Documentation
¶
Overview ¶
Package pdfscan triages a PDF for malicious active content — the in-tree analogue of Didier Stevens' pdfid.
A weaponised PDF is a top phishing payload: an /OpenAction or /AA that fires /JavaScript on open, a /Launch action that runs an external program, an /EmbeddedFile dropper, or an /XFA / /AcroForm + /SubmitForm credential form. Attackers hide these names with PDF hex-escapes (`/J#61vaScript` == /JavaScript) to evade naive grep. This counts the structural and dangerous keywords across the raw bytes — de-obfuscating name hex-escapes the way pdfid does — and flags the auto-run / payload signatures, without rendering or executing anything.
No confidently-wrong output: the file is recognised only by its `%PDF-` header; each keyword is counted by an exact (hex-escape-aware) match, never inferred; the obfuscation flag records when a match used a `#XX` escape; the danger verdict is a labelled heuristic over the documented active-content keywords (a clean scan is not a guarantee of safety — content may sit inside a compressed /ObjStm, which is noted). It does not parse object structure or decompress streams; it never executes.
Wrap-vs-native: native — a byte scan with PDF-name hex-escape handling; stdlib only, no new go.mod dependency. Keyword set + de-obfuscation per pdfid (Didier Stevens) and the PDF name-object spec (ISO 32000 §7.3.5).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Keyword ¶
type Keyword struct {
Name string `json:"name"`
Count int `json:"count"`
// Obfuscated is true when at least one occurrence used a PDF `#XX` name
// hex-escape (a strong evasion signal).
Obfuscated bool `json:"obfuscated,omitempty"`
}
Keyword is one keyword's tally.
type Result ¶
type Result struct {
Format string `json:"format"`
Version string `json:"version,omitempty"`
Keywords []Keyword `json:"keywords"`
Dangerous bool `json:"dangerous"`
DangerReasons []string `json:"danger_reasons,omitempty"`
// Obfuscation is true when any keyword was found hex-escaped.
Obfuscation bool `json:"name_obfuscation"`
Note string `json:"note"`
}
Result is the PDF triage.
Source Files