Gmail keeps flagging PDF (interactive) as containing a virus

[JanineRoling]

Hi! 

I've looked all over the internet but can't seem to find a solution. I made a brochure in Indesign that I exported as an interactive PDF. It contains hyperlinks and images (around 65 pages in total). When I add it to gmail it gives an error because it contains a virus. I can't seem to figure out which elements causes the virus notification, but when I export it as a print PDF (without hyperlinks etc) it works fine. However, we don't want it to be printed, so it needs to contain working hyperlinks. Exporting the print PDF with hyperlinks also gives the virus notification.

Although I can easily share it through e.g. Wetransfer, it should be possible to share it through email and upload it to Google Drive. So I'm eager to fix it. 

All the help is appreciated! 

[Geоrge]

• Or Send your pdf through zip/7z with password and don't forget to say your password in email-body;
• Or use it some gdrive/dropbox link instead of attaching.

You can't do anything with gmail protection and false positive of that service. There is no any normal link to send them your false positive sample (normal antiviruses - have it, gmail don't have it).

Just for fun -

check your pdf on virustotal.com is any of antiviruses says that your file isn't good?

[JanineRoling]

Thanks for your reply George! Im still hoping to 'fix' the document instead of sending it through dropbox/zip. 

This is the only one that comes up. Do you know whether it's possible to see which URL gives the warning? 

[Geоrge]

Even google chiefs don't knows what their Skynet is a artificial neural network-based conscious group mind and artificial general superintelligence system wanna say here. It works for your protection - google don't likes links in pdf that you try to attach to your email. Stop using free gmail service and start to use your own dignity, be the chief of yourself.

[dr.batisa]

I encountered the same issue, but after removing all web links from the PDF file, it attached successfully without triggering any false virus detections. It's also possible that certain links are flagged if the domain belongs to an entity under U.S. sanctions.

Just my thoughts.

[Test Screen Name]

It doesn't think it's a virus. It thinks it's a phishing trojan, which is something entirely different. It may well be detected by a combination of the contents of the PDF and the text of the email. (You can check by using bland random text). Phishing detectors are notoriously unreliable. And of course, how they detect things is a COMPLETE SECRET !! It has to be.

[JanineRoling]

I dont think the email text has anything to do with it unfortunately. Because if I try to upload it to the Gmail - without any texts - it already detects the virus. If I send it from another mailservice (outlook e.g.) to a Gmail account, it simply never arrives. It probably just thinks that a document with lots of hyperlinks is 'dangerous' per se. 

[Test Screen Name]

Does it contain any interactivity beyond hyperlinks? Such as JavaScript?

If not, I would look at the mix of URLs, the complete list of links. Google treat a web page with links to different domains as automatically a bit suspect. The world of web pages is full of very complex rules and barriers based on limiting cross-domain links in anything interactive.

Also, why are you emailing a PDF at all? I certainly don't welcome receiving them in email, they are often too large for a start. You don't really want to start an interaction with people cursing you for using 20% of their weekly data allowance just to send an newsletter (or whatever it is). The usual thing is to email a link to a PDF, or a link to a web page containing a link to a PDF. 

[JanineRoling]

It is also flagged as suspicious in the plugin we use to upload the pdf to our website. Because the ideal solution would indeed be to simply upload it to our website and then email the link. I will check the links, but most of them lead to reports on company websites and such. It will be difficult to figure out what exactly is suspicious for Google/Cyren. 

[Test Screen Name]

Linking to many web sites may be a problem. Do you see an issue if you use the same number of links to one site?