Didier Stevens has produced a programme which is called "pdfid" (https://blog.didierstevens.com/2009/03/31/pdfid/ and https://blog.didierstevens.com/programs/pdf-tools/#pdfid).
"I’ve developed a new tool to triage PDF documents, PDFiD. It helps you differentiate between PDF documents that could be malicious and those that are most likely not."
And that´s what I want to use it for.
"PDFiD will scan a PDF document for a given list of strings and count the occurrences (total and obfuscated) of each word:"
As far as I know the values of "obj" and "endobj" should match which means that there´s no object opened that wasn´t closed (perhaps causing buffer-overflow or something else).
should have zero value.
Yet I´ve seen quite a lot of pdf-documents with "obj" and "endobj" not matching but the other values seem to be o.k.
Example: Using_FreeDOS.pdf from http://www.freedos.org/ebook/download/using-freedos-24.pdf .
Yet this one has also "/OpenAction 1". I´m not quite sure how relevant that one is.
how important is the fact that "obj" and "endobj" match when the rest of the list of strings and count are o.k?
As already said: there are quite a few pdf-documents out there with "obj" and "endobj" not matching.