ReadPDFFile V2 gives error when reading PDF file

[pottapitot]

Hi everyone,

I was trying to make a playbook to extract indicators (Hash values, domains, IP addresses) from a PDF file. I tried to use the ReadPDFFile V2 utility, however it gives the below error on 2 of the PDF files I tried.

Command: 

!ReadPDFFileV2 entryID="29@14" maxImages="20" auto-extract="inline"(Scripts)

Reason

Could not load pdf file in EntryID 29@14 Error: 'http://www.w3.org/1999/xhtml'

Any idea how I can resolve this?

I though it was the PDF version at first (the original file is 1.5), so i tried converting to v1.8 and still it failed.

Thanks in advance.

[jwilkes]

Good morning, is 'http://www.w3.org/1999/xhtml' an indicator inside the PDF?

[pottapitot]

Hi @jwilkes 

It is not present in the file. There are 2 other domains not related to this and a couple of hashes and CVE.

[jwilkes]

Do other PDFs with the same PDF version work with ReadPDFFileV2 ?

[pottapitot]

Hi @jwilkes 

I tried another file, the PDF present in the below site as testing. That also failed with the same error. 

https://www.ncsc.gov.uk/news/indicators-of-compromise-for-malware-used-by-apt28

Since I am experimenting I am using the playbook "Phishing - Generic v3". The ReadPDFFilev2 is present in it and it stops there with the above error.