Interestingly, it's a single CVE that is described as RCE. So presumably the same vulnerability that allowed for the reading of arbitrary files also is what enabled RCE.

Which suggests that somebody at Adobe did see what the second stage looked like. Or was able logically draw the conclusion that the same vulnerability (used in a different way) could be leveraged for RCE.

There's also:
https://obf-io.deobfuscate.io/

It sure is better to run an app to do things than to even attempt to believe the nonsense that AI tools spew out.

And yeah, this part of the exploit allows for reading of arbitrary files.

Now, whatever threat actor at play here was fine with buffoons such as myself getting access to this part of the exploit chain. As it was only used to communicate precise details to the C2 server. i.e., this exploit chain was the disposable part.

I can only imagine what sort of second-stage exploit is being served up AES-encrypted to only some individuals.

Now, even without a fancy second stage, I suspect the ability to exfiltrate arbitrary files off of a system opening the PDF ain't nothing to sneeze at.

Which had a buffer overflow in CVE-2007-5659.

Strange days indeed.

Compared to Grok, which just did what I asked.

I'm not particularly fond of receiving ethical judgment and assumptions about why I'm doing my job

0-day in acroread.exe? Are we back in the early twenty teens again?

The million dollar question is: Is this vulnerability chain, which is honestly used just to provide useful information to the C2 just the warm-up to the real exploit delivered by the C2?

Or is privileged JavaScript execution enough to do bad things?

So there's no immediate obvious symptom of shenanigans. Other than the fact that a C2 server is polled for further instructions that is.