Analyzing malicious pdf with peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.From its SKILL.md
npx -y skills add Mikaru0Mystic/sectinel --skill analyzing-malicious-pdf-with-peepdfAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 11 stars11 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its file declares
Copied from the file, not written here
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
2.9 KB, 577 tokens by cl100k_base, as published. Nobody here has run it
Analyzing Malicious PDF with peepdf
When to Use
- When triaging suspicious PDF attachments from phishing emails
- During malware analysis of PDF-based exploit documents
- When extracting embedded JavaScript, shellcode, or executables from PDFs
- For forensic examination of weaponized document artifacts
- When building detection signatures for PDF-based threats
Prerequisites
- Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
- pdfid.py and pdf-parser.py from Didier Stevens suite
- Isolated analysis environment (VM or sandbox)
- Optional: PyV8 for JavaScript emulation within peepdf
- Optional: Pylibemu for shellcode analysis
Workflow
- Triage with pdfid: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
- Interactive Analysis: Open PDF in peepdf interactive mode to explore object structure.
- Identify Suspicious Objects: Locate objects containing JavaScript, streams, or encoded data.
- Extract Content: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
- Deobfuscate JavaScript: Analyze extracted JS for shellcode, heap sprays, or exploit code.
- Check VirusTotal: Use peepdf vtcheck to cross-reference file hash with AV detections.
- Generate IOCs: Extract URLs, domains, hashes, and shellcode signatures.
Key Concepts
| Concept | Description |
|---|---|
| /OpenAction | Automatic action executed when PDF is opened |
| /JavaScript /JS | Embedded JavaScript code in PDF objects |
| /Launch | Action that launches external applications |
| /EmbeddedFile | File embedded within the PDF structure |
| FlateDecode | zlib compression filter used to hide content |
| Object Streams | PDF objects stored in compressed streams |
Tools & Systems
| Tool | Purpose |
|---|---|
| peepdf / peepdf-3 | Interactive PDF analysis with JS emulation |
| pdfid.py | Quick triage scanning for suspicious keywords |
| pdf-parser.py | Deep object-level PDF parsing |
| VirusTotal | Hash lookup and AV detection cross-reference |
| CyberChef | Decode and transform extracted payloads |
Output Format
Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]
What ships with it: 3 files
22.5 KB alongside SKILL.md, 1 of them executable
references/
- api-reference.md3.2 KB
scripts/
- agent.pyruns8.2 KB
- LICENSE11.0 KB
Gives 0 of the 12 instructions most pdf office docs skills give in 577 tokens
Counted across 569 of the 585 authors here whose files we hold, read 2026-09-06
- Ensure every slide fits inside one viewportin 20 of 569, across 11 files
- Check for product marketing context firstin 15 of 569, across 5 files
- Ask for the minimum neededin 15 of 569, across 5 files
- Set the API key environment variablein 15 of 569, across 10 files
- Support keyboard and touch navigationin 14 of 569, across 5 files
- Match the buyer stagein 13 of 569, across 3 files
- Split overflowing content into multiple slidesin 12 of 569, across 3 files
- Set page size explicitly for consistent resultsin 12 of 569, across 5 files
- Convert documents to markdown using pandocin 12 of 569, across 6 files
- Read STYLE_PRESETS.md before generatingin 12 of 569, across 7 files
- Send multipart POST requests to the APIin 12 of 569, across 7 files
- Use smart quotes for new contentin 11 of 569, across 4 files
Said here and by no other author read
- Analyze extracted JavaScript for exploit code
- Cross-reference file hash with VirusTotal
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.