Malicious PDF — malware analysis report

function AddComment()
{
	var addCommentTextField = this.getField("AddCommentTextField");
	addCommentTextField.setFocus();
	player.pause();

	if (!editCommentFlag && !addCommentFlag)
	{
		DoComment();
	}
}

function CleanUp()
{
	this.getField("CommentList").clearItems();
}

function FlashRunningTimecode(time)
{
	// console.println("FlashRunningTimeCode: " + GetTimeCodeString(time));
    var runningTimecode = this.getField("RunningTimecode");
    runningTimecode.value = GetTimeCodeString(time);
}

function GetCommentHeaderRegex()
{
	var regex = /(\[(\w)*?\])?(.*?)(Comment at)?(.*?)(\d)?(\d\d[;:]\d\d[;:]\d\d[;:]\d\d)(.*?)(-)(\s)*/mg;
	return regex;
}

function GotoTimeCode(time)
{
    player.seek({time: time});   
	player.play();
	player.pause();
	player.seek({time: time});   
}

function PopulateMainCommentField(value)
{
    var mainCommentField = this.getField("MainCommentField");
    mainCommentField.value = value;
}

function SetFocusToCommentField()
{
	console.println("set focus to text field");
	this.getField("AddCommentTextField").setFocus();
}

function TerminateAutomaticCommentDisplay(timeout)
{
    app.clearInterval(timeout);
}

function startPlayer()
{
	player = app.media.openPlayer(args);
}

SaveComment();
app.execMenuItem("Save");

console.println("AddCommentTextField lost focus");
finishedCommentFlag = 1;

commentDirty = 1;
finishedCommentFlag = 0;

if ( intiatedAutomaticCommentDisplayFlag == 1)
{
	TerminateAutomaticCommentDisplay(timeout);
	intiatedAutomaticCommentDisplayFlag = 0;
	console.println("\n terminated recursive automatic comment display");   
}

/*Ubiquity*/
var needsUpdate = 0;
if (app.viewerType == "Exchange" && app.viewerVariation=="Fill-In")
    needsUpdate = 1;
else if (app.viewerType == "Reader")
{
    if (app.viewerVersion >= 6.0)
        needsUpdate = 0;
    else
        needsUpdate = 1;
}
if (needsUpdate)
{
    var ans = app.alert("To use all the features of this document,\nyou must use Adobe Reader 6.0 or later\nor Acrobat 6.0 or later.\n\nBecause you have an older version, or\nAcrobat Approval, some features will not work.\n\nClick OK to download the latest version of\nthe free Adobe Reader, which will enable\nthe additional features of this document.\n", 1, 1);
    if (ans == 1)
        this.getURL("http://www.adobe.com/products/acrobat/readstep.html", false);
}

function SaveComment()
{
	try
	{
		if (addCommentFlag == 1)
		{
				// Set the names of comments.
			var timeCodeTextFieldName = "timeCodeTextField" + numComments;
			var textAnnotFieldName = "textAnnotField" + numComments;
				
				// Get the reviewer's name.
			var enclosedReviewerName = GetEnclosedReviewerName();

				// Get handles to various fields.
			var addCommentTextField = this.getField("AddCommentTextField");
			if (addCommentTextField.value != "")
			{
				var reviewerNameTextField = this.getField("ReviewerNameTextField");
				var list = this.getField("CommentList");

					// Add two annots, time code ones are not visible to the user.
				timeCodeTextFieldArray[numComments] = this.addAnnot({
						page: 0,
						type: "Text",
						point: [400,720],
						name: timeCodeTextFieldName,
						author: timeCodeTextFieldName,
						contents: "",
						readOnly: true,
						hidden: true,
						noView: false
				});
				textAnnotField[numComments] = this.addAnnot({
						page: 0,
						type: "Text",
						point: [720,400],
						name: textAnnotFieldName,
						author: reviewerNameTextField.valueAsString,
						contents: "",
						readOnly: true,
						noView: true
				});
				
