JS:Pdfka-gen [Expl] False Positive?

Viruses and worms
1

My careers advisor sent me a job application form in pdf format for me to fill in. Was having trouble downloading it from my mail account until I realised it was Avast blocking the download, saying threat detected, JS:Pdfka-gen [Expl].

I temporarily disabled File System Shield and downloaded the pdf to send to Virustotal and it looks like Avast is the only AV flagging the file. Here’s the link.

https://www.virustotal.com/en/file/4e3b1a579a5a0d4e04e5ae4f2cfbf9049913297d5f96805f8e74beebe9297a1b/analysis/1469125132/

2

Report to avast lab >> https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

3

File is also new at VT First submission 2016-07-21 16:15:15 UTC ( 2 hours, 39 minutes ago )

also see extra info under: File Detail tab like this

This PDF document contains AcroForm objects. AcroForm Objects can specify and launch scripts or actions, that is why they are often abused by attackers.

This PDF document contains 18 object streams. A stream object is just a sequence of bytes and very often is only used to store images and page descriptions, however, since it is not limited in length many attackers use these artifacts in conjunction with filters to obfuscate other objects.

This PDF document has 5 pages, please note that most malicious PDFs have only one page.

4

Thanks for the reply. I’ve submitted the file to Avast as suggested.