1

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he opened it. The file is unreadable. Looks like it doesn't have the right font, or needs a different encoding to be read. I was wondering if the pdf file contains any malware or exploit(somehow using adobe reader or google chrome pdf reader to gain access to the system).

I uploaded it to virus total and wepawet nothing was detected.

Is it possible that this PDF could contain any malware or exploit? Maybe you can have a look at it?

Because if it doesn't have anything, then what's the point of it?

  • 4
    Just because virus scanners do not detect anything does not mean it isn't malware. – Philipp Jan 5 '16 at 9:06
  • If the file contains active elements, it is very likely that the Chrome PDF viewer is too dumb to deal with it. In order to analyze the document, you'd have to open it on an isolated (virtual) system; typical virus scanners don't interpret PDF. With "unreadable", does the file open and display ghibberish, or does it not open at all? You might also open the file in a text editor or a hex editor and find out whether it is actually a valid PDF (beginning with the %PDF header, and whether you find some evidence of object structure). – Max Wyss Jan 5 '16 at 18:08
  • It's a valid PDF. Virustotal analysis shows some properties about the pdf structure. I also used pdf2json to see the what's inside of it, but it was just containing gibberish text. – Farid Nouri Neshat Jan 5 '16 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.