You received a PDF and something feels off. Maybe the sender is unfamiliar, maybe the subject line is a little too urgent. Before you double-click, run through these five checks in order. Each one takes seconds and each one catches a different class of attack.
Step 1: Verify where it came from
Most malicious PDFs arrive by email or chat, and most of them fail this step. Ask yourself: was I expecting a file from this person? Does the sender's address match the display name (hover over it)? Does the message pressure you to act immediately? An "overdue invoice" from a company you have never dealt with is not an invoice, it is bait.
If the sender is someone you know but the message reads oddly, contact them through a different channel. Compromised mailboxes send PDFs to entire contact lists.
Step 2: Inspect the actual filename
Windows and macOS hide file extensions by default, so `Statement.pdf.exe` shows up as `Statement.pdf` with a slightly wrong icon. Turn extensions on (Windows: File Explorer → View → File name extensions; macOS: Finder → Settings → Advanced → Show all filename extensions). A real PDF ends in `.pdf` and nothing else.
Also check the file size. A one-page invoice is usually under 200 KB. A one-page PDF that weighs 5 MB may be carrying an attachment inside it.
Step 3: Scan the file structure locally
This is the step people skip because they think it requires uploading the file somewhere. It doesn't. The PDF Virus Scanner on this site reads the file inside your browser tab and looks for the structures attackers rely on:
- `/JavaScript` and `/JS` blocks, which contain executable script
- `/OpenAction` and `/AA` triggers, which run something automatically when the file or a page opens
- `/Launch` actions, which start external programs
- `/EmbeddedFiles`, which hide attachments inside the document
- `/URI` and `/SubmitForm` actions, which send you or your data to a remote address
- `/RichMedia` and `/XFA`, older interactive features with a long exploit history
The file never leaves your computer, so you can check contracts, medical records and anything else you would not upload to a third party. A clean result means none of those markers are present in the file's readable structure. It is not an antivirus and it cannot see inside compressed object streams, so treat it as a fast first filter rather than a final verdict.
Legitimate PDFs can contain JavaScript
Government and tax forms often use JavaScript for field validation. A flag does not prove the file is malicious. It means the file can do more than display text, so the source matters even more. If a random sender's "receipt" contains JavaScript, delete it.
Step 4: Run an antivirus check
Your operating system's built-in protection (Microsoft Defender, XProtect on macOS) scans downloads automatically, but you can right-click any file and scan it on demand. For files that contain nothing confidential, a multi-engine online scanner gives a second opinion from dozens of vendors at once. Never upload sensitive documents to those services; they retain samples.
Step 5: Open it in the most restricted viewer that works
If you still need to read the file, do not open it in a full desktop reader with JavaScript enabled. Use your browser's built-in viewer, a reader with Protected View, or a disposable virtual machine. The exact settings for each platform are in how to open a suspicious PDF safely.
Quick reference
- Unexpected sender or urgent tone → do not open, verify through another channel.
- Extension is not exactly `.pdf`, or the size is wrong for the content → delete.
- Scan locally → JavaScript, OpenAction, Launch or embedded files found → treat as hostile unless you trust the source completely.
- Antivirus on demand → any detection → delete and report.
- Still need to read it → sandboxed viewer, JavaScript off.
Curious why these structures are dangerous in the first place? Can a PDF have a virus? explains each attack type, and what PDF vulnerabilities are covers the history.