pdfalyzer 1.16.3__py3-none-any.whl → 1.16.5__py3-none-any.whl

CHANGELOG.md

@@ -1,5 +1,11 @@
 # NEXT RELEASE
 
+### 1.16.5
+* Add YARA rule for GIFTEDCROOK infostealer PDFs
+
+### 1.16.4
+* Bump `PyPDF` to 5.7.0
+
 ### 1.16.3
 * Fix typo in help
 

pdfalyzer/yara_rules/PDF.yara

@@ -26,7 +26,6 @@ rule Cobaltgang_PDF_Metadata_Rev_A
         author = "Palo Alto Networks Unit 42"
         date = "2018-10-25"
         reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
-
    strings:
         $ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide
    condition:
@@ -293,7 +292,6 @@ rule suspicious_embed : PDF
 		version = "0.1"
 		ref = "https://feliam.wordpress.com/2010/01/13/generic-pdf-exploit-hider-embedpdf-py-and-goodbye-av-detection-012010/"
 		weight = 2
-
 	strings:
 		$magic = { 25 50 44 46 }
 
@@ -330,7 +328,6 @@ rule invalid_XObject_js : PDF
 		ref = "https://blogs.adobe.com/ReferenceXObjects/"
 		version = "0.1"
 		weight = 2
-
 	strings:
 		$magic = { 25 50 44 46 }
 		$ver = /%PDF-1\.[4-9]/
@@ -526,7 +523,6 @@ rule blackhole2_pdf : EK PDF{
         yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
         weight = 6
         tag = "attack.initial"
-
     strings:
         $string0 = "/StructTreeRoot 5 0 R/Type/Catalog>>"
         $string1 = "0000036095 00000 n"
@@ -558,7 +554,6 @@ rule XDP_embedded_PDF : PDF
 		version = "0.1"
 		ref = "http://blog.9bplus.com/av-bypass-for-malicious-pdfs-using-xdp"
         weight = 1
-
 	strings:
 		$s1 = "<pdf xmlns="
 		$s2 = "<chunk>"
@@ -1073,3 +1068,17 @@ rule QakbotPDF {
     condition:
         $url
 }
+
+
+rule GIFTEDCROOK {
+    meta:
+        date = "2025-06-29"
+        description = "Find GIFTEDCROOK PDFs"
+        hash = "1974709f9af31380f055f86040ef90c71c68ceb2e14825509babf902b50a1a4b"
+        reference = "https://arcticwolf.com/resources/blog/giftedcrook-strategic-pivot-from-browser-stealer-to-data-exfiltration-platform/"
+    strings:
+        $str0 = "https://mega.nz/file"
+    condition:
+        uint32(0) == 0x25504446 and
+        all of them
+}

{pdfalyzer-1.16.3.dist-info → pdfalyzer-1.16.5.dist-info}/METADATA

@@ -1,10 +1,10 @@
 Metadata-Version: 2.1
 Name: pdfalyzer
-Version: 1.16.3
+Version: 1.16.5
 Summary: A PDF analysis toolkit. Scan a PDF with relevant YARA rules, visualize its inner tree-like data structure in living color (lots of colors), force decodes of suspicious font binaries, and more.
 Home-page: https://github.com/michelcrypt4d4mus/pdfalyzer
 License: GPL-3.0-or-later
-Keywords: ascii art,binary,color,font,encoding,malicious pdf,malware,malware analysis,pdf,threat assessment,visualization,yara
+Keywords: ascii art,binary,color,font,encoding,maldoc,malicious pdf,malware,malware analysis,pdf,pdfs,pdf analysis,threat assessment,visualization,yara
 Author: Michel de Cryptadamus
 Author-email: michel@cryptadamus.com
 Requires-Python: >=3.9,<4.0
@@ -271,6 +271,8 @@ scripts/install_t1utils.sh
 * [A Curious Exploration of Malicious PDF Documents](https://www.scitepress.org/Papers/2020/89923/89923.pdf) by Julian Lindenhofer, Rene Offenthaler and Martin Pirker, 2020. Overview of all the possible execution paths that can lead to a PDF executing JavaScript, opening loca/remote files, or making web requests.
 * [Malicious PDF Generator](https://github.com/jonaslejon/malicious-pdf) is a well maintained GitHub project that does what it says on the tin.
 * [PDF is Broken, and so is this file](https://blog.trailofbits.com/2021/02/02/pdf-is-broken-a-justctf-challenge/) is a 2021 report on what happens when you challenge cybersecurity teams to turn PDFs into weapons. (Among other things they managed to create a PDF that launches a webserver when you open it.)
+* [linuxPDF](https://github.com/ading2210/linuxpdf) is a project that managed to embed an entire linux operating system inside a PDF document. The related [DoomPDF](https://github.com/ading2210/doompdf) managed to embed the classic video game Doom in a PDF.
+* [horrifying-pdf-experiments](https://github.com/osnr/horrifying-pdf-experiments) is a repo of horrifying things you can do with PDFs.
 
