Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [pdf]

Portable Document Format (PDF) is an open standard for electronic document exchange maintained by the International Organization for Standardization (ISO). Questions can be about PDF specific malware or protections.

Filter by
Sorted by
Tagged with
0 votes
0 answers
37 views

Do MS Word and Adobe Elf/Acrobat block javascripts from running?

I opened a pdf yesterday and found out it contained javascripts (that could possibly be malcious.) I wanted to know if the javascripts would trigger if I opened it in Word "protected view" ...
Kyle Yang's user avatar
0 votes
0 answers
97 views

Malware in a PDF

I opened a PDF yesterday. How large would a PDF be that has malware? The one I downloaded was approximately 5 MB. If I opened the PDF on a browser, would the browser be infected? For some context: I ...
EDE's user avatar
  • 1
1 vote
1 answer
121 views

Does PDF level compression implicitly cleans file of malware?

Recently I've been looking into PDF files security, specifically about malware exploiting vulnerabilities in PDF readers. I thought about one thing - does compressing PDF file (for example, by using ...
Madzik's user avatar
  • 13
1 vote
1 answer
323 views

How safe it is to view PDF file in browser without downloading the file into PC?

When I view the PDF file in a browser such as FireFox without downloading the file into my PC, does FireFox temporarily store the PDF file in my PC? I heard that FireFox has been sandbox heavily and ...
JUZ Aviewer's user avatar
0 votes
0 answers
135 views

I am trying to identify suspicious content within a PDF file

I have a PDF file that has been sent to me as part of a suspicious email. I viewed the email as message source from within outlook. This gave me all raw text within the email. I copied this to ...
JHM's user avatar
  • 1
1 vote
1 answer
108 views

Do frequently crashing programs pose a bigger security threat than stable programs?

If I have an app that's frequently and randomly crashing, will it impose a bigger security threat (e.g: possible attack vector) than apps that are stable? Or are both apps equally protected from such ...
AvidSeeker's user avatar
0 votes
1 answer
357 views

Is there a safe alternative to PDF?

As PDF may contain malicious code, is there any easy to use file format providing the same features ? If not, could you share recommendations to limit the attack surface for average users ? (exclude ...
Sumak's user avatar
  • 103
0 votes
1 answer
186 views

Fuzzy hash of a file

Could someone please explain this to me: When you use a fuzzy hash algorithm (ssdeep, tlsh, sdhash... or any other) to calculate the hash value of a file, does it calculate the hash based on the whole ...
Moooz's user avatar
  • 35
1 vote
2 answers
1k views

Check if javascript in pdf is malicious

I used Didier Stevens's pdfid.py to check a pdf, and it found js and automatic actions associated with the pdf: How do I check if this is malicious code?
Randusr's user avatar
  • 23
0 votes
0 answers
40 views

How to "clean" PDF to remove non-text and non-images in Product User Manual? [duplicate]

I need guidance on, with the least security risk, how to edit Product User Manuals and Engineering Drawings PDFs from the internet. Antivirus is insufficient, according to advice from a website which ...
panes-rubrics's user avatar
0 votes
1 answer
220 views

Is it possible to use hashcat or john the ripper on a .drmz file?

I have n .drmz files which I can read with Javelin PDF Reader. Obviously to access the content I need a password, which I have, the same for each file. In case I don't have the password is there a way ...
Biggab's user avatar
  • 3
0 votes
1 answer
3k views

Volatility: AutoMagic Symbol Table error

I am trying to analyze the .vmem file from HoneyNet challenge 3: Banking Troubles (HoneyNet) using volatility3. But I can't seem to get past this error: PS C:\Users\<user>\Desktop\HoneyNet\...
Varghese George's user avatar
0 votes
0 answers
2k views

How to inspect for potential malware on pdf attachment?

I received an email at work the other day from a client (with the correct email address) that had a pdf attached. When I opened the pdf, it said the client had required the recipient to login to ...
Elaine's user avatar
  • 9
1 vote
1 answer
201 views

Can websites, through cookies or other usual means, access PDFs opened in browser?

Can websites through the use of cookies or other usual means, see the content in a PDF (saved and opened locally or opened from the web) that is also opened in the browser at the same time, or in the ...
AndroidUser558's user avatar
1 vote
1 answer
734 views

Can a PDF file make network requests to remote computers?

Do PDF files have the ability to ping a remote server such that the remote server will know that I opened the PDF file? If so, how do I stop that? I am using the Evince PDF reader on my computer that ...
Flux's user avatar
  • 913
1 vote
1 answer
401 views

Why do you need to wrap bash command inside another when opening a reverse shell?

