I have received a PDF document from a fake Paypal address. The PDF name is Paypal_EmailID_JK… To be sure whether the document is malicious or not I used the pdfid.py tool as in the screenshot below .
It is clear that there are 25 objects and 4 URLs in the document, /JS pointing to 0 meaning there is no javascript in this document. Also /OpenAction is 0 meaning there is no malicious action.But let use the pdfid.py with -e option for more information as in the figure below
We see the nothing apended After last %%EOF and the Total entropy.Finally I use
pdf-parser.py to extract those URLs as in the picture below
The PDF appears to be from Paypal but in fact will redirect the victim to the
https://www.hasanacademy.com/buy.php
Happy Hunting.
