analyzing-malicious-pdf-with-peepdf
Lets your agent analyze suspicious PDF files. It looks for hidden code that could be dangerous, like what's used in phishing emails.
What it does
This tool analyzes suspicious PDF files to find hidden malicious code, like JavaScript or dangerous programs. It helps understand what the PDF file is trying to do.
When to use it
- ✓When receiving a strange PDF via email.
- ✓When investigating a PDF file that might contain a virus.
- ✓When looking for dangerous code inside a PDF.
Example of what to ask your AI
“Analyze this PDF and tell me if it's dangerous and what it does.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
The tool first scans the PDF for danger signs. Then, it dives into the file to look at hidden code, like JavaScript, and tries to extract and understand what it does.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malicious-pdf-with-peepdfOr download just the file:
curl -L https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/main/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Analyzing Malicious PDF with peepdf
When to Use
- When triaging suspicious PDF attachments from phishing emails
- During malware analysis of PDF-based exploit documents
- When extracting embedded JavaScript, shellcode, or executables from PDFs
- For forensic examination of weaponized document artifacts
- When building detection signatures for PDF-based threats
Prerequisites
- Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
- pdfid.py and pdf-parser.py from Didier Stevens suite
- Isolated analysis environment (VM or sandbox)
- Optional: PyV8 for JavaScript emulation within peepdf
- Optional: Pylibemu for shellcode analysis
Workflow
- Triage with pdfid: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
- Interactive Analysis: Open PDF in peepdf interactive mode to explore object structure.
- Identify Suspicious Objects: Locate objects containing JavaScript, streams, or encoded data.
- Extract Content: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
- Deobfuscate JavaScript: Analyze extracted JS for shellcode, heap sprays, or exploit code.
- Check VirusTotal: Use peepdf vtcheck to cross-reference file hash with AV detections.
- Generate IOCs: Extract URLs, domains, hashes, and shellcode signatures.
Key Concepts
| Concept | Description |
|---|---|
| /OpenAction | Automatic action executed when PDF is opened |
| /JavaScript /JS | Embedded JavaScript code in PDF objects |
| /Launch | Action that launches external applications |
| /EmbeddedFile | File embedded within the PDF structure |
| FlateDecode | zlib compression filter used to hide content |
| Object Streams | PDF objects stored in compressed streams |
Tools & Systems
| Tool | Purpose |
|---|---|
| peepdf / peepdf-3 | Interactive PDF analysis with JS emulation |
| pdfid.py | Quick triage scanning for suspicious keywords |
| pdf-parser.py | Deep object-level PDF parsing |
| VirusTotal | Hash lookup and AV detection cross-reference |
| CyberChef | Decode and transform extracted payloads |
Output Format
Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]
FAQ
What are '/JS' or '/OpenAction' in a PDF?
These are codes or instructions within the PDF that can do things automatically when you open the file, like run a program or show a specific page, which can be dangerous.
What is 'FlateDecode'?
It's a way to compress and hide information within the PDF. The tool can 'decompress' it to see what was hidden.
Do I need to install anything to use it?
Yes, you need to have Python installed and some specific tools like 'peepdf', 'pdfid', and 'pdf-parser'. It's recommended to use a safe environment, like a virtual machine, to avoid risks.
Details
Original description by the author
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF threats.
Popularity
- GitHub stars
- 35k
- Ranking position
- #5462
- License
- Apache-2.0
- Updated
- 8/31/2026
Comments
- …
More skills from this repository
abusing-dpapi-for-credential-access
Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.
mukul975/Anthropic-Cybersecurity-Skills
abusing-shadow-credentials-for-privesc
Teaches your AI agent to write clear, well-structured text.
mukul975/Anthropic-Cybersecurity-Skills
achieving-cmmc-level-2-compliance
Helps your agent prepare an environment for CMMC Level 2 compliance. It implements security requirements and manages necessary documentation.
mukul975/Anthropic-Cybersecurity-Skills
acquiring-disk-image-with-dd-and-dcfldd
Helps your agent create exact copies of hard drives. This is useful for ensuring no information is lost or altered during investigations.
mukul975/Anthropic-Cybersecurity-Skills
Similar skills
data-throughput-accelerator
Makes your agent speed up the movement of large data volumes. It finds bottlenecks and ensures data is transferred quickly and correctly.
affaan-m/ECC
inventory-demand-planning
Helps your agent predict product demand in stores. It optimizes stock and plans when to run promotions to sell more.
affaan-m/ECC
market-research
Helps your agent conduct market research and competitive analysis. Provides summaries with source attribution.
affaan-m/ECC