I wonder if anyone can help me with the results of my virustotal-scan (online virus lab).

I submitted a pdf-file of an Russian-German textbook ("1_Ulrike_Patow_Gabriela_Stelzig_Russisch_bitte.pdf") to virustotal.

The results were fine: 0/59. So it seemed the wouldn´t be any issues (see: https://www.virustotal.com/de/file/a7bb9a6e8a0f217844a343f171e158e2f57fce062c974ccec7f9d3e34c8bf60e/analysis/1526815455/)

When viewing the "file details" however it said:

This PDF file contains 1 JavaScript block. Malicious PDF documents often contain JavaScript to exploit JavaScript vulnerabilities and/or to execute heap sprays. Please note you can also find JavaScript in PDFs without malicious intent.

This PDF file contains an automatic action to be performed when a given page of the document is viewed. Malicious PDF documents with JavaScript very often use an automatic action to launch the JavaScript without user interaction.

The combination of automatic actions and JavaScript makes this PDF document suspicious.

Now I´m unsure what to make of it. How can it be that all the engines found no danger whatsoever whereas there´s the additional information concerning JavaScript block and automatic action? Tnx.

My system: Linux/Lubuntu 16.04.4 LTS, 64 bit


Short answer: Your PDF is probably safe.

Your question isn't Ubuntu specific -- however -- you're quoting the "PDFiD information" in the VirusTotal report which is just helpful metadata. The scanners didn't find anything malicious in the embedded JS, but the metadata tool is just telling you that the embedded scripts could be an exploit vector (e.g., harboring zero-days the scanners missed).

You can manually go through the JS in the PDF with 3rd-party tools as per https://security.stackexchange.com/a/2897 if you are concerned.

Alternatively, you may view the PDF with a client that doesn't support scripting at all, negating the possibility of malicious JavaScript execution.

| improve this answer | |
  • Hi. Tnx for your answer. Well, what you said seems to be good news. Alternatively, you may view the PDF with a client that doesn't support scripting at all O.K., I´m interested in this. Alas I´ve got no idea what pdf-reader to use. At the moment I´ve got evince and okular available but don´t know whether they support scripting or not. Could you suggest something? Tnx. – Rosika May 20 '18 at 13:06
  • 1
    Hi. Tnx for the answer and the link. I´m glad to be able to use evince safely. As I have that one already available I think I´ll choose this option. Just to be on the safe side. Greetings. – Rosika May 20 '18 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.