Malicious PDF — malware analysis report

Static analysis result for SHA-256 20fe1c99cc3fafe5…

MALICIOUS

PDF

144.4 KB Created: 2011-03-31 13:16:34 +01:00 Authoring application: QuarkXPress(R) 8.5 First seen: 2012-06-14
MD5: 5cbef8e4ade60ef54b57132762974125 SHA-1: 814229a12f5a84030dce9361edbd04b37a576a65 SHA-256: 20fe1c99cc3fafe5d46979616e2ee8fc704e70e88aeba6afd3fd156919c095e0
128 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains multiple embedded JavaScript streams, with a high-confidence heuristic detecting an eval() call. This indicates the script is likely obfuscated and designed to execute arbitrary code. The presence of JavaScript actions and AcroForm buttons further supports the malicious intent. The script's primary function appears to be downloading and executing a second-stage payload, though the exact URL or payload could not be reconstructed due to obfuscation.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4091

Heuristics 6

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
       this.getField("plz_zone").value = eval(feld);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0042_000.js pdf-javascript-stream PDF /JS object 42 at offset 0x2DA7 133 bytes
SHA-256: 86fffb8d4e8265b3fc37bafab0b19373f197c61c544091ee5c9a7f08c2310613
Preview script
First 1,000 lines of the extracted script
function praemie_sachhaft()
{
   
   

  
}
javascript_obj0315_001.js pdf-javascript-stream PDF /JS object 315 at offset 0x1820C 221 bytes
SHA-256: 23be8bc3f4bf0ba4a37f1053ddaa9fe36695c732d3ee0c4a4a163a8528f46406
Preview script
First 1,000 lines of the extracted script
var fd = this.getField("t_FD").value;

if (isNaN(fd))
{
   app.alert("Bitte geben Sie eine g�ltige FD-Nummer ein.", 0, 0, "Fehler");
   this.resetForm("t_FD");
   this.getField("t_FD").setFocus();
}
javascript_obj0318_002.js pdf-javascript-stream PDF /JS object 318 at offset 0x18530 216 bytes
SHA-256: 13b41a553f956c35387292f2e3108b93b9d7234a901b336f7ca01e8adaf40fc3
Preview script
First 1,000 lines of the extracted script
var fd = this.getField("t_FD").value;

if (isNaN(fd))
{
   app.alert("Bitte geben Sie eine g�ltige FD-Nummer ein.", 0, 0, "Fehler");
   this.resetForm("t_FD");
   his.getField("t_FD").setFocus();
}
javascript_obj0334_003.js pdf-javascript-stream PDF /JS object 334 at offset 0x1954F 38 bytes
SHA-256: fc0d40578dc4f8bbb0dcf4777bc7e3f64eb1e8bc4595fe48b8e0a1f8aeb24159
Preview script
First 1,000 lines of the extracted script
plausis();
javascript_obj0341_004.js pdf-javascript-stream PDF /JS object 341 at offset 0x198AA 39 bytes
SHA-256: 3328eab8501405fcffcc95bb30fbb8bcb963b88928e4a40bd4be3a45d3e80107
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 2, 0, 0, "", false);
javascript_obj0342_005.js pdf-javascript-stream PDF /JS object 342 at offset 0x198FB 42 bytes
SHA-256: 1829f93c988f1bfcd4bf6a74fc06fa5705171ae9bf3ac877b13813c6b492c742
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 2, 0, 0, "", false);
javascript_obj0354_009.js pdf-javascript-stream PDF /JS object 354 at offset 0x19F90 33 bytes
SHA-256: c4287c5c3e37d48b98ace11b04930d19e8be4d405af6749d7e51f8d70a59029e
Preview script
First 1,000 lines of the extracted script
AFDate_KeystrokeEx("dd.mm.yyyy");
javascript_obj0359_012.js pdf-javascript-stream PDF /JS object 359 at offset 0x1A360 146 bytes
SHA-256: 8027e20dc5159f434cbe123a98e1a41d00443a399bb81cdf469636c48f45da27
Preview script
First 1,000 lines of the extracted script
this.getField("fehlertext_plz").display = display.visible; 
this.getField("fehlertext_plz").readonly = true;
javascript_obj0361_013.js pdf-javascript-stream PDF /JS object 361 at offset 0x1A536 39 bytes
SHA-256: cf3ef38cead83f4b1b39c7a061c8fef2c62d068861252a2b5ba7c0b959eec058
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", false);
javascript_obj0362_014.js pdf-javascript-stream PDF /JS object 362 at offset 0x1A587 42 bytes
SHA-256: a22e7a3e6dbfb6427839e3a2fdcab1be9d58bdd666536d5308358ec98c59feed
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", false);
javascript_obj0433_015.js pdf-javascript-stream PDF /JS object 433 at offset 0x1D110 39 bytes
SHA-256: 3bc80ec40ddc2a11c8e2fe6adcd0b03351c4b296889df91d41bcbfba1fd9d4ad
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 3, 0, 0, "", false);
javascript_obj0434_016.js pdf-javascript-stream PDF /JS object 434 at offset 0x1D161 42 bytes
SHA-256: 38771303e5b133f65b24c6712ec9e6df4c1e3ff95fa802e5cb4ed740e2d70e27
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 3, 0, 0, "", false);
javascript_obj0439_017.js pdf-javascript-stream PDF /JS object 439 at offset 0x1D94C 39 bytes
SHA-256: 6b7cde5083353dc94a728e784406248df1e3c34b8a1b86c325dca7d6822fc92b
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 1, 0, 0, "", false);
javascript_obj0440_018.js pdf-javascript-stream PDF /JS object 440 at offset 0x1D99D 42 bytes
SHA-256: d7feabbe96d6239a4e68846c17660c84111cd34df235720909593806041f8a24
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 1, 0, 0, "", false);
javascript_obj0443_019.js pdf-javascript-stream PDF /JS object 443 at offset 0x1DB2D 183 bytes
SHA-256: a375a48bafb1c40ae55622380be8da4c3fe81500a2f5e40d723fd990ec8ecd82
Preview script
First 1,000 lines of the extracted script
var plz = this.getField ("t_PLZ_Ort").value;
var zone = this.getField ("plz_zone").value;

