Malicious PDF — malware analysis report

Static analysis result for SHA-256 b77dec096238ac2b…

MALICIOUS

PDF

1.79 MB Created: 2014-05-05 15:14:44 -05:00 Authoring application: Adobe LiveCycle Forms 8.2 First seen: 2014-06-03
MD5: 075266eaebf4b70961f117b609967404 SHA-1: 4ac9d347fd021dd9b1bee8ffa4687348d02f7229 SHA-256: b77dec096238ac2bca683e0aba3da2002bee727f126c0f029de1ecfe42e6d14a
266 Risk Score

🔏 Digital signature Modified after signing

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1059.001 Scripting: PowerShell T1059.007 Scripting: JavaScript

The PDF contains critical XFA heap spray exploit code and risky executable scripts, indicating an attempt to leverage a known vulnerability. The embedded JavaScript streams and XFA actions are designed to trigger this exploit. The presence of multiple unknown URLs suggests a potential command and control or payload delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9803

Heuristics 11

  • XFA form contains risky executable script high CVE related PDF_XFA_SCRIPT
    PDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
  • XFA JavaScript heap-spray exploit code critical PDF_XFA_HEAP_SPRAY
    PDF contains XFA script content with heap-spray or shellcode-like JavaScript markers such as large encoded word sequences, util.pack, large arrays, or spray variable names. This is a weaponised Adobe Reader exploit pattern, not a normal interactive form.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Active content added after the PDF was signed medium PDF_SIGNATURE_POST_SIGN_MODIFICATION
    An incremental update appended AFTER the signed byte range introduces active content (/EmbeddedFile, /Catalog). Some of this can occur in legitimate form-fill (field scripts, a rewritten /Catalog), so it is suspicious rather than damning — but it is content the signer did not approve.
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://localhost:8080/FormsWSQS/HandleData In PDF document text
    • http://67.192.221.68/rh/part2Pdf.aspx?SaveOnly=trueIn PDF document text
    • http://localhost:1787/intoCareers/images/formlogoes/cis.gifIn PDF document text
    • https://www.iiresearch.net/rh/part2Pdf.aspxIn PDF document text
    • http://localhost:8080/FormsWSQSIn PDF document text
    • http://localhost:8080/FormServerIn PDF document text
    • http://www.monotype.comMonotypeIn PDF document text
    • http://ocsp.verisign.com0In PDF document text
    • http://www.adobe.com/go/reader_downloadIn PDF document text
    • http://www.adobe.com/go/acrreaderIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xfa/promoted-desc/In PDF document text
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/2.8/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.8/In PDF document text
    • http://www.w3.org/1999/xhtmlIn PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.4/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.7/In PDF document text
    • http://www.xfa.org/schema/xfa-locale-set/2.6/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text
    • http://www.adobe.com/go/acrIn PDF document text
    • http://cgi.adobe.com/special/acrobat/updateReferenced by PDF JavaScript
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://crl.verisign.com/tss-ca.crl0In PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
    • https://www.verisign.com/rpa01In PDF document text
    • http://crl.verisign.com/pca3.crl0In PDF document text
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DIn PDF document text
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0In PDF document text
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlIn PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn PDF document text
    • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In PDF document text
    • http://logo.verisign.com/vslogo.gif0In PDF document text
    • http://csc3-2010-crl.verisign.com/CSC3-2010.crl0DIn PDF document text
    • http://csc3-2010-aia.verisign.com/CSC3-2010.cer0In PDF document text
    • https://www.verisign.com/cps0*In PDF document text
    • http://logo.verisign.com/vslogo.gif04In PDF document text
    • http://crl.verisign.com/pca3-g5.crl04In PDF document text
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlMyriadIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 13

