PDF static analysis report

Static analysis result for SHA-256 87c0a08a7e91a069…

SUSPICIOUS

PDF

122.0 KB Created: 2003-09-15 10:32:00 Authoring application: PDF+Forms 2.0 (via Cardiff Software - TELEform 8.2) First seen: 2026-05-11
MD5: a6deb33c4113aa8ab614bb036ba211de SHA-1: 37b4b0ad392b7e3342b9cc420322bfa2dd87c234 SHA-256: 87c0a08a7e91a069b49b2c227a0ab3a0db9bc831d87981cb76aa3c39c2eec41e
40 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains multiple JavaScript streams that utilize functions like submitForm and util.printf, indicating an intent to process or exfiltrate form data. The ML classifier also flagged this PDF as malicious. While the extracted URLs are benign, the presence of JavaScript and form capabilities suggests a malicious intent, likely related to phishing or data theft, and thus classified as a potential spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7255

Heuristics 7

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.adobe.com/acrobat/readstep.html PDF link annotation
  • Interactive-form capabilities present but unconfirmed info PDF_FORM_CAPABILITY_UNCORROBORATED
    The PDF is a heavily-scripted interactive AcroForm whose only malicious-leaning signals are structural/ML (JavaScript presence, stream count, form widgets, the Nyx ML classifier) — nothing corroborates harm: no exploit/CVE primitive, /Launch, /EmbeddedFile, SubmitForm, JS obfuscation, social-engineering lure, redirector, or external URL. The verdict was capped at 'suspicious' so legitimate script-heavy forms are not flagged malicious on capability presence alone.

