When you login to https://support.paloaltonetworks.com/ click on "Threat Database" in "Find Answers" (to the left or the right).
In the search box type "33939" (without the quotes), make sure "vulnerability" (for this case) is selected in "type" and finally click on the Find-button.
However... doing the above will only bring you the obvious:
Attack Name PDF Exploit Evasion Found
Description This alert indicates that PDF exploit evasion has been found on your network.
Threat ID 33939
So ehm... anyone else with ideas? 🙂
This signature is looking for use of double- and triple-encoded data within PDFs. This is a commen evasion technique that malicious PDFs use to hide their malicious payload. However, legimate PDFs can sometimes use double- (and perhaps triple-) encoded data as well, and so this signature is rated as "informational". In fact, some PDF reports generated by the Palo Alto Networks firewalls can trigger this informational signature.
This signature, just like any other informational signature, is not the highest priority and should not necessarily trigger immediate alarm, however keeping an eye on instances of this alert for PDFs from untrusted sources is a good idea.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!