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0055.bin pdf-embedded-file PDF EmbeddedFile object 55 at offset 0x1A0FF3 162 bytes
SHA-256: 82d700fa7402fd5bb12c64a441d17a7a45a3a9db8a99b42c21061a2ca6d2a0e9
embedded_file_obj0056.bin pdf-embedded-file PDF EmbeddedFile object 56 at offset 0x1A10E6 643859 bytes
SHA-256: e97a1c12feed9baaeadf819aa2b73832a91fcf30910d6af6ee10c541f0c6261a
embedded_file_obj0057.bin pdf-embedded-file PDF EmbeddedFile object 57 at offset 0x1B7565 162566 bytes
SHA-256: 6b4b62781e5de0997aebdd980ddcb374c08b70f670671d30382324f348424f16
javascript_obj0027_000.js pdf-javascript-stream PDF /JS object 27 at offset 0x18A0 1169 bytes
SHA-256: 0ab3d232b2f2272b7039ee3e45d0be78ade06bb45327a799559ad4a592ef5a3d
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_string_Need_New_Version_Msg_Old = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_string_Need_New_Version_Msg = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may display, but may not work properly. Some form elements might not be visible at all. Click OK for more information on obtaining the latest version of Adobe Reader.";
ADBE.Viewer_string_Need_New_Version_Msg_Updater = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may display, but may not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj0028_001.js pdf-javascript-stream PDF /JS object 28 at offset 0x1746 902 bytes
SHA-256: e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 9.0)
{
   ADBE.Reader_Need_Version = 9.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 9.0)
{
   ADBE.Viewer_Need_Version = 9.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0029_002.js pdf-javascript-stream PDF /JS object 29 at offset 0x1569 1363 bytes
SHA-256: 529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.8)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_string_Need_New_Version_Msg_Old, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 9.0)
         {
            if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_string_Need_New_Version_Msg_Updater, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.8"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
stream_006_off000af611.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xAF611 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
stream_007_off000e1f18.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE1F18 352198 bytes
SHA-256: 1e8564d3d89047875dccaa98279599de9d7ddf77240906041f1156ba8edf3315
embedded_pdf_script_00003f65.bin pdf-embedded-script PDF raw stream script payload at offset 0x3F65 10491 bytes
SHA-256: fa02a0d4947b5f2c6c9b6fe9648af45d8bfd132393d481694df3a8362e7db897
Preview script
First 1,000 lines of the extracted script
<config xmlns:xfa="http://www.xfa.org/schema/xci/2.8/" xmlns="http://www.xfa.org/schema/xci/2.8/"
><present
><!--  [0..n]  --><cache
><macroCache formats=""
/><renderCache enable="1"
/><templateCache maxEntries="5"
/></cache
><common
><callout name=""
><!--  [0..n]  --><binary
/><event
/></callout
><localeSet
/><log
><!--  [0..n]  --><uri
/><mode
>append</mode
><!-- append|overwrite --><threshold
>trace</threshold
><!-- trace|information|warning|error --><to
>memory</to
><!-- uri|memory|stdout|null|stderror|system --></log
><messaging
><message
><!--  [0..n]  --><msgId
>0</msgId
><severity
>ignore</severity
><!-- ignore|trace|information|warning|error --></message
></messaging
><suppressBanner
>0</suppressBanner
><!-- 0|1 --><temp
><uri
>C:\WINDOWS\TEMP\</uri
></temp
><template
><base
>C:/smardocwork/</base
><startPage
>0</startPage
><uri
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
><relevant
/></template
><versionControl outputBelow="warn" sourceAbove="warn" sourceBelow="update"
/><data
><adjustData
>1</adjustData
><!-- 0|1 --><attributes
>preserve</attributes
><!-- ignore|delegate|preserve --><excludeNS
/><!--  [0..n]  --><incrementalLoad
>none</incrementalLoad
><!-- none|forwardOnly --><outputXSL
><uri
/></outputXSL
><range
/><record
/><startNode
/><transform ref=""
><!--  [0..n]  --><groupParent
/><ifEmpty
>dataValue</ifEmpty
><!-- ignore|remove|dataGroup|dataValue --><nameAttr
/><picture
/><rename
/><whitespace
>preserve</whitespace
><!-- trim|rtrim|ltrim|normalize|preserve --><presence
>preserve</presence
><!-- ignore|dissolve|preserve|dissolveStructure --></transform
><uri
/><window
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
></data
><locale
>en_US</locale
><metaData
/></common
><copies
>1</copies
><destination
>pdf</destination
><!-- pdf|ps|pcl --><driver level="" name=""
><!--  [0..n]  --><fontInfo
><alwaysEmbed
/><!--  [0..n]  --><defaultTypeface writingScript="*"
/><!--  [0..n]  --><embed
>0</embed
><!-- 0|1 --><map
><equate force="" from="" to="" validate="1"
/><!-- [0..n] Attributes: from='', to='', force='0|1' [0..n]  --><equateRange from="" to="" unicodeRange=""
/><!--  [0..n]  --></map
><neverEmbed
/><!--  [0..n]  --><subsetBelow
>100</subsetBelow
></fontInfo
><xdc
><uri
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
></xdc
></driver
><image name=""
><!--  [0..n]  --><compression
><compressObjectStream
>0</compressObjectStream
><!-- 0|1 --><compressLogicalStructure
>0</compressLogicalStructure
><!-- 0|1 --><level
>6</level
><type
>none</type
><!-- none|packbit|ccittrle|ccittfax3|ccittfax4 --></compression
><fontInfo
><alwaysEmbed
/><!--  [0..n]  --><defaultTypeface writingScript="*"
/><!--  [0..n]  --><embed
>0</embed
><!-- 0|1 --><map
><equate force="" from="" to="" validate="1"
/><!-- [0..n] Attributes: from='', to='', force='0|1' [0..n]  --><equateRange from="" to="" unicodeRange=""
/><!--  [0..n]  --></map
><neverEmbed
/><!--  [0..n]  --><subsetBelow
>100</subsetBelow
><!-- An integer value between 0-100 representing a percentage --></fontInfo
><xdc
><uri
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
></xdc
><cSpace
>SRGB</cSpace
><!-- SRGB|mono --><version
>1.3</version
></image
><incrementalMerge
>1</incrementalMerge
><overprint
>none</overprint
><!-- none|draws|fields|drawsAndFields --><pagination
>simplex</pagination
><!-- simplex|duplexLongEdge|duplexShortEdge --><paginationOverride
>none</paginationOverride
><!-- none|forceSimplex|forceDuplex|forceDuplexLongEdge|forceDuplexShortEdge --><pcl name=""
><!--  [0..n]  --><batchOutput format="none"
/><fontInfo
><alwaysEmbed
/><!--  [0..n]  --><defaultTypeface writingScript="*"
/><!--  [0..n]  --><embed
>0</embed
><!-- 0|1 --><map
><equate force="" from="" to="" validate="1"
/><!-- [0..n] Attributes: from='', to='', force='0|1' [0..n]  --><equateRange from="" to="" unicodeRange=""
/><!--  [0..n]  --></map
><neverEmbed
/><!--  [0..n]  --><subsetBelow
>100</subsetBelow
><!-- An integer value between 0-100 representing a percentage --></fontInfo
><jog
>usePrinterSetting</jog
><!-- usePrinterSetting|none|pageSet --><macro
/><mediumInfo
><map
><equate force="" from="" to="" validate="1"
/><!--  [0..n]  --><equateRange from="" to="" unicodeRange=""
/><!--  [0..n]  --></map
></mediumInfo
><outputBin
/><pageOffset x="useXDCSetting" y="useXDCSetting"
