Studying malicious PDFs

The Portable Document Format (PDF) was developed by Adobe in the 90s for presenting documents in a uniform way, regardless of the application software or operating system used. Originally proprietary, it was released as an open standard in 2008. Unfortunately, due to its popularity, multiple attackers misuse it to deliver their malicious payloads. Let's see how they actually work and how they can be analyzed.

File structure

A PDF is a tree file that consists of objects that implement one of eight data types:

• Null object.
• Boolean values.
• Numbers.
• Names: These values can be recognized by a forward slash at the beginning.
• Strings: Surrounded by double parentheses.
• Arrays: Enclosed within square brackets.
...