Didier Stevens

Anyone worth their grain of salt would download and analyze in a vm before executing on their own personal machine... I know I would. Didier Stevens[0] has a ton of tools for static analysis of these file types. [0] https://blog.didierstevens.com/

You have to essentially render the document yourself in order to figure out what the order of chunks is. Then you might be able to extract content from the chunks you're interested in - or not. A given zipped chunk might be literally anything. Didier Stevens is the best expert of PDFs that I know of: https://blog.didierstevens.com/programs/pdf-tools/

I'd never use the words PDF and goodness in the same sentence. I doubt Didier Stevens (http://blog.didierstevens.com/) would either. Don't get me wrong, I like Chrome (in fact I'm using it now) but it's a browser. I don't want a document viewer, I just want to surf the Internet.

The PDF specification is wild. My current favourite trivia is that it supports all of Photoshop's layer blend modes for rendering overlapping elements.[1] My second-favourite is that it supports appended content that modifies earlier content, so one should always look for forensic evidence in all distinct versions represented in a given file.[2] It's also a fun example of the futility of DRM. The spec includes password-based encryption, and allows for different "owner" and "user" passwords. There's a bitfield with options for things like "prevent printing", "prevent copying text", and so forth,[3] but because reading the document necessarily involves decrypting it, one can use the "user" password to open an encrypted PDF in a non-compliant tool,[4] then save the unencrypted version to get an editable equivalent. [1] "More than just transparency" section of https://blog.adobe.com/en/publish/2022/01/31/20-years-of-transparency-… [2] https://blog.didierstevens.com/2008/05/07/solving-a-little-pdf-puzzle/ [3] Page 61 of https://opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandards/PDF32000… [4] For example, a script that uses the pypdf library.

I though Swiss Army knife for PDF are Didier Stevens PDF tools: https://blog.didierstevens.com/programs/pdf-tools/

svchost.exe is literally what the name implies. It's a generic service host. You pass it a dll and an entrypoint (via command line arguments and registry keys) and it runs it. You should look at which thing it's actually running to see what's using all your CPU. Some articles detailing what it does and how it works: [1] https://nasbench.medium.com/demystifying-the-svchost-exe-process-and-i… [2] https://pusha.be/index.php/2020/05/07/exploration-of-svchost-exe-p-fla… [3] https://blog.didierstevens.com/2019/10/29/quickpost-running-a-service-…

For analysis, I’ve used Didier’s tools. If you just want a safe way to open it, upload it to a cloud storage provider which destructively renders the pdf. Box or Google drive should work. https://blog.didierstevens.com/programs/pdf-tools/

PDF is also a minefield, for how many ways there are to mess with the format: https://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/

Alternatively it's also possible to disable ASLR in the executable itself by removing the flag 0x40 (opt-in flag for ASLR) in the DllCharacteristics field of the header. There's a neat little tool called SetDllCharacteristics[0] which can do that. [0] https://blog.didierstevens.com/2010/10/17/setdllcharacteristics/

Thank you for your input. I forgot the mention in the original post that there is a tool called pdf-parser.py [1] which claims to be able to do that but it produces a broken output. I don’t know anything about Python or PDF internals to hack on it. Posting it here and hoping that the HN crowds could point me in the correct direction. [1]: https://blog.didierstevens.com/programs/pdf-tools/

No, but depending on what program you open it with it may be able to do far worse than execute javascript in a browser sandbox. [0][1] [0]: https://blog.didierstevens.com/2010/03/29/escape-from-pdf/ [1]: https://thestack.com/security/2016/06/09/pdf-exploit-found-in-default-…

More information on analysis of PDF malware: http://blog.didierstevens.com/programs/pdf-tools/ PDF malware can be used for economic espionage targeting commercial research. What would help is a single open registry which has: bibliographic metadata + hash of known-good PDF for each paper.

