Please enable JavaScript.
Coggle requires JavaScript to display documents.
INFECTED PDF (pdf-parser.py (--search javascript <file>, --search…
INFECTED PDF
pdf-parser.py
--search javascript <file>
--search javascript --raw <file>
./pdf-parser.py --search uri suspicious.pdf
./pdf-parser.py --search ObjStm --raw suspicious.pdf
--search javascript --raw <filename>
--search OpenAction --raw <filename>
--reference <some_ID> --raw <filename>
--object <object_ID> --raw <filename>
pdfid.py
/OpenAction
and /AA specify the script or action to run automatically.
/
JavaScript
and /JS specify JavaScript to run.
/
GoTo
changes the view to a specified destination within the PDF or in another PDF file.
/
Launch
can launch a program or open a document.
/
URI
accesses a resource by its URL.
/
SubmitForm
and /GoToR can send data to URL.
/
RichMedia
can be used to embed Flash in a PDF.
/
ObjStm
can hide objects inside an Object Stream.
tags
http://www.fpdf.org/en/doc/