Extracted artifacts 25

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0504_000.js pdf-javascript-stream PDF /JS object 504 at offset 0x1531E 43 bytes
SHA-256: d5817a3cac36e93639c72edea35429ebb9916510d2c8967062acb8187f9f30fe
Preview script
First 1,000 lines of the extracted script
// <cardiff:dbtype name="number"/>
TFNF(0);
javascript_obj0505_001.js pdf-javascript-stream PDF /JS object 505 at offset 0x1537C 47 bytes
SHA-256: 3c0a83bc48f8a4c6e6ac28733fe8d4f139302f2d391a7024e575e4b7cc3d5be8
Preview script
First 1,000 lines of the extracted script
// <cardiff:dbtype name="number"/>
TFNK(0,0,0);
javascript_obj0506_002.js pdf-javascript-stream PDF /JS object 506 at offset 0x153DE 85 bytes
SHA-256: e72e4b7db1522ed3f4c92366b48556144c7b234b63ac8abbf7549562ad6d684f
Preview script
First 1,000 lines of the extracted script
TFSignature_Format( "b12c96nfSig", "1",  true, "EXCEPT", new Array ( "@SubmitIt" ) );
javascript_obj0507_003.js pdf-javascript-stream PDF /JS object 507 at offset 0x15469 55 bytes
SHA-256: 096d96a201f71a786fe5fe58834d70437b9bc0d2814e62318278edbd77d818de
Preview script
First 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/>
TFT("XX~.XX~.XXXX",0);
javascript_obj0508_004.js pdf-javascript-stream PDF /JS object 508 at offset 0x154D3 48 bytes
SHA-256: 8c1842de4ccb6a3c96db5313300728b182467d8c490b4d5e0d55a77535907087
Preview script
First 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/>
TFANP(1,0,0,0);
javascript_obj0509_005.js pdf-javascript-stream PDF /JS object 509 at offset 0x15536 43 bytes
SHA-256: 02eeeb59a750af55895dd82f8c07082f6ccaf8c344013a1232372526b533590a
Preview script
First 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/>
TFAV(1,0);
javascript_obj0512_008.js pdf-javascript-stream PDF /JS object 512 at offset 0x15616 51 bytes
SHA-256: 38f010c517e8345003be76828c9806cabd66e041c22eb57f7b272762c559441f
Preview script
First 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/>
TFAK(1,0);TFUp(1);
javascript_obj0513_009.js pdf-javascript-stream PDF /JS object 513 at offset 0x1567E 56 bytes
SHA-256: ce097b681948ad0d3597ead0b3cf6f260e9c3c864ea4bb3ca9488fd68747dd67
Preview script
First 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/>
TFTF("XX~.XX~.XXXX",0);
javascript_obj0514_010.js pdf-javascript-stream PDF /JS object 514 at offset 0x156E9 64 bytes
SHA-256: 23e251cef7da22949aa6585216df59201dba4e48a7aee970f38c6ff3ce69cffd
Preview script
First 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/>
TFAN();
TFANP(1,0,0,0);TFUp(0);
javascript_obj0515_011.js pdf-javascript-stream PDF /JS object 515 at offset 0x15763 48 bytes
SHA-256: 84391237e30359fab2288524f69e3a5faa52ab0bd4a553b0a541fda146d94ede
Preview script
First 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/>
TFANP(0,1,0,0);
javascript_obj0066_014.js pdf-javascript-stream PDF /JS object 66 at offset 0x1B251 1099 bytes
SHA-256: 3112db3e821afc97ff13e6c3273f02c6c1acfe984d30346d19ea73f5554b20dd
Preview script
First 1,000 lines of the extracted script
var TF_DT_INVALID="Das eingegebene Datum ist ung�ltig: %s";
var TF_RESET_ASK="Datum des Formulars zur�cksetzen?";
var TF_EMAIL_NOTE="Ihr Formular wird per E-Mail gesendet. �berpr�fen Sie gegebenenfalls im Ordner 'Gesendete Objekte' Ihres E-Mail-Programms, ob das Formular gesendet wurde.";
var TF_REQIURED="Beim Exportieren wurde festgestellt, dass das erforderliche Feld '%s' leer ist!";
var TF_MAIL_NOT_AVAILABLE ="Zur Verwendung der E-Mail-Funktion ben�tigen Sie Adobe Acrobat 4.x oder h�her (nicht Acrobat Reader)!";
var TF_SUBMIT_NOT_AVAILABLE ="Dieser Vorgang kann nur verwendet werden, wenn Acrobat Reader in einem Web-Browser ausgef�hrt wird!";
var TF_REQUIRED_VERSION_MSG ="Sie verf�gen nicht �ber das Update f�r das Formular-Plugin Version %.2f, das f�r diese Datei erforderlich ist.";
var TF_REQUIRED_VERSION =4.05;
var TF_SIG_RESET_MSG = "Sollen die Signaturen zur�ckgesetzt und die Formulardaten beibehalten werden?";
var TF_SIG_LOCK = "27518";
var TF_ALPHA=" ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz�������������������������������������������������������������\n\r";
javascript_obj0069_015.js pdf-javascript-stream PDF /JS object 69 at offset 0x1B5B2 2518 bytes
SHA-256: d355aeeec017f0cb7adbe25c368ee35b2b7d74ae2a2bbbe30489cdbb9158d6da
Preview script
First 1,000 lines of the extracted script
function TFAuto(u,f,n,auto)
{
 var i=0,j,t,s="",m="",l,e,b,c;

 calculateNow();
 
 if ("undefined" != typeof TF_REQIURED) m=TF_REQIURED;
 else m="The required field '%s' was found empty during export!";
 
 if ("undefined" != typeof TF_ENTRY_ARRAY) {
   for(;i<TF_ENTRY_ARRAY.length;i++) {
    j=0;b=0;c=0;sc=0;
    if (TF_ENTRY_ARRAY[i].indexOf("%s") == -1) c=1;
    if (c && TF_ENTRY_ARRAY[i].indexOf("@") == -1) { c=0;sc=1};
    if (!sc) {
      while(1) {
        l="";
        if (j < 100) l+="0";
        if (j < 10) l+="0";
        l+=j.toString();
        if (c) { 
          e=util.printf("%s.%d", TF_ENTRY_ARRAY[i], j);
        }
        else e=util.printf(TF_ENTRY_ARRAY[i],l);
        t=this.getField(e);
        if(!t) {
         if (j==0) b=1;
         break;
        }
        if (t.value.toString() != "Off") { b=1; break;}
        j++;
      }
    } else {
      t=this.getField(TF_ENTRY_ARRAY[i]);
      if (!t) { b=1; }
      if (t.value.toString() != "Off") { b=1;}
    }
    
    if (!b) {
      if (sc) e = TF_ENTRY_ARRAY[i];
      else if (c) e=util.printf("%s.0", TF_ENTRY_ARRAY[i]);
      else e=util.printf(TF_ENTRY_ARRAY[i],"000");
      t=this.getField(e);
      if(t) {
        if (!t.userName || t.userName.length == 0) s=util.printf(m,t.name);
        else s=util.printf(m,t.userName);

        app.alert(s);
      }
      return 0;
    }
   }
 }

 for (i=0; i < this.numFields; i++) {
  t=this.getField(this.getNthFieldName(i));
  if (!t || t.name.indexOf("@") == 0) continue;
  if (!t.required) continue;
  if (t.type=="button") continue;
  if (t.name=="recipient" || t.name=="TFRVrecipient") continue;

  if (t.value.toString().length==0 || ((t.type=="checkbox" || t.type=="radiobutton") && (t.value.toString() == "Off"))) {

    if (!t.userName || t.userName.length == 0) s=util.printf(m,t.name);
    else s=util.printf(m,t.userName);
 
      app.alert(s);
    return 0;
  }
 }
 
 if (auto==0) {
  if (app.viewerType != "Exchange" && !this.external) {
  if ("undefined" != typeof TF_SUBMIT_NOT_AVAILABLE) app.alert(TF_SUBMIT_NOT_AVAILABLE);
  else app.alert("This operation can only be used when \n Acrobat Reader is running inside a web browser!");
  } else this.submitForm(u,f,0);

 } else if (auto==1) {
  return TFEmail(n);
 } else {
  if ((typeof app.formsVersion=="undefined" || app.formsVersion<3.5) || this.external) {
  this.submitForm(u,f,0);
  }
  else return TFEmail(n);
 }
 return 1;
}
javascript_obj0072_016.js pdf-javascript-stream PDF /JS object 72 at offset 0x1B9F9 1278 bytes
SHA-256: 3c4718d5b4722e6302a5956d94c9292ffa8bca5b293d7b4d2fb92ad68b7a1803
Preview script
First 1,000 lines of the extracted script
function TFANP(bv,bf,bn,bc)
{
 var i=0,v,vl,dv="",s=0,bi,f=event.target;
 if (bc) dv=f.defaultValue.toString();
 if (bf) vl=event.value.toString();
 else vl=AFMergeChange(event);
 if (!event.rc) return;
 bi=(f.textFont!=font.Cour);
 v=vl;
 if (bn && !bi) {
  if (bf) {
   for(v=""; i < (f.charLimit-vl.length); i++) v+=" ";
   v+=vl; i=0;
  }
  s=v.length-dv.length;
 }

 if (bv && dv.length) {
  if (v.length < dv.length) event.rc=0;
  if (((!bn||bi) && v.indexOf(dv) != s) || ((bn && !bi) && v.lastIndexOf(dv) != s)) event.rc=0;
 }

 if (!event.rc && app.calculate) app.beep(0);

 if (bf && !bi) {
  event.value="";
  if (!bn) {
   for(;i < dv.length; i++) event.value+=" ";
   if (v.length > dv.length) event.value+=v.substring(dv.length,v.length);
  } else {
   if (v.length > dv.length) event.value+=v.substring(0,v.length-dv.length);
   for (; i < dv.length; i++) event.value+=" ";
  }
 }

 if (bi && event.willCommit) {
  if (event.value.toString().length > 0) f.bgColor=color.white; 
  else f.bgColor=color.transparent; 
 }
}

var TF_SPECIAL="@#$%&()*+-,./;:";

