Skip to main content
affpapa.org
RU EN
skill CX Codex

analyzing-malicious-pdf-with-peepdf — Claude Code skill

This skill statically inspects suspicious PDFs with peepdf, pdfid.py, and pdf-parser.py. Use it to triage attachments, inspect exploit documents, and collect detection indicators.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malicious-pdf-with-peepdf -a claude-code
Open on GitHub

What analyzing-malicious-pdf-with-peepdf does

The skill follows a PDF triage workflow. It starts with pdfid.py to scan for suspicious keywords, then opens the file in interactive peepdf mode. It can locate objects containing JavaScript, streams, or encoded data, dump suspicious content, and decode FlateDecode or ASCIIHexDecode filters.

The workflow also covers JavaScript deobfuscation, shellcode checks, hash lookup with VirusTotal, and IOC collection for URLs, domains, hashes, and shellcode signatures. Prerequisites include Python 3.8+ with peepdf-3, plus pdfid.py and pdf-parser.py from the Didier Stevens suite. An isolated VM or sandbox is needed before analysis because the file may be an exploit document. PyV8 and Pylibemu are optional additions for JavaScript emulation and shellcode analysis.

What it helps with

  • triage a suspicious PDF attachment
  • locate embedded JavaScript and shellcode
  • extract encoded streams and suspicious objects
  • collect URLs, domains, hashes, and other IOCs
  • prepare indicators for PDF threat signatures

Example prompts for the agent

  • Analyze filename.pdf as a suspicious attachment, inspect its objects, and write a report with extracted JavaScript, shellcode, and IOCs.
  • Run an initial pdfid.py triage on filename.pdf, then explore it in peepdf and decode suspicious streams.
  • Perform static analysis of filename.pdf, check its hash with VirusTotal, and list indicators for a PDF threat signature.

How to install analyzing-malicious-pdf-with-peepdf

1Skills CLI (Vercel)

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malicious-pdf-with-peepdf -a claude-code

2Manually: put the files in place

~/.claude/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/analyzing-malicious-pdf-with-peepdf/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about analyzing-malicious-pdf-with-peepdf

How do I install analyzing-malicious-pdf-with-peepdf in Claude Code?

Run npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malicious-pdf-with-peepdf -a claude-code, run the same command again, then check ~/.claude/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md.

What does analyzing-malicious-pdf-with-peepdf do?

It guides static PDF analysis with pdfid.py, peepdf, and pdf-parser.py, including suspicious-object discovery, JavaScript and shellcode extraction, stream decoding, and IOC collection.

What do I need before using analyzing-malicious-pdf-with-peepdf?

Prepare Python 3.8+ with peepdf-3, pdfid.py, pdf-parser.py, and an isolated VM or sandbox. PyV8 and Pylibemu are optional components.

Source text

SKILL.md · Apache-2.0 
---
name: analyzing-malicious-pdf-with-peepdf
description: Perform static analysis of malicious PDF documents using peepdf, pdfid,
  and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
  Use when triaging a suspicious PDF attachment from a phishing email, analyzing a
  PDF-based exploit document, or building detection signatures for weaponized PDF
  threats.
domain: cybersecurity
subdomain: malware-analysis
tags:
- malware-analysis
- pdf
- peepdf
- pdfid
- pdf-parser
- static-analysis
- reverse-engineering
- dfir
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- DE.AE-02
- RS.AN-03
- ID.RA-01
- DE.CM-01
mitre_attack:
- T1204.002
- T1059.007
- T1027
- T1106
---

# Analyzing Malicious PDF with peepdf

## When to Use

- When triaging suspicious PDF attachments from phishing emails
- During malware analysis of PDF-based exploit documents
- When extracting embedded JavaScript, shellcode, or executables from PDFs
- For forensic examination of weaponized document artifacts
- When building detection signatures for PDF-based threats

## Prerequisites

- Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
- pdfid.py and pdf-parser.py from Didier Stevens suite
- Isolated analysis environment (VM or sandbox)
- Optional: PyV8 for JavaScript emulation within peepdf
- Optional: Pylibemu for shellcode analysis

## Workflow

1. **Triage with pdfid**: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
2. **Interactive Analysis**: Open PDF in peepdf interactive mode to explore object structure.
3. **Identify Suspicious Objects**: Locate objects containing JavaScript, streams, or encoded data.
4. **Extract Content**: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
5. **Deobfuscate JavaScript**: Analyze extracted JS for shellcode, heap sprays, or exploit code.
6. **Check VirusTotal**: Use peepdf vtcheck to cross-reference file hash with AV detections.
7. **Generate IOCs**: Extract URLs, domains, hashes, and shellcode signatures.

