More And More Obfuscation Being Used In The Malicious Script

This report documents discovery and manual deobfuscation of a heavily obfuscated JavaScript injection that loads a malicious PDF from a remote URL; the PDF exploits multiple Adobe Reader vulnerabilities. Automated tools struggled with the obfuscation, the author details step-by-step decoding to reveal the exploit chain, and network capture confirms retrieval of the malicious PDF which had low detection rates on VirusTotal.