PDF red flags

Scan a PDF's raw bytes for tokens that indicate active content, JavaScript, auto-open actions, embedded files, incremental updates, as a quick triage signal, not proof of malice.

PDF red flags counts eight raw-byte tokens tied to active content, from /URI and /Launch through /JavaScript, /JS, /OpenAction, /AA, /EmbeddedFile and /RichMedia, tallying %%EOF markers for post-save edits. Five of those eight count as high risk on their own. Because this counts bytes rather than parsing real PDF objects, a token inside an unrelated literal string can trigger a false flag.

Questions

What tokens does it scan for?

/JavaScript, /JS, /OpenAction, /AA, /Launch, /EmbeddedFile, /URI and /RichMedia, counted across the raw bytes of the file.

Which of those count as high risk?

/JavaScript, /JS, /OpenAction, /Launch and /RichMedia; the rest only raise the verdict to worth a closer look.

What does the incremental-update note mean?

More than one %%EOF marker means the file has been edited and re-saved at least once since it was first written.

Is a clean verdict a guarantee of safety?

No, this is a byte-level token scan, not a real PDF object parser, so it can miss content and can also flag a token that sits inside a harmless literal string.

What does it check first?

That the file starts with the %PDF- header; anything else is refused as not a PDF.

Related Forensics tools

n→nDetect file typeIdentify a file by its magic bytes, not its extension;n→nExtract stringsPull runs of printable text out of any binary file: the classic first look at an unknown file.n→nExtract embedded filesCarve out the bytes starting at each detected file signature, up to the next signature or end of file.n→nScan for embedded/appended filesScan every offset for known file signatures: finds a file hidden or appended inside another, e.g. a ZIP tacked onto a JPEG. A match means "signature found here", not "a file was deliberately hidden".1→1File tree from archiveList the paths, sizes and structure inside a ZIP or TAR archive, without extracting anything.n→nTrailing dataFind and carve out bytes appended after a PNG/JPEG/PDF/ZIP/GIF's real end marker, a common place to smuggle a second payload.n→nPolyglot detectCheck whether a file carries more than one valid format signature, at offset 0 or buried inside, the hallmark of a polyglot file.n→nMagic decodeTry base64, base32, hex, URL-encoding, ROT13/47 and single-byte XOR against a string and rank the results by how much they read like real text.