peepdf

peepdf parses PDF files and exposes their object structure, streams, and embedded JavaScript for inspection. It decodes common filters and encodings, wraps PyV8 for JavaScript analysis and pylibemu for shellcode analysis, and checks hashes against VirusTotal. The interactive console lets analysts walk the document tree and extract suspicious objects. The repository has had no commits since November 2016.

Dissecting a suspicious PDF attachment to confirm an exploit or a JavaScript downloader.

• +Interactive console purpose-built for PDF structure.
• +Shellcode analysis through the optional pylibemu wrapper.
• +Simple to script for batch checks.

• +No commits to the repository since 2016.
• +Code uses Python 2 syntax and does not run on Python 3.

Confirming malicious PDFs in phishing investigations and extracting indicators from embedded payloads.