Malicious PDF / .TXT — malware analysis report

Static analysis result for SHA-256 928f61eaaeab1c51…

MALICIOUS

PDF / .TXT

110.9 KB Authoring application: Cirali Output Manager B1-23 http://www.fjd.de (via cirali-pdf Pdf-V70 http://www.fjd.de) First seen: 2026-05-10
MD5: 46101161be71a984d68061560ca1f3f8 SHA-1: 9d6812bc0c78f6ae9dbd9dcbe6e9b9b7312fb59f SHA-256: 928f61eaaeab1c51cfba7abe4c91a74a860d00baeca1a41614aabb879b0991b3
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams and actions, indicated by PDF_JAVASCRIPT, PDF_JS, PDF_AA, and PDF_ACROFORM_BUTTON heuristics. The document body presents a form for a hunting license application, suggesting a social engineering lure. The embedded JavaScript is likely intended to exploit vulnerabilities or perform malicious actions upon opening the document, although the specific payload could not be determined due to obfuscation or truncation. The presence of embedded JavaScript and the social engineering pretext point towards a malicious document designed to trick users into interaction.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9705

Heuristics 6

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.fjd.de In PDF document text
    • http://www.fjd.de)/CreatorIn PDF document text
    • http://www.fjd.de)/AuthorIn PDF document text

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0002_000.js pdf-javascript-stream PDF /JS object 2 at offset 0x13D 449 bytes
SHA-256: 227ca46bb27e6d02fc509d522435c3c917f7409b7380571752f9579fd7d8fea5
Preview script
First 1,000 lines of the extracted script
var n = this.numFields;
var f;
var fn;
for(var i=0;i<n;i++)
{
   fn = this.getNthFieldName(i);
   if(""==fn) continue;

   f = this.getField(fn);
   if(null==f) continue;
   if("button"==f.type)continue;

   SYS_FILL(f,color.transparent);


