PDF files
livewells reads a PDF as data. It shows pictures of the pages, lists what the file holds and flags the parts that can harm you. The file never opens on your computer.
Send a PDF
Send a .pdf file on the Upload a file tab, or through the API. livewells also reads a PDF inside another item of the same case, such as an email attachment or an archive member.
What you see
- Page pictures. One picture for each of the first 20 pages. A QR code in a picture goes to QR reading.
- Links. Each web link in the file, with its page. Each link is defanged. You open a link in the disposable browser with one click.
- Embedded JavaScript. The script text, line by line. A script that starts when the file opens gets a high flag.
- Actions. Each action that starts a program, opens a file, sends a form or opens a link, and when it starts.
- Form fields. The name, type and value of each field.
- Embedded files. The name, size and SHA-256 of each file inside the PDF. livewells checks each one as its own item.
- Facts. Page count, PDF version, title, author, creator, producer, dates, saved versions and encryption.
Every link, address and file name in the report is defanged. An example is hxxps[://]example[.]com/a.
Locked PDFs
livewells tries the empty user password. Many protected PDFs open with it, and livewells reads them in full. For a PDF that needs another password, the case shows the flag "This PDF is locked. We could not read it." Remove the password and send the PDF again.
Limits
| Limit | Value |
|---|---|
| File size | 25 MiB |
| Page pictures | 20 pages for each file |
| Page text checked for links | 200 pages for each file |
| Text read for each page | 1 MiB |
| Links found in page text | 2,000 links, 1 MiB of link text in all |
| Script text | 1 MiB for each script, 4 MiB and 1,000 scripts in all |
| Actions read | 2,000, 200 listed |
| Form fields read | 20,000 fields, 2 MiB of field text in all, 200 listed |
| Embedded file names | 200 characters each |
| Picture size | 1600 pixels on the longest side, 2 MiB each |
| Files inside a PDF | 100, each at most 64 MiB |
| Links listed | 500 |
| Length of one link | 2,048 characters |
| Indicators listed | 500 |
| Parts of the PDF read | 100,000 |
| Reading time | 30 seconds |
A PDF inside other files gets page pictures when it sits at most two levels down. A deeper PDF gets the full text analysis and no pictures.
When a PDF reaches a limit, livewells reads what it can and raises the flag "We stopped reading part of this PDF because it is too big or too deep." Treat that PDF as hostile.
Flags
| Severity | Flag |
|---|---|
| high | This PDF has script code that starts when you open it. |
| medium | This PDF has script code inside it. |
| high | The script code in this PDF is hidden with tricks. |
| high | This PDF can start a program or open a file on your computer. |
| medium | This PDF starts an action as soon as you open it. |
| medium | This PDF can open another file or address when you click. |
| high | This PDF form can send what you type to a web address. |
| low | This PDF has a form you can fill in. |
| medium | This PDF has a form type that can hold script code. |
| medium | This PDF has other files hidden inside it. |
| high | A file inside this PDF looks like a program or script. |
| medium | This PDF has movie, sound or 3D content that can run code. |
| medium | This PDF hides the names of its parts. |
| info | Parts of this PDF are packed so that a simple scan cannot see them. |
| low | This PDF has links to web addresses. |
| medium | This PDF is locked. We could not read it. |
| info | This PDF is encrypted but opens without a password. |
| medium | This PDF is damaged or built in an unusual way. We read only part of it. |
| medium | We stopped reading part of this PDF because it is too big or too deep. |
| low | We could not make a picture of some pages. |
| low | This file has extra data before or after the PDF. |
| low | This PDF was saved more than once. Older content can stay hidden in it. |
A flag points at something to check. Your analysts set the verdict.