1

I used Didier Stevens's pdfid.py to check a pdf, and it found js and automatic actions associated with the pdf:

enter image description here

How do I check if this is malicious code?

Improve this question

2 Answers 2

Reset to default
1

In such a simple case, you might force open the file in a text/hex editor and find the objects referred by the /JS and /OpenAction tags. You should be able to get the Acrobat Javascript code, and can analyse it visually.

Improve this answer
1

The only way to check if said code is malicious is to scan it with anti-malware solutions/products. The usual way would be to also use sandboxes/dynamic analysis and see that the code does.

Obviously, in many cases, you cannot do that kind of analyses locally (i.e., using an installed product), but have to check it online with multi-scanning products. In that case, by uploading the whole document, confidentiality is not preserved, as the file is uploaded publicly.

You could try isolating the executable code (using some tool) and then uploading the code online for analyses (e.g., VirusTotal, which has uses sandboxes, too).

Improve this answer
4
  • However, I have serious doubts whether those products and services understand Acrobat JavaScript.
    – Max Wyss
    Commented May 7, 2023 at 18:57
  • @MaxWyss Well, we work with what we have, at least without doing it manually. VirusTotal does recognized it and runs PDF's through the sandbox. The other option is to extract the JavaScript manually, put it in a ".js" script and then run it through scanning.
    – ARGYROU MINAS
    Commented May 7, 2023 at 19:09
  • But does your scanning tool understand Acrobat JavaScript?? Running in the sandbox and see what it does is a legitimate way to test, however.
    – Max Wyss
    Commented May 8, 2023 at 20:14
  • @MaxWyss Sandboxes, supposedly, track changes on the computer and then analyze. If the computer understands and runs the Acrobat JavaScript (or any other language), changes will be made to the computer, so, the sandbox should "catch" it,. Sandboxes don't have to understand specific languages since, all executable code turns into machine code (at some point). But, most sandboxes also recognize multiple languages, and Acrobat JavaScript is relatively common, so it should be recognized. So, my conclusion is that malicious code probably will be detected, including code in Acrobat JavaScript.
    – ARGYROU MINAS
    Commented May 9, 2023 at 0:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .