Malicious PDF — malware analysis report

Static analysis result for SHA-256 b94f1d5b33787c78…

MALICIOUS

PDF

362.6 KB First seen: 2026-05-09
MD5: bdcd80d47c95745580ad54e187f7456b SHA-1: 247c4bc31aa53c39d387611685a3fd7a4ada0aea SHA-256: b94f1d5b33787c78694721ad497ffec68e2ed18ccfeb785e1f7603771d317dc7
168 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.007 JavaScript

The PDF file contains embedded JavaScript, indicated by PDF_JAVASCRIPT and PDF_JS heuristics. The JavaScript stream, specifically stream_002_off0000065f.js, utilizes eval() and unescape() functions, suggesting obfuscation and dynamic code execution. This script is likely responsible for downloading and executing a second-stage payload. The presence of these techniques points to a downloader or droppper functionality, common in initial access stages of an attack.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2593

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
                     var quarterString = eval("quarterContainer._" + quarter);
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pajhome.org.uk/crypt/md5 Referenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
    • http://purl.org/dc/elements/1.1/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/g/img/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/mm/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#Referenced by PDF JavaScript
    • http://ns.adobe.com/illustrator/1.0/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/t/pg/Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#Referenced by PDF JavaScript
    • http://ns.adobe.com/xap/1.0/g/Referenced by PDF JavaScript
    • http://ns.adobe.com/pdf/1.3/Referenced by PDF JavaScript
    • http://www.unicode.org/reports/tr35/tr35-11.html#Number_Format_PatternsReferenced by PDF JavaScript
    • http://www.unicode.org/reports/tr35/tr35-11.html#Lenient_ParsingReferenced by PDF JavaScript
    • http://unicode.org/reports/tr18/Referenced by PDF JavaScript

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000065f.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x65F 433067 bytes
SHA-256: 78a09da5d2c3141b9b5e84788882238071d67b5ac7da2a1d84457b00801ccc9b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 10 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
stream_080_off00037600.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x37600 213 bytes
SHA-256: 88cf83eacfa4ab997462d207c0c2ed6b53626fc3794ce976e7bdf29d2c84f5d4
deobfuscated.js deobfuscated-js PDF JavaScript deobfuscation pass 3244221 bytes
SHA-256: 0fa701399c7ae0f65114a63125a439929c12fd23db43ca79e7eb6035865e5a4f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 20 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
�     h    �y     >     �     �     �           �           �           �           �           �           �           �           �     �     �     �     �     �     �           �           �           �           �     �           �           �           �           �     �           �           �           �           �     �           �           �           �           �     �           �           �           �           �     �     �           �           v     �           �           �           �     *     *     K     1     ,     �     �     �     w    g�     W    
	     9    �v     E    K�     �     �          H�   �@@     ?                                                                                                                                                                                                                                                                                                                                                                                                  �  ��
       �     t                      � H  @ ���$!u0 `   �P ��DP���                                                                                        ��5��� .6�޿� �}y�z� 8���v��:m����\Wq����@              ������������������������������������   �����  ���  �� � �� ����$!u0 `   �P �   &  ��   i   v     W  ۑ y�-  � 0     � C 0  �   � � . � D�0�   0 P (   � E "� �   8   : � N�/  @	� � t x � ^ '@ � � � � ( � J -  � @ P P h � Z %  �	@ � ( ( � J -  � @ � � B � E 1@I� � � P h � Z "� `	� � L � � j�&   �   ��   � q"��=Ģ�   � nG:
��9� @     $ 
 � C 0  �
 �� �                                  f  ��V��wr��}�6+֫S%<��͝>��r�ȏ  8�_?� �N�5l��F Y3X�r�i�)T�"Tȏ @�ѳ�L�.X�B I  4p� E   0p`�   5  ��       �

var cldr={
"supplemental_plurals":{
"zero":function(n) { return false; },
"one":function(n) { return n == 1; },
"two":function(n) { return false; },
"few":function(n) { return false; },
"many":function(n) { return false; }
},
"numbers_symbols":{
"decimal":".",
"group":"'",
"list":";",
"nativeZeroDigit":"0",
"plusSign":"+",
"minusSign":"-",
"numberPattern":"#,##0.###",
"nan":"NaN",
"infinity":"\u221E"
},
"calendar_gregorian":{
"months_format":{
"abbreviated":{
"_1":"Jan","_2":"Feb","_3":"Mrz","_4":"Apr","_5":"Mai","_6":"Jun","_7":"Jul","_8":"Aug","_9":"Sep","_10":"Okt","_11":"Nov","_12":"Dez"
},
"wide":{
"_1":"Januar","_2":"Februar","_3":"M\u00E4rz","_4":"April","_5":"Mai","_6":"Juni","_7":"Juli","_8":"August","_9":"September","_10":"Oktober","_11":"November","_12":"Dezember"
},
"narrow":{
"_1":"J","_2":"F","_3":"M","_4":"A","_5":"M","_6":"J","_7":"J","_8":"A","_9":"S","_10":"O","_11":"N","_12":"D"
}
},
"months_stand_alone":{
"abbreviated":{
"_3":"M\u00E4r","_7":"Jul","_8":"Aug","_9":"Sep","_10":"Okt","_11":"Nov","_12":"Dez","_1":"Jan","_2":"Feb","_4":"Apr","_5":"Mai","_6":"Jun"
},
"wide":{
"_1":"Januar","_2":"Februar","_3":"M\u00E4rz","_4":"April","_5":"Mai","_6":"Juni","_7":"Juli","_8":"August","_9":"September","_10":"Oktober","_11":"November","_12":"Dezember"
},
"narrow":{
"_1":"J","_2":"F","_3":"M","_4":"A","_5":"M","_6":"J","_7":"J","_8":"A","_9":"S","_10":"O","_11":"N","_12":"D"
}
},
"days_format":{
"abbreviated":{
"sun":"So.","mon":"Mo.","tue":"Di.","wed":"Mi.","thu":"Do.","fri":"Fr.","sat":"Sa."
},
"wide":{
"sun":"Sonntag","mon":"Montag","tue":"Dienstag","wed":"Mittwoch","thu":"Donnerstag","fri":"Freitag","sat":"Samstag"
},
"narrow":{
"sun":"S","mon":"M","tue":"D","wed":"M","thu":"D","fri":"F","sat":"S"
}
},
"days_stand_alone":{
"abbreviated":{
"sun":"So.","mon":"Mo.","tue":"Di.","wed":"Mi.","thu":"Do.","fri":"Fr.","sat":"Sa."
},
"wide":{
"sun":"Sonntag","mon":"Montag","tue":"Dienstag","wed":"Mittwoch","thu":"Donnerstag","fri":"Freitag","sat":"Samstag"
},
"narrow":{
"sun":"S","mon":"M","tue":"D","wed":"M","thu":"D","fri":"F","sat":"S"
}
},
"quarters_format":{
"abbreviated":{
"_1":"Q1","_2":"Q2","_3":"Q3","_4":"Q4"
},
"wide":{
"_1":"1. Quartal","_2":"2. Quartal","_3":"3. Quartal","_4":"4. Quartal"
},
"narrow":{
"_1":"1","_2":"2","_3":"3","_4":"4"
}
},
"quarters_stand_alone":{
"abbreviated":{
"_1":"Q1","_2":"Q2","_3":"Q3","_4":"Q4"
},
"wide":{
"_1":"1. Quartal","_2":"2. Quartal","_3":"3. Quartal","_4":"4. Quartal"
},
"narrow":{
"_1":"1","_2":"2","_3":"3","_4":"4"
}
},
"am":"vorm.",
"pm":"nachm.",
"eraNames":{"beforeChrist":"v. Chr.","afterChrist":"n. Chr."},
"eraAbbr":{"beforeChrist":"v. Chr.","afterChrist":"n. Chr."},
"eraNarrow":{"beforeChrist":"v. Chr.","afterChrist":"n. Chr."},
"relative_days":{
"_0":"Heute","_1":"Morgen","_2":"\u00DCbermorgen","_3":"In drei Tagen","_-1":"Gestern","_-2":"Vorgestern","_-3":"Vor drei Tagen"
},
"months_all":{
"_1":["Januar","January","janvier","gennaio"],"_2":["Februar","February","f\u00E9vrier","febbraio"],"_3":["M\u00E4rz","March","mars","marzo"],"_4":["April","avril","aprile"],"_5":["Mai","May","mai","maggio"],"_6":["Juni","June","juin","giugno"],"_7":["Juli","July","juillet","Luglio"],"_8":["August","ao\u00FBt","agosto"],"_9":["September","septembre","settembre"],"_10":["Oktober","October","octobre","ottobre"],"_11":["November","novembre"],"_12":["Dezember","December","d\u00E9cembre","dicembre"]
},
"days_all":{
"sun":["Sonntag","Sunday","dimanche","domenica"],"mon":["Montag","Monday","lundi","luned\u00EC"],"tue":["Dienstag","Tuesday","mardi","marted\u00EC"],"wed":["Mittwoch","Wednesday","mercredi","mercoled\u00EC"],"thu":["Donnerstag","Thursday","jeudi","gioved\u00EC"],"fri":["Freitag","Friday","vendredi","venerd\u00EC"],"sat":["Samstag","Saturday","samedi","sabato"]
},
"timeFormats":{
"short":"HH:mm",
"medium":"HH:mm:ss",
},
"dateFormats":{
"short":"dd.MM.yy",
"medium":"dd.MM.yyyy",
"long":"d. MMMM yyyy",
"full":"EEEE, d. MMMM yyyy",
},
},
"timeZoneNames":{
"hourFormat":"+HH:mm;-HH:mm",
"gmtFormat":"GMT{0}",
},
"numbers_currencyFormats":{
"currencySpacing":{
"beforeCurrency":{
"currencyMatch":"[:letter:]",
"surroundingMatch":"[:digit:]",
"insertBetween":"\u00A0"
},
"afterCurrency":{
"currencyMatch":"[:letter:]",
"surroundingMatch":"[:digit:]",
"insertBetween":"\u00A0"
}
},
"unitPatterns":{
"one":"{0} {1}"
,"other":"{0} {1}"

