agentsclimarketplace

Analyzing malicious pdfs

Skill meltedinhex/analyst-ai-pack/skills/analyzing-malicious-pdfs

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-pdfs

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Analyzes malicious PDF documents: parsing the object structure for JavaScript, OpenAction/launch triggers, embedded files, and URIs, then extracting and decoding suspicious streams without opening the document in a reader. Activates for requests to analyze a malicious PDF, inspect PDF JavaScript, or extract embedded payloads from a PDF.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.0 KB, as published. Nobody here has run it

Analyzing Malicious PDFs

When to Use

  • You have a suspicious PDF (often from phishing) and must determine if it is weaponized.
  • You need to find auto-executing actions, embedded JavaScript, launch actions, or embedded files.
  • You want to extract and decode suspicious streams safely.

Do not use a PDF reader to "just look" — opening in a viewer can trigger the very actions you are investigating. Parse the structure statically.

Prerequisites

  • A PDF object parser (Python, or pdfid/pdf-parser/peepdf); the sample handled inertly.

Safety & Handling

  • Never open the PDF in a graphical reader; parse the raw object structure only.
  • Defang any extracted URLs and store embedded payloads password-protected.

Workflow

Step 1: Triage the object inventory

Count high-risk keywords: /JavaScript, /JS, /OpenAction, /AA, /Launch, /EmbeddedFile, /URI, /RichMedia. Their presence (especially auto-actions) flags weaponization.

python scripts/analyst.py triage sample.pdf

Step 2: Locate auto-execution triggers

Resolve /OpenAction and /AA (additional actions) to see what runs on open, and any /Launch actions that spawn external programs.

Step 3: Extract and decode streams

Pull JavaScript and suspicious streams, applying filters (/FlateDecode, /ASCIIHexDecode) to get the cleartext; deobfuscate layered JS as needed.

Step 4: Recover payloads and IOCs

Extract embedded files and URIs; hash payloads, defang URLs, and route extracted executables to PE analysis.

Validation

  • Auto-execution triggers (/OpenAction, /AA, /Launch) are resolved to concrete actions.
  • JavaScript/streams are decoded through their filters, not left encoded.
  • Embedded payloads and URIs are extracted, hashed, and defanged.

Pitfalls

  • Opening the PDF in a reader and triggering the payload.
  • Missing object-stream (/ObjStm) compressed objects that hide the malicious content.
  • Stopping at the first JS layer when it is multiply obfuscated.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.