Lion Cipher Lab
Analyze a suspicious PDF: JavaScript, actions, and embedded delivery tricks
- Digital Forensics & IR (DFIR)
- Intermediate
- ~40 min
- Free · no account required
Why it matters
A PDF looks like the most boring file on earth — a page you read. That is exactly why attackers love it: a PDF is not just paper, it is a small document format with an object graph that can carry JavaScript, auto-run actions, embedded files, and commands to launch other programs. Send one as an email attachment (MITRE ATT&CK Spearphishing Attachment, T1566.001), get the target to open it (User Execution: Malicious File, T1204.002), and the PDF's own scripting layer (JavaScript, T1059.007) fires the moment the reader opens the page — no second click. The defender's whole job is to answer…
What you'll learn
- reading a pdfid keyword summary and knowing which counts are red flags
- following /OpenAction -> /JavaScript as the auto-execution trigger
- recognizing /EmbeddedFile, /Launch and /URI as payload-delivery vectors
- deobfuscating PDF JavaScript at a concept level (unescape / eval / hex names)
- pulling URLs and embedded files out as IOCs without ever opening the PDF
- mapping PDF-delivery behavior to MITRE ATT&CK (T1566.001, T1204.002, T1059.007)
- judging when static PDF triage is conclusive vs when you must detonate
Steps in this lab
- A PDF is not paper — it is an object graph that can act
- The analyst's chair: you read the file, you never open it
- Read the pdfid keyword summary — which counts are red flags
- Follow /OpenAction to the JavaScript — the auto-run chain
- Open the JavaScript object and deobfuscate it (at a concept level)
- The payload vectors: /EmbeddedFile, /Launch, and /URI
- Metadata, and mapping the whole thing to MITRE ATT&CK
- The third rule: when static triage is conclusive, and when it isn't
- Write the verdict — and the habit it builds