},
"currencyPattern":"\u00A4\u00A0#,##0.00;\u00A4-#,##0.00"
},
"numbers_currencies":{
},
"supplemental_currencyData_fractions":{"DEFAULT":{"digits":2,"rounding":0},
}
}

var formProperties = new Array();
var CANCEL_EVENT = false;
var EMPTY = 0;
var VALID = 1;
var INVALID = 2;
var REQUIRED = 3;

var INVALIDITY_REASON_INPUT = 0;
var INVALIDITY_REASON_OTHER = 1;

var commitWithTab = false;
var tabTarget = "";
var nextFieldState = 0;
var tabOn = true;
var eventLevel = 0;
var backward = false;
var prevAcroField = null;
var possibleBackJump = false;
//var nextAcroField = null;
var submitForm_formatingBack = false;
var ignoreAllEvents = false;
var ignoreAllRules = false;
var fieldIdCached = new Array();
var CANCEL_CALCULATION = false;
var CALCULATE_RULES = false;
var CALCULATION_ONE_FILLED = false;
var CALCULATION_ALL_FILLED = false;
var CALCULATION_WITH_FIELD = false;
this.SWISSFORMS_FORM = true;

var openTime;

var IN_INIT = false;

var IGNORE_FORMAT_EVENT = false;

var CACHED_CB_GROUPS = new Array();

var printHiddenFieldOriginalDisplay = undefined;

var calculateCounter = 0;

if(app.runtimeHighlight)
{
	app.runtimeHighlight = false;
}

/// events

var eventRegister = new Object();

function registerEvent(eventName, fieldName, source)
{
	if(eventRegister[eventName] == undefined) eventRegister[eventName] = new Object();
	if(eventRegister[eventName][fieldName] == undefined) eventRegister[eventName][fieldName] = new Array();
	eventRegister[eventName][fieldName].push(source);
}

function handleEvent(event, withRules)
{
	if (ignoreAllEvents)
		return;
	
	var eventName = event.name;
	if (eventName == "Format" && IGNORE_FORMAT_EVENT)
		return;
	
	// optimization: don't blur or format hidden fields
	if ((eventName == "Format" || eventName == "Blur") && event.target != undefined)
	{
		if (event.target.hidden)
			return;
	}
	
	eventLevel++;
	
	/*if (eventName == "Calculate")
		console.println("Enter Event: " + eventName + ", " + event.source.name + ", " + eventLevel);
	else
		console.println("Enter Event: " + eventName + ", " + event.target.name + ", " + eventLevel);*/
	
	if(eventName == "Keystroke" && event.target != null && event.commitKey == 3 && eventLevel == 1)
	{
		//this.console.println("tab commit: " + event.target.name);

		// look up prev active field
		prevAcroField = tabOrderB[event.target.name];
		var pField = this.getField(prevAcroField);
		while(pField != null && (pField.display == 1 || pField.display == 3 || pField.readonly))
		{
			prevAcroField = tabOrderB[prevAcroField];
			pField = this.getField(prevAcroField);
		}

		/*// look up prev active field
		nextAcroField = tabOrder[event.target.name];
		var nField = this.getField(nextAcroField);
		while(nField != null && (nField.display == 1 || nField.display == 3 || nField.readonly))
		{
			nextAcroField = tabOrder[nextAcroField];
			nField = this.getField(nextAcroField);
		}*/

		commitWithTab = true;
		tabTarget = event.target.name;
		nextFieldState = event.target.display;
	}


	if(eventRegister[eventName] == undefined)
	{
		if(eventName == "Calculate")
		{
			calculateFields(event);
		}
		
