PDF Exploit: Number Of Pages Is The Key

This report describes a malicious PDF that embeds heavily obfuscated JavaScript which uses the PDF's number-of-pages (this.numPages) as a decoding key; after decoding the script performs a heap-spray and attempts to exploit three Adobe Reader vulnerabilities (CVE-2009-4324, CVE-2007-5659, CVE-2009-0927). The sample had poor detection on VirusTotal, demonstrating a deliberate evasion technique that impeded automated decoders and analysts.