peepdf (@peepdf) profile picture

peepdf

@peepdf

peepdf is a Python tool to perform PDF analysis in order to find out if the explored files can be harmful or not.

peepdf.eternal-todo.com
Joined February 2012
  • Tweets307
  • Following0
  • Followers791
17Media
Photo by peepdf (@peepdf)Photo by peepdf (@peepdf)Photo by peepdf (@peepdf)Photo by peepdf (@peepdf)Photo by peepdf (@peepdf)Photo by peepdf (@peepdf)Photo by peepdf (@peepdf)Photo by peepdf (@peepdf)Photo by peepdf (@peepdf)
Fresh PDF (81fa2eb97128b6d711158f37698e044f) being used to drop docm file which downloads #Dridex Easy extraction with #peepdf ;) #malware
Image from peepdf (@peepdf)
2
51
2
61
It seems there are still PDF vulns to be exploited... @ESET discovered a #PDF uploaded to @virustotal containing two 0days, one for Adobe Reader (CVE-2018-4990) and a sandbox bypass (CVE-2018-8120) welivesecurity.com/2018/05/1… #vulnerabilities #infosec #apt #cybercrime
A tale of two zero-days

A tale of two zero-days

Double zero-day vulnerabilities fused into one. A mysterious sample enables attackers to execute arbitrary code with the highest privileges on intended targets

welivesecurity.com
8
1
8
Happy to see the @sekoia_fr guys using @peepdf in their new dropper analysis service (malware.sekoia.fr) presented at #Botconf 😊
Image from peepdf (@peepdf)
5
9
New tool added: peepdf (PDF analysis) by @peepdf #pdf #tools linuxsecurity.expert/tools/p…
Peepdf review (PDF analysis)

Peepdf review (PDF analysis)

peepdf is a tool to explore a PDF file in order to find out if the file can be harmful or not. It helps security researchers in simplifying the analysis of PDF

linuxsecurity.expert
1
2
More details about the #Dridex campaign (botnet 7200) using PDF documents as infection vector eternal-todo.com/blog/dridex… #malware #spam #peepdf nitter.gq/peepdf/status/85156300…
peepdf (@peepdf) profile picturepeepdf@peepdf10 Apr 2017
Fresh PDF (81fa2eb97128b6d711158f37698e044f) being used to drop docm file which downloads #Dridex Easy extraction with #peepdf ;) #malware
Image from peepdf (@peepdf)
3
4
Another #malware campaign spreading PDFs (85066792c8952100ac057055a2f49a8c) to ask the user to execute docm files. The docm was detected ;)
Image from peepdf (@peepdf)
10
14
Big thanks to Jose Miguel Esparza @peepdf @EternalTodo for interview, questions on his Kali Linux tools (Peepdf) buff.ly/2m6iame
Image from Cybersecurity Conferences (@infosec_events)
7
16
Detailed analysis of a heap buffer overflow in Adobe Acrobat and Reader (CVE-2016-4203) by @Fortinet blog.fortinet.com/2016/07/20… #infosec #PDF
3
7
Interesting post by @DidierStevens about reconstructing a PDF file parcially encrypted by ransomware blog.didierstevens.com/2016/… #DFIR #infosec
Recovering A Ransomed PDF

Recovering A Ransomed PDF

I was contacted to help with a PDF file encrypted by ransomware. Just like another case I helped with, the file was not completely encrypted. The file had parts with low entropy, as byte-stats.py s…

blog.didierstevens.com
13
20
Comprehensive vulnerability analysis of a Use-After-Free in Adobe Acrobat and Reader (CVE-2016-4119) by @Fortinet blog.fortinet.com/2016/06/06…
2
Replying to @michael_yip
@michael_yip @ProjectHoneynet @bartblaze @decalage2 Give it a try! ;) It is listed here, btw :) decalage.info/en/file_format…
1
2
1
Jose Esparza showing how to analyze a malicious PDF, extract shellcodes and automate analysis with Peepdf #HNW2016
Image from The Honeynet Project (@ProjectHoneynet)
1
17
19
Learning very useful techniques on analyzing PDFs. @EternalTodo
Image from 𝓓ᵉⓥ𝐎ⓝ ǤŕẸєŇ𝔢 🧐 (@DasMeDevon)
3
3
Just added a new parameter (-C) to execute commands via command line, update! ;) #security #infosec #DFIR #tools
Image from peepdf (@peepdf)
Image from peepdf (@peepdf)
6
7
Just one week for the PDF Analysis workshop with @peepdf at #HNW2016 in San Antonio sanantonio2016.honeynet.org/… sanantonio2016.honeynet.org/… #infosec

Trainings - The Honeynet Project Workshop 2016

sanantonio2016.honeynet.org
It is not in the master branch yet, but take a look at the @peepdf scoring system! ;) eternal-todo.com/blog/adding… #gsoc
Image from peepdf (@peepdf)
4
8
Still in beta but if you update #peepdf you can use "extract" to extract all URIs and Javascript code in a PDF file
Image from peepdf (@peepdf)
Image from peepdf (@peepdf)
3
39
56
Replying to @peepdf
@peepdf : A Python tool to explore PDFs to find out if they can be harmful or not. + github.com/jesparza/peepdf + eternal-todo.com/tools/peepd…
GitHub - jesparza/peepdf: Powerful Python tool to analyze PDF documents

GitHub - jesparza/peepdf: Powerful Python tool to analyze PDF documents

Powerful Python tool to analyze PDF documents. Contribute to jesparza/peepdf development by creating an account on GitHub.

github.com
1
10
14
The Honeynet Project is applying for Google Summer of Code 2016, more information on honeynet.org/gsoc #GSoC2016
28
16
Adding a scoring system to #peepdf honeynet.org/node/1304 #gsoc @EternalTodo
Image from The Honeynet Project (@ProjectHoneynet)
1
35
49
Load more