analyzing-malicious-pdfs
starsforks
How to install analyzing-malicious-pdfs?
meltedinhex/analyst-ai-pack/analyzing-malicious-pdfs
$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-pdfsAnalyzes malicious PDF documents: parsing the object structure for JavaScript,
SKILL.md
| 1 | # Analyzing Malicious PDFs |
| 2 | |
| 3 | ## When to Use |
| 4 | |
| 5 | - You have a suspicious PDF (often from phishing) and must determine if it is weaponized. |
| 6 | - You need to find auto-executing actions, embedded JavaScript, launch actions, or embedded files. |
| 7 | - You want to extract and decode suspicious streams safely. |
| 8 | |
| 9 | **Do not use** a PDF reader to "just look" — opening in a viewer can trigger the very actions you |
| 10 | are investigating. Parse the structure statically. |
| 11 | |
| 12 | ## Prerequisites |
| 13 | |
| 14 | - A PDF object parser (Python, or pdfid/pdf-parser/peepdf); the sample handled inertly. |
| 15 | |
| 16 | ## Safety & Handling |
| 17 | |
| 18 | - Never open the PDF in a graphical reader; parse the raw object structure only. |
| 19 | - Defang any extracted URLs and store embedded payloads password-protected. |
| 20 | |
| 21 | ## Workflow |
| 22 | |
| 23 | ### Step 1: Triage the object inventory |
| 24 | |
| 25 | Count high-risk keywords: `/JavaScript`, `/JS`, `/OpenAction`, `/AA`, `/Launch`, `/EmbeddedFile`, |
| 26 | `/URI`, `/RichMedia`. Their presence (especially auto-actions) flags weaponization. |
| 27 | |
| 28 | ```bash |
| 29 | python scripts/analyst.py triage sample.pdf |
| 30 | ``` |
| 31 | |
| 32 | ### Step 2: Locate auto-execution triggers |
| 33 | |
| 34 | Resolve `/OpenAction` and `/AA` (additional actions) to see what runs on open, and any `/Launch` |
| 35 | actions that spawn external programs. |
| 36 | |
| 37 | ### Step 3: Extract and decode streams |
| 38 | |
| 39 | Pull JavaScript and suspicious streams, applying filters (`/FlateDecode`, `/ASCIIHexDecode`) to |
| 40 | get the cleartext; deobfuscate layered JS as needed. |
| 41 | |
| 42 | ### Step 4: Recover payloads and IOCs |
| 43 | |
| 44 | Extract embedded files and URIs; hash payloads, defang URLs, and route extracted executables to |
| 45 | PE analysis. |
| 46 | |
| 47 | ## Validation |
| 48 | |
| 49 | - Auto-execution triggers (`/OpenAction`, `/AA`, `/Launch`) are resolved to concrete actions. |
| 50 | - JavaScript/streams are decoded through their filters, not left encoded. |
| 51 | - Embedded payloads and URIs are extracted, hashed, and defanged. |
| 52 | |
| 53 | ## Pitfalls |
| 54 | |
| 55 | - Opening the PDF in a reader and triggering the payload. |
| 56 | - Missing object-stream (`/ObjStm`) compressed objects that hide the malicious content. |
| 57 | - Stopping at the first JS layer when it is multiply obfuscated. |
| 58 | |
| 59 | ## References |
| 60 | |
| 61 | - See [`references/api-reference.md`](references/api-reference.md) for the PDF triage parser. |
| 62 | - ISO 32000 and Didier Stevens' PDF tools (linked in frontmatter). |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
