SUSPICIOUS
40
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1566.001 Spearphishing Attachment
The PDF contains multiple JavaScript streams that utilize functions like submitForm and util.printf, indicating an intent to process or exfiltrate form data. The ML classifier also flagged this PDF as malicious. While the extracted URLs are benign, the presence of JavaScript and form capabilities suggests a malicious intent, likely related to phishing or data theft, and thus classified as a potential spearphishing attachment.
Machine Learning
- Nyx PDF Classifier malicious score 0.7255
Heuristics 7
-
JavaScript action low 1 related finding PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
AcroForm button with action trigger low PDF_ACROFORM_BUTTONPDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.adobe.com/acrobat/readstep.html PDF link annotation
-
Interactive-form capabilities present but unconfirmed info PDF_FORM_CAPABILITY_UNCORROBORATEDThe PDF is a heavily-scripted interactive AcroForm whose only malicious-leaning signals are structural/ML (JavaScript presence, stream count, form widgets, the Nyx ML classifier) — nothing corroborates harm: no exploit/CVE primitive, /Launch, /EmbeddedFile, SubmitForm, JS obfuscation, social-engineering lure, redirector, or external URL. The verdict was capped at 'suspicious' so legitimate script-heavy forms are not flagged malicious on capability presence alone.
Extracted artifacts 25
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0504_000.js |
pdf-javascript-stream | PDF /JS object 504 at offset 0x1531E | 43 bytes |
SHA-256: d5817a3cac36e93639c72edea35429ebb9916510d2c8967062acb8187f9f30fe |
|||
Preview scriptFirst 1,000 lines of the extracted script
// <cardiff:dbtype name="number"/> TFNF(0); |
|||
javascript_obj0505_001.js |
pdf-javascript-stream | PDF /JS object 505 at offset 0x1537C | 47 bytes |
SHA-256: 3c0a83bc48f8a4c6e6ac28733fe8d4f139302f2d391a7024e575e4b7cc3d5be8 |
|||
Preview scriptFirst 1,000 lines of the extracted script
// <cardiff:dbtype name="number"/> TFNK(0,0,0); |
|||
javascript_obj0506_002.js |
pdf-javascript-stream | PDF /JS object 506 at offset 0x153DE | 85 bytes |
SHA-256: e72e4b7db1522ed3f4c92366b48556144c7b234b63ac8abbf7549562ad6d684f |
|||
Preview scriptFirst 1,000 lines of the extracted script
TFSignature_Format( "b12c96nfSig", "1", true, "EXCEPT", new Array ( "@SubmitIt" ) ); |
|||
javascript_obj0507_003.js |
pdf-javascript-stream | PDF /JS object 507 at offset 0x15469 | 55 bytes |
SHA-256: 096d96a201f71a786fe5fe58834d70437b9bc0d2814e62318278edbd77d818de |
|||
Preview scriptFirst 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/>
TFT("XX~.XX~.XXXX",0);
|
|||
javascript_obj0508_004.js |
pdf-javascript-stream | PDF /JS object 508 at offset 0x154D3 | 48 bytes |
SHA-256: 8c1842de4ccb6a3c96db5313300728b182467d8c490b4d5e0d55a77535907087 |
|||