		/*if (eventName == "Calculate")
			console.println("Leave Event: " + eventName + ", " + event.source.name + ", " + eventLevel);
		else
			console.println("Leave Event: " + eventName + ", " + event.target.name + ", " + eventLevel);*/
			
		eventLevel--;
		return;
	}
	var registeredEvent = eventRegister[eventName];
	if(registeredEvent[event.target.name] == undefined)
	{
		/*if (eventName == "Calculate")
			console.println("Leave Event: " + eventName + ", " + event.source.name + ", " + eventLevel);
		else
			console.println("Leave Event: " + eventName + ", " + event.target.name + ", " + eventLevel);*/
			
		eventLevel--;
		return;
	}
	var fieldName = event.target.name;
	CANCEL_EVENT = false;
	for(var i = 0; i < registeredEvent[fieldName].length; i++)
	{
		if(!CANCEL_EVENT)
		{
			registeredEvent[fieldName][i](event);
		}
		else break;
	}

	//if(withRules != 1) doRules(event);

	if(eventName == "Calculate")
	{
		calculateFields(event);
	}

	//////////////// ACHTUNG
	
	if(possibleBackJump && eventName == "Focus" && eventLevel == 1)
	{
		if(event.target.name == prevAcroField)
		{
			var nextFieldName = tabOrderB[tabTarget];

			var name = nextFieldName;
			var field2 = this.getField(name);

			while(field2 != null && (field2.display == 1 || field2.display == 3 || field2.readonly))
			{
				name = tabOrderB[name];
				field2 = this.getField(name);
			}

			field2.setFocus();
		}
	}
	else if(possibleBackJump && eventName == "Blur" && tabTarget == event.target.name && eventLevel == 1)
	{
		;
		// do nothing
	}
	else if(possibleBackJump && eventLevel == 1)
	{
		possibleBackJump = false;
	}

	/*if (eventName == "Calculate")
		console.println("Leave Event: " + eventName + ", " + event.source.name + ", " + eventLevel);
	else
		console.println("Leave Event: " + eventName + ", " + event.target.name + ", " + eventLevel);*/
	
	eventLevel--;
}

function getFieldById(id)
{
	if (fieldIdCached[id] != undefined)
	{
		return fieldIdCached[id];
	}
	else
	{
		var name = fieldIdNameMapping[""+id];
		if (name == undefined) return undefined;
		var field = this.getField(name);
		if (field == undefined) return undefined;
		fieldIdCached[id] = field;
		return field;
		return undefined;
	}
}

function doRules(rulesArr)
{
	if(rules != undefined)
	{
		if (!ignoreAllRules)
		{
			rulesArr.sort();
			for(var i = 0; i < rulesArr.length; i ++)
			{
				var rule = rules[rulesArr[i]];
				CALCULATE_RULES = true;
				var complied = Boolean(rule["condition"]());
				if(complied)
				{
					if(rule["trueActions"] != undefined)
					{
						for(var j = 0; j < rule["trueActions"].length; j++)
						{
							tabOn = false;
							rule["trueActions"][j]();
							tabOn = true;
						}
					}
				}
				else
				{
					if(rule["falseActions"] != undefined)
					{
						for(var j = 0; j < rule["falseActions"].length; j++)
						{
							tabOn = false;
							rule["falseActions"][j]();
							tabOn = true;
						}
					}
				}
			}
		}
		//this.console.println("setFocus: " + event.target.name + " level: " + eventLevel);

		if(commitWithTab && tabOn && eventLevel == 1)
		{
			var nextFieldName = tabOrder[tabTarget];
			var name = nextFieldName;
			var field2 = this.getField(name);

			while(field2 != null && (field2.display == 1 || field2.display == 3 || field2.readonly))
			{
				name = tabOrder[name];
				field2 = this.getField(name);
			}

			field2.setFocus();
			possibleBackJump = true;
			commitWithTab = false;
		}
	}
}

function customValidateAllFieldsWithBlur(fieldName)
{
	if(fields[fieldName] != undefined && fields[fieldName]["validations"] != undefined)
	{
		for(var i = 0; i < fields[fieldName]["validations"].length; i++)
		{
			var fName = fields[fieldName]["validations"][i];
			var field = this.getField(fName);

			if(field != undefined)
			{
				generateOnlyValidateEvent(field);
				var dummyEvent = new Object();
				dummyEvent.target = field;
				dummyEvent.name = "Blur";
				handleEvent(dummyEvent);
			}
		}
	}
}

function customValidateAllFields(fieldName)
{
	if(fields[fieldName] != undefined && fields[fieldName]["validations"] != undefined)
	{
		for(var i = 0; i < fields[fieldName]["validations"].length; i++)
		{
			var fName = fields[fieldName]["validations"][i];
			var field = this.getField(fName);

			if(field != undefined)
			{
				generateOnlyValidateEvent(field);
			}
		}
	}
}

function calculateFields(event)
{
	if (event.source == undefined) return;
	var currFieldName = event.source.name;
	
	customValidateAllFieldsWithBlur(currFieldName);
	if (fields[currFieldName] == undefined) return;
	
	var fieldId = fields[currFieldName]["id"];
	var currIndex = calcTreeEntryMapping[fieldId+""];
	
