This is how a PDF doc­u­ment looks — with a JavaScript exe­cu­tion. Note that with Ope­n­Ac­tion 6 (object block 6) this block is exe­cut­ed when the doc­u­ment is opened. Oth­er way to cre­ate a mali­cious PDF: Analyse a PDF file If a PDF file is com­pressed, decom­press it first. pdftk input.pdf output output.pdf uncompress Get details with Pdfin­fo…