← LeaderboardThe Skill Leaderboard

analyzing-malicious-pdf-with-peepdf

Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF threats.

Published by mukul975 ↗mukul975/Anthropic-Cybersecurity-Skills

Try your first task

analyzing-malicious-pdf-with-peepdf

Start a fresh conversation. Replace the highlighted placeholders.

Use analyzing-malicious-pdf-with-peepdf to analyzing-malicious-pdf-with-peepdf to statically analyze [suspicious PDF file] in an isolated analysis environment and deliver a PDF-MAL report with suspicious objects, extracted indicators, embedded content, hashes, and risk level.

Required inputs

  • [suspicious PDF file]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: analyzing-malicious-pdf-with-peepdfdescription: Perform static analysis of malicious PDF documents using peepdf, pdfid,  and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.  Use when triaging a suspicious PDF attachment from a phishing email, analyzing a  PDF-based exploit document, or building detection signatures for weaponized PDF  threats.domain: cybersecuritysubdomain: malware-analysistags: - malware-analysis- pdf- peepdf- pdfid- pdf-parser- static-analysis- reverse-engineering- dfirversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - DE.AE-02- RS.AN-03- ID.RA-01- DE.CM-01mitre_attack: - T1204.002- T1059.007- T1027- T1106

Analyzing Malicious PDF with peepdf

When to Use

  • When triaging suspicious PDF attachments from phishing emails
  • During malware analysis of PDF-based exploit documents
  • When extracting embedded JavaScript, shellcode, or executables from PDFs
  • For forensic examination of weaponized document artifacts
  • When building detection signatures for PDF-based threats

Prerequisites

  • Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
  • pdfid.py and pdf-parser.py from Didier Stevens suite
  • Isolated analysis environment (VM or sandbox)
  • Optional: PyV8 for JavaScript emulation within peepdf
  • Optional: Pylibemu for shellcode analysis

Workflow

  1. Triage with pdfid: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
  2. Interactive Analysis: Open PDF in peepdf interactive mode to explore object structure.
  3. Identify Suspicious Objects: Locate objects containing JavaScript, streams, or encoded data.
  4. Extract Content: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
  5. Deobfuscate JavaScript: Analyze extracted JS for shellcode, heap sprays, or exploit code.
  6. Check VirusTotal: Use peepdf vtcheck to cross-reference file hash with AV detections.
  7. Generate IOCs: Extract URLs, domains, hashes, and shellcode signatures.

Key Concepts

ConceptDescription
/OpenActionAutomatic action executed when PDF is opened
/JavaScript /JSEmbedded JavaScript code in PDF objects
/LaunchAction that launches external applications
/EmbeddedFileFile embedded within the PDF structure
FlateDecodezlib compression filter used to hide content
Object StreamsPDF objects stored in compressed streams

Tools & Systems

ToolPurpose
peepdf / peepdf-3Interactive PDF analysis with JS emulation
pdfid.pyQuick triage scanning for suspicious keywords
pdf-parser.pyDeep object-level PDF parsing
VirusTotalHash lookup and AV detection cross-reference
CyberChefDecode and transform extracted payloads

Output Format

Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]
analyzing-malicious-pdf-with-peepdf by mukul975 · The Skill Leaderboard