Interesting analysis of a malicious PDF.

Worth noting, Adobe launched Reader X two days ago, which they claim has a "sandbox" design that prevents attacks such as these.

[1] http://www.computerworld.com/s/article/9197230/Adobe_launche...

Google web cache for those who can't get to non-standard ports: https://webcache.googleusercontent.com/search?q=cache:E3WJ19...

Some more interesting tidbits on how to write exploits: http://x9090.blogspot.com/2010/03/tutorial-exploit-writting-...

Why is this being served over port 8800?

port 80 read the wrong pdf!

Because you can run your HTTP server on any port you want.

That doesn't really answer my question.

Maybe the user has an Internet provider with one of those stupid policy where TCP port 80 is closed as inbound. And he used a TCP high port to be able to host his/her HTTP server.