Safe way to open a .pdf?

Author
Discussion

paulrockliffe

Original Poster:

15,956 posts

233 months

Friday 12th May 2023
quotequote all
I've got an email, I'm only 95% sure it'll be a scam, there's a pdf attached. Is there a safe way to open open it that doesn't involve spinning up a VM and nuking it when I'm done?

simon_harris

1,663 posts

40 months

Friday 12th May 2023
quotequote all
are you 100% sure it is a PDF?

paulrockliffe

Original Poster:

15,956 posts

233 months

Friday 12th May 2023
quotequote all
No, I only have the email and what looks like an attached pdf.

Harpoon

1,945 posts

220 months

Friday 12th May 2023
quotequote all
You can upload a file to VirusTotal for scanning with multiple AV engines:

https://www.virustotal.com/gui/home/upload

paulrockliffe

Original Poster:

15,956 posts

233 months

Friday 12th May 2023
quotequote all
Don't I have to download it first? Don't really want to do that, it's sat in an email that Gmail hasn't identified as dodgy.

juice

8,766 posts

288 months

Friday 12th May 2023
quotequote all
paulrockliffe said:
I've got an email, I'm only 95% sure it'll be a scam, there's a pdf attached. Is there a safe way to open open it that doesn't involve spinning up a VM and nuking it when I'm done?
Joe Sandbox

bitchstewie

54,489 posts

216 months

Friday 12th May 2023
quotequote all
I stick them in Google Drive so it previews in my web browser.

eeLee

837 posts

86 months

Monday 15th May 2023
quotequote all
send it to a GMail address and read it there in the web. Basically very similar to doing it in the web context of GDrive plus Google will scan it for malware.

Zetec-S

6,213 posts

99 months

Monday 15th May 2023
quotequote all
No further updates from the OP... I guess he opened the pdf... biggrin

On a more serious point, why bother opening it at all? You are 95% sure it's a scam, so what's behind the 5% uncertainty? Do you have another way to contact the sender and see if they can verify it?

Ham_and_Jam

2,490 posts

103 months

Monday 15th May 2023
quotequote all
Zetec-S said:
No further updates from the OP... I guess he opened the pdf... biggrin

On a more serious point, why bother opening it at all? You are 95% sure it's a scam, so what's behind the 5% uncertainty? Do you have another way to contact the sender and see if they can verify it?
That’s exactly what I did when I had an attachment sent from a known business contact.

Rang them up and they confirmed definitely not sent from them, and they confirmed they had been hacked previously.

paulrockliffe

Original Poster:

15,956 posts

233 months

Monday 15th May 2023
quotequote all
Sorry, I did manage to preview it and survived to tell the tale.

The email is from a Solicitor, whose details all check out, but the email is vague and what's in the PDF could have been simply put in an email. But it's fairly normal for Solicitors to have terrible IT systems that auto-email out PDF copies of Word documents with boiler-plate email content, so some amber-red flags, but also possibly a false-positive.

I've never had any reason to be contacted by these Solicitors and the person named in the email subject doesn't pop up on Google.

The PDF is asking me to write them a few paragraphs about when and how I transferred some money to this person to corroborate their statements so they can draw up a witness statement for me in their defence. It looks like this person is getting done under the Proceeds of Crime Act and is claiming that someone with my name sent them the money as a donation that might be in relation to some sort of church or culty type thing.

If it was a dodgy PDF there would be no need for it to contain such an elaborate back-story I don't think. And I don't think the content is a scam as there's nothing in it for me in replying and if I thought there was I would have to perjure myself to get my hands on some of these proceeds of crime.

Maybe I'm supposed to reply and confirm I'm a bit thick then there'll be more play out where I get offered millions but they just need to know my account details to transfer the money back to me. But on the other hand it seems a little early in the play to be reliant on me just randomly lying in a Witness Statement.

sgrimshaw

7,389 posts

256 months

Monday 15th May 2023
quotequote all
Ignore it.

If there's a genuine need to get you involved they will write to you.

Sheepshanks

34,440 posts

125 months

Monday 15th May 2023
quotequote all
paulrockliffe said:


Maybe I'm supposed to reply....
Are the From and Reply email address correct - the email addreses behind the visible names? Not easy to see on a mobile device - if it is a phishing email then usually they'll be very slightly different (or sometmes completely different) from the correct domain.

If it is genuine, it seems to odd to make contact by email even if it's meant for someone else. That said, I have a fairly unusual surname, but am listed in the phone book etc and a couple of times I've had phone calls from people who say they're solicitors asking if I know someone with same surname, different first name.