Preview scriptFirst 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/> TFANP(1,0,0,0); |
|||
javascript_obj0509_005.js |
pdf-javascript-stream | PDF /JS object 509 at offset 0x15536 | 43 bytes |
SHA-256: 02eeeb59a750af55895dd82f8c07082f6ccaf8c344013a1232372526b533590a |
|||
Preview scriptFirst 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/> TFAV(1,0); |
|||
javascript_obj0512_008.js |
pdf-javascript-stream | PDF /JS object 512 at offset 0x15616 | 51 bytes |
SHA-256: 38f010c517e8345003be76828c9806cabd66e041c22eb57f7b272762c559441f |
|||
Preview scriptFirst 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/> TFAK(1,0);TFUp(1); |
|||
javascript_obj0513_009.js |
pdf-javascript-stream | PDF /JS object 513 at offset 0x1567E | 56 bytes |
SHA-256: ce097b681948ad0d3597ead0b3cf6f260e9c3c864ea4bb3ca9488fd68747dd67 |
|||
Preview scriptFirst 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/>
TFTF("XX~.XX~.XXXX",0);
|
|||
javascript_obj0514_010.js |
pdf-javascript-stream | PDF /JS object 514 at offset 0x156E9 | 64 bytes |
SHA-256: 23e251cef7da22949aa6585216df59201dba4e48a7aee970f38c6ff3ce69cffd |
|||
Preview scriptFirst 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/> TFAN(); TFANP(1,0,0,0);TFUp(0); |
|||
javascript_obj0515_011.js |
pdf-javascript-stream | PDF /JS object 515 at offset 0x15763 | 48 bytes |
SHA-256: 84391237e30359fab2288524f69e3a5faa52ab0bd4a553b0a541fda146d94ede |
|||
Preview scriptFirst 1,000 lines of the extracted script
// <cardiff:dbtype name="text"/> TFANP(0,1,0,0); |
|||
javascript_obj0066_014.js |
pdf-javascript-stream | PDF /JS object 66 at offset 0x1B251 | 1099 bytes |
SHA-256: 3112db3e821afc97ff13e6c3273f02c6c1acfe984d30346d19ea73f5554b20dd |
|||
Preview scriptFirst 1,000 lines of the extracted script
var TF_DT_INVALID="Das eingegebene Datum ist ung�ltig: %s"; var TF_RESET_ASK="Datum des Formulars zur�cksetzen?"; var TF_EMAIL_NOTE="Ihr Formular wird per E-Mail gesendet. �berpr�fen Sie gegebenenfalls im Ordner 'Gesendete Objekte' Ihres E-Mail-Programms, ob das Formular gesendet wurde."; var TF_REQIURED="Beim Exportieren wurde festgestellt, dass das erforderliche Feld '%s' leer ist!"; var TF_MAIL_NOT_AVAILABLE ="Zur Verwendung der E-Mail-Funktion ben�tigen Sie Adobe Acrobat 4.x oder h�her (nicht Acrobat Reader)!"; var TF_SUBMIT_NOT_AVAILABLE ="Dieser Vorgang kann nur verwendet werden, wenn Acrobat Reader in einem Web-Browser ausgef�hrt wird!"; var TF_REQUIRED_VERSION_MSG ="Sie verf�gen nicht �ber das Update f�r das Formular-Plugin Version %.2f, das f�r diese Datei erforderlich ist."; var TF_REQUIRED_VERSION =4.05; var TF_SIG_RESET_MSG = "Sollen die Signaturen zur�ckgesetzt und die Formulardaten beibehalten werden?"; var TF_SIG_LOCK = "27518"; var TF_ALPHA=" ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz�������������������������������������������������������������\n\r"; |
|||
javascript_obj0069_015.js |
pdf-javascript-stream | PDF /JS object 69 at offset 0x1B5B2 | 2518 bytes |
