![\"\"](\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/signture.png\")
<\/a><\/p>\nA recheck with the tool TrIDNET<\/a> confirms that it is a pdf file.<\/p>\n Let’s add the fileexenstion pdf and open the file.<\/p>\n The pdf file contains a image with a cartoon character and the text: I dare you find it! \ud83d\ude42<\/strong><\/p>\n For the further analysis I used a free tool called Winking PDF Analyzer<\/a><\/p>\n A quick view shows that the pdf file contains streams. My assumption was that there is something hidden in that streams and I’ve tried to find a way to decode them.<\/p>\n On stackoverflow<\/a> I did find a hint howto decode them:<\/p>\n The easiest way to decode a PDF file is to use a tool intended to do it, for example MuPDF<\/a> can do this with « mutool.exe clean -d enigma.pdf enigma_decoded.pdf<\/p><\/blockquote>\n As we can see the filesize has changed from 161 KB\u00a0 to 2756 KB<\/p>\n <\/p>\n If I open the decoded pdf file again in Winking PDF Analyzer, I can see a reference of two images:<\/p>\n I’m using again mutool to extract the images of the pdf:<\/p>\n mutool.exe extract enigma_decoded.pdf<\/p><\/blockquote>\n img-005.png is the cartoon, but now let’s see what is img-004.png<\/strong><\/p>\n Sadly I had no plan how to revert that image, but a friend of mine gave me a hint:<\/p>\n In 2007 the police catched a pedophile<\/a> men who tried to mask his identity with a swirl face.<\/p>\n It is possible to revert the image with photoshop or an online image editing tool.<\/p>\n Now we can try to revert the image with photoshop<\/a> by choosing the effect distort –> twirl<\/p>\n Or using an online image editor<\/a>, which is a much faster way:<\/p>\n The same can be done with the black image above and we can read the text:<\/p>\n<\/a><\/p>\n<\/a><\/p>\nFinding Secrets<\/h1>\n
<\/a><\/p>\nmutool clean -d <input pdf file> <output PDF file><\/code>» will decompress (-d<\/code>) all the compressed streams in a PDF file and write the output to a new PDF file.<\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\nWhat computers can swirl,<\/h1>\n
Computers can unswirl<\/h1>\n
<\/a><\/p>\n<\/p>\n<\/a><\/p>\n