[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F5VW3XV8TR2WMJ55WPAP4":3,"skill-same:01M71F5VW3XV8TR2WMJ55WPAP4":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":14,"repositoryHtmlUrl":70,"repositoryHomepageUrl":6,"ownerHtmlUrl":71,"ownerBlogUrl":6,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M71F5VW3XV8TR2WMJ55WPAP4","pdf-peepdf-analyze",null,"Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fpdf\u002Fpeepdf\u002Fanalyze\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"PDF","analyze","peepdf","pdf peepdf analyze","malicious","analysis","Bash","documents","cybersecurity","t1059","objects","static","cm","reverse-engineering","static-analysis","t1566","reverse","dfir","pdf-parser","pdfid","2026-11-10 10:12:30",false,"---\nname: pdf-peepdf-analyze\ndescription: Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware-analysis\n- pdf\n- peepdf\n- pdfid\n- pdf-parser\n- static-analysis\n- reverse-engineering\n- dfir\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1566\ncapec: []\n---\n\n# Analyzing Malicious PDF with peepdf\n\n## When to Use\n\n- When triaging suspicious PDF attachments from phishing emails\n- During malware analysis of PDF-based exploit documents\n- When extracting embedded JavaScript, shellcode, or executables from PDFs\n- For forensic examination of weaponized document artifacts\n- When building detection signatures for PDF-based threats\n\n## Prerequisites\n\n- Python 3.8+ with peepdf-3 installed (pip install peepdf-3)\n- pdfid.py and pdf-parser.py from Didier Stevens suite\n- Isolated analysis environment (VM or sandbox)\n- Optional: PyV8 for JavaScript emulation within peepdf\n- Optional: Pylibemu for shellcode analysis\n\n## Workflow\n\n1. **Triage with pdfid**: Scan PDF for suspicious keywords (\u002FJS, \u002FJavaScript, \u002FOpenAction, \u002FLaunch, \u002FEmbeddedFile).\n2. **Interactive Analysis**: Open PDF in peepdf interactive mode to explore object structure.\n3. **Identify Suspicious Objects**: Locate objects containing JavaScript, streams, or encoded data.\n4. **Extract Content**: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).\n5. **Deobfuscate JavaScript**: Analyze extracted JS for shellcode, heap sprays, or exploit code.\n6. **Check VirusTotal**: Use peepdf vtcheck to cross-reference file hash with AV detections.\n7. **Generate IOCs**: Extract URLs, domains, hashes, and shellcode signatures.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| \u002FOpenAction | Automatic action executed when PDF is opened |\n| \u002FJavaScript \u002FJS | Embedded JavaScript code in PDF objects |\n| \u002FLaunch | Action that launches external applications |\n| \u002FEmbeddedFile | File embedded within the PDF structure |\n| FlateDecode | zlib compression filter used to hide content |\n| Object Streams | PDF objects stored in compressed streams |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| peepdf \u002F peepdf-3 | Interactive PDF analysis with JS emulation |\n| pdfid.py | Quick triage scanning for suspicious keywords |\n| pdf-parser.py | Deep object-level PDF parsing |\n| VirusTotal | Hash lookup and AV detection cross-reference |\n| CyberChef | Decode and transform extracted payloads |\n\n## Output Format\n\n```\nAnalysis Report: PDF-MAL-[DATE]-[SEQ]\nFile: [filename.pdf]\nSHA-256: [hash]\nSuspicious Keywords: [\u002FJS, \u002FOpenAction, etc.]\nObjects with JavaScript: [Object IDs]\nExtracted URLs: [List]\nShellcode Detected: [Yes\u002FNo]\nEmbedded Files: [Count and types]\nVirusTotal Detections: [X\u002FY engines]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n","# Analyzing Malicious PDF with peepdf\n\n## When to Use\n\n- When triaging suspicious PDF attachments from phishing emails\n- During malware analysis of PDF-based exploit documents\n- When extracting embedded JavaScript, shellcode, or executables from PDFs\n- For forensic examination of weaponized document artifacts\n- When building detection signatures for PDF-based threats\n\n## Prerequisites\n\n- Python 3.8+ with peepdf-3 installed (pip install peepdf-3)\n- pdfid.py and pdf-parser.py from Didier Stevens suite\n- Isolated analysis environment (VM or sandbox)\n- Optional: PyV8 for JavaScript emulation within peepdf\n- Optional: Pylibemu for shellcode analysis\n\n## Workflow\n\n1. **Triage with pdfid**: Scan PDF for suspicious keywords (\u002FJS, \u002FJavaScript, \u002FOpenAction, \u002FLaunch, \u002FEmbeddedFile).