Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d07a866a5ca2247…

MALICIOUS

PDF

146.3 KB Authoring application: Cirali Output Manager B1-23 http://www.fjd.de (via cirali-pdf B1-45 http://www.fjd.de) First seen: 2026-05-10
MD5: 1d4aa84249b4f471efa664715080a923 SHA-1: 81ff6e3195a98ca98604bfe11ca97d32ebf6931d SHA-256: 8d07a866a5ca2247ad56be997547c63a75b4136a8ca633d5725d52400f523bec
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams and associated actions, indicating a malicious intent. The presence of PDF_JAVASCRIPT and PDF_JS heuristics strongly suggests that the embedded scripts are designed to execute arbitrary code. While the specific actions of the scripts are not fully detailed, their presence in conjunction with the 'suspicious' verdict points towards a downloader or exploit delivery mechanism. The embedded URL http://www.fjd.de is likely part of this malicious chain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9449

Heuristics 6

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.fjd.de In PDF document text
    • http://www.fjd.de)/CreatorIn PDF document text
    • http://www.fjd.de)/AuthorIn PDF document text

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0002_000.js pdf-javascript-stream PDF /JS object 2 at offset 0x10D 449 bytes
SHA-256: 227ca46bb27e6d02fc509d522435c3c917f7409b7380571752f9579fd7d8fea5
Preview script
First 1,000 lines of the extracted script
var n = this.numFields;
var f;
var fn;
for(var i=0;i<n;i++)
{
   fn = this.getNthFieldName(i);
   if(""==fn) continue;

   f = this.getField(fn);
   if(null==f) continue;
   if("button"==f.type)continue;

   SYS_FILL(f,color.transparent);


   if("checkbox"==f.type)
   { f.style=style.cr;
     f.strokeColor=getBorderColor(fn);
   }
   else
   {    if(""+f.strokeColor!=""+color.transparent)
   		{  f.strokeColor=color.transparent;
   		}
   }
}
javascript_obj0019_002.js pdf-javascript-stream PDF /JS object 19 at offset 0x5116 172 bytes
SHA-256: 8cc2b8fed26bfd6bfd0e9390d61d0b1f0ddfa7085457fab06e3c2ebc31556cdb
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
  var strZiffern="0123456789";  
   if(-1 == strZiffern.indexOf(event.change))
   {       app.beep(0);event.rc=false;
   }
}
javascript_obj0040_004.js pdf-javascript-stream PDF /JS object 40 at offset 0x670A 1298 bytes
SHA-256: 333bd627679ccfe5a8c1374623d5b90aeb913b32d8ff912b5f89f994a0764d5c
Detection
ClamAV: No threats found
Obfuscation or payload: likely
42 of 43 identifiers look randomly generated (e.g. 'SYS_CB_OBJ71') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
if(event.source)
{ var n=event.source.name;
if(n=="OBJ1")SYS_CB_OBJ1();
if(n=="OBJ2")SYS_CB_OBJ2();
if(n=="OBJ7")SYS_CB_OBJ7();
if(n=="OBJ8")SYS_CB_OBJ8();
if(n=="OBJ10")SYS_CB_OBJ10();
if(n=="OBJ11")SYS_CB_OBJ11();
if(n=="OBJ13")SYS_CB_OBJ13();
if(n=="OBJ14")SYS_CB_OBJ14();
if(n=="OBJ16")SYS_CB_OBJ16();
if(n=="OBJ17")SYS_CB_OBJ17();
if(n=="OBJ19")SYS_CB_OBJ19();
if(n=="OBJ20")SYS_CB_OBJ20();
if(n=="OBJ22")SYS_CB_OBJ22();
if(n=="OBJ23")SYS_CB_OBJ23();
if(n=="OBJ25")SYS_CB_OBJ25();
if(n=="OBJ26")SYS_CB_OBJ26();
if(n=="OBJ28")SYS_CB_OBJ28();
if(n=="OBJ29")SYS_CB_OBJ29();
if(n=="OBJ31")SYS_CB_OBJ31();
if(n=="OBJ32")SYS_CB_OBJ32();
if(n=="OBJ36")SYS_CB_OBJ36();
if(n=="OBJ38")SYS_CB_OBJ38();
if(n=="OBJ39")SYS_CB_OBJ39();
if(n=="OBJ33")SYS_CB_OBJ33();
if(n=="OBJ34")SYS_CB_OBJ34();