SHA-256: d355aeeec017f0cb7adbe25c368ee35b2b7d74ae2a2bbbe30489cdbb9158d6da |
|||
Preview scriptFirst 1,000 lines of the extracted script
function TFAuto(u,f,n,auto)
{
var i=0,j,t,s="",m="",l,e,b,c;
calculateNow();
if ("undefined" != typeof TF_REQIURED) m=TF_REQIURED;
else m="The required field '%s' was found empty during export!";
if ("undefined" != typeof TF_ENTRY_ARRAY) {
for(;i<TF_ENTRY_ARRAY.length;i++) {
j=0;b=0;c=0;sc=0;
if (TF_ENTRY_ARRAY[i].indexOf("%s") == -1) c=1;
if (c && TF_ENTRY_ARRAY[i].indexOf("@") == -1) { c=0;sc=1};
if (!sc) {
while(1) {
l="";
if (j < 100) l+="0";
if (j < 10) l+="0";
l+=j.toString();
if (c) {
e=util.printf("%s.%d", TF_ENTRY_ARRAY[i], j);
}
else e=util.printf(TF_ENTRY_ARRAY[i],l);
t=this.getField(e);
if(!t) {
if (j==0) b=1;
break;
}
if (t.value.toString() != "Off") { b=1; break;}
j++;
}
} else {
t=this.getField(TF_ENTRY_ARRAY[i]);
if (!t) { b=1; }
if (t.value.toString() != "Off") { b=1;}
}
if (!b) {
if (sc) e = TF_ENTRY_ARRAY[i];
else if (c) e=util.printf("%s.0", TF_ENTRY_ARRAY[i]);
else e=util.printf(TF_ENTRY_ARRAY[i],"000");
t=this.getField(e);
if(t) {
if (!t.userName || t.userName.length == 0) s=util.printf(m,t.name);
else s=util.printf(m,t.userName);
app.alert(s);
}
return 0;
}
}
}
for (i=0; i < this.numFields; i++) {
t=this.getField(this.getNthFieldName(i));
if (!t || t.name.indexOf("@") == 0) continue;
if (!t.required) continue;
if (t.type=="button") continue;
if (t.name=="recipient" || t.name=="TFRVrecipient") continue;
if (t.value.toString().length==0 || ((t.type=="checkbox" || t.type=="radiobutton") && (t.value.toString() == "Off"))) {
if (!t.userName || t.userName.length == 0) s=util.printf(m,t.name);
else s=util.printf(m,t.userName);
app.alert(s);
return 0;
}
}
if (auto==0) {
if (app.viewerType != "Exchange" && !this.external) {
if ("undefined" != typeof TF_SUBMIT_NOT_AVAILABLE) app.alert(TF_SUBMIT_NOT_AVAILABLE);
else app.alert("This operation can only be used when \n Acrobat Reader is running inside a web browser!");
} else this.submitForm(u,f,0);
} else if (auto==1) {
return TFEmail(n);
} else {
if ((typeof app.formsVersion=="undefined" || app.formsVersion<3.5) || this.external) {
this.submitForm(u,f,0);
}
else return TFEmail(n);
}
return 1;
}
|
|||
javascript_obj0072_016.js |
pdf-javascript-stream | PDF /JS object 72 at offset 0x1B9F9 | 1278 bytes |
SHA-256: 3c4718d5b4722e6302a5956d94c9292ffa8bca5b293d7b4d2fb92ad68b7a1803 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function TFANP(bv,bf,bn,bc)
{
var i=0,v,vl,dv="",s=0,bi,f=event.target;
if (bc) dv=f.defaultValue.toString();
if (bf) vl=event.value.toString();
else vl=AFMergeChange(event);
if (!event.rc) return;
bi=(f.textFont!=font.Cour);
v=vl;
if (bn && !bi) {
if (bf) {
for(v=""; i < (f.charLimit-vl.length); i++) v+=" ";
v+=vl; i=0;
}
s=v.length-dv.length;
}
if (bv && dv.length) {
if (v.length < dv.length) event.rc=0;
if (((!bn||bi) && v.indexOf(dv) != s) || ((bn && !bi) && v.lastIndexOf(dv) != s)) event.rc=0;
}
if (!event.rc && app.calculate) app.beep(0);
if (bf && !bi) {
event.value="";
if (!bn) {
for(;i < dv.length; i++) event.value+=" ";
if (v.length > dv.length) event.value+=v.substring(dv.length,v.length);
} else {
if (v.length > dv.length) event.value+=v.substring(0,v.length-dv.length);
for (; i < dv.length; i++) event.value+=" ";
}
}
if (bi && event.willCommit) {
if (event.value.toString().length > 0) f.bgColor=color.white;
else f.bgColor=color.transparent;
}
}
var TF_SPECIAL="@#$%&()*+-,./;:";
if(!TF_ALPHA||!TF_ALPHA.length)
TF_ALPHA=" ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz�������������������������������������������������������������\r\n";
|
|||
javascript_obj0075_017.js |
pdf-javascript-stream | PDF /JS object 75 at offset 0x1BD2C | 1958 bytes |
SHA-256: 5d382703ccf55b94ad2dc8ae8af807385f94188aa2665d13e8c6b61957f5154f |
|||
Preview scriptFirst 1,000 lines of the extracted script
TF_RESET_ARRAY=new Array();
function TFOpen()
{
var f,a,i=0,j, req_ver = 3.5;
var b=this.getField("@adobe_link"), s=this.getField("@SubmitIt"), msg = "";
var fwdBtn = this.getField("@ForwardIt");
if ("undefined" != TF_REQUIRED_VERSION) req_ver = TF_REQUIRED_VERSION;
if (b&&!b.hidden) {
app.calculate=0;
if (typeof app.formsVersion == "undefined" || app.formsVersion < req_ver) {
if ("undefined" != TF_REQUIRED_VERSION_MSG) {
msg = util.printf(TF_REQUIRED_VERSION_MSG, req_ver);
} else {
msg = util.printf("You don't have the Forms plug-in ver. %.2f update needed for this file!", req_ver);
}
app.alert(msg);
} else {
b.hidden=1;
if (typeof TF_RESET_ARRAY != "undefined") {
for(i=0;i < TF_RESET_ARRAY.length; i++) {
f=this.getField(TF_RESET_ARRAY[i].toString());
if (!f) continue;
f.delay=1;
a=0;
if (f.name.indexOf("@") == 0) a = f.getArray();
if (a && a.length > 0) {
for(j=0; j < a.length; j++) {
if (a[j].defaultValue.toString().length > 0) { a[j].value = ""; a[j].value = a[j].defaultValue.toString(); }
else { a[j].value = "1"; a[j].value = ""; }
}
}
f.delay=0;
}
}
if (typeof TF_READONLY_ARRAY != "undefined") {
for(i=0;i < TF_READONLY_ARRAY.length; i++) {
f=this.getField(TF_READONLY_ARRAY[i].toString());
if (!f) continue;
f.readonly = true;
}
}
if (s) s.hidden=0;
app.calculate=1; this.dirty=0;
if (fwdBtn || typeof TF_SIG_ARRAY != "undefined") {
if(typeof app.formsVersion=="undefined" || app.formsVersion < 4.05 || app.viewerType != "Exchange") {
if ("undefined" != typeof TF_MAIL_NOT_AVAILABLE) {
app.alert(TF_MAIL_NOT_AVAILABLE);
} else {
app.alert("You need Adobe Acrobat 4.x or higher (not Reader) to use an e-mail!");
}
}
}
}
}
}
|
|||
javascript_obj0078_018.js |
pdf-javascript-stream | PDF /JS object 78 at offset 0x1C0C4 | 2807 bytes |
SHA-256: 8b78b88fd2bcbde72bb65ffc33990ae260d751b48cd0f040b5e653fcdcb4938b |
|||
Preview scriptFirst 1,000 lines of the extracted script
