PDF Malware Analysis: From Static Triage to Threat Intelligence

Tools & References

Introduction

PDF files are widely used for sharing documents, reports, and business information. However, the PDF format also supports features such as JavaScript, embedded files, object streams, and automatic actions that can be abused by attackers.

In this lab, two PDF samples were analyzed using PDFiD, pdf-parser, peepdf, and a Threat Intelligence platform. The objective was to determine whether the samples contained malicious functionality and to understand how suspicious content could be hidden inside the PDF structure.

The investigation followed a layered approach:

PDF Sample ↓ Initial Static Triage ↓ PDFiD ↓ pdf-parser ↓ peepdf ↓ JavaScript / Payload Analysis ↓ Threat Intelligence ↓ TTP & Final Assessment

1. Lab Environment and Tools

The analysis was performed in a Linux environment with Python 2 and the following tools:

· peepdf

· PDFiD

· pdf-parser

The lab instructions included the installation and execution commands for these tools.

2. Obtaining the Samples

Two PDF samples were selected for analysis using their SHA-256 identifiers.

Sample 1: cd9421c332a2b90b26152f0e85a7db621306cd1daa70f30af3210895d2aeb577

Sample 2: 5eaa1f5305f4c25292dff29257cd3e14ba3f956f6f8ddb206c0ee3e09af8244e

The samples were obtained from MalwareBazaar and extracted inside the analysis environment. The original lab specifies the infected archive password as: infected.

Sample 1: MalwareBazaar sample page

Sample 2: MalwareBazaar sample page

3. Sample One — PDFiD Initial Triage

The first sample was:

cd9421c332a2b90b26152f0e85a7db621306cd1daa70f30af3210895d2aeb577.pdf

PDFiD was used as the first analysis stage. PDFiD is designed for fast static triage and searches the PDF structure for keywords commonly associated with malicious documents, including /JS, /JavaScript, /OpenAction, /AA, /EmbeddedFile, /Launch, /XFA, /RichMedia, encryption, and object streams.

The results indicated JavaScript-related functionality and other structures that required deeper inspection. The investigation therefore moved to pdf-parser.

4. Deep Structural Analysis with pdf-parser

pdf-parser was used to inspect the internal objects and streams of the document. Unlike PDFiD, which provides quick keyword-based triage, pdf-parser allows inspection of individual PDF objects, streams, fonts, embedded content, and JavaScript.

The analysis identified multiple PDF objects, compressed streams, embedded files, JavaScript, metadata, /EmbeddedFiles, /JavaScript, and /JS. One embedded file named aaa was also identified.

5. Locating the JavaScript

The next step was to search specifically for JavaScript within the PDF. The investigation revealed that the PDF contained embedded JavaScript. Object 50 acted as a reference to Object 51, while the actual JavaScript content was stored in Object 52 as a compressed FlateDecode stream.

6. Extracting the Payload

After extracting Object 52 and decompressing the FlateDecode stream, the JavaScript was examined. The script contained a Base64-encoded payload stored inside a variable. The payload was extracted and decoded into a new file named stage2.bin.

The resulting file initially appeared to be ASCII text with extremely long lines and no line breaks. Inspection of the beginning of stage2.bin revealed hexadecimal values and byte-array representations, indicating an intermediate Stage 2 payload rather than normal text.

7. PE Reconstruction and In-Memory Loading

The final part of the extracted JavaScript contained large arrays (m, m1, fh, ba), variables holding target file names (dN, fN), and functions for reconstructing a PE file in memory (FA(), G(), GFA()), including locating PE headers and the IAT. The code also interacted with XML/DataObjects through this.addField and this.createDataObject and used setTimeout() to periodically execute functions.

This confirmed that stage2.bin contained a dynamic loader that reconstructs an executable directly in memory using data stored in arrays, preparing the final payload for execution. This technique can reduce the need for an obvious executable file to be written to disk.

8. peepdf Analysis — Sample One

The first sample was analyzed with peepdf to obtain file metadata, hashes, document structure, and suspicious objects.

PDF Version: 1.4 File Size: 509,814 bytes Encrypted: No Linearized: No Binary Content: Yes

MD5: 6d6399e5e98164e365029a9b141e1646 SHA1: 64f8b386000ed34f7b9f22a8144328d0e61ed31c SHA256: cd9421c332a2b90b26152f0e85a7db621306cd1daa70f30af3210895d2aeb577

9. Incremental Updates and Suspicious Objects

peepdf identified 56 total objects, 21 streams, 18 encoded streams, and one incremental update. Version 0 contained 46 objects and 18 encoded streams and appeared to represent the original document structure. Version 1 added 10 objects and 3 streams, with Object 52 containing JavaScript. This indicates that the malicious logic was introduced through the incremental update.

Suspicious elements included /Names entries in Objects 19, 49, and 50; /JavaScript in Objects 48 and 51; /JS in Object 51; and /EmbeddedFiles in Object 48.

10. Sample One — Final Assessment

The combined findings indicated a maliciously crafted PDF containing embedded JavaScript and embedded content, with malicious logic introduced through an incremental update. The extracted Stage 2 payload contained a dynamic loader capable of reconstructing a PE payload in memory.

Malicious PDF ↓ Embedded JavaScript ↓ Compressed Stream ↓ Base64 Payload ↓ stage2.bin ↓ Obfuscated JavaScript ↓ PE Reconstruction ↓ In-Memory Payload

11. Sample Two — PDFiD Initial Triage

The second sample was:

5eaa1f5305f4c25292dff29257cd3e14ba3f956f6f8ddb206c0ee3e09af8244e.pdf

Unlike the first sample, the initial PDFiD analysis did not identify JavaScript or automatic execution indicators.

The observed values included /JS = 0, /JavaScript = 0, /OpenAction = 0, /AA = 0, /EmbeddedFile = 0, /Launch = 0, /XFA = 0, and /RichMedia = 0. This significantly reduced the likelihood of a JavaScript-based exploit delivery mechanism.

12. pdf-parser Analysis — Sample Two

pdf-parser was then used for deeper structural analysis of Sample Two.

The analysis identified a linearized PDF, XRef streams, compressed object streams, /Catalog, /Pages, a single /Page, multiple /XObject /Image objects, embedded fonts, and XML metadata. No /JavaScript, /JS, /OpenAction, or /AA objects were identified, and no embedded executables or suspicious payload structures were found.

13. Threat Intelligence Analysis — Sample Two

Threat Intelligence was used as an additional layer of analysis and correlation rather than relying solely on local static tools.

14. peepdf Analysis — Sample Two

peepdf identified the following file information:

File Size: 31,276 bytes PDF Version: 1.6 Linearized: Yes Encrypted: No Binary Content: Yes

MD5: 2c182c48da297dcee3c7cafab4e46161 SHA1: d031305516b4791ec52a2bd03450d185c16e8dd0 SHA256: 5eaa1f5305f4c25292dff29257cd3e14ba3f956f6f8ddb206c0ee3e09af8244e

The PDF contained an incremental update, but the updated content did not contain JavaScript, embedded files, or automatic execution mechanisms. The streams, object streams, XObjects, images, fonts, and metadata were consistent with normal PDF functionality. A single URI was identified in Object 62, but no scripting was associated with it.

15. Final Triage and TTP Analysis

After completing the static analysis and Threat Intelligence review, the investigation moved toward final triage and TTP identification.

For Sample Two, the analysis concluded: Benign PDF — No evidence of malicious activity detected. The recommendation in the source analysis was that no containment or mitigation was needed based on the evidence available from the static investigation.

Conclusion

This investigation demonstrated why PDF malware analysis should be performed in multiple stages. The first sample initially appeared to be a PDF document, but deeper inspection uncovered a complex structure involving an incremental update, embedded JavaScript, Object 52, a Base64 payload, stage2.bin, obfuscated loader code, and PE reconstruction in memory.

The second sample provided an important contrast. Although it contained normal PDF complexity, compressed streams, object streams, and an incremental update, the analysis did not identify JavaScript, embedded payloads, or automatic execution mechanisms.

The main lesson is that one suspicious indicator should not determine the verdict. A proper malware-analysis workflow combines initial static triage, PDF object analysis, JavaScript extraction, payload analysis, structural analysis, hash-based Threat Intelligence, triage, and TTP analysis.

Key Indicators and Techniques

· JavaScript embedding

· Base64 encoding

· Payload obfuscation

· Compressed streams

· Incremental updates

· PE reconstruction

· In-memory loading

· Threat Intelligence

· Triage

· TTP analysis

Contents