Last week, I talked about how to disable some functionality in Adobe Acrobat (see blog).
This morning, we released generic detection for something we call Sus/PDFJs-S. Sophos will generically detect PDF files which use this functionality to run executables.This afternoon, I have just written detection for the first malicious PDF using this technique (Troj/PDFEx-DF).
When you open a file with Troj/PDFEx-DF you will be presented with the following:
If you were to ignore the obvious spelling mistake Troj/PDFEx-DF would drop and execute:
c:\windows\system32\ActiveX.exe
Which will be detected as Troj/Agent-MYJ.
![Password security infomerical leaves Ellen DeGeneres in disbelief.. and it will you too [VIDEO]](http://sophosnews.files.wordpress.com/2013/04/ellen-thumb.jpg?w=75&h=75&crop=1)
![Can multiple moving cursors really hide your password from spyware and peepers? [VIDEO]](http://sophosnews.files.wordpress.com/2013/03/cursors-thumb.jpg?w=75&h=75&crop=1)
![Hacked TV channels broadcast zombie apocalypse emergency alert [VIDEO]](http://sophosnews.files.wordpress.com/2013/02/zombie-thumb.jpg?w=75&h=75&crop=1)
