Malicious PDF — malware analysis report

Static analysis result for SHA-256 8efd2083fd6d6653…

MALICIOUS

PDF

154.6 KB Authoring application: Cirali Output Manager B1-23 http://www.fjd.de (via cirali-pdf Pdf-V73 http://www.fjd.de) First seen: 2026-05-10
MD5: 811eb005e53998fc43367f8480594e80 SHA-1: 633b421fd36af45c66a86536527b80c3893eeac1 SHA-256: 8efd2083fd6d66536d81417e57231642f7e62b40ce43aa51ae3dd1391d615fdf
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams and actions, indicating an attempt to execute code. The presence of JavaScript actions and embedded JS streams, along with an embedded URL, suggests the document is designed to download and execute a malicious payload. The specific intent of the JavaScript is unclear due to obfuscation, but the overall pattern points to a malicious document delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9790

Heuristics 5

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.fjd.de In PDF document text
    • http://www.fjd.de)/CreatorIn PDF document text
    • http://www.fjd.de)/AuthorIn PDF document text

Extracted artifacts 28

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0002_000.js pdf-javascript-stream PDF /JS object 2 at offset 0xCA 449 bytes
SHA-256: 227ca46bb27e6d02fc509d522435c3c917f7409b7380571752f9579fd7d8fea5
Preview script
First 1,000 lines of the extracted script
var n = this.numFields;
var f;
var fn;
for(var i=0;i<n;i++)
{
   fn = this.getNthFieldName(i);
   if(""==fn) continue;

   f = this.getField(fn);
   if(null==f) continue;
   if("button"==f.type)continue;

   SYS_FILL(f,color.transparent);


   if("checkbox"==f.type)
   { f.style=style.cr;
     f.strokeColor=getBorderColor(fn);
   }
   else
   {    if(""+f.strokeColor!=""+color.transparent)
   		{  f.strokeColor=color.transparent;
   		}
   }
}
javascript_obj0002_001.js pdf-javascript-stream PDF /JS object 2 at offset 0xCA 38 bytes
SHA-256: b2e38f438ed1e34f318d244186a1aea582b8a0caaa8ce2a5646ddcf16e0534b4
Preview script
First 1,000 lines of the extracted script
SYS_RESET_BG_COLORS_UPON_ALL_PAGES();
javascript_obj0015_002.js pdf-javascript-stream PDF /JS object 15 at offset 0x5078 172 bytes
SHA-256: 8cc2b8fed26bfd6bfd0e9390d61d0b1f0ddfa7085457fab06e3c2ebc31556cdb
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
  var strZiffern="0123456789";  
   if(-1 == strZiffern.indexOf(event.change))
   {       app.beep(0);event.rc=false;
   }
}
javascript_obj0017_003.js pdf-javascript-stream PDF /JS object 17 at offset 0x536A 2149 bytes
SHA-256: 85f05b7bb9bf0d2ac14093e116b9e1efa901afba94d1904d56e0c539376609b6
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   var cont=event.value
   var vk, nk;
   var nkstellen=2;
   
   if(cont.length > 0) 
   {
   	
       // Teilzeichenkette VOR dem Komma raustrennen
       vk=cont;
       var contidx=cont.indexOf(',');
       if(-1!=contidx) vk=cont.substring(0,contidx);
       var isNegative=0;
       if('-'==vk.substring(0,1))
       {  isNegative=1;vk=vk.substring(1,vk.length);
       }
       if(vk.length == 0) vk = "0";
       else if (vk.length > 3)
       {
       	var reversed="";
           var i=0;
           for(i=vk.length-1;i>=0;i--)
           {       reversed=reversed+vk.substring(i,i+1);
           }
           vk="";
           for(i=0;i<reversed.length;i++)
           {       // Punkte einf�gen
           	if((0!=i)&&(0==i%3)) vk=vk+'.'; // Nach jeder 3. Ziffer einen Punkt einf�gen                                                                                            
               vk=vk+reversed.substring(i,i+1);
           }                       
           reversed="";
           for(i=vk.length-1;i>=0;i--)
           {       reversed=reversed+vk.substring(i,i+1);
           } 
           vk=reversed;
       }
       
