{"id":678,"date":"2022-03-01T00:36:49","date_gmt":"2022-03-01T00:36:49","guid":{"rendered":"https:\/\/nftsgary.com\/?p=678"},"modified":"2023-04-01T06:43:51","modified_gmt":"2023-04-01T06:43:51","slug":"embedded-documents-in-pdf-files-that-can-easily-infect-you","status":"publish","type":"page","link":"https:\/\/myonlinesecurity.co.uk\/embedded-documents-in-pdf-files-that-can-easily-infect-you\/","title":{"rendered":"Embedded Documents In PDF Files That Can Easily Infect You"},"content":{"rendered":"<p>We have recently been seeing a newer method of infecting you by embedding <a href=\"https:\/\/myonlinesecurity.co.uk\/malformed-infected-word-docs-embedded-macro-viruses\/\">macro enabled word docs<\/a> into pdf files. To all intents and purposes these PDF files look quite innocent and will normally be an almost blank page with 1 line of text<br \/>\nThese recent posts illustrate the attack method:<\/p>\n<ul>\n<li>https:\/\/myonlinesecurity.co.uk\/the-return-of-locky-ransomware-with-fake-receipts-malspam\/<\/li>\n<li>https:\/\/myonlinesecurity.co.uk\/fake-copy-of-your-123-reg-invoice-delivers-dridex-banking-trojan\/<\/li>\n<li>https:\/\/myonlinesecurity.co.uk\/scan-data-malspam-pretending-to-come-from-noreply-your-own-email-address-tries-to-deliver-malware\/<\/li>\n<li>https:\/\/myonlinesecurity.co.uk\/scanned-file-with-pdf-attachment-malspam-drops-malicious-word-macro-delivers-malware\/<\/li>\n<li>https:\/\/myonlinesecurity.co.uk\/pdf-pretending-to-come-from-your-own-email-address-delivers-jaff-ransomware\/<\/li>\n<li>https:\/\/myonlinesecurity.co.uk\/more-fake-invoice-malspam-with-pdf-attachments-deliver-malware\/<\/li>\n<li>https:\/\/myonlinesecurity.co.uk\/scanned-image-malspam-with-pdf-attachment-delivers-jaff-ransomware\/<\/li>\n<li>https:\/\/myonlinesecurity.co.uk\/more-malware-via-embedded-word-macro-docs-in-pdf-attachments\/<\/li>\n<\/ul>\n<p>If you have Adobe reader or any other PDF reader set to default settings, then there is a high probability of you becoming infected via this method. Luckily it is relatively easy to protect yourself.<\/p>\n<p>First of all go to and follow the instructions to set PDF files to open in the Adobe Reader ( or whichever PDF reader you use) NOT to open in the browser which introduces many possible vulnerabilities.<\/p>\n<p>The settings vary for this vary according to your browser:<\/p>\n<h3><strong>Internet Explorer<\/strong><\/h3>\n<p>Step1. go to tools\/manage addons<br \/>\nStep2. Select all addons in the drop down, look for Adobe PDF reader and then press the disable button.<br \/>\nThat way any PDF you receive will only open in Adobe reader itself and not in your browser, so cutting down the risk of any exploit infecting you.<\/p>\n<h3><strong>Google Chrome<\/strong><\/h3>\n<p><strong>Step 1:<\/strong> Open Chrome and type \u201cabout:plugins\u201d into the omnibox at the top.<br \/>\n<strong>Step 2:<\/strong> Scroll down and find Chrome PDF Viewer.<br \/>\n<strong>Step 3:<\/strong> Click the \u201cDisable\u201d link to prevent PDFs from loading within Chrome<br \/>\n<strong>Firefox<\/strong> see <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/disable-built-pdf-viewer-and-use-another-viewer\" target=\"_blank\" rel=\"nofollow noopener\">HERE<\/a>\u00a0and select use Adobe Reader ( default) or the alternative PDF reader you have installed.<\/p>\n<p>Previewing PDFs in a browser is just too dangerous to take a risk with the current exploits and it is much safer to view them in the application itself which should be sand-boxed to prevent exploits slipping out.<br \/>\nOnce you have safer settings set in Adobe reader, you are extremely unlikely to infect yourself with this sort of malware.<\/p>\n<p>Trying to open a PDF with embedded content will give you this<\/p>\n<p>and you can see that you cannot open or save the embedded word document so stopping you from being infected, even though you can see the word doc listed in left hand side bar<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-682\" src=\"https:\/\/nftsgary.com\/wp-content\/uploads\/2022\/02\/Adobe-cannot-open-attachments.png\" alt=\"\" width=\"1638\" height=\"947\" srcset=\"https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/02\/Adobe-cannot-open-attachments.png 1638w, https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/02\/Adobe-cannot-open-attachments-300x173.png 300w, https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/02\/Adobe-cannot-open-attachments-1024x592.png 1024w, https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/02\/Adobe-cannot-open-attachments-768x444.png 768w, https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/02\/Adobe-cannot-open-attachments-1536x888.png 1536w\" sizes=\"(max-width: 1638px) 100vw, 1638px\" \/><br \/>\nFirst Open Adobe reader, on the top menu bar select Edit then Preferences. This contains all the settings you need to change to make sure that this and other similar types of malware cannot infect you.