					// Set the values
				textAnnotField[numComments].contents = AppendStartTagToComment(addCommentTextField.valueAsString, addCommentTextFieldTimeCode);
				timeCodeArray[numComments] = Math.floor((addCommentTextFieldTimeCode + 0.0001) * frameRate);
				timeCodeTextFieldArray[numComments].contents = Math.floor((addCommentTextFieldTimeCode + 0.0001) * frameRate);
				
					//insert comment into combobox
				var insertPositionInCommentList = FindLocationInCommentList( Math.floor((addCommentTextFieldTimeCode + 0.0001) * frameRate));
				var firstFew = GetFirstFewCharsFromComment(textAnnotField[numComments].contents);
				addCommentFlag = 0;		// important to put it here to take care of reentrancy
				list.insertItemAt(GetTimeCodeString(addCommentTextFieldTimeCode) + firstFew, Math.floor((addCommentTextFieldTimeCode + 0.0001) * frameRate), insertPositionInCommentList);

				numComments++;
				numCommentsField.value = numComments;
				
				addCommentTextField.readonly = true;
				isDirtyFlag = 1;
			}
			// AddCommentFlag is always unset after saveComment
			console.println("addcommentflag set to 0 in save comment");
			addCommentFlag = 0;
			commentDirty = 0;
		}
		else
		if(editCommentFlag ==1)
		{
			var addCommentTextField = this.getField("AddCommentTextField");
			var textFieldIndex = FindLocationInTimeCodeArray(Math.floor((addCommentTextFieldTimeCode + 0.0001) * frameRate));
			
			var header = textAnnotField[textFieldIndex].contents.match(GetCommentHeaderRegex())[0];

			textAnnotField[textFieldIndex].contents = header + addCommentTextField.valueAsString;

			editCommentFlag = 0;	//important to put it here to take care of reentrancy
			addCommentTextField.readonly = true;

			var list = this.getField("CommentList");
			var positionNum = FindLocationInCommentList(Math.floor((addCommentTextFieldTimeCode + 0.0001) * frameRate));
			list.deleteItemAt(positionNum);
			
			var firstFew = GetFirstFewCharsFromComment(textAnnotField[textFieldIndex].contents);
			list.insertItemAt(GetTimeCodeString(addCommentTextFieldTimeCode) + firstFew,Math.floor((addCommentTextFieldTimeCode + 0.0001) * frameRate), positionNum);
			isDirtyFlag = 1;
			commentDirty = 0;			
		}
	}
	catch(e)
	{
		console.println(e.extMessage);
	}
}

function PutCommentToStagingArea(comment)
{
    var addCommentTextField = this.getField("AddCommentTextField");
    var stagingAreaCommentHeaderField = this.getField("StagingAreaCommentHeaderField");

    if( comment != "")
    {
        var regex = GetCommentHeaderRegex();
        var matchedText = regex.exec(comment);
        //console.println(matchedText[0]);
        var truncatedComment = comment.replace( regex , '');
    
        addCommentTextField.value = truncatedComment;
        addCommentTextField.readOnly = true;
        
        stagingAreaCommentHeaderField.value = matchedText[0];
    }
    else
    {
         addCommentTextField.value = "";
         stagingAreaCommentHeaderField.value = "";
    }
}

function OnSelChangeCombo()
{	
	console.println("OnSelChangeCombo");
	if (!event.willCommit && event.changeEx != "")
	{
		var frameNumber = event.changeEx;
		console.println("OnSelChangeCombo and !willCommit");
		
		SaveComment();
		console.println("OnSelChangeCombo and !willCommit and saved comment");
		editCommentFlag = 0;
		addCommentFlag = 0;
		
		var positionNum = FindLocationInTimeCodeArray(frameNumber);
		// console.println(positionNum);
		console.println(frameNumber);
		PutCommentToStagingArea(textAnnotField[positionNum].contents);		
		addCommentTextFieldTimeCode = frameNumber / frameRate;
		var timecode = parseFloat(frameNumber / frameRate);
		console.println("timecode" + timecode);
		GotoTimeCode(timecode + 0.01);
		// EditComment();
	}
}