       // Ausgabe ohne Nachkommastellen
       if(0==nkstellen)
       {   if(isNegative) vk='-'+vk;
       	event.value=vk;
       }
       else
       {                               
       	// Ausgabe ohne Nachkommastellen
           var NKSTELLEN=2;
           if(-1!=nkstellen) NKSTELLEN=nkstellen;
           // Teilzeichenkette NACH dem Komma raustrennen
           nk = "";                                      
           if( (-1!=contidx) && ((contidx+1)<cont.length) )
           {       nk=cont.substring(contidx+1,cont.length);
           }
           if(nk.length > NKSTELLEN) nk = nk.substring(0, NKSTELLEN);
           while(nk.length < NKSTELLEN) nk =nk+"0";
           if(isNegative) vk='-'+vk;
           event.value=vk + ',' + nk;
           }
	}
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0017_004.js pdf-javascript-stream PDF /JS object 17 at offset 0x536A 203 bytes
SHA-256: 7aef6d99f3ac380da3181392319fe34bc159869d7297a6860e8302c01187d9e7
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
   AFNumber_Keystroke(2,2,0,0,'',true);
   var n=2;
   if( (0==n) && (","==event.change) )
   {       app.beep(0);
           event.rc=false;
   }       
}
javascript_obj0017_005.js pdf-javascript-stream PDF /JS object 17 at offset 0x536A 2043 bytes
SHA-256: 17ec086a3ea9ebd4aa574410d09503c246435249fd6f5260cefd456ab87beced
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   var cont=event.value
   var vk, nk;
   var nkstellen=2;
   
   if(cont.length > 0) 
   {
   	
       // Teilzeichenkette VOR dem Komma raustrennen
       vk=cont;
       var contidx=cont.indexOf(',');
       if(-1!=contidx) vk=cont.substring(0,contidx);
       var isNegative=0;
       if('-'==vk.substring(0,1))
       {  isNegative=1;vk=vk.substring(1,vk.length);
       }
       if(vk.length == 0) vk = "0";
       else if (vk.length > 3)
       {
       	var reversed="";
           var i=0;
           for(i=vk.length-1;i>=0;i--)
           {       reversed=reversed+vk.substring(i,i+1);
           }
           vk="";
           for(i=0;i<reversed.length;i++)
           {       // Punkte einf�gen
           	if((0!=i)&&(0==i%3)) vk=vk+'.'; // Nach jeder 3. Ziffer einen Punkt einf�gen                                                                                            
               vk=vk+reversed.substring(i,i+1);
           }                       
           reversed="";
           for(i=vk.length-1;i>=0;i--)
           {       reversed=reversed+vk.substring(i,i+1);
           } 
           vk=reversed;
       }
       
       // Ausgabe ohne Nachkommastellen
       if(0==nkstellen)
       {   if(isNegative) vk='-'+vk;
       	event.value=vk;
       }
       else
       {                               
       	// Ausgabe ohne Nachkommastellen
           var NKSTELLEN=2;
           if(-1!=nkstellen) NKSTELLEN=nkstellen;
           // Teilzeichenkette NACH dem Komma raustrennen
           nk = "";                                      
           if( (-1!=contidx) && ((contidx+1)<cont.length) )
           {       nk=cont.substring(contidx+1,cont.length);
           }
           if(nk.length > NKSTELLEN) nk = nk.substring(0, NKSTELLEN);
           while(nk.length < NKSTELLEN) nk =nk+"0";
           if(isNegative) vk='-'+vk;
           event.value=vk + ',' + nk;
           }
	}
}if(false==event.rc
javascript_obj0107_006.js pdf-javascript-stream PDF /JS object 107 at offset 0x1C21E 2149 bytes
SHA-256: d44f0fd89998372f3c7ec08f8b4aefd796c4bfe58d37e3578a72eb4e37856494
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   var cont=event.value
   var vk, nk;
   var nkstellen=0;
   
