service_manifest.yml

name: PeePDF
version: $SERVICE_TAG
description: >-
  This service uses the Python PeePDF library information from PDFs including JavaScript
  blocks which it will attempt to deobfuscate, if necessary, for further analysis.

accepts: (document/pdf|code/xml)

stage: CORE
category: Static Analysis

file_required: true

enabled: true
timeout: 60
disable_cache: false
licence_count: 0
privileged: true

heuristics:
  - heur_id: 1
    name: Embedded PDF in XDP
    filetype: document/pdf
    score: 1
    description: >-
      If there is the <chunk> tag in the PDF file contents, there is an embedded PDF in the XDP.

  - heur_id: 2
    filetype: document/pdf
    name: Large Buffers
    score: 100
    description: >-
      A buffer was found in the JavaScript code.

  - heur_id: 3
    filetype: document/pdf
    name: Contains eval
    score: 100
    description: >-
      The eval() function is found in the javascript block. This is
      commonly used to launch deofuscated javascript code.

  - heur_id: 4
    filetype: document/pdf
    name: Contains unescape
    score: 100
    description: >-
      The unescape() function is found in the javascript block. Malware
      could use this to deobfuscate code blocks.

  - heur_id: 5
    filetype: document/pdf
    name: JavaScript Shellcode
    score: 0
    description: >-
      Hidden shellcode found inside unescaped bytes.

  - heur_id: 6
    filetype: document/pdf
    name: Unescaped JavaScript Buffer
    score: 500
    description: >-
      If looking for JavaScript shellcode fails, the JavaScript is an
      unknown unescaped buffer.

  - heur_id: 8
    filetype: document/pdf
    name: Suspicious JavaScript Elements
    score: 0
    description: >-
      Suspicious JavaScript elements have been found within the file.

  - heur_id: 9
    name: Contains URL(s)
    score: 50
    filetype: document/pdf
    description: >-
      URL(s) have been found within the file.

docker_config:
  image: ${REGISTRY}cccs/assemblyline-service-peepdf:$SERVICE_TAG
  cpu_cores: 1
  ram_mb: 2048