/*******************************************************************/
/*                                                                 */
/*                      ADOBE CONFIDENTIAL                         */
/*                   _ _ _ _ _ _ _ _ _ _ _ _ _                     */
/*                                                                 */
/* Copyright 2004 Adobe Systems Incorporated                       */
/* All Rights Reserved.                                            */
/*                                                                 */
/* NOTICE:  All information contained herein is, and remains the   */
/* property of Adobe Systems Incorporated and its suppliers, if    */
/* any.  The intellectual and technical concepts contained         */
/* herein are proprietary to Adobe Systems Incorporated and its    */
/* suppliers and may be covered by U.S. and Foreign Patents,       */
/* patents in process, and are protected by trade secret or        */
/* copyright law.  Dissemination of this information or            */
/* reproduction of this material is strictly forbidden unless      */
/* prior written permission is obtained from Adobe Systems         */
/* Incorporated.                                                   */
/*                                                                 */
/*******************************************************************/

/*
**  Adobe patent application tracking # B032, 
**  entitled "Method For Annotating Time Line Based Content In Pdf", 
**  inventors: Grant, Nydam, Gupta, Gupta
*/

var location = 700;
var textField = new Array();
var textAnnotField = new Array();
var numCommentsField = this.getField("NumComments");
var numComments = numCommentsField.value;
var pageN = 1;
var timeout = 0;
var intiatedAutomaticCommentDisplayFlag = 0;

var gotoButtonArray = new Array();
var timeCodeArray = new Array();
var timeCodeTextFieldArray = new Array();

var mainCommentFieldTimeCode = 0.0;

var addCommentTextFieldTimeCode = 0.0;

var addCommentFlag = 0;
var editCommentFlag = 0;
var isDirtyFlag = 0;
var duration = 141.0;

var numCharsInCommentList = 28;

// app.execMenuItem("Annots:CommentsSummaryPane");
// app.execMenuItem("FullScreen");
app.execMenuItem("FitPage");
/*var timeout = InitiateAutomaticCommentDisplay();*/
var playButtonIconIsSetFlag = 1;

var selChangeFromPrevNextCommentButtonsFlag = 0;

// What follows might seems weird but we need to 
// do this becasue Acrobat for some unknown reason 
// only exports comments put through acrobat
// since the following comments are put by Premeire 
// their values were not getting exporter
// [TODO] Find a solution from Acrobat team for this
//  or if it's a bug get it fixed
var returnEMailAddressAnnot = this.getAnnot(0, "returnEmailAddress");
returnEMailAddressAnnot.contents = returnEMailAddressAnnot.contents;

var pdfInstructionsAnnot = this.getAnnot(0, "pdfInstructions");
pdfInstructionsAnnot.contents = pdfInstructionsAnnot.contents;

var seqIDAnnot = this.getAnnot(0, "seqID");
seqIDAnnot.contents = seqIDAnnot.contents;

var startTimeAnnot = this.getAnnot(0, "startTime");
startTimeAnnot.contents = startTimeAnnot.contents;

var frameRateAnnot = this.getAnnot(0, "frameRateField");
frameRateAnnot.contents = frameRateAnnot.contents;
var frameRateString = frameRateAnnot.contents;
var frameRate = new String();
if (frameRateString == "NTSC")
{
	frameRate = "29.97";
}
else
{
	frameRate = "25.00";
}

var timeDisplayAnnot = this.getAnnot(0, "timeDisplay");
timeDisplayAnnot.contents = timeDisplayAnnot.contents;
var timeDisplay = timeDisplayAnnot.contents;

CleanUp();
var tempName= "textAnnotField";
for ( var i = 0; i < numComments; i++)
{
    textAnnotField[i] = this.getAnnot( 0 , tempName + i);
    timeCodeTextFieldArray[i] = this.getAnnot(0,"timeCodeTextField" + i); 
	
	if (textAnnotField[i] != null && timeCodeTextFieldArray[i] != null)
	{
		var insertPositionInCommentList = FindLocationInCommentList( timeCodeTextFieldArray[i].con
... (truncated)

function GetTimeCodeString( time)
{
    var timeCodeString =  new String();
	var timeDisplayFormat = new String();
	timeDisplayFormat = timeDisplay;

	time += 0.01 * ( 1.0 / frameRate);
	
	if (frameRate == 29.97 && timeDisplayFormat == "DropFrame")
	{
		// [NOTE] pankaj 
		// Be careful here, the logic is complex 
		// partly due to optimizations
		var frames = Math.floor(time * 29.97);
		var tenMinutes = Math.floor(frames / 17982); // 10  * 30 * 60 - 18
		var hours = Math.floor(tenMinutes / 6);
		var afterTenMinFrames = frames - tenMinutes * 17982;
		var lastMinutes = 0;
		if (afterTenMinFrames >= 1800)
		{
			lastMinutes = Math.floor((afterTenMinFrames - 1800) / 1798 ) + 1; // 1798 = 10 * 60 * 30 - 2
		}
		
		var minutes = (tenMinutes - (hours*6)) * 10 + lastMinutes;
		var afterMinFrames = (afterTenMinFrames - lastMinutes*1798);
		
		var seconds = Math.floor(afterMinFrames / 30);
		var lastFrames = afterMinFrames - seconds * 30;

		timeCodeString = util.printf(" %02d;%02d;%02d;%02d ", hours, minutes, seconds, lastFrames);
	}
	else
	{
		var hours = Math.floor( time / 3600);
		var minutes = Math.floor( ( time - (hours*3600)) /60);
		var seconds = Math.floor( time % 60);
		/*var hundredthSecs = Math.floor( (time - Math.floor(time)) * 100); */
		var frames = Math.floor((time - Math.floor(time)) * frameRate);
		timeCodeString = util.printf(" %02d:%02d:%02d:%02d ", hours, minutes, seconds, frames);
	}

    return timeCodeString;
}

function GetFirstFewCharsFromComment(inComment)
{
	var tempStr = inComment.replace( GetCommentHeaderRegex() , '');
	var firstFew = tempStr.substring(0,numCharsInCommentList);
	if (tempStr.length > firstFew.length)
	{
		firstFew += "...";
	}
	return firstFew;
}

function GetEnclosedReviewerName()
{
	// Get the reviewer's name.
	var reviewerNameTextField = this.getField("ReviewerNameTextField");
	var reviewerName = "[" + reviewerNameTextField.valueAsString + "]";
	if( reviewerNameTextField.value == "")
		reviewerName = "";

	return reviewerName;
}

function FlashCommentToMainWindow(time)
{
    if(time != 0)
    {
        var positionNum = FindLocationInTimeCodeArray(Math.floor((time + 0.0001) * frameRate));
		if (positionNum != null)
		{
			PutCommentToStagingArea(textAnnotField[positionNum].contents);
		}       
    }
    else
    {
        PutCommentToStagingArea("");
    }     
}

function FindLocationInTimeCodeArray(timeCodeValue)
{
    for ( var i = 0; i < numCommentsField.value; i++)
    {
		if ( typeof timeCodeTextFieldArray[i] != "undefined" && timeCodeTextFieldArray[i] != null)
        {
		    var tempAnnotHandle = this.getAnnot(0,"timeCodeTextField" + i);
            if( tempAnnotHandle != null)
			    if( parseFloat(timeCodeValue) == parseFloat(tempAnnotHandle.contents))
				    return i;
        }
    } 
}

function FindLocationInCommentList(time)
{
    var returnVal = 0;
    var l = this.getField("CommentList");
    for ( var i = 0; i < l.numItems; i++)
    {
         if( time > Number(l.getItemAt(i)) )
            returnVal = i + 1;  
    }
    return returnVal;
}

