665,000+ skills indexed

AxxxxxxaaannCOMMUNITY

Explore all skills by this author →

Verified:GitHub

analyzing-malicious-pdf-with-peepdf

Analyze malicious PDFs with peepdf, pdfid, and pdf-parser to extract JavaScript and IOCs.

Updated Aug 23, 2026

Search Tags:#pdf #forensics #threat-hunting #malware-analysis #pdf-parser #pdfid #peepdf

One-click install

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-malicious-pdf-with-peepdf

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: analyzing-malicious-pdf-with-peepdf
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-malicious-pdf-with-peepdf
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-malicious-pdf-with-peepdf

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Analysts need to quickly identify weaponized PDFs and extract actionable indicators such as embedded JavaScript, shellcode, and suspicious objects. This skill provides static analysis workflows using peepdf, pdfid, and pdf-parser to triage and characterize malicious PDFs.

Core Features & Use Cases

Static PDF structure analysis and JavaScript discovery with peepdf
Triaging PDFs with pdfid to surface high-risk indicators
Object extraction and content summarization with pdf-parser to generate IOCs and cross-reference data
Forensic reporting and risk scoring to prioritize incident response

Quick Start

Run the analysis agent on a suspicious PDF to generate a malware report.

Frequently Asked Questions about analyzing-malicious-pdf-with-peepdf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I analyze a malicious PDF for embedded JavaScript and shellcode?▼

You can analyze a malicious PDF for embedded JavaScript and shellcode by running static structure analysis and object extraction with peepdf, generating an IOC-rich report for forensic workflows.

What is the best way to triage weaponized PDFs during a phishing investigation?▼

The best way to triage weaponized PDFs in a phishing investigation is to use pdfid to surface high-risk indicators rapidly, followed by deep object analysis to prioritize incident response.

Can I extract JavaScript from a suspicious PDF file using peepdf?▼

Yes, you can extract JavaScript from a suspicious PDF file using peepdf. The skill provides static analysis workflows that support JavaScript discovery and extraction to identify actionable indicators.

How does pdf-parser generate IOCs from malicious PDF objects?▼

Pdf-parser generates IOCs from malicious PDF objects by performing content summarization and cross-referencing extracted data to characterize suspicious content and build a forensic report.

Do I need any dependencies to run static malware analysis on PDF files?▼

No external dependencies are required to run static malware analysis on PDF files with this skill. It integrates pdfid, peepdf, and pdf-parser internally to provide triage and risk scoring.

When should I use peepdf instead of pdfid for PDF malware analysis?▼

You should use peepdf instead of pdfid when you need deep object analysis and JavaScript extraction rather than rapid triage. Peepdf characterizes embedded shellcode, while pdfid surfaces high-risk indicators.

Related Skills

Explore More Data & Analytics Skills→

Malware Analysis & Sandboxing

Extract hashes, strings, imports, and entropy from suspicious binaries.

ioc-extraction

Extract, classify, deduplicate, and enrich IOCs into STIX 2.1 observables.

malware-dynamic-analysis

Execute malware samples in sandboxes and capture runtime behavior with monitoring tools.

balic-AI-ML-R-D-Resources

yara-authoring

Write and test YARA rules to detect malware samples and threats.