analyzing-malicious-pdf-with-peepdf

1# Analyzing Malicious PDF with peepdf
2 
3## When to Use
4 
5- When triaging suspicious PDF attachments from phishing emails
6- During malware analysis of PDF-based exploit documents
7- When extracting embedded JavaScript, shellcode, or executables from PDFs
8- For forensic examination of weaponized document artifacts
9- When building detection signatures for PDF-based threats
10 
11## Prerequisites
12 
13- Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
14- pdfid.py and pdf-parser.py from Didier Stevens suite
15- Isolated analysis environment (VM or sandbox)
16- Optional: PyV8 for JavaScript emulation within peepdf
17- Optional: Pylibemu for shellcode analysis
18 
19## Workflow
20 
211. **Triage with pdfid**: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).
222. **Interactive Analysis**: Open PDF in peepdf interactive mode to explore object structure.
233. **Identify Suspicious Objects**: Locate objects containing JavaScript, streams, or encoded data.
244. **Extract Content**: Dump suspicious streams and decode filters (FlateDecode, ASCIIHexDecode).
255. **Deobfuscate JavaScript**: Analyze extracted JS for shellcode, heap sprays, or exploit code.
266. **Check VirusTotal**: Use peepdf vtcheck to cross-reference file hash with AV detections.
277. **Generate IOCs**: Extract URLs, domains, hashes, and shellcode signatures.
28 
29## Key Concepts
30 
31| Concept | Description |
32|---------|-------------|
33| /OpenAction | Automatic action executed when PDF is opened |
34…