Didier Stevens (of pdf-parser.py fame) has published a 23-page paper on how to analyze nasty PDFs. While the content is a bit dated and the attackers have added more insidious exploit obfuscation to their arsenal since, the document explains all the concepts that are still valid and useful whenever you encounter a suspicious PDF today.  If you're into PDF analysis (and even if you aren't :), this is a must-read.  http://blog.didierstevens.com/2010/09/26/free-malicious-pdf-analysis-e-book/