AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
SKILL verified Apache-2.0 Self-run

Analyzing Malicious Pdf With Peepdf

skill-killvxk-cybersecurity-skills-zh-analyzing-malicious-pdf-with-peepdf · by killvxk

>

↗ Repository
— No reviews yet
0 installs
42 views
0.0% view→install

Install

$ agentstack add skill-killvxk-cybersecurity-skills-zh-analyzing-malicious-pdf-with-peepdf

✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README, it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/skill-killvxk-cybersecurity-skills-zh-analyzing-malicious-pdf-with-peepdf)

Reliability & compatibility

✓ Security review passed
0 installs to date
— no reviews yet
○ 4mo ago

Declared compatibility

Claude CodeClaude Desktop

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Analyzing Malicious Pdf With Peepdf? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

使用 peepdf 分析恶意 PDF

适用场景

  • 对来自钓鱼邮件的可疑 PDF 附件进行分类
  • 对基于 PDF 的漏洞利用文档进行恶意软件分析
  • 从 PDF 中提取嵌入的 JavaScript、shellcode 或可执行文件
  • 对武器化文档工件进行取证检查
  • 为基于 PDF 的威胁构建检测签名

前置条件

  • Python 3.8+，安装 peepdf-3（pip install peepdf-3）
  • Didier Stevens 工具套件中的 pdfid.py 和 pdf-parser.py
  • 隔离分析环境（虚拟机或沙箱）
  • 可选：PyV8，用于 peepdf 内的 JavaScript 模拟
  • 可选：Pylibemu，用于 shellcode 分析

工作流程

  1. 使用 pdfid 分类：扫描 PDF 中的可疑关键词（/JS、/JavaScript、/OpenAction、/Launch、/EmbeddedFile）。
  2. 交互式分析：在 peepdf 交互模式下打开 PDF，探索对象结构。
  3. 识别可疑对象：定位包含 JavaScript、流或编码数据的对象。
  4. 提取内容：转储可疑流并解码过滤器（FlateDecode、ASCIIHexDecode）。
  5. 去混淆 JavaScript：分析提取的 JavaScript 中的 shellcode、堆喷射或漏洞利用代码。
  6. VirusTotal 检查：使用 peepdf vtcheck 将文件哈希与 AV 检测结果交叉验证。
  7. 生成 IOC：提取 URL、域名、哈希值和 shellcode 签名。

核心概念

| 概念 | 定义 | |---------|-------------| | /OpenAction | PDF 打开时自动执行的操作 | | /JavaScript /JS | PDF 对象中嵌入的 JavaScript 代码 | | /Launch | 启动外部应用程序的操作 | | /EmbeddedFile | 嵌入在 PDF 结构中的文件 | | FlateDecode | 用于隐藏内容的 zlib 压缩过滤器 | | Object Streams | 存储在压缩流中的 PDF 对象 |

工具与系统

| 工具 | 用途 | |------|---------| | peepdf / peepdf-3 | 带 JavaScript 模拟的交互式 PDF 分析 | | pdfid.py | 扫描可疑关键词的快速分类工具 | | pdf-parser.py | 深层对象级 PDF 解析 | | VirusTotal | 哈希查询和 AV 检测交叉验证 | | CyberChef | 解码和转换提取的载荷 |

输出格式

分析报告：PDF-MAL-[日期]-[序号]
文件：[filename.pdf]
SHA-256：[哈希值]
可疑关键词：[/JS、/OpenAction 等]
包含 JavaScript 的对象：[对象 ID]
提取的 URL：[列表]
检测到 Shellcode：[是/否]
嵌入文件：[数量和类型]
VirusTotal 检测：[X/Y 引擎]
风险等级：[严重/高/中/低]

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Content & Media