function FindCommentMarkerToPlayerTime()
{
    var where = player.where();
    var time = where.time;
    var returnVal  = 0;
    var floatTime = 0;
    for ( var i = 0; i < timeCodeTextFieldArray.length; i++)
    {
       if ( timeCodeTextFieldArray[i] != null)
        {
           floatTime = timeCodeTextFieldArray[i].contents / frameRate;
           floatTime = Number(floatTime);
           if ( time > floatTime)
                if( returnVal < floatTime )
                   returnVal = floatTime;
        }
    }    
    return returnVal;
}

function EditComment()
{
		var time = player.where().time;
		// Comment already exists. Prepare for editing
		editCommentFlag = 1;
		var addCommentTextField = this.getField("AddCommentTextField");
		addCommentTextField.readonly = false;
		addCommentTextField.setFocus();
		//addCommentTextField.value = textAnnotField[positionNum].contents;
		addCommentTextFieldTimeCode = time;							
		// Flash running timecode 
		// We have to synchronize the two time displayed time codes
		var runningTimecode = this.getField("RunningTimecode");
		runningTimecode.value = GetTimeCodeString(time);
}

function DoComment()
{
	// means that pausing didn't prepare for adding or editing a comment
	editCommentFlag = 0;
	addCommentFlag  = 0;
	var time = player.where().time;

	var addCommentTextField = this.getField("AddCommentTextField");
	var stagingAreaCommentHeaderField = this.getField("StagingAreaCommentHeaderField");

	var enclosedReviewerName = GetEnclosedReviewerName();
							
	var truncatedTimeCodeValue = Math.floor((time + 0.0001) * frameRate);
	var positionNum = FindLocationInTimeCodeArray(truncatedTimeCodeValue);

	if (positionNum == null)
	{
		// Prepare for adding a new comment
		addCommentTextField.value = "";
		addCommentTextFieldTimeCode = time;
		
		// [NOTE] ideally we should be doing this last but doing here to take care of some issues with setfocus
		addCommentFlag = 1;	
		finishedCommentFlag = 0;
		addCommentTextField.readonly = false;
		addCommentTextFieldTimeCode = time;
		stagingAreaCommentHeaderField.value = enclosedReviewerName + " " + GetTimeCodeString(time);
		console.println("stagingAreaCommentHeaderField set");

		// Flash running timecode 
		// We have to synchronize the two time codes displayed
		var runningTimecode = this.getField("RunningTimecode");
		runningTimecode.value = GetTimeCodeString(time);			
	}
	else
	{
		// Comment already exists. Prepare for editing
		editCommentFlag = 1;
		finishedCommentFlag = 0;
		addCommentTextField.readonly = false;
		addCommentTextFieldTimeCode = time;
		PutCommentToStagingArea(textAnnotField[positionNum].contents);
		// Flash running timecode 
		// We have to synchronize the two time displayed time codes
		var runningTimecode = this.getField("RunningTimecode");
		runningTimecode.value = GetTimeCodeString(time);			
	}
}

function DisplayAutomaticComment()
{
	try
	{
		// remove reentrance by defining a mutex
		if (displayCommentMutex == 0)
		{
			displayCommentMutex = displayCommentMutex + 1;
			// console.println("DisplayCOmmentMutex:" + displayCommentMutex);

	/////////////////ACTUAL CODE//////////////////////////////////////////////////ACTUAL CODE/////////////////////////////////

			if (player.isOpen)
			{
				if (addCommentFlag == 0 && editCommentFlag == 0)
				{
					if (player.isPlaying)
					{
						// flash comments while playing
						var commentTime = FindCommentMarkerToPlayerTime();
						if (commentTime != oldCommentTime)
						{
							FlashCommentToMainWindow(commentTime);
						}			
						
						FlashRunningTimecode(player.where().time);

						oldCommentTime = commentTime;
					}
					else
					{	
						// prepare for adding a comment
						try
						{
							var commentTime = player.where().time;
							if (commentTime != oldCommentTime)
							{
								SetFocusToCommentField();
								FlashRunningTimecode(commentTime);
								DoComment();
								oldCommentTime = commentTime;
							}
						}catch(e)
						{
							console.println(e.extMessage);
						}
					}
				}
				else
				{
					// A comment has been added, save the comment.
					try
					{	
						if(finishedCommentFlag)
						{														
							var commentTime = player.where().time;
							if (commentTime == oldCommentTime)
							{			
								if (commentDirty)
								{
									SaveComment();
									if (!player.isPlaying)
									{

										var addCommentTextField = this.getField("AddCommentTextField");
										addCommentTextField.readonly = false;
										if (addCommentTextField.valueAsString != "")
										{
											editCommentFlag = 1;
										}
										else
										{
											addCommentFlag = 1;
										}
									}
								}
							}
							else
							{
								SaveComment();
							}
						}
					}
					catch(e)
					{
						console.println(e.extMessage);
					}
				}
			}

	/////////////////ACTUAL CODE//////////////////////////////////////////////////ACTUAL CODE/////////////////////////////////
			displayCommentMutex = 0;
		}
		else
		{
			console.println("Mutex interrupted me");
		}
	}
	catch(e)
	{
		console.println(e.extMessage);
	}
}

function DeleteComment()
{
	var addCommentTextField = this.getField("AddCommentTextField");
	if (addCommentFlag)
	{
		addCommentTextField.value = "";
		addCommentTextField.setFocus();
	}
	else 
	{
		editCommentFlag = 0;
		addCommentFlag = 0;
		var l = this.getField("CommentList");

		if( l.numItems != 0)
		{
			var nButton = app.alert({nIcon: 1, nType: 2, cMsg: "Do you really want to delete the comment?"});
			if( nButton == 4)    /* reponse is yes */
			{        
				var positionNum = FindLocationInTimeCodeArray(l.value);
				if( typeof textAnnotField[positionNum] != "undefined" )
				{
					textAnnotField[positionNum].destroy();
					textAnnotField[positionNum] = null;
					timeCodeTextFieldArray[positionNum].destroy();
					timeCodeTextFieldArray[positionNum] = null;
				}
				var currIndex = l.currentValueIndices;
				l.deleteItemAt();					
				 
				if( l.numItems != 0)
				{
					if (currIndex > 0)		// select the prev comment
					{
						l.currentValueIndices = currIndex - 1;
					}
					else					// select the next comment
					{
						l.currentValueIndices = currIndex;
					}
				}

				DoComment();
				addCommentTextField.setFocus();			
			}
		}
	}
}

function AppendStartTagToComment(comment , timecode)
{
    // Get the reviewer's name.
	var enclosedReviewerName = GetEnclosedReviewerName();
    comment = enclosedReviewerName + " " + GetTimeCodeString(timecode) + " -" + comment ;
    return comment;
}

SaveComment();
// if( isDirtyFlag == 1)	// always export XFDF, earlier happened only when comments had been added.
{
    // app.alert("You have made changes to the comments since you last saved the comments. Please save the comments.");
    this.exportAsXFDF({ bAnnotations: true, bAllFields: true});
    isDirtyFlag = 0;
}

var returnEmailAddressAnnot = this.getAnnot(0, "returnEmailAddress");
if (returnEmailAddressAnnot.contents != "")
{
	var reviewerName = this.getField("ReviewerNameTextField").valueAsString;
	var body = "Hello.%0A%0DMy comments for the recent Adobe Clip Notes review session are attached to this e-mail. Please import them into the original " + this.getAnnot(0,"appName").contents +" project sequence/composition to view them.%0A%0D%0A%0D Thanks,";
	// [HACK] pankaj 05.13.2005
	// Need to fix this immidiately for UIF hence hardcoding the default name here
	if (reviewerName != "Enter your name here")
	{
		body = body + "%0A%0D" + reviewerName;
	}
	
	var cURLString = "mailto:" + returnEmailAddressAnnot.contents + "?subject=Clip Notes Comments&body=" + body + "&ui=true";
	this.submitForm({
        bAnnotations: true,
		cURL: cURLString,
		cSubmitAs: "XFDF",
        bInclNMKey: true
	});
}