Hello and welcome back to Lessons Ago, we did analysis of the file, that PDF, that perfusing using
I.D. and PDF passa, and then now we are going to continue the analysis using another to be.
So let me clear the screen.
So to do that, we take the common B PDF.
Followed by the option dashi, which means interactive mode and the meaning of right, so that we can
dump the suspicious file, which we, if ever we find any see, and a blinking cursor here, there is
a prompt meaning that we are in interactive mode.
So now if you scroll down, you can see the report even gives us the hash Amde five, Shahd one shot
five, six.
And the version of the PD is one point three.
And below that we can see it has found that this is version zero.
Now, -- can have multiple versions, but usually the PDF reader who only used the latest version
now in this particular -- only version, one version.
Therefore, it is pushing zero.
And inside you find there is one main section, the catalog section, which is idee one, and they are
14 objects.
And here all of the objects, Heidi, from one to 14.
And there are two streams within this Profar object 11 and object 13.
And and they are to encode it objects in here, which is subject 11 and 13, which are the streams.
And then in the yellow text here, you can see objects be suspicious elements.
And it has found two JavaScript code, which is an object, one in Object 13.
And he lists all the suspicious objects and you can see what connection name JavaScript at the bottom
here.
We will see something interesting.
The name of the vulnerability is to survive this here.
We can now go online and check what the details of this vulnerability and probably use the information
to help us avoid using an older version of the reader which might contain this vulnerability.
So now that we know that his JavaScript in the object here object objecting, you can go ahead and take
a look at the object itself, which is objecting.
So to do that, you can go through the interactive command line here and type the combined object,
followed by the object that we wish to inspect and enter.
And here you show us the JavaScript.
And he has also automatically decoded an uncompress it for us and show us the JavaScript.
Now, if he wanted to examine this in a standard editor like we should to your code, which we used
earlier, we can do that too.
All we need to do is redirect the output, objecting to a file so we can call this file maybe objective
and then underscore two four version two that the G.
S and enter.
And now we come back here.
We see there is another file and you can double click it and open it with visuals to your code.
And you will notice that there are two identical files.
Now I send it the new file which you just created, has got some additional tax here, which are the
output tax so we can delete it manually.
So go here and delete this.
And this and now we are left with the pure JavaScript function that they selected from this video for.
So now you can study the JavaScript and try to understand what he's doing since you have now got the
JavaScript here.
Now another thing you can do with her of BP, since you have the hasher, you can actually copy this
hash and go to various total and check it up so I can directly computers and then open my browser from
here.
And head over to Vivus, Toto.
And then click on search and paste the hasher and enter.
And you will see he has a long list of the name of the exploit, so this is how it can be use of this
PDF PDF is so easy to use compared to the PDAF ID and PDF.
Pazz in Feigin PDF, possibly we need it to manually perform the analysis, but in PDF we can do it
so easily and so far have just a few months.
So.
So remember when you're doing analysis, if you are using player ID and PDF password, you need to be
manually starting Previdi as triaging and then to get the suspicious report, if any.
And then once you're for anything suspicious, then you will use Pozzo and you need to hunt it on the
suspicious objects.
But if you wanted to do it fast and quick, then you can go straight to the PDF now added commands you
can secure PDF you can to help here and then you can see all the available commands that you can use
now to this this PDF PDF Technical Moncrieffe or here.
So now that we have managed to extract the JavaScript, remember to save your JavaScript and in a nice
video and come upcoming videos, we will analyze this, extract that malicious JavaScript.
So that's all for this lesson.
Thank you for watching.