# Analyzing Malicious PDF With Peepdf

> Perform analyzing malicious pdf with peepdf assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

- Skill: `wufufu770/analyzing-malicious-pdf-with-peepdf` (Agent Skill)
- Install (CLI): `npx skillmds@latest add wufufu770/analyzing-malicious-pdf-with-peepdf`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/analyzing-malicious-pdf-with-peepdf/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: wufufu770 (https://skillmd.com/u/wufufu770)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wufufu770/analyzing-malicious-pdf-with-peepdf

---


## TL;DR

- **目的**：Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspic…
- **适用**：恶意软件分析/逆向
- **输入**：目标组件/版本 + 漏洞 POC 标识
- **输出**：可复现 POC + 利用步骤
- **红线**：**仅限授权范围内**；破坏性 POC 先用只读变体；全 RCE 前明确批准
- **关联**：上游：003-src-session-start → 下游：138-analyzing-malicious-url-with-urlscan, 142-analyzing-pdf-malware-with-pdfid, 139-analyzing-malware-behavior-with-cuckoo-sandbox

# Analyzing Malicious PDF with peepdf

## When to Use

- When triaging suspicious PDF attachments from phishing emails
- During malware analysis of PDF-based exploit documents
- When extracting embedded JavaScript, shellcode, or executables from PDFs
- For forensic examination of weaponized document artifacts
- When building detection signatures for PDF-based threats

## Prerequisites

- Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
- pdfid.py and pdf-parser.py from Didier Stevens suite
- Isolated analysis environment (VM or sandbox)
- Optional: PyV8 for JavaScript emulation within peepdf
- Optional: Pylibemu for shellcode analysis

## Workflow

1. **Triage with pdfid**: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
2. **Interactive Analysis**: Open PDF in peepdf interactive mode to explore object structure.
3. **Identify Suspicious Objects**: Locate objects containing JavaScript, streams, or encoded data.
4. **Extract Content**: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
5. **Deobfuscate JavaScript**: Analyze extracted JS for shellcode, heap sprays, or exploit code.
6. **Check VirusTotal**: Use peepdf vtcheck to cross-reference file hash with AV detections.
7. **Generate IOCs**: Extract URLs, domains, hashes, and shellcode signatures.

## Key Concepts

| Concept | Description |
|---------|-------------|
| /OpenAction | Automatic action executed when PDF is opened |
| /JavaScript /JS | Embedded JavaScript code in PDF objects |
| /Launch | Action that launches external applications |
| /EmbeddedFile | File embedded within the PDF structure |
| FlateDecode | zlib compression filter used to hide content |
| Object Streams | PDF objects stored in compressed streams |

## Tools & Systems

| Tool | Purpose |
|------|---------|
| peepdf / peepdf-3 | Interactive PDF analysis with JS emulation |
| pdfid.py | Quick triage scanning for suspicious keywords |
| pdf-parser.py | Deep object-level PDF parsing |
| VirusTotal | Hash lookup and AV detection cross-reference |
| CyberChef | Decode and transform extracted payloads |

## Output Format

```
Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]
```

## Advanced Techniques

### Extract JavaScript from PDF
```bash
# 用 peepdf 提取 JS
peepdf -f malware.pdf -c
PP> js  # 列出 JS 对象
PP> extract_js  # 提取到文件
```

### Detect Obfuscated JavaScript
```bash
# 查找混淆特征
peepdf -f malware.pdf -c
PP> tree  # 查看对象树
PP> info  # 元数据
```

### YARA Scanning on PDFs
```yara
rule suspicious_pdf {
    strings:
        $js = "/JavaScript"
        $openaction = "/OpenAction"
        $embedded = "/EmbeddedFile"
    condition:
        all of them
}
```