zone = plz;
javascript_obj0027_021.js pdf-javascript-stream PDF /JS object 27 at offset 0x23C1E 40 bytes
SHA-256: 96f45e180d258928eb87466eda1b3f7df2cc70588dfd48ef7ca0c26d6240f2d7
Preview script
First 1,000 lines of the extracted script
plausis();
javascript_obj0028_022.js pdf-javascript-stream PDF /JS object 28 at offset 0x23C8D 767 bytes
SHA-256: 16c2812202cd2077c8b8cf1536dd83e33947fecadba51e73d679c52537de1400
Preview script
First 1,000 lines of the extracted script
if(this.getField("t_FD").value == "" ||
   this.getField("t_VermittlerNr").value == "" ||
   this.getField("t_Name").value == "" ||
   this.getField("t_Strasse_HausNr").value == "" ||
   this.getField("t_PLZ").value == "" ||
   this.getField("t_Ort").value == "" ||
   this.getField("t_Kontonummer").value == "" ||
   this.getField("t_BKZ").value == "" ||
   this.getField("t_Geldinstitut").value == "" ||
   this.getField("t_Vbeginn").value == "" ||
   this.getField("t_Vablauf").value == "" ||
   this.getField("t_VSU").value == "" ||
   this.getField("kf_Betriebsart").value == "999")
   {  
     app.alert("Bitte erg�nzen Sie alle Pflichtfelder (rotumrandet) nach dem Druck handschriftlich!",0,0,"Hinweis");
	}
javascript_obj0044_023.js pdf-javascript-stream PDF /JS object 44 at offset 0x2EE1 6940 bytes
SHA-256: 7c5ca01424b84f62db88d05d3f07f4db935427d28891d6363b57e2bb4968b40d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
function zone()
{

