Malicious PDF / .BIN — malware analysis report

if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 6.01)
{
   ADBE.Reader_Need_Version = 6.03
   ADBE.Reader_Value_New_Version_URL =
       "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l="
       + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_5";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 6.01)
{
   ADBE.Viewer_Need_Version = 6.03;
   ADBE.Viewer_Value_New_Version_URL =
       "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" 
       + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_5";
}

if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";

if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 1.2)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.01)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_Older, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA",
                                   cDesc: ADBE.Viewer_string_Update_Reader_Desc});
         }
         ADBE.Reader_Value_Asked = true;
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion == 6)
         {
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_60,
            cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO,
            cTitle: ADBE.Viewer_string_Title});
         }
         else if (app.viewerVersion < 6)
         {
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older,
            cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO,
            cTitle: ADBE.Viewer_string_Title});
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer_601, 1, 1) == 1)
                app.findComponent({cType:"Plugin", cName:"XFA",
                                   cDesc: ADBE.Viewer_string_Update_Desc});
         }
         ADBE.Viewer_Value_Asked = true;
      }
   }
}

<template xmlns="http://www.xfa.org/schema/xfa-template/2.5/" baseProfile="interactiveForms"
><subform layout="tb" locale="en_US" name="topmostSubform"
><pageSet
><pageArea id="PageArea1" name="PageArea1"
><contentArea h="792pt" name="ContentArea1" w="612pt" x="0pt" y="0pt"
></contentArea
><medium long="792pt" short="612pt" stock="custom"
></medium
></pageArea
></pageSet
><subform h="792pt" name="Page1" w="612pt" x="0pt" y="0pt"
><break before="pageArea" beforeTarget="#PageArea1"
></break
><bind match="none"
></bind
><field h="6.8788mm" name="Type" w="7.1988mm" x="31.1834mm" y="46.2156mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
><?PDF_OBJR Type[0]?></field
><field h="19.56pt" name="undefined" w="26.76pt" x="483.36pt" y="178.68pt"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><para vAlign="middle"
></para
><font typeface="Helvetica"
></font
><assist
><toolTip
>undefined</toolTip
></assist
><traversal
><traverse ref="Cardholder_Name_Print"
></traverse
></traversal
><?PDF_OBJR undefined[0]?></field
><field h="19.56pt" name="Cardholder_Name_Print" w="199.8pt" x="138.72pt" y="199.44pt"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><para vAlign="middle"
></para
><font typeface="Helvetica"
></font
><assist
><toolTip
>Cardholder Name (Print</toolTip
></assist
><traversal
><traverse ref="DCJS_ID"
></traverse
></traversal
><?PDF_OBJR Cardholder_Name_Print[0]?></field
><field h="10.56pt" name="DCJS_ID" w="145.56pt" x="408.96pt" y="208.44pt"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><para vAlign="middle"
></para
><font size="9.5pt" typeface="Helvetica"
></font
><assist
><toolTip
>DCJS ID</toolTip
></assist
><traversal
><traverse ref="Cardholder_s_Address"
></traverse
></traversal
><?PDF_OBJR DCJS_ID[0]?></field
><field h="19.56pt" name="Cardholder_s_Address" w="426.12pt" x="128.4pt" y="222.48pt"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><para vAlign="middle"
></para
><font typeface="Helvetica"
></font
><assist
><toolTip
>Cardholder’s Address</toolTip
></assist
><traversal
><traverse ref="City"
></traverse
></traversal
><?PDF_OBJR Cardholder_s_Address[0]?></field
><field h="19.56pt" name="City" w="209.76pt" x="128.76pt" y="250.08pt"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><para vAlign="middle"
></para
><font typeface="Helvetica"
></font
><assist
><toolTip
>City</toolTip
></assist
><traversal
><traverse ref="State"
></traverse
></traversal
><?PDF_OBJR City[0]?></field
><field h="19.56pt" name="State" w="72.12pt" x="374.4pt" y="250.08pt"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><para vAlign="middle"
></para
><font typeface="Helvetica"
></font
><assist
><toolTip
>State</toolTip
></assist
><traversal
><traverse ref="Zip"
></traverse
></traversal
><?PDF_OBJR State[0]?></field
><field h="19.56pt" name="Zip" w="72.12pt" x="482.4pt" y="250.08pt"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><para vAlign="middle"
></para
