We’re testing our Memory Analysis package (currently in beta) against various challenges available online.

We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to CyberTalents for creating it in the first place. The challenge can be downloaded directly from here.

In this case, after observing the presence of a PDF viewer process, we mined the user memory of that process for PDF documents and found one. When opened in a PDF viewer, the PDF displays only one image; however, it contains a second image…