var aTFReadOnly = new Array( "@@@SKFI0", "@@@SKFI1"
, "@@@SKFI2"
, "b12c96nfSig"
, "@@b12c96nfB22_59.0"
, "@@b12c96nfB22_59.1"
, "@@b12c96nfB22_59.2"
, "@@b12c96nfB22_58.0"
, "@@b12c96nfB22_58.1"
, "@@b12c96nfB22_58.2"
, "@@b12c96nfB22_55.0", "@@b12c96nfB22_55.1"
, "@@b12c96nfB22_55.2"
, "@@b12c96nfB22_54.0"
, "@@b12c96nfB22_54.1"
, "@@b12c96nfB22_54.2"
, "@@b12c96nfB22_51.0"
, "@@b12c96nfB22_51.1"
, "@@b12c96nfB22_51.2"
, "@@b12c96nfB22_50.0"
, "@@b12c96nfB22_50.1", "@@b12c96nfB22_50.2"
, "@@b12c96nfB22_47.0"
, "@@b12c96nfB22_47.1"
, "@@b12c96nfB22_47.2"
, "@@b12c96nfB22_46.0"
, "@@b12c96nfB22_46.1"
, "@@b12c96nfB22_46.2"
, "@@b12c96nfB22_43.0"
, "@@b12c96nfB22_43.1"
, "@@b12c96nfB22_43.2", "@@b12c96nfB22_42.0"
, "@@b12c96nfB22_42.1"
, "@@b12c96nfB22_42.2"
, "@@b12c96nfB22_39.0"
, "@@b12c96nfB22_39.1"
, "@@b12c96nfB22_39.2"
, "@@b12c96nfB22_38.0"
, "@@b12c96nfB22_38.1"
, "@@b12c96nfB22_38.2"
, "@@b12c96nfB22_35.0", "@@b12c96nfB22_35.1"
, "@@b12c96nfB22_35.2"
, "@@b12c96nfB22_34.0"
, "@@b12c96nfB22_34.1"
, "@@b12c96nfB22_34.2"
, "@@b12c96nfB22_31.0"
, "@@b12c96nfB22_31.1"
, "@@b12c96nfB22_31.2"
, "@@b12c96nfB22_30.0"
, "@@b12c96nfB22_30.1", "@@b12c96nfB22_30.2"
, "@@b12c96nfB22_27.0"
, "@@b12c96nfB22_27.1"
, "@@b12c96nfB22_27.2"
, "@@b12c96nfB22_26.0"
, "@@b12c96nfB22_26.1"
, "@@b12c96nfB22_26.2"
, "@@b12c96nfB22_23.0"
, "@@b12c96nfB22_23.1"
, "@@b12c96nfB22_23.2", "@@b12c96nfB22_22.0"
, "@@b12c96nfB22_22.1"
, "@@b12c96nfB22_22.2"
, "@@b12c96nfB22_19.0"
, "@@b12c96nfB22_19.1"
, "@@b12c96nfB22_19.2"
, "@@b12c96nfB22_18.0"
, "@@b12c96nfB22_18.1"
, "@@b12c96nfB22_18.2"
, "@@b12c96nfB22_15.0", "@@b12c96nfB22_15.1"
, "@@b12c96nfB22_15.2"
, "@@b12c96nfB22_14.0"
, "@@b12c96nfB22_14.1"
, "@@b12c96nfB22_14.2"
, "@@b12c96nfB22_11.0"
, "@@b12c96nfB22_11.1"
, "@@b12c96nfB22_11.2"
, "@@b12c96nfB22_10.0"
, "@@b12c96nfB22_10.1", "@@b12c96nfB22_10.2"
, "@@b12c96nfB22_07.0"
, "@@b12c96nfB22_07.1"
, "@@b12c96nfB22_07.2"
, "@@b12c96nfB22_06.0"
, "@@b12c96nfB22_06.1"
, "@@b12c96nfB22_06.2"
, "@@b12c96nfB22_03.0"
, "@@b12c96nfB22_03.1"
, "@@b12c96nfB22_03.2", "@@b12c96nfB22_02.0"
, "@@b12c96nfB22_02.1"
, "@@b12c96nfB22_02.2"
);
TF_SIG_ARRAY=new Array("@b12c96nfSig");
function TFSigOpen()
{
var submitBtn = this.getField( "@SubmitIt" );
var sDate = new Date();
TFOpen()
if (typeof TF_SIG_ARRAY != "undefined") {
for (i = 0; i < TF_SIG_ARRAY.length; i++) {
f = this.getField( TF_SIG_ARRAY[i].toString() );
if (f && f.value == "") {
TF_SIG_LOCK += Date.parse( sDate.toLocaleString() ).toString();
global[TF_SIG_LOCK] = false;
break;
}
}
if (typeof global[TF_SIG_LOCK] == "undefined" && submitBtn) {
submitBtn.readonly = 1;
this.dirty = 0;
}
}
}
|
|||
javascript_obj0081_019.js |
pdf-javascript-stream | PDF /JS object 81 at offset 0x1C3DB | 365 bytes |
SHA-256: 07707251746d909fbaaac180bbb1c38ba5d42d3c8ee80b844efbc76a1050da70 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function TFNK(bs,bt,bc)