 
 ## Did The World Really Need Another PDF Tool?

{pdfalyzer-1.16.3.dist-info → pdfalyzer-1.16.5.dist-info}/RECORD

@@ -1,4 +1,4 @@
-CHANGELOG.md,sha256=ocHLB5eVKbwPuywuN8Db56bEgo3U8hqBKDN3tHBlsVU,11856
+CHANGELOG.md,sha256=XA_LQ-cJ5RnKVbcXLvgSQZyn5KMUKUSez7UWPcdLG8s,11953
 LICENSE,sha256=OXLcl0T2SZ8Pmy2_dmlvKuetivmyPd5m1q-Gyd-zaYY,35149
 pdfalyzer/__init__.py,sha256=q8qSdGdyUYmTYGOp_d2bRCCFASnlVt4wa-DlBikD5-M,5362
 pdfalyzer/__main__.py,sha256=Ko_AoAyYMLIe_cmhiUSl6twheLZrGyT8aOSJ2CP7EZY,43
@@ -36,12 +36,12 @@ pdfalyzer/util/argument_parser.py,sha256=hC0CLZPIXerP9Z0WZYE4Vj8wEPLwo3KpA-iRio6
 pdfalyzer/util/debugging.py,sha256=nE64VUQbdu2OQRC8w8-AJkMtBOy8Kf3mjozuFslfWsw,156
 pdfalyzer/util/exceptions.py,sha256=XLFFTdx1n6i_VCmvuzvIOCa-djJvGEitfo9lhy3zq0k,98
 pdfalyzer/util/pdf_parser_manager.py,sha256=FVRYAYsCd0y5MAm--qvXnwCZnDtB3x85FdJtb-gpyw4,3109
-pdfalyzer/yara_rules/PDF.yara,sha256=ht4J7auMYwzGXD5c0E9fTq7MFo0ep375lva3E2XCsl8,39670
+pdfalyzer/yara_rules/PDF.yara,sha256=b2Bk2x6aIpbO3KiFqAA38VVbbsXgEWdWaC1fr9kRhDI,40126
 pdfalyzer/yara_rules/PDF_binary_stream.yara,sha256=oWRPLe5yQiRFMvi3BTHNTlB6T7NcAuxKn0C9OSvgJSM,804
 pdfalyzer/yara_rules/__init.py__,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 pdfalyzer/yara_rules/lprat.static_file_analysis.yara,sha256=i0CwRH8pBx_QshKFTQtr1CP5n378EZelsF2FxMY2y5A,21859
-pdfalyzer-1.16.3.dist-info/LICENSE,sha256=OXLcl0T2SZ8Pmy2_dmlvKuetivmyPd5m1q-Gyd-zaYY,35149
-pdfalyzer-1.16.3.dist-info/METADATA,sha256=JdN4R0Z9QFcjFJnmNZ2xDoqJqmRPXqljmRC3xFpCzMw,25812
-pdfalyzer-1.16.3.dist-info/WHEEL,sha256=d2fvjOD7sXsVzChCqf0Ty0JbHKBaLYwDbGQDwQTnJ50,88
-pdfalyzer-1.16.3.dist-info/entry_points.txt,sha256=aZurgt-Xg3pojS7oTRI4hNLpK1hO4kTfChf0x2eQoD8,147
-pdfalyzer-1.16.3.dist-info/RECORD,,
+pdfalyzer-1.16.5.dist-info/LICENSE,sha256=OXLcl0T2SZ8Pmy2_dmlvKuetivmyPd5m1q-Gyd-zaYY,35149
+pdfalyzer-1.16.5.dist-info/METADATA,sha256=b73ndsRbnTaRQAK-ih5uSFujKe2ILhmHOinyBSj3igk,26231
+pdfalyzer-1.16.5.dist-info/WHEEL,sha256=d2fvjOD7sXsVzChCqf0Ty0JbHKBaLYwDbGQDwQTnJ50,88
+pdfalyzer-1.16.5.dist-info/entry_points.txt,sha256=aZurgt-Xg3pojS7oTRI4hNLpK1hO4kTfChf0x2eQoD8,147
+pdfalyzer-1.16.5.dist-info/RECORD,,