Questions tagged [pdf]

Portable Document Format (PDF) is an open standard for electronic document exchange maintained by the International Organization for Standardization (ISO). Questions can be about PDF specific malware or protections.

Filter by
Sorted by
Tagged with
161
votes
14answers
17k views

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

As an investigative journalist I receive each day dozens of messages, many of which contain PDF documents. But I'm worried about some of the potentially malicious consequences of blindly opening them ...
68
votes
3answers
232k views

Can a PDF file contain a virus?

Could a PDF file contain any type of malware?
64
votes
3answers
34k views

What security scheme is used by PDF password encryption, and why is it so weak?

Many PDFs are distributed as encrypted PDFs to lock out some of their functionality (eg printing, writing, copying). However, PDF cracking software is available online, which usually cracks the PDF ...
47
votes
11answers
54k views

How to safely view a malicious PDF?

I have a PDF with important information that may contain malware. What would be the best way to view it?
43
votes
5answers
59k views

How to scan a PDF for malware? [closed]

Can anyone suggest an automated tool to scan a PDF file to determine whether it might contain malware or other "bad stuff"? Or, alternatively, assigns a risk level to the PDF? I would prefer a free ...
22
votes
4answers
6k views

Detecting and preventing 'phone home' behavior in PDF files

I have received several PDF documents via email from someone I do not trust. I need to read the documents and respond to them. They are not encrypted. I want to make sure the documents are ...
19
votes
3answers
27k views

How can I tell if a PDF file I was sent contains malware?

I was emailed a PDF file by a family member. I have reason to suspect that it was given to said family member by someone who would like nothing more than to infect me with a Remote Access Trojan. How ...
16
votes
1answer
30k views

How can I extract the hash inside an encrypted PDF file?

As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password. When auditing security, a good attemp to break PDF files passwords ...
16
votes
2answers
4k views

Effectiveness of flattening a PDF to remove malware

I'm currently looking at ways to prevent malicious PDF files at the network boundary. This will include virus scanning - but there are known limitations to that. I see a common approach is to flatten ...
16
votes
1answer
1k views

Malicious PDF Analysis

I have been analyzing a PDF I suspect to contain malicious content. For the most part, I've always trusted automated tools to determine if a PDF was safe to open. However, my eyes have been opened to ...
14
votes
2answers
42k views

How to know if a PDF file is infected?

I'm afraid to open a PDF book. When checking the file via pdfid, I get this: PDF Header:% PDF-1.6 obj 4175 endobj 4174 stream 3379 endstream 3379 xref 0 trailer 0 startxref 1 /...
10
votes
3answers
4k views

Can you directly view a malicious PDF on Linux?

There have been questions on safe viewing of malicious PDFs on OS. I would like to know if it's okay to directly open them to view them in a Linux OS because the OS is said to be secure and malware-...
10
votes
1answer
5k views

What are the security risks associated with PDF files?

What are the security risks associated with PDF files? There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be ...
8
votes
1answer
186 views

Is there a best practice regarding PDF files on website?

When a website supplies a PDF there are two options for how a user might interact with it: View it in browser Download it As the host of these files is there a security advantage one way or the ...
8
votes
1answer
424 views

Security of PDF reader software

Are there any studies regarding the security of PDF viewer software from different vendors? I try to find the most secure reader.
7
votes
2answers
16k views

How secure a secured PDF really is? [duplicate]

I've googled the internet for answers regarding secured pdf/cracking them and found huge amount of stuff. But most of it is quite old. So could someone confirm the following is still valid in modern ...
6
votes
1answer
2k views

Does embedding images in PDF retain metadata?

I have a PDF file which I can select images to embed in. The customers are not technical so I do not want them to remove metadata themselves (e.g. GPS location of photos, etc). Will the PDF ...
6
votes
5answers
468 views

Document security - how to find who's leaked a confidential document?

I am legally obliged to distribute a document (probably by email, probably saved as MS word, or a PDF) to several hundred recipients. The recipients are legally obliged to keep it confidential. ...
6
votes
1answer
99 views

Printing document on usb drive with confidential information on multi user computer

I have a pdf file with confidential information on a usb flash drive. This document needs to be printed on a multi user Ubuntu system. I want to prevent other users from seeing the content of the ...
6
votes
1answer
2k views

Bank Has Emailed My Social Security Number

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first ...
6
votes
1answer
1k views

Can I redact by converting PDF to TIFF and back?

Background My boss asked me to come up with a way ordinary users can redact information from PDF files using free software. We get a lot of scanned documents and our client requires that sensitive ...
5
votes
3answers
6k views

Detected virus in pdf - should I be worried (CVE-2014-8449)?

I downloaded a pdf earlier, and I was trying to send it to my friend, but gmail said that it detected a virus. So I ran it through virustotal.com and only 1 out of 56 scanners came up with a virus - ...
5
votes
1answer
2k views

PDF file encrypted with my password, does that mean my password is stored in plaintext?

Every month, I receive an encrypted Portable Document Format (PDF) file with my payslip. I can open the file for reading with my password. Without providing my password, I cannot open the file at ...
5
votes
1answer
692 views

Verification of a timestamped PDF

I'm kinda new to the process of timestamping files to provide digital integrity. For testing purposes, i use tsa.safecreative.org for PDF files. Now i've signed a couple PDF files and if i open up ...
5
votes
1answer
2k views

Standard to represent digital signature on paper

Users are making a deal using the website. Website generated PDF file (something like contract or report). Users perform digital signing of this file (analogous to hand-written signature on paper ...
5
votes
4answers
1k views

Remove pdf malware by re-printing to new pdf or text extract?

Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either: open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program "print-...
5
votes
1answer
109 views

Could PDF's `/Filespec` type allow for remote file access?

I've read the PDF 1.7 spec 7.11.1 (okay, not all the spec, but a part of it), and I've seen that you have what Adobe calls /Filespec type objects. As far as I get it, this means that a PDF can make a ...
5
votes
1answer
2k views

Extract malicious code from PDF file

I've a PDF file that contains some malicious code; when opened the processor usage maxes out and the fans run at full rpm. The pdfid.py produces the following output: PDF Header: %PDF-1.7 obj ...
5
votes
0answers
156 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
4
votes
3answers
1k views

Is a PDF creating service vulnerable for injection of malicious code

We have a report in our web application that being shown in tabular format in HTML. This report has the provision to be downloaded as PDF by clicking the download as PDF button. The question is about ...
4
votes
2answers
3k views

Malicious PDF file upload

I have a web server for my customers to upload their PDF files. I have also an IDS/IPS with Anti-Malware license that is between the user and the web server and blocks malicious PDF files from ...
4
votes
2answers
18k views

Cracking a password Protected pdf file using John the ripper

What exactly happens after I provide the hash from the pdf file to John for cracking the password? Does John extract just the password hash from the file and work on it, or is there something else?
4
votes
2answers
7k views

Removing malware from a malicious PDF file [duplicate]

I have analyzed a large PDF using Didier Steven's pdfid tool. I get the following result: Now that I know there is malicious content in the PDF, what can I do to remove it? I would still like to view ...
4
votes
2answers
2k views

How to remove meta and sensitive data from PDF file?

I've some PDF files generated from different sources (such as web-browser, Photoshop, etc.) on Unix. How do I make sure PDF doesn't contain any sensitive information such as IP address, OS, user name,...
4
votes
1answer
283 views

Can the conversion of a malicious PDF to image be exploitable?

Let's say I want to allow to the customer's of my website to upload PDF documents. What would be more safe to do: Convert the PDF to image using a library and store it in my file server as an image? ...
4
votes
1answer
2k views

Why won't pdf2john extract the password hash of this encrypted pdf? Getting blank results

New to the community, and to JtR and Hashcat as a whole, but after searching for a few days I couldn't find a solution to this specific problem. I have a password protected PDF file that I'm trying ...
4
votes
2answers
121 views

what kind of signature to require in a medical B2C environment

I can't seem to find what is standard practice regarding signing/validating pdf files in a medical B2C environment. (A chiropractor's practice counts as medical, doesn't it?) I find quite a bit about ...
4
votes
4answers
6k views

How to detect malicious JavaScript in a PDF file?

Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are ...
4
votes
2answers
1k views

What is a secure method to send pdf files with private information? [duplicate]

An employer wants me to send an i-9 form, which has my social and date of birth, via e-mail to their HR department. This seems quite baffling to me why they would want me to just send the form in ...
3
votes
1answer
634 views

How to de-obfuscate a malicious payload?

I've received some spam email that led to a JavaScript file which I assume is malicious. My curiosity got the best of me so I opened the file in notepad and I'm trying to make sense of the code but I ...
3
votes
1answer
120 views

Can a PDF embed a tracking image?

I know that PDFs can contain embedded images and Javascript. Can a PDF contain something that tracks you? For instance, can it contain a remote image that, when the PDF is opened, will fetch that ...
3
votes
2answers
361 views

Hash value changes after first opening a file

Is it possible or normal that the hash value of a file changes just after the first opening/execution of it? I used sha256sum function within Ubuntu terminal to check the hash values before and after ...
3
votes
1answer
150 views

Does Adobe Acrobat Reader DC upload opened PDF files?

I'm wondering if Adobe Reader DC uploads all the PDF files it opens to the Adobe Cloud, even if you have not signed up for the cloud. I am not a fan of Adobe and generally do not install Adobe ...
3
votes
1answer
2k views

How strong is PDF security/encryption?

I want to securely convey a PDF document containing sensitive information from my system to another system. The latter is operated by a different person, whom I trust. However, this person does not ...
3
votes
1answer
142 views

PDF Documents in Browser 2020

I have a project where I would like to allow a user to view a document (PDF) in their browser by clicking on a link or thumbnail of the file. They would be able to download said file. Ive just begun ...
3
votes
1answer
1k views

How do digital signatures on PDF documents work?

I recently filled out a PDF document which required me to append a digital signature. The PDF document had a link embedded in it that I clicked and went through the process. I am curious how this ...
3
votes
1answer
91 views

What is the industry standard practice for saving a potentially (likely) malicious PDF for analysis?

I've received an email with an attached PDF which has many signs of being a malicious attachment. Lacking the time and resources to analyze it at the moment, I'd like to store it for later use, and ...
3
votes
1answer
1k views

Send GET request from a PDF file

I'm currently working on a security Proof Of Concept where I need to show the danger of opening an unknown PDF file. Internet says that many malwares use Javascript in PDF document (AcroJS) to ...
3
votes
1answer
2k views

PDF and embedded JavaScript

We have completed a vulnerability and a penetration test. One feature of our application allows for documents to be uploaded, and we allow for PDF documents. Prior to a document being accepted we ...
3
votes
1answer
743 views

Execute Shellcode embedded into a picture? [duplicate]

Somebody told me it is possible to insert shellcode into an image or pdf file and execute the shellcode if the image or pdf file was opened. I know that this could be possible if the application (for ...