{
var i=0,v=AFMergeChange(event);
if (bs && !bt) AFNumber_Keystroke(0,0,0,0,"",1);
else {
for(;i < v.length; i++) {
if (v[i] >= '0' && v[i] <= '9') continue;
if (bs && TF_SPECIAL.indexOf(v[i]) != -1) continue;
event.rc=0;
if (app.calculate) app.beep(0);
break;
}
}
if (event.rc) TFANP(1,0,!bt,bc);
}
|
|||
javascript_obj0084_020.js |
pdf-javascript-stream | PDF /JS object 84 at offset 0x1C575 | 829 bytes |
SHA-256: 77468418a7c15cf66abc810fe1bcdbbdf9e389ec97f8cde200a0fed65c7f1ca7 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function TFST(f,n)
{
var v1,v,n1="",n2="",l,nm=v=l="",j=n.indexOf("e"),i;
if (j==-1) return;
n1=n.substring(0,++j);
n2=n.substring(j+3,n.length);
i=j=0;
for(; i < f.length; i++) {
if (f[i]=='z') {
v1=l="";
if (j < 100) l+="0";
if (j < 10) l+="0";
nm=n1+l+j.toString()+n2;
v1=this.getField(nm).value.toString();
if (v1 != "Off") v+=v1;
else v+=" ";
j++; continue;
}
if (f[i]=='~' && ++i < f.length) v+=f[i].toString();
}
this.getField("@"+n1+"@@@"+n2).value=v;
}
function TFConstrShow()
{
if (typeof app.formsVersion != "undefined" && app.formsVersion > 4)
event.target.fillColor = color.white;
}
function TFConstrHide()
{
if (typeof app.formsVersion != "undefined" && app.formsVersion > 4)
event.target.fillColor = color.transparent;
}
|
|||
javascript_obj0087_021.js |
pdf-javascript-stream | PDF /JS object 87 at offset 0x1C7A6 | 1656 bytes |
SHA-256: 86b34d7cd1185ba895e901fbca0e6b245a7778f87f0b60b5df4482db1200d384 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function TFT(f,bc)
{
var dv,i=0,j=0,c,r=1,vl=dv="",v=AFMergeChange(event),l,ss=event.selStart,lf=f.length,ec=event.change.toString();
if (bc) dv=event.target.defaultValue.toString();
l= v.length;
if (!l && !dv.length) return;
if (l > lf) { event.rc=0; if (app.calculate) app.beep(0); return; }
for (; j < l && i < lf; i++,j++) {
c=v[j];
if (f[i]=='X' && (c<'0'||c>'9') && TF_ALPHA.indexOf(c)==-1) { r=!r; break; }
if (f[i]=='S' && TF_SPECIAL.indexOf(c)==-1) { r=!r; break; }
if (f[i]=='N' && (c<'0'||c>'9')) { r=!r; break; }
if ((f[i]=='A'||f[i]=='U'||f[i]=='L') && TF_ALPHA.indexOf(c)==-1) { r=!r; break; }
if (f[i]=='U') { vl+=c.toString().toUpperCase(); continue; }
if (f[i]=='L') { vl+=c.toString().toLowerCase(); continue; }
if (f[i]=='~') {
i++;
if (i > lf) { r=!r; break; }
if (f[i] != c) {
if (c.toString().toUpperCase()==f[i].toString().toUpperCase() && f[i].toString().toUpperCase()==f[i].toString()) {
vl+=c.toString().toUpperCase();continue;
}
if (c.toString().toLowerCase()==f[i].toString().toLowerCase() && f[i].toString().toLowerCase()==f[i].toString()) {
vl+=c.toString().toLowerCase();continue;
}
r=!r; break;
}
}
vl+=c.toString();
}
if (r && (ss + ec.length) == l && (event.value.toString().length <= l || ss!=event.selEnd-1)) {
while (1) {
if (i < lf && f[i]=='~' && ++i < lf) {
event.change+=f[i++].toString();
} else {
break;
}
}
}
if (r) {
TFANP(1,0,0,bc);
if (!event.rc) r=!r;
