Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca1c1bcc5b5b073c…

MALICIOUS

PDF

4.41 MB Created: 2021-04-15 11:21:00 UTC Authoring application: Microsoft Office Word (via Aspose.Words for Java 17.6) First seen: 2021-07-13
MD5: 35dca08b00f9bda5c68cccf0a027adf6 SHA-1: 7ac0e5111f7dd34c2f8fa3e9a5ed2ed0ad7b2735 SHA-256: ca1c1bcc5b5b073c3e3ddbfda200811679a29d88ebde34a62eda49afea7eaa77
148 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that validates user input in form fields, restricting it to alphanumeric characters and setting maximum lengths. This behavior, combined with the 'ML_NYX_PDF_MALICIOUS' heuristic and the 'PDF_JS_EXPLOIT_CLUSTER' firing, suggests an attempt to exploit PDF vulnerabilities or to facilitate a phishing or credential harvesting scheme. The script's validation logic and the presence of multiple embedded JavaScript streams indicate a structured attempt to interact with the user and potentially exfiltrate data.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6251

Heuristics 8

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    2 0 obj
<</Type/Catalog/Pages 3 0 R/Lang(en-US)/OpenAction<</S/JavaScript/JS(var libbcmath={PLUS:"+",MINUS:"-",BASE:10,scale:0,bc_num:function\(\){this.n_sign=null;this.n_len=null;this.n_scale=null;this.n_value=null;this.toString=function\(\){var b,a;a=this.n_value.join\(""\);b=\(\(this.n_sign==libbcmath.PLUS\)?"":this.n_sign\)+a.substr\(0,this.n_len\);if\(this.n_scale>0\){b+="."+a.substr\(this.n_len,this.n_scale\)}return b};this.setScale=function\(a\){while\(this.n_scale<a\){this.n_value.push\(0\);this …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.raiffeisen.ro/imm/in-sprijinul-tau/informatii-utile PDF link annotation
    • http://www.raiffeisen.ro/despre-noi/politica-de-confidentialitateIn PDF document text
    • http://www.monotype.comMonotypeReferenced by PDF JavaScript
    • https://)1(w)-1(ww.raiffeisen.ro/imm/in)-1(-sprijinu)-1(l-tau/informatii-u)-1(t)1(i)-1(leReferenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://dejavu.sourceforge.netReferenced by PDF JavaScript
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseReferenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://en.wikipedia.org/wiki/MIT_LicenseReferenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XReferenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TReferenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0Referenced by PDF JavaScript
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aReferenced by PDF JavaScript
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0Referenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0Referenced by PDF JavaScript
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@Referenced by PDF JavaScript
    • http://www.microsoft.com/Typography/0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In PDF document text
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In PDF document text

