LibreOffice Writer: exported pdf & virustotal

Discuss the word processor
Post Reply
vasa1
Volunteer
Posts: 261
Joined: Sat Dec 26, 2009 1:20 pm
Location: Bombay

LibreOffice Writer: exported pdf & virustotal

Post by vasa1 »

A user of LibreOffice Writer (Linux) exported an odt file as pdf and then uploaded it to virustotal.com for scanning. The organization to which she plans to submit the pdf file requires a "green" pass from virustotal.com.

I tried to get a green pass with the simplest of pdf files generated by LibreOffice 5.2.2 (Linux, Lubuntu 16.04) but couldn't. (It's nothing to do with a specific odt file.)

Taking the same odt file, opening it in Abiword 3.0.1 (a Linux word processor) and using "save as pdf" produces a pdf file that gets the green pass.

Here's a bit of information from the scan results for the LibreOffice pdf file:
The file being studied is a PDF document! The document's header reveals it is using the following file format specification: %PDF-1.4.
PDFiD information
This PDF file contains an open action to be performed when the document is viewed. Malicious PDF documents with JavaScript very often use open actions to launch the JavaScript without user interaction.
This PDF document has 3 pages, please note that most malicious PDFs have only one page.
This PDF document has 24 object start declarations and 24 object end declarations.
This PDF document has 7 stream object start declarations and 7 stream object end declarations.
This PDF document has a cross reference table (xref).
This PDF document has a pointer to the cross reference table (startxref).
This PDF document has a trailer dictionary containing entries allowing the cross reference table, and thus the file objects, to be read.
ExifTool file metadata
MIMEType
application/pdf

Producer
LibreOffice 5.2

Language
en-US

PageCount
3

FileType
PDF

Creator
Writer

Linearized
No

FileTypeExtension
pdf

PDFVersion
1.4

CreateDate
2016:10:21 09:37:47+05:30
And here's information from scanning the pdf file generated by Abiword 3.0.1:
Probably harmless! There are strong indicators suggesting that this file is safe to use.
The file being studied is a PDF document! The document's header reveals it is using the following file format specification: %PDF-1.5.
PDFiD information
This PDF document has 3 pages, please note that most malicious PDFs have only one page.
This PDF document has 27 object start declarations and 27 object end declarations.
This PDF document has 7 stream object start declarations and 7 stream object end declarations.
This PDF document has a cross reference table (xref).
This PDF document has a pointer to the cross reference table (startxref).
This PDF document has a trailer dictionary containing entries allowing the cross reference table, and thus the file objects, to be read.
ExifTool file metadata
MIMEType
application/pdf

Producer
cairo 1.14.6 (http://cairographics.org)

PageCount
3

FileType
PDF

Creator
cairo 1.14.6 (http://cairographics.org)

Linearized
No

FileTypeExtension
pdf

PDFVersion
1.5
The poster would like to stay entirely with LibreOffice. Is there any way to tell LibreOffice to exclude the "open action" when generating the pdf file?
LibreOffice 5.2.1.2 on Lubuntu 16.04 (Openbox)
Post Reply