If you are concerned about malicious JavaScript being hidden inside a PDF file, you can upload the file to Google's VirusTotal site which will scan the file with many antimalware programs. The scan results will show if any of the dozens of antivirus programs the site uses in its scans have detected malware in the file. However, for additional security, you may want to know if the file contains code that will automatically be executed when you open the file in a PDF viewer or if it contains embedded JavaScript. The VirusTotal site will provide that information. For PDF files, you will see "pdf" displayed in a gray oval underneath the file that was scanned. If there is code within the PDF file that will automatically be executed when you open the file, next to that oval will be another one with "autoaction" in it. Embedded JavaScript is denoted by an oval with "js-embedded" within it. Just because you see "autoaction" or "js-embedded" doesn't mean the JavaScript is malicious, but if you want to ensure any malicious JavaScript isn't executed, if you are using the Foxit Reader program to view PDF files, you can disable its execution of JavaScript.
To disable the execution of JavaScript in Foxit Reader Version 5.3.1.0606, take the following steps:
- From the menu at the top of the Foxit Reader window, click on Tools and select Preferences.
-
Click on JavaScript on the left side of the Preferences
window that will open and then uncheck the check box for "Enable JavaScript
Actions."
Also click on Trust Manager from the Prferences menu and make sure that the "Enable Safe Reading Mode" check box is checked. In the description of that setting, you will see "Foxit recommends that you check this option for controlling unauthorized actions and data transmissions; including URL connections, launching external files and running JavaScript functions to efficiently avoid attacks from malicious documents."
