MALICIOUS
168
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1059.007 JavaScript
The PDF file contains embedded JavaScript, indicated by PDF_JAVASCRIPT and PDF_JS heuristics. The JavaScript stream, specifically stream_002_off0000065f.js, utilizes eval() and unescape() functions, suggesting obfuscation and dynamic code execution. This script is likely responsible for downloading and executing a second-stage payload. The presence of these techniques points to a downloader or droppper functionality, common in initial access stages of an attack.
Machine Learning
- Nyx PDF Classifier suspicious score 0.2593
Heuristics 5
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
var quarterString = eval("quarterContainer._" + quarter); -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://pajhome.org.uk/crypt/md5 Referenced by PDF JavaScript
- http://www.w3.org/1999/02/22-rdf-syntax-ns#Referenced by PDF JavaScript
- http://purl.org/dc/elements/1.1/Referenced by PDF JavaScript
- http://ns.adobe.com/xap/1.0/Referenced by PDF JavaScript
- http://ns.adobe.com/xap/1.0/g/img/Referenced by PDF JavaScript
- http://ns.adobe.com/xap/1.0/mm/Referenced by PDF JavaScript
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#Referenced by PDF JavaScript
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#Referenced by PDF JavaScript
- http://ns.adobe.com/illustrator/1.0/Referenced by PDF JavaScript
- http://ns.adobe.com/xap/1.0/t/pg/Referenced by PDF JavaScript
- http://ns.adobe.com/xap/1.0/sType/Dimensions#Referenced by PDF JavaScript
- http://ns.adobe.com/xap/1.0/g/Referenced by PDF JavaScript
- http://ns.adobe.com/pdf/1.3/Referenced by PDF JavaScript
- http://www.unicode.org/reports/tr35/tr35-11.html#Number_Format_PatternsReferenced by PDF JavaScript
- http://www.unicode.org/reports/tr35/tr35-11.html#Lenient_ParsingReferenced by PDF JavaScript
- http://unicode.org/reports/tr18/Referenced by PDF JavaScript
Extracted artifacts 6
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_002_off0000065f.js |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x65F | 433067 bytes |
SHA-256: 78a09da5d2c3141b9b5e84788882238071d67b5ac7da2a1d84457b00801ccc9b |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 10 eval/decoder/string-building token(s). Carved artifact contains 1 long base64-like blob(s).
|
|||
stream_080_off00037600.js |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x37600 | 213 bytes |
SHA-256: 88cf83eacfa4ab997462d207c0c2ed6b53626fc3794ce976e7bdf29d2c84f5d4 |
|||
deobfuscated.js |
deobfuscated-js | PDF JavaScript deobfuscation pass | 3244221 bytes |
SHA-256: 0fa701399c7ae0f65114a63125a439929c12fd23db43ca79e7eb6035865e5a4f |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 20 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
� h �y > � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � v � � � � * * K 1 , � � � w g� W
9 �v E K� � � H� �@@ ? � ��
� t � H @ ���$!u0 ` �P ��DP��� ��5��� .6�� �}y�z� 8���v��:m����\Wq����@ ������������������������������������ ����� ��� �� � �� ����$!u0 ` �P � & �� i v W ۑ y�- � 0 � C 0 � � � . � D�0� 0 P ( � E "� � 8 : � N�/ @ � � t x � ^ '@ � � � � ( � J - � @ P P h � Z % � @ � ( ( � J - � @ � � B � E 1@I� � � P h � Z "� ` � � L � � j�& � �� � q"��=Ģ� � nG:
��9� @ $
� C 0 �
�� � f ��V��wr��}�6+֫S%<��͝>��r�ȏ 8�_?� �N�5l��F Y3X�r�i�)T�"Tȏ @�ѳ�L�.X�B I 4p� E 0p`� 5 �� �
var cldr={
"supplemental_plurals":{
"zero":function(n) { return false; },
"one":function(n) { return n == 1; },
"two":function(n) { return false; },
"few":function(n) { return false; },
"many":function(n) { return false; }
},
"numbers_symbols":{
"decimal":".",
"group":"'",
"list":";",
"nativeZeroDigit":"0",
"plusSign":"+",
"minusSign":"-",
"numberPattern":"#,##0.###",
"nan":"NaN",
"infinity":"\u221E"
},
"calendar_gregorian":{
"months_format":{
"abbreviated":{
"_1":"Jan","_2":"Feb","_3":"Mrz","_4":"Apr","_5":"Mai","_6":"Jun","_7":"Jul","_8":"Aug","_9":"Sep","_10":"Okt","_11":"Nov","_12":"Dez"
},
"wide":{
"_1":"Januar","_2":"Februar","_3":"M\u00E4rz","_4":"April","_5":"Mai","_6":"Juni","_7":"Juli","_8":"August","_9":"September","_10":"Oktober","_11":"November","_12":"Dezember"
},
"narrow":{
"_1":"J","_2":"F","_3":"M","_4":"A","_5":"M","_6":"J","_7":"J","_8":"A","_9":"S","_10":"O","_11":"N","_12":"D"
}
},
"months_stand_alone":{
"abbreviated":{
"_3":"M\u00E4r","_7":"Jul","_8":"Aug","_9":"Sep","_10":"Okt","_11":"Nov","_12":"Dez","_1":"Jan","_2":"Feb","_4":"Apr","_5":"Mai","_6":"Jun"
},
"wide":{
"_1":"Januar","_2":"Februar","_3":"M\u00E4rz","_4":"April","_5":"Mai","_6":"Juni","_7":"Juli","_8":"August","_9":"September","_10":"Oktober","_11":"November","_12":"Dezember"
},
"narrow":{
"_1":"J","_2":"F","_3":"M","_4":"A","_5":"M","_6":"J","_7":"J","_8":"A","_9":"S","_10":"O","_11":"N","_12":"D"
}
},
"days_format":{
"abbreviated":{
"sun":"So.","mon":"Mo.","tue":"Di.","wed":"Mi.","thu":"Do.","fri":"Fr.","sat":"Sa."
},
"wide":{
"sun":"Sonntag","mon":"Montag","tue":"Dienstag","wed":"Mittwoch","thu":"Donnerstag","fri":"Freitag","sat":"Samstag"
},
"narrow":{
"sun":"S","mon":"M","tue":"D","wed":"M","thu":"D","fri":"F","sat":"S"
}
},
"days_stand_alone":{
"abbreviated":{
"sun":"So.","mon":"Mo.","tue":"Di.","wed":"Mi.","thu":"Do.","fri":"Fr.","sat":"Sa."
},
"wide":{
"sun":"Sonntag","mon":"Montag","tue":"Dienstag","wed":"Mittwoch","thu":"Donnerstag","fri":"Freitag","sat":"Samstag"
},
"narrow":{
"sun":"S","mon":"M","tue":"D","wed":"M","thu":"D","fri":"F","sat":"S"
}
},
"quarters_format":{
"abbreviated":{
"_1":"Q1","_2":"Q2","_3":"Q3","_4":"Q4"
},
"wide":{
"_1":"1. Quartal","_2":"2. Quartal","_3":"3. Quartal","_4":"4. Quartal"
},
"narrow":{
"_1":"1","_2":"2","_3":"3","_4":"4"
}
},
"quarters_stand_alone":{
"abbreviated":{
"_1":"Q1","_2":"Q2","_3":"Q3","_4":"Q4"
},
"wide":{
"_1":"1. Quartal","_2":"2. Quartal","_3":"3. Quartal","_4":"4. Quartal"
},
"narrow":{
"_1":"1","_2":"2","_3":"3","_4":"4"
}
},
"am":"vorm.",
"pm":"nachm.",
"eraNames":{"beforeChrist":"v. Chr.","afterChrist":"n. Chr."},
"eraAbbr":{"beforeChrist":"v. Chr.","afterChrist":"n. Chr."},
"eraNarrow":{"beforeChrist":"v. Chr.","afterChrist":"n. Chr."},
"relative_days":{
"_0":"Heute","_1":"Morgen","_2":"\u00DCbermorgen","_3":"In drei Tagen","_-1":"Gestern","_-2":"Vorgestern","_-3":"Vor drei Tagen"
},
"months_all":{
"_1":["Januar","January","janvier","gennaio"],"_2":["Februar","February","f\u00E9vrier","febbraio"],"_3":["M\u00E4rz","March","mars","marzo"],"_4":["April","avril","aprile"],"_5":["Mai","May","mai","maggio"],"_6":["Juni","June","juin","giugno"],"_7":["Juli","July","juillet","Luglio"],"_8":["August","ao\u00FBt","agosto"],"_9":["September","septembre","settembre"],"_10":["Oktober","October","octobre","ottobre"],"_11":["November","novembre"],"_12":["Dezember","December","d\u00E9cembre","dicembre"]
},
"days_all":{
"sun":["Sonntag","Sunday","dimanche","domenica"],"mon":["Montag","Monday","lundi","luned\u00EC"],"tue":["Dienstag","Tuesday","mardi","marted\u00EC"],"wed":["Mittwoch","Wednesday","mercredi","mercoled\u00EC"],"thu":["Donnerstag","Thursday","jeudi","gioved\u00EC"],"fri":["Freitag","Friday","vendredi","venerd\u00EC"],"sat":["Samstag","Saturday","samedi","sabato"]
},
"timeFormats":{
"short":"HH:mm",
"medium":"HH:mm:ss",
},
"dateFormats":{
"short":"dd.MM.yy",
"medium":"dd.MM.yyyy",
"long":"d. MMMM yyyy",
"full":"EEEE, d. MMMM yyyy",
},
},
"timeZoneNames":{
"hourFormat":"+HH:mm;-HH:mm",
"gmtFormat":"GMT{0}",
},
"numbers_currencyFormats":{
"currencySpacing":{
"beforeCurrency":{
"currencyMatch":"[:letter:]",
"surroundingMatch":"[:digit:]",
"insertBetween":"\u00A0"
},
"afterCurrency":{
"currencyMatch":"[:letter:]",
"surroundingMatch":"[:digit:]",
"insertBetween":"\u00A0"
}
},
"unitPatterns":{
"one":"{0} {1}"
