Malicious PDF — malware analysis report

Static analysis result for SHA-256 53f61ce08ac1cebd…

MALICIOUS

PDF

121.5 KB Authoring application: Cirali Output Manager B1-23 http://www.fjd.de (via cirali-pdf Pdf-V74 http://www.fjd.de) First seen: 2026-05-10
MD5: 1deb359425ad2f8418a45aa87cfbb730 SHA-1: 8fb3d0866f68aa1f44d17ace52b52455b785ae48 SHA-256: 53f61ce08ac1cebd08774d836ac6f0153524dc461e76c2676edb7bc94d52308c
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF document contains multiple embedded JavaScript streams, indicated by the PDF_JAVASCRIPT and PDF_JS heuristics. These scripts are likely responsible for executing malicious actions, such as downloading and executing a second-stage payload from the embedded URL. The presence of AcroForm buttons with action triggers further suggests user interaction is intended to initiate the malicious script execution. The confidence is moderate due to the obfuscation often present in such embedded scripts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9657

Heuristics 6

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.fjd.de In PDF document text
    • http://www.fjd.de)/CreatorIn PDF document text
    • http://www.fjd.de)/AuthorIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0002_000.js pdf-javascript-stream PDF /JS object 2 at offset 0xDB 449 bytes
SHA-256: 227ca46bb27e6d02fc509d522435c3c917f7409b7380571752f9579fd7d8fea5
Preview script
First 1,000 lines of the extracted script
var n = this.numFields;
var f;
var fn;
for(var i=0;i<n;i++)
{
   fn = this.getNthFieldName(i);
   if(""==fn) continue;

   f = this.getField(fn);
   if(null==f) continue;
   if("button"==f.type)continue;

   SYS_FILL(f,color.transparent);