	var rulesArr = new Array();
	if (currIndex != -1 && currIndex != undefined)
	{
		var first = true;
	
		while (currIndex != -1 && currIndex != undefined)
		{
			if (flatCalcTree[currIndex] == undefined) break;
			var field = getFieldById(flatCalcTree[currIndex].fieldId);
			if(field != undefined && first == false)
			{
				var changed = calculateField(field);
				if (changed)
					customValidateAllFieldsWithBlur(field.name);
			}
			
			for(var i = 0; i < fields[field.name]["rules"].length; i++)
			{
				var rule = fields[field.name]["rules"][i];
				rulesArr.push(rule);
			}
			
			currIndex = flatCalcTree[currIndex].next;
			first = false;
		}
	}
	else
	{
		for(var i = 0; i < fields[event.source.name]["rules"].length; i++)
		{
			var rule = fields[event.source.name]["rules"][i];
			rulesArr.push(rule);
		}
	}
	
	
	// execute rules sorted in next event for that the rules can change the actual edited value
	doRules(rulesArr);
}

function calculateField(field)
{
	var changedValue = false;
	if(fields[field.name]["expression"] != undefined)
	{	
		CANCEL_CALCULATION = false;
		CALCULATE_RULES = false;
		CALCULATION_ONE_FILLED = false;
		CALCULATION_ALL_FILLED = true;
		CALCULATION_WITH_FIELD = false;
		
		var evaluated = fields[field.name]["expression"]();
		if (CANCEL_CALCULATION)
		{
			if (field.value != "")
			{
				field.value = "";
				changedValue = true;
			}
		}
		
		else if (CALCULATION_WITH_FIELD == true &&
				((fields[field.name]["expressionBehavior"] == 0 && CALCULATION_ALL_FILLED == false) || (fields[field.name]["expressionBehavior"] == 1 && CALCULATION_ONE_FILLED == false)))
		{
			// handle behavior if empty fields
			if (field.value != "")
			{
				field.value = "";
				changedValue = true;
			}
		}
		else
		{
			var newValue;
			if (typeof(evaluated) == 'number')
				newValue = formatNumber(evaluated, "0.#########");
			else
				newValue = evaluated;
				
			if (newValue != field.value)
			{
				field.value = newValue;
				changedValue = true;
			}
		}
	}
	return changedValue;
}

function generateDoRules(field)
{
	var rulesArr = new Array();
	for(var i = 0; i < fields[field.name]["rules"].length; i++)
	{
		var rule = fields[field.name]["rules"][i];
		rulesArr.push(rule);
	}
	doRules(rulesArr);
}

function arrayContains(arr, val)
{
	for(var i = 0; i < arr.length; i++)
	{
		if(arr[i] == val) return true;
	}

	return false;
}

function generateBlurEvent(field)
{
	var dummyEvent = new Object();
	var fieldValue = field.value;
	dummyEvent.target = field;
	dummyEvent.name = "Blur";
	handleEvent(dummyEvent);
}

function generateValidateEvent(field)
{
	var dummyEvent = new Object();
	var fieldValue = field.value;
	
	generateOnlyValidateEvent(field);
	dummyEvent.target = field;
	dummyEvent.name = "Calculate";
	dummyEvent.source = field;
	handleEvent(dummyEvent)
	calculateField(field);
	dummyEvent.name = "Blur";
	handleEvent(dummyEvent);
}

function generateOnlyValidateEvent(field)
{
	var dummyEvent = new Object();
	var fieldValue = field.valueAsString;
	// take the display value for combobox fields
	if (field.type == "combobox")
	{
		var index = field.currentValueIndices;
		
		if (index != -1)
		{
			var name = field.getItemAt(index, false);
			if (name != undefined)
				fieldValue = name;
		}
	}
	
	dummyEvent.name = "Validate";
	dummyEvent.target = field;
	dummyEvent.value = fieldValue;
	handleEvent(dummyEvent);
	
	// set field value if validate has changed value
	if (dummyEvent.value+"" != fieldValue+"")
	{
		ignoreAllEvents = true;
		field.value = dummyEvent.value;
		ignoreAllEvents = false;
	}
	else if (field.type != "combobox")
	{
		ignoreAllEvents = true;
		field.value = field.valueAsString;
		ignoreAllEvents = false;
	}
}

function javascriptsLoaded()
{
	openTime = new Date();
	initForm();
}

function initForm(dontFocusFirstField)
{
	//this.delay = true;
	this.calculate = false;
	IN_INIT = true;

	for(var k in fields)
	{
		var field = this.getField(k);

		if(field != undefined)
		{
			if (field.type != "checkbox")
			{
				generateOnlyValidateEvent(field);
			}
			else
			{
				// only validate check box group one time
				if (fields[field.name] != undefined && fields[field.name]["cbGroup"] != undefined && fields[field.name]["cbGroup"] != "")
				{
					var cbGroup = fields[field.name]["cbGroup"];
					if (CACHED_CB_GROUPS[cbGroup] == undefined)
						CACHED_CB_GROUPS[cbGroup] = new Array();
					
