6

I've a PDF file that contains some malicious code; when opened the processor usage maxes out and the fans run at full rpm. The pdfid.py produces the following output:

PDF Header: %PDF-1.7
 obj                 8598
 endobj              8598
 stream              8001
 endstream           8001
 xref                   0
 trailer                0
 startxref              2
 /Page                594
 /Encrypt               0
 /ObjStm              981
 /JS                    1
 /JavaScript            0
 /AA                    2
 /OpenAction            1
 /AcroForm              0
 /JBIG2Decode           0
 /RichMedia             0
 /Launch                0
 /EmbeddedFile          0
 /XFA                   0
 /URI                   0
 /Colors > 2^24         0

/JS indicate that there's one JavaScript code and /AA and /OpenAction indicate that there are code which will launch the JavaScript code.

However using the pdf-parser.py tool, searching for keyword javascript produces no matches:

python ./pdf-parser.py --search javascript ./document.pdf

But searching for keyword OpenScript returns one match.

python ./pdf-parser.py --search openaction --raw ./document.pdf

result:

obj 33412 0
 Type: /Catalog
 Referencing: 37640 0 R, 4364 0 R, 37641 0 R, 33413 0 R, 18188 0 R, 33259 0 R, 33264 0 R, 18275 0 R, 37642 0 R
<</MarkInfo 37640 0 R/Metadata 4364 0 R/Names 37641 0 R/OpenAction 33413 0 R/Outlines 18188 0 R/PageLabels 33259 0 R/PageLayout/SinglePage/PageMode/UseNone/Pages 33264 0 R/StructTreeRoot 18275 0 R/Type/Catalog/ViewerPreferences 37642 0 R>>

  <<
    /MarkInfo 37640 0 R
    /Metadata 4364 0 R
    /Names 37641 0 R
    /OpenAction 33413 0 R
    /Outlines 18188 0 R
    /PageLabels 33259 0 R
    /PageLayout /SinglePage
    /PageMode /UseNone
    /Pages 33264 0 R
    /StructTreeRoot 18275 0 R
    /Type /Catalog
    /ViewerPreferences 37642 0 R
  >>

Executing:

python ./pdf-parser.py --reference 33412 --raw ../document.pdf

result:

obj 37639 0
 Type: /XRef
 Referencing: 33410 0 R, 33412 0 R
 Contains stream

  <<
    /DecodeParms
      <<
        /Columns 5
        /Predictor 12
      >>
    /Filter /FlateDecode
    /ID [<0B1CC64D68284D90BD0A295FADB0972A><08CB936A1AF9EB42A906D26EC2F80EFA>]
    /Index [33411 15558]
    /Info 33410 0 R
    /Length 7901
    /Prev 15523287
    /Root 33412 0 R
    /Size 48969
    /Type /XRef
    /W [1 3 1]
  >>


obj 4368 0
 Type: /XRef
 Referencing: 33410 0 R, 33412 0 R
 Contains stream

  <<
    /DecodeParms
      <<
        /Columns 5
        /Predictor 12
      >>
    /Filter /FlateDecode
    /ID [<0B1CC64D68284D90BD0A295FADB0972A><08CB936A1AF9EB42A906D26EC2F80EFA>]
    /Info 33410 0 R
    /Length 8135
    /Root 33412 0 R
    /Size 33411
    /Type /XRef
    /W [1 3 1]
  >>

Finally running

python ./pdf-parser.py --object 4368 --raw --filter ./document.pdf

produces a binary output that I cannot decompress.

Can someone please point out my mistake or tell me how to extract the JavaScript and OpenAction code for viewing?

Improve this question
5
  • 1
    A stream is compressed (--raw ) . You can dump the decompressed object indeed, check out this : stackoverflow.com/questions/27997930/how-to-decode-a-pdf-stream
    – mootmoot
    Commented Apr 30, 2018 at 9:53
  • 1
    Well, that's mean you are not getting the first javascript entry point, but part of the obfuscated payload. My suggestion : download the GUI PDF dissector and use it to learn how the malicious PDF is structured.
    – mootmoot
    Commented Apr 30, 2018 at 11:15
  • Have you tried to just open the pdf files in a text editor? If I recall correctly, you should be able to see the javascript as plaintext.
    – Dog eat cat world
    Commented Apr 30, 2018 at 19:25
  • It seems peedft give you a nice walk through. Please use the similar method than immediately jump into the object that you found, which may not be the script. (Btw, I just notice the pdfdissector removed by the author, somebody mentioned they join google ).
    – mootmoot
    Commented Apr 30, 2018 at 19:27
  • pdfinfo -js myfile.pdf prints all JavaScript in the PDF. pdfinfo is from Poppler.
    – Flux
    Commented Jun 23, 2019 at 4:23

2 Answers 2

Reset to default
1

Use any Hex Editor, to split open the contents of the PDF file(aka image, text, javascript code etc). You can validate your file's contents henceforth and filter the javascript or suspicious code.

Improve this answer
1
  • 3
    "Use a hex editor" doesn't seem like much of an answer, and you offer no explanation as to how someone would "validate their file's contents" or "filter the javascript"
    – AndrolGenhald
    Commented May 3, 2018 at 14:07
0

You could also use pdfstreamdumper and use "Search_For" in the top menu for JavaScript.

If you find the Object ID you need with pdf-parser.py, you could also just go straight to that in the left column of pdfstreamdumper as well.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .