MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1566.001 Spearphishing Attachment
The PDF contains multiple embedded JavaScript streams, some of which are responsible for validating user input in form fields. One script prompts the user to download Adobe Reader, suggesting a lure to trick users into visiting a specific URL. The ML classifier also flagged this PDF as malicious.
Machine Learning
- Nyx PDF Classifier malicious score 0.6582
Heuristics 5
-
Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JSPDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
-
JavaScript action low 1 related finding PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
AcroForm button with action trigger low PDF_ACROFORM_BUTTONPDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.adobe.nl/products/acrobat/readstep.html Referenced by PDF JavaScript
- http://www.monotype.comhttp://www.monotype.com/html/type/license.htmlIn PDF document text
- http://www.monotype.comMonotypeIn PDF document text
- http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn PDF document text
- http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
- http://www.iec.chIn PDF document text
Extracted artifacts 32
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0040_003.js |
pdf-javascript-stream | PDF /JS object 40 at offset 0x3894 | 38 bytes |
SHA-256: dd4e86ff46931388298d522a0c25afc2a74df361f28fb6ad9f104ffc1f5056c1 |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Format(2, 2, 0, 0, "", true); |
|||
javascript_obj0041_004.js |
pdf-javascript-stream | PDF /JS object 41 at offset 0x38E8 | 41 bytes |
SHA-256: 6aeb2fc8f6b0dba7b9d76914b437aa0140bcd183b4c2b0d2b66173e7a39a1974 |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Keystroke(2, 2, 0, 0, "", true); |
|||
javascript_obj0050_006.js |
pdf-javascript-stream | PDF /JS object 50 at offset 0x3F52 | 185 bytes |
SHA-256: 39a6e192956526268f967ecd62963e349a4f9d8f93aae343ab46d49e74a1faac |
|||
Preview scriptFirst 1,000 lines of the extracted script
var cValid="0123456789, ";
for (var i = 0; i < event.change.length; i++) {
if (cValid.indexOf(event.change.charAt(i)) == -1) {
app.beep(0);
event.rc = false;
break;
}
}
|
|||
javascript_obj0099_007.js |
pdf-javascript-stream | PDF /JS object 99 at offset 0x73E6 | 183 bytes |
SHA-256: 09c13223a9edb138181d4aa87044b4b522b7d05aa50ae98d96796be4af6a870d |
|||
Preview scriptFirst 1,000 lines of the extracted script
var cValid="0123456789";
for (var i = 0; i < event.change.length; i++) {
if (cValid.indexOf(event.change.charAt(i)) == -1) {
app.beep(0);
event.rc = false;
break;
}
}
|
|||
javascript_obj0103_008.js |
pdf-javascript-stream | PDF /JS object 103 at offset 0x78C6 | 128 bytes |
SHA-256: 2c02b0f39c946a70222fce74c6b9a29312aca8d12ffeef5608de321cfc7686e6 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var result = validateNN(event.target);
if(result!="")
{
app.alert(result);
event.target.setFocus();
}
|
|||
javascript_obj0104_009.js |
pdf-javascript-stream | PDF /JS object 104 at offset 0x7993 | 195 bytes |
SHA-256: 30718e8554e684e75bade9d646412a00f869244611e5589a80012ab114e3fdea |
|||
Preview scriptFirst 1,000 lines of the extracted script
var cValid = "0123456789.-";
for (var i = 0; i < event.change.length; i++) {
if (cValid.indexOf(event.change.charAt(i)) == -1) {
app.beep(0);
event.rc = false;
break;
}
}
|
|||
javascript_obj0106_010.js |
pdf-javascript-stream | PDF /JS object 106 at offset 0x7C26 | 202 bytes |
SHA-256: 715a709fdf52da47ea73afa3297aede4df5ac6753f1483d1e4e5a211e67bd108 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var theValue=event.value;
var theField=this.getField(event.targetName);
if (theValue!="" && theValue!="0") {
FormatTel(theValue,theField);
}
else {
theField.fillColor=["RGB", .80,.85,1];
}
|
|||
javascript_obj0109_011.js |
pdf-javascript-stream | PDF /JS object 109 at offset 0x7FC8 | 207 bytes |
SHA-256: d669075ac4e19411c5b201874c3e34c0a2f2427450521a45a8d7177e4d976033 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var mess = validate();
if (mess!= "")
{
app.alert(mess)
} else{
app.alert("Le formulaire est rempli correctement. Vous pouvez maintenant proc�der � l'impression et signer le document.",3,0)
}
|
|||
javascript_obj0112_012.js |
pdf-javascript-stream | PDF /JS object 112 at offset 0x8349 | 156 bytes |
SHA-256: c46157ef2eb9a3b0e6938e8b6b9047b28037a9f11ae4422851d9541ad6799638 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var result = validate();
if (result=="")
this.print();
else
app.alert("Document invalide"+ "\r"+truncErrorMessage(result,10),0,0);
|
|||
javascript_obj0124_013.js |
pdf-javascript-stream | PDF /JS object 124 at offset 0x8A78 | 256 bytes |
SHA-256: 0db0e145a04be4c67455450a5495c6a54f5f634b29f5dff555449c32d29ee820 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function convertToNumForm( myNumber){
if (app.formsVersion < 7) {
var result = String(myNumber).replace(/[.]/g,'');
var result = result.replace(/[,]/g,'.');
} else {
var result = Number(myNumber);
}
return Number(result);
}
|
|||
javascript_obj0125_014.js |
pdf-javascript-stream | PDF /JS object 125 at offset 0x8BCC | 118 bytes |
SHA-256: 3d544555bcbdd7dc959c08f5424fdb6dd49d0b451b2a1015152c0c6bc81da1c2 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function euroRound(param)
{
var d
{d = (convertToNumForm(param));
d=Math.round(d*100)/100;
return d;
}
}
|
|||
javascript_obj0126_015.js |
pdf-javascript-stream | PDF /JS object 126 at offset 0x8C8B | 47 bytes |
SHA-256: 7eca804ba24c4b79f352f0ae5fb58e3acaf786d7ae6eb69eba05977f7d8638a7 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function isValidAmount()
{
// do nothing
}
|
|||
javascript_obj0129_016.js |
pdf-javascript-stream | PDF /JS object 129 at offset 0x8D55 | 114 bytes |
SHA-256: 718a0ba324a0da3fa3bc5281ae859e091e89c61d813e1a85f9222c2b354dac4c |
|||
Preview scriptFirst 1,000 lines of the extracted script
function setOptional()
{
this.getField.fillColor = ("RGB", .80, .85, 1);
this.getField.required = false;
}
|
|||
javascript_obj0130_017.js |
pdf-javascript-stream | PDF /JS object 130 at offset 0x8E04 | 125 bytes |
SHA-256: fe1d2e3911f5b8cc4b8d81ac3c9a54a69b3b52a739505ff737d8e3f7b72706d7 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function strtrim(myParam) {
var aString = new String(myParam);
return aString.replace(/^\s+/,'').replace(/\s+$/,'');
}
|
|||
javascript_obj0134_018.js |
pdf-javascript-stream | PDF /JS object 134 at offset 0x8F58 | 784 bytes |
SHA-256: 06f3236952bcef9fab7bfc14e917047b8f231dbac1fa958cdea40a33ffb111ac |
|||
Preview scriptFirst 1,000 lines of the extracted script
/*Ubiquity*/
var needsUpdate = 0;
if (app.viewerType == "Exchange" && app.viewerVariation=="Fill-In")
needsUpdate = 1;
else if (app.viewerType == "Reader")
{
if (app.viewerVersion >= 6.0)
needsUpdate = 0;
else
needsUpdate = 1;
}
if (needsUpdate)
{
var ans = app.alert("Als u alle functies van document wilt gebruiken,\nmoet u Adobe Reader 6.0 of hoger,\nof Acrobat 6.0 of hoger gebruiken.\n\nOmdat u een oudere versie of\nAcrobat Approval gebruikt, beschikt u niet over bepaalde functies.\n\nKlik op OK om de nieuwste versie van\nAdobe Reader te downloaden. Met dit gratis programma beschikt u wel\nover de extra functies van dit document.\n", 1, 1);
if (ans == 1)
this.getURL("http://www.adobe.nl/products/acrobat/readstep.html", false);
}
|
|||
javascript_obj0154_023.js |
pdf-javascript-stream | PDF /JS object 154 at offset 0xB949 | 652 bytes |
SHA-256: 367666dd9d22e9b521d5bbcd76a57f759819effd9514b5b8c053b8ffcacbfe22 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var po1 = this.getField ("z11.0")
var po2 = this.getField ("z11.1")
var po3 = this.getField ("z11.3")
var po4 = this.getField ("z11.4")
var po5 = this.getField ("z11.5")
var po6 = this.getField ("z11.6")
var po7 = this.getField ("z11.7")
var po8 = this.getField ("z11.8")
var po9 = this.getField ("z11.9")
var po10 = this.getField ("z11.10")
var po11 = this.getField ("z11.11")
event.value = (euroRound(po1.value)+euroRound(po2.value)+euroRound(po3.value)+euroRound(po4.value)+euroRound(po5.value)+euroRound(po6.value)+euroRound(po7.value)+euroRound(po8.value)+euroRound(po9.value)+euroRound(po10.value)+euroRound(po11.value));
|
|||
javascript_obj0155_024.js |
pdf-javascript-stream | PDF /JS object 155 at offset 0xBA3D | 646 bytes |
SHA-256: 9e0c27ad8dfdb947d2558e870cbb9f29f1d0121bd1a5edec90ddc25270a3c8f3 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var po1 = this.getField ("z12.0")
var po2 = this.getField ("z12.1")
var po3 = this.getField ("z12.3")
var po4 = this.getField ("z12.4")
var po5 = this.getField ("z12.5")
var po6 = this.getField ("z12.6")
var po7 = this.getField ("z12.7")
var po8 = this.getField ("z12.8")
var po9 = this.getField ("z12.9")
var po10 = this.getField ("z12.10")
var po11 = this.getField ("z12.11")
event.value = (euroRound(po1.value)+euroRound(po2.value)+euroRound(po3.value)+euroRound(po4.value)+euroRound(po5.value)+euroRound(po6.value)+euroRound(po7.value)+euroRound(po8.value)+euroRound(po9.value)+euroRound(po10.value)+euroRound(po11.value));
|
|||
javascript_obj0308_025.js |
pdf-javascript-stream | PDF /JS object 308 at offset 0x3BE13 | 567 bytes |
SHA-256: da50785931a1803e99e43198caebde2453adcab686379b085f2cf13024ccbe07 |
|||
Preview scriptFirst 1,000 lines of the extracted script
this.resetForm();
// Remettre certain champs en ordre apr�s remise � z�ro des donn�es
for(l=0;l<=10;l++)
{
temp1=this.getField("z10."+l);
temp1.required=false;
temp1.fillColor=["RGB",.80,.85,1];
}
for(m=0;m<=10;m++)
{
temp2=this.getField("z11."+m);
temp2.required=false;
temp2.fillColor=["RGB",.80,.85,1];
}
for(n=0;n<=10;n++)
{
temp3=this.getField("z12."+n);
temp3.required=false;
temp3.fillColor=["RGB",.80,.85,1];
}
|
|||
javascript_obj0313_026.js |
pdf-javascript-stream | PDF /JS object 313 at offset 0x3EAE0 | 321 bytes |
SHA-256: 2d1cbb9e0c035166f45104938f2c73971a2517dbb18bb724988988db4485bdef |
|||
Preview scriptFirst 1,000 lines of the extracted script
app.alert( " AVERTISSEMENT\n\nPour utiliser correctement ce formulaire, vous devez utiliser le logiciel Adobe Acrobat ou Adobe Reader � partir de la version 7.0. Adobe Reader est gratuit et permet de sauver les donn�es de ce formulaire sur votre poste de travail.",2,0); |
|||
javascript_obj0314_027.js |
pdf-javascript-stream | PDF /JS object 314 at offset 0x3EBFA | 699 bytes |
SHA-256: d0386924b79c7b059cdc01ed097b1666c6a45cf8627e9b32852d4c44651606ae |
|||
Preview scriptFirst 1,000 lines of the extracted script
function FormatTel(theValue,theField)
{
theValue=theValue.replace(/\./g,"").replace(/\(/,"").replace(/\)/,"").replace(/ /g,"");
var isCorrect=false;
switch (theValue) {
case String(theValue.match(/^0[2349]\d{7}$/)):
theField.value=util.printx("(99) 999.99.99",theValue);
isCorrect=true;
break;
case String(theValue.match(/^0[15678]\d\d{6}$/)):
theField.value=util.printx("(999) 99.99.99",theValue);
isCorrect=true;
break;
case String(theValue.match(/^04[7-9]\d{7}$/)):
theField.value=util.printx("(9999) 99.99.99",theValue);
isCorrect=true;
break;
}
if (!isCorrect) {
theField.setFocus();
theField.fillColor = color.red;
}
else {
theField.fillColor = ["RGB", .80,.85,1];
}}
|
|||
javascript_obj0315_028.js |
pdf-javascript-stream | PDF /JS object 315 at offset 0x3ED6D | 1741 bytes |
SHA-256: f1c35e4f020e537c107f3dc5180a1f4141edfe3cb46e0b3b372548fc004f84ef |
|||
Preview scriptFirst 1,000 lines of the extracted script
function getTranslatedMessageFiche(){
var result = "";
var typeErreur = arguments[0];
switch(typeErreur) {
case "InvalidAmountLength" : {
result = "Le montant ne peut comporter plus de 9 chiffres pour la partie enti�re et 2 pour la partie d�cimale";
break;
}
case "GlobalInvalidAmount" : {
result = "Le montant du champ $% ne peut comporter plus de 9 chiffres pour la partie enti�re et 2 pour la partie d�cimale";
break;
}
case "FieldMandatory" : {
result = "Le champ $% est obligatoire";
break;
}
case "CheckMaxLength" : {
result = "Ce champ ne peut contenir plus de $% caract�res";
break;
}
case "NotValidValue" : {
result = "Le champ $% ne peut contenir que $% comme valeur";
break;
}
case "WrongNN" : {
result = "Le num�ro national sur la premi�re page est incorrect\nIl ne peut contenir:\n-qu'un num�ro d'entreprise (ex:(9)999.999.999),\n-qu'un num�ro national de personne physique (ex:99.99.99.999-99).";
break;
}
case "InvalidYear" : {
result = "$% ne peut �tre post�rieure au $%";
break;
}
case "ExcessiveYear" : {
result = "L'ann�e ne peut �tre sup�rieure � $%";
break;
}
case "TooLowYear" : {
result = "L'ann�e du champ $% doit �tre post�rieure � $%";
break;
}
case "4DigitYear" : {
result = "$% doit comporter 4 chiffres";
break;
}
}
for (var i = 1; i< arguments.length;i++){
result = result.replace(/\$%/, "<"+strtrim(arguments[i])+">");
}
return result;
}
|
|||
javascript_obj0316_029.js |
pdf-javascript-stream | PDF /JS object 316 at offset 0x3F012 | 587 bytes |
SHA-256: 0540a36c216523c332549a87ee463f8684e390135864123faeffda0aa9f8a063 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function IsMandatory()
{var temp = event.target.name.split(".");
var z = temp[1];
var a = getField("z10."+z);
var b = getField("z11."+z);
var c = getField("z12."+z);
if (event.value != "") {a.required = true; a.fillColor = ["RGB", 1,.7,.7];
b.required = true; b.fillColor = ["RGB", 1,.7,.7];
c.required = true; c.fillColor = ["RGB", 1,.7,.7];
}
if ((a.value == "")&&(b.value == "")&&(c.value == "")) {a.required = false; a.fillColor = ["RGB", .80,.85,1];
b.required = false; b.fillColor = ["RGB", .80,.85,1];
c.required = false; c.fillColor = ["RGB", .80,.85,1];
}
}
|
|||
javascript_obj0317_030.js |
pdf-javascript-stream | PDF /JS object 317 at offset 0x3F151 | 614 bytes |
SHA-256: 3d7d820c08a52a3fef26b27045d26e9b6ee40654b0602b00a00f2836303e4e81 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function printDocument(){
this.oldValue = new Array(this.numFields)
for (var i = 0; i < this.numFields; i++){
var fieldName =this.getNthFieldName(i);
try{
var aField = this.getField(fieldName);
this.oldValue[i] = aField.fillColor;
if ((aField.type=="checkbox") || (aField.type=="radiobutton")) {
aField.fillColor = color.white;
aField.strokeColor = color.black;
}else {
if (strtrim(aField.value)!=""){
aField.fillColor = color.white;
}else{
aField.display= display.noPrint;
}
}
}catch( e){
app.alert(fieldName+" : "+e,0,0);
}
}
}
|
|||
javascript_obj0318_031.js |
pdf-javascript-stream | PDF /JS object 318 at offset 0x3F2D6 | 429 bytes |
SHA-256: f77d6f3a9b04e740ae9c3afae46916879406a13858e880299bf970c81deeed0c |
|||
Preview scriptFirst 1,000 lines of the extracted script
function restoreDocument(){
for (var i = 0; i < this.numFields; i++){
var fieldName =this.getNthFieldName(i);
try{
var aField = this.getField(fieldName);
aField.fillColor=this.oldValue[i];
aField.display=display.visible;
if ((aField.type=="checkbox") || (aField.type=="radiobutton")) {
aField.strokeColor = color.transparent;
}
}catch( e){
app.alert(fieldName+" : "+e,0,0);
}
}
}
|
|||
javascript_obj0319_032.js |
pdf-javascript-stream | PDF /JS object 319 at offset 0x3F427 | 324 bytes |
SHA-256: 1653bd3bdf486b9f2c24ce3020eba5a0d3996f31726014b30e43a80bff9c9664 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function truncErrorMessage(message, numberOfErrors){
var result = "";
var strMessage = new String(message);
var position = strMessage.indexOf("("+numberOfErrors+")");
if (position==-1) {
result =strMessage;
}else{
result = strMessage.substring(0,position);
}
return result
}
|
|||
javascript_obj0320_033.js |
pdf-javascript-stream | PDF /JS object 320 at offset 0x3F51E | 2004 bytes |
SHA-256: a6e0897ba8023b3b12038aa14d874adc496a0a02f2928a149c02c5990d8ab7f5 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function validate()
{
var mess = ""
var err = 0
var ch1= this.getField ("z1")
var ch2= this.getField ("z2")
//var ch3= this.getField ("z3")
var ch5= this.getField ("z5")
var ch6= this.getField ("z7.1")
var ch8= this.getField ("z8.1")
var ch9= this.getField ("z8.3")
var ch10= this.getField ("z9.1")
var ch11= this.getField ("z9.3")
if (ch1.value == "" )
{mess = mess + "Veuillez compl�ter le num�ro du relev� recapitulatif\n"
err=1};
if (ch2.value == "" )
{mess = mess + "Veuillez compl�ter le num�ro du relev�\n"
err=1};
//if (ch3.value == "" )
//{mess = mess + "Veuillez compl�ter l'ann�e\n"
//err=1};
if (ch5.value == "" )
{mess = mess + "Veuillez ins�rer le num�ro de r�f�rence\n"
err=1};
if (ch6.value == "" )
{mess = mess + "Veuillez ins�rer votre nom, pr�noms + nom de l'�poux ou la raison sociale ou d�nomination exacte\n"
err=1};
if (ch8.value == "" )
{mess = mess + "Veuillez ins�rer la rue et n� de votre domicile\n"
err=1};
if (ch9.value == "" )
{mess = mess + "Veuillez ins�rer votre code postal et commune de votre domicile\n"
err=1};
if (ch10.value == "" && ch8.value == "" )
{mess = mess + "Veuillez ins�rer la rue et n� du si�ge administratif ou d'exploitation \n"
err=1};
if (ch11.value == "" && ch9.value == "" )
{mess = mess + "Veuillez ins�rer votre code postal et commune du si�ge administratif ou d'exploitation\n"
