GithubHelp home page GithubHelp logo

cyb3rchi3f / pdf Goto Github PK

View Code? Open in Web Editor NEW

This project forked from malice-plugins/pdf

0.0 0.0 0.0 520 KB

Malice PDF Plugin

License: MIT License

Shell 0.10% Python 92.58% Go 3.49% Makefile 1.88% HTML 1.13% Dockerfile 0.82%

pdf's Introduction

pdf logo

malice-pdf

Circle CI License Docker Stars Docker Pulls Docker Image

Malice PDF Plugin

This repository contains a Dockerfile of malice/pdf. It runs PDFiD and pdf-parser.py on samples and will extract and (eventually) submit extracted files as children back to malice for analysis.


Dependencies

Installation

  1. Install Docker.
  2. Download trusted build from public DockerHub: docker pull malice/pdf

Usage

$ docker run --rm -v /path/to/malware:/malware malice/pdf --help

Usage: pdfscan [OPTIONS] COMMAND [ARGS]...

  Malice PDF Plugin

  Author: blacktop <https://github.com/blacktop>

Options:
  --version   print the version
  -h, --help  Show this message and exit.

Commands:
  scan  scan a file
  web   start web service

Scanning

$ docker run --rm -v /path/to/malware:/malware malice/pdf scan --help

Usage: pdfscan.py scan [OPTIONS] FILE_PATH

  Malice PDF Plugin.

Options:
  -v, --verbose            verbose output
  -t, --table              output as Markdown table
  -x, --proxy PROXY        proxy settings for Malice webhook endpoint
                           [$MALICE_PROXY]
  -c, --callback ENDPOINT  POST results back to Malice webhook
                           [$MALICE_ENDPOINT]
  --elasticsearch HOST     elasticsearch address for Malice to store results
                           [$MALICE_ELASTICSEARCH_URL]
  --timeout SECS           malice plugin timeout (default: 10)
                           [$MALICE_TIMEOUT]
  --extract PATH           where to extract the embedded objects to
  -h, --help               Show this message and exit.

This will output to stdout and POST to malice results API webhook endpoint.

Sample Output

{
  "pdf": {
    "streams": {},
    "peepdf": {},
    "pdfid": {
      "heuristics": {
        "embeddedfile": {
          "reason": "`/EmbeddedFile` flag(s) detected",
          "score": 0.9
        },
        "nameobfuscation": {
          "reason": "no hex encoded flags detected",
          "score": 0
        },
        "suspicious": {},
        "triage": {
          "reason": "sample is likely malicious and requires further analysis",
          "score": 1
        }
      },
      "countChatAfterLastEof": "0",
      "errorMessage": "",
      "dates": {
        "date": []
      },
      "nonStreamEntropy": "4.896895",
      "header": "%PDF-1.1",
      "version": "0.2.4",
      "entropy": "",
      "totalEntropy": "7.873045",
      "isPdf": "True",
      "keywords": {
        "keyword": [
          {
            "count": 9,
            "hexcodecount": 0,
            "name": "obj"
          },
          {
            "count": 9,
            "hexcodecount": 0,
            "name": "endobj"
          },
          {
            "count": 2,
            "hexcodecount": 0,
            "name": "stream"
          },
          {
            "count": 2,
            "hexcodecount": 0,
            "name": "endstream"
          },
          {
            "count": 1,
            "hexcodecount": 0,
            "name": "xref"
          },
          {
            "count": 1,
            "hexcodecount": 0,
            "name": "trailer"
          },
          {
            "count": 1,
            "hexcodecount": 0,
            "name": "startxref"
          },
          {
            "count": 1,
            "hexcodecount": 0,
            "name": "/Page"
          },
          ...SNIP...
          {
            "count": 0,
            "hexcodecount": 0,
            "name": "/Colors > 2^24"
          }
        ]
      },
      "countEof": "1",
      "streamEntropy": "7.970107",
      "errorOccured": "False"
    }
  }
}

pdf

[PDFiD]

  • PDF Header: %PDF-1.1
  • Total Entropy: 7.873045
  • Entropy In Streams: 7.970107
  • Entropy Out Streams: 4.896895
  • Count %% EOF: 1
  • Data After EOF: 0
Keyword Count
obj 9
endobj 9
stream 2
endstream 2
xref 1
trailer 1
startxref 1
/Page 1
/Encrypt 0
/ObjStm 0
/JS 1
/JavaScript 1
/AA 0
/OpenAction 1
/AcroForm 0
/JBIG2Decode 0
/RichMedia 0
/Launch 0
/EmbeddedFile 1
/XFA 0
/Colors > 2^24 0
Embedded File

Score: 50

  • /EmbeddedFile flag(s) detected
Triage

Score: 150

  • /JS: indicating javascript is present in the file.
  • /JavaScript: indicating javascript is present in the file.
  • /OpenAction: indicating automatic action to be performed when the page/document is viewed.
Suspicious Properties

Score: 50

  • Page count of 1

[pdf-parser]

Stats
  • Comment: 3
  • XREF: 1
  • Trailer: 1
  • StartXref: 1
  • Indirect object: 9
  • 1: 5
  • /Action 1: 9
  • /Catalog 1: 1
  • /EmbeddedFile 1: 8
  • /Filespec 1: 7
  • /Font 1: 6
  • /Outlines 1: 2
  • /Page 1: 4
  • /Pages 1: 3
TAGS

file_name:

  • eicar-dropper.doc

pestudio_blacklist_string:

  • JavaScript
Embedded Files
Object Sha256
8 eb0ae2d1cd318dc1adb970352e84361f9b194ff14f45b0186e4ed6696900394a
Carved Content

EmbeddedFile:

s<<++<<            /Names [(eicar-dropper.doc) 7 0 R]    /OpenAction 9 0 R

OpenAction:

<<
 /Type /Action
 /S /JavaScript
 /JS (this.exportDataObject({ cName: "eicar-dropper.doc", nLaunch: 2 });)
>>

JS:

(this.exportDataObject({ cName: "eicar-dropper.doc", nLaunch: 2 })    ; )

Documentation

Issues

Find a bug? Want more features? Find something missing in the documentation? Let me know! Please don't hesitate to file an issue

CHANGELOG

See CHANGELOG.md

Contributing

See all contributors on GitHub.

Please update the CHANGELOG.md

Credits

Heavily (if not entirely) influenced by CSE-CST's alsvc_pdfid and alsvc_peepdf

TODO

  • add PDFiD
  • add pdf-parser for streams
  • add peepdf for JS
  • add uwsgi to serve webserver (maybe nginx?)
  • float PDFiD errors up like I do with pdf-parser (handles errors when file is not a PDF)
  • check if PDF is too big (max size 3000000 ??)
  • add smart timeout to avoid DoS samples
  • use https://github.com/unidoc/unidoc instead?? I miss you golang, I miss you soooo hard ๐Ÿ˜ซ

License

MIT Copyright (c) 2016-2018 blacktop

pdf's People

Contributors

blacktop avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.