Can a PDF Have a Virus?
Yes. A PDF can carry malware, but not the way a program does. The danger sits in the extras a PDF is allowed to hold: scripts, attached files and links. You can check a PDF for JavaScript in your browser without opening it in a reader, then sanitize the PDF to remove the active parts.
Show PDF JavaScript: See any JavaScript hidden in a PDF. Free, and your file never leaves your device.
Open Show PDF JavaScriptSteps
Open Show PDF JavaScript and drop in the file. It is read in your browser and never uploaded.
Read the report. Every script is listed with where it is attached, such as "runs when the document opens". Nothing is run.
If anything looks unexpected, open Sanitize PDF and drop in the same file.
Keep JavaScript, embedded files and XFA selected. Tick external links too if you do not trust where the file came from.
Download the sanitized copy and open that one instead of the original.
How a PDF virus works
A PDF is a document format, not a program, so it cannot run on its own. It needs a reader, and the risk depends on what that reader agrees to do.
Malicious PDFs usually use one of four routes. JavaScript can run when the file opens or when you click something. Embedded files can hide a program or a macro document inside the PDF. Links and launch actions can send you to a phishing page or ask the reader to open another file. The fourth is a crafted font or image that attacks a bug in an old or unpatched reader.
How to check if a PDF is safe
Start with where it came from. An unexpected invoice or delivery notice from someone you do not know is the classic lure.
Then look inside without opening it in a desktop reader. Show PDF JavaScript lists every script in the file and where it is attached. Ordinary documents rarely need scripts. Fillable forms sometimes use small ones to check fields or add up totals, which is normal.
Check for attachments as well. PDF Attachments lists any files stored inside the PDF, so you can see an attached program before anything opens it.
Show PDF JavaScript: See any JavaScript hidden in a PDF. Free, and your file never leaves your device.
Open Show PDF JavaScriptHow to remove JavaScript from a PDF
Sanitize PDF removes JavaScript and auto-run actions, embedded files and media, XFA form data and metadata. You choose which. It can also remove external links. The visible pages stay the same, so the cleaned copy reads exactly like the original.
To strip comments, highlights and other markup as well, run the file through Remove Annotations. It keeps links and form fields unless you turn that off.
What sanitizing does not do
Sanitizing is not a virus scan. It removes the parts of a PDF that can act. It does not inspect fonts and images for crafted data aimed at a reader bug.
The best defence against that kind of attack is an up-to-date reader. Browser PDF viewers run inside the browser sandbox and support only a small part of PDF scripting, which makes them a safer place to open a file you are unsure about. For files you really do not trust, an antivirus scan is still worth running.