if(n=="OBJ35")SYS_CB_OBJ35();
if(n=="OBJ40")SYS_CB_OBJ40();
if(n=="OBJ41")SYS_CB_OBJ41();
if(n=="OBJ42")SYS_CB_OBJ42();
if(n=="OBJ43")SYS_CB_OBJ43();
if(n=="OBJ45")SYS_CB_OBJ45();
if(n=="OBJ47")SYS_CB_OBJ47();
if(n=="OBJ49")SYS_CB_OBJ49();
if(n=="OBJ50")SYS_CB_OBJ50();
if(n=="OBJ70")SYS_CB_OBJ70();
if(n=="OBJ71")SYS_CB_OBJ71();
if(n=="OBJ72")SYS_CB_OBJ72();
if(n=="OBJ73")SYS_CB_OBJ73();
if(n=="OBJ75")SYS_CB_OBJ75();
if(n=="OBJ77")SYS_CB_OBJ77();
if(n=="OBJ79")SYS_CB_OBJ79();
if(n=="OBJ80")SYS_CB_OBJ80();
}
javascript_obj0058_006.js pdf-javascript-stream PDF /JS object 58 at offset 0x7DD5 264 bytes
SHA-256: 2ca5f896ddb524115f411b81705017d1a0ad72d3a2b4c8fc2ce2eb602ac69267
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
AFDate_FormatEx("dd.mm.yyyy");
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0058_007.js pdf-javascript-stream PDF /JS object 58 at offset 0x7DD5 294 bytes
SHA-256: 7097080df016f1b41747ea27659445277babb3bd57e084e959e7f0194ae386db
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
  var c=event.change;
   var success=1;
   if( ((c<"0") || (c>"9")) && (c!=".") )
   {       success=0;
   }
   if(event.value.length>9)
   {       success=0;
   }
   if(0==success)
   {       app.beep(0);
           event.rc=false;
   }       
}
javascript_obj0058_008.js pdf-javascript-stream PDF /JS object 58 at offset 0x7DD5 436 bytes
SHA-256: ccd06df5c7564a65249a403c0814d380ed6a98208bab9228b6d196de20494d9e
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0058_009.js pdf-javascript-stream PDF /JS object 58 at offset 0x7DD5 158 bytes
SHA-256: fb9d7ddc44b866c21e006f356fc29d6871b9d2c20382f8e84c0b557ce25b4057
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
AFDate_FormatEx("dd.mm.yyyy");
}if(false==event.rc
javascript_obj0058_010.js pdf-javascript-stream PDF /JS object 58 at offset 0x7DD5 330 bytes
SHA-256: aaae3ab489cd132eee2eee63d623ef1847a3dd91ccc6336b54458acb205dd966
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}if(false==event.rc
javascript_obj0256_042.js pdf-javascript-stream PDF /JS object 256 at offset 0x1AEDC 994 bytes
SHA-256: dcbff5aa575e78f90b827166f7b06fc1fcc4c817f074c2fc532f82d433a2f6af
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if(date) 
   {       var DatumVonHeute= new Date();          
           var DatumVonMorgen= new Date();         
           DatumVonMorgen.setDate(DatumVonMorgen.getDate()+1);
           if(date.valueOf()<DatumVonMorgen.valueOf())
           {       var strMorgen=util.printd("dd.mm.yyyy",DatumVonMorgen);
                   app.alert("Bitte geben Sie ein Datum ein, das in der Zukunft - ab Morgen - liegt.\rMorgen haben wir den "+strMorgen+".\rDaher w�re das Datum "+strMorgen+" das erste g�ltige Datum.");
                   event.rc=false;
           }
   }
   else
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0256_043.js pdf-javascript-stream PDF /JS object 256 at offset 0x1AEDC 888 bytes
SHA-256: 75c94c381570726081e998e23dfd43e06a485d4624adbe8b3c7c7b31b0e65092
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if(date) 
   {       var DatumVonHeute= new Date();          
           var DatumVonMorgen= new Date();         
           DatumVonMorgen.setDate(DatumVonMorgen.getDate()+1);
           if(date.valueOf()<DatumVonMorgen.valueOf())
           {       var strMorgen=util.printd("dd.mm.yyyy",DatumVonMorgen);