,"other":"{0} {1}"
},
"currencyPattern":"\u00A4\u00A0#,##0.00;\u00A4-#,##0.00"
},
"numbers_currencies":{
},
"supplemental_currencyData_fractions":{"DEFAULT":{"digits":2,"rounding":0},
}
}
var formProperties = new Array();
var CANCEL_EVENT = false;
var EMPTY = 0;
var VALID = 1;
var INVALID = 2;
var REQUIRED = 3;
var INVALIDITY_REASON_INPUT = 0;
var INVALIDITY_REASON_OTHER = 1;
var commitWithTab = false;
var tabTarget = "";
var nextFieldState = 0;
var tabOn = true;
var eventLevel = 0;
var backward = false;
var prevAcroField = null;
var possibleBackJump = false;
//var nextAcroField = null;
var submitForm_formatingBack = false;
var ignoreAllEvents = false;
var ignoreAllRules = false;
var fieldIdCached = new Array();
var CANCEL_CALCULATION = false;
var CALCULATE_RULES = false;
var CALCULATION_ONE_FILLED = false;
var CALCULATION_ALL_FILLED = false;
var CALCULATION_WITH_FIELD = false;
this.SWISSFORMS_FORM = true;
var openTime;
var IN_INIT = false;
var IGNORE_FORMAT_EVENT = false;
var CACHED_CB_GROUPS = new Array();
var printHiddenFieldOriginalDisplay = undefined;
var calculateCounter = 0;
if(app.runtimeHighlight)
{
app.runtimeHighlight = false;
}
/// events
var eventRegister = new Object();
function registerEvent(eventName, fieldName, source)
{
if(eventRegister[eventName] == undefined) eventRegister[eventName] = new Object();
if(eventRegister[eventName][fieldName] == undefined) eventRegister[eventName][fieldName] = new Array();
eventRegister[eventName][fieldName].push(source);
}
function handleEvent(event, withRules)
{
if (ignoreAllEvents)
return;
var eventName = event.name;
if (eventName == "Format" && IGNORE_FORMAT_EVENT)
return;
// optimization: don't blur or format hidden fields
if ((eventName == "Format" || eventName == "Blur") && event.target != undefined)
{
if (event.target.hidden)
return;
}
eventLevel++;
/*if (eventName == "Calculate")
console.println("Enter Event: " + eventName + ", " + event.source.name + ", " + eventLevel);
else
console.println("Enter Event: " + eventName + ", " + event.target.name + ", " + eventLevel);*/
if(eventName == "Keystroke" && event.target != null && event.commitKey == 3 && eventLevel == 1)
{
//this.console.println("tab commit: " + event.target.name);
// look up prev active field
prevAcroField = tabOrderB[event.target.name];
var pField = this.getField(prevAcroField);
while(pField != null && (pField.display == 1 || pField.display == 3 || pField.readonly))
{
prevAcroField = tabOrderB[prevAcroField];
pField = this.getField(prevAcroField);
}
/*// look up prev active field
nextAcroField = tabOrder[event.target.name];
var nField = this.getField(nextAcroField);
while(nField != null && (nField.display == 1 || nField.display == 3 || nField.readonly))
{
nextAcroField = tabOrder[nextAcroField];
nField = this.getField(nextAcroField);
}*/
commitWithTab = true;
tabTarget = event.target.name;
nextFieldState = event.target.display;
}
if(eventRegister[eventName] == undefined)
{
if(eventName == "Calculate")
{
calculateFields(event);
}
/*if (eventName == "Calculate")
console.println("Leave Event: " + eventName + ", " + event.source.name + ", " + eventLevel);
else
console.println("Leave Event: " + eventName + ", " + event.target.name + ", " + eventLevel);*/
eventLevel--;
return;
}
var registeredEvent = eventRegister[eventName];
if(registeredEvent[event.target.name] == undefined)
{
/*if (eventName == "Calculate")
console.println("Leave Event: " + eventName + ", " + event.source.name + ", " + eventLevel);
else
console.println("Leave Event: " + eventName + ", " + event.target.name + ", " + eventLevel);*/
eventLevel--;
return;
}
var fieldName = event.target.name;
CANCEL_EVENT = false;
for(var i = 0; i < registeredEvent[fieldName].length; i++)
{
if(!CANCEL_EVENT)
{
registeredEvent[fieldName][i](event);
}
else break;
}
//if(withRules != 1) doRules(event);
if(eventName == "Calculate")
