Concatenated PDFs: A Simple Trick That Confuses Anti-Malware Engines and AI Systems

To understand how a concatenation attack works, it is necessary to first understand how PDF parsers read a document.

When a PDF reader opens a file, it follows a defined sequence: it locates the last end-of-file marker, reads the startxref pointer, uses it to locate the cross-reference (xref) table and trailer, and then reconstructs the document by resolving object offsets. This design is intentional, allowing readers to instantly locate objects in large documents without scanning the entire file.

During internal security research, OPSWAT discovered that appending two entirely separate PDFs into a single file produces a document that different parsers interpret in fundamentally different ways. What began as a structural curiosity revealed a meaningful and reproducible evasion technique that had gone largely unexamined. The resulting file contains two independent document structures, each with its own header, xref table, trailer, and end-of-file marker.

This is conceptually similar to parser exploitation techniques already observed with archive files, where structural ambiguity is used to obscure malicious content from security tools. In the case of PDFs, the consequences extend further: not only do security scanners disagree on what the file contains, but the version users ultimately see in their PDF reader may be entirely different from the version that was inspected.

A proof-of-concept was created using two PDF sections: the first instructing to draw a rectangle, and the second instructing to draw a circle.

Common PDF readers, including Adobe Reader, Foxit Reader, Chrome, and Microsoft Edge, locate the last startxref pointer in the file, which references the structure of the appended (second) document. They render the circle instruction.

The security implications of this structural ambiguity were validated through direct testing using the OPSWAT MetaDefender® platform, which aggregates results from multiple antivirus engines.

A PDF containing phishing content and malicious hyperlinks was submitted to 34 antivirus engines. Eight engines correctly identified the malicious content.

A clean, blank PDF was prepended before the phishing PDF to produce a concatenated document. The combined file was submitted to the same 34 engines.

As AI-powered document processing becomes embedded in enterprise workflows, this structural ambiguity introduces a distinct category of risk beyond conventional malware delivery. Organizations increasingly rely on large language models to analyze documents, extract information, and support decision-making. If those systems interpret a different version of a document than the one a human user sees, the consequences extend well beyond a missed phishing link.

Testing with the same concatenated PDF demonstrated that major AI platforms interpret the file according to the same parser-dependent logic observed in traditional reader applications.

GPT resolved the first document structure in the file and extracted the content from the hidden prepended section. It read and acted on the rectangle instruction, which is not the content visible to a user opening the file in Adobe Reader.

Both Gemini and Claude resolved the second document structure and extracted the content consistent with what users see in Adobe Reader. While this is the expected behavior from a user experience standpoint, it demonstrates that AI systems are subject to the same structural parsing differences as conventional readers.

OPSWAT Deep CDR™ Technology treats every file as potentially malicious. Rather than attempting to detect specific malicious patterns, Deep CDR™ Technology deconstructs each file, validates its internal structure against official format specifications, removes all elements that do not conform or that fall outside defined policy, and regenerates a clean, fully usable file. This approach addresses the concatenated PDF attack at its structural root.

Deep CDR™ Technology prevents this attack technique with its File Structure Verification capability. When processing a concatenated PDF, Deep CDR™ Technology identifies the structural anomaly: the presence of multiple independent document structures, multiple xref tables, multiple trailers, and multiple end-of-file markers in a configuration that does not conform to a valid single PDF document. It then removes the conflicting elements and reconstructs the document from the verified, safe content layer only.

The following screenshot from MetaDefender shows the Deep CDR™ Technology analysis result for the concatenated phishing PDF. With Deep CDR™ Technology configured and applied, the system identified and acted on each element that violated the expected file structure or security policy. 

In environments where usability must be maintained alongside security, Deep CDR™ Technology operates in Flexible Sanitization Mode. The system does not block the file. Instead, it performs structural reconstruction: the conflicting document sections are removed, all active and potentially malicious objects are stripped, and a clean, policy-compliant PDF is regenerated and delivered to the user. The user experience is preserved while the attack surface is eliminated.

Every file processed by Deep CDR™ Technology produces a forensic sanitization report documenting which objects were identified, what action was taken, and why. As illustrated in Figure 11, this report provides a full audit trail of every structural anomaly and policy violation addressed. For Compliance Officers, Privacy Officers, and Legal Counsel, this report is the documented proof that files entering the environment were processed against a consistent, verifiable security policy, and that any deviation from expected file structure was recorded and remediated.

While Deep CDR™ Technology mitigates the risk by sanitizing and rebuilding the document, OPSWAT Adaptive Sandbox (Aether) approaches the problem from a fundamentally different angle: it performs deep behavioral analysis of every possible document structure within the file. Where Deep CDR™ Technology removes the threat before a file reaches a user, Adaptive Sandbox detonates the file in a controlled environment and observes exactly what it was designed to do.

In the case of concatenated PDFs, Adaptive Sandbox does not rely on a single parser interpretation. Instead, it performs structure-aware analysis to identify that the file actually contains multiple valid PDF documents appended together. This directly prevents attackers from hiding malicious content behind parser inconsistencies. The analysis proceeds in three stages:

1. Extract: Each embedded PDF document is individually extracted from the concatenated structure. No document layer is treated as an authoritative one. Every section present in the binary stream is identified and isolated for independent inspection.