Detecting PDF JS Obfuscation using Elementary Statistics
CVE-2013-0641was recently found in the wild. I was fortunate
enough to get a sample. I have to apologize beforehand but I
won't be able to share the sample. If I come across a public
sample and the exploit has been patched I will share it. Someone
has added an incomplete section of the code to pastebin. To be
honest I have done very little analysis of the sample. The
farthest I have gotten has been staring at the structure of the
JS (Javascript).  I haven't even deobfuscated it. Why? I thinks
it's kind of elegant compared to the typical obfuscations we
would see in BlackHole Explot kits or other exploit packs.  A
typical side effect of obfuscated Javascript is the structure of
the code is destroyed. The code looks like one massive one liner
or blocks of code rather a structured layout. From an
interpreter standpoint the Javascript can be structured in any
format. The code just needs the correct syntax. Below we have
obfuscated Javascript from a PDF. Th