Quick PDF Analysis | Extract Embedded Data from PDF | Hidden Malicious Script
LET'S DO SOME FORENSICS ANALYSIS ON PDF QUICKLY!!
-------------------------------------------------------------------------------------------------------------------------
In continuation of Malware Analysis and DFIR Tools & Techniques series, this episode covers another tool named Origami, that will help us extracting embedded content(scripts, images, attachments, metadata, pdf streams) from a PDF. This episode has also been compiled from a real life usecase. While doing Incident Response you identified, one of end-users machine is trying to communicate with command and control IP address. From initial feed on your End-Point Detection system you found there is something wrong on a PDF that came as attachment email to user. You grabbed that PDF Sample and start the investigation.
We will run the tool against this collected PDF Sample. You may be surprised by the results!!
**If you enjoy this video, please consider Subscribing to our channel and share this to your community as well**
After this session, you will be able to do the following things by your own
-------------------------------------------------------------------------------------------------------------------------
1. Extract embedded content(pdf exif data, script, images, pdf streams) from PDFs.
2. Analyse hidden malicious Script to identify the IOCs.
3. Use Origami Framework
4. Get PDF Metadata. (You can use exiftool after you have extracted the contents)
Tool that you will be needing
-------------------------------------------------------------------------------------------------------------------------
1. Origami Framework- https://bit.ly/3gjbiL0
2. REMnux- https://remnux.org/
What's next in BlackPerl?
-------------------------------------------------------------------------------------------------------------------------
We will come up with a new tool for analyzing image files in forensic level. You won't need to bother about anything related to exif data, don't even need to get boarded by opening hex editor. The tool will do all the job for you. Please stay tuned!
We are socially active as well-
-----------------------------------------------------------------------------------------------------------------------
LinkedIn: / blackperl
Twitter: @blackperl_dfir
Insta: (blackperl_dfir) / blackperl_dfir
Can be reached via [email protected]
-------------------------------------------------------------------------------------------------------------------------
Thanks for Watching!! Be CyberAware!!
Be CyberAware!!
#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics #MalwareAnalysis #Malware #PDFAnalysis
~-~~-~~~-~~-~
Please watch: "The Next Big Event You Need to Prepare For"
• The Next Big Event You Need to Prepare For
~-~~-~~~-~~-~
On this page of the site you can watch the video online Quick PDF Analysis | Extract Embedded Data from PDF | Hidden Malicious Script with a duration of online in good quality, which was uploaded by the user BlackPerl 21 August 2020, share the link with friends and acquaintances, this video has already been watched 16,338 times on youtube and it was liked by 261 viewers. Enjoy your viewing!
