Threat behavior
Exploit:JS/Pdfjsc.JU is a detection for specially-crafted PDF files that attempt to exploit software vulnerabilities in Adobe Acrobat and Adobe Reader. Once the malformed PDF files are opened by vulnerable versions of Adobe Acrobat and Reader, the embedded JavaScript is executed and loads the exploit.
Installation
These PDF files contain an embedded JavaScript that, when loaded (as when the files are opened in a vulnerable version of Adobe Acrobat or Adobe Reader) executes a shellcode that exploits the vulnerabilities. The shellcode may perform any action, such as downloading and running other malware.
Exploit:JS/Pdfjsc.JU usually arrives in the system when the user visits a webpage that contains a malicious PDF file or opens an e-mail message containing the PDF file as an attachment.
The vulnerabilities it attempts to exploit are the following:
Payload
Downloads arbitrary files
The malicious script first checks the version of the Adobe Reader and Acrobat software installed and calls the exploit function if deemed vulnerable. Successful exploitation of a vulnerable computer by Exploit:JS/Pdfjsc.JU could result downloading arbitrary files.
Additional Information
The vulnerability affects Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X.
Analysis by Rex Plantado
Prevention