Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Analyzing Malicious PDF with peepdf · mukul975 | DecimalAI

Analyzing Malicious PDF With Peepdf

SkillScore27Maintained

analyzing-malicious-pdf-with-peepdf

Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md

decimalai skills pull analyzing-malicious-pdf-with-peepdf --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md https://app.decimal.ai/s/analyzing-malicious-pdf-with-peepdf/SKILL.md

Raw file: /s/analyzing-malicious-pdf-with-peepdf/SKILL.md ↗ · machine-readable summary at /s/analyzing-malicious-pdf-with-peepdf.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

—+8% tokens0% turns27% of whole cases pass with skill (6/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	—	—
case-15	✗→✓	▲ Improved	—	—
case-08	✗→✓	▲ Improved	—	—
case-20	✓→✓	＝ Same ✓	—	—
case-19	✓→✓	＝ Same ✓	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/analyzing-malicious-pdf-with-peepdf/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Analyzing Malicious PDF with peepdf

When to Use

When triaging suspicious PDF attachments from phishing emails
During malware analysis of PDF-based exploit documents
When extracting embedded JavaScript, shellcode, or executables from PDFs
For forensic examination of weaponized document artifacts
When building detection signatures for PDF-based threats

Prerequisites

Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
pdfid.py and pdf-parser.py from Didier Stevens suite
Isolated analysis environment (VM or sandbox)
Optional: PyV8 for JavaScript emulation within peepdf
Optional: Pylibemu for shellcode analysis

Workflow

Triage with pdfid: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
Interactive Analysis: Open PDF in peepdf interactive mode to explore object structure.
Identify Suspicious Objects: Locate objects containing JavaScript, streams, or encoded data.
Extract Content: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
Deobfuscate JavaScript: Analyze extracted JS for shellcode, heap sprays, or exploit code.
Check VirusTotal: Use peepdf vtcheck to cross-reference file hash with AV detections.
Generate IOCs: Extract URLs, domains, hashes, and shellcode signatures.

Key Concepts

| Concept | Description | |---------|-------------| | /OpenAction | Automatic action executed when PDF is opened | | /JavaScript /JS | Embedded JavaScript code in PDF objects | | /Launch | Action that launches external applications | | /EmbeddedFile | File embedded within the PDF structure | | FlateDecode | zlib compression filter used to hide content | | Object Streams | PDF objects stored in compressed streams |

Tools & Systems

| Tool | Purpose | |------|---------| | peepdf / peepdf-3 | Interactive PDF analysis with JS emulation | | pdfid.py | Quick triage scanning for suspicious keywords | | pdf-parser.py | Deep object-level PDF parsing | | VirusTotal | Hash lookup and AV detection cross-reference | | CyberChef | Decode and transform extracted payloads |

Output Format

Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]

Illustrative Want to see what analyzing-malicious-pdf-with-peepdf would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/27/2026, 23:44 UTC · 22 cases

