"sigtool -fPUA.PDF.OpenActionObject|sigtool --decode-sigs" says:
VIRUS NAME: PUA.PDF.OpenActionObject
TARGET TYPE: ANY FILE
OFFSET: 0
DECODED SIGNATURE:
%PDF-{WILDCARD_ANY_STRING}obj{WILDCARD_ANY_STRING(LENGTH<=2)}<<{WILDCARD_ANY_STRING}/OpenAction/OpenAction comes in two variants - the PDF Referance says: A value specifying a destination to be displayed or an action to be performed when the document is opened. The value is either an array defining a destination (see Section 8.2.1, “Destinations”) or an action dictionary representing an action (Section 8.5, “Actions”). If this entry is absent, the document should be opened to the top of the first page at the default magnification factor. An OpenAction such as "/OpenAction [4 0 R /Fit]" is harmless ? -- Thanks Johannes Schulz _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
