LET'S DO SOME FORENSICS ANALYSIS ON PDF QUICKLY!!
-------------------------------------------------------------------------------------------------------------------------
In continuation of Malware Analysis and DFIR Tools & Techniques series, this episode covers another tool named Origami, that will help us extracting embedded content(scripts, images, attachments, metadata, pdf streams) from a PDF. This episode has also been compiled from a real life usecase. While doing Incident Response you identified, one of end-users machine is trying to communicate with command and control IP address. From initial feed on your End-Point Detection system you found there is something wrong on a PDF that came as attachment email to user. You grabbed that PDF Sample and start the investigation.
We will run the tool against this collected PDF Sample. You may be surprised by the results!!
***If you enjoy this video, please consider Subscribing to our channel and share this to your community as well***
After this session, you will be able to do the following things by your own
-------------------------------------------------------------------------------------------------------------------------
1. Extract embedded content(pdf exif data, script, images, pdf streams) from PDFs.
2. Analyse hidden malicious Script to identify the IOCs.
3. Use Origami Framework
4. Get PDF Metadata. (You can use exiftool after you have extracted the contents)
Tool that you will be needing
-------------------------------------------------------------------------------------------------------------------------
1. Origami Framework- [ Ссылка ]
2. REMnux- [ Ссылка ]
What's next in BlackPerl?
-------------------------------------------------------------------------------------------------------------------------
We will come up with a new tool for analyzing image files in forensic level. You won't need to bother about anything related to exif data, don't even need to get boarded by opening hex editor. The tool will do all the job for you. Please stay tuned!
We are socially active as well-
-----------------------------------------------------------------------------------------------------------------------
LinkedIn: [ Ссылка ]
Twitter: @blackperl_dfir
Insta: (blackperl_dfir)[ Ссылка ]
Can be reached via blackperl_dfir@yahoo.com
-------------------------------------------------------------------------------------------------------------------------
Thanks for Watching!! Be CyberAware!!
Be CyberAware!!
#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics #MalwareAnalysis #Malware #PDFAnalysis
-~-~~-~~~-~~-~-
Please watch: "The Next Big Event You Need to Prepare For"
[ Ссылка ]
-~-~~-~~~-~~-~-
