PDF Structure & Infection Vectors

PDFs are not flat images; they are complex containers capable of executing JavaScript and launching external applications.

The PDF Document Structure

A PDF file is fundamentally composed of four parts:

1. Header: Specifies the PDF version (e.g., %PDF-1.7).
2. Body: Contains a sequence of indirect objects representing the document's content (text, fonts, images).
3. Cross-Reference Table (xref): Maps object IDs to their byte offsets within the file, allowing random access.
4. Trailer: Points to the xref table and the root object (Catalog).

Malicious Vectors

Attackers exploit the rich features of the PDF specification to deliver malware.

Embedded JavaScript

PDFs support Acrobat JavaScript (an extension of JS). Attackers embed scripts using the /JS and /JavaScript name tags. When the PDF is opened (e.g., via the /OpenAction tag), the script executes. This was historically used to exploit memory corruption vulnerabilities in Adobe Reader.

Embedded Files (Launch Action)

The /Launch action allows a PDF to execute an external application. An attacker can embed an executable payload within the PDF and use /Launch to run it, often prompting the user with a deceptive "Save File" dialog.

Incremental Updates (Polyglots)

Because PDFs support incremental updates (adding new objects at the end of the file without rewriting the whole document), attackers can hide malicious payloads in unreferenced objects or append non-PDF data (like a ZIP archive) to the end of the file, creating a polyglot.