Could a PDF file contain any type of malware?

  • 1
    Yes. And I have a PDF that has effective malware in it. I would link to it (and I did once) but it was immediately scanned, virus detected; and removed. Adobe's PDF language can run OS functions and privilege escalate through the editor that runs it, to backdoor your computer and do anything: add it as a drone to a DDOS botnet, capture video and file text for credit card transactions. I'm here, reluctantly, studying one, having caught it through the attack vector of a PDF attachment on spam email that I opened. – Eric Leschinski Feb 13 '19 at 13:43
  • Check this site: canarytokens.org – DxTx Apr 7 '19 at 9:01

There are many features in the PDF that can be used in malicious ways without exploiting a vulnerability. One example is given by Didier Stevens here. Basically he embeds an executable and has it launch when opening the file. I am not sure how today's versions of readers handle this but its a good method of using PDF features in malicious ways.

  • 8
    Would such a PDF be dangerous only on OS'es like Windows? Would the permission system of Mac/Linux be able to prevent such PDF's from running executables automatically? – Nav Apr 26 '17 at 3:32
  • @Nav executing code has little to do with the OS, and everything to do with the reader. Executing code is allowed to execute other code. Basically you have to trust the reader to not do something stupid like allowing a PDF to execute an application. – Steve Sether Nov 26 '19 at 20:57

Yes it can. PDF is a rich format that aside from static content, can contain dynamic elements. The latter can for example contain JavaScript, and other elements. Modern PDF viewers tend to warn the user about potential malicious activity though.

If you want an example malware, check out pidief.

And generally PDF malware will predominantly be just the dropper, not the payload itself.

To learn more on the vulnerabilities associated with pdf files and ways of detecting them before they do any damage read this kali documentation on peepdf.


Yes it can.

Whether a file is malicious or not, does not depend on the file extension (in this case PDF). It depends on the vulnerabilities in the software which will be parsing it. So for example, PDF reader that you are using potentially contains a buffer overflow vulnerability, then an attacker can construct a special PDF file to exploit that vulnerability.

Consequently, to guard against such attacks is also easy, just ensure your PDF reader is up-to-date.

A simple google search landed me up on the SANS Institute's overview of PDF malware, which seems to be good to start with.

  • 1
    For Adobe Reader, which is likely what you use if you didn't consciously choose something else, the bulletins at helpx.adobe.com/security/products/reader.html list the numerous fixed vulnerabilities, with no or little detail. – dave_thompson_085 Jul 27 '14 at 20:58
  • @Jor-el unsurprisingly this page is now serving a 404 error. Would you care to re-find it and summarise it in your answer? – Steve Dodier-Lazaro Aug 31 '16 at 19:22
  • (edit: I updated the link -- still, the proper thing to do would be to summarise the content). – Steve Dodier-Lazaro Aug 31 '16 at 19:50
  • "Guarding by constantly updating" is not necessarily 'easy', nor is it a guarantee that you won't fall prey to an unpatched vulnerability. Yes, it's a good thing to do, but it requires constant discipline. Adobe Reader has so many vulnerabilities that they include an automatic updater - do you really think they've all been found yet? – John Deters Aug 31 '16 at 19:54

Yes, in fact, there have been many historical PDF exploits.

The PDF reader built into popular Internet browsers support a robust sandboxed security model, so viewing a PDF in a browser is much more secure than viewing the same file in a native PDF reader. I'd recommend either Chrome or Safari as they've done best in penetration testing.

  • 4
    This does not answer the question. – Mark Jul 27 '14 at 9:48
  • 8
    Now I really want to see some evidence for the fact that embedded readers are sandboxed (per browser and platform). There also is a sandbox for Adobe Reader on Windows 8, and possibly Windows 7. So then, I also want to see a security evaluation of the relative strengths and weaknesses of said sandboxes against the browsers'. ;) – Steve Dodier-Lazaro Jul 27 '14 at 15:53
  • @Mark - yes, it does. – Konrad Gajewski Jul 5 '19 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy