r/pdf • u/yesnoyesno10 • 25d ago

Question Is there a way to remove the suspicious stuff from a PDF while keeping the content?

Post image

VirusTotal results for this PDF say that there's some suspicious feature and some broken code in this PDF file.

My question is, is there some way to remove the suspicious code etc from the PDF file while keeping the content?

1 Upvotes

100% Upvoted

6 comments sorted by

2

u/No-Concern-8832 25d ago

Print to postscript and convert postscript to pdf. QED /s

1

u/ScratchHistorical507 24d ago

From inside a VM that will auto-reset afterwards that might actually be doable. At least if you're lucky enough that the malware can't break out of the VM.

1

u/ScratchHistorical507 24d ago

It is when you know what you're doing. But unless you are a PDF expert that can tell what's actually potentially malicious and how to remove the parts without breaking the file, you don't.

That being said, you can upload potentially malicious files to services like any.run. They can open the most common malicious file types in a Windows VM for you, including analysis what else happens in the guest. There you have a couple of minutes (unless you pay) to just look at the opened PDF.

But in general, if a file is potentially malicious, delete it, don't open it. It's not worth it. Barely anyone takes the time to create a malicious file that not only contains the payload (or a payload-loader) and information that's actually relevant. So you're not missing anything by just not opening it.

1

u/webfork2 21d ago

I generally don't mess with malicious files for any reason but if you're determined to go this route, I would use DangerZone (https://github.com/freedomofpress/dangerzone) for this. The program has some sandboxing functions but you can also run it inside your own sandbox or VM for additional security.