err=1};
//validate tableau recapitulatif
var appmess = false;
for(i=0;i<=11;i++)
{
var tmp = this.getField("z10."+i);
if (tmp.required == true && tmp.value=="" && tmp.value!==0)
appmess = true;
tmp = this.getField("z11."+i);
if (tmp.required == true && tmp.value=="" && tmp.value!==0)
appmess = true;
tmp = this.getField("z12."+i);
if (tmp.required == true && tmp.value=="" && tmp.value!==0)
appmess = true;
if (appmess == true)
{
mess = mess + "Veuillez compl�ter tous les zones obligatoire (en rose) sur page 2\n"
break;
}
}
return mess;
}
|
|||
javascript_obj0321_034.js |
pdf-javascript-stream | PDF /JS object 321 at offset 0x3F7AF | 1205 bytes |
SHA-256: 56f6fe517bf900ef142d4796428b497321b062b17b34edc2b81792c34dd76c36 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function validateNN(myField)
{
var result="";
var myValue = strtrim(myField.valueAsString);
if(myValue=="")
{
//DoNothing
}
else if((!myValue.match(/^[0-9]{2}[.]?[0-9]{2}[.]?[0-9]{2}[.]?[0-9]{3}[-]?[0-9]{2}$/))&&(!myValue.match(/^[0-9]?[0-9]{3}[.]?[0-9]{3}[.]?[0-9]{3}$/)))
{
result = getTranslatedMessageFiche("WrongNN");
}
else if((myValue.match(/^[0-9]{2}[.]?[0-9]{2}[.]?[0-9]{2}[.]?[0-9]{3}[-]?[0-9]{2}$/))||(myValue.match(/^[0-9]?[0-9]{3}[.]?[0-9]{3}[.]?[0-9]{3}$/)))
{
//DoNothing;
myValue = myValue.replace(/\./g,'');
myValue = myValue.replace(/-/g,'');
if(myValue.length==9)
{
myField.value="0"+myValue.substring(0,3)+"."+myValue.substring(3,6)+"."+myValue.substring(6,9);
}
else if(myValue.length==10)
{
myField.value=myValue.substring(0,4)+"."+myValue.substring(4,7)+"."+myValue.substring(7,10);
}
else if(myValue.length==11)
{
myField.value=myValue.substring(0,2)+"."+myValue.substring(2,4)+"."+myValue.substring(4,6)+"."+myValue.substring(6,9)+"-"+myValue.substring(9,11);
}
}
return result;
}
|
|||
javascript_obj0326_035.js |
pdf-javascript-stream | PDF /JS object 326 at offset 0x4096C | 337 bytes |
SHA-256: 0359e434b773d54279b387258e9ec1c99e680d4936571c26b802761518398e98 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var cValid="BPbp";
for (var i = 0; i < event.change.length; i++) {
if (cValid.indexOf(event.change.charAt(i)) == -1) {
app.beep (0);
app.alert("La zone ne peut contenir que les lettres 'B' (formulaires transmis par Belcotax) ou 'P' (formulaires transmis au format papier)");
event.rc = false;
break;
}
}
|
|||
stream_023_off0000bb7b.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xBB7B | 261650 bytes |
SHA-256: 3fcbc78accea7c4b324d9202e62a8927d0f81b8bef01372ecb05e010b40a7eb1 |
|||
stream_098_off00042168.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x42168 | 308015 bytes |
SHA-256: 4735e29f6b4dfaae31ceba3a66c7548a579b3b0ad8f9ec68bc6e90b0597d7de3 |
|||
icc_00_off0003f9c4.icc |
pdf-icc-profile | PDF ICC profile at offset 0x3F9C4 | 3144 bytes |
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e |
|||
javascript_obj0292_000.js |
pdf-javascript-stream | PDF /JS object 292 at offset 0x13FF | 256 bytes |
SHA-256: ca6db76aac3f7771357dea7aaaa1b18742724c22fb8ad7134abe3525d12fe226 |
|||
Preview scriptFirst 1,000 lines of the extracted script
N��%�t� n>� Yd+� �C۹y��/ �c�c d����S#I� � *���b^!tX�K�x*Ǹ���%� �v~� 3Y�:�Ka ��Y� ��+�K���]�� �N�� ��DV��3�d ��E6+����1f��0 �>�8��.�� dΡ�lee� �9[���z�)��炜�z��ӥ��Vz� �(�d !,)���d�B~V��V-� �p�ch',�DxF�]: j V�Q��R��7 � p8 O��UաI�U��)� l�1C & |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.