{
calculateFields(event);
}
//////////////// ACHTUNG
if(possibleBackJump && eventName == "Focus" && eventLevel == 1)
{
if(event.target.name == prevAcroField)
{
var nextFieldName = tabOrderB[tabTarget];
var name = nextFieldName;
var field2 = this.getField(name);
while(field2 != null && (field2.display == 1 || field2.display == 3 || field2.readonly))
{
name = tabOrderB[name];
field2 = this.getField(name);
}
field2.setFocus();
}
}
else if(possibleBackJump && eventName == "Blur" && tabTarget == event.target.name && eventLevel == 1)
{
;
// do nothing
}
else if(possibleBackJump && eventLevel == 1)
{
possibleBackJump = false;
}
/*if (eventName == "Calculate")
console.println("Leave Event: " + eventName + ", " + event.source.name + ", " + eventLevel);
else
console.println("Leave Event: " + eventName + ", " + event.target.name + ", " + eventLevel);*/
eventLevel--;
}
function getFieldById(id)
{
if (fieldIdCached[id] != undefined)
{
return fieldIdCached[id];
}
else
{
var name = fieldIdNameMapping[""+id];
if (name == undefined) return undefined;
var field = this.getField(name);
if (field == undefined) return undefined;
fieldIdCached[id] = field;
return field;
return undefined;
}
}
function doRules(rulesArr)
{
if(rules != undefined)
{
if (!ignoreAllRules)
{
rulesArr.sort();
for(var i = 0; i < rulesArr.length; i ++)
{
var rule = rules[rulesArr[i]];
CALCULATE_RULES = true;
var complied = Boolean(rule["condition"]());
if(complied)
{
if(rule["trueActions"] != undefined)
{
for(var j = 0; j < rule["trueActions"].length; j++)
{
tabOn = false;
rule["trueActions"][j]();
tabOn = true;
}
}
}
else
{
if(rule["falseActions"] != undefined)
{
for(var j = 0; j < rule["falseActions"].length; j++)
{
tabOn = false;
rule["falseActions"][j]();
tabOn = true;
}
}
}
}
}
//this.console.println("setFocus: " + event.target.name + " level: " + eventLevel);
if(commitWithTab && tabOn && eventLevel == 1)
{
var nextFieldName = tabOrder[tabTarget];
var name = nextFieldName;
var field2 = this.getField(name);
while(field2 != null && (field2.display == 1 || field2.display == 3 || field2.readonly))
{
name = tabOrder[name];
field2 = this.getField(name);
}
field2.setFocus();
possibleBackJump = true;
commitWithTab = false;
}
}
}
function customValidateAllFieldsWithBlur(fieldName)
{
if(fields[fieldName] != undefined && fields[fieldName]["validations"] != undefined)
{
for(var i = 0; i < fields[fieldName]["validations"].length; i++)
{
var fName = fields[fieldName]["validations"][i];
var field = this.getField(fName);
if(field != undefined)
{
generateOnlyValidateEvent(field);
var dummyEvent = new Object();
dummyEvent.target = field;
dummyEvent.name = "Blur";
handleEvent(dummyEvent);
}
}
}
}
function customValidateAllFields(fieldName)
{
if(fields[fieldName] != undefined && fields[fieldName]["validations"] != undefined)
{
for(var i = 0; i < fields[fieldName]["validations"].length; i++)
{
var fName = fields[fieldName]["validations"][i];
var field = this.getField(fName);
if(field != undefined)
{
generateOnlyValidateEvent(field);
}
}
}
}
function calculateFields(event)
{
if (event.source == undefined) return;
var currFieldName = event.source.name;
customValidateAllFieldsWithBlur(currFieldName);
if (fields[currFieldName] == undefined) return;
var fieldId = fields[currFieldName]["id"];
var currIndex = calcTreeEntryMapping[fieldId+""];
var rulesArr = new Array();
if (currIndex != -1 && currIndex != undefined)
{
var first = true;
while (currIndex != -1 && currIndex != undefined)
{
if (flatCalcTree[currIndex] == undefined) break;
var field = getFieldById(flatCalcTree[currIndex].fieldId);
if(field != undefined && first == false)
{
var changed = calculateField(field);
if (changed)
customValidateAllFieldsWithBlur(field.name);
}
for(var i = 0; i < fields[field.name]["rules"].length; i++)
{
var rule = fields[field.name]["rules"][i];
