Malicious PDF — malware analysis report

Static analysis result for SHA-256 d44816a503bd3884…

MALICIOUS

PDF

4.71 MB Created: 2010-01-21 11:59:45 -05:00 Authoring application: Adobe LiveCycle Forms 8.2 First seen: 2026-05-10
MD5: 39816da3210d08e32d6753b5e33d512e SHA-1: 48d34b3001f57fb0f703a003e51c4893a8c20516 SHA-256: d44816a503bd3884c113705405e1d685fb01e80de14052aaef03793e55099a03
454 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Malware Insights

MITRE ATT&CK
T1059.007 Service Execution: JavaScript T1204.002 Malicious File Execution: Malicious JavaScript

This PDF document contains multiple JavaScript streams and XFA form elements, indicating it is designed to execute malicious code. The critical PDF_XFA_HEAP_SPRAY and PDF_XFA_SCRIPT heuristics confirm the presence of exploit code and risky scripts within the XFA form. The embedded file and numerous streams suggest a complex, multi-stage attack. The ML classifier also strongly flags this PDF as malicious. The primary suspicious URL identified is http://localhost:7001/apply/ProcessForm, likely used to fetch the secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9123

Heuristics 15

  • XFA form contains risky executable script high CVE related PDF_XFA_SCRIPT
    PDF embeds an XFA form whose script block contains exploit, submission/launch, or shell-execution primitives. Ordinary LiveCycle print/update scripts are left as generic XFA/JS signals unless stronger behavior is present.
  • Embedded PDF child has suspicious static findings critical PDF_EMBEDDED_CHILD_STATIC_TRIAGE
    PDF contains an embedded PDF stream whose extracted child matches suspicious or malicious PDF heuristics. Wrapper PDFs are commonly used to hide the actual exploit or lure payload from scanners that do not recursively inspect attachments.
  • XFA JavaScript heap-spray exploit code critical PDF_XFA_HEAP_SPRAY
    PDF contains XFA script content with heap-spray or shellcode-like JavaScript markers such as large encoded word sequences, util.pack, large arrays, or spray variable names. This is a weaponised Adobe Reader exploit pattern, not a normal interactive form.
  • JavaScript action low 4 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • exportDataObject + nLaunch — embedded-file launch-on-open dropper critical PDF_JS_EXPORT_LAUNCH_DROPPER
    PDF JavaScript calls exportDataObject() with nLaunch set, which extracts the document's embedded file and launches it in its default application. This is a launch-on-open dropper: the embedded file is the payload. No benign workflow auto-launches an extracted PDF attachment. (identified after nested-decoder de-obfuscation)
  • PDF JavaScript rewrites strings thousands of times to hide its payload critical PDF_JS_EXTREME_STRING_REWRITE_OBFUSCATION
    The document's JavaScript performs an extreme number of runtime string-rewriting operations (substr/substring/replace/charAt/charCodeAt) — it rebuilds its sink names and payload by slicing and replacing junk-interleaved strings so the literal exploit sinks (util.printf, Collab.getIcon, unescape, eval) never appear for a static scanner. Benign PDF form/calculation scripts use a handful of these calls; obfuscated-exploit droppers run into the thousands. This rewrite density has no benign purpose and marks the file an obfuscated JavaScript exploit even when the specific CVE cannot be statically resolved (the sinks are only assembled at run time).
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://localhost:7001/apply/ProcessForm In PDF document text
    • http://ohrp.osophs.dhhs.gov/humansubjects/guidance/45cfr46.htmIn PDF document text
    • http://w.rnsgvhl/onodsfwr.sReferenced by PDF JavaScript
    • http://www.grants.gov/help/download_software.jsp#adobe811Referenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://www.xfa.org/schema/xci/2.6/In PDF document text
