{"id":13796979,"url":"https://github.com/zbetcheckin/pdf_analysis","last_synced_at":"2025-04-09T09:45:36.379Z","repository":{"id":151141366,"uuid":"64815175","full_name":"zbetcheckin/PDF_analysis","owner":"zbetcheckin","description":"Several PDF analysis reassembled with additional tips and tools","archived":false,"fork":false,"pushed_at":"2023-05-16T11:56:09.000Z","size":241,"stargazers_count":323,"open_issues_count":2,"forks_count":57,"subscribers_count":9,"default_branch":"master","last_synced_at":"2025-02-15T03:47:26.265Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zbetcheckin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-08-03T04:30:35.000Z","updated_at":"2025-02-09T03:29:35.000Z","dependencies_parsed_at":"2024-08-03T23:17:39.977Z","dependency_job_id":null,"html_url":"https://github.com/zbetcheckin/PDF_analysis","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zbetcheckin%2FPDF_analysis","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zbetcheckin%2FPDF_analysis/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zbetcheckin%2FPDF_analysis/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zbetcheckin%2FPDF_analysis/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zbetcheckin","download_url":"https://codeload.github.com/zbetcheckin/PDF_analysis/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248017899,"owners_count":21034042,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T23:01:19.104Z","updated_at":"2025-04-09T09:45:36.298Z","avatar_url":"https://github.com/zbetcheckin.png","language":null,"funding_links":[],"categories":["\u003ca id=\"8c5a692b5d26527ef346687e047c5c21\"\u003e\u003c/a\u003e收集"],"sub_categories":[],"readme":"# PDF Analysis\n\n\u003eSeveral PDF analysis has already been done, I reassembled a lot of them with additional tips \u0026 tools here\n\n\n- [PDF format](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#pdf-format-page_facing_up)\u003cbr /\u003e\n- [Tools list](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#tools-list-wrench)\u003cbr /\u003e\n- [Quick Analysis](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#quick-analysis-rocket)\u003cbr /\u003e\n- [Complete Analysis](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#complete-analysis-mag_right)\u003cbr /\u003e\n\t- [Basic informations](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#basic-informations-1)\u003cbr /\u003e\n\t- [Metadata](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#metadata)\u003cbr /\u003e\n\t- [Search for older version](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#search-for-older-versions)\u003cbr /\u003e\n\t- [Online Analysis](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#online-analysis-1)\u003cbr /\u003e\n\t- [Statistics](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#statistics)\u003cbr /\u003e\n\t- [Visual analysis](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#visual-analysis)\u003cbr /\u003e\n\t- [Go deeper in the analysis](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#go-deeper-in-the-analysis)\u003cbr /\u003e\n\t- [Displaying objects and actions structure](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#displaying-objects-and-actions-structure-1)\u003cbr /\u003e\n\t- [Map of the objects flows](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#map-of-the-objects-flows)\u003cbr /\u003e\n\t- [Actions](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#actions)\u003cbr /\u003e\n\t- [Compression](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#compression)\u003cbr /\u003e\n\t- [Embeded files](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#embeded-files)\u003cbr /\u003e\n\t- [Extract files / scripts / objects](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#extract-files--scripts--objects-1)\u003cbr /\u003e\n\t- [Conversions](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#conversion)\u003cbr /\u003e\n\t- [Encryption](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#encryption)\u003cbr /\u003e\n\t- [Javascript](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#javascript)\u003cbr /\u003e\n\t- [Flash](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#flash)\u003cbr /\u003e\n- [Sources](https://github.com/zbetcheckin/PDF_analysis/blob/master/README.md#sources-information_source)\u003cbr /\u003e\n\n\n## PDF Format :page_facing_up:\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://github.com/zbetcheckin/PDF_analysis/blob/master/pdf_ange_albertini.png\" alt=\"alt text\" width=\"580\" height=\"403\"\u003e\n\u003c/p\u003e\n\u003cbr /\u003e\nhttps://www.adobe.com/devnet/pdf/pdf_reference.html \u003cbr /\u003e\nhttps://blog.didierstevens.com/2008/04/09/quickpost-about-the-physical-and-logical-structure-of-pdf-files/ \u003cbr /\u003e\nhttps://web.archive.org/web/20141010035745/http://gnupdf.org/Introduction_to_PDF \u003cbr /\u003e\n\n## Tools list :wrench:\n\nTool | URL\n------------------------------------ | ---------------------------------------------\nAnalyzePDF.py | https://github.com/hiddenillusion/AnalyzePDF\nByteForce | https://github.com/weaknetlabs/ByteForce\nCaradoc | https://github.com/ANSSI-FR/caradoc\nDidier Stevens suite | https://github.com/DidierStevens/DidierStevensSuite\ndumppdf | https://packages.debian.org/jessie/python-pdfminer\nforensics-all | https://packages.debian.org/jessie-backports/forensics-all\nOrigami | https://code.google.com/archive/p/origami-pdf/\nParanoiDF | https://github.com/patrickdw123/ParanoiDF\npeepdf | https://github.com/jesparza/peepdf\nPDF Xray | https://github.com/9b/pdfxray_public\npdf-parser | http://didierstevens.com/files/software/pdf-parser_V0_6_4.zip\npdf2jhon.py | https://github.com/magnumripper/JohnTheRipper/blob/unstable-jumbo/run/pdf2john.py\npdfcrack | https://packages.debian.org/jessie/pdfcrack\npdfextract | https://github.com/CrossRef/pdfextract\npdfobjflow.py | https://bitbucket.org/sebastiendamaye/pdfobjflow\npdfresurrect | https://packages.debian.org/jessie/pdfresurrect\nPdfStreamDumper.exe | http://sandsprite.com/CodeStuff/PDFStreamDumper_Setup.exe\npdftk | https://packages.debian.org/en/jessie/pdftk\npdfxray_lite.py | https://github.com/9b/pdfxray_lite\npoppler-utils | https://packages.debian.org/en/jessie/poppler-utils (pdftotext, pdfimages, pdftohtml, pdftops, pdfinfo, pdffonts, pdfdetach, pdfseparate, pdfsig, pdftocairo, pdftoppm, pdfunite)\npyew | https://packages.debian.org/en/jessie/pyew\nqpdf | https://packages.debian.org/jessie/qpdf\nswf_mastah.py | https://github.com/9b/pdfxray_public/blob/master/builder/swf_mastah.py\n\n\n#### Existing list\nhttp://blog.didierstevens.com/programs/pdf-tools/ \u003cbr /\u003e\nhttps://github.com/sans-dfir/sift-files/tree/master/pdf-tools\n\n\n## Quick Analysis :rocket:\n\n\n#### Basic informations\n```\n$ file file.pdf\n$ pdfinfo -box -meta -js -rawdates file.pdf\n```\n\n\n#### Displaying objects and actions structure \n```\n$ python pdfdid.py -aefv file.pdf\n```\n\n\n#### Search for /OpenAction /AA /Launch /GoTo /GoToR /SubmitForm /Richmedia (for Flash) /JS /JavaScript /URI - Encode - Cipher - Shell code - Obfuscation...