   if(cont.length > 0) 
   {
   	
       // Teilzeichenkette VOR dem Komma raustrennen
       vk=cont;
       var contidx=cont.indexOf(',');
       if(-1!=contidx) vk=cont.substring(0,contidx);
       var isNegative=0;
       if('-'==vk.substring(0,1))
       {  isNegative=1;vk=vk.substring(1,vk.length);
       }
       if(vk.length == 0) vk = "0";
       else if (vk.length > 3)
       {
       	var reversed="";
           var i=0;
           for(i=vk.length-1;i>=0;i--)
           {       reversed=reversed+vk.substring(i,i+1);
           }
           vk="";
           for(i=0;i<reversed.length;i++)
           {       // Punkte einf�gen
           	if((0!=i)&&(0==i%3)) vk=vk+'.'; // Nach jeder 3. Ziffer einen Punkt einf�gen                                                                                            
               vk=vk+reversed.substring(i,i+1);
           }                       
           reversed="";
           for(i=vk.length-1;i>=0;i--)
           {       reversed=reversed+vk.substring(i,i+1);
           } 
           vk=reversed;
       }
       
       // Ausgabe ohne Nachkommastellen
       if(0==nkstellen)
       {   if(isNegative) vk='-'+vk;
       	event.value=vk;
       }
       else
       {                               
       	// Ausgabe ohne Nachkommastellen
           var NKSTELLEN=2;
           if(-1!=nkstellen) NKSTELLEN=nkstellen;
           // Teilzeichenkette NACH dem Komma raustrennen
           nk = "";                                      
           if( (-1!=contidx) && ((contidx+1)<cont.length) )
           {       nk=cont.substring(contidx+1,cont.length);
           }
           if(nk.length > NKSTELLEN) nk = nk.substring(0, NKSTELLEN);
           while(nk.length < NKSTELLEN) nk =nk+"0";
           if(isNegative) vk='-'+vk;
           event.value=vk + ',' + nk;
           }
	}
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0107_007.js pdf-javascript-stream PDF /JS object 107 at offset 0x1C21E 203 bytes
SHA-256: 7023736fab13df2b4ba7c529d34a213cd9b8c9adc3e01e1e0e3af98f438cd621
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
   AFNumber_Keystroke(0,2,0,0,'',true);
   var n=0;
   if( (0==n) && (","==event.change) )
   {       app.beep(0);
           event.rc=false;
   }       
}
javascript_obj0107_008.js pdf-javascript-stream PDF /JS object 107 at offset 0x1C21E 2043 bytes
SHA-256: e3769ea8721bb1a76473c7b4b3e2f0b2d76e0c3c3ef79757577e19b926aa8929
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   var cont=event.value
   var vk, nk;
   var nkstellen=0;
   
   if(cont.length > 0) 
   {
   	
       // Teilzeichenkette VOR dem Komma raustrennen
       vk=cont;
       var contidx=cont.indexOf(',');
       if(-1!=contidx) vk=cont.substring(0,contidx);
       var isNegative=0;
       if('-'==vk.substring(0,1))
       {  isNegative=1;vk=vk.substring(1,vk.length);
       }
       if(vk.length == 0) vk = "0";
       else if (vk.length > 3)
       {
       	var reversed="";
           var i=0;
           for(i=vk.length-1;i>=0;i--)
           {       reversed=reversed+vk.substring(i,i+1);
           }
           vk="";
           for(i=0;i<reversed.length;i++)
           {       // Punkte einf�gen
           	if((0!=i)&&(0==i%3)) vk=vk+'.'; // Nach jeder 3. Ziffer einen Punkt einf�gen                                                                                            
               vk=vk+reversed.substring(i,i+1);
           }                       
           reversed="";
           for(i=vk.length-1;i>=0;i--)
           {       reversed=reversed+vk.substring(i,i+1);
           } 
           vk=reversed;
       }
       
       // Ausgabe ohne Nachkommastellen
       if(0==nkstellen)
       {   if(isNegative) vk='-'+vk;
       	event.value=vk;
       }
       else
       {                               
       	// Ausgabe ohne Nachkommastellen
           var NKSTELLEN=2;
           if(-1!=nkstellen) NKSTELLEN=nkstellen;
           // Teilzeichenkette NACH dem Komma raustrennen
           nk = "";                                      
           if( (-1!=contidx) && ((contidx+1)<cont.length) )
           {       nk=cont.substring(contidx+1,cont.length);
           }
           if(nk.length > NKSTELLEN) nk = nk.substring(0, NKSTELLEN);
           while(nk.length < NKSTELLEN) nk =nk+"0";
           if(isNegative) vk='-'+vk;
           event.value=vk + ',' + nk;
           }
	}
}if(false==event.rc
javascript_obj0114_010.js pdf-javascript-stream PDF /JS object 114 at offset 0x1DCF7 188 bytes
SHA-256: d2f15482b7327f6f30df22aea84a24cf6b40d1b9b58ba8747c0b4c35d804177c
Preview script
First 1,000 lines of the extracted script
if(event.source)
{ var n=event.source.name;
if(n=="Eigenleistung")SYS_CB_Eigenleistung();
if(n=="Eigenleistung1")SYS_CB_Eigenleistung1();
if(n=="Eigenleistung2")SYS_CB_Eigenleistung2();
}
javascript_obj0138_013.js pdf-javascript-stream PDF /JS object 138 at offset 0x1F697 2539 bytes
SHA-256: 276e5d93a2a78c801c950a6bc7c716851621d23d207ccc79e404e34e6ce7080d
Preview script
First 1,000 lines of the extracted script
function getBgColor(fn){
var BG_DISABLED=["RGB",0.749,0.749,0.749];
var BG_85=["RGB",1.0,1.0,0.502];
  if(fn=="Koerperschaft") return BG_85;
  if(fn=="Gemeindeschluessel") return BG_85;
  if(fn=="Ort_Datum") return BG_85;
  if(fn=="Zahlungsmonat_Jahr") return BG_85;
  if(fn=="Ident1") return BG_85;
  if(fn=="Rechnung1") return BG_85;
  if(fn=="Eigenanteil1") return BG_85;
  if(fn=="Eigenant_Prozent1") return BG_85;
  if(fn=="azw_Betrag1") return BG_85;
  if(fn=="Ident2") return BG_85;
  if(fn=="Rechnung2") return BG_85;
  if(fn=="Eigenanteil2") return BG_85;
  if(fn=="Eigenant_Prozent2") return BG_85;
  if(fn=="azw_Betrag2") return BG_85;
  if(fn=="Ident3") return BG_85;
  if(fn=="Rechnung3") return BG_85;
  if(fn=="Eigenanteil3") return BG_85;
  if(fn=="Eigenant_Prozent3") return BG_85;
  if(fn=="azw_Betrag3") return BG_85;
  if(fn=="Ident4") return BG_85;
  if(fn=="Rechnung4") return BG_85;
  if(fn=="Eigenanteil4") return BG_85;
  if(fn=="Eigenant_Prozent4") return BG_85;
  if(fn=="azw_Betrag4") return BG_85;
  if(fn=="Ident5") return BG_85;
  if(fn=="Rechnung5") return BG_85;
  if(fn=="Eigenanteil5") return BG_85;
  if(fn=="Eigenant_Prozent5") return BG_85;
  if(fn=="azw_Betrag5") return BG_85;
  if(fn=="Ident6") return BG_85;
  if(fn=="Rechnung6") return BG_85;
  if(fn=="Eigenanteil6") return BG_85;
  if(fn=="Eigenant_Prozent6") return BG_85;
  if(fn=="azw_Betrag6") return BG_85;
  if(fn=="Ident7") return BG_85;
  if(fn=="Rechnung7") return BG_85;
  if(fn=="Eigenanteil7") return BG_85;
  if(fn=="Eigenant_Prozent7") return BG_85;
  if(fn=="azw_Betrag7") return BG_85;
  if(fn=="Ident8") return BG_85;
  if(fn=="Rechnung8") return BG_85;
  if(fn=="Eigenanteil8") return BG_85;
  if(fn=="Eigenant_Prozent8") return BG_85;
  if(fn=="azw_Betrag8") return BG_85;
  if(fn=="Rechnungssumme") return BG_85;
  if(fn=="Eigenanteilsumme") return BG_85;
  if(fn=="Sum_azw_Betrag") return BG_85;
  if(fn=="Kassenzeichen") return BG_85;
