Post cover image

August 24, 2026

🚨 PDF Exploit Scanner & Patcher | Detect Malicious PDFs + Block Threats

PDF files are everywhere.

By Pentester Club

7 min read

Businesses use them for invoices, contracts, reports, resumes, presentations, forms, and internal documentation. Because PDFs are so common, they are also an attractive delivery mechanism for malicious content.

A PDF can contain much more than visible text and images. Modern PDF documents may include:

None
  • JavaScript
  • Embedded files
  • Launch actions
  • Forms
  • External references
  • Annotations
  • Multimedia
  • Object streams
  • Complex document structures

That makes PDF security analysis an important part of modern defensive security.

A useful PDF-security workflow should answer two questions:

_🔎 _Does this PDF contain suspicious or potentially dangerous structures?

and:

_🛡️ _Can we safely sanitize the document before distributing it?

This article explores the concept of a PDF Exploit Scanner & Patcher — a defensive security workflow for detecting suspicious PDF structures and producing a safer sanitized copy.

📄 Why Are PDFs a Security Concern?

A PDF looks like a simple document to the user:

┌─────────────────────────┐
│                         │
│       PDF DOCUMENT      │
│                         │
│   Text + Images         │
│                         │
└─────────────────────────┘

Internally, however, a PDF can contain a complex object hierarchy:

PDF
│
├── Catalog
├── Pages
├── Fonts
├── Images
├── Metadata
├── Actions
├── JavaScript
├── Embedded Files
└── Object Streams

This complexity creates a larger attack surface for PDF readers and processing applications.

A malicious document may attempt to abuse a vulnerability in a PDF viewer, exploit dangerous document features, or trick a user into interacting with an embedded resource.

🔎 What Is a PDF Exploit Scanner?

A PDF exploit scanner is a defensive analysis tool that examines a document for indicators associated with potentially malicious or risky PDF behavior.

A simplified architecture looks like:

📄 PDF
                  │
                  ▼
          File Validation
                  │
                  ▼
           PDF Structure
              Analysis
                  │
        ┌─────────┼─────────┐
        ▼         ▼         ▼
     Scripts   Actions   Embedded
                          Objects
        │         │         │
        └─────────┼─────────┘
                  ▼
             Risk Engine
                  │
            ┌─────┴─────┐
            ▼           ▼
         CLEAN       SUSPICIOUS
                        │
                        ▼
                    Sanitizer
                        │
                        ▼
                  Safe Copy

The important concept is that a scanner should identify risk indicators, not automatically claim that every suspicious PDF is an exploit.

🧠 Detection vs Exploitation

One of the most important distinctions in document security is:

Suspicious PDF
      ≠
Confirmed Exploit

For example, the presence of JavaScript does not automatically mean a PDF contains malware.

Similarly:

Embedded File
      ≠
Malicious File

A legitimate business document may contain attachments or interactive forms.

Therefore, a good scanner should use findings as indicators requiring context.

🔬 PDF Structure Analysis

A PDF is composed of objects that describe the document.

A simplified structure might look like:

1 0 obj
   Catalog
endobj
2 0 obj
   Pages
endobj
3 0 obj
   Page
endobj

Additional objects can describe:

  • Fonts
  • Images
  • Streams
  • Actions
  • Forms
  • Attachments

A security scanner can inspect these objects for unusual or dangerous constructs.

🚨 Suspicious PDF Features

A defensive scanner may flag structures such as:

JavaScript

PDF JavaScript can provide interactive document functionality, but it can also be abused in attacks.

OpenAction

A document can specify actions that execute when the document is opened.

Launch Actions

These can be particularly sensitive because they may attempt to launch external resources or applications.

Embedded Files

Attachments can contain additional content that needs independent inspection.

URI Actions

PDFs can contain links to external resources.

AcroForms

Forms are legitimate PDF functionality, but they can also be involved in phishing and data-collection workflows.

🧪 A Basic Scanning Workflow

A defensive analysis pipeline can be structured as:

1. Receive PDF
       ↓
2. Calculate file hash
       ↓
3. Validate PDF structure
       ↓
4. Extract metadata
       ↓
5. Inspect objects
       ↓
6. Detect suspicious features
       ↓
7. Assign risk indicators
       ↓
8. Sanitize if required
       ↓
9. Re-scan sanitized PDF
       ↓
10. Generate report

This provides a repeatable security workflow.

🔐 Step 1 — Hash the Original File

Before modifying a document, calculate a cryptographic hash.

For example:

sha256sum suspicious.pdf

The result provides an identifier for the original artifact.

Conceptually:

PDF
 │
 ▼
SHA-256
 │
 ▼
Original File Hash

This is useful for:

  • Incident response
  • Evidence tracking
  • File comparison
  • Reproducibility
  • Security investigations

Never overwrite the original evidence during analysis.

🔎 Step 2 — Inspect PDF Metadata

Metadata can provide useful information about the document.

