Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [pdf]

Portable Document Format (PDF) is an open standard for electronic document exchange maintained by the International Organization for Standardization (ISO). Questions can be about PDF specific malware or protections.

Filter by
Sorted by
Tagged with
159 votes
14 answers
19k views

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

As an investigative journalist I receive each day dozens of messages, many of which contain PDF documents. But I'm worried about some of the potentially malicious consequences of blindly opening them ...
Tom the journalist's user avatar
87 votes
3 answers
306k views

Can a PDF file contain a virus?

Could a PDF file contain any type of malware?
user avatar
73 votes
3 answers
39k views

What security scheme is used by PDF password encryption, and why is it so weak?

Many PDFs are distributed as encrypted PDFs to lock out some of their functionality (eg printing, writing, copying). However, PDF cracking software is available online, which usually cracks the PDF ...
March Ho's user avatar
  • 1,705
62 votes
11 answers
109k views

How to safely view a malicious PDF?

I have a PDF with important information that may contain malware. What would be the best way to view it?
user avatar
46 votes
5 answers
86k views

How to scan a PDF for malware? [closed]

Can anyone suggest an automated tool to scan a PDF file to determine whether it might contain malware or other "bad stuff"? Or, alternatively, assigns a risk level to the PDF? I would prefer a free ...
D.W.'s user avatar
  • 99.9k
21 votes
4 answers
8k views

Detecting and preventing 'phone home' behavior in PDF files

I have received several PDF documents via email from someone I do not trust. I need to read the documents and respond to them. They are not encrypted. I want to make sure the documents are ...
Tim's user avatar
  • 211
21 votes
2 answers
65k views

How to know if a PDF file is infected?

I'm afraid to open a PDF book. When checking the file via pdfid, I get this: PDF Header:% PDF-1.6 obj 4175 endobj 4174 stream 3379 endstream 3379 xref 0 trailer 0 startxref 1 /...
stackflow's user avatar
  • 325
20 votes
1 answer
55k views

How can I extract the hash inside an encrypted PDF file?

As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password. When auditing security, a good attemp to break PDF files passwords ...
Sopalajo de Arrierez's user avatar
20 votes
3 answers
41k views

How can I tell if a PDF file I was sent contains malware?

I was emailed a PDF file by a family member. I have reason to suspect that it was given to said family member by someone who would like nothing more than to infect me with a Remote Access Trojan. How ...
user158844's user avatar
19 votes
2 answers
6k views

Effectiveness of flattening a PDF to remove malware

I'm currently looking at ways to prevent malicious PDF files at the network boundary. This will include virus scanning - but there are known limitations to that. I see a common approach is to flatten ...
symcbean's user avatar
  • 18.6k
16 votes
2 answers
6k views

Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?

Opening a PDF link in the browser (e.g. google chrome with the ootb PDF viewer plugin) apparently indicates that when the PDF is hosted on a cloudflare-facing domain there is additional data present ...
ccpizza's user avatar
  • 291
16 votes
1 answer
2k views

Malicious PDF Analysis

I have been analyzing a PDF I suspect to contain malicious content. For the most part, I've always trusted automated tools to determine if a PDF was safe to open. However, my eyes have been opened to ...
Ccorock's user avatar
  • 263
15 votes
8 answers
4k views

Document security - how to find who's leaked a confidential document?

I am legally obliged to distribute a document (probably by email, probably saved as MS word, or a PDF) to several hundred recipients. The recipients are legally obliged to keep it confidential. ...
ConanTheGerbil's user avatar
12 votes
1 answer
9k views

What are the security risks associated with PDF files?

What are the security risks associated with PDF files? There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be ...
End Antisemitic Hate's user avatar
11 votes
3 answers
9k views

Can you directly view a malicious PDF on Linux?

There have been questions on safe viewing of malicious PDFs on OS. I would like to know if it's okay to directly open them to view them in a Linux OS because the OS is said to be secure and malware-...
BlackSwan's user avatar
  • 213
9 votes
1 answer
7k views

Does embedding images in PDF retain metadata?

I have a PDF file which I can select images to embed in. The customers are not technical so I do not want them to remove metadata themselves (e.g. GPS location of photos, etc). Will the PDF ...
Anderson's user avatar
  • 495
9 votes
4 answers
19k views

How to detect malicious JavaScript in a PDF file?

Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are ...
Bob Ortiz's user avatar
  • 6,665
9 votes
2 answers
26k views

How secure a secured PDF really is? [duplicate]

I've googled the internet for answers regarding secured pdf/cracking them and found huge amount of stuff. But most of it is quite old. So could someone confirm the following is still valid in modern ...
user1909791's user avatar
8 votes
4 answers
4k views

Remove pdf malware by re-printing to new pdf or text extract?

Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either: open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program "print-...
user3200534's user avatar
8 votes
1 answer
599 views

Is there a best practice regarding PDF files on website?

When a website supplies a PDF there are two options for how a user might interact with it: View it in browser Download it As the host of these files is there a security advantage one way or the ...
pzirkind's user avatar
  • 747
8 votes
1 answer
3k views

PDF file encrypted with my password, does that mean my password is stored in plaintext?

Every month, I receive an encrypted Portable Document Format (PDF) file with my payslip. I can open the file for reading with my password. Without providing my password, I cannot open the file at ...
gerrit's user avatar
  • 1,910
8 votes
1 answer
797 views

Security of PDF reader software

Are there any studies regarding the security of PDF viewer software from different vendors? I try to find the most secure reader.
Jadibon's user avatar
  • 81
7 votes
2 answers
22k views

Cracking a password Protected pdf file using John the ripper

What exactly happens after I provide the hash from the pdf file to John for cracking the password? Does John extract just the password hash from the file and work on it, or is there something else?
rats20's user avatar
  • 119
7 votes
1 answer
8k views

Why won't pdf2john extract the password hash of this encrypted pdf? Getting blank results

New to the community, and to JtR and Hashcat as a whole, but after searching for a few days I couldn't find a solution to this specific problem. I have a password protected PDF file that I'm trying ...
Baljeet Appleseed's user avatar
6 votes
1 answer
648 views

Printing document on usb drive with confidential information on multi user computer

I have a pdf file with confidential information on a usb flash drive. This document needs to be printed on a multi user Ubuntu system. I want to prevent other users from seeing the content of the ...
user avatar
6 votes
1 answer
4k views

Bank Has Emailed My Social Security Number

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first ...
Rob P.'s user avatar
  • 245
6 votes
2 answers
8k views

Extract malicious code from PDF file

I've a PDF file that contains some malicious code; when opened the processor usage maxes out and the fans run at full rpm. The pdfid.py produces the following output: PDF Header: %PDF-1.7 obj ...
zindarod's user avatar
  • 161
6 votes
1 answer
2k views

Can I redact by converting PDF to TIFF and back?

Background My boss asked me to come up with a way ordinary users can redact information from PDF files using free software. We get a lot of scanned documents and our client requires that sensitive ...
browly's user avatar
  • 2,100
5 votes
3 answers
6k views

Detected virus in pdf - should I be worried (CVE-2014-8449)?

I downloaded a pdf earlier, and I was trying to send it to my friend, but gmail said that it detected a virus. So I ran it through virustotal.com and only 1 out of 56 scanners came up with a virus - ...
Sehejen's user avatar
  • 51
5 votes
1 answer
2k views

Can a PDF embed a tracking image?

I know that PDFs can contain embedded images and Javascript. Can a PDF contain something that tracks you? For instance, can it contain a remote image that, when the PDF is opened, will fetch that ...
D.W.'s user avatar
  • 99.9k
5 votes
1 answer
1k views

Verification of a timestamped PDF

I'm kinda new to the process of timestamping files to provide digital integrity. For testing purposes, i use tsa.safecreative.org for PDF files. Now i've signed a couple PDF files and if i open up ...
James Cameron's user avatar
5 votes
1 answer
3k views

Standard to represent digital signature on paper

Users are making a deal using the website. Website generated PDF file (something like contract or report). Users perform digital signing of this file (analogous to hand-written signature on paper ...
vbezhenar's user avatar
  • 257
5 votes
1 answer
3k views

How do digital signatures on PDF documents work?

