Analyzing Malicious PDF With Peepdf

TL;DR

• 目的：Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspic…
• 适用：恶意软件分析/逆向
• 输入：目标组件/版本 + 漏洞 POC 标识
• 输出：可复现 POC + 利用步骤
• 红线：仅限授权范围内；破坏性 POC 先用只读变体；全 RCE 前明确批准
• 关联：上游：003-src-session-start → 下游：138-analyzing-malicious-url-with-urlscan, 142-analyzing-pdf-malware-with-pdfid, 139-analyzing-malware-behavior-with-cuckoo-sandbox

Analyzing Malicious PDF with peepdf

When to Use

• When triaging suspicious PDF attachments from phishing emails
• During malware analysis of PDF-based exploit documents
• When extracting embedded JavaScript, shellcode, or executables from PDFs
• For forensic examination of weaponized document artifacts
• When building detection signatures for PDF-based threats

Prerequisites

• Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
• pdfid.py and pdf-parser.py from Didier Stevens suite
• Isolated analysis environment (VM or sandbox)
• Optional: PyV8 for JavaScript emulation within peepdf
• Optional: Pylibemu for shellcode analysis

Workflow

1. Triage with pdfid: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
2. Interactive Analysis: Open PDF in peepdf interactive mode to explore object structure.
3. Identify Suspicious Objects: Locate objects containing JavaScript, streams, or encoded data.
4. Extract Content: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
5. Deobfuscate JavaScript: Analyze extracted JS for shellcode, heap sprays, or exploit code.
6. Check VirusTotal: Use peepdf vtcheck to cross-reference file hash with AV detections.
7. Generate IOCs: Extract URLs, domains, hashes, and shellcode signatures.

Key Concepts

Tools & Systems

Output Format

Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]

Advanced Techniques

Extract JavaScript from PDF

# 用 peepdf 提取 JS
peepdf -f malware.pdf -c
PP> js  # 列出 JS 对象
PP> extract_js  # 提取到文件

Detect Obfuscated JavaScript

# 查找混淆特征
peepdf -f malware.pdf -c
PP> tree  # 查看对象树
PP> info  # 元数据

YARA Scanning on PDFs

rule suspicious_pdf {
    strings:
        $js = "/JavaScript"
        $openaction = "/OpenAction"
        $embedded = "/EmbeddedFile"
    condition:
        all of them
}