Why would an image only PDF (or an Image + a space) be a bad thing? Checking the links in a PDF – regardless of the content – certainly seems like a reasonable thing to do, however.
Leonard On 8/25/17, 9:50 PM, "poppler on behalf of Alex" <[email protected] on behalf of [email protected]> wrote: Hi, On Fri, Aug 25, 2017 at 5:58 PM, Adrian Johnson <[email protected]> wrote: > On 26/08/17 02:47, Alex wrote: >> Hi, >> I'm attempting to use pdftohtml and pdftotext on fedora25 >> (poppler-utils-0.45.0-5.fc25.x86_64) and I'm unable to get it to >> extract the text from a particular PDF I need. >> >> I'm trying to use the poppler-utils to work with a spamassassin plugin >> to extract text from PDFs that may be malicious. Here is one such >> example: >> >> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dropbox.com%2Fs%2Fb97pcvl1wm1oocq%2Fpdf-phish.pdf%3Fdl%3D0&data=02%7C01%7C%7Cec4d1f186a84418de9c208d4ec24d2b0%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C1%7C636393090302511369&sdata=ZYGRUowz5XLtq4Tf5qcAmSgx6qsbdEeeNUvTA%2B5dVPY%3D&reserved=0 >> >> It appears to extract the header information (author, date, etc) but >> no text from within the PDF. > > That's because there is no text in the PDF. > > Here's the content stream ... > The only text is a single space character. The rest is an image. There > is also a link annotation. Maybe we could add an option to pdfinfo to > list the annotations in the file and for link annotations show the URL. Yes, I thought that might have been the problem, but the URL is what I was specifically talking about. That signature alone might be very helpful for identifying these malicious PDFs. Does the presence of a single space character with an image sound like a unique pattern, and if so, how can I encapsulate that into something I can trigger on? In other words, even something like an exit code or other indication that it's the only real content would be helpful. Thanks, Alex _______________________________________________ poppler mailing list [email protected] https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.freedesktop.org%2Fmailman%2Flistinfo%2Fpoppler&data=02%7C01%7C%7Cec4d1f186a84418de9c208d4ec24d2b0%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C636393090302511369&sdata=dm08Epwy3Ay6XiKfO0MZKnyZUBoqm38%2FNvJptdxFypA%3D&reserved=0 _______________________________________________ poppler mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/poppler
