Analyzing malicious pdfs
Skill meltedinhex/analyst-ai-pack/skills/analyzing-malicious-pdfs
An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-pdfsAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Analyzes malicious PDF documents: parsing the object structure for JavaScript, OpenAction/launch triggers, embedded files, and URIs, then extracting and decoding suspicious streams without opening the document in a reader. Activates for requests to analyze a malicious PDF, inspect PDF JavaScript, or extract embedded payloads from a PDF.
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.0 KB, as published. Nobody here has run it
Analyzing Malicious PDFs
When to Use
- You have a suspicious PDF (often from phishing) and must determine if it is weaponized.
- You need to find auto-executing actions, embedded JavaScript, launch actions, or embedded files.
- You want to extract and decode suspicious streams safely.
Do not use a PDF reader to "just look" — opening in a viewer can trigger the very actions you are investigating. Parse the structure statically.
Prerequisites
- A PDF object parser (Python, or pdfid/pdf-parser/peepdf); the sample handled inertly.
Safety & Handling
- Never open the PDF in a graphical reader; parse the raw object structure only.
- Defang any extracted URLs and store embedded payloads password-protected.
Workflow
Step 1: Triage the object inventory
Count high-risk keywords: /JavaScript, /JS, /OpenAction, /AA, /Launch, /EmbeddedFile,
/URI, /RichMedia. Their presence (especially auto-actions) flags weaponization.
python scripts/analyst.py triage sample.pdf
Step 2: Locate auto-execution triggers
Resolve /OpenAction and /AA (additional actions) to see what runs on open, and any /Launch
actions that spawn external programs.
Step 3: Extract and decode streams
Pull JavaScript and suspicious streams, applying filters (/FlateDecode, /ASCIIHexDecode) to
get the cleartext; deobfuscate layered JS as needed.
Step 4: Recover payloads and IOCs
Extract embedded files and URIs; hash payloads, defang URLs, and route extracted executables to PE analysis.
Validation
- Auto-execution triggers (
/OpenAction,/AA,/Launch) are resolved to concrete actions. - JavaScript/streams are decoded through their filters, not left encoded.
- Embedded payloads and URIs are extracted, hashed, and defanged.
Pitfalls
- Opening the PDF in a reader and triggering the payload.
- Missing object-stream (
/ObjStm) compressed objects that hide the malicious content. - Stopping at the first JS layer when it is multiply obfuscated.
References
- See
references/api-reference.mdfor the PDF triage parser. - ISO 32000 and Didier Stevens' PDF tools (linked in frontmatter).