we know that he has got this JavaScript which you can see, but it is not properly nicely formatted
and it's difficult to read.
So we need to Dumela to a separate file and analyze it with suitable JavaScript editor.
So to do that we can repeat the command, but this time we are going to put clear clearly screen.
This time we are going to done.
So we put a dash dum dum and then the name of the file that we wish to be caught.
We would call LBJ 13 dogs and enter and it gives some output, some some output references and as well
as a new file so far.
And we can do here, as you can see this, a new file will be Dr. King.
And then if we see here in the GUI, we can see habituating and we can open it by clicking and opening
the officials to you could.
Visual Studio could play nicely for me, the whole thing, so that we can easily really and over here
we see that there is a function.
Will the office get a name and some other escape functions as well, another function?
Here is a look here and there is another function called Lepton info.
So there's one more thing we can do.
We update passa.
So VFP pdf.
So you have managed to extract the JavaScript function.
So let me show you how you can use the PDF and YAARA together.
So to do that we typedef parser not be and then pass it the dash y option, which means to use their
YAARA rules to scan and then we specify the location of the arrows itself.
The index Yaffa, followed by the name of the --.
You want to scan and now you can enter.
And if we use Tiara's scan and he has found a match, he says that the issue possible exploit object
13.
And it is a stream object and it is compress a filter flat line one thousand one hundred three base.
And you remember earlier on when we scan this file that pdaf yaara, if you did not see this, that
is because this stream is compressed.
Now when you use PDF, possibly Bedfast was smart enough to be able to uncompress the stream using the
filter and then because he has uncompress accuracy bortolotti look inside the stream and detect that
exploit.
So this output here object is exactly what we saw.
When we get manual analysis using the PDF parser earlier.
If you have a problem with using pure passive you Desh, why some of you may find that some errors,
some errors about unable to open include files or other kinds of errors.
Can you watch how another video following this video on how you can fix that error and then once you
fix that error, you can come back to this project and we will use another different to be PDF to analyze
this file.
Thank you for watching.
I'll see you in the next one.