On 2021-06-07 13:58, Benoît Panizzon wrote:
So extracing the link URI from a PDF and checking this against URI blacklists would probably be more clever.
its not url, its if pdf excute javascripts or contains macros that autoload malware, so url is irrelevant
google yara, and foxhole i use all foxhole, no surprise anymore