\nAutomatically with ParanoiDF\n```\n$ python paranoiDF.py -fl file.pdf\n```\nOr with pdf-parser\n```\n$ python pdf-parser.py -v file.pdf\n```\nWith an hexadecimal analyser\n```\n$ bless file.pdf\n```\n\n\n#### Extract files / scripts / Objects\npdf-parser to extract a js object for example\n```\n$ pdf-parser --object 32 --raw \u003e extractedObject.js\n```\npdfextract from Origami\n```\n$ pdfextract file.pdf\n```\n\n\n#### Online analysis\u003cbr /\u003e\n*Beware to don't leak any important/professional/personnal data or to expose your research*\u003cbr /\u003e\nhttps://www.hybrid-analysis.com/\n\n\n## Complete Analysis :mag_right:\n\n\n### Basic informations\n```\n$ file file.pdf\n$ pdfinfo file.pdf\n$ pdfinfo -box -meta -js -rawdates file.pdf\n```\n\n\n### Powerfull Python tool to analyze PDF and exploit\n```\n$ pyew file.pdf \t\n```\n\n\n### Other Python tool to explore PDF\n```\n$ peepdf -fl file.pdf\n$ peepdf --interactive file.pdf\n```\n\n\n#### Analysis under Windows\nPDF Stream Dumper\u003cbr /\u003e\nhttps://github.com/dzzie/pdfstreamdumper\n\n\n\n### Metadata\nGet metadata\n```\n$ exiftool -a -u -g2 file.pdf\n```\n\nGet metadata recursivly from current directory\n```\n$ exiftool -r -ext pdf .\n```\n\nChange an element\n```\n$ exiftool -Title=\"New title\" file.pdf\n```\n\nRemove metadata\n```\n$ exiftool -all= file.pdf \u0026\u0026 exiftool -all:all= file.pdf \u0026\u0026 qpdf --linearize file.pdf filewithoutmeta.pdf\n$ mat file.pdf # latest version of mat doesn't support pdf format anymore...\n```\n\nRemove metadata recursively from the current directory :\n*Very dirty but work well*\n*The filename must not have space at the moment, the commande will be optimized*\n```\n$ find . -name \"*.pdf\" -print0 | while read -d $'\\0' file; do echo ${file:2} \u0026\u0026 mv ${file:2} ${file:2}.pdf \u0026\u0026 exiftool -all= ${file:2}.pdf \u0026\u0026 exiftool -all:all= ${file:2}.pdf \u0026\u0026 qpdf --linearize ${file:2}.pdf ${file:2} \u0026\u0026 rm ${file:2}.pdf \u0026\u0026 rm ${file:2}.pdf_original; done\n```\n\n\n### Search for older versions\nSearch for older \"hidden\" versions\n```\n$ pdfresurrect file.pdf -i\n$ exiftool -pdf-update:all= file.pdf\n```\n\n\n### Online Analysis \nName | URL\n------------------------------------ | ---------------------------------------------\nMalwr | https://malwr.com/submission/\nHybrid analysis | https://www.hybrid-analysis.com/\nMalware Tracker | https://www.malwaretracker.com/pdf.php\nVirusTotal | http://www.virustotal.com/\nPDF examiner | http://www.pdfexaminer.com/\nDocument Analyzer | http://www.document-analyzer.net/\nJotti | https://virusscan.jotti.org/\nPDF X-ray | http://www.pdfxray.com/\nPDF Online | https://www.pdf-online.com/\nExtract PDF | http://www.extractpdf.com\nChar conversion | https://kt.pe/tools.html#conv/\n\n\n### Statistics \nCalcul byte statistics, entropy min and max, ASCII count, ... from a PDF\n```\n$ python byte-stats.py file.pdf\n```\n\n\n### Visual analysis\nVisual analysis of a PDF or a binary file\u003cbr /\u003e\nhttp://binvis.io\n\n\n## Go deeper in the analysis\n\n### Displaying objects and actions structure \n```\n$ python pdfid.py --all --extra --force --verbose file.pdf\n```\n\n### Map of the objects flows\n```\n$ pdf-parser file.pdf | ./pdfobjflow\n$ eog pdfobjflow.png\n```\n\n\n### Actions\nSearch for : \u003cbr /\u003e\n/OpenAction /AA specifies the script or action to run automatically.\u003cbr /\u003e\n/Names /AcroForm /Action can also specify and launch scripts or actions.\u003cbr /\u003e\n/JavaScript specifies JavaScript to run.\u003cbr /\u003e\n/GoTo changes the view to a specified destination within the PDF or in another PDF file.\u003cbr /\u003e\n/Launch a program or opens a document.\u003cbr /\u003e\n/URI accesses a resource by its URL.\u003cbr /\u003e\n/SubmitForm /GoToR can send data to URL.\u003cbr /\u003e\n/RichMedia can be used to embed Flash in PDF.\u003cbr /\u003e\n/ObjStm can hide objects inside an Object Stream.