Exploit Action with PDF OpenAction

When users open an maliciously crafted PDF document, the payload automatically executes and downloads another malicious file from Internet, which is then executed. Actually, the payload is not triggered by a vulnerability used in the exploit directly but a tag in PDF called OpenAction which can specify an action to be performed when the document is opened.