PDF signature

A PDF starts with 25 50 44 46 (%PDF). It can carry embedded JavaScript, forms and embedded objects, so it's a common phishing and malware vector. Always verify by signature, not extension.