New PDF Tool Detects Malicious Files Using PDF Object Hashing

A new open-source tool called PDF Object Hashing, released by Proofpoint, helps security teams detect and track malicious files distributed as PDFs. The tool is now available on GitHub and represents a significant advance in identifying suspicious documents used by threat actors in phishing campaigns, malware distribution, and business email compromise attacks.

Rather than analysing internal content, PDF Object Hashing examines the document’s underlying structure, creating a skeleton of the PDF and hashing the object types into a unique fingerprint that remains stable even when attackers modify images, URLs, or text. The technique works even on encrypted PDFs because the document structure remains visible, allowing detection when traditional tools cannot read inside the file.

Proofpoint notes that the UAC-0050 group, which targets Ukraine, and another actor known as UNK_ArmyDrive rely on PDFs in their attack chains, and the open-source release enables the broader security community to integrate this detection method into their tools and workflows. According to Proofpoint, this approach enhances attribution and helps security teams connect related PDFs to the same campaign.