   if("checkbox"==f.type)
   { f.style=style.cr;
     f.strokeColor=getBorderColor(fn);
   }
   else
   {    if(""+f.strokeColor!=""+color.transparent)
   		{  f.strokeColor=color.transparent;
   		}
   }
}
javascript_obj0014_003.js pdf-javascript-stream PDF /JS object 14 at offset 0x630D 1972 bytes
SHA-256: fedcfdb1bdd69145a75e4485dd1bebc1d47925d2e5ac2e8eff316caed66b8497
Detection
ClamAV: No threats found
Obfuscation or payload: likely
32 of 34 identifiers look randomly generated (e.g. 'SYS_CB_CHECKBOX_p0_x120_y143') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
if(event.source)
{ var n=event.source.name;
if(n=="CHECKBOX.p0.x120.y27")SYS_CB_CHECKBOX_p0_x120_y27();
if(n=="CHECKBOX.p0.x152.y27")SYS_CB_CHECKBOX_p0_x152_y27();
if(n=="CHECKBOX.p0.x120.y36")SYS_CB_CHECKBOX_p0_x120_y36();
if(n=="CHECKBOX.p0.x135.y44")SYS_CB_CHECKBOX_p0_x135_y44();
if(n=="CHECKBOX.p0.x135.y52")SYS_CB_CHECKBOX_p0_x135_y52();
if(n=="CHECKBOX.p0.x120.y64")SYS_CB_CHECKBOX_p0_x120_y64();
if(n=="CHECKBOX.p0.x120.y72")SYS_CB_CHECKBOX_p0_x120_y72();
if(n=="CHECKBOX.p0.x152.y107")SYS_CB_CHECKBOX_p0_x152_y107();
if(n=="CHECKBOX.p0.x176.y107")SYS_CB_CHECKBOX_p0_x176_y107();
if(n=="CHECKBOX.p0.x44.y137")SYS_CB_CHECKBOX_p0_x44_y137();
if(n=="CHECKBOX.p0.x72.y137")SYS_CB_CHECKBOX_p0_x72_y137();
if(n=="CHECKBOX.p0.x108.y143")SYS_CB_CHECKBOX_p0_x108_y143();
if(n=="CHECKBOX.p0.x120.y143")SYS_CB_CHECKBOX_p0_x120_y143();
if(n=="CHECKBOX.p0.x72.y149")SYS_CB_CHECKBOX_p0_x72_y149();
if(n=="CHECKBOX.p0.x108.y149")SYS_CB_CHECKBOX_p0_x108_y149();
if(n=="CHECKBOX.p0.x22.y169")SYS_CB_CHECKBOX_p0_x22_y169();
if(n=="CHECKBOX.p0.x72.y169")SYS_CB_CHECKBOX_p0_x72_y169();
if(n=="CHECKBOX.p0.x108.y169")SYS_CB_CHECKBOX_p0_x108_y169();
if(n=="CHECKBOX.p0.x152.y169")SYS_CB_CHECKBOX_p0_x152_y169();
if(n=="CHECKBOX.p0.x22.y175")SYS_CB_CHECKBOX_p0_x22_y175();
if(n=="CHECKBOX.p0.x22.y191")SYS_CB_CHECKBOX_p0_x22_y191();
if(n=="CHECKBOX.p0.x22.y197")SYS_CB_CHECKBOX_p0_x22_y197();
if(n=="CHECKBOX.p0.x22.y213")SYS_CB_CHECKBOX_p0_x22_y213();
if(n=="CHECKBOX.p0.x22.y219")SYS_CB_CHECKBOX_p0_x22_y219();
if(n=="CHECKBOX.p0.x22.y233")SYS_CB_CHECKBOX_p0_x22_y233();
if(n=="CHECKBOX.p0.x22.y239")SYS_CB_CHECKBOX_p0_x22_y239();
if(n=="CHECKBOX.p0.x145.y36")SYS_CB_CHECKBOX_p0_x145_y36();
if(n=="CHECKBOX.p0.x169.y36")SYS_CB_CHECKBOX_p0_x169_y36();
if(n=="CHECKBOX.p1.x22.y27")SYS_CB_CHECKBOX_p1_x22_y27();
if(n=="CHECKBOX.p1.x56.y27")SYS_CB_CHECKBOX_p1_x56_y27();
if(n=="CHECKBOX.p1.x30.y83")SYS_CB_CHECKBOX_p1_x30_y83();
if(n=="CHECKBOX.p1.x30.y91")SYS_CB_CHECKBOX_p1_x30_y91();
}
javascript_obj0043_010.js pdf-javascript-stream PDF /JS object 43 at offset 0x872E 32 bytes
SHA-256: f3795cd69fcbdbac4f29ea2eb191d567f48861df75bce13cd7fa8533f6d4ab77
Preview script
First 1,000 lines of the extracted script
SYS_CB_CHECKBOX_p0_x152_y107();
javascript_obj0046_011.js pdf-javascript-stream PDF /JS object 46 at offset 0x8A28 32 bytes
SHA-256: 4ccbdce4761881ed762649a9970d3816e04d81710d87f1602c732968d4d8cf23
Preview script
First 1,000 lines of the extracted script
SYS_CB_CHECKBOX_p0_x176_y107();
javascript_obj0063_014.js pdf-javascript-stream PDF /JS object 63 at offset 0x9A47 32 bytes
SHA-256: 205a3e4c1268a9bcc2078e1a199ccac1ab2dbc5775c9e317ffe80634fa6b614d
Preview script
First 1,000 lines of the extracted script
SYS_CB_CHECKBOX_p0_x108_y143();
javascript_obj0066_015.js pdf-javascript-stream PDF /JS object 66 at offset 0x9D41 32 bytes
SHA-256: 4b8c8a3c7222f1f500679e5b57ec292e53dbc4ef116b3f7a74d1598c2c6ffeac
Preview script
First 1,000 lines of the extracted script
SYS_CB_CHECKBOX_p0_x120_y143();
javascript_obj0072_017.js pdf-javascript-stream PDF /JS object 72 at offset 0xA333 32 bytes