<\/p>\n<p>The majority of time, you don\u2019t need JavaScript enabled. On the odd occasion that you need it to fill in forms from Governments, employers, Tax etc. you can re-enable it for that single use.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-683\" src=\"https:\/\/nftsgary.com\/wp-content\/uploads\/2022\/02\/Adobe-javaascript.png\" alt=\"\" width=\"991\" height=\"665\" srcset=\"https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/02\/Adobe-javaascript.png 991w, https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/02\/Adobe-javaascript-300x201.png 300w, https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/02\/Adobe-javaascript-768x515.png 768w\" sizes=\"(max-width: 991px) 100vw, 991px\" \/><br \/>\nNext enable Adobe Protected Mode and Enhanced Security. This blocks most features in Adobe reader to stop anything auto opening or running. It prevents you saving or opening attachments or embedded objects like video or sound ( why anyone would want music or video in a PDF is beyond me though.)<\/p>\n<p>Enable Adobe Protected ModeNext and the most important in preventing embedded objects from being used maliciously<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-685\" src=\"https:\/\/nftsgary.com\/wp-content\/uploads\/2022\/02\/Pdf-att.png\" alt=\"\" width=\"1003\" height=\"662\" srcset=\"https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/02\/Pdf-att.png 1003w, https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/02\/Pdf-att-300x198.png 300w, https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/02\/Pdf-att-768x507.png 768w\" sizes=\"(max-width: 1003px) 100vw, 1003px\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>We have recently been seeing a newer method of infecting you by embedding macro enabled word docs into pdf files. To all intents and purposes these PDF files look quite innocent and will normally be an almost blank page with 1 line of text These recent posts illustrate the attack method: https:\/\/myonlinesecurity.co.uk\/the-return-of-locky-ransomware-with-fake-receipts-malspam\/ https:\/\/myonlinesecurity.co.uk\/fake-copy-of-your-123-reg-invoice-delivers-dridex-banking-trojan\/ https:\/\/myonlinesecurity.co.uk\/scan-data-malspam-pretending-to-come-from-noreply-your-own-email-address-tries-to-deliver-malware\/ https:\/\/myonlinesecurity.co.uk\/scanned-file-with-pdf-attachment-malspam-drops-malicious-word-macro-delivers-malware\/&#8230;<\/p>\n","protected":false},"author":8,"featured_media":13444,"parent":0,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kad_post_transparent":"default","_kad_post_title":"default","_kad_post_layout":"default","_kad_post_sidebar_id":"","_kad_post_content_style":"default","_kad_post_vertical_padding":"default","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"taxonomy_info":[],"featured_image_src_large":["https:\/\/myonlinesecurity.co.uk\/wp-content\/uploads\/2022\/03\/file.jpg",1000,666,false],"author_info":{"display_name":"Darrel Heers","author_link":"https:\/\/myonlinesecurity.co.uk\/author\/darrel-heers\/"},"comment_info":0,"_links":{"self":[{"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/pages\/678"}],"collection":[{"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/comments?post=678"}],"version-history":[{"count":2,"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/pages\/678\/revisions"}],"predecessor-version":[{"id":28330,"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/pages\/678\/revisions\/28330"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/media\/13444"}],"wp:attachment":[{"href":"https:\/\/myonlinesecurity.co.uk\/wp-json\/wp\/v2\/media?parent=678"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}