PUA.PDF.OpenActionObject has been dropped and has been replaced with
the signatures below:
PUA.Script.PDF.OpenActionObjectwithJavascript
PUA.Script.PDF.OpenActionObjectwithJS
Thanks,
-Alain
On Sun, Apr 24, 2011 at 5:03 AM, Johannes Schulz wrote:
> "sigtool -fPUA.PDF.OpenActionObject|sigtool --
"sigtool -fPUA.PDF.OpenActionObject|sigtool --decode-sigs" says:
VIRUS NAME: PUA.PDF.OpenActionObject
TARGET TYPE: ANY FILE
OFFSET: 0
DECODED SIGNATURE:
%PDF-{WILDCARD_ANY_STRING}obj{WILDCARD_ANY_STRING(LENGTH<=2)}<<{WILDCARD_ANY_STRING}/OpenAction
/OpenAction comes in two variants - the PDF Refe
