Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a PDF with important information that may contain malware. What would be the best way to view it?

share|improve this question
1  
Is it of a JS kind? I think you can turn off JS. –  curiousguy Aug 19 '12 at 17:26
2  
I am not sure if the sandbox tag is relevant here... –  curiousguy Aug 19 '12 at 17:53
    
@curiousguy sandbox is a method of solving OP's problem. But OP doesn't mention it at all so in my opinion it shouldn't be there. –  Andrey Botalov Aug 19 '12 at 18:00
    
@AndreyBotalov I agree. –  curiousguy Aug 19 '12 at 18:05
    
The thing I would do is open it in a virtual machine without network access. –  Luc Aug 19 '12 at 19:25
show 3 more comments

7 Answers

up vote 7 down vote accepted

Document-based exploits are directed not at the document itself, but rather at some vulnerability in the viewer. If you view the document in a program that isn't vulnerable (or in a configuration that inhibits the vulnerability), then you won't be exploited.

The real issue is knowing whether or not your viewer is vulnerable, which usually means knowing specifically what the exploit is. But there are alternate PDF viewers such as foxit or even Google chrome's built-in viewer that do not necessarily have the same vulnerabilities as Adobe's official viewer. This is not necessarily true for all vulnerabilities, so it's important to understand what you're getting in to ahead of time.

EDIT
If you find yourself frequently dealing with potentially malicious materials, it would be very wise to set up a hardened virtual environment. I'd recommend booting into a Linux system and running your target OS (usually Windows) in Virtualbox or a similar environment. Save a snapshot of the virtual OS, and then revert to that snapshot after you're done interacting with the malicious content. Also, it's not a bad idea to run the host Linux environment from a read-only installation (i.e. Live-CD).

share|improve this answer
    
The main vulnerability in adobe (which I don't use) is using javascript to call on an insecure undocumented API it run shellcode. I used origami to decrypt and decomporess and pdfid to check if it has javascript triggers (which it doesn't)... but I guess this doesn't even matter for anyone not using adobe viewer. –  user11101 Aug 19 '12 at 19:01
4  
Reasonably simple setup would be a VM + Sandboxie + DigiSigner –  Polynomial Aug 19 '12 at 19:59
1  
I keep a copy of Foxit on one VM just to open pdf's in a non-Adobe reader. –  Rory Alsop Aug 20 '12 at 13:31
    
I don't use foxit or adobe. I use an obscure reader. Recently, it crashed when i opened a pdf file. Can this be a malware attack? How do I check? –  FirstName LastName Feb 5 '13 at 10:11
add comment

First upload it to virustotal.com to have it scanned by 20+ AV programs, then open it in Virtual machine using the options mentioned by others.

share|improve this answer
add comment

We can say ALL of the in-the-wild or targetted attack using malicious PDF file are covered with obfuscation techniques to hardened the analysis or detection process.

Most of the obfuscation technique are mainly using JavaScript obfuscation like eval(), String.fromCharCode(), arguments.callee(), base64, and even with PDF key values such as /Author, /Keywords, /CreationDate and etc.

We might unable to view the content of the malicious PDF file (those within the PDF object stream) as it might be deflated commonly with FlateDecode. But there are tools available to allow us to inflate the content within the PDF object stream, such as pdf-parser (http://blog.didierstevens.com/programs/pdf-tools/) and FileInsight (http://www.mcafee.com/us/downloads/free-tools/fileinsight.aspx). Most of the obfuscated JavaScript code will lies within the inflated PDF stream.

We can advise you to get the latest patched version of PDF reader with turned-off JavaScript functionality to open the file, but the good solution is to get a virtual machine where you can delete it or revert the snapshot after opening the file.

share|improve this answer
add comment

Use pdf.js [1] with a sandboxed browser (such as Chromium) in a virtual machine without network access.

[1] http://mozilla.github.com/pdf.js/web/viewer.html

It should be quite tricky for a malware to get out of this.

share|improve this answer
add comment

Use a virtual machine that can be reverted to clean slate after tests. If the PDF reader is vulnerable, your real workstation will be much less likely to be affected.

share|improve this answer
add comment

In this situation I've always used the Unix/Linux/OSX shell command "strings". On *nix systems, do this:

strings ScaryFile.pdf | less

You can also get "strings" for Windows, as mentioned by Polynomial, below. You can download it here. Runs on XP or higher. Here is an example of using it on Windows:

strings ScaryFile | findstr /i TextToSearchFor

But for the rest of my answer here I'll assume you're on *nix, since that is my experience with strings. Assuming all you're looking for is text content (not bitmaps or vector graphics), you can scroll down or search and find bits of the text you need. Unfortunately, to find it you have to wade through tons of metadata, most of which is in XML, and formatting settings in some other markup, plus some binary (as ascii, not raw bytes). So you may want to use the search capabilities of the "less" command. To search down the document for the case-sensitive string "thingyouwant", use the slash key + your string + return:

/thingyouwant

Then hit the "n" key to see the next instance of "thingyouwant", over and over till you find what you want. You can use the "?" key to do the same thing in the upward direction. See the less man page (type "man less") for more magic.

You could also analyze things like which URLs the document links to:

strings ScaryFile.pdf| grep -i "http" | sort | uniq | less

But, as stated above, 99% of what you'll see from the output of "strings" is going to be metadata and formatting settings.

share|improve this answer
1  
Windows has strings too. –  Polynomial Aug 20 '12 at 6:04
    
+1 for strings(1) and pdfinfo with a followup in evince. Paging through the file looking for JS and calls to outside resources is quite effective if a bit slow. –  adric Aug 24 '12 at 11:14
add comment

Put it through a PDF viewer that isn't vulnerable to the exploit. If it's someone else's viewer, that's even safer. Try Google Docs, where they will parse it and display it as HTML, so the malicious payload won't harm you. (I'm sure that their PDF parser is extremely secure, so you shouldn't feel bad about possibly infecting them.)

share|improve this answer
1  
I don't want to give the information in the PDF to google but thanks. –  user11101 Aug 20 '12 at 3:21
    
hey @B-con! Good idea. –  FirstName LastName Feb 5 '13 at 10:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.