Obfuscated multi-stage PDF JavaScript heap-spray exploit

The PDF JavaScript is hidden behind nested stream filter chains (e.g. ASCIIHexDecode/FlateDecode/ASCIIHexDecode) and/or a custom in-JS decoder (a rolling-XOR 'ffts' stager that XORs each byte with a feedback key and evals the result). After the analyzer unwinds those layers, the recovered stage contains a heap-spray / ROP chain (repeated 0c0c/9090/4141 landing words plus shellcode). A spray that only appears after de-obfuscation is never benign — this is an obfuscated multi-stage Adobe Reader JavaScript exploit. ClamAV often labels these by the dropped Windows payload (Win.Trojan.Agent), which is the second stage, not the delivery; the family is attributed at related confidence because the exact Reader CVE trigger may sit in an even deeper layer.