PDF Analyzer
Multi-layered static analysis and sanitization for suspicious PDFs with threat intelligence integration.
Baseline review at submission: an accuracy and overt-behavior check, not a full security audit, and it does not cover later changes to the repository. Learn more about our security review process.
PDF Analyzer dissects suspicious PDFs through six layers of static analysis and threat intelligence. It never renders a PDF, never executes JavaScript, and never opens embedded files.
What it does
- Six analysis layers: structure parsing, action detection, JavaScript detection, embedded content cataloging, obfuscation detection, and VirusTotal hash reputation lookup
- Cleaning and sanitization: strips malicious elements (OpenAction, JavaScript, embedded files, dangerous URI schemes) and outputs a safe copy while preserving document layout
- IOC extraction: hashes, URLs, and embedded filenames ready to feed into detection tools
- Risk scoring: evidence-based verdict (LOW/MEDIUM/HIGH/CRITICAL) with per-layer breakdown
How it works
All analysis is static - files are read as raw bytes, parsed with regex and heuristics, and never rendered or executed. VirusTotal integration performs hash-only lookups (the file is never uploaded). Cleaning is powered by pdf-defang for proper PDF parsing, with additional custom sanitization for URL defanging in annotations and content streams.