Origami €? Parse, Analyze Forge PDF Documents
Ara Scholze
origami is a Ruby framework designed to parse, analyze, and forge PDFdocuments. This is NOT a PDF rendering library. It aims at providing ascripting tool to generate and analyze malicious PDF files. As well,it can be used to create on-the-fly customized PDFs, or to inject(evil) code into already existing documents.
python-oletools is a package of python tools to analyze Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on my olefile parser.
As I already announced in the last blog post, I was in Las Vegas giving a workshop about how to analyze exploit kits and PDF documents at BlackHat. The part related to exploit kits included some tips to analyze obfuscated Javascript code manually and obtain the exploit URLs or/and shellcodes. The tools needed to accomplish this task were just a text editor, a Javascript engine like Spidermonkey, Rhino or PyV8, and some tool to beautify the code (like peepdf ;p). In a generic way, we can say that the steps to analyze an exploit kit page are the following: