Anonymous ID: d37032 May 11, 2020, 7:19 a.m. No.9122400   🗄️.is 🔗kun   >>2435 >>2824

ghidra let me know that the McCankles pdf is composed of image embeds… those images have steganography

 

$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz #3R&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Anonymous ID: d37032 May 11, 2020, 8:17 a.m. No.9122983   🗄️.is 🔗kun   >>3002 >>3023

>>9122950

open pdf in ghidra, select a platform, I used 64 bit gcc, run the auto analysis, then select the text adn press "D" to disassemble, check your definded data ouputs. You will see a list of images.

 

you can use xpdf's pdfimages exporter to acquire the files.