Skip to content

Instantly share code, notes, and snippets.

@minkione
Forked from averagesecurityguy/launch_url.txt
Created February 11, 2017 06:34
Show Gist options
  • Save minkione/16ffb3c6a71608acdb4584e6e75a34a5 to your computer and use it in GitHub Desktop.
Save minkione/16ffb3c6a71608acdb4584e6e75a34a5 to your computer and use it in GitHub Desktop.
"Malicious" PDF
%PDF-1.0
1 0 obj
<<
/Type /Catalog
/Pages 2 0 R
/Names 6 0 R
>>
endobj
2 0 obj
<<
/Type /Pages
/Count 1
/Kids [3 0 R]
>>
endobj
3 0 obj
<<
/Type /Page
/Parent 2 0 R
/Resources << /Font << /F1 5 0 R >>
>>
/MediaBox [0 0 612 792]
/Contents 4 0 R
>>
endobj
4 0 obj
<< /Length 45 >>
stream
BT
/F1 24 Tf
250 700 Td (Hello, World!) Tj
ET
endstream
endobj
5 0 obj
<<
/Type /Font
/Subtype /Type1
/BaseFont /Helvetica
>>
endobj
6 0 obj
<<
/JavaScript 7 0 R
>>
endobj
7 0 obj
<<
/Names [(My Code) 8 0 R]
>>
endobj
8 0 obj
<<
/JS (
app.alert("This document is encrypted, when prompted, please allow Adobe to connect to https://www.google.com to download the decryption key for this document.");
app.launchURL("https://www.google.com");
)
/S
/JavaScript
>>
endobj
xref
0 9
trailer
<<
/Size 9
/Root 1 0 R
>>
startxref
%%EOF
This is a modified version of the JavaScript embedded PDF documented here.
https://mariomalwareanalysis.blogspot.com/2012/02/how-to-embed-javascript-into-pdf.html
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment