This new version of pdf-parser.py brings 2 new features; the idea came to me during private & public trainings I gave on malicious documents (if you are interested in a training, please get in touch).
The statistics option (-a –stats) has been enhanced with a search for keywords section:
In this section, the result of searches for particular keywords (that might indicate a malicious PDF) is displayed: you get the number of hits followed by the indices of the objects that contain this keyword.
In the example above, we see that object 11 contains JavaScript.
Remark that this section is the result of a search command (-s): search in pdf-parser is not case-senstive and partial (unlike PDFiD). That explains why /AA is found in object 37, while it’s actually /Aacute:
pdf-parser will also read file pdfid.ini (if present) so that the personal keywords you added to PDFiD are also used by pdf-parser.
–overridingfilters is a new option: it allows for the processing of streams with a different filter (or filter chain) than the one specified in the object’s dictionary. Use value raw to obtain the raw stream, without filtering.
pdf-parser_V0_6_9.zip (https)
MD5: 27D65A96FEAF157360ACBBAAB9748D27
SHA256: 3F102595B9EAE5842A1B4723EF965344AE3AB01F90D85ECA96E9678A6C7092B7
Didier Stevens 
[…] Update: pdf-parser.py Version 0.6.9 […]
Pingback by Week 43 – 2018 – This Week In 4n6 — Sunday 28 October 2018 @ 3:55
[…] Update: pdf-parser.py Version 0.6.9 […]
Pingback by Overview of Content Published in October | Didier Stevens — Friday 2 November 2018 @ 0:00