topic Re: ReadPDFFile V2 gives error when reading PDF file in Cortex XSOAR Discussions

ReadPDFFile V2 gives error when reading PDF file

pottapitot — Wed, 09 Feb 2022 10:59:07 GMT

Hi everyone,

I was trying to make a playbook to extract indicators (Hash values, domains, IP addresses) from a PDF file. I tried to use the ReadPDFFile V2 utility, however it gives the below error on 2 of the PDF files I tried.

Command:

!ReadPDFFileV2 entryID="29@14" maxImages="20" auto-extract="inline"(Scripts)

Reason

Could not load pdf file in EntryID 29@14 Error: 'http://www.w3.org/1999/xhtml'

Any idea how I can resolve this?

I though it was the PDF version at first (the original file is 1.5), so i tried converting to v1.8 and still it failed.

Thanks in advance.

Re: ReadPDFFile V2 gives error when reading PDF file

jwilkes — Wed, 09 Feb 2022 12:40:19 GMT

Good morning, is 'http://www.w3.org/1999/xhtml' an indicator inside the PDF?

Re: ReadPDFFile V2 gives error when reading PDF file

pottapitot — Wed, 09 Feb 2022 12:52:51 GMT

Hi @jwilkes

It is not present in the file. There are 2 other domains not related to this and a couple of hashes and CVE.

Re: ReadPDFFile V2 gives error when reading PDF file

jwilkes — Wed, 09 Feb 2022 12:54:48 GMT

Do other PDFs with the same PDF version work with ReadPDFFileV2 ?

Re: ReadPDFFile V2 gives error when reading PDF file

pottapitot — Wed, 09 Feb 2022 14:08:54 GMT

Hi @jwilkes

I tried another file, the PDF present in the below site as testing. That also failed with the same error.

https://www.ncsc.gov.uk/news/indicators-of-compromise-for-malware-used-by-apt28

Since I am experimenting I am using the playbook "Phishing - Generic v3". The ReadPDFFilev2 is present in it and it stops there with the above error.

Re: ReadPDFFile V2 gives error when reading PDF file

jwilkes — Wed, 09 Feb 2022 14:39:47 GMT

@pottapitot ,

I tried that same file for my XSOAR instance (6.2) and it failed as well. Can you please create a support ticket to investigate this further? I know that ReadPDFFileV2 uses the linux utility "pdftohtml" and maybe there are some limitations.

I know we have found limitations before but they were with PDF encryption: https://xsoar.ideas.aha.io/ideas/FR-I-1397

Re: ReadPDFFile V2 gives error when reading PDF file

pottapitot — Wed, 09 Feb 2022 14:52:19 GMT

@jwilkes

Wow! I am impressed by the speed of the resolution. I was looking through the automation script after my previous post when I noticed there was an update for the ReadPDFFileV2 script. I updated the automation and tried it again. Now it works perfectly!

I am not sure how you did it but once again thanks alot! 😃

Re: ReadPDFFile V2 gives error when reading PDF file

jwilkes — Wed, 09 Feb 2022 14:59:18 GMT

Yes, this looks related. Glad to help!