Suspicious detection heuristics

Adobe Reader ToolButton use-after-free exploit pattern critical PDF_JS_TOOLBUTTON_UAF_EXPLOIT

PDF JavaScript combines app.addToolButton(), app.removeToolButton(), heap-spray arrays, and unescape('%u...') shellcode markers.

JSFuck-obfuscated PDF Function-constructor stager high PDF_JS_JSFUCK_FUNCTION_STAGER

PDF JavaScript constructs a hidden second stage through a JSFuck primitive table and the Function constructor.