"Malicious" PDF

launch_url.txt

%PDF-1.0

1 0 obj
<<
/Type /Catalog
/Pages 2 0 R
/Names 6 0 R
>>
endobj

2 0 obj
<<
/Type /Pages
/Count 1
/Kids [3 0 R]
>>
endobj

3 0 obj
<<
/Type /Page
/Parent 2 0 R
/Resources << /Font << /F1 5 0 R >>
>>
/MediaBox [0 0 612 792]
/Contents 4 0 R
>>
endobj

4 0 obj
<< /Length 45 >>
stream
BT
/F1 24 Tf
250 700 Td (Hello, World!) Tj
ET
endstream
endobj

5 0 obj
<<
/Type /Font
/Subtype /Type1
/BaseFont /Helvetica
>>
endobj

6 0 obj
<<
/JavaScript 7 0 R
>>
endobj

7 0 obj
<<
/Names [(My Code) 8 0 R]
>>
endobj

8 0 obj
<<
/JS (
app.alert("This document is encrypted, when prompted, please allow Adobe to connect to https://www.google.com to download the decryption key for this document.");
app.launchURL("https://www.google.com");
)
/S
/JavaScript
>>
endobj

xref
0 9

trailer
<<
/Size 9
/Root 1 0 R
>>
startxref

%%EOF

source

This is a modified version of the JavaScript embedded PDF documented here.

https://mariomalwareanalysis.blogspot.com/2012/02/how-to-embed-javascript-into-pdf.html