					CACHED_CB_GROUPS[cbGroup].push(field);
				}
				else
					generateOnlyValidateEvent(field);
			}
		}
	}
	
	// validate check box groups
	for (var group in CACHED_CB_GROUPS)
	{
		if (validateCbGroup != undefined)
		{
			validateCbGroup(CACHED_CB_GROUPS[group], undefined);
		}
	}

	for (var i = 0; i < openCalcOrderList.length; i ++)
	{
		var fieldId = openCalcOrderList[i];
		var field = getFieldById(fieldId);
		if (field == undefined) continue;
		
		ignoreAllEvents = true;
		var changed = calculateField(field);
		ignoreAllEvents = false;
		if (changed)
		{
			generateOnlyValidateEvent(field);
			customValidateAllFields(field.name);
		}
	}

	for(var k in fields)
	{
		var field = this.getField(k);

		if(field != undefined)
		{
			generateDoRules(field);
			if (field.type != "checkbox")
				generateBlurEvent(field);
			else
			{
				if (!(fields[field.name] != undefined && fields[field.name]["cbGroup"] != undefined && fields[field.name]["cbGroup"] != ""))
					generateBlurEvent(field);
			}
		}
	}
	
	IN_INIT = false;

	if (dontFocusFirstField == undefined || dontFocusFirstField == false)
		focusFirstField();
	
	this.calculate = true;
	//this.delay = false;
}

function focusFirstField()
{
	var firstFieldName = formProperties["firstField"];

	if(fields[firstFieldName] != undefined)
	{
		var field = this.getField(firstFieldName);

		if(field != undefined)
		{
			field.setFocus();
		}
	}
}

function willPrint()
{
	for(var k in fields)
	{
		var field = this.getField(k);
		field.fillColor = fields[field.name]["backgroundColor"];
	}
	
	ignoreAllEvents = true;
	for(var k in fields)
	{
		var field = this.getField(k);
		
		if (fields[k]["_empty"] == true && fields[k]["nullText"] != undefined && fields[k]["nullText"] != "")
		{
			field.value = "";
		}
	}
	ignoreAllEvents = false;
	
	var formEmpty = isFormEmpty();
	
	var generateDm = false;
	if (!formEmpty)
	{
		generateDm = true;
		
		var result = checkForm();
		if(result != undefined)
		{
			if (!formProperties.alwaysAllowPrint)
			{
				if (formProperties.printShowMessage)
				{
					app.alert(formProperties.printShowMessageText);
				}
				if (formProperties.printShowHiddenField && formProperties.printHiddenField != undefined && formProperties.printHiddenField != "")
				{
					var field = getField(formProperties.printHiddenField);
					if (field != undefined)
					{
						printHiddenFieldOriginalDisplay = field.display;
						field.display = display.noView;
					}
				}
			}
			result.setFocus();
			
			generateDm = formProperties.printGenerateDataMatrix;
		}
	}
	
	if(dmArray.length > 0)
	{
		if (generateDm == true)
			calcBarcode(dmArray);
		else
			clearBarcode(dmArray);
	}
	
	ignoreAllEvents = true;
}

function didPrint()
{
	ignoreAllEvents = false;
	
	var dummyEvent = new Object();

	// null text
	for(var k in fields)
	{
		var field = this.getField(k);
		if (fields[k]["_empty"] == true && fields[k]["nullText"] != undefined && fields[k]["nullText"] != "")
		{
			field.value = "";
		}
	}

	for(var k in fields)
	{
		var field = this.getField(k);

		if(field != undefined)
		{
			dummyEvent.target = field;
			dummyEvent.value = field.value;
			dummyEvent.name = "Blur";
			handleEvent(dummyEvent);
		}
	}
	
	if (!formProperties.alwaysAllowPrint)
	{
		if (formProperties.printShowHiddenField && formProperties.printHiddenField != undefined && formProperties.printHiddenField != "" && printHiddenFieldOriginalDisplay != undefined)
		{
			var field = getField(formProperties.printHiddenField);
			if (field != undefined)
			{
				field.display = printHiddenFieldOriginalDisplay;
			}
		}
	}
	
	printHiddenFieldOriginalDisplay = undefined;
}

function checkForm()
{
	for(var k in tabOrder)
	{
		if(fields[k]["validity"] == INVALID)
		{
			var field = this.getField(k);

			if(field.display == display.visible || field.display == display.noPrint)
			{
				return field;
			}
		}

		if(fields[k]["_empty"] == true && fields[k]["required"])
		{
			var field = this.getField(k);

			if(field.display == display.visible || field.display == display.noPrint)
			{
				return field;
			}
		}
	}

	return undefined;
}

function isFormEmpty()
{
	for(var k in fields)
	{
		var field = this.getField(k);
		if (field.valueAsString != field.defaultValue && !field.readonly)
		{
			return false;
		}
	}
	
	return true;
}

// iPDF Reader Importer
function dataHasImported(event)
{
	if (event.value == "imported")
	{
		initForm();
	}
}
/* Rijndael (AES) Encryption
 * Copyright 2005 Herbert Hanewinkel, www.haneWIN.de
 * version 1.0, check www.haneWIN.de for the latest version

