跳到主要内容
知知仓学习社ZHICANG

analyzing-malicious-pdf-with-peepdf

Perform static analysis of malicious PDF documents using peepdf, pdfid,

执行命令读文件写文件严重 0 · 高危 6mukul975/Anthropic-Cybersecurity-Skills

它会碰到什么

扫了多少4 个文本文件，26 KB
它会碰到什么执行命令读文件写文件
命中总数9 处
命中统计严重 0 · 高 6 · 中 3 · 低 0
逐条看命中（6 条严重或高危）
  • 高 scripts/agent.py:40exec-spawn
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
  • 高 scripts/agent.py:42exec-spawn
    result = subprocess.run(alt_cmd, capture_output=True, text=True, timeout=120)
  • 高 scripts/agent.py:62exec-spawn
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
  • 高 scripts/agent.py:64exec-spawn
    result = subprocess.run(alt_cmd, capture_output=True, text=True, timeout=120)
  • 高 scripts/agent.py:101exec-spawn
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
  • 高 scripts/agent.py:110exec-spawn
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)

这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。

技能内容

Analyzing Malicious PDF with peepdf

When to Use

  • When triaging suspicious PDF attachments from phishing emails
  • During malware analysis of PDF-based exploit documents
  • When extracting embedded JavaScript, shellcode, or executables from PDFs
  • For forensic examination of weaponized document artifacts
  • When building detection signatures for PDF-based threats

Prerequisites

  • Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
  • pdfid.py and pdf-parser.py from Didier Stevens suite
  • Isolated analysis environment (VM or sandbox)
  • Optional: PyV8 for JavaScript emulation within peepdf
  • Optional: Pylibemu for shellcode analysis

Workflow

  1. Triage with pdfid: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
  2. Interactive Analysis: Open PDF in peepdf interactive mode to explore object structure.
  3. Identify Suspicious Objects: Locate objects containing JavaScript, streams, or encoded data.
  4. Extract Content: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
  5. Deobfuscate JavaScript: Analyze extracted JS for shellcode, heap sprays, or exploit code.
  6. Check VirusTotal: Use peepdf vtcheck to cross-reference file hash with AV detections.
  7. Generate IOCs: Extract URLs, domains, hashes, and shellcode signatures.

Key Concepts

| Concept | Description |

|---------|-------------|

| /OpenAction | Automatic action executed when PDF is opened |

| /JavaScript /JS | Embedded JavaScript code in PDF objects |

| /Launch | Action that launches external applications |

| /EmbeddedFile | File embedded within the PDF structure |

| FlateDecode | zlib compression filter used to hide content |

| Object Streams | PDF objects stored in compressed streams |

Tools & Systems

| Tool | Purpose |

|------|---------|

| peepdf / peepdf-3 | Interactive PDF analysis with JS emulation |

| pdfid.py | Quick triage scanning for suspicious keywords |

| pdf-parser.py | Deep object-level PDF parsing |

| VirusTotal | Hash lookup and AV detection cross-reference |

| CyberChef | Decode and transform extracted payloads |

Output Format

Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]

想直接用这个技能？

本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。

去原始仓库

它属于哪个仓库

仓库mukul975/Anthropic-Cybersecurity-Skills
星标★ 32,865
本站分层T1
该仓技能数818
原文件路径skills/analyzing-malicious-pdf-with-peepdf/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 818 个技能