In the CSAW 2022 web challenge, called "my little website", a youtuber in this video used a vulnerability in md-to-pdf to run arbitrary js, and this is the payload used: ---js ((require[&...
snatchysquid's user avatar
0 votes
1 answer
177 views

Using PDF files from dubious sources

In one of my university courses, the lecture materials (solutions to homework assignments) are not fully supplied by the university itself, but have to be created by the students themselves: The ...
auto_driving_q's user avatar
1 vote
1 answer
4k views

Are there any known vulnerabilities that exploit google's PDF viewer?

I have told my users for years not to ever click on PDF Documents if they are not 100% sure they know where it came from as they can sometimes be the delivery vector for malicious code. Recently, one ...
CaffeineAddiction's user avatar
1 vote
2 answers
2k views

John The Ripper unable to crack long PDF passwords

Steps I follow: I protected a PDF with a long password (I am trying with 38 characters password). I created a dictionary that contains the password to crack the PDF with John the Ripper. I run john --...
pericopo10's user avatar
0 votes
2 answers
4k views

Is it still possible to embed executables in PDF in 2022?

I have searched and found those posts how to embed exe file to pdf? and https://stackoverflow.com/questions/2941700/can-i-embed-an-exe-payload-in-a-pdf-doc-ppt-or-any-other-file-format, but they are ...
dovod74538's user avatar
2 votes
1 answer
549 views

Website with embedded PDFs and JavaScript for Acrobat

Context On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files. I was wondering if this could come with security issues. The uploaded PDF are ...
SitAmet's user avatar
  • 21
1 vote
3 answers
17k views

Is there a way to scan a pdf to ensure it doesn't contain anything that could be a virus?

The answers to Can a PDF file contain a virus? show that clearly it can! Sometimes we can be quite sure a certain pdf should not need to do anything sophisticated - for example a book in pdf form - so ...
stevec's user avatar
  • 1,280
1 vote
1 answer
182 views

Personally identifiable information in a PDF bank statement?

I have got to upload a sample bank statement PDF online which is going to accessible to everyone. I have obviously edited out all account details, names, codes, transaction particulars and the ...
callmeanythingyouwant's user avatar
0 votes
1 answer
2k views

What hidden metadata might be embedded in a PDF that is not visible "to the naked eye"?

I have edited a PDF file in Acrobat, which left some metadata and I am wondering: What metadata might be possible to discern from the end file if I were to send it to external parties? What actions ...
Ohan's user avatar
  • 101
1 vote
2 answers
303 views

When receiving PDFs from unknown sources, is it sufficient to remove dynamic content to minimise attack surface?

My company allows customers to upload PDFs, JPEGs and PNGs to our servers, which are then viewed by clients. We want to minimise the potential for attack on the clients. While the image formats are ...
DividedByZero's user avatar
1 vote
1 answer
197 views

Secure PDF Document Transmission for US State Government Official

I have been requested to send a copy of a past year tax return to a US state office. I have been in contact with a tax official by email to send this copy through various means. This state is a few ...
shaky_dispute's user avatar
0 votes
1 answer
552 views

Do pdf files pose a higher security risk than regular image files (png, jpeg, etc.)?

Do pdf files pose a higher security risk than regular image files (png, jpeg, etc.)? In my understanding is that most image files don't carry any security risk because all exploits were fixed, but ...
Sayaman's user avatar
  • 111
1 vote
2 answers
239 views

HSM High Volume Keys

Our project is to apply digital signature to PDF, so each user should have their own key pairs and a certificate. To keep key securely, we plan to purchase HSM, but from what I understand HSM have a ...
Norak's user avatar
  • 111
1 vote
0 answers
580 views

A PDF ran GetAdaptersAddresses. Should I be concerned?

I received and opened a PDF that ran: GetTickCount IsDebuggerPresent SetWindowsHookExW Sleep GetAdaptersAddresses These are the 2 files it wrote: C:\Windows\ServiceProfiles\LocalService\AppData\...
Allsonto's user avatar
1 vote
1 answer
3k views

Strange virustotal tags on pdf file

I've received PDF at work, which I then ran through virustotal scan out of habit. It turned out to be clean, but at the same time some tags caught my attention, namely: checks-user-input detect-debug-...
Fraymonix's user avatar
1 vote
2 answers
531 views

Vulnerabilities in Receiving User-Submitted PDF Files Through HTTP(S)

For context; I have a web application that allows users to upload a PDF file from which the web app extracts certain information by parsing it. The app then sends this information to another server ...
portabletable's user avatar
16 votes
2 answers
6k views

Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?

