# Analyzing Malicious PDF With Peepdf

Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser...

- Repository: https://github.com/mukul975/Anthropic-Cybersecurity-Skills (35398 stars)
- Category: Documents
- License: Apache-2.0
- Last updated: 2026-08-31
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malicious-pdf-with-peepdf -g -a claude-code -y`
Codex: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malicious-pdf-with-peepdf -g -a codex -y`
Cursor: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malicious-pdf-with-peepdf -g -a cursor -y`
Gemini CLI: `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malicious-pdf-with-peepdf -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add mukul975/Anthropic-Cybersecurity-Skills`

## Description

Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF threats.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Analyzing Malicious PDF with peepdf

## When to Use

- When triaging suspicious PDF attachments from phishing emails
- During malware analysis of PDF-based exploit documents
- When extracting embedded JavaScript, shellcode, or executables from PDFs
- For forensic examination of weaponized document artifacts
- When building detection signatures for PDF-based threats

## Prerequisites

- Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
- pdfid.py and pdf-parser.py from Didier Stevens suite
- Isolated analysis environment (VM or sandbox)
- Optional: PyV8 for JavaScript emulation within peepdf
- Optional: Pylibemu for shellcode analysis

## Workflow

1. **Triage with pdfid**: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
2. **Interactive Analysis**: Open PDF in peepdf interactive mode to explore object structure.
3. **Identify Suspicious Objects**: Locate objects containing JavaScript, streams, or encoded data.
4. **Extract Content**: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
5. **Deobfuscate JavaScript**: Analyze extracted JS for shellcode, heap sprays, or exploit code.
6. **Check VirusTotal**: Use peepdf vtcheck to cross-reference file hash with AV detections.
7. **Generate IOCs**: Extract URLs, domains, hashes, and shellcode signatures.

## Key Concepts

| Concept | Description |
|---------|-------------|
| /OpenAction | Automatic action executed when PDF is opened |
| /JavaScript /JS | Embedded JavaScript code in PDF objects |
| /Launch | Action that launches external applications |
| /EmbeddedFile | File embedded within the PDF structure |
| FlateDecode | zlib compression filter used to hide content |
| Object Streams | PDF objects stored in compressed streams |

## Tools & Systems

The rest: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/HEAD/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md