PDF Exploits Targeted Through Blackhole Exploit Kits.

This report analyzes Blackhole exploit kit PDF-based attacks that leverage an Adobe Reader getIcon() buffer overflow (CVE-2009-0927) to achieve code execution. It presents de-obfuscated JavaScript from the malicious PDFs, lists observed payload URLs (for example: http://flightpub.net/l/content/ap1.php?f=97d19::182b5 and variants), and provides example Snort signatures and mitigation advice (patching/updating Adobe Reader).