Glossary: Threat Vectors: Files, Networks and Endpoints

PDF action entries (/JS, /JavaScript, /OpenAction, /AA, /Launch, /EmbeddedFile)

Also written: /JS, /JavaScript, /OpenAction, /AA, /AA (additional actions), /Launch, /EmbeddedFile

Named entries inside a PDF that pdfid counts: /JS and /JavaScript mark script code and script actions, /OpenAction runs something the moment the file opens, /AA (additional actions) runs actions on events such as turning a page, /Launch asks the reader to start another program, and /EmbeddedFile hides a whole other file inside. A normal invoice shows 0 for all of them, so when the fake Statement_Oct.pdf showed /JavaScript 1 and /OpenAction 1, Alex knew it was not genuine.