/><staple mode="usePrinterSetting"
/><xdc
><uri
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
></xdc
></pcl
><pdf name=""
><!--  [0..n]  --><adobeExtensionLevel
>3</adobeExtensionLevel
><batchOutput format="none"
/><compression
><compressObjectStream
>0</compressObjectStream
><!-- 0|1 --><compressLogicalStructure
>0</compressLogicalStructure
><!-- 0|1 --><level
>6</level
><!-- 0 - 9, 0=no compression 1=best speed 9=best compression --><type
>none</type
></compression
><creator
>Adobe LiveCycle Forms 8.2</creator
><encryption
><encrypt
>0</encrypt
><!-- 0|1 --><encryptionLevel
>40bit</encryptionLevel
><!-- 40bit|128bit --><permissions
><accessibleContent
>0</accessibleContent
><!-- 0|1 --><contentCopy
>0</contentCopy
><!-- 0|1 --><documentAssembly
>0</documentAssembly
><!-- 0|1 --><formFieldFilling
>0</formFieldFilling
><!-- 0|1 --><modifyAnnots
/><plaintextMetadata
>0</plaintextMetadata
><!-- 0|1 --><print
>1</print
><!-- 0|1 --><printHighQuality
/><change
>0</change
><!-- 0|1 --></permissions
></encryption
><fontInfo
><alwaysEmbed
/><!--  [0..n]  --><defaultTypeface writingScript="*"
/><!--  [0..n]  --><embed
>1</embed
><!-- 0|1 --><map
><equate force="" from="" to="" validate="1"
/><!-- [0..n] Attributes: from='', to='', force='0|1' [0..n]  --><equateRange from="" to="" unicodeRange=""
/><!--  [0..n]  --></map
><neverEmbed
/><!--  [0..n]  --><subsetBelow
>100</subsetBelow
><!-- An integer value between 0-100 representing a percentage --></fontInfo
><interactive
>1</interactive
><!-- 0|1 --><linearized
>0</linearized
><!-- 0|1 --><openAction
><destination
>none</destination
><!-- none|pageFit --></openAction
><pdfa
><amd
/><conformance
>A</conformance
><!-- A|B --><includeXDPContent
/><part
>1</part
></pdfa
><producer
>Adobe LiveCycle Forms 8.2</producer
><renderPolicy
>client</renderPolicy
><!-- server|client --><scriptModel
>XFA</scriptModel
><!-- XFA|none --><silentPrint
><addSilentPrint
>0</addSilentPrint
><!-- 0|1 --><printerName
/></silentPrint
><submitFormat
>html</submitFormat
><!-- html|fdf|xml|pdf --><tagged
>0</tagged
><!-- 0|1 --><taggedMode
>normal</taggedMode
><!-- normal|custom --><viewerPreferences
><addViewerPreferences
>0</addViewerPreferences
><!-- 0|1 --><duplexOption
>simplex</duplexOption
><!-- simplex|duplexFlipShortEdge|duplexFlipLongEdge --><numberOfCopies
/><pageRange
/></viewerPreferences
><xdc
><uri
>adobepdf.xdc</uri
><xsl
><debug
><uri
/></debug
><uri
/></xsl
></xdc
><version
>1.7</version
><!-- 1.5=acrobat 6|1.6=acrobat 7|1.65=acrobat 7.0.5|1.7=acrobat 8 --></pdf
><ps name=""
><!--  [0..n]  --><batchOutput format="none"
/><compress scope="imageOnly"
/><fontInfo
><alwaysEmbed
/><!--  [0..n]  --><defaultTypeface writingScript="*"
/><!--  [0..n]  --><embed
>0</embed
><!-- 0|1 --><map
><equate force="" from="" to="" validate="1"
/><!-- [0..n] Attributes: from='', to='', force='0|1' [0..n]  --><equateRange from="" to="" unicodeRange=""
/><!--  [0..n]  --></map
><neverEmbed
/><!--  [0..n]  --><subsetBelow
>100</subsetBelow
><!-- An integer value between 0-100 representing a percentage --></fontInfo
><jog
>usePrinterSetting</jog
><!-- usePrinterSetting|none|pageSet --><macro
/><mediumInfo
><map
><equate force="" from="" to="" validate="1"
/><!--  [0..n]  --><equateRange from="" to="" unicodeRange=""
/><!--  [0..n]  --></map
></mediumInfo
><outputBin
/><staple mode="usePrinterSetting"
/><xdc
><uri
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
></xdc
></ps
><!--  [0..n]  --><webClient name=""