rulesArr.push(rule);
}
currIndex = flatCalcTree[currIndex].next;
first = false;
}
}
else
{
for(var i = 0; i < fields[event.source.name]["rules"].length; i++)
{
var rule = fields[event.source.name]["rules"][i];
rulesArr.push(rule);
}
}
// execute rules sorted in next event for that the rules can change the actual edited value
doRules(rulesArr);
}
function calculateField(field)
{
var changedValue = false;
if(fields[field.name]["expression"] != undefined)
{
CANCEL_CALCULATION = false;
CALCULATE_RULES = false;
CALCULATION_ONE_FILLED = false;
CALCULATION_ALL_FILLED = true;
CALCULATION_WITH_FIELD = false;
var evaluated = fields[field.name]["expression"]();
if (CANCEL_CALCULATION)
{
if (field.value != "")
{
field.value = "";
changedValue = true;
}
}
else if (CALCULATION_WITH_FIELD == true &&
((fields[field.name]["expressionBehavior"] == 0 && CALCULATION_ALL_FILLED == false) || (fields[field.name]["expressionBehavior"] == 1 && CALCULATION_ONE_FILLED == false)))
{
// handle behavior if empty fields
if (field.value != "")
{
field.value = "";
changedValue = true;
}
}
else
{
var newValue;
if (typeof(evaluated) == 'number')
newValue = formatNumber(evaluated, "0.#########");
else
newValue = evaluated;
if (newValue != field.value)
{
field.value = newValue;
changedValue = true;
}
}
}
return changedValue;
}
function generateDoRules(field)
{
var rulesArr = new Array();
for(var i = 0; i < fields[field.name]["rules"].length; i++)
{
var rule = fields[field.name]["rules"][i];
rulesArr.push(rule);
}
doRules(rulesArr);
}
function arrayContains(arr, val)
{
for(var i = 0; i < arr.length; i++)
{
if(arr[i] == val) return true;
}
return false;
}
function generateBlurEvent(field)
{
var dummyEvent = new Object();
var fieldValue = field.value;
dummyEvent.target = field;
dummyEvent.name = "Blur";
handleEvent(dummyEvent);
}
function generateValidateEvent(field)
{
var dummyEvent = new Object();
var fieldValue = field.value;
generateOnlyValidateEvent(field);
dummyEvent.target = field;
dummyEvent.name = "Calculate";
dummyEvent.source = field;
handleEvent(dummyEvent)
calculateField(field);
dummyEvent.name = "Blur";
handleEvent(dummyEvent);
}
function generateOnlyValidateEvent(field)
{
var dummyEvent = new Object();
var fieldValue = field.valueAsString;
// take the display value for combobox fields
if (field.type == "combobox")
{
var index = field.currentValueIndices;
if (index != -1)
{
var name = field.getItemAt(index, false);
if (name != undefined)
fieldValue = name;
}
}
dummyEvent.name = "Validate";
dummyEvent.target = field;
dummyEvent.value = fieldValue;
handleEvent(dummyEvent);
// set field value if validate has changed value
if (dummyEvent.value+"" != fieldValue+"")
{
ignoreAllEvents = true;
field.value = dummyEvent.value;
ignoreAllEvents = false;
}
else if (field.type != "combobox")
{
ignoreAllEvents = true;
field.value = field.valueAsString;
ignoreAllEvents = false;
}
}
function javascriptsLoaded()
{
openTime = new Date();
initForm();
}
function initForm(dontFocusFirstField)
{
//this.delay = true;
this.calculate = false;
IN_INIT = true;
for(var k in fields)
{
var field = this.getField(k);
if(field != undefined)
{
if (field.type != "checkbox")
{
generateOnlyValidateEvent(field);
}
else
{
// only validate check box group one time
if (fields[field.name] != undefined && fields[field.name]["cbGroup"] != undefined && fields[field.name]["cbGroup"] != "")
{
var cbGroup = fields[field.name]["cbGroup"];
if (CACHED_CB_GROUPS[cbGroup] == undefined)
CACHED_CB_GROUPS[cbGroup] = new Array();
CACHED_CB_GROUPS[cbGroup].push(field);
}
else
generateOnlyValidateEvent(field);
}
}
}
// validate check box groups
for (var group in CACHED_CB_GROUPS)
{
if (validateCbGroup != undefined)
{
validateCbGroup(CACHED_CB_GROUPS[group], undefined);
}
}
for (var i = 0; i < openCalcOrderList.length; i ++)
{
var fieldId = openCalcOrderList[i];