SHA-256: a6f12262c0e377365c444d8f3703fb53887681cc04375ab3e3c8fb07cd89a693
Preview script
First 1,000 lines of the extracted script
SYS_CB_CHECKBOX_p0_x108_y149();
javascript_obj0083_020.js pdf-javascript-stream PDF /JS object 83 at offset 0xADE8 32 bytes
SHA-256: 872034db8c03dad33cbb979d7c72f49e2340e019fad0f14f41811ef4a371a52a
Preview script
First 1,000 lines of the extracted script
SYS_CB_CHECKBOX_p0_x108_y169();
javascript_obj0086_021.js pdf-javascript-stream PDF /JS object 86 at offset 0xB0E2 32 bytes
SHA-256: 99d682218ac60baf7d14a97d571120f6af541a12b422584be9f99f1bb28f40bc
Preview script
First 1,000 lines of the extracted script
SYS_CB_CHECKBOX_p0_x152_y169();
javascript_obj0184_035.js pdf-javascript-stream PDF /JS object 184 at offset 0x11676 3486 bytes
SHA-256: d301417e5e32fce86c48527a6d6e7f002a2102ddbd6763fca3bdd48990cad691
Preview script
First 1,000 lines of the extracted script
function getBgColor(fn){
var BG_DISABLED=["RGB",0.749,0.749,0.749];
var BG_118=["RGB",1.0,1.0,1.0];
  if(fn=="CHECKBOX.p0.x120.y27") return BG_118;
  if(fn=="CHECKBOX.p0.x152.y27") return BG_118;
  if(fn=="CHECKBOX.p0.x120.y36") return BG_118;
  if(fn=="CHECKBOX.p0.x135.y44") return BG_118;
  if(fn=="CHECKBOX.p0.x135.y52") return BG_118;
  if(fn=="CHECKBOX.p0.x120.y64") return BG_118;
  if(fn=="CHECKBOX.p0.x120.y72") return BG_118;
  if(fn=="TEXTFIELD.p0.x24.y91") return BG_118;
  if(fn=="TEXTFIELD.p0.x24.y99") return BG_118;
  if(fn=="TEXTFIELD.p0.x74.y99") return BG_118;
  if(fn=="TEXTFIELD.p0.x24.y107") return BG_118;
  if(fn=="TEXTFIELD.p0.x74.y107") return BG_118;
  if(fn=="CHECKBOX.p0.x152.y107") return BG_118;
  if(fn=="CHECKBOX.p0.x176.y107") return BG_118;
  if(fn=="TEXTFIELD.p0.x24.y115") return BG_118;
  if(fn=="TEXTFIELD.p0.x154.y115") return BG_118;
  if(fn=="TEXTFIELD.p0.x24.y123") return BG_118;
  if(fn=="TEXTFIELD.p0.x24.y131") return BG_118;
  if(fn=="CHECKBOX.p0.x44.y137") return BG_118;
  if(fn=="CHECKBOX.p0.x72.y137") return BG_118;
  if(fn=="CHECKBOX.p0.x108.y143") return BG_118;
  if(fn=="CHECKBOX.p0.x120.y143") return BG_118;
  if(fn=="CHECKBOX.p0.x72.y149") return BG_118;
  if(fn=="CHECKBOX.p0.x108.y149") return BG_118;
  if(fn=="TEXTFIELD.p0.x24.y155") return BG_118;
  if(fn=="CHECKBOX.p0.x22.y169") return BG_118;
  if(fn=="CHECKBOX.p0.x72.y169") return BG_118;
  if(fn=="CHECKBOX.p0.x108.y169") return BG_118;
  if(fn=="CHECKBOX.p0.x152.y169") return BG_118;
  if(fn=="CHECKBOX.p0.x22.y175") return BG_118;
  if(fn=="TEXTFIELD.p0.x24.y183") return BG_118;
  if(fn=="TEXTFIELD.p0.x104.y183") return BG_118;
  if(fn=="TEXTFIELD.p0.x154.y183") return BG_118;
  if(fn=="CHECKBOX.p0.x22.y191") return BG_118;
  if(fn=="TEXTFIELD.p0.x122.y191") return BG_118;
  if(fn=="CHECKBOX.p0.x22.y197") return BG_118;
  if(fn=="CHECKBOX.p0.x22.y213") return BG_118;
  if(fn=="CHECKBOX.p0.x22.y219") return BG_118;
  if(fn=="TEXTFIELD.p0.x24.y227") return BG_118;
  if(fn=="TEXTFIELD.p0.x104.y227") return BG_118;
  if(fn=="TEXTFIELD.p0.x154.y227") return BG_118;
  if(fn=="CHECKBOX.p0.x22.y233") return BG_118;
  if(fn=="CHECKBOX.p0.x22.y239") return BG_118;
  if(fn=="TEXTFIELD.p0.x24.y259") return BG_118;
  if(fn=="TEXTFIELD.p0.x104.y259") return BG_118;
  if(fn=="CHECKBOX.p0.x145.y36") return BG_118;
  if(fn=="CHECKBOX.p0.x169.y36") return BG_118;
  if(fn=="TEXTFIELD.p1.x100.y19") return BG_118;
  if(fn=="CHECKBOX.p1.x22.y27") return BG_118;
  if(fn=="CHECKBOX.p1.x56.y27") return BG_118;
  if(fn=="TEXTFIELD.p1.x100.y27") return BG_118;
  if(fn=="TEXTFIELD.p1.x138.y27") return BG_118;
  if(fn=="TEXTFIELD.p1.x138.y35") return BG_118;
  if(fn=="TEXTFIELD.p1.x100.y43") return BG_118;
  if(fn=="TEXTFIELD.p1.x24.y52") return BG_118;
