Detect Malicious Pdf Dropper
This rule detects potentially malicious PDF files that act as droppers. It looks for a valid PDF header combined with specific PDF object patterns (Catalog, Pages, Page, FlateDecode) and indicators of malicious activity. These indicators include commands to launch chrome.exe, launch actions, obfuscated JavaScript for data export, or an 'anonymous' author field, which can be used by malware families like win.cloudeye.
YARA