Measured on 21 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+14%

27% vs 14%

Agent turns

1.0 vs 1.0

Tokens

+8%

1,822.14 vs 1,688.57

fail → pass · 3pass → pass · 3fail → fail · 16

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-03 Our SOC received a suspicious document `employee_survey.pdf` suspected of carrying a PDF-based exploit. Please inspect the PDF streams and objects to extract embedded code and IOCs. I need an Analysis Report structured with standard tracking headers, including file hash, suspicious keyword flags, list of JavaScript objects, extracted URLs, shellcode analysis results, count and types of embedded files, VirusTotal scan metrics, and the evaluated risk level.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 In object 7 of `purchase_order.pdf`, we found an action dictionary entry `/Launch`. What operational behavior does this element trigger when processed by a document viewer?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 In `tax_form.pdf`, we found a dictionary entry referencing `/EmbeddedFile`. What threat artifact does this structural element denote?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We detected an endpoint alert triggered by `urgent_invoice.pdf`. Can you analyze this artifact for embedded exploits or malicious code? Deliver an analysis report that includes the hash, key PDF structural elements flagged (like launch or script keywords), specific object IDs hosting JS code, any extracted domains or URLs, detection of shellcode payload, embedded payload attachments, VT detection numbers, and a final risk classification from Low to Critical.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 When analyzing `rfp_response.pdf` with `pdf-parser.py` to extract raw stream content from object 12 into a file named `payload.bin`, which command-line flag specifies dumping the decoded stream?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 We have `statement_scan.pdf` which contains obfuscated object streams. What interactive Python CLI analysis framework allows navigating object trees, extracting streams, and performing inline VirusTotal checks?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 In modern PDF files, multiple structural objects are frequently packed inside compressed stream containers to obscure object IDs from naive regex tools. What is the standard PDF specification name for these containers?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 I need you to perform a forensic triage on a suspicious file named `phishing_attachment_20231012.pdf` that came through our mail gateway. Please run a complete analysis on the document structure and provide a summary report. The output should follow standard malicious document analysis reporting, listing the file name, calculated SHA-256 checksum, identified suspicious PDF keywords, object IDs containing JavaScript, extracted network URLs, whether shellcode was detected, embedded file counts and types, VirusTotal detection statistics, and an overall assigned risk level.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 When provisioning a dedicated malware analysis VM for PDF inspection, what optional Python libraries extend analysis capability to execute embedded JavaScript in memory and emulate shellcode execution?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We intercepted a malicious Word document named `invoice_2023.docm` containing auto-executing macros. Please analyze the VBA macro code inside this Microsoft Word file to extract obfuscated PowerShell payloads and suspicious functions.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 We are setting up an automated Python 3.8+ virtual environment to run interactive PDF triage. What exact PyPI package name should be specified in `requirements.txt` to install the modernized peepdf tool?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 When beginning analysis of an untrusted file `rfq_doc.pdf`, what sequence step should be conducted prior to launching an interactive inspection session?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 We are reverse engineering a buffer overflow vulnerability in `AcroRd32.dll` disassembly using Ghidra to write a patch for Adobe Reader. What disassembly and debugging steps should we follow to identify the vulnerable function in the DLL?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 While analyzing stream object 12 in `phishing_doc.pdf`, we found two encoding filters applied to hide the payload. What filter denotes standard zlib/deflate stream compression, and what filter denotes ASCII hexadecimal encoding?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 During forensic triage of `bank_statement.pdf`, object ID 14 is flagged for hosting compressed encoded stream data. What procedure should be applied to inspect the uncompressed payload contents?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Our legal department needs to verify the cryptographic validity of the digital signature embedded in `vendor_agreement.pdf` to confirm signing certificate validity and signature integrity. How should we perform this PKI verification?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 After extracting a deobfuscated array of hex-encoded bytes from object 5 of `resume_eval.pdf`, what multi-stage web and offline payload transformation utility is recommended for decoding byte arrays and shellcode?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We want to quickly scan a batch of 500 email PDF attachments to identify flags like script execution or embedded files without executing interactive python shells. What script from the Didier Stevens suite is designed for initial keyword triage scanning?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We are analyzing `suspicious_spec.pdf` inside an interactive PDF CLI session. What specific command queries VirusTotal to retrieve hash detection metrics directly within the console?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 When performing initial static scanning on `malicious_payload.pdf` using triage tools, what specific PDF catalog and object dictionary keys indicate automatic code execution upon opening and embedded script blocks?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 When keyword triage indicates that `invoice_9921.pdf` contains hidden streams, what script from Didier Stevens is intended for deep object-level extraction and dumping specific object content by ID?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 We want to search `securities_report.pdf` for any PDF objects referencing `/JavaScript` using `pdf-parser.py`. What command-line option passes the search string to scan all object dictionary entries?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +14 percentage points is the difference between those two pass rates over the 21 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 13.6%
Pass rate with the skill: 27.3%
Cases attempted: 22
Cases counted toward lift: 21
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/27/2026, 23:44 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run27

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+26% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.