As a forensic investigator specializing in cybersecurity, you've been assigned to analyze a suspicious PDF document named "infected.pdf." This document was discovered on a company server and is…

Question

Options

• ARun the command python pdfid.py infected.pdf in a Linux terminal to review the file's structure and
• BOpen the PDF document in a virtual machine environment to observe potential malicious behavior.
• CUtilize a web-based tool to extract metadata from the PDF document and analyze any anomalies.
• DUse a hex editor to manually inspect the contents of the PDF document for suspicious patterns.

• A
  72% (26)
• B
  8% (3)
• C
  17% (6)
• D
  3% (1)

Explanation

According to the CHFI v11 objectives under Malware Forensics and Static Malware Analysis, the correct initial step when analyzing a suspicious document--such as a potentially malicious PDF-- is to perform static analysis before any execution. Running the tool PDFiD using the command python pdfid.py infected.pdf is a standard and CHFI-aligned first action. PDFiD is designed to quickly scan a PDF file and identify suspicious elements such as /JavaScript, /OpenAction, /Launch, /EmbeddedFile, and /AA, which are commonly abused by attackers to deliver malware through PDF documents. This approach is non-intrusive and ensures the investigator does not accidentally trigger malicious code, thereby preserving evidence integrity and maintaining forensic soundness. Opening the file in a virtual machine (Option B) constitutes dynamic analysis, which should only be performed after initial static indicators suggest malicious intent and after proper containment controls are in place. Metadata extraction (Option C) is useful but limited, as metadata alone does not reliably expose embedded exploit code. Manual hex inspection (Option D) is advanced and time-consuming and is not recommended as the first step.

No community discussion yet for this question.