  if(fn=="TEXTFIELD.p1.x56.y67") return BG_118;
  if(fn=="TEXTFIELD.p1.x100.y67") return BG_118;
  if(fn=="TEXTFIELD.p1.x164.y67") return BG_118;
  if(fn=="TEXTFIELD.p1.x100.y75") return BG_118;
  if(fn=="TEXTFIELD.p1.x164.y75") return BG_118;
  if(fn=="CHECKBOX.p1.x30.y83") return BG_118;
  if(fn=="TEXTFIELD.p1.x68.y83") return BG_118;
  if(fn=="CHECKBOX.p1.x30.y91") return BG_118;
  if(fn=="TEXTFIELD.p1.x24.y100") return BG_118;
  if(fn=="TEXTFIELD.p1.x114.y100") return BG_118;
  if(fn=="TEXTFIELD.p1.x24.y136") return BG_118;
  if(fn=="TEXTFIELD.p1.x114.y136") return BG_118;
  if(fn=="TEXTFIELD.p1.x56.y169") return BG_118;
  if(fn=="TEXTFIELD.p1.x114.y169") return BG_118;
    return color.transparent;}
javascript_obj0185_036.js pdf-javascript-stream PDF /JS object 185 at offset 0x12515 166 bytes
SHA-256: 9f51a81ea495069ac3bd65daf89fd1c4a332f6ab52c21e14c04ec2c85ecccdee
Preview script
First 1,000 lines of the extracted script
function getBorderColor(fn){
   var f = this.getField(fn);
   if((null!=f)&&("checkbox"==f.type))
   { return ["RGB",0.0,0.0,0.0];
   }
   return color.transparent;
}
javascript_obj0186_037.js pdf-javascript-stream PDF /JS object 186 at offset 0x125F8 280 bytes
SHA-256: bb0cc0ea4c337306f6e2f48a1141a3f0f0b71c8fa4e6a492f8fae20a58ca3eb4
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CLR(name,bNeedsColouredMustFillBorder)
{
    if(bNeedsColouredMustFillBorder)
    {    getField(name).strokeColor=color.red;
        }
        else
    	{    getField(name).strokeColor=getBorderColor(name);
        }
    return bNeedsColouredMustFillBorder;
}
javascript_obj0187_038.js pdf-javascript-stream PDF /JS object 187 at offset 0x12751 468 bytes
SHA-256: 82c0fd6e6cc117687c47ced7f0ce920ecb308781c8402ac1927d871608b9fef1
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_STATE()
{
    if(false==SYS_IS_MUFI_CB(SYS_CB_HDL_STATE.arguments[0])) return false;
    var obj=getField(SYS_CB_HDL_STATE.arguments[0]);
    if("Yes"==obj.value) return false;
    if(true==obj.readonly) return false;
    if(display.hidden==obj.display) return false;
    for(var i=1;i<SYS_CB_HDL_STATE.arguments.length;i++)
    {   if("Yes"==getField(SYS_CB_HDL_STATE.arguments[i]).value)
    	{   return false;
        }
    }
    return true;
}
javascript_obj0188_039.js pdf-javascript-stream PDF /JS object 188 at offset 0x12974 168 bytes
SHA-256: f6c2357c12b7e2cbd2f963dd05935f9bd1d924cb5654b0cfca7b2eeaa3f05a1b
Preview script
First 1,000 lines of the extracted script
function SYS_IS_MUFI_CB(cbname)
{   var all_mufi_cb= new Array();
	for(var i=0;i<all_mufi_cb.length;i++)
	{	if(cbname==all_mufi_cb[i]) return true;
	}
	return false;
}
javascript_obj0189_040.js pdf-javascript-stream PDF /JS object 189 at offset 0x12A58 70 bytes
SHA-256: 68582c3b030f7ce77460540a7ea21e899d133ef6ae8330fbbb6a5db8d1040ccb
Preview script
First 1,000 lines of the extracted script
function SYS_FILL(f,c){
  if(""+f.fillColor!=""+c)  {f.fillColor=c;}}
javascript_obj0190_041.js pdf-javascript-stream PDF /JS object 190 at offset 0x12AD1 251 bytes
SHA-256: 11a1bd3ed0d867a06a568a40ba9d93946c031e168697e359578f9ad5e75f7e59
Preview script
First 1,000 lines of the extracted script
function SYS_EWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0191_042.js pdf-javascript-stream PDF /JS object 191 at offset 0x12C18 251 bytes
SHA-256: b489e14c022670e263ade06b76d1f9a44446979ddfa4df58bed63e1e68ca6dfa
Preview script
First 1,000 lines of the extracted script
function SYS_AWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
 else
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
}
javascript_obj0192_043.js pdf-javascript-stream PDF /JS object 192 at offset 0x12D5F 220 bytes