## Key Concepts

| Concept | Description |
|---------|-------------|
| /OpenAction | Automatic action executed when PDF is opened |
| /JavaScript /JS | Embedded JavaScript code in PDF objects |
| /Launch | Action that launches external applications |
| /EmbeddedFile | File embedded within the PDF structure |
| FlateDecode | zlib compression filter used to hide content |
| Object Streams | PDF objects stored in compressed streams |

## Tools & Systems

| Tool | Purpose |
|------|---------|
| peepdf / peepdf-3 | Interactive PDF analysis with JS emulation |
| pdfid.py | Quick triage scanning for suspicious keywords |
| pdf-parser.py | Deep object-level PDF parsing |
| VirusTotal | Hash lookup and AV detection cross-reference |
| CyberChef | Decode and transform extracted payloads |

## Output Format

```
Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]
```

© mahipal · Apache-2.0 · mukul975/Anthropic-Cybersecurity-Skills

Similar skills

All skills for Security →
PDF Watermark claude-office-skills Adds text and image watermarks, headers, footers, and page numbers to PDF documents. Helps brand drafts and confidential files before sharing. CX Codex +1 4,600installs pdf official openai A skill for reading, creating and reviewing PDFs where layout matters. Useful when the agent builds a document and needs to see how it renders. CX Codex +1 13,400installs pdf-extraction claude-office-skills Extracts tables and text from PDF files using pdfplumber. It helps when you need to pull tabular data into DataFrames or parse invoices. CX Codex +1 9,300installs remove-pdf-watermark pilioai Removes watermarks from PDF files via the official Pilio CLI and API. Useful when cleaning up editable documents or reconstructing pages with AI. CX Codex +1 7,400installs nano-pdf openclaw Edit PDF pages with plain text instructions through the nano-pdf CLI. Useful when you need to fix a typo or swap a heading without leaving your terminal. CX Codex +1 7,200installs minimax-pdf MiniMax-AI Generates professional PDFs with visual identity: reports, resumes, portfolios. Design is derived from document type, with consistent color and typography throughout. CX Codex +1 3,800installs

From the same set90

analyzing-malicious-url-with-urlscan This skill walks through scanning suspicious and phishing URLs with URLScan.io and pulling the screenshot, DOM, redirect chain and IOCs out of the report. CX Codex +1 411installs analyzing-web-server-logs-for-intrusion This skill parses Apache and Nginx logs, flags attack patterns, and builds a findings report. Use it for incident analysis or monitoring checks. CX Codex +1 408installs analyzing-cobalt-strike-beacon-configuration This skill extracts Cobalt Strike Beacon configuration from PE files and memory dumps. Use it to inspect C2 infrastructure, malleable C2 settings, and operator clues. CX Codex +1 404installs analyzing-ethereum-smart-contract-vulnerabilities Runs static and symbolic analysis on Solidity smart contracts using Slither and Mythril. Catches reentrancy, integer overflows, and access flaws before deployment. CX Codex +1 393installs testing-api-for-mass-assignment-vulnerability Tests APIs for mass assignment by adding undocumented request fields and checking whether they persist. Use it for profile, registration, and object-creation endpoints. CX Codex +1 385installs analyzing-network-covert-channels-in-malware Reads a PCAP for DNS tunneling, ICMP exfiltration and C2 hidden in HTTP. Useful during incident response or a hunt for exfiltration channels. CX Codex +1 372installs analyzing-network-flow-data-with-netflow This skill parses NetFlow v9 and IPFIX records to spot volumetric anomalies, port scanning, data exfiltration and C2 beaconing. CX Codex +1 372installs analyzing-heap-spray-exploitation A skill that reads memory dumps and finds heap spray artifacts: NOP sleds, executable injected regions and embedded shellcode. CX Codex +1 372installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor