This Metasploit module can either creates a blank PDF file which contains a UNC link which can be used to capture NetNTLM credentials, or if the PDFINJECT option is used it will inject the necessary code into an existing PDF document if possible.
b008d7e54ddfd9cbdcce9f6c237e1e5ab88081ef4d74a59bce1242f2ce897dc6