Depending on the file, it may contain:

Author
Creator
Producer
Creation Date
Modification Date
Title
Subject

Tools such as pdfinfo can help with basic inspection:

pdfinfo suspicious.pdf

Metadata alone does not establish maliciousness, but unusual values can contribute to an investigation.

🧰 Step 3 — Extract PDF Objects

A deeper analysis examines the document's internal objects.

Security researchers may look for indicators such as:

/JavaScript
/JS
/OpenAction
/AA
/Launch
/EmbeddedFile
/URI
/AcroForm

A simple static scanner can search for suspicious object names.

For example:

strings suspicious.pdf | grep -Ei '/JavaScript|/JS|/OpenAction|/Launch|/EmbeddedFile'

However, string matching alone is not sufficient for serious analysis.

PDF files can use object streams, compression, encoding, and other structures that make simple pattern matching incomplete.

🧩 JavaScript Detection

PDF JavaScript deserves special attention.

A scanner might identify:

/JavaScript

or:

/JS

and report:

⚠ JavaScript detected
Risk: Medium
Action: Manual review

The correct response isn't necessarily:

"This PDF is malicious."

Instead:

"This PDF contains active scripting functionality and should be reviewed according to organizational policy."

🚨 OpenAction Analysis

A PDF can define actions that occur when a document is opened.

A scanner may therefore flag:

/OpenAction

The important question is:

What does the action actually do?

A benign document might use actions for legitimate navigation.

A suspicious document might combine automatic actions with other dangerous features.

Therefore, correlation matters.

📎 Embedded File Detection

PDFs can contain embedded files.

A security scanner may identify:

/EmbeddedFile

and extract metadata about the attachment without automatically opening it.

The safe workflow is:

PDF
 │
 ▼
Embedded Object
 │
 ▼
Extract Safely
 │
 ▼
Hash
 │
 ▼
Analyze Separately

Embedded files should be treated as independent potentially untrusted artifacts.

🧹 What Does "Patching" a PDF Mean?

PDF patching in a defensive context generally means sanitizing the document.

Instead of trying to repair a potentially malicious object manually, a safer approach can be to reconstruct the document while preserving only the content that is required.

For example:

Original PDF
    │
    ├── Text
    ├── Images
    ├── JavaScript
    ├── Actions
    └── Attachments
           │
           ▼
       Sanitization
           │
           ▼
    ┌────────────────┐
    │ Safe Content   │
    │ Text           │
    │ Images         │
    └────────────────┘

The sanitized document may deliberately lose advanced functionality.

That tradeoff can be acceptable when security is the priority.

🛡️ Content Disarm and Reconstruction

A more advanced approach is known as Content Disarm and Reconstruction (CDR).

The basic idea is:

Untrusted Document
        ↓
Parse
        ↓
Extract Safe Content
        ↓
Reconstruct
        ↓
New Document

Instead of trying to determine whether every malicious component is safe, the system removes potentially dangerous functionality and rebuilds the document.

This can dramatically reduce the attack surface.

🔄 Re-Scan After Sanitization

Never assume that a sanitization process succeeded.

Use:

Original PDF
    │
    ▼
Scan
    │
    ▼
Sanitize
    │
    ▼
New PDF
    │
    ▼
Scan Again

Compare the results.

For example:

Original:
JavaScript → Detected
OpenAction → Detected
Embedded File → Detected
Sanitized:
JavaScript → Not detected
OpenAction → Not detected
Embedded File → Not detected

This provides evidence that the sanitization process actually changed the document.

🧪 Safe Testing Environment

Suspicious PDFs should not be opened casually on a production workstation.

A safer architecture is:

📄 Suspicious PDF
                       │
                       ▼
                ┌──────────────┐
                │ Quarantine   │
                └──────┬───────┘
                       │
                       ▼
                ┌──────────────┐
                │ Isolated VM  │
                └──────┬───────┘
                       │
                Static Analysis
                       │
                       ▼
                  Sanitization
                       │
                       ▼
                  Re-Analysis

Additional controls can include:

  • Network isolation
  • Disposable virtual machines
  • Restricted privileges
  • No access to sensitive files
  • Snapshot/revert capability
  • Malware-analysis infrastructure

🔥 Building a PDF Security Scanner

A basic defensive application could be organized into modules:

pdf_security/
│
├── scanner.py
├── metadata.py
├── indicators.py
├── sanitizer.py
├── hashing.py
├── reporter.py
└── cli.py

Each component can have a specific responsibility.

scanner.py

Parses the PDF and coordinates analysis.

metadata.py

Extracts document metadata.

indicators.py

Detects suspicious PDF structures.

sanitizer.py

Creates a sanitized copy.

hashing.py

Calculates cryptographic hashes.

reporter.py

Generates security findings.

cli.py

Provides the command-line interface.

📊 Example Scanner Output

A useful defensive scanner could produce:

========================================
 PDF SECURITY ANALYSIS
========================================
File: invoice.pdf
SHA256: <hash>
[+] PDF structure: Valid
[+] Pages: 4
[+] Metadata: Extracted
[!] JavaScript: Detected
[!] OpenAction: Detected
[+] Embedded files: None
[+] Launch actions: None
[+] URI actions: 2
Risk Assessment:
HIGH
Recommendation:
Sanitize document before distribution.

