See what a PDF runs and collects FORMAUDIT
A PDF can run script, submit what you type to an address it chooses, hide fields and carry attachments. FORMAUDIT reads the file in your browser and tells you what is in there.
How it works
A PDF is a program as well as a page
People treat a PDF as a picture of a document. The format allows rather more than that, and the parts that matter are not visible when you read it.
- JavaScript. A PDF can carry script and run it, and an open action runs on load without any interaction at all. Historically this has been the delivery mechanism for a long line of reader exploits.
- A submit action. A form field can send what you type to an address the document chooses, which need not be the organisation whose logo is at the top. A fill-in form that quietly posts elsewhere is a credible phishing vehicle precisely because a PDF feels inert.
- Hidden fields. Fields present in the file and not drawn on the page, which travel back with everything else when the form is submitted, including ones pre-filled with an identifier for you.
- Embedded attachments. A PDF can carry other files inside it, of any type.
- Remote references. An image or resource fetched from a URL when the document opens, which confirms to the sender that you opened it and when: the same trick as a tracking pixel in email.
It reads the compressed object streams as well as the plain ones, which matters because everything above is normally compressed, and a tool that only reads what it can see in the raw bytes reports a clean file.
Reading the result
A finding is not a verdict. Legitimate forms carry JavaScript for field validation and totals; legitimate documents carry attachments on purpose. What deserves attention is the mismatch: script in a document that is not a form, a submit action to a domain that is not the sender's, hidden fields in something you are being asked to fill in, a remote reference in what is supposed to be an offline document.
If it is suspicious, do not open it in a reader to find out; that is the action the file may be waiting for. Read it here first. DISARM strips the script, the actions and the attachments and gives back a document that is only a document, and X-RAY is the broader look at what a file is hiding.
Doing this often? PDF Studio edits forms, with fields, drop-downs and checks, and flattens filled forms across a batch. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.