Analyzing PDF Malware With Pdfid

Analyzing Pdf Malware With Pdfid

Overview

Cybersecurity skill for analyzing pdf malware with pdfid. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing pdf malware with pdfid"

• "Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify emb"

• A suspicious PDF attachment has been flagged by email security or reported by a user

• You need to determine if a PDF contains embedded JavaScript, shellcode, or exploit code

• Triaging PDF documents before opening them in a sandbox or analysis environment

• Extracting embedded executables, scripts, or URLs from malicious PDF objects

• Analyzing PDF exploit kits targeting Adobe Reader or other PDF viewer vulnerabilities

Do not use for analyzing the rendered visual content of a PDF; this is for structural analysis of the PDF file format for malicious objects.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Python 3.8+ with Didier Stevens' PDF tools installed (pip install pdfid pdf-parser)
• peepdf installed for interactive PDF analysis (pip install peepdf)
• pdftotext from poppler-utils for extracting text content safely
• YARA with PDF-specific rules for malware family identification
• Isolated analysis VM without a PDF reader installed (prevent accidental opening)
• CyberChef for decoding embedded Base64, hex, or deflate streams

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Scope the Analysis — Define what pdf malware artifacts or data sources to examine and the investigation timeline.
2. Preserve Evidence — Create forensic copies of relevant data. Maintain chain of custody documentation.
3. Extract Key Indicators — Use pdfid to parse and extract relevant pdf malware data points from collected artifacts.
4. Correlate Findings — Cross-reference extracted data with other sources (threat intel, logs, timelines).
5. Build Timeline — Construct a chronological sequence of events related to pdf malware.
6. Document Analysis — Write findings report with evidence, conclusions, and recommendations.

Tools

• pdfid — Primary tool for this skill
• Forensic Toolkit — Evidence collection and analysis
• Timeline Tools — Chronological event reconstruction
• Log Analysis Platform — Centralized log parsing and search

Process

1. Reconnaissance — Gather target information, identify attack surface, enumerate services
2. Analysis/Exploitation — Execute the technique, analyze results, document findings
3. Reporting — Document IOCs, write findings, provide remediation recommendations

Verification

• All pdf malware procedures executed completely and documented
• Findings validated against multiple data sources
• False positives identified and filtered
• Results documented with evidence and timestamps
• Recommendations provided with risk-based prioritization

Anti-Rationalization Table