\u003cbr /\u003e\n/JavaScript \u003e /J#61vaScript Beware on obfuscation technique with hex codes\n\n\nWith ParanoiDF\n```\n$ python paranoiDF.py -fl file.pdf\n```\nWith pdf-parser\n```\n$ python pdf-parser.py -v file.pdf\n```\nWith an hexadecimal analyser\n```\n$ bless file.pdf\n```\nWith dumppdf\n```\n$ dumppdf -a file.pdf\n```\n\n\n\n\n\n\n\n### Compression\nSearch for compression\n```\n$ strings file.pdf | grep --color \"/Filter\"\n```\n\n2 ways to decompress a PDF\n```\n$ pdftk compressed.pdf output uncompressed.pdf uncompress\n$ qpdf --stream-data=uncompress compressed.pdf uncompressed.pdf \n```\n\n\n\n### Embeded files\n4 ways to search for embeded files/scripts inside a PDF\n```\n$ binwalk file.pdf\n$ foremost -a -v file.pdf\n$ hachoir-subfile file.pdf\n$ scalpel file.pdf\n```\n\n\n### Extract files / scripts / objects\nExtract file corresponding to object ID, jpg for example\n```\n$ dumppdf.py -i 32 -r file.pdf \u003e image.jpg\n```\nExtract js from an object for example\n```\n$ pdf-parser --object 32 --raw \u003e extractedObject.js\n```\npdfextract from Origami\n```\n$ pdfextract file.pdf\n```\n\n\n\n### Conversion\nPDF to Postscript\n```\n$ pdftops file.pdf\n```\nPDF to TXT\n```\n$ pdftotext file.pdf\n```\nPDF to JPG\n```\n$ convert file.pdf image.jpg\n```\nNon-exhaustive list of possible conversion \n\n\n\n\n### LZWDecode filter\nConvert a PDF to Postscript without the LZWDecode filter\n```\n$ qpdf --stream-data=uncompress original.pdf decoded.pdf # Decompress it\n$ pdftops decoded.pdf decoded.ps # Convert it\n```\n\n\n### Encryption\nPDF supports RC4 encryption (40 to 128 bits keys) and AES (128 to 256 with the Extension Level 3). \u003cbr /\u003e\nBeware with empty password.\n\n\n#### Password recovering\nBrute force a PDF with pdfcrack\n```\n$ pdfcrack -w yourDictionnary.txt file.pdf\n```\nWith john\n```\n$ pdf2john.py file.pdf \u003e x.hash\n$ john --wordlist=yourDictionnary.txt x.hash\n```\n\n\n### Javascript\n\n2 ways to search for Javascript\n```\n$ pdf-parser --search=JavaScript file.pdf \n$ pdfinfo -js file.pdf\n```\n\n\nExtract an object\nWith jsunpack\n```\n$ jsunpack-extractjs file.pdf\n```\nWith pdf-parser\n```\n$ pdf-parser --object 32 --raw file.pdf \u003e file.js\n```\nWith pdfextract from Origami\n```\n$ pdfextract --js file.pdf\n```\n\n\n#### De-obfuscate\nhttps://github.com/urule99/jsunpack-n \u003cbr /\u003e\n\nOnline :\u003cbr /\u003e\nhttp://jsunpack.jeek.org/java/ \u003cbr /\u003e\n\nMalzilla and SpiderMonkey can also help deobfuscate JavaScript.\u003cbr /\u003e\nMalzilla : \u003cbr /\u003e\nhttp://www.malzilla.org/downloads.html \u003cbr /\u003e\nSpiderMonkey : \u003cbr /\u003e\nhttp://www.didierstevens.com/files/software/js-1.7.0-mod.tar.gz \u003cbr /\u003e\nMore details coming soon.\n\n\n#### Add Javascript to PDF\nhttps://didierstevens.com/files/software/make-pdf_V0_1_6.zip \u003cbr /\u003e\nhttps://neonprimetime.blogspot.fr/2015/03/how-to-add-javascript-to-pdf.html \u003cbr /\u003e\n\n\n#### Disarming a PDF\n```\n$ python pdfid.py --disarm file.pdf\n```\n\n\n### Flash\n\nSearch for flash\n```\n$ python pdf-parser.py --search flash file.pdf\n```\n\nExtract flash with swf_mastah\n```\n$ python swf_mastah.py -f file.pdf -o ./\n$ file *.swf\n```\nWith pdf-parser\n```\n$ pdf-parser.py --object 32 --filter --raw file.pdf \u003e flashFile.swf\n$ file flashFile.swf\n```\n\nAnalysing flash program\n```\n$ swfdump -Ddu flashFile.swf \u003e flashFile.txt\n```\nMore details coming soon.\n\n\n## Sources :information_source:\n\nhttps://blog.didierstevens.com/category/pdf/ \u003cbr /\u003e\nhttp://www.decalage.info/file_formats_security/pdf \u003cbr /\u003e\nhttps://zeltser.com/analyzing-malicious-documents/ \u003cbr /\u003e\nhttps://code.google.com/archive/p/corkami/wikis/PDFTricks.wiki \u003cbr /\u003e\nhttps://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443 \u003cbr /\u003e\nhttps://digital-forensics.sans.org/blog/2009/12/14/pdf-malware-analysis/ \u003cbr /\u003e\nhttp://fileformats.archiveteam.org/wiki/PDF \u003cbr /\u003e\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzbetcheckin%2Fpdf_analysis","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzbetcheckin%2Fpdf_analysis","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzbetcheckin%2Fpdf_analysis/lists"}