Adobe Reader JavaScript exploit kit (URL-keyed loader)

Fires when the PDF OpenAction JavaScript contains the fingerprint of a specific anti-analysis Adobe Reader exploit kit: a substitution cipher keyed on this.URL (the delivery filename, extracted via indexOf('rtl')), a decoy fallback key when the URL contains ':' (so sandboxes/static analysis decode to garbage by design), and a parseInt(pair,16)->fromCharCode hex decoder feeding eval. The kit bundles the classic Adobe Reader JavaScript CVEs (CVE-2007-5659, CVE-2008-2992, CVE-2009-0927, CVE-2009-4324, CVE-2010-0188) and selects one at runtime by viewer version. Because the decode key is the runtime delivery URL, the specific CVE is not statically recoverable, so the loader fingerprint attributes the Reader-exploit family at related confidence (which removes it from the unknown-exploit/0-day hunt queue).