var plz55487= "3"
var plz55490= "3"
var plz55491= "3"
var plz55494= "3"
var plz55496= "3"
var plz55497= "3"
var plz55499= "3"
var plz55543= "3"
var plz55545= "3"
var plz55546= "3"
var plz55559= "3"
var plz55566= "3"
var plz55568= "3"
var plz55569= "3"
var plz55571= "3"
var plz55576= "3"
var plz55578= "3"
var plz55583= "3"
var plz55585= "3"
var plz55590= "3"
var plz55592= "3"
var plz55593= "3"
var plz55595= "3"
var plz55596= "3"
var plz55597= "3"
var plz55599= "3"
var plz55606= "2"
var plz55608= "2"
var plz55618= "2"
var plz55619= "2"
var plz55621= "2"
var plz55624= "2"
var plz55626= "2"
var plz55627= "2"
var plz55629= "2"
var plz55743= "2"
var plz55756= "2"
var plz55758= "2"
var plz55765= "2"
var plz55767= "2"
var plz55768= "2"
var plz55774= "2"
var plz55776= "2"
var plz55777= "2"
var plz55779= "2"
var plz56068= "3"
var plz56070= "3"
var plz56072= "3"
var plz56073= "3"
var plz56075= "3"
var plz56076= "3"
var plz56077= "3"
var plz56112= "2"
var plz56130= "2"
var plz56132= "2"
var plz56133= "2"
var plz56154= "2"
var plz56170= "2"
var plz56179= "2"
var plz56182= "2"
var plz56191= "2"
var plz56203= "3"
var plz56204= "3"
var plz56206= "3"
var plz56218= "3"
var plz56220= "3"
var plz56235= "3"
var plz56237= "3"
var plz56242= "3"
var plz56244= "3"
var plz56249= "3"
var plz56253= "3"
var plz56254= "3"
var plz56269= "3"
var plz56271= "3"
var plz56276= "3"
var plz56281= "3"
var plz56283= "3"
var plz56288= "3"
var plz56290= "3"
var plz56291= "3"
var plz56294= "3"
var plz56295= "3"
var plz56299= "3"
var plz56305= "2"
var plz56307= "2"
var plz56316= "2"
var plz56317= "2"
var plz56321= "2"
var plz56322= "2"
var plz56323= "2"
var plz56329= "2"
var plz56330= "2"
var plz56332= "2"
var plz56333= "2"
var plz56335= "2"
var plz56337= "2"
var plz56338= "2"
var plz56340= "2"
var plz56341= "2"
var plz56346= "2"
var plz56348= "2"
var plz56349= "2"
var plz56355= "2"
var plz56357= "2"
var plz56368= "2"
var plz56370= "2"
var plz56377= "2"
var plz56379= "2"
var plz56410= "3"
var plz56412= "3"
var plz56414= "3"
var plz56422= "3"
var plz56424= "3"
var plz56427= "3"
var plz56428= "3"
var plz56457= "3"
var plz56459= "3"
var plz56462= "3"
var plz56470= "3"
var plz56472= "3"
var plz56477= "3"
var plz56479= "3"
var plz56564= "3"
var plz56566= "3"
var plz56567= "3"
var plz56575= "3"
var plz56579= "3"
var plz56581= "3"
var plz56584= "3"
var plz56587= "3"
var plz56588= "3"
var plz56589= "3"
var plz56593= "3"
var plz56594= "3"
var plz56598= "3"
var plz56599= "3"
var plz56626= "3"
var plz56630= "3"
var plz56637= "3"
var plz56642= "3"
var plz56645= "3"
var plz56648= "3"
var plz56651= "3"
var plz56653= "3"
var plz56656= "3"
var plz56659= "3"
var plz56727= "3"
var plz56729= "3"
var plz56736= "3"
var plz56743= "3"
var plz56745= "3"
var plz56746= "3"
var plz56751= "3"
var plz56753= "3"
var plz56754= "3"
var plz56759= "3"
var plz56761= "3"
var plz56766= "3"
var plz56767= "3"
var plz56769= "3"
var plz56812= "1"
var plz56814= "1"
var plz56818= "1"
var plz56820= "1"
var plz56821= "1"
var plz56823= "1"
var plz56825= "1"
var plz56826= "1"
var plz56828= "1"
var plz56829= "1"
var plz56841= "1"
var plz56843= "1"
var plz56850= "1"
var plz56856= "1"
var plz56858= "1"
var plz56859= "1"
var plz56861= "1"
var plz56862= "1"
var plz56864= "1"
var plz56865= "1"
var plz56867= "1"
var plz56869= "1"
var plz57072= "2"
var plz57074= "2"
var plz57076= "2"
var plz57078= "2"
var plz57080= "2"
var plz57223= "2"
var plz57234= "2"
var plz57250= "2"
var plz57258= "2"
var plz57271= "2"
var plz57290= "2"
var plz57299= "2"
var plz57319= "2"
var plz57334= "2"
var plz57339= "2"
var plz57368= "2"
var plz57392= "2"
var plz57399= "2"
var plz57413= "3"
var plz57439= "3"
var plz57462= "3"
var plz57482= "3"
var plz57489= "3"
var plz57518= "2"
var plz57520= "2"
var plz57537= "2"
var plz57539= "2"
var plz57548= "2"
var plz57555= "2"
var plz57562= "2"
var plz57567= "2"
var plz57572= "2"
var plz57577= "2"
var plz57578= "2"
var plz57580= "2"
var plz57581= "2"
var plz57583= "2"
var plz57584= "2"
var plz57586= "2"
var plz57587= "2"
var plz57589= "2"
var plz57610= "3"
var plz57612= "3"
var plz57614= "3"
var plz57627= "3"
var plz57629= "3"
var plz57632= "3"
var plz57635= "3"
var plz57636= "3"
var plz57638= "3"
var plz57639= "3"
var plz57641= "3"
var plz57642= "3"
var plz57644= "3"
var plz57645= "3"
var plz57647= "3"
var plz57648= "3"
var plz58089= "4"
var plz58091= "4"
var plz58093= "4"
var plz58095= "4"
var plz58097= "4"
var plz58099= "4"
var plz58119= "4"
var plz58135= "4"
var plz58239= "4"
var plz58256= "4"
var plz58285= "4"
var plz58300= "3"
var plz58313= "3"
var plz58332= "3"
var plz58339= "3"
var plz58452= "3"
var plz58453= "3"
var plz58454= "3"
var plz58455= "3"
var plz58456= "3"
var plz58507= "4"
var plz58509= "4"
var plz58511= "4"
var plz58513= "4"
var plz58515= "4"
var plz58540= "4"
var plz58553= "4"
var plz58566= "4"
var plz58579= "4"
var plz58636= "4"
var plz58638= "4"
var plz58640= "4"
var plz58642= "4"
var plz58644= "4"
var plz58675= "4"
var plz58706= "3"
var plz58708= "3"
var plz58710= "3"
var plz58730= "3"
var plz58739= "3"
var plz58762= "3"
var plz58769= "3"
var plz58791= "3"
var plz58802= "2"
var plz58809= "2"
var plz58840= "2"
var plz58849= "2"
var plz59063= "3"
var plz59065= "3"
var plz59067= "3"
var plz59069= "3"
var plz59071= "3"
var plz59073= "3"
var plz59075= "3"
var plz59077= "3"
var plz59174= "4"
var plz59192= "4"
var plz59199= "4"
var plz59227= "3"
var plz59229= "3"
var plz59269= "3"
var plz59302= "4"
var plz59320= "4"
var plz59329= "4"
var plz59348= "4"
var plz59368= "4"
var plz59379= "4"
var plz59387= "4"
var plz59394= "4"
var plz59399= "4"
var plz59423= "3"
var plz59425= "3"
var plz59427= "3"
var plz59439= "3"
var plz59457= "3"
var plz59469= "3"
var plz59494= "3"
var plz59505= "3"
var plz59510= "3"
var plz59514= "3"
var plz59519= "3"
var plz59555= "3"
var plz59556= "3"
var plz59557= "3"
var plz59558= "3"
var plz59581= "3"
var plz59590= "3"
var plz59597= "3"
var plz59602= "4"
var plz59609= "4"
var plz59755= "3"
var plz59757= "3"
var plz59759= "3"
var plz59821= "3"
var plz59823= "3"
var plz59846= "3"
var plz59872= "3"
var plz59889= "3"
var plz59909= "2"
var plz59929= "2"
var plz59939= "2"

   var feld = "";
    
   this.resetForm("plz_zone");

   var plz = this.getField("t_PLZ").value;
   var plz_hilf = plz + "*";
      
   if(plz_hilf.length == 5)
   {
      var plz_hilf = "0" + plz_hilf;
   }
       
   plz_hilf = plz_hilf.substr(0,5);
   var zone = this.getField("plz_zone").value;

   feld = "plz" + plz_hilf;
   this.getField("plz_zone").value = eval(feld);
   

}
javascript_obj0045_024.js pdf-javascript-stream PDF /JS object 45 at offset 0x33DB 382 bytes
SHA-256: ff20cb0f501b22f004b4e7d90665a002cafa09266468661b315bd5436c2157e4
Preview script
First 1,000 lines of the extracted script
function praemie_ergebnis()
{
   var jp_gesamt = this.getField("t_Jahrespr�mie_gesamt");
   var steuer = this.getField("t_Versicherungssteuer");
   var p_steuer = this.getField("t_Pr�mieInklSteuer");   
   
   steuer.value = jp_gesamt.value * 19 / 100;
   p_steuer.value = jp_gesamt.value + steuer.value;
}
javascript_obj0046_025.js pdf-javascript-stream PDF /JS object 46 at offset 0x34DA 2144 bytes
SHA-256: 56b88c3e8e8ab2b41fec07fe4d90c145db0707dbf77b98df0c1ad532775ecfc2
Preview script
First 1,000 lines of the extracted script
function praemie_berechnen_mitdiffdeck()
{
   var person = this.getField("t_Personen");
   var vs = this.getField("t_VSU");
   var praemie = this.getField("t_Jahrespr�mie_SachHaft");
   var jp_gesamt = this.getField("t_Jahrespr�mie_gesamt");
   var dil = this.getField("kk_Differenzdeckung");
   var pp = this.getField("t_Jahrespr�mie_Plus");
   var pd = this.getField("t_Jahrespr�mie_Differenzdeckung");
   var pPHV = this.getField("t_Jahrespr�mie_PHV");
   
   //Sach-Mindestpr�mie
   var mp_sach = 120;
   //Haft-Mindestpr�mie
   var mp_haft = this.getField("mp_haft").value;
   var pHaft = this.getField("praemie_haft").value;
   var pSach = this.getField("praemie_sach").value;
   var praemieHaft = this.getField("haft_hilfe");
     
   praemie_sachhaft();
   
   
   if(person.value > 0)
   {   
      var hilf_ph = person.value * AFMakeNumber(pHaft);
            
      if (hilf_ph > AFMakeNumber(mp_haft))
      {
         //praemie.value = hilf_ph;
         praemieHaft.value = hilf_ph;
      }
      else
      {
         //praemie.value = AFMakeNumber(mp_haft);
         praemieHaft.value = AFMakeNumber(mp_haft);
      }
      
      if(vs.value > 4999 && vs.value < 100001)
      { 
         var hilf_ps = vs.value * AFMakeNumber(pSach) / 1000;
         
         if (hilf_ps > mp_sach)
         {
            praemie.value = praemieHaft.value + hilf_ps;
         }
         else
         {
            praemie.value = praemieHaft.value + mp_sach;
         }
        
      }
   }   

   
   
   if(dil.value == "Ja")
   {
      
     // var pd = this.getField("t_Jahrespr�mie_Differenzdeckung");
      pd.value = diffdeckung_berechnen();
   }  
   
/*
   if(praemie.value);
   {
      jp_gesamt.value = praemie.value;
      
   }
 */  
   

  if(pd.value)
   {
      jp_gesamt.value = pd.value;
      
   }
   
   if(pp.value)
   {
      jp_gesamt.value = jp_gesamt.value + pp.value;
      
   }

   
   if(pPHV.value)
   {
      jp_gesamt.value = jp_gesamt.value + pPHV.value;
      
   }


  praemie_ergebnis();
   
}
javascript_obj0047_026.js pdf-javascript-stream PDF /JS object 47 at offset 0x375A 2327 bytes
SHA-256: a519d81121d74da9c4f32590eb40c57db4834aa5267f6de7463c1a4987658c92
Preview script
First 1,000 lines of the extracted script
function praemie_berechnen()
{
   var person = this.getField("t_Personen");
   var vs = this.getField("t_VSU");
   var praemie = this.getField("t_Jahrespr�mie_SachHaft");
   var jp_gesamt = this.getField("t_Jahrespr�mie_gesamt");
   var dil = this.getField("kk_Differenzdeckung");
   var pp = this.getField("t_Jahrespr�mie_Plus");
   var pd = this.getField("t_Jahrespr�mie_Differenzdeckung");
   var pPHV = this.getField("t_Jahrespr�mie_PHV");
   
   //Sach-Mindestpr�mie
   var mp_sach = 120;
   //Haft-Mindestpr�mie
   var mp_haft = this.getField("mp_haft").value;
   var pHaft = this.getField("praemie_haft").value;
   var pSach = this.getField("praemie_sach").value;
   var praemieHaft = this.getField("haft_hilfe");
     
   praemie_sachhaft();
   
   
   if(person.value > 0)
   {   
      var hilf_ph = person.value * AFMakeNumber(pHaft);
            
      if (hilf_ph > AFMakeNumber(mp_haft))
      {
         //praemie.value = hilf_ph;
         praemieHaft.value = hilf_ph;
      }
      else
      {
         //praemie.value = AFMakeNumber(mp_haft);
         praemieHaft.value = AFMakeNumber(mp_haft);
      }
      
      if(vs.value > 4999 && vs.value < 100001)
      { 
         var hilf_ps = vs.value * AFMakeNumber(pSach) / 1000;
         
         if (hilf_ps > mp_sach)
         {
            praemie.value = praemieHaft.value + hilf_ps;
         }
         else
         {
            praemie.value = praemieHaft.value + mp_sach;
         }
        
      }
   }   

/*
   if(dil.value == "Ja")
   {
      
     // var pd = this.getField("t_Jahrespr�mie_Differenzdeckung");
      pd.value = diffdeckung_berechnen();
   }  
   
*/
   if(praemie.value);
   {
      jp_gesamt.value = praemie.value;
      
   }
   
   if(pp.value)
   {
      jp_gesamt.value = jp_gesamt.value + pp.value;
      
   }

 /*  
   if(pd.value)
   {
      jp_gesamt.value = jp_gesamt.value + pd.value;
      
   }

   */
   if(pPHV.value)
   {
      jp_gesamt.value = jp_gesamt.value + pPHV.value;
      
   }


  praemie_ergebnis();
 
}
javascript_obj0048_027.js pdf-javascript-stream PDF /JS object 48 at offset 0x39DC 889 bytes
SHA-256: ea5dfc8446cca5a344fcfe941c7eca19e4c9990989480d09d9c9d7559f4fc5fe
Preview script
First 1,000 lines of the extracted script
function plausis()
{ 
	if(this.getField("t_FD").value == "" ||
   this.getField("t_VermittlerNr").value == "" ||
   this.getField("t_Name").value == "" ||
   this.getField("t_Strasse_HausNr").value == "" ||
   this.getField("t_PLZ").value == "" ||
   this.getField("t_Ort").value == "" ||
   this.getField("t_Kontonummer").value == "" ||
   this.getField("t_BKZ").value == "" ||
   this.getField("t_Geldinstitut").value == "" ||
   this.getField("t_Vbeginn").value == "" ||
   this.getField("t_Vablauf").value == "" ||
   this.getField("t_VSU").value == "" ||
   this.getField("kf_Betriebsart").value == "999")
   {  
     app.alert("Bitte erg�nzen Sie alle Pflichtfelder (rot umrandet) im Formular-PDF oder nach dem Druck handschriftlich!",0,0,"Hinweis");
	}
}
javascript_obj0049_028.js pdf-javascript-stream PDF /JS object 49 at offset 0x3B52 844 bytes
SHA-256: 69bc9892d3f321228f316005243e31e72c2484bbd289b398db8a1270b12d5a8a
Preview script
First 1,000 lines of the extracted script
function gebdat_plausi()
{
  // var heute = new Date();
   //var tag = this.getField("t_Geburtsdatum").value.substr(0,2);
   //var monat = this.getField("t_Geburtsdatum").value.substr(3,2);
  // var jahr = this.getField("t_Geburtsdatum").value.substr(6,4);
   
   if( jahr < 1900)
   {  
      app.alert("Das Geburtsdatum ist ung�ltig. Bitte geben Sie ein Geburtsdatum zwischen 01.01.1900 und 01.01.2010 ein.",0,0,"Hinweis")
   }
   if( jahr > 2010)
   {  
      app.alert("Das Geburtsdatum ist ung�ltig. Bitte geben Sie ein Geburtsdatum zwischen 01.01.1900 und 01.01.2010 ein.",0,0,"Hinweis")
   }
   if(jahr == 2010 && (monat > 1 || tag > 1) )
   {  
      app.alert("Das Geburtsdatum ist ung�ltig. Bitte geben Sie ein Geburtsdatum zwischen 01.01.1900 und 01.01.2010 ein.",0,0,"Hinweis")
   } 
}
javascript_obj0050_029.js pdf-javascript-stream PDF /JS object 50 at offset 0x3CBB 356 bytes
SHA-256: 7cd1577d6aafbe58891aa4f57982f899cf32bcce034d17b9d5741a38b35fafab
Preview script
First 1,000 lines of the extracted script
function diffdeckung_berechnen(pr_sachhaft)
{
   // Die Differenzdeckung betr�gt 30 % von der Pr�mie
   var pro = 0.3;
   var pr_sachhaft = this.getField("t_Jahrespr�mie_SachHaft");
   
   var diffdeckung = pr_sachhaft.value * AFMakeNumber(pro);

   return diffdeckung;
}
javascript_obj0051_030.js pdf-javascript-stream PDF /JS object 51 at offset 0x3DD1 1012 bytes
SHA-256: 5361c80e920788d5926a13588a36b2cbcde06dce7af839f5fafaf3b6f707b5e9
Preview script
First 1,000 lines of the extracted script
function VorVR_AblDatum()
{
   var versbegdatum = this.getField("t_Vbeginn").value;
   var versbegtag = this.getField("t_Vbeginn").value.substr(0,2);
   var versbegmon = this.getField("t_Vbeginn").value.substr(3,2);
   var versbegjahr = this.getField("t_Vbeginn").value.substr(6,4);
   var versbegdatum_hilf = new Date(versbegjahr, versbegmon - 1, versbegtag);
   app.alert(versbegdatum_hilf);

   var versabldatum = this.getField("t_Ablaufdatum_1").value;
   var versabltag = this.getField("t_Ablaufdatum_1").value.substr(0,2);
   var versablmon = this.getField("t_Ablaufdatum_1").value.substr(3,2);
   var versabljahr = this.getField("t_Ablaufdatum_1").value.substr(6,4);
   
   var versabldatum_hilf = new Date(versabljahr, versablmon - 1, versabltag);
    app.alert(versabldatum_hilf);
   if(versbegdatum_hilf <= versabldatum_hilf)
  {
      app.alert("Das Ablaufdatum der Vorversicherung muss vor dem Versicherungsbeginn liegen.", 0, 0, "Hinweis");
   }
}
javascript_obj0317_031.js pdf-javascript-stream PDF /JS object 317 at offset 0x1836D 1817 bytes
SHA-256: 84667b874a29838ebb45931a3baad967c0bbb15be5096426a4c4fda2a7780dd7
Preview script
First 1,000 lines of the extracted script
/*
var vermittlernummer = this.getField("t_VermittlerNr").value;

if(vermittlernummer != "")
{
   var vermittlernumme_hilf = vermittlernummer + "*";
   this.getField("t_VermittlerNr").value = vermittlernumme_hilf;
   if(this.getField("t_VermittlerNr").value.length == 9)
   {
      var vnr_1 = this.getField("t_VermittlerNr").value.substr(0,3);
      var vnr_2 = this.getField("t_VermittlerNr").value.substr(4,4);
      var punkt = this.getField("t_VermittlerNr").value.substr(3,1);
      vermittlernummer = this.getField("t_VermittlerNr").value;
      app.alert(vnr_1);
      if (isNaN(vnr_1) || isNaN(vnr_2))
      {
            app.alert("Die Vermittlernummer ist ung�ltig. Beispiel: 120.9999", 0, 0, "Fehler");
            this.resetForm("t_VermittlerNr");
            this.getField("t_VermittlerNr").setFocus();
      }
      else
      {  
         if(isNaN(punkt))
         {
         if(punkt != ".")
         {
            app.alert("Die Vermittlernummer ist ung�ltig. Beispiel: 120.9999", 0, 0, "Fehler");
            this.resetForm("t_VermittlerNr");
            this.getField("t_VermittlerNr").setFocus();
         }
         }
         else
         {
            app.alert("Die Vermittlernummer ist ung�ltig. Beispiel: 120.9999", 0, 0, "Fehler");
            this.resetForm("t_VermittlerNr");
            this.getField("t_VermittlerNr").setFocus();      
         }
      }
   }
   else
   {
      app.alert("Die Vermittlernummer ist ung�ltig. Beispiel: 120.9999", 0, 0, "Fehler");
      this.resetForm("t_VermittlerNr");
      this.getField("t_VermittlerNr").setFocus();
      app.alert("test");      
   }
}

*/
javascript_obj0332_032.js pdf-javascript-stream PDF /JS object 332 at offset 0x19396 1661 bytes
SHA-256: 0761d0ea577d0f477186cb5a94d71216af129ccb9a08d8b7f8bf1e69f7cb0bbe
Preview script
First 1,000 lines of the extracted script
this.getField("fehlertext_plz").display = display.hidden;

this.getField("kk_VV_hilf").display = display.hidden;
this.getField("of_Vorversicherung").display = display.visible;
this.getField("t_Differenzdeckung").readonly = true;
this.getField("t_Gesellschaft_1").readonly = true;
this.getField("t_Gesellschaft_2").readonly = true;
this.getField("t_Gesellschaft_3").readonly = true;
this.getField("t_VersicherungsNr_1").readonly = true;
this.getField("t_VersicherungsNr_2").readonly = true;
this.getField("t_VersicherungsNr_3").readonly = true;
this.getField("t_Ablaufdatum_1").readonly = true;
this.getField("t_Ablaufdatum_2").readonly = true;
this.getField("t_Ablaufdatum_3").readonly = true;
this.getField("of_K�ndigungDurch_1").readonly = true;
this.getField("of_K�ndigungDurch_2").readonly = true;
this.getField("of_K�ndigungDurch_3").readonly = true;

this.getField("of_AnredePHV_1").readonly = true;
this.getField("of_AnredePHV_2").readonly = true;
this.getField("of_AnredePHV_3").readonly = true;
this.getField("t_NamePHV_1").readonly = true;
this.getField("t_NamePHV_2").readonly = true; 
this.getField("t_NamePHV_3").readonly = true;
this.getField("t_GeburtsdatumPHV_1").readonly = true;
this.getField("t_GeburtsdatumPHV_2").readonly = true; 
this.getField("t_GeburtsdatumPHV_3").readonly = true;