if(!TF_ALPHA||!TF_ALPHA.length)
 TF_ALPHA=" ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz�������������������������������������������������������������\r\n";
javascript_obj0075_017.js pdf-javascript-stream PDF /JS object 75 at offset 0x1BD2C 1958 bytes
SHA-256: 5d382703ccf55b94ad2dc8ae8af807385f94188aa2665d13e8c6b61957f5154f
Preview script
First 1,000 lines of the extracted script
TF_RESET_ARRAY=new Array();
function TFOpen() 
{
 var f,a,i=0,j, req_ver = 3.5;
 var b=this.getField("@adobe_link"), s=this.getField("@SubmitIt"), msg = "";
 var fwdBtn = this.getField("@ForwardIt");

 if ("undefined" != TF_REQUIRED_VERSION) req_ver = TF_REQUIRED_VERSION;
 
 if (b&&!b.hidden) {
  app.calculate=0;

  if (typeof app.formsVersion == "undefined" || app.formsVersion < req_ver) {
  
  if ("undefined" != TF_REQUIRED_VERSION_MSG) {
    msg = util.printf(TF_REQUIRED_VERSION_MSG, req_ver);
  } else {
    msg = util.printf("You don't have the Forms plug-in ver. %.2f update needed for this file!", req_ver);
  }

  app.alert(msg);

  } else {


  b.hidden=1;
 
  if (typeof TF_RESET_ARRAY != "undefined") {
    for(i=0;i < TF_RESET_ARRAY.length; i++) {
    f=this.getField(TF_RESET_ARRAY[i].toString());
    if (!f) continue;
    f.delay=1;
    
    a=0;
    if (f.name.indexOf("@") == 0) a = f.getArray();
    
    if (a && a.length > 0) {
      for(j=0; j < a.length; j++) {
        if (a[j].defaultValue.toString().length > 0) { a[j].value = ""; a[j].value = a[j].defaultValue.toString(); }
        else { a[j].value = "1"; a[j].value = ""; }
      }
    }
    
    f.delay=0;
    }
  }

  if (typeof TF_READONLY_ARRAY != "undefined") {
    for(i=0;i < TF_READONLY_ARRAY.length; i++) {
      f=this.getField(TF_READONLY_ARRAY[i].toString());
      if (!f) continue;
      f.readonly = true;
    }
  }
 
  if (s) s.hidden=0;
 
  app.calculate=1; this.dirty=0;
    if (fwdBtn || typeof TF_SIG_ARRAY != "undefined") {
      if(typeof app.formsVersion=="undefined" || app.formsVersion < 4.05 || app.viewerType != "Exchange") {
    
        if ("undefined" != typeof TF_MAIL_NOT_AVAILABLE) {
          app.alert(TF_MAIL_NOT_AVAILABLE);
        } else {
          app.alert("You need Adobe Acrobat 4.x or higher (not Reader) to use an e-mail!"); 
        }
      }
    }
  }
 }
}
javascript_obj0078_018.js pdf-javascript-stream PDF /JS object 78 at offset 0x1C0C4 2807 bytes
SHA-256: 8b78b88fd2bcbde72bb65ffc33990ae260d751b48cd0f040b5e653fcdcb4938b
Preview script
First 1,000 lines of the extracted script
var aTFReadOnly = new Array( "@@@SKFI0", "@@@SKFI1"
, "@@@SKFI2"
, "b12c96nfSig"
, "@@b12c96nfB22_59.0"
, "@@b12c96nfB22_59.1"
, "@@b12c96nfB22_59.2"
, "@@b12c96nfB22_58.0"
, "@@b12c96nfB22_58.1"
, "@@b12c96nfB22_58.2"
, "@@b12c96nfB22_55.0", "@@b12c96nfB22_55.1"
, "@@b12c96nfB22_55.2"
, "@@b12c96nfB22_54.0"
, "@@b12c96nfB22_54.1"
, "@@b12c96nfB22_54.2"
, "@@b12c96nfB22_51.0"
, "@@b12c96nfB22_51.1"
, "@@b12c96nfB22_51.2"
, "@@b12c96nfB22_50.0"
, "@@b12c96nfB22_50.1", "@@b12c96nfB22_50.2"
, "@@b12c96nfB22_47.0"
, "@@b12c96nfB22_47.1"
, "@@b12c96nfB22_47.2"
, "@@b12c96nfB22_46.0"
, "@@b12c96nfB22_46.1"
, "@@b12c96nfB22_46.2"
, "@@b12c96nfB22_43.0"
, "@@b12c96nfB22_43.1"
, "@@b12c96nfB22_43.2", "@@b12c96nfB22_42.0"
, "@@b12c96nfB22_42.1"
, "@@b12c96nfB22_42.2"
, "@@b12c96nfB22_39.0"
, "@@b12c96nfB22_39.1"
, "@@b12c96nfB22_39.2"
, "@@b12c96nfB22_38.0"
, "@@b12c96nfB22_38.1"
, "@@b12c96nfB22_38.2"
, "@@b12c96nfB22_35.0", "@@b12c96nfB22_35.1"
, "@@b12c96nfB22_35.2"
, "@@b12c96nfB22_34.0"
, "@@b12c96nfB22_34.1"
, "@@b12c96nfB22_34.2"
, "@@b12c96nfB22_31.0"
, "@@b12c96nfB22_31.1"
, "@@b12c96nfB22_31.2"
, "@@b12c96nfB22_30.0"
, "@@b12c96nfB22_30.1", "@@b12c96nfB22_30.2"
, "@@b12c96nfB22_27.0"
, "@@b12c96nfB22_27.1"
, "@@b12c96nfB22_27.2"
, "@@b12c96nfB22_26.0"
, "@@b12c96nfB22_26.1"
, "@@b12c96nfB22_26.2"
, "@@b12c96nfB22_23.0"
, "@@b12c96nfB22_23.1"
, "@@b12c96nfB22_23.2", "@@b12c96nfB22_22.0"
, "@@b12c96nfB22_22.1"
, "@@b12c96nfB22_22.2"
, "@@b12c96nfB22_19.0"
, "@@b12c96nfB22_19.1"
, "@@b12c96nfB22_19.2"
, "@@b12c96nfB22_18.0"
, "@@b12c96nfB22_18.1"
, "@@b12c96nfB22_18.2"
, "@@b12c96nfB22_15.0", "@@b12c96nfB22_15.1"
, "@@b12c96nfB22_15.2"
, "@@b12c96nfB22_14.0"
, "@@b12c96nfB22_14.1"
, "@@b12c96nfB22_14.2"
, "@@b12c96nfB22_11.0"
, "@@b12c96nfB22_11.1"
, "@@b12c96nfB22_11.2"
, "@@b12c96nfB22_10.0"
, "@@b12c96nfB22_10.1", "@@b12c96nfB22_10.2"
, "@@b12c96nfB22_07.0"
, "@@b12c96nfB22_07.1"
, "@@b12c96nfB22_07.2"
, "@@b12c96nfB22_06.0"
, "@@b12c96nfB22_06.1"
, "@@b12c96nfB22_06.2"
, "@@b12c96nfB22_03.0"
, "@@b12c96nfB22_03.1"
, "@@b12c96nfB22_03.2", "@@b12c96nfB22_02.0"
, "@@b12c96nfB22_02.1"
, "@@b12c96nfB22_02.2"
 );
TF_SIG_ARRAY=new Array("@b12c96nfSig");
function TFSigOpen() 
{

  var       submitBtn       = this.getField( "@SubmitIt" );
  var       sDate           = new Date();

  TFOpen()
  
  if (typeof TF_SIG_ARRAY != "undefined") {  
    
    for (i = 0; i < TF_SIG_ARRAY.length; i++) {
      f = this.getField( TF_SIG_ARRAY[i].toString() );
      if (f && f.value == "") {
        TF_SIG_LOCK += Date.parse( sDate.toLocaleString() ).toString();
        global[TF_SIG_LOCK] = false;
        break;
      }
    }

    if (typeof global[TF_SIG_LOCK] == "undefined" && submitBtn) {
      submitBtn.readonly = 1;
      this.dirty = 0;
    }
  }
}
javascript_obj0081_019.js pdf-javascript-stream PDF /JS object 81 at offset 0x1C3DB 365 bytes
SHA-256: 07707251746d909fbaaac180bbb1c38ba5d42d3c8ee80b844efbc76a1050da70
Preview script
First 1,000 lines of the extracted script
function TFNK(bs,bt,bc)
{
 var i=0,v=AFMergeChange(event);

 if (bs && !bt) AFNumber_Keystroke(0,0,0,0,"",1);
 else {
  for(;i < v.length; i++) {
   if (v[i] >= '0' && v[i] <= '9') continue;
   if (bs && TF_SPECIAL.indexOf(v[i]) != -1) continue;
   event.rc=0;
   if (app.calculate) app.beep(0);
   break;
  }
 }

 if (event.rc) TFANP(1,0,!bt,bc);
}
javascript_obj0084_020.js pdf-javascript-stream PDF /JS object 84 at offset 0x1C575 829 bytes
SHA-256: 77468418a7c15cf66abc810fe1bcdbbdf9e389ec97f8cde200a0fed65c7f1ca7
Preview script
First 1,000 lines of the extracted script
function TFST(f,n)
{
 var v1,v,n1="",n2="",l,nm=v=l="",j=n.indexOf("e"),i;

 if (j==-1) return;
 n1=n.substring(0,++j);
 n2=n.substring(j+3,n.length);
 i=j=0;
 for(; i < f.length; i++) {
  if (f[i]=='z') { 
   v1=l="";
   if (j < 100) l+="0";
   if (j < 10) l+="0";
   nm=n1+l+j.toString()+n2;
   v1=this.getField(nm).value.toString();
   if (v1 != "Off") v+=v1;
   else v+=" ";
   j++; continue;
  }
  if (f[i]=='~' && ++i < f.length) v+=f[i].toString();
 }

 this.getField("@"+n1+"@@@"+n2).value=v;
}

function TFConstrShow()
{
  if (typeof app.formsVersion != "undefined" && app.formsVersion > 4)
    event.target.fillColor = color.white;
} 

function TFConstrHide()
{
  if (typeof app.formsVersion != "undefined" && app.formsVersion > 4)
    event.target.fillColor = color.transparent;
}
javascript_obj0087_021.js pdf-javascript-stream PDF /JS object 87 at offset 0x1C7A6 1656 bytes
SHA-256: 86b34d7cd1185ba895e901fbca0e6b245a7778f87f0b60b5df4482db1200d384
Preview script
First 1,000 lines of the extracted script
function TFT(f,bc)
{
 var dv,i=0,j=0,c,r=1,vl=dv="",v=AFMergeChange(event),l,ss=event.selStart,lf=f.length,ec=event.change.toString();

 if (bc) dv=event.target.defaultValue.toString();
 l= v.length;
 if (!l && !dv.length) return;
 if (l > lf) { event.rc=0; if (app.calculate) app.beep(0); return; }

 for (; j < l && i < lf; i++,j++) {
  c=v[j];
  if (f[i]=='X' && (c<'0'||c>'9') && TF_ALPHA.indexOf(c)==-1) { r=!r; break; }
  if (f[i]=='S' && TF_SPECIAL.indexOf(c)==-1) { r=!r; break; }
  if (f[i]=='N' && (c<'0'||c>'9')) { r=!r; break; }
  if ((f[i]=='A'||f[i]=='U'||f[i]=='L') && TF_ALPHA.indexOf(c)==-1) { r=!r; break; }
  if (f[i]=='U') { vl+=c.toString().toUpperCase(); continue; }
  if (f[i]=='L') { vl+=c.toString().toLowerCase(); continue; }
  if (f[i]=='~') {
   i++;
   if (i > lf) { r=!r; break; }
   if (f[i] != c) {
    if (c.toString().toUpperCase()==f[i].toString().toUpperCase() && f[i].toString().toUpperCase()==f[i].toString()) {
     vl+=c.toString().toUpperCase();continue;
    }
    if (c.toString().toLowerCase()==f[i].toString().toLowerCase() && f[i].toString().toLowerCase()==f[i].toString()) {
     vl+=c.toString().toLowerCase();continue;
    }
    r=!r; break;
   }
  }
  vl+=c.toString();
 }

 if (r && (ss + ec.length) == l && (event.value.toString().length <= l || ss!=event.selEnd-1)) {
  while (1) {
	if (i < lf && f[i]=='~' && ++i < lf) {
		event.change+=f[i++].toString();
	} else {
		break; 
	}
  }
 }

 if (r) {
  TFANP(1,0,0,bc);
  if (!event.rc) r=!r;
 }
 
 if (!r) {
  if (app.calculate) app.beep(0);
  event.rc=0;
 } else if (event.willCommit) event.value=vl;
}
javascript_obj0090_022.js pdf-javascript-stream PDF /JS object 90 at offset 0x1CAA4 631 bytes
SHA-256: 760e944e7e46e3092e1dc3a425d8ca0ca7fc183ce551abb7d05fd4a6c83f358a
Preview script
First 1,000 lines of the extracted script
function TFTF(f,bc)
{
 var n=event.target.name,nm="@@"+n,i=0,k=0,v="",a=0,fl=this.getField(nm),vl;
 
 if (fl) a = fl.getArray();
 
 TFANP(0,1,0,bc);

 vl=event.value.toString();

 for (; i < f.length; i++) {
	if (f[i]=='S'||f[i]=='N'||f[i]=='X'||f[i]=='A'||f[i]=='U'||f[i]=='L') {
	  if (k < vl.length) v+=vl[k++].toString();
	  else v+=" ";
	} else {
	  if(f[i]=='~') continue;
	  else k++;
	}
 }

 for (i=0; i < a.length; i++) {
   fl = this.getField(nm + "." + i);
   if (fl) fl.defaultValue = fl.value = v.substring(0,fl.charLimit);
   v=v.substring(fl.charLimit,v.length);
 }

 event.value = "";
}
javascript_obj0093_023.js pdf-javascript-stream PDF /JS object 93 at offset 0x1CC94 299 bytes
SHA-256: 8e3ba51bc83b2f9b72901e1bdab10e0359724e263e39ab4782ed2172eeaf60d1
Preview script
First 1,000 lines of the extracted script
function TFNF(bc)
{
 var i=0,v="",c=event.value.toString(),t=event.target;
 if (t.textFont!=font.Cour) {
  if (c.length > 0) t.bgColor=color.white; 
  else t.bgColor=color.transparent;
  return;
 }
 for (; i< (t.charLimit-c.length); i++) v+=" ";
 v+=c; event.value=v;
 TFANP(0,1,1,bc);
}
javascript_obj0096_024.js pdf-javascript-stream PDF /JS object 96 at offset 0x1CE04 1615 bytes
SHA-256: 6c960f0df22dcb3ee28d79851a53dc3f63927d02b55449393dd60e1e8e50b99b
Preview script
First 1,000 lines of the extracted script
function TFEmail(n)
{
  var           msg     = "";

  if (typeof app.formsVersion=="undefined"
                    ||
      app.formsVersion < 3.5
                    ||
      (n == 1 && app.formsVersion < 4.05)
                    ||
      app.viewerType != "Exchange")
  {
    
    if ("undefined" != typeof TF_MAIL_NOT_AVAILABLE) {
      app.alert(TF_MAIL_NOT_AVAILABLE);
    } else {
      app.alert("You need Adobe Acrobat 4.x or higher (not Reader) to use an e-mail!"); 
    }
    return 0;

  }
 
 var t,i=0,body="",to,f=this.getField("recipient"),bUI=0,s="TF Email",val="";

 if (!f) f=this.getField("TFRVrecipient");

 if (f) to=f.value.toString();
 else { to=""; bUI=1; }

 for (; i < this.numFields; i++) {
  t=this.getField(this.getNthFieldName(i));
  if (!t || t.name.indexOf("@") == 0) continue;
  if (t.type=="button" || !t.value || t.value.toString().length==0) continue;
  if (t.name=="recipient") continue;
  if ((t.type=="checkbox" || t.type=="radiobutton") && (t.value=="Off")) continue;
  
  if (typeof t.valueAsString == "string")
    val = t.valueAsString;
  else
    val = t.value.toString();