                   app.alert("Bitte geben Sie ein Datum ein, das in der Zukunft - ab Morgen - liegt.\rMorgen haben wir den "+strMorgen+".\rDaher w�re das Datum "+strMorgen+" das erste g�ltige Datum.");
                   event.rc=false;
           }
   }
   else
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}if(false==event.rc
javascript_obj0303_053.js pdf-javascript-stream PDF /JS object 303 at offset 0x1ED72 4654 bytes
SHA-256: 6e5ff75b5183fc30b06110381a8c0ca5ae3286ba346902fc30d9e9a8b9fa6fc7
Preview script
First 1,000 lines of the extracted script
function getBgColor(fn){
var BG_DISABLED=["RGB",0.749,0.749,0.749];
var BG_78=["RGB",1.0,1.0,0.502];
if(fn=="Name_Vorname_Dienst_Amtsbezeichnung2") return BG_78;
if(fn=="Anschrift.Name1") return BG_78;
if(fn=="Anschrift.Name") return BG_78;
if(fn=="Anschrift.Strasse") return BG_78;
if(fn=="Anschrift.Postleitzahl") return BG_78;
if(fn=="Anschrift.Ort") return BG_78;
if(fn=="Bearbeitet_von") return BG_78;
if(fn=="Mitarbeiter.Email4") return BG_78;
if(fn=="OBJ Bezugszeichenzeile1") return BG_78;
if(fn=="OBJ60") return BG_78;
if(fn=="OBJ82") return BG_78;
if(fn=="OBJ83") return BG_78;
if(fn=="Ihr_Zeichen_Ihre_Nachricht_vom1") return BG_78;
if(fn=="OBJ1") return BG_78;
if(fn=="OBJ2") return BG_78;
if(fn=="Name_Vorname_Dienst_Amtsbezeichnung") return BG_78;
if(fn=="OBJ3") return BG_78;
if(fn=="OBJ4") return BG_78;
if(fn=="OBJ5") return BG_78;
if(fn=="OBJ6") return BG_78;
if(fn=="dienst_arbeitsunfaehig_von") return BG_78;
if(fn=="dienst_arbeitsunfaehig_bis") return BG_78;
if(fn=="Wiederaufnahme_des_Dienstes_am") return BG_78;
if(fn=="OBJ7") return BG_78;
if(fn=="OBJ8") return BG_78;
if(fn=="OBJ9") return BG_78;
if(fn=="ausgefallene_Unterrichtsstunden") return BG_78;
if(fn=="dienst_arbeitsunfaehig_von1") return BG_78;
if(fn=="dienst_arbeitsunfaehig_bis1") return BG_78;
if(fn=="Wiederaufnahme_des_Dienstes_am1") return BG_78;
if(fn=="OBJ10") return BG_78;
if(fn=="OBJ11") return BG_78;
if(fn=="OBJ12") return BG_78;
if(fn=="ausgefallene_Unterrichtsstunden1") return BG_78;
if(fn=="dienst_arbeitsunfaehig_von2") return BG_78;
if(fn=="dienst_arbeitsunfaehig_bis2") return BG_78;
if(fn=="Wiederaufnahme_des_Dienstes_am2") return BG_78;
if(fn=="OBJ13") return BG_78;
if(fn=="OBJ14") return BG_78;
if(fn=="OBJ15") return BG_78;
if(fn=="ausgefallene_Unterrichtsstunden2") return BG_78;
if(fn=="dienst_arbeitsunfaehig_von3") return BG_78;
if(fn=="dienst_arbeitsunfaehig_bis3") return BG_78;
if(fn=="Wiederaufnahme_des_Dienstes_am3") return BG_78;
if(fn=="OBJ16") return BG_78;
if(fn=="OBJ17") return BG_78;
if(fn=="OBJ18") return BG_78;
if(fn=="ausgefallene_Unterrichtsstunden3") return BG_78;
if(fn=="dienst_arbeitsunfaehig_von4") return BG_78;
if(fn=="dienst_arbeitsunfaehig_bis4") return BG_78;
if(fn=="Wiederaufnahme_des_Dienstes_am4") return BG_78;
if(fn=="OBJ19") return BG_78;
if(fn=="OBJ20") return BG_78;
if(fn=="OBJ21") return BG_78;
if(fn=="ausgefallene_Unterrichtsstunden4") return BG_78;
if(fn=="dienst_arbeitsunfaehig_von5") return BG_78;
if(fn=="dienst_arbeitsunfaehig_bis5") return BG_78;
if(fn=="Wiederaufnahme_des_Dienstes_am5") return BG_78;
if(fn=="OBJ22") return BG_78;
if(fn=="OBJ23") return BG_78;
if(fn=="OBJ24") return BG_78;
if(fn=="ausgefallene_Unterrichtsstunden5") return BG_78;
if(fn=="dienst_arbeitsunfaehig_von6") return BG_78;
if(fn=="dienst_arbeitsunfaehig_bis6") return BG_78;