    • http://www.xfa.org/schema/xfa-template/2.1/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.6/In PDF document text
    • http://www.w3.org/1999/xhtmlReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-data/1.0/Referenced by PDF JavaScript
    • http://grants.gov/help/general_faqs.jsp#adobeReferenced by PDF JavaScript
    • http://stemcells.nih.gov/research/registry/In PDF document text
    • http://grants1.nih.gov/grants/guide/notice-files/NOT-OD-02-017.htmlIn PDF document text
    • http://www.whitehouse.gov/omb/circulars/a021/a21_2004.html#excReferenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-template/2.2/Referenced by PDF JavaScript
    • http://www.xfa.org/schema/xfa-connection-set/2.4/In PDF document text
    • http://www.xfa.org/schema/xfa-connection-set/2.1/In PDF document text
    • http://ns.adobe.com/data-description/In PDF document text
    • http://apply.grants.gov/system/MetaGrantApplicationWrapperIn PDF document text
    • http://apply.grants.gov/system/MetaGrantApplicationIn PDF document text
    • http://apply.grants.gov/system/Header-V1.0In PDF document text
    • http://apply.grants.gov/system/Global-V1.0In PDF document text
    • http://apply.grants.gov/forms/RRSF424_SF424B-V1.1In PDF document text
    • http://apply.grants.gov/forms/SF424C-V1.0In PDF document text
    • http://apply.grants.gov/forms/RR_Budget-V1.1In PDF document text
    • http://apply.grants.gov/system/GlobalLibrary-V2.0In PDF document text
    • http://apply.grants.gov/system/Attachments-V1.0In PDF document text
    • http://apply.grants.gov/forms/RR_SubawardBudget-V1.2In PDF document text
    • http://apply.grants.gov/forms/RR_SubawardBudget30-V1.2In PDF document text
    • http://apply.grants.gov/forms/RR_FedNonFedBudget-V1.1In PDF document text
    • http://apply.grants.gov/forms/RR_FedNonFed_SubawardBudget-V1.2In PDF document text
    • http://apply.grants.gov/forms/RR_FedNonFed_SubawardBudget30-V1.2In PDF document text
    • http://apply.grants.gov/forms/RR_Budget10-V1.1In PDF document text
    • http://apply.grants.gov/forms/RR_SubawardBudget10_10-V1.2In PDF document text
    • http://apply.grants.gov/forms/RR_SubawardBudget10_30-V1.2In PDF document text
    • http://apply.grants.gov/forms/RR_FedNonFedBudget10-V1.1In PDF document text
    • http://apply.grants.gov/forms/RR_FedNonFed_SubawardBudget10_10-V1.2In PDF document text
    • http://apply.grants.gov/forms/RR_FedNonFed_SubawardBudget10_30-V1.2In PDF document text
    • http://apply.grants.gov/forms/RR_PerformanceSite-V1.1In PDF document text
    • http://apply.grants.gov/forms/PerformanceSite_1_2-V1.2In PDF document text
    • http://apply.grants.gov/forms/PerformanceSite_1_3-V1.3In PDF document text
    • http://apply.grants.gov/forms/PerformanceSite_1_4-V1.4In PDF document text
    • http://apply.grants.gov/forms/RR_KeyPerson-V1.1In PDF document text
    • http://apply.grants.gov/forms/RR_KeyPersonExpanded-V1.1In PDF document text
    +65 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj1295_000.js pdf-javascript-stream PDF /JS object 1295 at offset 0x3EA0C 870 bytes
SHA-256: 4a1aca004cf20431c9a66dce85404a6411a54d881a6c257882260ffc972a13eb
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 7.0)
{
   ADBE.Reader_Need_Version = 7.0;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 7.0)
{
   ADBE.Viewer_Need_Version = 7.0;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&w=" + "XFA1_6";
}
javascript_obj1297_001.js pdf-javascript-stream PDF /JS object 1297 at offset 0x3EB96 2798 bytes
SHA-256: 922f7942d25f53e6e6eedc1b3a95c47a757faab3be4838fa02db0dbea2c4dbcc
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer_7x = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