Extracted artifacts 22

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0109_000.js pdf-javascript-stream PDF /JS object 109 at offset 0xADD9F 819 bytes
SHA-256: 7c19d223c1a6601b7d69f4418ab38c176c1f8902c976669bdfc11945d33e50fd
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 40;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {
	event.value = event.value.toUpperCase();
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters
				+ ' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
	if (event.value.length > 0) {
		var matching = event.value.match(alfanumericRegex);
		if (matching == null) {
			app.alert("Introduceti doar caractere alfanumerice!");
			field.strokeColor = color.red;
		} else {
			field.strokeColor = color.black;
			this.getField("documentProducer").value = "G";
		}
	} else {
		field.strokeColor = color.black;
		this.getField("documentProducer").value = "G";
	}
	generateBarcode();
}
javascript_obj0120_001.js pdf-javascript-stream PDF /JS object 120 at offset 0x1D8C4D 818 bytes
SHA-256: 0e4e6a2409405cf53c3f7247d2e441f477b49e28a6bcdb70a105781376cb7084
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 6;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {
	event.value = event.value.toUpperCase();
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters
				+ ' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
	if (event.value.length > 0) {
		var matching = event.value.match(alfanumericRegex);
		if (matching == null) {
			app.alert("Introduceti doar caractere alfanumerice!");
			field.strokeColor = color.red;
		} else {
			field.strokeColor = color.black;
			this.getField("documentProducer").value = "G";
		}
	} else {
		field.strokeColor = color.black;
		this.getField("documentProducer").value = "G";
	}
	generateBarcode();
}
javascript_obj0225_002.js pdf-javascript-stream PDF /JS object 225 at offset 0x1E7C97 656 bytes
SHA-256: 19aabcd651111650b0647840faf699d8ad0d7d63bbbd9f038ba4aa1da770dd79
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 35;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0228_003.js pdf-javascript-stream PDF /JS object 228 at offset 0x1E8242 656 bytes
SHA-256: 357ac1b8756a275aea839a1e41f2c02b52d9a22f215b82825e907a3ab2a2ef13
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 45;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0231_004.js pdf-javascript-stream PDF /JS object 231 at offset 0x1E87EA 655 bytes
SHA-256: 25e3c7a495fb2dfa3cc773ff68c3827b7d6c7a0315d02650f9c21e571fbb3c7a
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 6;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0237_005.js pdf-javascript-stream PDF /JS object 237 at offset 0x1E932E 655 bytes
SHA-256: 8f788739670419f56a746328549f6401093057413295cb0c9b2c38732fac2d07
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 3;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0240_006.js pdf-javascript-stream PDF /JS object 240 at offset 0x1E98D5 655 bytes
SHA-256: 55f8a09e6a6956aaa538de612595e62d0923831409e3a3963e606d63daa5a7bb
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 4;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0243_007.js pdf-javascript-stream PDF /JS object 243 at offset 0x1E9E7B 655 bytes
SHA-256: 0603f23604100bb5654893fad0e87ad35eb06b91760d2d57f3b142d9f8b42362
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 2;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0249_008.js pdf-javascript-stream PDF /JS object 249 at offset 0x1EA9CE 656 bytes
SHA-256: 27356a0b68c50db86a649e362029115f4cf116e447eec5e903af561b7cc97d72
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 20;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0252_009.js pdf-javascript-stream PDF /JS object 252 at offset 0x1EAF7D 656 bytes
SHA-256: d6e90511090e4d02212262b70d6edba4c7ab1b5f9787f45d12847507b55be623
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 10;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0342_010.js pdf-javascript-stream PDF /JS object 342 at offset 0x1F5982 998 bytes
SHA-256: 78b099c02d2a467d0ca6ba37596043c8bb8f9ff30e3d9681fa333155f26c6456
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
function checkCnp() {
	if (event.value != null || event.value.length != 0) {
		var documentProducerField = this.getField("documentProducer");
		if (documentProducerField != null)
			documentProducerField.value = "G";
		var i = 0, year = 0, hashResult = 0, cnp = [], hashTable = [ 2, 7, 9,
				1, 4, 6, 3, 5, 8, 2, 7, 9 ];
		for (i = 0; i < 13; i++) {
			cnp[i] = parseInt(event.value.charAt(i), 10);
			if (isNaN(cnp[i])) {
				app.alert('CNP incorect!');
				field.strokeColor = color.red;
				return -1;
			} else {
				if (i < 12) {
					hashResult = hashResult + (cnp[i] * hashTable[i]);
				}
			}
		}
		hashResult = hashResult % 11;
		if (hashResult === 10) {
			hashResult = 1;
		}
		if (cnp[12] !== hashResult) {
			app.alert('CNP-ul introdus nu este valid!');
			field.strokeColor = color.red;
			return -1;
		} else {
			field.strokeColor = color.black;
			generateBarcode();
			return 0;
		}
	}
}
checkCnp();
javascript_obj0351_011.js pdf-javascript-stream PDF /JS object 351 at offset 0x1F72C3 525 bytes
SHA-256: a9b368c96b57e9600f1a70aa7d85a03a87ea12378d905b4c1ec79011987e25f5
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 6;
var num = /^[0-9]*$/;
if (event.value != null) {	
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters + ' de caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    if (event.value.match(num)==null) {
		app.alert('Campul  trebuie sa contina doar date numerice!');
		field.strokeColor = color.red;
	}else{
		field.strokeColor = color.black;
	}
    generateBarcode();
}
javascript_obj0354_012.js pdf-javascript-stream PDF /JS object 354 at offset 0x1F77EE 526 bytes
SHA-256: 8794072c3411ff3b4dce6ede72fb1787b0711876c0a4594ae9b78b400b4184a8
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 15;
var num = /^[0-9]*$/;
if (event.value != null) {	
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters + ' de caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    if (event.value.match(num)==null) {
		app.alert('Campul  trebuie sa contina doar date numerice!');
		field.strokeColor = color.red;
	}else{
		field.strokeColor = color.black;
	}
    generateBarcode();
}
javascript_obj0369_013.js pdf-javascript-stream PDF /JS object 369 at offset 0x1F91BF 767 bytes
SHA-256: 646bb7f107d003b603ad7d8dabc4fc1d4eea2a168af9e75159a17e3af75bf906
Preview script
First 1,000 lines of the extracted script
var emailRegex = /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
event.rc = true;
var field = event.target;
var maxCharacters = 50;
if (event.value != null) {
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters
				+ ' de caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
	if (event.value.length > 0) {
		var matching = event.value.match(emailRegex);
		if (matching == null) {
			app.alert('Campul trebuie sa contina un email valid!');
		} else {
			field.strokeColor = color.black;
		}
		this.getField("documentProducer").value = "G";
		generateBarcode();
	}
}
javascript_obj0379_014.js pdf-javascript-stream PDF /JS object 379 at offset 0x1FA572 1616 bytes
SHA-256: 7c6a5acea904187d4d4ecdcff226670d5f779fed5d26846b46a38f58892d1759
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;

