skills.rest
YukiIto1999
YukiIto1999COMMUNITY
Explore all skills by this author →
GitHub

analyzing-pdf-malware-with-pdfid

Identify embedded JavaScript, shellcode, and exploit indicators in suspicious PDFs.

Updated Apr 23, 2026
Search Tags:#pdf#forensics#osint#malware-analysis#pdf-parser#pdfid#peepdf
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill analyzing-pdf-malware-with-pdfid
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: analyzing-pdf-malware-with-pdfid
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/analyzing-pdf-malware-with-pdfid
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill analyzing-pdf-malware-with-pdfid

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

It enables security teams to triage suspicious PDFs by revealing embedded JavaScript, auto-execution vectors, object streams, and embedded files without executing the document.

Core Features & Use Cases

  • Detection and triage of JavaScript and action entries in PDFs (JS, OpenAction, AA) to identify potential exploits.
  • Extraction and analysis of JavaScript streams and embedded files, with URLs and IOCs cataloged for incident response.
  • Use Case: A SOC analyst receives a phishing PDF; this Skill quickly confirms whether it contains exploit vectors or is limited to benign metadata.

Quick Start

Analyze a suspect PDF with the agent to surface JavaScript, streams, and IOCs.

Frequently Asked Questions about analyzing-pdf-malware-with-pdfid

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect embedded JavaScript and exploit indicators in a suspicious PDF?▼

PDF malware analysis involves identifying embedded JavaScript, shellcode, and exploit indicators in suspicious documents. It detects /JS, /OpenAction, and /AA entries to reveal auto-execution vectors and object streams without executing the file.

What is the best way to extract JavaScript and URLs from a phishing PDF for incident response?▼

Extracting JavaScript and URLs from a phishing PDF requires decompressing object streams to catalog embedded files and IOCs. This generates a structured report detailing exploit vectors and malicious links for incident response teams.

Can I use PDFiD and peepdf to safely analyze object streams and shellcode?▼

Yes, you can use PDFiD and peepdf to safely analyze object streams and shellcode. These tools perform static keyword triage and stream decompression to identify exploit indicators without executing the suspicious PDF document.

How do PDFiD and pdf-parser compare for malware triage and JavaScript extraction?▼

PDFiD is used for initial keyword triage to detect suspicious tags like /JS and /OpenAction, while pdf-parser decompresses and extracts JavaScript streams. Together they provide a structured report for incident response workflows.

What are the limitations of static PDF malware analysis without executing the document?▼

Static PDF malware analysis limitations include potential obfuscation within deeply nested object streams or encrypted containers. While it safely identifies known exploit indicators and IOCs, it may not uncover heavily obfuscated shellcode without dynamic execution.

Related Skills

Explore More Software Engineering Skills→
FuzzdkkFuzzdkk
3

malware-triage

Extract indicators from suspicious files via static malware analysis.

Community
Advanced
radareorgradareorg
20

r2mcp-basic

Guide binary analysis and reverse-engineering tasks via the r2mcp MCP server.

Official
Intermediate
workromancerworkromancer

web-load2

Fetch web URLs and extract all text content.

Community
Basic
YukiIto1999YukiIto1999

performing-threat-hunting-with-yara-rules

Detect malware and indicators of compromise across filesystems and memory dumps with YARA rules.

Community
Advanced