reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-malicious-pdfs/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: analyzing-malicious-pdfs
+description: 'Analyzes malicious PDF documents: parsing the object structure for JavaScript,
+  OpenAction/launch triggers, embedded files, and URIs, then extracting and decoding suspicious
+  streams without opening the document in a reader. Activates for requests to analyze a malicious
+  PDF, inspect PDF JavaScript, or extract embedded payloads from a PDF.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - pdf
+  - document-malware
+  - javascript
+  - static-analysis
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1204.002
+  - T1059.007
+  - T1027
+d3fend:
+  - D3-FCR
+  - D3-DA
+references:
+  - 'PDF 32000-1:2008 (ISO PDF specification) — https://www.pdfa.org/resource/iso-32000-pdf/'
+  - 'Didier Stevens PDF tools (pdfid, pdf-parser) — https://blog.didierstevens.com/programs/pdf-tools/'
+---
+
+# Analyzing Malicious PDFs
+
+## When to Use
+
+- You have a suspicious PDF (often from phishing) and must determine if it is weaponized.
+- You need to find auto-executing actions, embedded JavaScript, launch actions, or embedded files.
+- You want to extract and decode suspicious streams safely.
+
+**Do not use** a PDF reader to "just look" — opening in a viewer can trigger the very actions you
+are investigating. Parse the structure statically.
+
+## Prerequisites
+
+- A PDF object parser (Python, or pdfid/pdf-parser/peepdf); the sample handled inertly.
+
+## Safety & Handling
+
+- Never open the PDF in a graphical reader; parse the raw object structure only.
+- Defang any extracted URLs and store embedded payloads password-protected.
+
+## Workflow
+
+### Step 1: Triage the object inventory
+
+Count high-risk keywords: `/JavaScript`, `/JS`, `/OpenAction`, `/AA`, `/Launch`, `/EmbeddedFile`,
+`/URI`, `/RichMedia`. Their presence (especially auto-actions) flags weaponization.
+
+```bash
+python scripts/analyst.py triage sample.pdf
+```
+
+### Step 2: Locate auto-execution triggers
+
+Resolve `/OpenAction` and `/AA` (additional actions) to see what runs on open, and any `/Launch`
+actions that spawn external programs.
+
+### Step 3: Extract and decode streams
+
+Pull JavaScript and suspicious streams, applying filters (`/FlateDecode`, `/ASCIIHexDecode`) to
+get the cleartext; deobfuscate layered JS as needed.
+
+### Step 4: Recover payloads and IOCs
+
+Extract embedded files and URIs; hash payloads, defang URLs, and route extracted executables to
+PE analysis.
+
+## Validation
+
+- Auto-execution triggers (`/OpenAction`, `/AA`, `/Launch`) are resolved to concrete actions.
+- JavaScript/streams are decoded through their filters, not left encoded.
+- Embedded payloads and URIs are extracted, hashed, and defanged.
+
+## Pitfalls
+
+- Opening the PDF in a reader and triggering the payload.
+- Missing object-stream (`/ObjStm`) compressed objects that hide the malicious content.
+- Stopping at the first JS layer when it is multiply obfuscated.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the PDF triage parser.
+- ISO 32000 and Didier Stevens' PDF tools (linked in frontmatter).