   if("checkbox"==f.type)
   { f.style=style.cr;
     f.strokeColor=getBorderColor(fn);
   }
   else
   {    if(""+f.strokeColor!=""+color.transparent)
   		{  f.strokeColor=color.transparent;
   		}
   }
}
javascript_obj0002_001.js pdf-javascript-stream PDF /JS object 2 at offset 0xDB 38 bytes
SHA-256: b2e38f438ed1e34f318d244186a1aea582b8a0caaa8ce2a5646ddcf16e0534b4
Preview script
First 1,000 lines of the extracted script
SYS_RESET_BG_COLORS_UPON_ALL_PAGES();
javascript_obj0016_002.js pdf-javascript-stream PDF /JS object 16 at offset 0xA654 172 bytes
SHA-256: 8cc2b8fed26bfd6bfd0e9390d61d0b1f0ddfa7085457fab06e3c2ebc31556cdb
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
  var strZiffern="0123456789";  
   if(-1 == strZiffern.indexOf(event.change))
   {       app.beep(0);event.rc=false;
   }
}
javascript_obj0018_003.js pdf-javascript-stream PDF /JS object 18 at offset 0xA904 383 bytes
SHA-256: 5c2793e47ed93c663b7a3f6d30a48d644d952599bfb3287b36adfa8990b6bb2f
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
var str1= event.value.substring(0,3);
var str2= event.value.substring(3,6);
var str3= event.value.substring(6,8);
event.value=str1+" "+str2+" "+str3;
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0018_004.js pdf-javascript-stream PDF /JS object 18 at offset 0xA904 182 bytes
SHA-256: ec999b72d989c5d75c8daf099c3634a7ca9160827e5673f75d4056ae2fdb9ced
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
var c= event.change;
if(c<"0" || c>"9" )
{ app.beep(0);
event.rc=false; }
if(event.value.length>7)
{ app.beep(0);
event.rc=false; } 
}
javascript_obj0018_005.js pdf-javascript-stream PDF /JS object 18 at offset 0xA904 421 bytes
SHA-256: d5ef5f36cf6753cac87e0c0f333c1d9ab3740d15399ec0bbdd3e2593ce37ed26
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
var nettovalue=event.value;
nettovalue=nettovalue.replace(/ /g,"");
if(nettovalue.length!=8)
{ app.alert("Bitte geben Sie eine Bankleitzahl mit genau 8 Ziffern an.");
event.rc = false; } 
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0018_006.js pdf-javascript-stream PDF /JS object 18 at offset 0xA904 277 bytes
SHA-256: d1c03959506bbd1350972231588ca5d32f8cb1d94f1bb5555eedc21fa0a56738
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
var str1= event.value.substring(0,3);
var str2= event.value.substring(3,6);
var str3= event.value.substring(6,8);
event.value=str1+" "+str2+" "+str3;
}if(false==event.rc
javascript_obj0018_007.js pdf-javascript-stream PDF /JS object 18 at offset 0xA904 315 bytes
SHA-256: d28308bb7c8227f9512535b128a59026b46d551e291e2470db29b165f9641359
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
var nettovalue=event.value;
nettovalue=nettovalue.replace(/ /g,"");
if(nettovalue.length!=8)
{ app.alert("Bitte geben Sie eine Bankleitzahl mit genau 8 Ziffern an.");
event.rc = false; } 
}if(false==event.rc
javascript_obj0031_009.js pdf-javascript-stream PDF /JS object 31 at offset 0xB948 748 bytes
SHA-256: a2eda249f747e76c19f7c5ccc9dd09e4abe2fbd66a6fe35712020bd22049cd3a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
24 of 25 identifiers look randomly generated (e.g. 'SYS_CB_OBJ11') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
if(event.source)
{ var n=event.source.name;
if(n=="OBJ1")SYS_CB_OBJ1();
if(n=="OBJ2")SYS_CB_OBJ2();
if(n=="OBJ3")SYS_CB_OBJ3();
if(n=="OBJ4")SYS_CB_OBJ4();
if(n=="OBJ5")SYS_CB_OBJ5();
if(n=="OBJ6")SYS_CB_OBJ6();
if(n=="OBJ7")SYS_CB_OBJ7();
if(n=="OBJ8")SYS_CB_OBJ8();
if(n=="OBJ9")SYS_CB_OBJ9();
if(n=="OBJ10")SYS_CB_OBJ10();
if(n=="OBJ11")SYS_CB_OBJ11();
if(n=="OBJ12")SYS_CB_OBJ12();
if(n=="OBJ14")SYS_CB_OBJ14();
if(n=="OBJ15")SYS_CB_OBJ15();
if(n=="OBJ16")SYS_CB_OBJ16();
if(n=="OBJ17")SYS_CB_OBJ17();
if(n=="OBJ18")SYS_CB_OBJ18();
if(n=="OBJ19")SYS_CB_OBJ19();
if(n=="OBJ20")SYS_CB_OBJ20();
if(n=="OBJ21")SYS_CB_OBJ21();
if(n=="OBJ22")SYS_CB_OBJ22();
if(n=="OBJ23")SYS_CB_OBJ23();
if(n=="OBJ24")SYS_CB_OBJ24();
if(n=="OBJ25")SYS_CB_OBJ25();
}
javascript_obj0090_024.js pdf-javascript-stream PDF /JS object 90 at offset 0xF406 193 bytes
SHA-256: eaec0c046174819a7cd7725f077f44be3bdce719b2461e6c8e40b4c3c15a586b
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
SYS_EWB(event.value,"Strecke");if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0090_025.js pdf-javascript-stream PDF /JS object 90 at offset 0xF406 87 bytes
SHA-256: 67e881a9d34e06e65c31038f1e0e6644a3f876529051aeb246f60d758bc1fb76
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
SYS_EWB(event.value,"Strecke");if(false==event.rc
javascript_obj0101_029.js pdf-javascript-stream PDF /JS object 101 at offset 0xFF5C 271 bytes
SHA-256: 9b7492c273fc43e3844d0b6b7c6c631c485ca0c92ae7941958a1d32dbb6c378c
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   AFNumber_Format(2,2,0,0,'',false);
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0101_030.js pdf-javascript-stream PDF /JS object 101 at offset 0xFF5C 204 bytes
SHA-256: f8e422b4c2d1511eac19167be1bab2c1bdebc8f959058486dff878ad7cc95a0f
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
   AFNumber_Keystroke(2,2,0,0,'',false);
   var n=2;
   if( (0==n) && (","==event.change) )
   {       app.beep(0);
           event.rc=false;
   }       
}
javascript_obj0101_031.js pdf-javascript-stream PDF /JS object 101 at offset 0xFF5C 165 bytes
SHA-256: 8ae0e1d8cccba0af56742d343baa3534800b293045d23409c34fc48f38c2ae43
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   AFNumber_Format(2,2,0,0,'',false);
}if(false==event.rc
javascript_obj0171_038.js pdf-javascript-stream PDF /JS object 171 at offset 0x16F94 2780 bytes
SHA-256: 3748a2b9ced4b992edf063a471376a8686624d908f01a2f849d6bb512bfbad64
Preview script
First 1,000 lines of the extracted script
function getBgColor(fn){
var BG_DISABLED=["RGB",0.749,0.749,0.749];
var BG_270=["RGB",1.0,1.0,1.0];
  if(fn=="Beschaeftigungsstelle") return BG_270;
  if(fn=="Abrechnende_Dienststelle") return BG_270;
  if(fn=="Name__Vorname") return BG_270;
  if(fn=="Wohnungsanschrift") return BG_270;
  if(fn=="Kontonummer") return BG_270;
  if(fn=="Bankleitzahl") return BG_270;
  if(fn=="Kreditinstitut") return BG_270;
  if(fn=="Grund_der_RKR") return BG_270;
  if(fn=="Grund_der_RKR1") return BG_270;
  if(fn=="Bei_RRS") return BG_270;
  if(fn=="OBJ1") return BG_270;
  if(fn=="OBJ2") return BG_270;
  if(fn=="Beginn_der_Dienstreise") return BG_270;
  if(fn=="Beginn_des_Dienstgeschaefts") return BG_270;
  if(fn=="Ende_des_Dienstgeschaefts") return BG_270;
  if(fn=="Ende_der_Dienstreise") return BG_270;
  if(fn=="OBJ3") return BG_270;
  if(fn=="Dienststelle_Datum") return BG_270;
  if(fn=="Reiseziel_Reiseweg") return BG_270;
  if(fn=="OBJ4") return BG_270;
  if(fn=="OBJ5") return BG_270;
  if(fn=="OBJ6") return BG_270;
  if(fn=="OBJ7") return BG_270;
  if(fn=="OBJ8") return BG_270;
  if(fn=="Erlaeuterungen") return BG_270;
  if(fn=="OBJ9") return BG_270;
  if(fn=="OBJ10") return BG_270;
  if(fn=="OBJ11") return BG_270;
  if(fn=="Tage_Mahlzeiten_Naechte") return BG_270;
  if(fn=="OBJ12") return BG_270;
  if(fn=="OBJ14") return BG_270;
  if(fn=="OBJ15") return BG_270;
  if(fn=="OBJ16") return BG_270;
  if(fn=="Strecke") return BG_270;
  if(fn=="OBJ17") return BG_270;
  if(fn=="OBJ18") return BG_270;
  if(fn=="OBJ19") return BG_270;
  if(fn=="Zuwendungen_Dritter") return BG_270;
  if(fn=="OBJ20") return BG_270;
  if(fn=="Reisekostenabschlag") return BG_270;
  if(fn=="OBJ21") return BG_270;
  if(fn=="OBJ22") return BG_270;
  if(fn=="OBJ23") return BG_270;
  if(fn=="OBJ24") return BG_270;
  if(fn=="OBJ25") return BG_270;
  if(fn=="Tage") return BG_270;
  if(fn=="EUR") return BG_270;
  if(fn=="Tage1") return BG_270;
  if(fn=="EUR1") return BG_270;
  if(fn=="Tage2") return BG_270;
  if(fn=="EUR2") return BG_270;
  if(fn=="Uebernachtungsgeld") return BG_270;
  if(fn=="Erstattung_Uebernachtungskosten") return BG_270;
  if(fn=="Fahrkarte") return BG_270;
  if(fn=="Zuschlaege") return BG_270;
  if(fn=="Sonstige_Fahrauslagen") return BG_270;
  if(fn=="Tage3") return BG_270;
  if(fn=="EUR3") return BG_270;
  if(fn=="Wegstreckenentschaedigung") return BG_270;
  if(fn=="Tage4") return BG_270;
  if(fn=="EUR4") return BG_270;
  if(fn=="Wegstreckenentschaedigung1") return BG_270;
  if(fn=="Tage5") return BG_270;
  if(fn=="EUR5") return BG_270;
  if(fn=="Wegstreckenentschaedigung2") return BG_270;
  if(fn=="Erstattung_der_Nebenkosten") return BG_270;
  if(fn=="Feldaufwandverguetung") return BG_270;
  if(fn=="Unterschrift") return BG_270;
    return color.transparent;}
javascript_obj0172_039.js pdf-javascript-stream PDF /JS object 172 at offset 0x17B6E 166 bytes
SHA-256: 9f51a81ea495069ac3bd65daf89fd1c4a332f6ab52c21e14c04ec2c85ecccdee
Preview script
First 1,000 lines of the extracted script
function getBorderColor(fn){
   var f = this.getField(fn);
   if((null!=f)&&("checkbox"==f.type))
   { return ["RGB",0.0,0.0,0.0];
   }
   return color.transparent;
}
javascript_obj0173_040.js pdf-javascript-stream PDF /JS object 173 at offset 0x17C51 280 bytes
SHA-256: bb0cc0ea4c337306f6e2f48a1141a3f0f0b71c8fa4e6a492f8fae20a58ca3eb4
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CLR(name,bNeedsColouredMustFillBorder)
{
    if(bNeedsColouredMustFillBorder)
    {    getField(name).strokeColor=color.red;
        }
        else
    	{    getField(name).strokeColor=getBorderColor(name);
        }
    return bNeedsColouredMustFillBorder;
}
javascript_obj0174_041.js pdf-javascript-stream PDF /JS object 174 at offset 0x17DAA 468 bytes
SHA-256: 82c0fd6e6cc117687c47ced7f0ce920ecb308781c8402ac1927d871608b9fef1
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_STATE()
{
    if(false==SYS_IS_MUFI_CB(SYS_CB_HDL_STATE.arguments[0])) return false;
    var obj=getField(SYS_CB_HDL_STATE.arguments[0]);
    if("Yes"==obj.value) return false;
    if(true==obj.readonly) return false;
    if(display.hidden==obj.display) return false;
    for(var i=1;i<SYS_CB_HDL_STATE.arguments.length;i++)
    {   if("Yes"==getField(SYS_CB_HDL_STATE.arguments[i]).value)
    	{   return false;
        }
    }
    return true;
}
javascript_obj0175_042.js pdf-javascript-stream PDF /JS object 175 at offset 0x17FCD 168 bytes
SHA-256: f6c2357c12b7e2cbd2f963dd05935f9bd1d924cb5654b0cfca7b2eeaa3f05a1b
Preview script
First 1,000 lines of the extracted script
function SYS_IS_MUFI_CB(cbname)
{   var all_mufi_cb= new Array();
	for(var i=0;i<all_mufi_cb.length;i++)
	{	if(cbname==all_mufi_cb[i]) return true;
	}
	return false;
}
javascript_obj0176_043.js pdf-javascript-stream PDF /JS object 176 at offset 0x180B1 70 bytes
SHA-256: 68582c3b030f7ce77460540a7ea21e899d133ef6ae8330fbbb6a5db8d1040ccb
Preview script
First 1,000 lines of the extracted script
function SYS_FILL(f,c){
  if(""+f.fillColor!=""+c)  {f.fillColor=c;}}
javascript_obj0177_044.js pdf-javascript-stream PDF /JS object 177 at offset 0x1812A 251 bytes
SHA-256: 11a1bd3ed0d867a06a568a40ba9d93946c031e168697e359578f9ad5e75f7e59
Preview script
First 1,000 lines of the extracted script
function SYS_EWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0178_045.js pdf-javascript-stream PDF /JS object 178 at offset 0x18271 251 bytes
SHA-256: b489e14c022670e263ade06b76d1f9a44446979ddfa4df58bed63e1e68ca6dfa
Preview script
First 1,000 lines of the extracted script
function SYS_AWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
 else
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
}
javascript_obj0179_046.js pdf-javascript-stream PDF /JS object 179 at offset 0x183B8 220 bytes
SHA-256: f4379dc788b0345e77b7c62fb70b4743640256954408c64b71bb4e1d213b0ffe
Preview script
First 1,000 lines of the extracted script
function SYS_EWB(v1,f2){
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(""==v1)
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0180_047.js pdf-javascript-stream PDF /JS object 180 at offset 0x184DD 1263 bytes
SHA-256: 2856e6304c394af10c1bf9c2627fd4c31d4605a8e9c743b15c91d5a1c90a0abe
Preview script
First 1,000 lines of the extracted script
function SYS_PA2_SUBMIT()
{
        var pflichtfelder_befuellt = SYS_CHECK_MF_FIELDS();
        var n = this.numFields;
        var f;
        var fn;
        for(var i=0;i<n;i++)
        {
                fn = this.getNthFieldName(i);
                if( (""!=fn) && ("SYS_SEND_BUTTON"==fn.substring(0,15)) )
                {
                        f = this.getField(fn);
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=false;
                        	 }
                        	 else
                        	 { f.readonly=true;
                        	 }
                        }
                        f = this.getField("SYS_SEND_BTN_SHADOW"+fn.substring(15,fn.length));
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=true;
                        	   f.display=display.hidden;
                        	 }
                        	 else
                        	 { f.readonly=false;
                        	   f.display=display.visible;
                        	 }
                        }
                }
        }
}
javascript_obj0181_048.js pdf-javascript-stream PDF /JS object 181 at offset 0x18A3B 192 bytes
SHA-256: f4ee8d2d3bf82dba4486bce1ab3d25f348d052810784e42aa89c50053d74fbc1
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_OBJ1(changecolor)
{   var retval=SYS_CB_HDL_STATE("OBJ1","OBJ1","OBJ2","OBJ3");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("OBJ1",retval);
    }
    return retval;
}
javascript_obj0182_049.js pdf-javascript-stream PDF /JS object 182 at offset 0x18B37 192 bytes
SHA-256: 5ad9a9b4398c5da9986b615fcb24685fa2fa5719db0cc915bd99d523c6172c08
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_OBJ2(changecolor)
{   var retval=SYS_CB_HDL_STATE("OBJ2","OBJ1","OBJ2","OBJ3");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("OBJ2",retval);
    }
    return retval;
}
javascript_obj0183_050.js pdf-javascript-stream PDF /JS object 183 at offset 0x18C33 192 bytes
SHA-256: a10f6616bb73c9a47011a974108a3c972b3c25f30deb21198fdd0d81010d6c48
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_OBJ3(changecolor)
{   var retval=SYS_CB_HDL_STATE("OBJ3","OBJ1","OBJ2","OBJ3");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("OBJ3",retval);
    }
    return retval;
}
javascript_obj0184_051.js pdf-javascript-stream PDF /JS object 184 at offset 0x18D2F 206 bytes
SHA-256: 2a2b7328309864821ee36097d3376ce02c8b9f5184a826b0e249e895654dcc2f
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_OBJ4(changecolor)
{   var retval=SYS_CB_HDL_STATE("OBJ4","OBJ4","OBJ5","OBJ6","OBJ7","OBJ8");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("OBJ4",retval);
    }
    return retval;
}
javascript_obj0185_052.js pdf-javascript-stream PDF /JS object 185 at offset 0x18E39 206 bytes
SHA-256: b0c1a7f70ce2fdc9829708286f9dd26d1b1e6a00cd334e3bbdecd65fa34ca549
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_OBJ5(changecolor)
{   var retval=SYS_CB_HDL_STATE("OBJ5","OBJ4","OBJ5","OBJ6","OBJ7","OBJ8");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("OBJ5",retval);
    }
    return retval;
}
javascript_obj0186_053.js pdf-javascript-stream PDF /JS object 186 at offset 0x18F43 206 bytes
SHA-256: 06182ddd201579fef8ed392dd86af97f4ffccb74b5c529fa99f0a3238b2fe508
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_OBJ6(changecolor)
{   var retval=SYS_CB_HDL_STATE("OBJ6","OBJ4","OBJ5","OBJ6","OBJ7","OBJ8");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("OBJ6",retval);
    }
    return retval;
}
javascript_obj0187_054.js pdf-javascript-stream PDF /JS object 187 at offset 0x1904D 206 bytes
SHA-256: 823aeabec57637efed4af76d19d82fd280a5beb399563c619d3e74b1a8ed9011
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_OBJ7(changecolor)
{   var retval=SYS_CB_HDL_STATE("OBJ7","OBJ4","OBJ5","OBJ6","OBJ7","OBJ8");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("OBJ7",retval);
    }
    return retval;
}
javascript_obj0188_055.js pdf-javascript-stream PDF /JS object 188 at offset 0x19157 206 bytes
SHA-256: 7703a66ee81f95747fdc81c2c19baf4fef6a5dad8b2ddf4dbdb615d5cd4cee98
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_OBJ8(changecolor)
{   var retval=SYS_CB_HDL_STATE("OBJ8","OBJ4","OBJ5","OBJ6","OBJ7","OBJ8");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("OBJ8",retval);
    }
    return retval;
}

Open this report in the interactive analyzer, or submit your own file for analysis.