if(fn=="Wiederaufnahme_des_Dienstes_am6") return BG_78;
if(fn=="OBJ25") return BG_78;
if(fn=="OBJ26") return BG_78;
if(fn=="OBJ27") return BG_78;
if(fn=="ausgefallene_Unterrichtsstunden6") return BG_78;
if(fn=="dienst_arbeitsunfaehig_von7") return BG_78;
if(fn=="dienst_arbeitsunfaehig_bis7") return BG_78;
if(fn=="Wiederaufnahme_des_Dienstes_am7") return BG_78;
if(fn=="OBJ28") return BG_78;
if(fn=="OBJ29") return BG_78;
if(fn=="OBJ30") return BG_78;
if(fn=="ausgefallene_Unterrichtsstunden7") return BG_78;
if(fn=="OBJ31") return BG_78;
if(fn=="OBJ32") return BG_78;
if(fn=="OBJ36") return BG_78;
if(fn=="OBJ38") return BG_78;
if(fn=="OBJ39") return BG_78;
if(fn=="OBJ33") return BG_78;
if(fn=="OBJ34") return BG_78;
if(fn=="OBJ35") return BG_78;
if(fn=="OBJ37") return BG_78;
if(fn=="Name_Vorname_Dienst_Amtsbezeichnung1") return BG_78;
if(fn=="Unterschrift1") return BG_78;
if(fn=="Landesschulbehoerde") return BG_78;
if(fn=="OBJ40") return BG_78;
if(fn=="OBJ41") return BG_78;
if(fn=="OBJ42") return BG_78;
if(fn=="Massnahmen") return BG_78;
if(fn=="OBJ43") return BG_78;
if(fn=="OBJ44") return BG_78;
if(fn=="OBJ45") return BG_78;
if(fn=="OBJ46") return BG_78;
if(fn=="OBJ47") return BG_78;
if(fn=="OBJ48") return BG_78;
if(fn=="OBJ49") return BG_78;
if(fn=="OBJ51") return BG_78;
if(fn=="OBJ50") return BG_78;
if(fn=="OBJ86") return BG_78;
if(fn=="Pruefung") return BG_78;
if(fn=="OBJ70") return BG_78;
if(fn=="OBJ71") return BG_78;
if(fn=="OBJ72") return BG_78;
if(fn=="Massnahmen1") return BG_78;
if(fn=="OBJ73") return BG_78;
if(fn=="OBJ74") return BG_78;
if(fn=="OBJ75") return BG_78;
if(fn=="OBJ76") return BG_78;
if(fn=="OBJ77") return BG_78;
if(fn=="OBJ78") return BG_78;
if(fn=="OBJ79") return BG_78;
if(fn=="OBJ81") return BG_78;
if(fn=="OBJ80") return BG_78;
if(fn=="OBJ87") return BG_78;
    return color.transparent;}
javascript_obj0304_054.js pdf-javascript-stream PDF /JS object 304 at offset 0x20131 166 bytes
SHA-256: 9f51a81ea495069ac3bd65daf89fd1c4a332f6ab52c21e14c04ec2c85ecccdee
Preview script
First 1,000 lines of the extracted script
function getBorderColor(fn){
   var f = this.getField(fn);
   if((null!=f)&&("checkbox"==f.type))
   { return ["RGB",0.0,0.0,0.0];
   }
   return color.transparent;
}
javascript_obj0305_055.js pdf-javascript-stream PDF /JS object 305 at offset 0x20214 70 bytes
SHA-256: 68582c3b030f7ce77460540a7ea21e899d133ef6ae8330fbbb6a5db8d1040ccb
Preview script
First 1,000 lines of the extracted script
function SYS_FILL(f,c){
  if(""+f.fillColor!=""+c)  {f.fillColor=c;}}
javascript_obj0306_056.js pdf-javascript-stream PDF /JS object 306 at offset 0x2028D 251 bytes
SHA-256: 11a1bd3ed0d867a06a568a40ba9d93946c031e168697e359578f9ad5e75f7e59
Preview script
First 1,000 lines of the extracted script
function SYS_EWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0307_057.js pdf-javascript-stream PDF /JS object 307 at offset 0x203D4 251 bytes
SHA-256: b489e14c022670e263ade06b76d1f9a44446979ddfa4df58bed63e1e68ca6dfa
Preview script
First 1,000 lines of the extracted script
function SYS_AWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
 else
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
}
javascript_obj0308_058.js pdf-javascript-stream PDF /JS object 308 at offset 0x2051B 1417 bytes
SHA-256: e3050b0f0a40066c63f4a4d2a3fbd05f262ff454cf17fbbcfb1ccc59939ddf76
