Obfuscated multi-stage PDF JavaScript dropper

Fires when the PDF JavaScript shows three or more independent signals of exploit-kit-style multi-stage obfuscation: annotation-subject payload staging (reading pr[N].subject after getAnnots), String.fromCharCode hex decoder loops, long -hh-hh-hh hex-dashed payloads, incremental construction of a method name starting from 'ev' (to hide an eval call), and three or more app.plugIns.length anti-analysis gates. The actual CVE is hidden in the final decoded layer and is not visible via static analysis, but the template is strongly consistent with exploit-kit style payload staging.