I recently filled out a PDF document which required me to append a digital signature. The PDF document had a link embedded in it that I clicked and went through the process. I am curious how this ...
Minaj's user avatar
  • 1,576
5 votes
1 answer
2k views

How strong is PDF security/encryption?

I want to securely convey a PDF document containing sensitive information from my system to another system. The latter is operated by a different person, whom I trust. However, this person does not ...
no.human.being's user avatar
5 votes
1 answer
2k views

Can the conversion of a malicious PDF to image be exploitable?

Let's say I want to allow the customers of my website to upload PDF documents. What would be more safe to: Convert the PDF to image using a library and store it in my file server as an image? Can the ...
elli's user avatar
  • 339
5 votes
1 answer
3k views

What is the difference between PKCS#7 and CADES, PADES and XADES?

I am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me.
rashid's user avatar
  • 51
5 votes
0 answers
225 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
samgak's user avatar
  • 2,068
4 votes
3 answers
2k views

Is a PDF creating service vulnerable for injection of malicious code

We have a report in our web application that being shown in tabular format in HTML. This report has the provision to be downloaded as PDF by clicking the download as PDF button. The question is about ...
Aditya Cherla's user avatar
4 votes
2 answers
7k views

Malicious PDF file upload

I have a web server for my customers to upload their PDF files. I have also an IDS/IPS with Anti-Malware license that is between the user and the web server and blocks malicious PDF files from ...
fargo01's user avatar
  • 45
4 votes
3 answers
976 views

How to harden Adobe Acrobat and Acrobat Reader [closed]

I found this recommendation by the CISA to disable Javascript in Acrobat Reader. Also, this article recommends to disable Flash and Multimedia, and the opening of non-PDF attachments. Both ...
Victor's user avatar
  • 423
4 votes
1 answer
3k views

Is it safe to view local pdf files in a browser?

When receiving a pdf file by e-mail, the question is how to open it. Browsers are normally quite secure, don't support all pdf features (an advantage in this case) and the viewer/conversion might ...
leuk98743's user avatar
4 votes
2 answers
11k views

Removing malware from a malicious PDF file [duplicate]

I have analyzed a large PDF using Didier Steven's pdfid tool. I get the following result: Now that I know there is malicious content in the PDF, what can I do to remove it? I would still like to view ...
Mike's user avatar
  • 141
4 votes
2 answers
4k views

How to remove meta and sensitive data from PDF file?

I've some PDF files generated from different sources (such as web-browser, Photoshop, etc.) on Unix. How do I make sure PDF doesn't contain any sensitive information such as IP address, OS, user name,...
cicada's user avatar
  • 43
4 votes
3 answers
3k views

Is Firefox's new JavaScript support within PDF files a security concern?

Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
End Antisemitic Hate's user avatar
4 votes
3 answers
12k views

Gmail warns about encrypted PDF file

I recently received a PDF file that, when attached to a gmail message, causes a warning to be displayed as follows: Encrypted attachment warning – Be careful with this attachment. This message ...
Marcus Junius Brutus's user avatar
4 votes
2 answers
181 views

what kind of signature to require in a medical B2C environment

I can't seem to find what is standard practice regarding signing/validating pdf files in a medical B2C environment. (A chiropractor's practice counts as medical, doesn't it?) I find quite a bit about ...
donutguy640's user avatar
4 votes
1 answer
237 views

Could PDF's `/Filespec` type allow for remote file access?

I've read the PDF 1.7 spec 7.11.1 (okay, not all the spec, but a part of it), and I've seen that you have what Adobe calls /Filespec type objects. As far as I get it, this means that a PDF can make a ...
Xenos's user avatar
  • 1,371
4 votes
1 answer
2k views

Execute Shellcode embedded into a picture? [duplicate]

Somebody told me it is possible to insert shellcode into an image or pdf file and execute the shellcode if the image or pdf file was opened. I know that this could be possible if the application (for ...
Bowmann's user avatar
  • 57
4 votes
1 answer
880 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
GarlicCheese's user avatar
4 votes
2 answers
3k views

What is a secure method to send pdf files with private information? [duplicate]

An employer wants me to send an i-9 form, which has my social and date of birth, via e-mail to their HR department. This seems quite baffling to me why they would want me to just send the form in ...
jman's user avatar
  • 143