The following is the post of a moderator (Lupin) of Remote-Exploit Forums which I found very helpful.
Here's the method that I use in
analysing malicious PDFs:
I use the tools
pdf-parser from here. In the
past I have also used
pdftk, but I'm
finding that less useful recently.
pdfid to analyse the pdf document.
pdfid can tell you if a
autorun functionality and how many
pages it has. A one page document with
determine its purpose. Sometimes the
in which case you can just use the
strings utility to extract it.
Otherwise, you can use pdf-parser to
extract certain types of encoded
true purpose. To remove this
obfuscation I modify the script a
little to allow easier debugging (e.g.
assign the code from eval statements
to a variable instead) and use the
how the code is transformed as it
overflows, and the shellcode is often
in unicode format. I have a perl
script that I wrote to convert
this type of shellcode to a C program
(really just C style shellcode with
some wrapper code) which can then be
compiled to be further analysed using
standard binary analysis techniques.
I will note that PDF exploits are
practice most of the ones out in the
wild seem to use it. Certainly the
ones I have seen have it.