GIAC
GREM · Question #179
You are analyzing a suspicious PDF document that was flagged by antivirus software. Initial inspection shows that the PDF contains a JavaScript action triggering upon document opening, which is…
The correct answer is A. Use PDF parser tools to extract the JavaScript code for analysis. B. Disable JavaScript execution and open the document in a sandbox environment. C. Analyze the PDF trailer for any hidden embedded objects. See the full explanation below for the reasoning.
Question
You are analyzing a suspicious PDF document that was flagged by antivirus software. Initial inspection shows that the PDF contains a JavaScript action triggering upon document opening, which is obfuscated. What are the next steps you should take to determine whether the document is malicious? (Choose three)
Options
- AUse PDF parser tools to extract the JavaScript code for analysis.
- BDisable JavaScript execution and open the document in a sandbox environment.
- CAnalyze the PDF trailer for any hidden embedded objects.
- DExtract and analyze the metadata to assess the document's creation.
- EAttempt to open the document in a standard PDF viewer to observe its behavior.
How the community answered
(66 responses)- A79% (52)
- D6% (4)
- E15% (10)
Community Discussion
No community discussion yet for this question.