Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either:
open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program "print-to-file" a new clean pdf file from the original one?
use a program to extract only the text from the contaminated file and save only text to a *.txt file?
If both are insufficient, are there any tools like "NoScript" for pdf? Or else, to protect against pdf malware - other than a virtual machine?
PDF malware tends to target the vulnerabilities of the PDF reader you use. You might find success by using an alternate reader and extracting the text.
As for "NoScript"-like options, PDF readers do tend to have the option to not execute dynamic code, but not all malware takes advantage of PDF scripting to do its work (it takes advantage of vulnerabilities, as I said).
Opening in an isolated system definitely helps. If you have Acrobat running in that isolated system, you can use Save as other… -> Optimized PDF, and then set to discard more or less everything "active", and you have a better PDF.
"Refrying" (create a PostScript file and send that through Distiller) does create a completely new document, and also gets rid of any active element.
Option 2 does not work, because in order to access the contents of the PDF, you have to interpret it.
For bigger volumes, there are command line utilities which do that cleaning up (you might talk to Appligent, for example).
One question remains: Why are you suspicious? Because of a virus scan? If so, you have, with a very high probability, a false positive. Because PDF has compressed sections, it is possible that any character sequence can be found in those sections.
I would use a tool like PDFiD or peepdf to remove malware. These tools allow you to manually remove malware.
I was thinking using a live linux distro which has a pdf viewer included.
1) Launch the Live linux distro as a live cd in virtual box
2) Open the pdf file using the included pdf viewer from the live linux cd
3) Print the PDF file to another PDF file.