><font typeface="Helvetica"
></font
><assist
><toolTip
>Zip</toolTip
></assist
><traversal
><traverse ref="Cardholder_s_Signature"
></traverse
></traversal
><?PDF_OBJR Zip[0]?></field
><field h="19.56pt" name="Cardholder_s_Signature" w="423.6pt" x="130.92pt" y="284.76pt"
><ui
><signature
></signature
></ui
><font size="0pt" typeface="Helvetica"
></font
><assist
><toolTip
>Cardholder’s Signature</toolTip
></assist
><traversal
><traverse ref="Daytime_Phone_Number_2"
></traverse
></traversal
><?PDF_OBJR Cardholder_s_Signature[0]?></field
><field h="19.56pt" name="Daytime_Phone_Number_1" w="418.08pt" x="136.44pt" y="305.04pt"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><para vAlign="middle"
></para
><font typeface="Helvetica"
></font
><assist
><toolTip
>Daytime Phone Number [1]</toolTip
></assist
><traversal
><traverse ref="Memo"
></traverse
></traversal
><?PDF_OBJR Daytime_Phone_Number_1[0]?></field
><field h="19.56pt" name="Memo" w="478.68pt" x="75.84pt" y="334.92pt"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><para vAlign="middle"
></para
><font typeface="Helvetica"
></font
><assist
><toolTip
>Memo</toolTip
></assist
><traversal
><traverse ref="Please_provide_a_valid_email_address_to_receive_a_receipt_confirmation_of_payment"
></traverse
></traversal
><?PDF_OBJR Memo[0]?></field
><field h="19.56pt" name="Please_provide_a_valid_email_address_to_receive_a_receipt_confirmation_of_payment" w="224.04pt" x="330.48pt" y="357.96pt"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><para vAlign="middle"
></para
><font typeface="Helvetica"
></font
><assist
><toolTip
>Please provide a valid email address to receive a receipt confirmation of payment</toolTip
></assist
><?PDF_OBJR Please_provide_a_valid_email_address_to_receive_a_receipt_confirmation_of_payment[0]?></field
><?templateDesigner expand 1?><field h="6mm" name="PrintButton1" w="28.575mm" x="187.325mm"
><?templateDesigner isPrintObject true?><ui
><button
></button
></ui
><font typeface="Myriad Pro"
></font
><caption
><value
><text
>Print Form</text
></value
><para hAlign="center" vAlign="middle"
></para
><font typeface="Myriad Pro"
></font
></caption
><border hand="right"
><?templateDesigner StyleID apbx2?><edge cap="butt" stroke="raised"
></edge
><fill
><color value="212,208,200"
></color
></fill
></border
><bind match="none"
></bind
><event activity="click"
><script contentType="application/x-javascript"
>xfa.host.print(1, "0", (xfa.host.numPages -1).toString(), 0, 1, 0, 0, 0);</script
></event
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="39.3432mm" y="46.2156mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="47.6602mm" y="46.2156mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="55.8144mm" y="46.2156mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="63.9685mm" y="46.2157mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="72.1283mm" y="46.0586mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="80.2824mm" y="46.2156mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="88.2792mm" y="46.2157mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="96.4329mm" y="46.0587mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="104.593mm" y="46.0587mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="112.7471mm" y="46.0586mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="121.0641mm" y="46.2157mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="129.2182mm" y="46.2156mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="137.215mm" y="46.0586mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="145.3748mm" y="46.0587mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="7.1988mm" x="153.529mm" y="46.0586mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="13.2736mm" x="42.3774mm" y="54.3758mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="6.8788mm" name="Type" w="12.7963mm" x="42.8611mm" y="62.6928mm"
><ui
><textEdit hScrollPolicy="off"
><comb numberOfCells="16"
></comb
><margin
></margin
></textEdit
></ui
><value
><text maxChars="16"
></text
></value
><para vAlign="middle"
></para
><font typeface="Courier"
></font
><assist
><toolTip
>Type</toolTip
></assist
><traversal
><traverse ref="undefined"
></traverse
></traversal
></field
><field h="19.56pt" name="undefined" w="26.76pt" x="158.3281mm" y="63.0132mm"
><ui
><textEdit
><margin
></margin
></textEdit
></ui
><para vAlign="middle"
></para
><font typeface="Helvetica"
></font
><assist
><toolTip
>undefined</toolTip
></assist
><traversal
><traverse ref="Cardholder_Name_Print"
></traverse
></traversal
></field
></subform
><?templateDesigner expand 1?></subform
><?templateDesigner Zoom 165?><?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:0?></template
>