Tools: pdfid.py and pdf-parser.py, QPDF and Poppler.
ISC diary entries: “Encrypted Sextortion PDFs”
Sample: 294592cd85ddf80ad1a092f955f1ae25
howto
nmap Service Detection Customization
Analysis of PDFs Created with OpenOffice/LibreOffice
Tools: pdfid.py, pdf-parser.py
ISC diary entry: Analysis of PDFs Created with OpenOffice/LibreOffice
Maldoc Analysis: Excel 4.0 Macro
Sample: 7df15be35bd8fd1a98adc24e6be7bfcd..
Tools: oledump.py
ISC Diary entry: Maldoc: Excel 4.0 Macro
Maldoc: Excel 4.0 Macro
Analyzing a Phishing PDF with /ObjStm
Sample: 55c336693e66b5d6a799b6b4f8eb5f1a.
Tools: pdfid.py, pdf-parser.py
Blog post: Analyzing a Phishing PDF with /ObjStm
