# PDF Analyzer

> Multi-layered static analysis and sanitization for suspicious PDFs with threat intelligence integration.

- Type: Skill
- Author: mostafahussein
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-09-14
- Source repository: https://github.com/mostafahussein/pdf-analyzer
- Repo state: not archived
- Last push: 2026-09-16T16:25:54Z
- Stars: 1 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: VirusTotal
- Domains: security-operations, threat-intelligence
- Tags: pdf-analysis, malware-analysis, static-analysis, pdf-sanitization, threat-intelligence, incident-response, ioc-extraction
- Date added: 2026-09-11
- Compatible platforms: Claude Code
- Invocation: `/pdf-analyzer`
- Listing page: https://exchange.tenable.com/skills/pdf-analyzer
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/pdf-analyzer.md

PDF Analyzer dissects suspicious PDFs through six layers of static analysis and threat intelligence. It never renders a PDF, never executes JavaScript, and never opens embedded files.

## What it does

- **Six analysis layers:** structure parsing, action detection, JavaScript detection, embedded content cataloging, obfuscation detection, and VirusTotal hash reputation lookup
- **Cleaning and sanitization:** strips malicious elements (OpenAction, JavaScript, embedded files, dangerous URI schemes) and outputs a safe copy while preserving document layout
- **IOC extraction:** hashes, URLs, and embedded filenames ready to feed into detection tools
- **Risk scoring:** evidence-based verdict (LOW/MEDIUM/HIGH/CRITICAL) with per-layer breakdown

## How it works

All analysis is static - files are read as raw bytes, parsed with regex and heuristics, and never rendered or executed. VirusTotal integration performs hash-only lookups (the file is never uploaded). Cleaning is powered by pdf-defang for proper PDF parsing, with additional custom sanitization for URL defanging in annotations and content streams.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/pdf-analyzer.json. The full index and how to read it: https://exchange.tenable.com/llms.txt