pdf-parser

Parse PDF structure

$ pdf-parser [file.pdf]

$ pdf-parser -s [keyword] [file.pdf]

$ pdf-parser -o [5] [file.pdf]

$ pdf-parser -d [output.bin] -o [5] [file.pdf]

$ pdf-parser -a [file.pdf]

$ pdf-parser -t [/JavaScript] [file.pdf]

$ pdf-parser -f [file.pdf]

pdf-parser [-s search] [-o id] [-t type] [-f] [options] file

pdf-parser analyzes PDF file structure. It's used for malware analysis and forensics.
Object enumeration shows all PDF objects. Each object's type and contents are displayed.
Searching finds embedded scripts, URLs, or suspicious content. JavaScript and launch actions are common malware vectors.
Stream extraction dumps compressed or encoded data. Filters decompress FlateDecode and other encodings.
Statistics summarize object types present. This quickly identifies files with unusual structures.
Reference following traces object relationships. Cross-references reveal document structure.

-s STRING

Search for string.

Select object by ID.

Filter by type.

Apply stream filters.

Dump stream to file.

Statistics and analysis.

Raw output.

Reference object.

Content stream.

Verbose output.

Malicious PDFs may crash parsers. Output can be very large. Not all PDF features supported.

pdf-parser was created by Didier Stevens for PDF malware analysis. It's part of his toolkit for analyzing suspicious documents and is widely used in incident response.

pdfinfo(1), pdftotext(1), pdfid(1), strings(1)