# PDF Malware Reference

## PDF Structure Overview

PDF files consist of:
1. **Header**: `%PDF-1.x`
2. **Body**: Objects (dictionaries, streams, arrays)
3. **Cross-reference table**: Object locations
4. **Trailer**: Points to root object and xref table

## Attack Vectors

### JavaScript Execution
PDF supports JavaScript via Adobe's Acrobat JavaScript API.

**Trigger mechanisms:**
- `/OpenAction` — Executes when PDF is opened
- `/AA` (Additional Actions) — Various event triggers
- `/AcroForm` with `/XFA` — Form-based script execution

**Common exploit patterns:**
```javascript
// Heap spray
var shellcode = unescape("%u9090%u9090...");
var block = unescape("%u0c0c%u0c0c");
while (block.length < 0x100000) block += block;
// Trigger vulnerability...
```

### Embedded Files
Files attached within the PDF via `/EmbeddedFile` streams.

- Executables disguised with document icons
- Script files (.js, .vbs, .ps1)
- Other malicious documents

### Launch Actions
`/Launch` action can execute external programs.

```
/Launch /Win << /F (cmd.exe) /P (/c calc.exe) >>
```

### URI Actions
Links to malicious websites for drive-by downloads.

## Notable PDF CVEs

| CVE | Description | Exploitation |
|-----|-------------|-------------|
| CVE-2010-1297 | Adobe Flash Player in PDF | Embedded SWF |
| CVE-2013-0640 | Remote code execution | Crafted PDF |
| CVE-2017-3010 | XSLT processing | Malformed XML |
| CVE-2023-21608 | Use-after-free | Crafted PDF |

## Analysis Tools

| Tool | Purpose |
|------|---------|
| **pdfid** | Identify suspicious keywords |
| **pdf-parser** | Parse PDF structure |
| **peepdf** | Interactive PDF analysis |
| **QPDF** | PDF transformation and inspection |
| **pdftotext** | Extract text content |
| **PDFStreamDumper** | GUI-based PDF analysis |

## Detection Indicators

- Multiple `/OpenAction` or `/AA` entries
- JavaScript with `unescape()` or `eval()`
- Embedded files within PDF
- `/Launch` actions
- Highly encoded/compressed streams
- Malformed xref tables or trailer
- PDF version mismatches