I have received a PDF document from a fake Paypal address. The PDF name is Paypal_EmailID_JK… To be sure whether the document is malicious or not I used the pdfid.py tool as in the screenshot below .
We see the nothing apended After last %%EOF and the Total entropy.Finally I use
pdf-parser.py to extract those URLs as in the picture below
The PDF appears to be from Paypal but in fact will redirect the victim to the