this.getField("t_Schadensart_1").readonly = true;
this.getField("t_Schadensart_2").readonly = true;
this.getField("t_Vorsch�denDatum_1").readonly = true;
this.getField("t_Vorsch�denDatum_2").readonly = true;
this.getField("t_Schadenh�he_1").readonly = true;
this.getField("t_Schadenh�he_2").readonly = true;
javascript_obj0339_033.js pdf-javascript-stream PDF /JS object 339 at offset 0x196BC 1419 bytes
SHA-256: 63b5b34809a443427498cd5e3e39ec8acc67a5b93ef8d88b1d7f345b320c13ed
Preview script
First 1,000 lines of the extracted script
var phv_1 = this.getField("t_NamePHV_1");
var phv_2 = this.getField("t_NamePHV_2");
var phv_3 = this.getField("t_NamePHV_3");

var pp = this.getField("t_Jahrespr�mie_Plus");
var praemie = this.getField("t_Jahrespr�mie_SachHaft");
var pd = this.getField("t_Jahrespr�mie_Differenzdeckung");
var pPHV = this.getField("t_Jahrespr�mie_PHV");
var jp_gesamt = this.getField("t_Jahrespr�mie_gesamt");

var pphv = 39.90;

if(phv_1.value != "")
{
   if(phv_2.value != "" && phv_3.value != "")
   {
      pPHV.value = 3 * pphv;
   }
   else
   {
      if(phv_2.value != "" || phv_3.value != "")
      {
         pPHV.value = 2 * pphv;
      }
      else
      {
         pPHV.value = 1 * pphv;
      }
   }
}
else
{
   this.resetForm("of_AnredePHV_1");   
   this.resetForm("t_GeburtsdatumPHV_1");
   
   if(phv_2.value != "" && phv_3.value != "")
   {
      pPHV.value = 2 * pphv;
   }
   else
   {
      
      if(phv_2.value != "" || phv_3.value != "")
      {
         pPHV.value = 1 * pphv;         
      }
      else
      {
         this.resetForm("t_Jahrespr�mie_PHV"); 
      }
      
   }
}

if (this.getField("kk_Differenzdeckung" ).value == "Ja")
{ 
   praemie_berechnen_mitdiffdeck();
}
else
{
   praemie_berechnen();
}
javascript_obj0343_034.js pdf-javascript-stream PDF /JS object 343 at offset 0x1994F 612 bytes
SHA-256: 947369daf35a85cbd01f827ae31a20e4e74cdbeae5ff3be9152fc5a460602fcf
Preview script
First 1,000 lines of the extracted script
var vs = this.getField("t_VSU");
var pers = this.getField("t_Personen");


if(vs.value < 5000) 
{  
   app.alert("Die minimale Versicherungssumme betr�gt 5.000!", 1, 0, "Hinweis");
   vs.value = 5000;
}
if(vs.value > 100000)
{
   app.alert("Die maximale Versicherungssumme betr�gt 100.000!", 1, 0, "Hinweis");
   vs.value = 100000;   
}

if (this.getField("kk_Differenzdeckung" ).value == "Ja")
{ 
   praemie_berechnen_mitdiffdeck();
}
else
{
   praemie_berechnen();
}
javascript_obj0349_035.js pdf-javascript-stream PDF /JS object 349 at offset 0x19C03 2501 bytes
SHA-256: 3d5b206c99efc06b188dffe166bde0cdb2f36ecbdf5300bd1eadb715bba514f6
Preview script
First 1,000 lines of the extracted script
var heute = new Date();
var versbegmonat = this.getField("t_Vbeginn").value.substr(3,2);
var versbegjahr = this.getField("t_Vbeginn").value.substr(6,4);
var versbegtag = this.getField("t_Vbeginn").value.substr(0,2);
var versabldatum = this.getField("t_Vablauf").value;
var heute = new Date();
var mm_now = heute.getMonth();
var yyyy_now = heute.getFullYear();

var abldatum = versabldatum + " ";

if(abldatum.length == 7)
{
   abldatum = "0" + abldatum;
}

var ablmonat = abldatum.substr(0,2);
var abljahr = abldatum.substr(3,4);

if(abljahr != "")
{
if(abljahr > versbegjahr) 
{  
   if(abljahr - versbegjahr == 1)
   {  
      if(ablmonat < versbegmonat)
      {
         app.alert("Die Vertragsdauer betr�gt mindestens ein Jahr.",0,0,"Fehler");
         this.getField("t_Vablauf").setFocus();
      }
      else
      {
         if(ablmonat - versbegmonat == 0 && versbegtag != "01")
         {
            app.alert("Die Vertragsdauer betr�gt mindestens ein Jahr.",0,0,"Fehler");
            this.getField("t_Vablauf").setFocus();
         }
      }
   }
}
else
{
   if(abljahr - versbegjahr == 0 && ablmonat > versbegmonat)
   {  
      app.alert("Die Vertragsdauer betr�gt mindestens ein Jahr.",0,0,"Fehler");
      this.getField("t_Vablauf").setFocus();
   }
   else
   {  
      app.alert("Der Versicherungsablauf darf nicht vor dem Versicherungsbeginn liegen.\nDie Vertragsdauer betr�gt mindestens ein Jahr.",0,0,"Fehler");
      this.getField("t_Vablauf").setFocus();      
   }
}

if(abljahr > versbegjahr)
{
   if(abljahr - versbegjahr > 4)
   { 
      app.alert("Die Vertragsdauer darf vier Jahre nicht �berschreiten.",0,0,"Fehler");
      this.getField("t_Vablauf").setFocus();
   }
   else
   {
      if(abljahr - versbegjahr == 4)
      {
         if(ablmonat > versbegmonat)
         {
            app.alert("Die Vertragsdauer darf vier Jahre nicht �berschreiten.",0,0,"Fehler");
            this.getField("t_Vablauf").setFocus();
         }
         else
         {
            if(ablmonat - versbegmonat == 0 && versbegtag == "01")
            {
               app.alert("Die Vertragsdauer darf vier Jahre nicht �berschreiten.",0,0,"Fehler");
               this.getField("t_Vablauf").setFocus();
            }         
         }         
      }
   }
      