Preview script
First 1,000 lines of the extracted script
function SYS_ON_PAGE_OPEN()
{
        var n = this.numFields;
        var f;
        var fn;
        for(var i=0;i<n;i++)
        {
                fn = this.getNthFieldName(i);
                if( (""!=fn) && ("SYSTEM_P1_DUMMY"!=fn) )
                {
                        f = this.getField(fn);
                        if( (null!=f)&&((app.viewerVersion<6)||(f.page==this.pageNum))&&("button"!=f.type))
                        {
                                if("checkbox"==f.type)
                                { 
                                  f.style=style.cr;
                                }
                                if(f.readonly)
                                {
                                        if(f.readonly) SYS_FILL(f,["RGB",0.749,0.749,0.749]);
                                }
                                else
                                {
                                     SYS_FILL(f,getBgColor(fn));
                                }
                                if((f.required)&&(""==f.value))
                                {
                                        f.strokeColor=color.red;
                                }
                                else
                                {
                                   f.strokeColor=getBorderColor(fn);
                                }
                        }
                }
        }
}
javascript_obj0309_059.js pdf-javascript-stream PDF /JS object 309 at offset 0x20B24 220 bytes
SHA-256: f4379dc788b0345e77b7c62fb70b4743640256954408c64b71bb4e1d213b0ffe
Preview script
First 1,000 lines of the extracted script
function SYS_EWB(v1,f2){
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(""==v1)
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0310_060.js pdf-javascript-stream PDF /JS object 310 at offset 0x20C49 110 bytes
SHA-256: aac80299184793a9e70385b05eafbcd022913965a9d23ce3098c03e28c427502
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ1() {var F1=getField("OBJ2");var F0=getField("OBJ1");if("Yes"==F0.value){F1.value="Off";};}
javascript_obj0311_061.js pdf-javascript-stream PDF /JS object 311 at offset 0x20CEC 110 bytes
SHA-256: efbe7ccd26331aca38235f372546527bc0a07b84c6570359e24ce1448cc1f270
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ2() {var F0=getField("OBJ1");var F1=getField("OBJ2");if("Yes"==F1.value){F0.value="Off";};}
javascript_obj0312_062.js pdf-javascript-stream PDF /JS object 312 at offset 0x20D8F 110 bytes
SHA-256: 2a109bad9dc707f5fbbef833e58a6b37785a577f6e8e8f2d64e19526a7f4d853
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ7() {var F7=getField("OBJ8");var F6=getField("OBJ7");if("Yes"==F6.value){F7.value="Off";};}
javascript_obj0313_063.js pdf-javascript-stream PDF /JS object 313 at offset 0x20E32 110 bytes
SHA-256: c7582630ebd2fe60fb6e7ebd41d067ebac3c9f5d9812075f9c3a4216fffe7a45
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ8() {var F6=getField("OBJ7");var F7=getField("OBJ8");if("Yes"==F7.value){F6.value="Off";};}
javascript_obj0314_064.js pdf-javascript-stream PDF /JS object 314 at offset 0x20ED5 115 bytes
SHA-256: 505c17fafdb354aae6775f07aa57b24faadde238c68e4fb4a4a529e60f5dce74
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ10() {var F10=getField("OBJ11");var F9=getField("OBJ10");if("Yes"==F9.value){F10.value="Off";};}