}
if (!r) {
if (app.calculate) app.beep(0);
event.rc=0;
} else if (event.willCommit) event.value=vl;
}
|
|||
javascript_obj0090_022.js |
pdf-javascript-stream | PDF /JS object 90 at offset 0x1CAA4 | 631 bytes |
SHA-256: 760e944e7e46e3092e1dc3a425d8ca0ca7fc183ce551abb7d05fd4a6c83f358a |
|||
Preview scriptFirst 1,000 lines of the extracted script
function TFTF(f,bc)
{
var n=event.target.name,nm="@@"+n,i=0,k=0,v="",a=0,fl=this.getField(nm),vl;
if (fl) a = fl.getArray();
TFANP(0,1,0,bc);
vl=event.value.toString();
for (; i < f.length; i++) {
if (f[i]=='S'||f[i]=='N'||f[i]=='X'||f[i]=='A'||f[i]=='U'||f[i]=='L') {
if (k < vl.length) v+=vl[k++].toString();
else v+=" ";
} else {
if(f[i]=='~') continue;
else k++;
}
}
for (i=0; i < a.length; i++) {
fl = this.getField(nm + "." + i);
if (fl) fl.defaultValue = fl.value = v.substring(0,fl.charLimit);
v=v.substring(fl.charLimit,v.length);
}
event.value = "";
}
|
|||
javascript_obj0093_023.js |
pdf-javascript-stream | PDF /JS object 93 at offset 0x1CC94 | 299 bytes |
SHA-256: 8e3ba51bc83b2f9b72901e1bdab10e0359724e263e39ab4782ed2172eeaf60d1 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function TFNF(bc)
{
var i=0,v="",c=event.value.toString(),t=event.target;
if (t.textFont!=font.Cour) {
if (c.length > 0) t.bgColor=color.white;
else t.bgColor=color.transparent;
return;
}
for (; i< (t.charLimit-c.length); i++) v+=" ";
v+=c; event.value=v;
TFANP(0,1,1,bc);
}
|
|||
javascript_obj0096_024.js |
pdf-javascript-stream | PDF /JS object 96 at offset 0x1CE04 | 1615 bytes |
SHA-256: 6c960f0df22dcb3ee28d79851a53dc3f63927d02b55449393dd60e1e8e50b99b |
|||
Preview scriptFirst 1,000 lines of the extracted script
function TFEmail(n)
{
var msg = "";
if (typeof app.formsVersion=="undefined"
||
app.formsVersion < 3.5
||
(n == 1 && app.formsVersion < 4.05)
||
app.viewerType != "Exchange")
{
if ("undefined" != typeof TF_MAIL_NOT_AVAILABLE) {
app.alert(TF_MAIL_NOT_AVAILABLE);
} else {
app.alert("You need Adobe Acrobat 4.x or higher (not Reader) to use an e-mail!");
}
return 0;
}
var t,i=0,body="",to,f=this.getField("recipient"),bUI=0,s="TF Email",val="";
if (!f) f=this.getField("TFRVrecipient");
if (f) to=f.value.toString();
else { to=""; bUI=1; }
for (; i < this.numFields; i++) {
t=this.getField(this.getNthFieldName(i));
if (!t || t.name.indexOf("@") == 0) continue;
if (t.type=="button" || !t.value || t.value.toString().length==0) continue;
if (t.name=="recipient") continue;
if ((t.type=="checkbox" || t.type=="radiobutton") && (t.value=="Off")) continue;
if (typeof t.valueAsString == "string")
val = t.valueAsString;
else
val = t.value.toString();
body += t.name + "=" + val + "\n";
}
if (body.length==0) return 0;
if (n==0) app.mailMsg(bUI,to,"","",s,body);
if (n==1) this.mailDoc(bUI,to,"","",s,body);
if (n==2) this.mailForm(bUI,to,"","",s,body);
if ("undefined" != typeof TF_EMAIL_NOTE) app.alert(TF_EMAIL_NOTE,1);