><!--  [0..n]  --><fontInfo
><alwaysEmbed
/><!--  [0..n]  --><defaultTypeface writingScript="*"
/><!--  [0..n]  --><embed
>0</embed
><!-- 0|1 --><map
><equate force="" from="" to="" validate="1"
/><!-- [0..n] Attributes: from='', to='', force='0|1' [0..n]  --><equateRange from="" to="" unicodeRange=""
/><!--  [0..n]  --></map
><neverEmbed
/><!--  [0..n]  --><subsetBelow
>100</subsetBelow
></fontInfo
><xdc
><uri
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
></xdc
></webClient
><xdp
><embedRenderedOutput
>0</embedRenderedOutput
><!-- 0|1 --><packets
>*</packets
></xdp
><zpl name=""
><!--  [0..n]  --><batchOutput format="none"
/><flipLabel
>0</flipLabel
><!-- 0|1 --><fontInfo
><alwaysEmbed
/><!--  [0..n]  --><defaultTypeface writingScript="*"
/><!--  [0..n]  --><embed
>0</embed
><!-- 0|1 --><map
><equate force="" from="" to="" validate="1"
/><!-- [0..n] Attributes: from='', to='', force='0|1' [0..n]  --><equateRange from="" to="" unicodeRange=""
/><!--  [0..n]  --></map
><neverEmbed
/><!--  [0..n]  --><subsetBelow
>100</subsetBelow
><!-- An integer value between 0-100 representing a percentage --></fontInfo
><macro
/><xdc
><uri
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
></xdc
></zpl
><layout
>paginate</layout
><!-- paginate|panel --><output
><uri
/><to
>memory</to
><!-- uri|memory|stdout|null --><type
>native</type
><!-- native|xdp|mergedXDP --></output
><script
><currentPage
>0</currentPage
><exclude
>initialize ready calculate enter exit validate nullTest formatTest docClose</exclude
><runScripts
>server</runScripts
><!-- client|server|both|none --></script
><validate
>preSubmit</validate
><submitUrl
>http://localhost:8080/FormsWSQS/HandleData</submitUrl
></present
><acrobat
><acrobat7
><dynamicRender
>required</dynamicRender
></acrobat7
><common
><versionControl sourceBelow="maintain"
/><locale
>en_US</locale
><data
><!-- 0|1 --><!-- ignore|delegate|preserve --><!--  [0..n]  --><!-- none|forwardOnly --><adjustData
>1</adjustData
><attributes
>preserve</attributes
><excludeNS
/><incrementalLoad
>none</incrementalLoad
><outputXSL
><uri
/></outputXSL
><range
/><record
/><startNode
/><transform ref=""
><!--  [0..n]  --><!-- ignore|remove|dataGroup|dataValue --><!-- trim|rtrim|ltrim|normalize|preserve --><!-- ignore|dissolve|preserve|dissolveStructure --><groupParent
/><ifEmpty
>dataValue</ifEmpty
><nameAttr
/><picture
/><rename
/><whitespace
>preserve</whitespace
><presence
>preserve</presence
></transform
><uri
/><window
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
></data
><template
><base
>C:/smardocwork/</base
><startPage
>0</startPage
><uri
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
><relevant
/></template
></common
><validate
>preSubmit</validate
></acrobat
></config
>
font_00_sfnt_off000779ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x779EE 95975 bytes
SHA-256: c29e5b1537bee8c88b3ffca56c5f24a45ec8da374cf9d4c0b4a78d04fc230949
font_01_sfnt_off000883fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x883FA 97320 bytes
SHA-256: 926d8eb5abd4c74e46a419aaf25a490564d389c7a250d2392b198a342df65b8a
font_02_sfnt_off00098c10.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x98C10 173912 bytes
SHA-256: b00e7021057467332c8f8af567cecc8f5b0cd81afb6370e3470acaf1454e14f9
font_05_sfnt_off001b95d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B95D4 100386 bytes
SHA-256: c2866f0a01f1ce525d7f9cf64dedca6f78fb819607944a1bad77ae8d36a08de5

Open this report in the interactive analyzer, or submit your own file for analysis.