5

I've a PDF file that contains some malicious code; when opened the processor usage maxes out and the fans run at full rpm. The pdfid.py produces the following output:

PDF Header: %PDF-1.7
 obj                 8598
 endobj              8598
 stream              8001
 endstream           8001
 xref                   0
 trailer                0
 startxref              2
 /Page                594
 /Encrypt               0
 /ObjStm              981
 /JS                    1
 /JavaScript            0
 /AA                    2
 /OpenAction            1
 /AcroForm              0
 /JBIG2Decode           0
 /RichMedia             0
 /Launch                0
 /EmbeddedFile          0
 /XFA                   0
 /URI                   0
 /Colors > 2^24         0

/JS indicate that there's one JavaScript code and /AA and /OpenAction indicate that there are code which will launch the JavaScript code.

However using the pdf-parser.py tool, searching for keyword javascript produces no matches:

python ./pdf-parser.py --search javascript ./document.pdf

But searching for keyword OpenScript returns one match.

python ./pdf-parser.py --search openaction --raw ./document.pdf

result:

obj 33412 0
 Type: /Catalog
 Referencing: 37640 0 R, 4364 0 R, 37641 0 R, 33413 0 R, 18188 0 R, 33259 0 R, 33264 0 R, 18275 0 R, 37642 0 R
<</MarkInfo 37640 0 R/Metadata 4364 0 R/Names 37641 0 R/OpenAction 33413 0 R/Outlines 18188 0 R/PageLabels 33259 0 R/PageLayout/SinglePage/PageMode/UseNone/Pages 33264 0 R/StructTreeRoot 18275 0 R/Type/Catalog/ViewerPreferences 37642 0 R>>

  <<
    /MarkInfo 37640 0 R
    /Metadata 4364 0 R
    /Names 37641 0 R
    /OpenAction 33413 0 R
    /Outlines 18188 0 R
    /PageLabels 33259 0 R
    /PageLayout /SinglePage
    /PageMode /UseNone
    /Pages 33264 0 R
    /StructTreeRoot 18275 0 R
    /Type /Catalog
    /ViewerPreferences 37642 0 R
  >>

Executing:

python ./pdf-parser.py --reference 33412 --raw ../document.pdf

result:

obj 37639 0
 Type: /XRef
 Referencing: 33410 0 R, 33412 0 R
 Contains stream

  <<
    /DecodeParms
      <<
        /Columns 5
        /Predictor 12
      >>
    /Filter /FlateDecode
    /ID [<0B1CC64D68284D90BD0A295FADB0972A><08CB936A1AF9EB42A906D26EC2F80EFA>]
    /Index [33411 15558]
    /Info 33410 0 R
    /Length 7901
    /Prev 15523287
    /Root 33412 0 R
    /Size 48969
    /Type /XRef
    /W [1 3 1]
  >>


obj 4368 0
 Type: /XRef
 Referencing: 33410 0 R, 33412 0 R
 Contains stream

  <<
    /DecodeParms
      <<
        /Columns 5
        /Predictor 12
      >>
    /Filter /FlateDecode
    /ID [<0B1CC64D68284D90BD0A295FADB0972A><08CB936A1AF9EB42A906D26EC2F80EFA>]
    /Info 33410 0 R
    /Length 8135
    /Root 33412 0 R
    /Size 33411
    /Type /XRef
    /W [1 3 1]
  >>

Finally running

python ./pdf-parser.py --object 4368 --raw --filter ./document.pdf

produces a binary output that I cannot decompress.

Can someone please point out my mistake or tell me how to extract the JavaScript and OpenAction code for viewing?

  • 1
    A stream is compressed (--raw ) . You can dump the decompressed object indeed, check out this : stackoverflow.com/questions/27997930/how-to-decode-a-pdf-stream – mootmoot Apr 30 '18 at 9:53
  • 1
    Well, that's mean you are not getting the first javascript entry point, but part of the obfuscated payload. My suggestion : download the GUI PDF dissector and use it to learn how the malicious PDF is structured. – mootmoot Apr 30 '18 at 11:15
  • Have you tried to just open the pdf files in a text editor? If I recall correctly, you should be able to see the javascript as plaintext. – Dog eat cat world Apr 30 '18 at 19:25
  • It seems peedft give you a nice walk through. Please use the similar method than immediately jump into the object that you found, which may not be the script. (Btw, I just notice the pdfdissector removed by the author, somebody mentioned they join google ). – mootmoot Apr 30 '18 at 19:27
  • pdfinfo -js myfile.pdf prints all JavaScript in the PDF. pdfinfo is from Poppler. – Flux Jun 23 at 4:23
1

Use any Hex Editor, to split open the contents of the PDF file(aka image, text, javascript code etc). You can validate your file's contents henceforth and filter the javascript or suspicious code.

  • 2
    "Use a hex editor" doesn't seem like much of an answer, and you offer no explanation as to how someone would "validate their file's contents" or "filter the javascript" – AndrolGenhald May 3 '18 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.