PDF_RICHMEDIA_AESPHP_SHELLCODE_STAGE — RichMedia AES demo paired with PDF-side shellcode stage

critical PDF_RICHMEDIA_AESPHP_SHELLCODE_STAGE

What it means

PDF embeds an AESFlashToPHPDemo RichMedia SWF while OpenAction JavaScript builds shellcode.

Why it fires

The embedded SWF can look like ordinary Flash demo content in isolation. The detector requires that RichMedia AES/Flash demo shape plus a PDF-side Lookup/String.fromCharCode heap-spray shellcode builder with downloader evidence such as urlmon.dll, update.exe, or an Adobe-2010-1297 URL. This separates exploit delivery PDFs from benign RichMedia demos.

Other PDF heuristics

PDF_LAUNCH_JS_PROTOCOL PDF_LAUNCH_COMMAND PDF_LAUNCH_MSHTA PDF_ADOBE_QR_UNLOCK_LURE PDF_JS_URL_KEYED_READER_EXPLOIT_KIT CVE_2009_2990_U3D_AUTOACTIVATE PDF_ANNOT_AUTHOR_EVAL_STAGER PDF_ANNOT_SUBJECT_HEX_EVAL_STAGER PDF_ANNOT_SUBJECT_MARKER_EVAL_STAGER PDF_JS_BASE_N_TOKEN_DOWNLOADER PDF_BASE64_PE_PAYLOAD PDF_BRAND_INVOICE_LURE_OFFDOMAIN PDF_BRAND_INVOICE_CLOUD_EMAIL_LURE PDF_CORPORATE_PRESENTATION_CLOUD_REDIRECT_LURE PDF_CORRUPTED_FILE_UPDATE_LURE PDF_CRACKED_SOFTWARE_SHORTLINK_LURE PDF_GAME_HACK_SEO_LINK_FARM PDF_DISTRIBUTED_PIRACY_LINK_FARM PDF_DOCUSIGN_DOWNLOAD_LURE PDF_DOCUMENT_ACTION_HOST_MISMATCH_LURE PDF_DYNAMIC_DNS_DOCUMENT_LINK_FARM PDF_SWF_NATIVE_MEMORY_CORRUPTION_PAYLOAD PDF_EMBEDDED_PE_PAYLOAD CVE_2010_1240_EMBEDDED_EXPORT_LAUNCH