analyzing-pdf-malware-with-pdfid

Featured

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.

Data & Documents 12,642 stars 1468 forks Updated today Apache-2.0

Install

View on GitHub

Quality Score: 99/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Analyzing PDF Malware with PDFiD ## When to Use - A suspicious PDF attachment has been flagged by email security or reported by a user - You need to determine if a PDF contains embedded JavaScript, shellcode, or exploit code - Triaging PDF documents before opening them in a sandbox or analysis environment - Extracting embedded executables, scripts, or URLs from malicious PDF objects - Analyzing PDF exploit kits targeting Adobe Reader or other PDF viewer vulnerabilities **Do not use** for analyzing the rendered visual content of a PDF; this is for structural analysis of the PDF file format for malicious objects. ## Prerequisites - Python 3.8+ with Didier Stevens' PDF tools installed (`pip install pdfid pdf-parser`) - peepdf installed for interactive PDF analysis (`pip install peepdf`) - pdftotext from poppler-utils for extracting text content safely - YARA with PDF-specific rules for malware family identification - Isolated analysis VM without a PDF reader installed (prevent accidental opening) - CyberChef for decoding embedded Base64, hex, or deflate streams ## Workflow ### Step 1: Initial Triage with PDFiD Scan the PDF for suspicious keywords and structures: ```bash # Run PDFiD to identify suspicious elements pdfid suspect.pdf # Expected output analysis: # /JS - JavaScript (HIGH risk) # /JavaScript - JavaScript object (HIGH risk) # /AA - Auto-Action triggered on open (HIGH risk) # /OpenAction - Action on document open (HIGH risk) # /Launch...

Details

Author
mukul975
Repository
mukul975/Anthropic-Cybersecurity-Skills
Created
3 months ago
Last Updated
today
Language
Python
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

Data & Documents Listed

analyzing-malicious-pdf-with-peepdf

Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.

6 Updated today
26zl
Data & Documents Featured

analyzing-malicious-pdf-with-peepdf

Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.

12,642 Updated today
mukul975
Data & Documents Featured

analyzing-macro-malware-in-office-documents

Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques. Uses olevba, oledump, and VBA deobfuscation to extract the attack chain. Activates for requests involving Office macro analysis, VBA malware investigation, maldoc analysis, or document-based threat examination.

12,642 Updated today
mukul975
Data & Documents Listed

analyzing-macro-malware-in-office-documents

Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques. Uses olevba, oledump, and VBA deobfuscation to extract the attack chain. Activates for requests involving Office macro analysis, VBA malware investigation, maldoc analysis, or document-based threat examination.

6 Updated today
26zl
Data & Documents Listed

malware-analyst

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

335 Updated today
aiskillstore