}
}
this.resetForm("t_Differenzdeckung");
javascript_obj0355_036.js pdf-javascript-stream PDF /JS object 355 at offset 0x19FDB 3311 bytes
SHA-256: d15dcae9fc171abbf550138cfd05816658c070d707c1117b1e3828288f54ecfb
Preview script
First 1,000 lines of the extracted script
var heute = new Date();
var BeginnLaufzeit = new Date (2011, 06, 01);
var versbegtag = this.getField("t_Vbeginn").value.substr(0,2);
var versbegmonat = this.getField("t_Vbeginn").value.substr(3,2);
var versbegjahr = this.getField("t_Vbeginn").value.substr(6,4);
var dd_now = util.printd("dd", heute);
var mm_now = heute.getMonth();
var yyyy_now = heute.getFullYear();
var mm_neu = mm_now + 1 - 3;

var versbegdatum = this.getField("t_Vbeginn").value;
var versbegdatum_hilf = new Date(versbegjahr, versbegmonat - 1, versbegtag);


if(this.getField("t_Vbeginn").value)
{
   
   if(versbegdatum_hilf < BeginnLaufzeit)
   {
      app.alert("Der Versicherungsbeginn darf nicht vor dem 01.07.2011 liegen.",0,0,"Fehler");
      this.getField("t_Vbeginn").setFocus();
   }
   
   else
   {
      //max. R�ckdatierung betr�gt 3 Monate
      if(mm_neu <= 0)
      {
         if (versbegjahr == yyyy_now - 1 && versbegmonat < mm_now + 1 + 12 - 3)
         {
            app.alert("Der Versicherungsbeginn darf maximal 3 Monate in der Vergangenheit liegen.",0,0,"Fehler");
            this.getField("t_Vbeginn").setFocus();
         }
         else
         {
            if (versbegjahr == yyyy_now - 1 && mm_now == versbegmonat - 10 && versbegtag < dd_now)
            {
               app.alert("Der Versicherungsbeginn darf maximal 3 Monate in der Vergangenheit liegen.",0,0,"Fehler");
               this.getField("t_Vbeginn").setFocus();
            }
         }
      }
      else
      {
         if (versbegjahr == yyyy_now && versbegmonat < mm_now + 1 - 3)
         {  
            app.alert("Der Versicherungsbeginn darf maximal 3 Monate in der Vergangenheit liegen.",0,0,"Fehler");
            this.getField("t_Vbeginn").setFocus();
         }
         else
         {
            if (versbegjahr == yyyy_now && mm_now - versbegmonat == 2 && versbegtag < dd_now)
            {
               app.alert("Der Versicherungsbeginn darf maximal 3 Monate in der Vergangenheit liegen.",0,0,"Fehler");
               this.getField("t_Vbeginn").setFocus();
            }
         }

         if (versbegjahr < yyyy_now)
         {
            app.alert("Der Versicherungsbeginn darf maximal 3 Monate in der Vergangenheit liegen.",0,0,"Fehler");
            this.getField("t_Vbeginn").setFocus();
         }
      }
   }


//max. Vordatierung betr�gt ein Jahr
if (versbegjahr == yyyy_now + 1 && versbegmonat > mm_now + 1)
{
   app.alert("Der Versicherungsbeginn darf maximal ein Jahr vordatiert werden.",0,0,"Fehler");
   this.getField("t_Vbeginn").setFocus();
}
else
{
   if (versbegjahr == yyyy_now + 1 && versbegmonat - mm_now == 1 && versbegtag > dd_now)
      {
         app.alert("Der Versicherungsbeginn darf maximal ein Jahr vordatiert werden.",0,0,"Fehler");
         this.getField("t_Vbeginn").setFocus();
      }

}
if (versbegjahr > yyyy_now + 1)
{
   app.alert("Der Versicherungsbeginn darf maximal ein Jahr vordatiert werden.",0,0,"Fehler");
   this.getField("t_Vbeginn").setFocus();
}
}
this.resetForm("t_Differenzdeckung");
javascript_obj0360_037.js pdf-javascript-stream PDF /JS object 360 at offset 0x1A444 373 bytes
SHA-256: 3a67edcd7dfd86abbf19cf40178d46661b70e06f73b86c96c9ea8c7fbdaa86b1
Preview script
First 1,000 lines of the extracted script
zone();

this.getField("fehlertext_plz").display = display.hidden; 


praemie_sachhaft();

if (this.getField("kk_Differenzdeckung" ).value == "Ja")
{ 
   praemie_berechnen_mitdiffdeck();
}
else
{
   praemie_berechnen();
}