Quick PDF Analysis | Extract Embedded Data from PDF | Hidden Malicious Script
LET'S DO SOME FORENSICS ANALYSIS ON PDF QUICKLY!!
-------------------------------------------------------------------------------------------------------------------------
In continuation of Malware Analysis and DFIR Tools & Techniques series, this episode covers another tool named Origami, that will help us extracting embedded content(scripts, images, attachments, metadata, pdf streams) from a PDF. This episode has also been compiled from a real life usecase. While doing Incident Response you identified, one of end-users machine is trying to communicate with command and control IP address. From initial feed on your End-Point Detection system you found there is something wrong on a PDF that came as attachment email to user. You grabbed that PDF Sample and start the investigation.
We will run the tool against this collected PDF Sample. You may be surprised by the results!!
**If you enjoy this video, please consider Subscribing to our channel and share this to your community as well**
After this session, you will be able to do the following things by your own
-------------------------------------------------------------------------------------------------------------------------
1. Extract embedded content(pdf exif data, script, images, pdf streams) from PDFs.
2. Analyse hidden malicious Script to identify the IOCs.
3. Use Origami Framework
4. Get PDF Metadata. (You can use exiftool after you have extracted the contents)
Tool that you will be needing
-------------------------------------------------------------------------------------------------------------------------
1. Origami Framework- https://bit.ly/3gjbiL0
2. REMnux- https://remnux.org/
What's next in BlackPerl?
-------------------------------------------------------------------------------------------------------------------------
We will come up with a new tool for analyzing image files in forensic level. You won't need to bother about anything related to exif data, don't even need to get boarded by opening hex editor. The tool will do all the job for you. Please stay tuned!
We are socially active as well-
-----------------------------------------------------------------------------------------------------------------------
LinkedIn: / blackperl
Twitter: @blackperl_dfir
Insta: (blackperl_dfir) / blackperl_dfir
Can be reached via [email protected]
-------------------------------------------------------------------------------------------------------------------------
Thanks for Watching!! Be CyberAware!!
Be CyberAware!!
#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics #MalwareAnalysis #Malware #PDFAnalysis
~-~~-~~~-~~-~
Please watch: "The Next Big Event You Need to Prepare For"
• The Next Big Event You Need to Prepare For
~-~~-~~~-~~-~
In questa pagina del sito puoi guardare il video online Quick PDF Analysis | Extract Embedded Data from PDF | Hidden Malicious Script della durata di online in buona qualità , che l'utente ha caricato BlackPerl 21 agosto 2020, condividi il link con amici e conoscenti, su youtube questo video è già stato visto 16,338 volte e gli è piaciuto 261 spettatori. Buona visione!
