Can you directly view a malicious PDF on Linux?

To say Linux is malware-proof most of the times is incorrect, it's just that much malware focuses on other OS'es (but there is nothing preventing an attacker from targeting more than one OS). Avoid opening the PDF on your box unless you are absolutely sure the malware wasn't written for and won't execute in Linux.

If you are trying to perform analysis then use a sandbox, such as Cuckoo. With that said, some malware is sandbox aware and will try to avoid detection/analysis.


Whether or not the PDF is safe to open depends on whether or not your environment (i.e. Linux and your PDF software) is vulnerable to the exploit. Linux is not malware-proof; it just happens that most malware targets Windows.

However, conclusively determining whether or not an unknown, malicious PDF will affect you is difficult.

To do thorough research, you should probably view the PDF in a VM or sandbox, examine the exploit's behavior in a sandbox, and try to read their source code. The more the merrier! I wouldn't open them directly in your real OS; not worth the risk.

Tags:

Linux

Pdf

Malware