javascript_obj0315_065.js pdf-javascript-stream PDF /JS object 315 at offset 0x20F7D 115 bytes
SHA-256: 75b5f9fc5c54b33cf33f34d161d04d15a7e210e22a8a4d02eaa3f44f7bcba37d
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ11() {var F9=getField("OBJ10");var F10=getField("OBJ11");if("Yes"==F10.value){F9.value="Off";};}
javascript_obj0316_066.js pdf-javascript-stream PDF /JS object 316 at offset 0x21025 117 bytes
SHA-256: 01b66f18263f8388fef31f75298ea3447744a879141b0a9c083e73c4eaa97a26
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ13() {var F13=getField("OBJ14");var F12=getField("OBJ13");if("Yes"==F12.value){F13.value="Off";};}
javascript_obj0317_067.js pdf-javascript-stream PDF /JS object 317 at offset 0x210CF 117 bytes
SHA-256: 9afbb74ea631fdf9419b8013489d6b3c488b4a905f376604125274784ff1fd9d
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ14() {var F12=getField("OBJ13");var F13=getField("OBJ14");if("Yes"==F13.value){F12.value="Off";};}
javascript_obj0318_068.js pdf-javascript-stream PDF /JS object 318 at offset 0x21179 117 bytes
SHA-256: 549d4a299ee713338a8913928145f758b4877d23c67c72a8596d447da05dd4f4
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ16() {var F16=getField("OBJ17");var F15=getField("OBJ16");if("Yes"==F15.value){F16.value="Off";};}
javascript_obj0319_069.js pdf-javascript-stream PDF /JS object 319 at offset 0x21223 117 bytes
SHA-256: 201ebdab3b9e8551243a51299fa36ae7387dd93278b992ab23b6a7124180edbe
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ17() {var F15=getField("OBJ16");var F16=getField("OBJ17");if("Yes"==F16.value){F15.value="Off";};}
javascript_obj0320_070.js pdf-javascript-stream PDF /JS object 320 at offset 0x212CD 117 bytes
SHA-256: f9a0aa48e4a9b2cdfc11fcc88b08e4c67ddcfdd5f8eb1666f5c940ee43b16ec2
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ19() {var F19=getField("OBJ20");var F18=getField("OBJ19");if("Yes"==F18.value){F19.value="Off";};}
javascript_obj0321_071.js pdf-javascript-stream PDF /JS object 321 at offset 0x21377 117 bytes
SHA-256: 2f2c22e7644ba22b84d4e0f0cbe343acf20092ca4f1a2950dedf3530193d1fd3
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ20() {var F18=getField("OBJ19");var F19=getField("OBJ20");if("Yes"==F19.value){F18.value="Off";};}
javascript_obj0322_072.js pdf-javascript-stream PDF /JS object 322 at offset 0x21421 117 bytes
SHA-256: 9c6804dc335aed56a09a19791cfd30917dab80b9c545fa718c8a450ba2425f9f
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ22() {var F22=getField("OBJ23");var F21=getField("OBJ22");if("Yes"==F21.value){F22.value="Off";};}
javascript_obj0323_073.js pdf-javascript-stream PDF /JS object 323 at offset 0x214CB 117 bytes
SHA-256: 10e29d3ebf6a45f7d7444d333ceef30692b074caaa767b4ab26d4fb7f5720070
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ23() {var F21=getField("OBJ22");var F22=getField("OBJ23");if("Yes"==F22.value){F21.value="Off";};}
javascript_obj0324_074.js pdf-javascript-stream PDF /JS object 324 at offset 0x21575 117 bytes
SHA-256: 0b68f653e48b95d97e1365a7a592f1177f498c8ccdb0b94415137ed6a5e29c95
Preview script
First 1,000 lines of the extracted script
function SYS_CB_OBJ25() {var F25=getField("OBJ26");var F24=getField("OBJ25");if("Yes"==F24.value){F25.value="Off";};}

Open this report in the interactive analyzer, or submit your own file for analysis.