How it works
The tool inspects the file structure for the mechanisms malicious PDFs rely on: JavaScript code, actions run on open, external program launches, embedded files, XFA forms, rich media. The file is decompressed and walked object by object — including compressed object streams, where a plain-text scan would see nothing. The tool reports the indicators it found and a level: no indicator, review, or risky. It is not an antivirus: “no indicator found” does not mean harmless, and a PDF with no active code can perfectly well contain a phishing link.
FAQ
Is a PDF with JavaScript necessarily dangerous?
No: some legitimate forms contain it. But a PDF from a stranger that embeds JavaScript and an on-open action deserves serious suspicion.
Does the tool disinfect the file?
No, it only analyses. To neutralise a suspicious PDF, convert it to images (PDF to JPG) and rebuild it: any active code disappears.
Is the file opened during analysis?
Its structure is parsed, but no page is rendered and no code from the PDF is executed: this is the only tool on the site that never shows a preview, precisely so a suspicious file is never interpreted.