Lion Cipher Lab

Triage a suspicious PDF safely with pdfid and pdf-parser

• Digital Forensics & IR (DFIR)
• Intermediate
• ~50 min
• Free · no account required

Why it matters

A PDF arrives as an email attachment and someone has to decide, fast, whether to open it. A PDF is not paper: it is an object graph that can carry an /OpenAction that runs /JavaScript the instant the file opens, a /Launch that starts a program, or an /EmbeddedFile it drops to disk. RFC 8118, the document that defines the application/pdf media type, warns in its security section that PDF supports JavaScript, launch actions and embedded files and that these are a route to malicious behaviour. The wrong move is to open the file to see what it does, because opening it is exactly what the attacker…

What you'll learn

• explaining why a PDF is executable surface: /OpenAction and /AA auto-run entries, /JavaScript or /JS, /Launch and /EmbeddedFile can all fire when the file is opened, before a human reads a word
• triaging a document statically, on disk, without ever rendering it in a reader (the single habit that keeps an analyst from detonating the thing they are trying to judge)
• running pdfid to count the structural keywords and reading the summary as a reason-to-look, not a verdict: a clean control shows /JS 0 /OpenAction 0, the demonstrator shows /JS 1 /JavaScript 1 /OpenAction 1
• walking the object graph with pdf-parser: follow /OpenAction from the catalog to the action object, follow its /JS reference to the stream, and DUMP the script text so you read the payload instead of executing it
• recognising obfuscation: a FlateDecode-compressed JavaScript stream that a naive strings/grep search misses (0 hits on the payload body) while pdfid still flags /JS 1, and recovering it with pdf-parser --filter
• knowing the honest limits (pdfid counts, it does not decide; legit forms carry /JS and /AA; name-splitting and nested filters can hide keywords from a naive reader) and the pro flow: pdfid to triage, pdf-parser to read, a sandbox only if static is inconclusive

Steps in this lab

1. Why a PDF can act before you have read a word
2. The defender's chair: triage on disk, never open the file
3. Get the two tools (free, standalone Python scripts)
4. Build your own demonstrator PDF and a clean control
5. Count the keywords with pdfid (clean vs demonstrator)
6. Follow /OpenAction with pdf-parser and READ the script
7. The obfuscation: a FlateDecode stream a naive search misses
8. The honest negatives: a count is not a verdict
9. The pro flow: when to reach for this, and what comes next

Open the full interactive lab →