else app.alert("Your form will be sent via E-mail. You may check the 'Sent' folder of your E-mail program to verify that the form was sent.",1);
return 1;
}
|
|||
javascript_obj0099_025.js |
pdf-javascript-stream | PDF /JS object 99 at offset 0x1D163 | 183 bytes |
SHA-256: a59d06e64edf5385b5548ecdb40fe2cfdb70398b3ca0574fa36b51394fee4ddf |
|||
Preview scriptFirst 1,000 lines of the extracted script
function TFUp(b)
{
if (event.rc && event.willCommit) {
if (b) event.value=event.value.toString().toUpperCase();
else event.value=event.value.toString().toLowerCase();
}
}
|
|||
javascript_obj0102_026.js |
pdf-javascript-stream | PDF /JS object 102 at offset 0x1D274 | 262 bytes |
SHA-256: 5dc825a345efe5e078ad9ec1684ba5d192fdd7934134de2e788cee9f8b089aac |
|||
Preview scriptFirst 1,000 lines of the extracted script
function TFAN()
{
var i=0,v=AFMergeChange(event);
if (!v.length || !event.rc) return;
for(;i < v.length; i++) {
if ((v[i] >= '0' && v[i] <= '9')||TF_ALPHA.indexOf(v[i]) != -1) continue;
event.rc=0;
if (app.calculate) app.beep(0);
break;
}
}
|
|||
javascript_obj0105_027.js |
pdf-javascript-stream | PDF /JS object 105 at offset 0x1D3DE | 928 bytes |
SHA-256: 2b071df929c05654f72077c7ee065adf5737ae835836e3c7519c4eaa6efbe205 |
|||
Preview scriptFirst 1,000 lines of the extracted script
// Alpha - only keystroke
// b - special chars OK/NO
// bc - check force prefill.
function TFAK(b,bc)
{
var i=0,ec=event.change.toString(),c;
for (; i <ec.length; i++) {
c=ec[i];
if (b && TF_SPECIAL.indexOf(c) != -1) continue;
if (TF_ALPHA.indexOf(c) == -1) { event.rc=0; if (app.calculate) app.beep(0); break; }
}
TFANP(1,0,0,bc);
}
// Alpha - only validation
// b - special chars OK/NO
// bc - check force prefill.
function TFAV(b,bc)
{
var i=0,ev=event.value.toString(),c;
for (; i < ev.length && event.rc; i++) {
c=ev[i];
if (b && TF_SPECIAL.indexOf(c) != -1) continue;
if (TF_ALPHA.indexOf(c) == -1) { event.rc=0; break; }
}
if (bc && event.rc) {
var dv=event.target.defaultValue.toString();
if (dv.length) {
if (ev.length < dv.length) event.rc=0;
if (ev.indexOf(dv) != 0) event.rc=0;
}
}
if (!event.rc && app.calculate) app.beep(0);
}
|
|||
javascript_obj0108_028.js |
pdf-javascript-stream | PDF /JS object 108 at offset 0x1D5FF | 629 bytes |
SHA-256: d50a77f1aae5efdef2cc9d7f5a5866c710aa5947ec224d097022d5a53889021a |
|||
Preview scriptFirst 1,000 lines of the extracted script
function TFSignature_Format( sField, sValue, bLock, cOperation, cFields )
{
var f = this.getField( sField );
if (f) {
if (event.value != "") {
f.value = sValue;
} else {
f.value = "";
}
}
if (bLock) {
AFSignature_Format( cOperation, cFields );
//
// restore read only fields
//
for (i = 0; i < aTFReadOnly.length; i++) {
var f = this.getField(aTFReadOnly[i] );
if (f == null) {
continue;
}
var a = f.getArray();
for (var j = 0; j < a.length; j++) {
a[j].readonly = true;
}
}
}
}
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.