Skip to content

Additional improvements to PDFInfo service#103

Open
wootski wants to merge 10 commits intocrits:masterfrom
wootski:pdfinfo
Open

Additional improvements to PDFInfo service#103
wootski wants to merge 10 commits intocrits:masterfrom
wootski:pdfinfo

Conversation

@wootski
Copy link
Contributor

@wootski wootski commented Apr 2, 2015

This pull request includes a number of proposed changes from pull request #94.

Key features:

  • PDFid output is now sorted by item count.
  • Improvements to the detection of files being stored within PDF streams.
  • Addition of JavaScript helper functions.
  • Identify embedded PDF documents i.e. PDF documents that are concatenated together.
  • PDF Detection techniques:
    • Use of PDFid results to identify interesting details: pdf encryption, javascript etc.
    • Identify features in JavaScript content using string matching.

Comments:

  • JavaScript detection strings were developed from the analysis of all PDF samples available on ContagioDump.

wootski added 10 commits March 27, 2015 11:55
- Added imports for adding child objects
- re-order existing imports to look nicer
- Prompt user to submit suspicious PDF child objects.
- Testing code included for submitting child objects of interest
- Improvements to identifying object content type.
- Items now sorted by count.
- Notify user of JavaScript, encryption and open actions
- Look for uneven counts of obj and endobj
- JS minimization
- JS formatting using the jsbeautifier library
- PEP8 changes
- Locate embedded PDF documents
- Detect PDF strings of interest
- Submit child files based on JS/file header detection
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant