1
2
3
4
5 import os
6
7 from lib.common.abstracts import Package
8 from lib.api.process import Process
9 from lib.common.exceptions import CuckooPackageError
10
12 """PDF analysis package."""
13
15 adobe = os.path.join(os.getenv("ProgramFiles"), "Adobe")
16 paths = [
17 os.path.join(adobe, "Reader 8.0", "Reader", "AcroRd32.exe"),
18 os.path.join(adobe, "Reader 9.0", "Reader", "AcroRd32.exe"),
19 os.path.join(adobe, "Reader 10.0", "Reader", "AcroRd32.exe"),
20 os.path.join(adobe, "Reader 11.0", "Reader", "AcroRd32.exe"),
21 ]
22
23 for path in paths:
24 if os.path.exists(path):
25 return path
26
27 return None
28
30 reader = self.get_path()
31 if not reader:
32 raise CuckooPackageError("Unable to find any Adobe Reader "
33 "executable available")
34
35 dll = self.options.get("dll", None)
36 free = self.options.get("free", False)
37 suspended = True
38 if free:
39 suspended = False
40
41 p = Process()
42 if not p.execute(path=reader, args="\"%s\"" % path, suspended=suspended):
43 raise CuckooPackageError("Unable to execute initial Adobe Reader "
44 "process, analysis aborted")
45
46 if not free and suspended:
47 p.inject(dll)
48 p.resume()
49 return p.pid
50 else:
51 return None
52
55
57 if self.options.get("procmemdump", False):
58 for pid in self.pids:
59 p = Process(pid=pid)
60 p.dump_memory()
61
62 return True
63