ReadPDFFile V2 gives error when reading PDF file

[pottapitot]

Hi everyone,

I was trying to make a playbook to extract indicators (Hash values, domains, IP addresses) from a PDF file. I tried to use the ReadPDFFile V2 utility, however it gives the below error on 2 of the PDF files I tried.

Command: 

!ReadPDFFileV2 entryID="29@14" maxImages="20" auto-extract="inline"(Scripts)

Reason

Could not load pdf file in EntryID 29@14 Error: 'http://www.w3.org/1999/xhtml'

Any idea how I can resolve this?

I though it was the PDF version at first (the original file is 1.5), so i tried converting to v1.8 and still it failed.

Thanks in advance.

[jwilkes]

Good morning, is 'http://www.w3.org/1999/xhtml' an indicator inside the PDF?

[pottapitot]

Hi @jwilkes 

It is not present in the file. There are 2 other domains not related to this and a couple of hashes and CVE.

[jwilkes]

Do other PDFs with the same PDF version work with ReadPDFFileV2 ?

[pottapitot]

Hi @jwilkes 

I tried another file, the PDF present in the below site as testing. That also failed with the same error. 

https://www.ncsc.gov.uk/news/indicators-of-compromise-for-malware-used-by-apt28

Since I am experimenting I am using the playbook "Phishing - Generic v3". The ReadPDFFilev2 is present in it and it stops there with the above error.

[jwilkes]

@pottapitot ,

I tried that same file for my XSOAR instance (6.2) and it failed as well.  Can you please create a support ticket to investigate this further?  I know that ReadPDFFileV2 uses the linux utility "pdftohtml" and maybe there are some limitations.

I know we have found limitations before but they were with PDF encryption: https://xsoar.ideas.aha.io/ideas/FR-I-1397

[pottapitot]

@jwilkes 

Wow! I am impressed by the speed of the resolution. I was looking through the automation script after my previous post when I noticed there was an update for the ReadPDFFileV2 script. I updated the automation and tried it again. Now it works perfectly!

I am not sure how you did it but once again thanks alot! 😃

[jwilkes · Accepted solution]

Yes, this looks related.  Glad to help!