As one of the comments there mention, the Origin client is only enumerating the list of recently run applications. The app name in that list is ROT13-"encrypted" by explorer.exe for some odd reason; see: http://blog.didierstevens.com/2006/07/24/rot13-is-used-in-windows-you%…

TLDR: X.509 certificate collision attack where the uptime of the signing server appears to have been guessed successfully to an accuracy of 1 millisecond (!) Some further technical details: Dump of the full certificate chain: http://blog.didierstevens.com/2012/06/06/flame-authenticode-dumps-kb27… Technical analysis and information about the certificate from Microsoft (MSRC): https://blogs.technet.com/b/srd/archive/2012/06/06/more-information-ab… Discussion on the [email protected] mailing list: http://www.mail-archive.com/[email protected]/msg02916.html

Foxit has had some pretty blatant security vulnerabilities -- straight up unprompted local code execution: http://blog.didierstevens.com/2010/03/29/escape-from-pdf/ It does a mediocre job of rendering, and isn't faster than Acrobat if you strip out all of Adobe's lame plugins (we put plugins in your plugins so you can extend while you embrace!)

But given a sufficiently complex code, you can execute from unexpected places. Sometimes even without any bugs involved: http://blog.didierstevens.com/2010/03/29/escape-from-pdf/

This tool is based on the old (and deprecated) Software Restriction Policy (SRP) API. I see some posters here stating that AppLocker and SRP are the same thing. Their goal is the same, but they're implemented completely differently. SRP is enforced in user mode, and it can be circumvented by hooking user mode API calls. Back in 2005 Mark Russinovich blogged about bypassing SRP: https://web.archive.org/web/20061219234012/http://blogs.technet.com/ma… AppLocker does the enforcement in kernel-mode, so it can't be bypassed with DLL injection. (The kernel side could be patched by a user with local Administrator rights, but that runs afoul of Kernel Patch Protection and raises the bar significantly for an attacker. Users should be using unprivileged accounts for day-to-day work anyway... >grumble<) SRP in whitelist mode is more difficult to bypass, but it's still possible to patch it out by using WriteProcessMemory: https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-srp-with-dll… I'm not suggesting that this tool isn't useful, but it's not the same thing as AppLocker or Windows Defender Application Control. If SRP ends up being used significantly as a defense attackers will just incorporate bypassing it into their payloads / strategies (start out w/ getting the user to run a Word macro that patches Word's copy of ADVAPI32.DLL, etc).

This should do: > In the first demo, I just select the PDF document with one click. This is enough to exploit the vulnerability, because the PDF document is implicitly read to gather extra information. > In the second demo, I change the view to Thumbnails view. In a thumbnail view, the first page of a PDF document is rendered to be displayed in a thumbnail. Rendering the first page implies reading the PDF document, and hence triggering the vulnerability. > In the third demo, I use my special PDF document with the malformed stream object in the metadata. When I hover with the mouse cursor over the document (I don’t click), a tooltip will appear with the file properties and metadata. But with my specially crafted PDF document, the vulnerability is triggered because the metadata is read to display the tooltip… https://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigge…

What is the MIME type of a .tar file; and what are the MIME types of the constituent concatenated files within an archive format like e.g. tar? hachoir/subfile/main.py: https://github.com/vstinner/hachoir/blob/main/hachoir/subfile/main.py File signature: https://en.wikipedia.org/wiki/File_signature PhotoRec: https://en.wikipedia.org/wiki/PhotoRec "File Format Gallery for Kaitai Struct"; 185+ binary file format specifications: https://formats.kaitai.io/ Table of ': https://formats.kaitai.io/xref.html AntiVirus software > Identification methods > Signature-based detection, Heuristics, and ML/AI data mining: https://en.wikipedia.org/wiki/Antivirus_software#Identification_method… Executable compression; packer/loader: https://en.wikipedia.org/wiki/Executable_compression Shellcode database > MSF: https://en.wikipedia.org/wiki/Shellcode_database sigtool.c: https://github.com/Cisco-Talos/clamav/blob/main/sigtool/sigtool.c clamav sigtool: https://www.google.com/search?q=clamav+sigtool https://blog.didierstevens.com/2017/07/14/clamav-sigtool-decode-sigs/ : sigtool –-find-sigs "$name" | sigtool –-decode-sigs List of file signatures: https://en.wikipedia.org/wiki/List_of_file_signatures And then also clusterfuzz/oss-fuzz scans .txt source files with (sandboxed) Static and Dynamic Analysis tools, and `debsums`/`rpm -Va` verify that files on disk have the same (GPG signed) checksums as the package they are supposed to have been installed from, and a file-based…