 * This software is provided as-is, without express or implied warranty.  
 * Permission to use, copy, modify, distribute or sell this software, with or
 * without fee, for any purpose and by any individual or organization, is hereby
 * granted, provided that the above copyright notice and this paragraph appear 
 * in all copies. Distribution as a part of an application or binary must
 * include the above copyright notice in the documentation and/or other materials
 * provided with the application or distribution.
 */

function AES_init(){}

var blockSizeInBits = 128;
var keySizeInBits = 128;

// The round constants used in subkey expansion
var Rcon = [ 
0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 
0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 
0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91 ];

// Precomputed lookup table for the SBox
var S = [
 99, 124, 119, 123, 242, 107, 111, 197,  48,   1, 103,  43, 254, 215, 171, 
118, 202, 130, 201, 125, 250,  89,  71, 240, 173, 212, 162, 175, 156, 164, 
114, 192, 183, 253, 147,  38,  54,  63, 247, 204,  52, 165, 229, 241, 113, 
216,  49,  21,   4, 199,  35, 195,  24, 150,   5, 154,   7,  18, 128, 226, 
235,  39, 178, 117,   9, 131,  44,  26,  27, 110,  90, 160,  82,  59, 214, 
179,  41, 227,  47, 132,  83, 209,   0, 237,  32, 252, 177,  91, 106, 203, 
190,  57,  74,  76,  88, 207, 208, 239, 170, 251,  67,  77,  51, 133,  69, 
249,   2, 127,  80,  60, 159, 168,  81, 163,  64, 143, 146, 157,  56, 245, 
188, 182, 218,  33,  16, 255, 243, 210, 205,  12,  19, 236,  95, 151,  68,  
23,  196, 167, 126,  61, 100,  93,  25, 115,  96, 129,  79, 220,  34,  42, 
144, 136,  70, 238, 184,  20, 222,  94,  11, 219, 224,  50,  58,  10,  73,
  6,  36,  92, 194, 211, 172,  98, 145, 149, 228, 121, 231, 200,  55, 109, 
141, 213,  78, 169, 108,  86, 244, 234, 101, 122, 174,   8, 186, 120,  37,  
 46,  28, 166, 180, 198, 232, 221, 116,  31,  75, 189, 139, 138, 112,  62, 
181, 102,  72,   3, 246,  14,  97,  53,  87, 185, 134, 193,  29, 158, 225,
248, 152,  17, 105, 217, 142, 148, 155,  30, 135, 233, 206,  85,  40, 223,
140, 161, 137,  13, 191, 230,  66, 104,  65, 153,  45,  15, 176,  84, 187,  
 22 ];