var field = getFieldById(fieldId);
if (field == undefined) continue;
ignoreAllEvents = true;
var changed = calculateField(field);
ignoreAllEvents = false;
if (changed)
{
generateOnlyValidateEvent(field);
customValidateAllFields(field.name);
}
}
for(var k in fields)
{
var field = this.getField(k);
if(field != undefined)
{
generateDoRules(field);
if (field.type != "checkbox")
generateBlurEvent(field);
else
{
if (!(fields[field.name] != undefined && fields[field.name]["cbGroup"] != undefined && fields[field.name]["cbGroup"] != ""))
generateBlurEvent(field);
}
}
}
IN_INIT = false;
if (dontFocusFirstField == undefined || dontFocusFirstField == false)
focusFirstField();
this.calculate = true;
//this.delay = false;
}
function focusFirstField()
{
var firstFieldName = formProperties["firstField"];
if(fields[firstFieldName] != undefined)
{
var field = this.getField(firstFieldName);
if(field != undefined)
{
field.setFocus();
}
}
}
function willPrint()
{
for(var k in fields)
{
var field = this.getField(k);
field.fillColor = fields[field.name]["backgroundColor"];
}
ignoreAllEvents = true;
for(var k in fields)
{
var field = this.getField(k);
if (fields[k]["_empty"] == true && fields[k]["nullText"] != undefined && fields[k]["nullText"] != "")
{
field.value = "";
}
}
ignoreAllEvents = false;
var formEmpty = isFormEmpty();
var generateDm = false;
if (!formEmpty)
{
generateDm = true;
var result = checkForm();
if(result != undefined)
{
if (!formProperties.alwaysAllowPrint)
{
if (formProperties.printShowMessage)
{
app.alert(formProperties.printShowMessageText);
}
if (formProperties.printShowHiddenField && formProperties.printHiddenField != undefined && formProperties.printHiddenField != "")
{
var field = getField(formProperties.printHiddenField);
if (field != undefined)
{
printHiddenFieldOriginalDisplay = field.display;
field.display = display.noView;
}
}
}
result.setFocus();
generateDm = formProperties.printGenerateDataMatrix;
}
}
if(dmArray.length > 0)
{
if (generateDm == true)
calcBarcode(dmArray);
else
clearBarcode(dmArray);
}
ignoreAllEvents = true;
}
function didPrint()
{
ignoreAllEvents = false;
var dummyEvent = new Object();
// null text
for(var k in fields)
{
var field = this.getField(k);
if (fields[k]["_empty"] == true && fields[k]["nullText"] != undefined && fields[k]["nullText"] != "")
{
field.value = "";
}
}
for(var k in fields)
{
var field = this.getField(k);
if(field != undefined)
{
dummyEvent.target = field;
dummyEvent.value = field.value;
dummyEvent.name = "Blur";
handleEvent(dummyEvent);
}
}
if (!formProperties.alwaysAllowPrint)
{
if (formProperties.printShowHiddenField && formProperties.printHiddenField != undefined && formProperties.printHiddenField != "" && printHiddenFieldOriginalDisplay != undefined)
{
var field = getField(formProperties.printHiddenField);
if (field != undefined)
{
field.display = printHiddenFieldOriginalDisplay;
}
}
}
printHiddenFieldOriginalDisplay = undefined;
}
function checkForm()
{
for(var k in tabOrder)
{
if(fields[k]["validity"] == INVALID)
{
var field = this.getField(k);
if(field.display == display.visible || field.display == display.noPrint)
{
return field;
}
}
if(fields[k]["_empty"] == true && fields[k]["required"])
{
var field = this.getField(k);
if(field.display == display.visible || field.display == display.noPrint)
{
return field;
}
}
}
return undefined;
}
function isFormEmpty()
{
for(var k in fields)
{
var field = this.getField(k);
if (field.valueAsString != field.defaultValue && !field.readonly)
{
return false;
}
}
return true;
}
// iPDF Reader Importer
function dataHasImported(event)
{
if (event.value == "imported")
{
initForm();
}
}
/* Rijndael (AES) Encryption
* Copyright 2005 Herbert Hanewinkel, www.haneWIN.de
* version 1.0, check www.haneWIN.de for the latest version
* This software is provided as-is, without express or implied warranty.