  if(fn=="OBJ1") return BG_85;
  if(fn=="OBJ2") return BG_85;
  if(fn=="Liquiditaetsbetrag") return BG_85;
  if(fn=="Liquiditaetsbetrag1") return BG_85;
  if(fn=="Eigenleistung") return BG_85;
  if(fn=="Eigenleistung1") return BG_85;
  if(fn=="Eigenleistung2") return BG_85;
  if(fn=="Sachlich_richtig") return BG_85;
  if(fn=="rechnerisch_richtig") return BG_85;
  if(fn=="Stapel") return BG_85;
  if(fn=="Buchungsschluessel") return BG_85;
  if(fn=="Belegnr") return BG_85;
  if(fn=="Kassenzeichen1") return BG_85;
  if(fn=="Namenszeichen") return BG_85;
    return color.transparent;}
javascript_obj0139_014.js pdf-javascript-stream PDF /JS object 139 at offset 0x2016E 166 bytes
SHA-256: 9f51a81ea495069ac3bd65daf89fd1c4a332f6ab52c21e14c04ec2c85ecccdee
Preview script
First 1,000 lines of the extracted script
function getBorderColor(fn){
   var f = this.getField(fn);
   if((null!=f)&&("checkbox"==f.type))
   { return ["RGB",0.0,0.0,0.0];
   }
   return color.transparent;
}
javascript_obj0140_015.js pdf-javascript-stream PDF /JS object 140 at offset 0x20251 280 bytes
SHA-256: bb0cc0ea4c337306f6e2f48a1141a3f0f0b71c8fa4e6a492f8fae20a58ca3eb4
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CLR(name,bNeedsColouredMustFillBorder)
{
    if(bNeedsColouredMustFillBorder)
    {    getField(name).strokeColor=color.red;
        }
        else
    	{    getField(name).strokeColor=getBorderColor(name);
        }
    return bNeedsColouredMustFillBorder;
}
javascript_obj0141_016.js pdf-javascript-stream PDF /JS object 141 at offset 0x203AA 468 bytes
SHA-256: 82c0fd6e6cc117687c47ced7f0ce920ecb308781c8402ac1927d871608b9fef1
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_STATE()
{
    if(false==SYS_IS_MUFI_CB(SYS_CB_HDL_STATE.arguments[0])) return false;
    var obj=getField(SYS_CB_HDL_STATE.arguments[0]);
    if("Yes"==obj.value) return false;
    if(true==obj.readonly) return false;
    if(display.hidden==obj.display) return false;
    for(var i=1;i<SYS_CB_HDL_STATE.arguments.length;i++)
    {   if("Yes"==getField(SYS_CB_HDL_STATE.arguments[i]).value)
    	{   return false;
        }
    }
    return true;
}
javascript_obj0142_017.js pdf-javascript-stream PDF /JS object 142 at offset 0x205CD 168 bytes
SHA-256: f6c2357c12b7e2cbd2f963dd05935f9bd1d924cb5654b0cfca7b2eeaa3f05a1b
Preview script
First 1,000 lines of the extracted script
function SYS_IS_MUFI_CB(cbname)
{   var all_mufi_cb= new Array();
	for(var i=0;i<all_mufi_cb.length;i++)
	{	if(cbname==all_mufi_cb[i]) return true;
	}
	return false;
}
javascript_obj0143_018.js pdf-javascript-stream PDF /JS object 143 at offset 0x206B1 70 bytes
SHA-256: 68582c3b030f7ce77460540a7ea21e899d133ef6ae8330fbbb6a5db8d1040ccb
Preview script
First 1,000 lines of the extracted script
function SYS_FILL(f,c){
  if(""+f.fillColor!=""+c)  {f.fillColor=c;}}
javascript_obj0144_019.js pdf-javascript-stream PDF /JS object 144 at offset 0x2072A 251 bytes
SHA-256: 11a1bd3ed0d867a06a568a40ba9d93946c031e168697e359578f9ad5e75f7e59
Preview script
First 1,000 lines of the extracted script
function SYS_EWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0145_020.js pdf-javascript-stream PDF /JS object 145 at offset 0x20871 251 bytes
SHA-256: b489e14c022670e263ade06b76d1f9a44446979ddfa4df58bed63e1e68ca6dfa
Preview script
First 1,000 lines of the extracted script
function SYS_AWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