var T1 = [
0xa56363c6, 0x847c7cf8, 0x997777ee, 0x8d7b7bf6,
0x0df2f2ff, 0xbd6b6bd6, 0xb16f6fde, 0x54c5c591,
0x50303060, 0x03010102, 0xa96767ce, 0x7d2b2b56,
0x19fefee7, 0x62d7d7b5, 0xe6abab4d, 0x9a7676ec,
0x45caca8f, 0x9d82821f, 0x40c9c989, 0x877d7dfa,
0x15fafaef, 0xeb5959b2, 0xc947478e, 0x0bf0f0fb,
0xecadad41, 0x67d4d4b3, 0xfda2a25f, 0xeaafaf45,
0xbf9c9c23, 0xf7a4a453, 0x967272e4, 0x5bc0c09b,
0xc2b7b775, 0x1cfdfde1, 0xae93933d, 0x6a26264c,
0x5a36366c, 0x413f3f7e, 0x02f7f7f5, 0x4fcccc83,
0x5c343468, 0xf4a5a551, 0x34e5e5d1, 0x08f1f1f9,
0x937171e2, 0x73d8d8ab, 0x53313162, 0x3f15152a,
0x0c040408, 0x52c7c795, 0x65232346, 0x5ec3c39d,
0x28181830, 0xa1969637, 0x0f05050a, 0xb59a9a2f,
0x0907070e, 0x36121224, 0x9b80801b, 0x3de2e2df,
0x26ebebcd, 0x6927274e, 0xcdb2b27f, 0x9f7575ea,
0x1b090912, 0x9e83831d, 0x742c2c58, 0x2e1a1a34,
0x2d1b1b36, 0xb26e6edc, 0xee5a5ab4, 0xfba0a05b,
0xf65252a4, 0x4d3b3b76, 0x61d6d6b7, 0xceb3b37d,
0x7b292952, 0x3ee3e3dd, 0x712f2f5e, 0x97848413,
0xf55353a6, 0x68d1d1b9, 0x00000000, 0x2cededc1,
0x60202040, 0x1ffcfce3, 0xc8b1b179, 0xed5b5bb6,
0xbe6a6ad4, 0x46cbcb8d, 0xd9bebe67, 0x4b393972,
0xde4a4a94, 0xd44c4c98, 0xe85858b0, 0x4acfcf85,
0x6bd0d0bb, 0x2aefefc5, 0xe5aaaa4f, 0x16fbfbed,
0xc5434386, 0xd74d4d9a, 0x55333366, 0x94858511,
0xcf45458a, 0x10f9f9e9, 0x06020204, 0x817f7ffe,
0xf05050a0, 0x443c3c78, 0xba9f9f25, 0xe3a8a84b,
0xf35151a2, 0xfea3a35d, 0xc0404080, 0x8a8f8f05,
0xad92923f, 0xbc9d9d21, 0x48383870, 0x04f5f5f1,
0xdfbcbc63, 0xc1b6b677, 0x75dadaaf, 0x63212142,
0x30101020, 0x1affffe5, 0x0ef3f3fd, 0x6dd2d2bf,
0x4ccdcd81, 0x140c0c18, 0x35131326, 0x2fececc3,
0xe15f5fbe, 0xa2979735, 0xcc444488, 0x3917172e,
0x57c4c493, 0xf2a7a755, 0x827e7efc, 0x473d3d7a,
0xac6464c8, 0xe75d5dba, 0x2b191932, 0x957373e6,
0xa06060c0, 0x98818119, 0xd14f4f9e, 0x7fdcdca3,
0x66222244, 0x7e2a2a54, 0xab90903b, 0x8388880b,
0xca46468c, 0x29eeeec7, 0xd3b8b86b, 0x3c141428,
0x79dedea7, 0xe25e5ebc, 0x1d0b0b16, 0x76dbdbad,
0x3be0e0db, 0x56323264, 0x4e3a3a74, 0x1e0a0a14,
0xdb494992, 0x0a06060c, 0x6c242448, 0xe45c5cb8,
0x5dc2c29f, 0x6ed3d3bd, 0xefacac43, 0xa66262c4,
0xa8919139, 0xa4959531, 0x37e4e4d3, 0x8b7979f2,
0x32e7e7d5, 0x43c8c88b, 0x5937376e, 0xb76d6dda,
0x8c8d8d01, 0x64d5d5b1, 0xd24e4e9c, 0xe0a9a949,
0xb46c6cd8, 0xfa5656ac, 0x07f4f4f3, 0x25eaeacf,
0xaf6565ca, 0x8e7a7af4, 0xe9aeae47, 0x18080810,
0xd5baba6f, 0x887878f0, 0x6f25254a, 0x722e2e5c,
0x241c1c38, 0xf1a6a657, 0xc7b4b473, 0x51c6c697,
0x23e8e8cb, 0x7cdddda1, 0x9c7474e8, 0x211f1f3e,
0xdd4b4b96, 0xdcbdbd61, 0x868b8b0d, 0x858a8a0f,
0x907070e0, 0x423e3e7c, 0xc4b5b571, 0xaa6666cc,
0xd8484890, 0x05030306, 0x01f6f6f7, 0x120e0e1c,
0xa36161c2, 0x5f35356a, 0xf95757ae, 0xd0b9b969,
0x91868617, 0x58c1c199, 0x271d1d3a, 0xb99e9e27,
0x38e1e1d9, 0x13f8f8eb, 0xb398982b, 0x33111122,
0xbb6969d2, 0x70d9d9a9, 0x898e8e07, 0xa7949433,
…
objstm_0179_00.bin pdf-objstm-decoded PDF /ObjStm 179 0 obj (inflated) 29641 bytes
SHA-256: 35a9117d5d85253f7dc78e83df30e6cc2fc04de10bc831e855cf9502f348eb06
objstm_0050_00.bin pdf-objstm-decoded PDF /ObjStm 50 0 obj (inflated) 7938 bytes
SHA-256: 5908c02938ade32c57089f6db3365eb8e04fa3625f912e623529ee0abf596f4b
objstm_0052_00.bin pdf-objstm-decoded PDF /ObjStm 52 0 obj (inflated) 180 bytes
SHA-256: a2d800a4fb1f25c290b8a7af16a81ba0c6b1550a2d5552366cf06269efdf7a46