About

Imported from momo0410/mmm (skills/imported/analyzing-malicious-pdf-with-peepdf/SKILL.md). Install upstream with npx skills add momo0410/mmm --skill analyzing-malicious-pdf-with-peepdf. Copyright stays with the author (Apache-2.0).

Analyzing Malicious PDF with peepdf

Name: analyzing-malicious-pdf-with-peepdf
Author: momo0410

When to Use

When triaging suspicious PDF attachments from phishing emails
During malware analysis of PDF-based exploit documents
When extracting embedded JavaScript, shellcode, or executables from PDFs
For forensic examination of weaponized document artifacts
When building detection signatures for PDF-based threats

Prerequisites

Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
pdfid.py and pdf-parser.py from Didier Stevens suite
Isolated analysis environment (VM or sandbox)
Optional: PyV8 for JavaScript emulation within peepdf
Optional: Pylibemu for shellcode analysis

Workflow

Triage with pdfid: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
Interactive Analysis: Open PDF in peepdf interactive mode to explore object structure.
Identify Suspicious Objects: Locate objects containing JavaScript, streams, or encoded data.
Extract Content: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
Deobfuscate JavaScript: Analyze extracted JS for shellcode, heap sprays, or exploit code.
Check VirusTotal: Use peepdf vtcheck to cross-reference file hash with AV detections.
Generate IOCs: Extract URLs, domains, hashes, and shellcode signatures.

Key Concepts

Concept	Description
/OpenAction	Automatic action executed when PDF is opened
/JavaScript /JS	Embedded JavaScript code in PDF objects
/Launch	Action that launches external applications
/EmbeddedFile	File embedded within the PDF structure
FlateDecode	zlib compression filter used to hide content
Object Streams	PDF objects stored in compressed streams

Tools & Systems

Tool	Purpose
peepdf / peepdf-3	Interactive PDF analysis with JS emulation
pdfid.py	Quick triage scanning for suspicious keywords
pdf-parser.py	Deep object-level PDF parsing
VirusTotal	Hash lookup and AV detection cross-reference
CyberChef	Decode and transform extracted payloads

Output Format

Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/momo0410-mmm-analyzing-malicious-pdf-with-peepdf/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

momo0410-mmm-analyzing-malicious-pdf-with-peepdf.ocm.jsonjson

{
  "ocm": "1",
  "id": "momo0410-mmm-analyzing-malicious-pdf-with-peepdf",
  "kind": "skill",
  "name": "analyzing-malicious-pdf-with-peepdf",
  "description": "Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.",
  "publisher": "momo0410",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "malware-analysis",
      "pdf",
      "peepdf",
      "pdfid",
      "pdf-parser",
      "static-analysis",
      "reverse-engineering",
      "dfir",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/momo0410/mmm",
      "path": "skills/imported/analyzing-malicious-pdf-with-peepdf/SKILL.md",
      "ref": "840ea312c2c57d1a59a63d629c2323b974b7e8d2",
      "url": "https://github.com/momo0410/mmm/blob/840ea312c2c57d1a59a63d629c2323b974b7e8d2/skills/imported/analyzing-malicious-pdf-with-peepdf/SKILL.md",
      "key": "momo0410/mmm/skills/imported/analyzing-malicious-pdf-with-peepdf/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Analyzing Malicious PDF with peepdf\n\n## When to Use\n\n- When triaging suspicious PDF attachments from phishing emails\n- During malware analysis of PDF-based exploit documents\n- When extracting embedded JavaScript, shellcode, or executables from PDFs\n- For forensic examination of weaponized document artifacts\n- When building detection signatures for PDF-based threats\n\n## Prerequisites\n\n- Python 3.8+ with peepdf-3 installed (pip install peepdf-3)\n- pdfid.py and pdf-parser.py from Didier Stevens suite\n- Isolated analysis environment (VM or sandbox)\n- Optional: PyV8 for JavaScript emulation withi",
  "cost": {
    "context_tokens": 620
  }
}

Fetch it by URL: GET /api/v1/registry/momo0410-mmm-analyzing-malicious-pdf-with-peepdf/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.