SHA-256: f4379dc788b0345e77b7c62fb70b4743640256954408c64b71bb4e1d213b0ffe
Preview script
First 1,000 lines of the extracted script
function SYS_EWB(v1,f2){
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(""==v1)
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0193_044.js pdf-javascript-stream PDF /JS object 193 at offset 0x12E84 1263 bytes
SHA-256: 2856e6304c394af10c1bf9c2627fd4c31d4605a8e9c743b15c91d5a1c90a0abe
Preview script
First 1,000 lines of the extracted script
function SYS_PA2_SUBMIT()
{
        var pflichtfelder_befuellt = SYS_CHECK_MF_FIELDS();
        var n = this.numFields;
        var f;
        var fn;
        for(var i=0;i<n;i++)
        {
                fn = this.getNthFieldName(i);
                if( (""!=fn) && ("SYS_SEND_BUTTON"==fn.substring(0,15)) )
                {
                        f = this.getField(fn);
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=false;
                        	 }
                        	 else
                        	 { f.readonly=true;
                        	 }
                        }
                        f = this.getField("SYS_SEND_BTN_SHADOW"+fn.substring(15,fn.length));
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=true;
                        	   f.display=display.hidden;
                        	 }
                        	 else
                        	 { f.readonly=false;
                        	   f.display=display.visible;
                        	 }
                        }
                }
        }
}
javascript_obj0194_045.js pdf-javascript-stream PDF /JS object 194 at offset 0x133E2 265 bytes
SHA-256: 7d175927c748d11a0a237b5a9bf3f46159c3cdc730d27f448e23bb4c1a6ba76f
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x120_y27(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x120.y27","CHECKBOX.p0.x120.y27","CHECKBOX.p0.x152.y27");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x120.y27",retval);
    }
    return retval;
}
javascript_obj0195_046.js pdf-javascript-stream PDF /JS object 195 at offset 0x13527 265 bytes
SHA-256: 41e93d429eaf21cb568926ade796d06f516cebe4c363537b4daa0708332b9a31
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x152_y27(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x152.y27","CHECKBOX.p0.x120.y27","CHECKBOX.p0.x152.y27");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x152.y27",retval);
    }
    return retval;
}
javascript_obj0196_047.js pdf-javascript-stream PDF /JS object 196 at offset 0x1366C 288 bytes
SHA-256: 8934b4a9c16d593a6be5cfd4f6b44939da8d5281d08347f04603b32f64365510
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x120_y36(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x120.y36","CHECKBOX.p0.x120.y36","CHECKBOX.p0.x145.y36","CHECKBOX.p0.x169.y36");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x120.y36",retval);
    }
    return retval;
}
javascript_obj0197_048.js pdf-javascript-stream PDF /JS object 197 at offset 0x137C8 265 bytes
SHA-256: 254d1e9a801d87b70afb8dda5f53e057352e3daf84ce0d0462277f47a346cda5
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x135_y44(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x135.y44","CHECKBOX.p0.x135.y44","CHECKBOX.p0.x135.y52");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x135.y44",retval);
    }
    return retval;
}
javascript_obj0198_049.js pdf-javascript-stream PDF /JS object 198 at offset 0x1390D 265 bytes
SHA-256: 3cb2a832c0a50e667c4ed56de0e94de2616437002faca2cd918d4f1c20c822bd
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x135_y52(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x135.y52","CHECKBOX.p0.x135.y44","CHECKBOX.p0.x135.y52");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x135.y52",retval);