  body += t.name + "=" + val + "\n";
 }

 if (body.length==0) return 0;
 if (n==0) app.mailMsg(bUI,to,"","",s,body);
 if (n==1) this.mailDoc(bUI,to,"","",s,body);
 if (n==2) this.mailForm(bUI,to,"","",s,body);

 if ("undefined" != typeof TF_EMAIL_NOTE) app.alert(TF_EMAIL_NOTE,1);
 else app.alert("Your form will be sent via E-mail. You may check the 'Sent' folder of your E-mail program to verify that the form was sent.",1);

  return 1;
}
javascript_obj0099_025.js pdf-javascript-stream PDF /JS object 99 at offset 0x1D163 183 bytes
SHA-256: a59d06e64edf5385b5548ecdb40fe2cfdb70398b3ca0574fa36b51394fee4ddf
Preview script
First 1,000 lines of the extracted script
function TFUp(b)
{
 if (event.rc && event.willCommit) {
  if (b) event.value=event.value.toString().toUpperCase();
  else event.value=event.value.toString().toLowerCase();
 }
}
javascript_obj0102_026.js pdf-javascript-stream PDF /JS object 102 at offset 0x1D274 262 bytes
SHA-256: 5dc825a345efe5e078ad9ec1684ba5d192fdd7934134de2e788cee9f8b089aac
Preview script
First 1,000 lines of the extracted script
function TFAN()
{
 var i=0,v=AFMergeChange(event);
 if (!v.length || !event.rc) return;
 for(;i < v.length; i++) {
  if ((v[i] >= '0' && v[i] <= '9')||TF_ALPHA.indexOf(v[i]) != -1) continue;
  event.rc=0;
  if (app.calculate) app.beep(0);
  break;
 }
}
javascript_obj0105_027.js pdf-javascript-stream PDF /JS object 105 at offset 0x1D3DE 928 bytes
SHA-256: 2b071df929c05654f72077c7ee065adf5737ae835836e3c7519c4eaa6efbe205
Preview script
First 1,000 lines of the extracted script
// Alpha - only keystroke 
// b - special chars OK/NO
// bc - check force prefill.
function TFAK(b,bc)
{
 var i=0,ec=event.change.toString(),c;
 for (; i <ec.length; i++) {
  c=ec[i];
  if (b && TF_SPECIAL.indexOf(c) != -1) continue;
  if (TF_ALPHA.indexOf(c) == -1) { event.rc=0; if (app.calculate) app.beep(0); break; }
 }
 TFANP(1,0,0,bc);
}

// Alpha - only validation 
// b - special chars OK/NO
// bc - check force prefill.
function TFAV(b,bc)
{
 var i=0,ev=event.value.toString(),c;
 
 for (; i < ev.length && event.rc; i++) {
  c=ev[i];
  if (b && TF_SPECIAL.indexOf(c) != -1) continue;
  if (TF_ALPHA.indexOf(c) == -1) { event.rc=0; break; }
 }

 if (bc && event.rc) {
   var dv=event.target.defaultValue.toString();

   if (dv.length) {
     if (ev.length < dv.length) event.rc=0;
     if (ev.indexOf(dv) != 0) event.rc=0;
   }
 }
 
 if (!event.rc && app.calculate) app.beep(0);
}
javascript_obj0108_028.js pdf-javascript-stream PDF /JS object 108 at offset 0x1D5FF 629 bytes
SHA-256: d50a77f1aae5efdef2cc9d7f5a5866c710aa5947ec224d097022d5a53889021a
Preview script
First 1,000 lines of the extracted script
function TFSignature_Format( sField, sValue, bLock, cOperation, cFields )
{

  var f = this.getField( sField );

  if (f) {
    if (event.value != "") {
      f.value = sValue;
    } else {
      f.value = "";
    }
  }
    
  if (bLock) {
    AFSignature_Format( cOperation, cFields );
    //
    //    restore read only fields
    //
    for (i = 0; i < aTFReadOnly.length; i++) {
      var f = this.getField(aTFReadOnly[i] );
      if (f == null) {
        continue;
      }
      var a = f.getArray();

      for (var j = 0; j < a.length; j++) {
        a[j].readonly = true;
      }
    }
  }
}