function validateDate() {
	var re = /^\d{2}.\d{2}.\d{4}$/;
	if (!event.value.match(re)) {
		app.alert("Format invalid data (zz.ll.aaaa): " + event.value);
		return;
	}
	var validDate = false;
	try {
		validDate = js_validate_date_dmyyyy(event.value);
	} catch (err) {
		app.alert(err);
	}
	if (validDate == false) {
		app.alert("Format invalid data (zz.ll.aaaa): " + event.value);
		field.strokeColor = color.red;
	} else if (validDate == true) {
		field.strokeColor = color.black;
	}
	generateBarcode();
}

validateDate();

// dd/mm/yyyy
function js_validate_date_dmyyyy(js_datestr) {
	var js_days_in_year = [ 0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 ];
	var js_datepattern = /^(\d{2})([\.])(\d{2})([\.])(\d{4})$/;

	if (!js_datepattern.test(js_datestr)) {
		return false;
	}

	var js_match = js_datestr.match(js_datepattern);
	var js_day = Number(js_match[1]);
	var js_delimiter1 = js_match[2];
	var js_month = Number(js_match[3]);
	var js_delimiter2 = js_match[4];
	var js_year = Number(js_match[5]);

	if (js_is_leap_year(js_year)) {
		js_days_in_year[2] = 29;
	}

	if (js_delimiter1 !== js_delimiter2) {
		return false;
	}
	if (js_month === 0 || js_month > 12) {
		return false;
	}
	if (js_day === 0 || js_day > js_days_in_year[js_month]) {
		return false;
	}

	return true;
}

function js_is_leap_year(js_year) {
	if (js_year % 4 === 0) {
		if (js_year % 100 === 0) {
			if (js_year % 400 === 0) {
				return true;
			} else
				return false;
		} else
			return true;
	}
	return false;
}
javascript_obj0394_015.js pdf-javascript-stream PDF /JS object 394 at offset 0x1FDFC5 305 bytes
SHA-256: 71544809148308882997e04eb5e14fb050678264b200ffaaeb7046cfcbb0dc3a
Preview script
First 1,000 lines of the extracted script
var maxChars = 100;
var field = event.target;
if(field.value != null && field.value.length > 0){
	if(maxChars > 0){
		if(field.value.length > maxChars){
			app.alert('Campul trebuie sa contina maxim ' + maxChars + ' (de) caractere!');
			field.value = field.value.substring(0, maxChars);
		}
	}
}
javascript_obj0397_016.js pdf-javascript-stream PDF /JS object 397 at offset 0x1FE3E0 304 bytes
SHA-256: 3bb02f2f9ad4559d9ef842c728710173b52be1f971be7cd5ef4e8da2606fced8
Preview script
First 1,000 lines of the extracted script
var maxChars = 80;
var field = event.target;
if(field.value != null && field.value.length > 0){
	if(maxChars > 0){
		if(field.value.length > maxChars){
			app.alert('Campul trebuie sa contina maxim ' + maxChars + ' (de) caractere!');
			field.value = field.value.substring(0, maxChars);
		}
	}
}
javascript_obj13224_017.js pdf-javascript-stream PDF /JS object 13224 at offset 0x401F06 153 bytes
SHA-256: 92cf70c866e749229a8a8125cc91ec4dd66f94472f686e0fe3186ea20b35ce8a
Preview script
First 1,000 lines of the extracted script
if(getField("documentProducer").value=='P'){
	getField("documentProducer").value = 'G';
}
console.println("Regenerating barcode");
generateBarcode();
javascript_obj13345_018.js pdf-javascript-stream PDF /JS object 13345 at offset 0x4222F8 2494 bytes
SHA-256: 1cb5ced1451ab595ebc611659095daeb9020ec520176b44ab0b9b4d715d7d6c3
Preview script
First 1,000 lines of the extracted script
var field = event.target;