* Permission to use, copy, modify, distribute or sell this software, with or
* without fee, for any purpose and by any individual or organization, is hereby
* granted, provided that the above copyright notice and this paragraph appear
* in all copies. Distribution as a part of an application or binary must
* include the above copyright notice in the documentation and/or other materials
* provided with the application or distribution.
*/
function AES_init(){}
var blockSizeInBits = 128;
var keySizeInBits = 128;
// The round constants used in subkey expansion
var Rcon = [
0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8,
0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4,
0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91 ];
// Precomputed lookup table for the SBox
var S = [
99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171,
118, 202, 130, 201, 125, 250, 89, 71, 240, 173, 212, 162, 175, 156, 164,
114, 192, 183, 253, 147, 38, 54, 63, 247, 204, 52, 165, 229, 241, 113,
216, 49, 21, 4, 199, 35, 195, 24, 150, 5, 154, 7, 18, 128, 226,
235, 39, 178, 117, 9, 131, 44, 26, 27, 110, 90, 160, 82, 59, 214,
179, 41, 227, 47, 132, 83, 209, 0, 237, 32, 252, 177, 91, 106, 203,
190, 57, 74, 76, 88, 207, 208, 239, 170, 251, 67, 77, 51, 133, 69,
249, 2, 127, 80, 60, 159, 168, 81, 163, 64, 143, 146, 157, 56, 245,
188, 182, 218, 33, 16, 255, 243, 210, 205, 12, 19, 236, 95, 151, 68,
23, 196, 167, 126, 61, 100, 93, 25, 115, 96, 129, 79, 220, 34, 42,
144, 136, 70, 238, 184, 20, 222, 94, 11, 219, 224, 50, 58, 10, 73,
6, 36, 92, 194, 211, 172, 98, 145, 149, 228, 121, 231, 200, 55, 109,
141, 213, 78, 169, 108, 86, 244, 234, 101, 122, 174, 8, 186, 120, 37,
46, 28, 166, 180, 198, 232, 221, 116, 31, 75, 189, 139, 138, 112, 62,
181, 102, 72, 3, 246, 14, 97, 53, 87, 185, 134, 193, 29, 158, 225,
248, 152, 17, 105, 217, 142, 148, 155, 30, 135, 233, 206, 85, 40, 223,
140, 161, 137, 13, 191, 230, 66, 104, 65, 153, 45, 15, 176, 84, 187,
22 ];
var T1 = [
0xa56363c6, 0x847c7cf8, 0x997777ee, 0x8d7b7bf6,
0x0df2f2ff, 0xbd6b6bd6, 0xb16f6fde, 0x54c5c591,
0x50303060, 0x03010102, 0xa96767ce, 0x7d2b2b56,
0x19fefee7, 0x62d7d7b5, 0xe6abab4d, 0x9a7676ec,
0x45caca8f, 0x9d82821f, 0x40c9c989, 0x877d7dfa,
0x15fafaef, 0xeb5959b2, 0xc947478e, 0x0bf0f0fb,
0xecadad41, 0x67d4d4b3, 0xfda2a25f, 0xeaafaf45,
0xbf9c9c23, 0xf7a4a453, 0x967272e4, 0x5bc0c09b,
0xc2b7b775, 0x1cfdfde1, 0xae93933d, 0x6a26264c,
0x5a36366c, 0x413f3f7e, 0x02f7f7f5, 0x4fcccc83,
0x5c343468, 0xf4a5a551, 0x34e5e5d1, 0x08f1f1f9,
0x937171e2, 0x73d8d8ab, 0x53313162, 0x3f15152a,
0x0c040408, 0x52c7c795, 0x65232346, 0x5ec3c39d,
0x28181830, 0xa1969637, 0x0f05050a, 0xb59a9a2f,
