Analyzing PDF Exploits For Finding Payloads Used

This report analyzes an active PDF-based exploit that hides obfuscated JavaScript across PDF objects, performs a heap-spray and deploys Unicode-encoded shellcode to exploit Adobe Reader vulnerabilities; the analyst decodes the script, converts the shellcode to an executable, and reverses it to recover a URL used to download a secondary malicious binary.