if (event.value == null || event.value.length == 0) {
	field.strokeColor = color.red;
	app.alert('Campul trebuie completat');
}
if (event.value != null || event.value.length != 0) {	
	field.value = event.value.toUpperCase();
	this.getField("documentProducer").value = "G";
	if (event.value.length === 13) {
		validareCNP(event.value);
	} else if (event.value.length < 13) {
		validareCIF(event.value);
	}
	generateBarcode();
}

function validareCNP(s) {
	var i = 0, year = 0, hashResult = 0, cnp = [], hashTable = [ 2, 7, 9, 1, 4,
			6, 3, 5, 8, 2, 7, 9 ];
	if (event.value.length === 13) {
		for (i = 0; i < 13; i++) {
			cnp[i] = parseInt(event.value.charAt(i), 10);
			if (isNaN(cnp[i])) {
				app.alert('CNP-ul contine si alte caractere in afara de cifre!');
				field.strokeColor = color.red;
				return false;
			} else {
				if (i < 12) {
					hashResult = hashResult + (cnp[i] * hashTable[i]);
				}
			}
		}
		hashResult = hashResult % 11;
		if (hashResult === 10) {
			hashResult = 1;
		}
		if (cnp[12] !== hashResult) {
			app.alert('CNP-ul introdus nu este valid!');
			field.strokeColor = color.red;
			return false;
		} else {
			field.fieldstrokeColor = color.black;			
			return true;
		}
		return false;
	}
	return false;
}

function validareCIF(s) {
	if (parseInt(s) != s) // CIF is of form ROxxxxxxxxx
	{
		if (s.substring(0, 2).toUpperCase() != 'RO' || s.length > 12) {
			app.alert("CIF-ul nu este introdus intr-un format valid!");
			field.strokeColor = color.red;
			return false;
		}

		s = s.substring(2, s.length); // Extract only the numeric content
	} else // CIF is only numeric
	{
		if (s.length > 10) {
			app.alert("CIF-ul introdus contine mai mult de 10 cifre!");
			field.strokeColor = color.red;
			return false;
		}
	}
	var cifraControl = s.charAt(s.length - 1);
	var content = s.substring(0, s.length - 1);
	while (content.length < 9) {
		content = '0' + content;
	}
	suma = content.charAt(0) * 7 + content.charAt(1) * 5 + content.charAt(2)
			* 3 + content.charAt(3) * 2 + content.charAt(4) * 1
			+ content.charAt(5) * 7 + content.charAt(6) * 5 + content.charAt(7)
			* 3 + content.charAt(8) * 2;
	suma = suma * 10;
	rest = suma % 11;
	if (rest == 10)
		rest = 0;
	if (rest == cifraControl) {
		field.strokeColor = color.black;
		return true;
	}
	app.alert("CIF-ul introdus nu este valid!");
	field.strokeColor = color.red;
	return false;
}
stream_012_off00095f05.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x95F05 31912 bytes
SHA-256: b4a77d604cd8b4cf76959b5e4be6a88f157f1bbd5b4a0bcc6a0c175637eed8f8
stream_019_off000ae4bb.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xAE4BB 1110940 bytes
SHA-256: 5eba94a47b790275719ccddd55d8f2bed63e8aec3cecfa275de4f55f14b1da41
font_00_sfnt_off000879a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x879A2 27104 bytes
SHA-256: 87c7baf706d47bb60ea4fd4805ad09c69e570910d7b5ccdc37c98fada136e246

Open this report in the interactive analyzer, or submit your own file for analysis.