\n2. **Interactive Analysis**: Open PDF in peepdf interactive mode to explore object structure.\n3. **Identify Suspicious Objects**: Locate objects containing JavaScript, streams, or encoded data.\n4. **Extract Content**: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).\n5. **Deobfuscate JavaScript**: Analyze extracted JS for shellcode, heap sprays, or exploit code.\n6. **Check VirusTotal**: Use peepdf vtcheck to cross-reference file hash with AV detections.\n7. **Generate IOCs**: Extract URLs, domains, hashes, and shellcode signatures.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| \u002FOpenAction | Automatic action executed when PDF is opened |\n| \u002FJavaScript \u002FJS | Embedded JavaScript code in PDF objects |\n| \u002FLaunch | Action that launches external applications |\n| \u002FEmbeddedFile | File embedded within the PDF structure |\n| FlateDecode | zlib compression filter used to hide content |\n| Object Streams | PDF objects stored in compressed streams |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| peepdf \u002F peepdf-3 | Interactive PDF analysis with JS emulation |\n| pdfid.py | Quick triage scanning for suspicious keywords |\n| pdf-parser.py | Deep object-level PDF parsing |\n| VirusTotal | Hash lookup and AV detection cross-reference |\n| CyberChef | Decode and transform extracted payloads |\n\n## Output Format\n\n```\nAnalysis Report: PDF-MAL-[DATE]-[SEQ]\nFile: [filename.pdf]\nSHA-256: [hash]\nSuspicious Keywords: [\u002FJS, \u002FOpenAction, etc.]\nObjects with JavaScript: [Object IDs]\nExtracted URLs: [List]\nShellcode Detected: [Yes\u002FNo]\nEmbedded Files: [Count and types]\nVirusTotal Detections: [X\u002FY engines]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n",{"name":5,"tags":49,"capec":52,"model":53,"tools":54,"domain":32,"maxTurns":58,"nist_csf":59,"subdomain":50,"description":7,"mitre_attack":64},[50,51,26,43,42,38,37,41],"malware-analysis","pdf",[],"sonnet",[55,30,56,57],"Read","Glob","Grep",20,[60,61,62,63],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01",[65,66],"T1059","T1566","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Fpdf\u002Fpeepdf\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill pdf-peepdf-analyze",{"tool":80,"command":81},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill pdf-peepdf-analyze",{"tool":83,"command":84},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill pdf-peepdf-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fpdf\u002Fpeepdf\u002Fanalyze\u002FSKILL.md",true,[88],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"index.json","REFERENCE","参考文档",622,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fpdf\u002Fpeepdf\u002Fanalyze\u002Findex.json",[95,119,140,160,182,198],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[102,103,104,105,106,107,36,108,109,110,111,112,113,114,115,116,117,32,118],"services","detect","services wmi persistence detect","wmi","persistence","de","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[126,102,127,105,128,129,130,32,30,29,131,132,133,134,107,135,136,137,138,139],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[147,148,149,150,151,152,32,30,153,29,25,154,107,137,155,156,157,158,159,53],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[103,167,168,169,170,171,172,36,173,32,118,174,175,176,177,178,179,180,181,107],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[189,190,103,191,169,171,192,36,193,173,32,118,29,194,195,196,197,181,107,108],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[205,103,169,206,192,36,207,208,32,118,209,210,211,212,213,214,107,108,215,216],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]