@MaxWyss Sandboxes, supposedly, track changes on the computer and then analyze. If the computer understands and runs the Acrobat JavaScript (or any other language), changes will be made to the computer, so, the sandbox should "catch" it,. Sandboxes don't have to understand specific languages since, all executable code turns into machine code (at some point). But, most sandboxes also recognize multiple languages, and Acrobat JavaScript is relatively common, so it should be recognized. So, my conclusion is that malicious code probably will be detected, including code in Acrobat JavaScript.

@MaxWyss Well, we work with what we have, at least without doing it manually. VirusTotal does recognized it and runs PDF's through the sandbox. The other option is to extract the JavaScript manually, put it in a ".js" script and then run it through scanning.

@lilshine No, they won't.

There does not exist a Nist_P512 named curve. They chose 521 on purpose, because 2^521-1 happens to be a prime.