I found many PDFs that are vulnerable, and my Palo Alto firewall categorises them as "Adobe PDF File With Embedded Javascript". And this pdf file contacting a Russian IP address.

What should I do? My recommendation is to delete the file. What's yours?

  • You need to edit this question to include more detail such as: what you've looked at so far, any research you've done, where you've read about these kinds of attacks, etc. This will help us help you. – J.J May 29 '18 at 4:39
  • 3
    "My antivirus flagged a file as potentially malicious. What do I do?" Well, what do you want to do? Do you want to open them safely? Do you want to dispose of them securely? Do you want to confirm that they are malicious? Are you the recipient or are you the network admin? Your question is too broad to answer. – schroeder May 29 '18 at 8:48

While PDF files with Javascript might be used with attacks there are also legitimate reasons for a PDF file to have Javascript in it, for example to validate the input within PDF forms.

Because of this it is impossible to say what to do based on only the fact that a PDF contained Javascript. Instead you need to check where these files come from, who the recipient is, if the recipient maybe expected such files, if the source is maybe known for PDF files which contain Javascript for a non-malicious reason etc.

| improve this answer | |
  • i don't know whether the user downloaded or not but pan detected as the file vulnerable and its contacting russian ip – kanthraj Jun 3 '18 at 5:39
  • 1
    @kanthraj: This is the kind of detail which was missing from your initial question. If working with the PDF file causes a request to an IP address in Russia it looks more suspicious. But again it depends on the context and details: if you live in Russia then this might be actually an expected behavior for some PDF. If instead you work in some critical infrastructure in the Ukraine then this is more likely an attack. But it also depends on what it is actually doing in this request, i.e. loading some external image vs. loading some malware or similar. – Steffen Ullrich Jun 3 '18 at 5:51
  • SIEM tool detected it PDF file is vulnarable ID- CVE-2008-0655, CVE-2007-5659, CVE-2007-5663, CVE-2007-5666, CVE-2008-0667, CVE-2008-0726, CVE-2008-2042 but user is not dowloaded i mean he accessed the pdf file i got logs from Pan(firewall) not sure about he downloaded or not. – kanthraj Jun 9 '18 at 3:34
  • @kanthraj: the PDF file itself is not vulnerable but it might contain code which tries to exploit the given vulnerabilities. Given the age of these vulnerabilities your infrastructure is hopefully not vulnerable against these anymore. But in any case ask the user and don't ask me what the user did with the file. Note that this is not a support forum for security admins here where any log message you see gets analyzed. It is usually expected when administrating a firewall that you have the knowledge to interpret the logs from your firewalls. Please take appropriate training. – Steffen Ullrich Jun 9 '18 at 3:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.