(5) Each element has its own detailed attributes editing dialog box. Click and drag your cursor to size and place the element on the OO Write sheet. (4) Once you have your grid in place, select the form element(s) that you like. When you have a grid on your form, placing form elements that align with each other becomes much easier. I especially recommend the DISPLAY GRID and SNAP TO GRID tools (the buttons on the right end of the strıp that really look like a grid). (3) Click Form design, the button at the bottom to display a very useful array of additional form design tools:

(2) Select View > Toolbars > Form Controls to display the rich variety of form controls: (1) Launch your OO Writer and create a new document. But it's very unlikely to find this in common maldocs.ī DidierStevensLabs.Think of OpenOffice Writer as the free equivalent of MS Word (free download at ).ĭid you know that you can create perfect PDF forms by using nothing else but OO Writer? A targeted attack might use a more sofisticated exploit, without any of the signs reported by pdfid or pdf-parser's statistics. Should you suspect that this is targeted, then you could continue your analysis as explained in diary entry series ' It is a resume', for example. When you encounter a document like this, it's most likely not malicious. This explicit destination refers to object 1: this is a page: This is explained in the PDF reference documents: OpenAction here is not used to execute JavaScript code upon opening of the PDF (as is often the case with malicious PDFs), but it is used to present the first page with the desired position and zoom. Its purpose is to present the first page when you open the document for the first time. This /OpenAction is typically added by OpenOffice and LibreOffice when creating a PDF document. Best is to combine this with option -O to look inside stream objects, should they be present: You can also find search keywords like /OpenAction using pdf-parser.py's statistics option (-a). When you look at such a PDF with pdfid.py, everything looks OK, except that there is an /OpenAction: From time to time, I get a question about PDFs that have an /OpenAction, but don't seem to contain (malicious) code.

Openoffice pdf documents