 else
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
}
javascript_obj0146_021.js pdf-javascript-stream PDF /JS object 146 at offset 0x209B8 220 bytes
SHA-256: f4379dc788b0345e77b7c62fb70b4743640256954408c64b71bb4e1d213b0ffe
Preview script
First 1,000 lines of the extracted script
function SYS_EWB(v1,f2){
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(""==v1)
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0147_022.js pdf-javascript-stream PDF /JS object 147 at offset 0x20ADD 1263 bytes
SHA-256: 2856e6304c394af10c1bf9c2627fd4c31d4605a8e9c743b15c91d5a1c90a0abe
Preview script
First 1,000 lines of the extracted script
function SYS_PA2_SUBMIT()
{
        var pflichtfelder_befuellt = SYS_CHECK_MF_FIELDS();
        var n = this.numFields;
        var f;
        var fn;
        for(var i=0;i<n;i++)
        {
                fn = this.getNthFieldName(i);
                if( (""!=fn) && ("SYS_SEND_BUTTON"==fn.substring(0,15)) )
                {
                        f = this.getField(fn);
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=false;
                        	 }
                        	 else
                        	 { f.readonly=true;
                        	 }
                        }
                        f = this.getField("SYS_SEND_BTN_SHADOW"+fn.substring(15,fn.length));
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=true;
                        	   f.display=display.hidden;
                        	 }
                        	 else
                        	 { f.readonly=false;
                        	   f.display=display.visible;
                        	 }
                        }
                }
        }
}
javascript_obj0148_023.js pdf-javascript-stream PDF /JS object 148 at offset 0x2103B 198 bytes
SHA-256: 898d1239de1b220e8950a76e05e1b8c0ca2e6107a7ac1211ce3e62882374c90f
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_Eigenleistung(changecolor)
{   var retval=SYS_CB_HDL_STATE("Eigenleistung");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("Eigenleistung",retval);
    }
    return retval;
}
javascript_obj0149_024.js pdf-javascript-stream PDF /JS object 149 at offset 0x2113D 201 bytes
SHA-256: 4232956ef098a08e62c9b052f803584c7cd38ecfc4699d1dcbf1d1a25fe6b689
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_Eigenleistung1(changecolor)
{   var retval=SYS_CB_HDL_STATE("Eigenleistung1");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("Eigenleistung1",retval);
    }
    return retval;
}
javascript_obj0150_025.js pdf-javascript-stream PDF /JS object 150 at offset 0x21242 201 bytes
SHA-256: 5af87e62fb7854ce7d4340a40e3ed2ce54bfae1f55140d7752256ad37814ab41
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_Eigenleistung2(changecolor)
{   var retval=SYS_CB_HDL_STATE("Eigenleistung2");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("Eigenleistung2",retval);
    }
    return retval;
}
javascript_obj0151_026.js pdf-javascript-stream PDF /JS object 151 at offset 0x21347 843 bytes
SHA-256: f5a5da81906ef38153e188a7505f9a75384d0f8ed552cf2ce7944aa305653e90
Preview script
First 1,000 lines of the extracted script
function SYS_CHECK_MF_FIELDS()
{
        var n = this.numFields;
        var f;
        var fn;
        for(var i=0;i<n;i++)
        {
                fn = this.getNthFieldName(i);
                if( (""!=fn) && ("SYSTEM_P1_DUMMY"!=fn) )