The output should clearly distinguish:

Detected Indicator

from:

Confirmed Exploit

🧠 Risk Scoring

A scanner can assign risk based on multiple indicators.

For example:

JavaScript          +2
OpenAction          +3
Launch              +4
Embedded File       +2
Suspicious URI      +1
Malformed Objects   +3

Then:

0–2   → Low
3–5   → Medium
6–8   → High
9+    → Critical

However, these values should be treated as an internal heuristic rather than a universal vulnerability standard.

Context is essential.

🔍 Static vs Dynamic Analysis

There are two major approaches.

Static Analysis

Inspect the PDF without executing its content.

Advantages:

  • Safer
  • Fast
  • Easy to automate
  • Suitable for large document volumes

Limitations:

  • Can miss behavior hidden behind complex structures
  • May produce false positives

Dynamic Analysis

Open the document inside a controlled analysis environment and monitor behavior.

Potential observations include:

Process creation
Network connections
File creation
Registry changes
Unexpected child processes

Dynamic analysis can provide more behavioral information, but it requires substantially stronger isolation.

🛡️ Enterprise PDF Security Architecture

Organizations processing large volumes of documents can implement:

Email / Upload
                       │
                       ▼
                 File Gateway
                       │
                       ▼
                 PDF Scanner
                       │
          ┌────────────┴────────────┐
          ▼                         ▼
       Clean                    Suspicious
          │                         │
          ▼                         ▼
     Delivery                 Quarantine
                                    │
                                    ▼
                                  CDR
                                    │
                                    ▼
                              Sanitized File
                                    │
                                    ▼
                                Re-scan

This approach can help prevent potentially dangerous documents from reaching employees directly.

📧 PDF Security in Email

Email is a common delivery mechanism for malicious documents.

A secure email gateway can analyze:

Message
 │
 ├── Sender
 ├── Authentication
 ├── URLs
 ├── Attachments
 │      │
 │      ▼
 │   PDF Analysis
 │
 └── Reputation

Combining email authentication with attachment analysis provides stronger defense than relying on either control alone.

🚨 Common Mistakes

Mistake #1 — Trusting File Extensions

A file named:

invoice.pdf

shouldn't automatically be considered safe.

The actual file format should be validated.

Mistake #2 — Opening Suspicious Files Directly

Don't open unknown documents on machines containing sensitive information.

Use isolation.

Mistake #3 — Relying on One Scanner

No static scanner detects everything.

Use layered analysis.

Mistake #4 — Automatically Calling Every Finding Malware

A PDF containing JavaScript isn't necessarily malicious.

Always distinguish indicators from confirmed malicious behavior.

Mistake #5 — Modifying the Original Evidence

Keep:

Original
+
Hash
+
Analysis Results
+
Sanitized Copy

Never overwrite the original during forensic analysis.

📋 PDF Security Checklist

  • Validate the actual file format
  • Calculate SHA-256 hash
  • Extract metadata
  • Inspect PDF objects
  • Check for JavaScript
  • Check automatic actions
  • Check launch actions
  • Check embedded files
  • Check external URI actions
  • Analyze suspicious attachments separately
  • Sanitize high-risk documents
  • Re-scan sanitized output
  • Keep the original artifact
  • Use isolated analysis environments
  • Document findings

🔥 Why PDF Sanitization Matters

Traditional antivirus detection asks:

"Is this file malicious?"

A CDR-oriented security model asks:

"What functionality does this document actually need?"

If the answer is:

Text
Images
Formatting

then there may be little reason to preserve:

JavaScript
Embedded executables
Automatic actions
External launch behavior

Removing unnecessary functionality can reduce the attack surface.

🚀 Final Thoughts

PDF security is often underestimated because PDFs appear to be simple documents.

Under the hood, however, they can contain complex structures and active functionality.

A robust defensive workflow therefore looks like:

📄 Receive
   ↓
🔎 Inspect
   ↓
🧠 Analyze
   ↓
🚨 Detect Suspicious Features
   ↓
🧹 Sanitize
   ↓
🔍 Re-scan
   ↓
📊 Report
   ↓
✅ Safely Distribute

The most important lesson is:

Don't blindly trust documents just because they have a familiar file extension.

Security teams should combine:

Static analysis + sandboxing + CDR + email security + endpoint protection + user awareness.

A PDF exploit scanner and patcher can become a valuable layer in that defense, particularly when it focuses on safe analysis, transparent findings, document sanitization, and verification after remediation.

🔐 Responsible Security Notice

This article is intended for defensive cybersecurity research, malware-analysis laboratories, CTFs, document-security testing, and authorized penetration-testing environments.

Do not use malicious documents against unsuspecting users or systems. Never open potentially dangerous PDFs on production machines without appropriate security controls.

Scan suspicious documents. Sanitize aggressively. Preserve evidence. Protect users. 🚨📄🔐