Investigate PDF files¶

There are a couple of tools available in dfirws to investigate PDF files. Some of them are:

• pdf-parser.py
• pdfalyzer
• pdfid.py
• PDFStreamDumper
• peepdf-3 (virtualenv name peepdf3)

There is a Jupyter Notebook available to analyse PDF files.

Resources¶

• You can see this local PDF of the article How to Analyze Malicious PDF Files by Intezer.
• DFIR PDF analysis by neolea
• PDF Object Streams