    }
    return retval;
}
javascript_obj0199_050.js pdf-javascript-stream PDF /JS object 199 at offset 0x13A52 265 bytes
SHA-256: a6bf11c8a0c4a5649dd98de4c096d51e80a1cc037dda0ffd7b2c85e5ec92f92f
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x120_y64(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x120.y64","CHECKBOX.p0.x120.y64","CHECKBOX.p0.x120.y72");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x120.y64",retval);
    }
    return retval;
}
javascript_obj0200_051.js pdf-javascript-stream PDF /JS object 200 at offset 0x13B97 265 bytes
SHA-256: 8ede5768451e493edb4477fae1fea23f4b7e70d1c6f594d59f35825e6eaaacba
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x120_y72(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x120.y72","CHECKBOX.p0.x120.y64","CHECKBOX.p0.x120.y72");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x120.y72",retval);
    }
    return retval;
}
javascript_obj0201_052.js pdf-javascript-stream PDF /JS object 201 at offset 0x13CDC 270 bytes
SHA-256: 76cb44f4eaa1de99c715f3941060582f9a83358182770e93e092899a3af4c310
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x152_y107(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x152.y107","CHECKBOX.p0.x152.y107","CHECKBOX.p0.x176.y107");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x152.y107",retval);
    }
    return retval;
}
javascript_obj0202_053.js pdf-javascript-stream PDF /JS object 202 at offset 0x13E26 270 bytes
SHA-256: 22af46a037ff04b4800b02fc6ebdf1048d8016ff666e5be310e8a2c9001aee1e
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x176_y107(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x176.y107","CHECKBOX.p0.x152.y107","CHECKBOX.p0.x176.y107");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x176.y107",retval);
    }
    return retval;
}
javascript_obj0203_054.js pdf-javascript-stream PDF /JS object 203 at offset 0x13F70 265 bytes
SHA-256: 631264be374f8c7c5a72f875a6e0013438c59255da6d98c19b3580968252070c
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x44_y137(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x44.y137","CHECKBOX.p0.x44.y137","CHECKBOX.p0.x72.y137");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x44.y137",retval);
    }
    return retval;
}
javascript_obj0204_055.js pdf-javascript-stream PDF /JS object 204 at offset 0x140B5 265 bytes
SHA-256: e863aa6f7c6c35dd9d8da50fc37fbcc9ec173c547fbdcd7d525637eca4c839d9
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x72_y137(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x72.y137","CHECKBOX.p0.x44.y137","CHECKBOX.p0.x72.y137");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x72.y137",retval);
    }
    return retval;
}
javascript_obj0205_056.js pdf-javascript-stream PDF /JS object 205 at offset 0x141FA 270 bytes
SHA-256: a53b49294ee50974ad61b4b98cdea4323aacf3e051132d9801e87d5dc8ed3b22
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x108_y143(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x108.y143","CHECKBOX.p0.x108.y143","CHECKBOX.p0.x120.y143");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x108.y143",retval);
    }
    return retval;
}
javascript_obj0206_057.js pdf-javascript-stream PDF /JS object 206 at offset 0x14344 270 bytes
SHA-256: 2bd73ce58e04acc3eeb265a450eadae344755e5788df908497cf4753e01e4fad
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x120_y143(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x120.y143","CHECKBOX.p0.x108.y143","CHECKBOX.p0.x120.y143");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x120.y143",retval);
    }
    return retval;
}

Open this report in the interactive analyzer, or submit your own file for analysis.