I've received an email with an attached PDF which has many signs of being a malicious attachment. Lacking the time and resources to analyze it at the moment, I'd like to store it for later use, and possibly share it with another researcher. What is the recommended process for storing this potentially malicious attachment, given that at least one mail client I use may preview the attachments before I actively click on them?
Should I use a webmail client, and download the file, then promptly zip it? Should I GPG or encrypt the file in another way, to prevent the filesystem from triggering some auto-open payload? Should I create a VM with my credentials loaded into it (seems like a potentially bad idea, should the VM be compromised) for a mail client, and download the file there?
This is different from this question, as I'm looking to store (and transfer) these potentially malicious PDFs.
If it matters, I'm considering using PDF Tools by Didier Stevens for later analysis.