analyzing-malicious-pdf-with-peepdf

name	analyzing-malicious-pdf-with-peepdf
description	Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
domain	cybersecurity
subdomain	malware-analysis
tags	["malware-analysis","pdf","peepdf","pdfid","pdf-parser","static-analysis","reverse-engineering","dfir"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]

Analyzing Malicious PDF with peepdf

When to Use

• When triaging suspicious PDF attachments from phishing emails
• During malware analysis of PDF-based exploit documents
• When extracting embedded JavaScript, shellcode, or executables from PDFs
• For forensic examination of weaponized document artifacts
• When building detection signatures for PDF-based threats

Detection Gaps & Validation

• Hex-escaped names dodge pdfid keyword counts. /JavaScript written as /J#61vaScript (and /OpenAction, /Launch similarly) won't increment pdfid's counters, so pdfid alone undercounts. Normalize names and re-scan with pdf-parser.py --search before concluding the PDF is clean.
• Objects hide inside object streams. Malicious JS/actions packed in compressed /ObjStm are invisible to surface keyword scans; decompress with pdf-parser.py -O (or peepdf object listing) to expose them.
• Nested/stacked filters. A stream may chain FlateDecode -> ASCIIHexDecode -> JBIG2; decode every filter layer (pdf-parser.py -f) or the payload looks like noise.
• Incremental updates and split JS. Later %%EOF/xref sections and /OpenAction can override earlier benign content, and JS is often concatenated across objects then eval'd - analyze the effective final version.
• Confirm a hit: fully extract the JavaScript, deobfuscate it in box-js or a JS engine, run any extracted shellcode through scdbg/libemu, and confirm embedded URLs//EmbeddedFile payloads are live and hostile.
• False positives: legitimate PDFs use JavaScript for form validation and /OpenAction for navigation; signed Adobe/forms workflows are common. Confirm exploit/download behavior before rating malicious.

Prerequisites

• Python 3.8+ with peepdf-3 installed (pip install peepdf-3)
• pdfid.py and pdf-parser.py from Didier Stevens suite
• Isolated analysis environment (VM or sandbox)
• Optional: PyV8 for JavaScript emulation within peepdf
• Optional: Pylibemu for shellcode analysis

Workflow

1. Triage with pdfid: Scan PDF for suspicious keywords (/JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile).