seikaikyo/analyzing-malicious-pdf-with-peepdf
external/anthropic-cybersecurity-skills/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
$ install --global
skillsauthnpx skillsauth add seikaikyo/dash-skills analyzing-malicious-pdf-with-peepdfInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 2, 2026, 3:48 AM146.1s3 files scanned
SKILL.md
- name:
- analyzing-malicious-pdf-with-peepdf
- description:
- Perform static analysis of malicious PDF documents using peepdf, pdfid,
- domain:
- cybersecurity
- subdomain:
- malware-analysis
- version:
- 1.0
- author:
- mahipal
- license:
- Apache-2.0
Analyzing Malicious PDF with peepdf
When to Use
- When triaging suspicious PDF attachments from phishing emails
- During malware analysis of PDF-based exploit documents
- When extracting embedded JavaScript, shellcode, or executables from PDFs
- For forensic examination of weaponized document artifacts
- When building detection signatures for PDF-based threats
Prerequisites
- Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
- pdfid.py and pdf-parser.py from Didier Stevens suite
- Isolated analysis environment (VM or sandbox)
- Optional: PyV8 for JavaScript emulation within peepdf
- Optional: Pylibemu for shellcode analysis
Workflow
- Triage with pdfid: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
- Interactive Analysis: Open PDF in peepdf interactive mode to explore object structure.
- Identify Suspicious Objects: Locate objects containing JavaScript, streams, or encoded data.
- Extract Content: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
- Deobfuscate JavaScript: Analyze extracted JS for shellcode, heap sprays, or exploit code.
- Check VirusTotal: Use peepdf vtcheck to cross-reference file hash with AV detections.
- Generate IOCs: Extract URLs, domains, hashes, and shellcode signatures.
Key Concepts
| Concept | Description | |---------|-------------| | /OpenAction | Automatic action executed when PDF is opened | | /JavaScript /JS | Embedded JavaScript code in PDF objects | | /Launch | Action that launches external applications | | /EmbeddedFile | File embedded within the PDF structure | | FlateDecode | zlib compression filter used to hide content | | Object Streams | PDF objects stored in compressed streams |
Tools & Systems
| Tool | Purpose | |------|---------| | peepdf / peepdf-3 | Interactive PDF analysis with JS emulation | | pdfid.py | Quick triage scanning for suspicious keywords | | pdf-parser.py | Deep object-level PDF parsing | | VirusTotal | Hash lookup and AV detection cross-reference | | CyberChef | Decode and transform extracted payloads |
Output Format
Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]
Related Skills
seikaikyo/sketch
development
VerifiedTrustedCommunity
拋棄式 HTML mockup 比稿：產出 2 到 3 個設計立場不同的變體（密度 / 版式 / 強調軸，不是換色），各附取捨說明，最後給有立場的對比結論。適用：「畫個草圖」「比較 A 版 B 版」「先看方向再做」「給我看幾種做法」。要 production 元件或設計已定案時不適用。
1SKILL.mdUpdated Jul 21, 2026
seikaikyo/interview-me
tools
VerifiedTrustedCommunity
需求不明時的意圖萃取訪談：一次一題、每題附上自己的猜測、聽出「真正想要 vs 覺得應該要」，直到能預測使用者反應（約 95% 信心）才動工。適用：需求缺少對象 / 動機 / 成功標準 / 約束，或使用者點名「訪談我」「先確認一下」「我們確定嗎」。明確自足的指示、純資訊查詢、機械性操作不適用。
1SKILL.mdUpdated Jul 21, 2026
seikaikyo/doubt-driven-development
development
VerifiedTrustedCommunity
對非平凡決策啟動新鮮 context 對抗審查（找碴不背書），在修正還便宜的時候抓出錯誤方向。適用：高風險改動（production、資安敏感邏輯、不可逆操作）、不熟的程式碼、要宣稱「這樣是安全的 / 可行的」之前。機械性操作與一行修改不適用。
1SKILL.mdUpdated Jul 21, 2026
seikaikyo/writing-great-skills
testing
VerifiedTrustedCommunity
Reference for writing and editing agent skills well — the vocabulary and principles that make a skill predictable. Consult when authoring, reviewing, or pruning a SKILL.md.
1SKILL.mdUpdated Jul 21, 2026