Stats
Actions
Tags
From cybersec-toolkit
Performs static analysis of malicious PDFs using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects for malware triage and forensics.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:analyzing-malicious-pdf-with-peepdfThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- When triaging suspicious PDF attachments from phishing emails
| Concept | Description |
|---|---|
| /OpenAction | Automatic action executed when PDF is opened |
| /JavaScript /JS | Embedded JavaScript code in PDF objects |
| /Launch | Action that launches external applications |
| /EmbeddedFile | File embedded within the PDF structure |
| FlateDecode | zlib compression filter used to hide content |
| Object Streams | PDF objects stored in compressed streams |
| Tool | Purpose |
|---|---|
| peepdf / peepdf-3 | Interactive PDF analysis with JS emulation |
| pdfid.py | Quick triage scanning for suspicious keywords |
| pdf-parser.py | Deep object-level PDF parsing |
| VirusTotal | Hash lookup and AV detection cross-reference |
| CyberChef | Decode and transform extracted payloads |
Analysis Report: PDF-MAL-[DATE]-[SEQ]
File: [filename.pdf]
SHA-256: [hash]
Suspicious Keywords: [/JS, /OpenAction, etc.]
Objects with JavaScript: [Object IDs]
Extracted URLs: [List]
Shellcode Detected: [Yes/No]
Embedded Files: [Count and types]
VirusTotal Detections: [X/Y engines]
Risk Level: [Critical/High/Medium/Low]
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitPerforms static analysis of malicious PDFs using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects for malware triage and forensics.
Performs static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Useful for triaging phishing attachments and malware forensics.
Performs static analysis on malicious PDFs using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Useful for malware reverse engineering and DFIR.