peepdf
Python PDF analysis tool for finding JavaScript, shellcode, and exploit artifacts in documents.
Technical Architecture & Overview
peepdf parses PDF files and exposes their object structure, streams, and embedded JavaScript for inspection. It can decode filters, analyze shellcode with libemu, and check hashes against VirusTotal. The interactive console lets analysts walk the document tree and extract suspicious objects. Development activity is low, so treat it as a stable tool rather than a fast-moving one.
Targeted Technical Use Cases
Dissecting a suspicious PDF attachment to confirm an exploit or a JavaScript downloader.
Evaluation & Trade-offs
Core Strengths
- +Interactive console purpose-built for PDF structure.
- +Shellcode analysis built in.
- +Simple to script for batch checks.
Trade-Offs & Limitations
- -Sparse recent development activity.
- -Newer PDF obfuscation can require manual decoding.
Defensive Security Application
Confirming malicious PDFs in phishing investigations and extracting indicators from embedded payloads.
Frequently Asked Questions
What is peepdf?→
peepdf parses PDF files and exposes their object structure, streams, and embedded JavaScript for inspection. It can decode filters, analyze shellcode with libemu, and check hashes against VirusTotal. The interactive console lets analysts walk the document tree and extract suspicious objects. Development activity is low, so treat it as a stable tool rather than a fast-moving one.
What is peepdf used for?→
Dissecting a suspicious PDF attachment to confirm an exploit or a JavaScript downloader.
What are the strengths of peepdf?→
- +Interactive console purpose-built for PDF structure.
- +Shellcode analysis built in.
- +Simple to script for batch checks.
What are the limitations of peepdf?→
- +Sparse recent development activity.
- +Newer PDF obfuscation can require manual decoding.
How is peepdf used defensively?→
Confirming malicious PDFs in phishing investigations and extracting indicators from embedded payloads.