Quick PDF Analysis | Extract Embedded Data from PDF | Hidden Malicious Script
LET'S DO SOME FORENSICS ANALYSIS ON PDF QUICKLY!!
-------------------------------------------------------------------------------------------------------------------------
In continuation of Malware Analysis and DFIR Tools & Techniques series, this episode covers another tool named Origami, that will help us extracting embedded content(scripts, images, attachments, metadata, pdf streams) from a PDF. This episode has also been compiled from a real life usecase. While doing Incident Response you identified, one of end-users machine is trying to communicate with command and control IP address. From initial feed on your End-Point Detection system you found there is something wrong on a PDF that came as attachment email to user. You grabbed that PDF Sample and start the investigation.
We will run the tool against this collected PDF Sample. You may be surprised by the results!!
**If you enjoy this video, please consider Subscribing to our channel and share this to your community as well**
After this session, you will be able to do the following things by your own
-------------------------------------------------------------------------------------------------------------------------
1. Extract embedded content(pdf exif data, script, images, pdf streams) from PDFs.
2. Analyse hidden malicious Script to identify the IOCs.
3. Use Origami Framework
4. Get PDF Metadata. (You can use exiftool after you have extracted the contents)
Tool that you will be needing
-------------------------------------------------------------------------------------------------------------------------
1. Origami Framework- https://bit.ly/3gjbiL0
2. REMnux- https://remnux.org/
What's next in BlackPerl?
-------------------------------------------------------------------------------------------------------------------------
We will come up with a new tool for analyzing image files in forensic level. You won't need to bother about anything related to exif data, don't even need to get boarded by opening hex editor. The tool will do all the job for you. Please stay tuned!
We are socially active as well-
-----------------------------------------------------------------------------------------------------------------------
LinkedIn: / blackperl
Twitter: @blackperl_dfir
Insta: (blackperl_dfir) / blackperl_dfir
Can be reached via [email protected]
-------------------------------------------------------------------------------------------------------------------------
Thanks for Watching!! Be CyberAware!!
Be CyberAware!!
#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics #MalwareAnalysis #Malware #PDFAnalysis
~-~~-~~~-~~-~
Please watch: "The Next Big Event You Need to Prepare For"
• The Next Big Event You Need to Prepare For
~-~~-~~~-~~-~
Sur cette page du site, vous pouvez voir la vidéo en ligne Quick PDF Analysis | Extract Embedded Data from PDF | Hidden Malicious Script durée online en bonne qualité , qui a été Téléchargé par l'utilisateur BlackPerl 21 août 2020, Partagez le lien avec vos amis et connaissances, sur youtube cette vidéo a déjà été regardée 16,338 fois et il a aimé 261 téléspectateurs. Bon visionnage!
