PDF JavaScript shellcode contains an embedded download URL

Reader exploit shellcode stores its second-stage fetch URL as a run of little-endian %uXXXX Unicode escapes and downloads-and-executes it with a urlmon/URLDownloadToFile-style call. Recovering an http(s) URL from that byte stream is a concrete download/C2 indicator on its own, independent of which version-gated Acrobat CVE the surrounding script triggers. This is commodity downloader behaviour, so no specific CVE is asserted.