How can i embed javascript code to pdf and get it to execute?

Question

i am talking a malware analysis class in uni and in the previous lesson we talked about malicious pdf documents and embeded executables, as well as embeded javascript that runs once the pdf is opened. After class, i tried creating one such pdf myself, but with no luck. I tried doing it manually by loading the pdf in notepad and adding pdf objects like this article is doing (in 2012...) https://mariomalwareanalysis.blogspot.com/2012/02/how-to-embed-javascript-into-pdf.html , as well as running some python scripts i found using pypdf2 library. But neither the manual way worked, nor the python scripts. Python scripts in particular actually created the pdf with the javascript objects embeded, but did not create a popup alert upon opening.

The python scripts i tried was :

• https://gist.github.com/notdodo/a441f2bdfc8c99c1999db0a3e8495fb6
• https://github.com/py-pdf/PyPDF2/issues/482 But i was getting the same error when running them :

Incorrect first char in NameObject:((app.alert("Startup");))

Also, when the "malicious" pdf was generated, i was opening it in microsoft edge/mozilla/chrome and not in acrobat.

Any ideas how could i embed js and get it running when the file is opened in browser? Thanks

Answer 1

It is not trivial to inject JS using Python, for this example I used a GUI and other editors like MS Notepad as easier to cut and paste. Note it is a very simple proof of concept to test if a browser will respond to scripting.

It could be much cleaner that this but you can compare with one that is not working so if a browser is set to open scripts they will run there or in Acrobat, what you should note Acro EcmaSript is not like HTML at this basic level.

obj
<<
  /A <<
    /JS (app.setTimeOut \('app.alert\("Hello Moon!", 3\)', 5000 \);)
    /S /JavaScript
  >>
  /AP <<
    /N 18 0 R
  >>
  /DA (/HeBo 5 Tf 0 g)
  /F 4
  /Ff 65536
  /FT /Btn
  /M (D:20221021205839+01'00')
  /MK <<
    /BG [ .164825 .776596 .065796 ]
    /CA (app.alert in 5 second)
  >>
  /P 11 0 R
  /Parent 10 0 R
  /Rect [ 225 175 375 200 ]
  /Subtype /Widget
  /T (alert in 5 seconds)
  /Type /Annot
>>
endobj

Part2

obj
<<
  /A <<
    /JS (app.alert\("Hello World!", 3\);)
    /S /JavaScript
  >>
  /AP <<
    /N 19 0 R
  >>
  /DA (/HeBo 5 Tf 0 g)
  /F 4
  /Ff 65536
  /FT /Btn
  /M (D:20221021205712+01'00')
  /MK <<
    /BG [ .164825 .776596 .065796 ]
    /CA (app.alert Now)
  >>
  /P 11 0 R
  /Parent 10 0 R
  /Rect [ 50 175 200 200 ]
  /Subtype /Widget
  /T (alert now)
  /Type /Annot
>>
endobj

You asked how that can be run on file opening and if we move a simplified hybrid of those 2 actions from acroform to delayed action on file open it should look as easy as this:-

2 0 obj
...
/OpenAction <<
/JS (app.setTimeOut \('app.alert\("Hello World!", 3\)', 5000 \);)
/S /JavaScript
...
endobj

so without any user action after 5 seconds we see we are owned