Can a PDF contain a virus?
Yes. PDF is a programmable format, and malicious PDFs have been a routine attack vector for twenty years; a modern, updated reader makes exploitation rare, but the file type itself is not safe by nature.
How a .PDF file can do harm
- JavaScript that runs when the document opens, used to trigger reader vulnerabilities or to fetch a second-stage payload
- Embedded files and launch actions that try to open an attached executable, script or Office document
- Links to phishing pages, often behind a convincing 'View document' button, which is the most common PDF attack today
- Exploits for specific reader bugs in fonts, images or the parser itself; most are patched quickly, so an old reader is the real exposure
- Form submission actions that post what you type to an attacker's server
What it cannot do
- Infect you merely by sitting in a folder; it has to be opened by a vulnerable or over-permissive reader
- Run native code on its own; it needs a reader bug or a user clicking through a warning
Signs of a suspicious .PDF file
- Unexpected invoices, shipping notices, voicemail or fax notifications with a PDF attached
- A single page that is mostly a button or a blurred preview asking you to 'click to view'
- A reader prompt asking to allow JavaScript, open an attachment, or launch a program
- A very small file for what claims to be a multi-page document, or a very large one for a one-line notice
- The detector reports something other than PDF: a renamed executable or HTML file with a .pdf name
Before you open it
- Keep the reader updated; Acrobat, Preview, Edge and Chrome all patch PDF bugs regularly
- Open untrusted PDFs in a browser (Chrome, Edge, Firefox) rather than Acrobat; the browser viewers run sandboxed and ignore most active content
- Disable JavaScript in Acrobat Reader (Preferences, JavaScript) if you use it; almost no legitimate document needs it
- Hover over links before clicking and compare the URL with the sender
- Check the SHA-256 against VirusTotal; the detector computes it without uploading the file
Check that it really is a .PDF file
The first question for any suspicious file is whether it is what its name says. Drop it on the detector: it reads the bytes in your browser, reports the real type, and computes the SHA-256 you can look up on VirusTotal, all without the file leaving your machine. A common PDF signature is 25 50 44 46 2D (%PDF-); see the signature reference.