analysis suspicious PDF

# analysis suspicious pdf(file name is pdf.pdf that is downloaded at gowlave.cn)

# HaiDong, 091215
 

# uncompress pdf stream by pdftk

# decode str variable section by malzla

  

# analysis IyLrgiy variable

 

# copy upper decoded data & paste by hex at Hex view Tab 

# exe.php is malware as below