                {
                        f = this.getField(fn);
                        if( (null!=f) && ("button"!=f.type) )
                        {
                                if((f.required)&&(""==f.value))
                                {
                                        return false;
                                }
                        }
                }
        }
    	if(true==SYS_CB_HDL_Eigenleistung(false)){return false;}
    	if(true==SYS_CB_HDL_Eigenleistung1(false)){return false;}
    	if(true==SYS_CB_HDL_Eigenleistung2(false)){return false;}
        return true;
}
javascript_obj0152_027.js pdf-javascript-stream PDF /JS object 152 at offset 0x216FE 1520 bytes
SHA-256: 2ccaeea88de0bedab331957b0d1e59669eae0a38fdba1313709d8f66da82c30b
Preview script
First 1,000 lines of the extracted script
function SYS_RESET_BG_COLORS_UPON_ALL_PAGES()
{
SYS_PA2_SUBMIT();
        var n = this.numFields;
        var f;
        var fn;
        for(var i=0;i<n;i++)
        {
                fn = this.getNthFieldName(i);
                if( (""!=fn) && ("SYSTEM_P1_DUMMY"!=fn) )
                {
                        f = this.getField(fn);
                        if( (null!=f) && ("button"!=f.type) )
                        {
                                if("checkbox"==f.type)
                                { 
                                  f.style=style.cr;
                                }
                                if(f.readonly)
                                {
                                        if(f.readonly) SYS_FILL(f,["RGB",0.749,0.749,0.749]);
                                }
                                else
                                {
                                     SYS_FILL(f,getBgColor(fn));
                                }
                                if((f.required)&&(""==f.value))
                                {
                                        f.strokeColor=color.red;
                                }
                                else
                                {
                                   f.strokeColor=getBorderColor(fn);
                                }
                        }
                }
        }
    	SYS_CB_HDL_Eigenleistung(true);
    	SYS_CB_HDL_Eigenleistung1(true);
    	SYS_CB_HDL_Eigenleistung2(true);
}
javascript_obj0153_028.js pdf-javascript-stream PDF /JS object 153 at offset 0x21D74 82 bytes
SHA-256: 7a61705c49f820c5de336808e23446597d359e0793cdc225a321581897c141fc
Preview script
First 1,000 lines of the extracted script
function SYS_CB_Eigenleistung() {SYS_CB_HDL_Eigenleistung(true);SYS_PA2_SUBMIT();}
javascript_obj0154_029.js pdf-javascript-stream PDF /JS object 154 at offset 0x21DF9 84 bytes
SHA-256: 1fc81e2da924d593e724eb11ca441f6effdc409480e45e4fd657e119b8fb2852
Preview script
First 1,000 lines of the extracted script
function SYS_CB_Eigenleistung1() {SYS_CB_HDL_Eigenleistung1(true);SYS_PA2_SUBMIT();}
javascript_obj0155_030.js pdf-javascript-stream PDF /JS object 155 at offset 0x21E80 84 bytes
SHA-256: 47e602542714fa18a79dd8c413c46bc575fee9987a4d67604dd468a8c08908f7
Preview script
First 1,000 lines of the extracted script
function SYS_CB_Eigenleistung2() {SYS_CB_HDL_Eigenleistung2(true);SYS_PA2_SUBMIT();}

Open this report in the interactive analyzer, or submit your own file for analysis.