14

I was emailed a PDF file by a family member. I have reason to suspect that it was given to said family member by someone who would like nothing more than to infect me with a Remote Access Trojan. How can I tell if it contains code that would allow an attacker to gain access to my Android phone?

12

You can upload a pdf to VirusTotal and check if that file is infected, but be careful since results from VirusTotal are not 100% accurate.

There is also PDF Examiner.

PDF Examiner by Malware Tracker is able to scan the uploaded PDF for several known exploits, allows the user to explore the structure of the file, as well as examine, decode and dump PDF object contents. This tool lends itself well to manual PDF analysis tasks. In this way, it differs from Jsunpack and Wepawet, which focus on automating the analysis as much as possible.

One more free service Jsunpack.

Jsunpack by Blake Hartstein is designed for automatically examining and de-obfuscating JavaScript. Its features also include carving contents of network packet capture (PCAP) files and identifying common client-side exploits. It can also examine PDF files for malicious JavaScript artifacts.

For deeper analysis you should check PDF tools from Didier Stevens.

https://blog.didierstevens.com/programs/pdf-tools/

  • 2
    +1 for Didier Stevens' tools, which will handle larger files that the online tools will not. – phs Mar 4 '17 at 21:04
  • 1
    jsunpack link is broken – schroeder Apr 27 at 15:42
1

There's also PDFrate, it works like VirusTotal and is specialized on PDFs.

PDFrate is designed to complement existing malicious document detection mechanisms, such as signature matching and dynamic analysis systems. PDFrate is capable of detecting malicious documents, including previously unseen variants, without relying on extensive parsing or execution of the documents. In addition to identifying malicious documents, PDFrate seeks to accurately separate opportunistic attacks, which represent the overwhelming majority of malicious activity, from targeted attacks, whose apparent goal is espionage against a small number of specific victims.

  • 1
    The link isn't valid and domain web server returns a blank page. – tbc0 May 17 '18 at 1:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.