Статический анализ вредоносных PDF с peepdf

★ 8.4 · security

analyzing-malicious-pdf-with-peepdf is a Claude Code skill that performs static analysis of malicious PDF documents using peepdf, pdfid.py, and pdf-parser.py to extract embedded JavaScript, shellcode, and suspicious objects. The workflow covers seven steps: quick triage with pdfid scanning for keywords like /JS, /OpenAction, and /Launch; interactive object-structure exploration in peepdf; stream extraction and filter decoding (FlateDecode, ASCIIHexDecode); JavaScript deobfuscation; VirusTotal hash lookup; and IOC generation covering URLs, domains, and shellcode signatures. Designed for DFIR analysts and malware researchers triaging suspicious PDF attachments from phishing emails, examining PDF-based exploit documents, or building detection signatures for weaponized PDF threats. Requires Python 3.8+ with peepdf-3 in an isolated environment such as a VM or sandbox, with optional PyV8 for JavaScript emulation and Pylibemu for shellcode analysis.