Opening a PDF link in the browser (e.g. google chrome with the ootb PDF viewer plugin) apparently indicates that when the PDF is hosted on a cloudflare-facing domain there is additional data present ...
ccpizza's user avatar
  • 291
0 votes
0 answers
911 views

Get encrypted PDF password

For a CTF challenge, I got a locked PDF file with a data folder that contains images, a plaintext file and a wav audio file. I used pdf2john.pl to get the password hash and I performed a brute force ...
sproadn's user avatar
0 votes
1 answer
1k views

Where is the PDF encryption key stored

Assuming you have the user protected PDF file. Using the password, the cryptographic key is generated and the file encrypted. Where is the key stored, is it on the RAM every time the file is opened?
shogunisgone's user avatar
4 votes
3 answers
3k views

Is Firefox's new JavaScript support within PDF files a security concern?

Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
End Antisemitic Hate's user avatar
4 votes
3 answers
977 views

How to harden Adobe Acrobat and Acrobat Reader [closed]

I found this recommendation by the CISA to disable Javascript in Acrobat Reader. Also, this article recommends to disable Flash and Multimedia, and the opening of non-PDF attachments. Both ...
Victor's user avatar
  • 423
1 vote
2 answers
3k views

What PDF file format alternative should I choose if I am looking for more security in my document files? [closed]

There are tons of exploits being created using the PDF file format for most PDF viewers out there every year. PDF files have lots of power and can utilize things such as JavaScript. This is really ...
linker's user avatar
  • 127
1 vote
0 answers
2k views

John the ripper - "no password hashes loaded " for pdf

I'm trying to decrypt a pdf that I no longer have the password for. When I use JohnTheRipper, it can't seem to load any password hashes. Basically, this is what I run. └─$ perl pdf2john.pl /home/...
user6836893's user avatar
0 votes
2 answers
505 views

Can converting a virus-infected webpage to PDF format still contain viruses [closed]

So I know that PDF files can contain viruses themselves if they are target specifically for that purpose. However, my question for here is this: If a webpage that has some malicious scripts or a virus ...
elypros's user avatar
0 votes
2 answers
1k views

Foxit Reader - disable JavaScript / Safely read PDF

Today I disabled JavaScript in my Foxit Reader settings because I hope to gain better security against malware embedded in PDF books I read. As some sort of simple check I tried to open a PDF with ...
renzoranzo's user avatar
0 votes
1 answer
660 views

Is converting malicious PDF to JPG then backwards via web services is good method to obtain safe PDF?

I've downloaded a book but by default its considered malicious by me. I thought of converting that PDF to JPG here: https://smallpdf.com/pl/pdf-do-jpg Then backwards: https://smallpdf.com/pl/jpg-to-...
noone's user avatar
  • 3
0 votes
2 answers
2k views

Is it impossible to have a PDF file execute a command without abusing any exploits?

We are running a purple team which includes attempting to run a malicious PDF on the target system. The targeted user is well aware of the exercise so there is no concerns about an AV picking the ...
trallgorm's user avatar
  • 885
1 vote
0 answers
286 views

Is the most secure way of viewing an infected pdf file through a cloud pdf reader like xodo using a pdf uploaded to Google Drive?

Is the most secure way of viewing an infected pdf file through a cloud pdf reader like xodo using a pdf uploaded to Google Drive? I have a work laptop and I currently work for a small startup that had ...
Sayaman's user avatar
  • 111
2 votes
1 answer
5k views

Unable to get John the Ripper to crack PDF password

I am new to Kali Linux and JTR but am playing around trying to crack a PDF file. I set the PDF Password to test so it's a known password on my own file. For whatever reason JTR appears to finish ...
Hooplator15's user avatar
2 votes
1 answer
512 views

How can a pdf file have two passwords?

I receive emails from my bank with password protected PDF files, and they provide two passwords - either xxxx or yyyy. How is this possible?
Neeraj's user avatar
  • 121
4 votes
3 answers
12k views

Gmail warns about encrypted PDF file

I recently received a PDF file that, when attached to a gmail message, causes a warning to be displayed as follows: Encrypted attachment warning – Be careful with this attachment. This message ...
Marcus Junius Brutus's user avatar
5 votes
1 answer
2k views

Can a PDF embed a tracking image?

I know that PDFs can contain embedded images and Javascript. Can a PDF contain something that tracks you? For instance, can it contain a remote image that, when the PDF is opened, will fetch that ...
D.W.'s user avatar
  • 99.9k
2 votes
1 answer
678 views

Why do PDFs contain password hashes?

Reading this question about extracting PDF password hashes to feed into john the ripper has me wondering why password hashes are in a PDF in the first place? Shouldn't it be using the supplied ...
Mike Ounsworth's user avatar
0 votes
0 answers
57 views

John the Ripper [duplicate]

I've already cracked a PDF with pdf2john but it doesn't show the password. What could be the problem? (The password isn't blank.)
Márton Környei's user avatar
0 votes
0 answers
1k views

Android 10 downloaded suspicious files without my permission

This is my first question on this forum so please let me know if I need to clarify anything. My Android 10 Pixel 2 just downloaded 2 files without my permission today, both named something to the ...
jimothy's user avatar