http://news.poseidon-us.com/TG6cBp
The first thing to do, when analyzing a potentially malicious PDF, is to look for the /Encrypt name as explained in diary entry Analyzing an Encrypted Phishing PDF.
http://news.poseidon-us.com/TG6cBp
http://news.poseidon-us.com/TG6cBp