0x0907070e, 0x36121224, 0x9b80801b, 0x3de2e2df,
0x26ebebcd, 0x6927274e, 0xcdb2b27f, 0x9f7575ea,
0x1b090912, 0x9e83831d, 0x742c2c58, 0x2e1a1a34,
0x2d1b1b36, 0xb26e6edc, 0xee5a5ab4, 0xfba0a05b,
0xf65252a4, 0x4d3b3b76, 0x61d6d6b7, 0xceb3b37d,
0x7b292952, 0x3ee3e3dd, 0x712f2f5e, 0x97848413,
0xf55353a6, 0x68d1d1b9, 0x00000000, 0x2cededc1,
0x60202040, 0x1ffcfce3, 0xc8b1b179, 0xed5b5bb6,
0xbe6a6ad4, 0x46cbcb8d, 0xd9bebe67, 0x4b393972,
0xde4a4a94, 0xd44c4c98, 0xe85858b0, 0x4acfcf85,
0x6bd0d0bb, 0x2aefefc5, 0xe5aaaa4f, 0x16fbfbed,
0xc5434386, 0xd74d4d9a, 0x55333366, 0x94858511,
0xcf45458a, 0x10f9f9e9, 0x06020204, 0x817f7ffe,
0xf05050a0, 0x443c3c78, 0xba9f9f25, 0xe3a8a84b,
0xf35151a2, 0xfea3a35d, 0xc0404080, 0x8a8f8f05,
0xad92923f, 0xbc9d9d21, 0x48383870, 0x04f5f5f1,
0xdfbcbc63, 0xc1b6b677, 0x75dadaaf, 0x63212142,
0x30101020, 0x1affffe5, 0x0ef3f3fd, 0x6dd2d2bf,
0x4ccdcd81, 0x140c0c18, 0x35131326, 0x2fececc3,
0xe15f5fbe, 0xa2979735, 0xcc444488, 0x3917172e,
0x57c4c493, 0xf2a7a755, 0x827e7efc, 0x473d3d7a,
0xac6464c8, 0xe75d5dba, 0x2b191932, 0x957373e6,
0xa06060c0, 0x98818119, 0xd14f4f9e, 0x7fdcdca3,
0x66222244, 0x7e2a2a54, 0xab90903b, 0x8388880b,
0xca46468c, 0x29eeeec7, 0xd3b8b86b, 0x3c141428,
0x79dedea7, 0xe25e5ebc, 0x1d0b0b16, 0x76dbdbad,
0x3be0e0db, 0x56323264, 0x4e3a3a74, 0x1e0a0a14,
0xdb494992, 0x0a06060c, 0x6c242448, 0xe45c5cb8,
0x5dc2c29f, 0x6ed3d3bd, 0xefacac43, 0xa66262c4,
0xa8919139, 0xa4959531, 0x37e4e4d3, 0x8b7979f2,
0x32e7e7d5, 0x43c8c88b, 0x5937376e, 0xb76d6dda,
0x8c8d8d01, 0x64d5d5b1, 0xd24e4e9c, 0xe0a9a949,
0xb46c6cd8, 0xfa5656ac, 0x07f4f4f3, 0x25eaeacf,
0xaf6565ca, 0x8e7a7af4, 0xe9aeae47, 0x18080810,
0xd5baba6f, 0x887878f0, 0x6f25254a, 0x722e2e5c,
0x241c1c38, 0xf1a6a657, 0xc7b4b473, 0x51c6c697,
0x23e8e8cb, 0x7cdddda1, 0x9c7474e8, 0x211f1f3e,
0xdd4b4b96, 0xdcbdbd61, 0x868b8b0d, 0x858a8a0f,
0x907070e0, 0x423e3e7c, 0xc4b5b571, 0xaa6666cc,
0xd8484890, 0x05030306, 0x01f6f6f7, 0x120e0e1c,
0xa36161c2, 0x5f35356a, 0xf95757ae, 0xd0b9b969,
0x91868617, 0x58c1c199, 0x271d1d3a, 0xb99e9e27,
0x38e1e1d9, 0x13f8f8eb, 0xb398982b, 0x33111122,
0xbb6969d2, 0x70d9d9a9, 0x898e8e07, 0xa7949433,
…
|
|||
objstm_0179_00.bin |
pdf-objstm-decoded | PDF /ObjStm 179 0 obj (inflated) | 29641 bytes |
SHA-256: 35a9117d5d85253f7dc78e83df30e6cc2fc04de10bc831e855cf9502f348eb06 |
|||
objstm_0050_00.bin |
pdf-objstm-decoded | PDF /ObjStm 50 0 obj (inflated) | 7938 bytes |
SHA-256: 5908c02938ade32c57089f6db3365eb8e04fa3625f912e623529ee0abf596f4b |
|||
objstm_0052_00.bin |
pdf-objstm-decoded | PDF /ObjStm 52 0 obj (inflated) | 180 bytes |
SHA-256: a2d800a4fb1f25c290b8a7af16a81ba0c6b1550a2d5552366cf06269efdf7a46 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.