javascript_obj1299_002.js pdf-javascript-stream PDF /JS object 1299 at offset 0x3EE8F 1535 bytes
SHA-256: 04ceb4c2218e7db19a6e007ca4ce846f92c17fff5eaf3a611e71bbd7a5726917
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.1)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 6.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_5x, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.viewerVersion < 7.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_601, 1, 1) == 1)
               app.findComponent({cType:"App", cName:"Reader7", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
         else
         {
            if (app.alert(ADBE.Viewer_Form_string_Reader_6_7x, 1, 1) == 1)
               app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Reader_Desc});
            ADBE.Reader_Value_Asked = true;
         }
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
         else if (app.alert(ADBE.Viewer_Form_string_Viewer_7x, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cDesc: ADBE.Viewer_string_Update_Desc});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
embedded_file_obj0049.bin pdf-embedded-file PDF EmbeddedFile object 49 at offset 0x482451 401614 bytes
SHA-256: 89809666d37e31c6b507bbc8fbf6a120ec1fce378c260d1266b3c31600ac5ee9
javascript_obj0021_000.js pdf-javascript-stream PDF /JS object 21 at offset 0x191D 1313 bytes
SHA-256: f94e41f586bf3f20bc1deeac4bfbda388a61db43f25fbd6304ba73f5653368cf
Preview script
First 1,000 lines of the extracted script
if (typeof(xfa_installed) == "undefined" || typeof(xfa_version) == "undefined" || xfa_version < 2.6)
{
   if (app.viewerType == "Reader")
   {
      if (ADBE.Reader_Value_Asked != true)
      {
         if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Reader_string_Need_New_Version_Msg, 1, 1) == 1)
               this.getURL(ADBE.Reader_Value_New_Version_URL + ADBE.SYSINFO, false);
            ADBE.Reader_Value_Asked = true;
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
      }
   }
   else
   {
      if (ADBE.Viewer_Value_Asked != true)
      {
         if (app.viewerVersion < 7.0)
            app.response({cQuestion: ADBE.Viewer_Form_string_Viewer_Older, cDefault: ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, cTitle: ADBE.Viewer_string_Title});
		   else if (app.viewerVersion < 8.0)
         {
            if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
               app.launchURL(ADBE.Viewer_Value_New_Version_URL + ADBE.SYSINFO, true);
         }
         else if (app.alert(ADBE.Viewer_Form_string_Viewer, 1, 1) == 1)
            app.findComponent({cType:"Plugin", cName:"XFA", cVer:"2.6"});
         ADBE.Viewer_Value_Asked = true;
      }
   }
}
javascript_obj0022_001.js pdf-javascript-stream PDF /JS object 22 at offset 0x1AFA 902 bytes
SHA-256: 1b2ec98752b966f601d5223a750559cf13d562ac5e5c6d1fcc7217835b01f5fd
Preview script
First 1,000 lines of the extracted script
if (typeof(ADBE.Reader_Value_Asked) == "undefined")
   ADBE.Reader_Value_Asked = false;
if (typeof(ADBE.Viewer_Value_Asked) == "undefined")
   ADBE.Viewer_Value_Asked = false;
if (typeof(ADBE.Reader_Need_Version) == "undefined" || ADBE.Reader_Need_Version < 8.1)
{
   ADBE.Reader_Need_Version = 8.1;
   ADBE.Reader_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Reader_Need_Version;
}
if (typeof(ADBE.Viewer_Need_Version) == "undefined" || ADBE.Viewer_Need_Version < 8.1)
{
   ADBE.Viewer_Need_Version = 8.1;
   ADBE.Viewer_Value_New_Version_URL = "http://cgi.adobe.com/special/acrobat/update";
   ADBE.SYSINFO = "?p=" + app.platform + "&v=" + app.viewerVersion + "&l=" + app.language + "&c=" + app.viewerType + "&r=" + ADBE.Viewer_Need_Version;
}
javascript_obj0023_002.js pdf-javascript-stream PDF /JS object 23 at offset 0x1C53 2795 bytes
SHA-256: 826c5622c798d67e5281cca7e05933dddc90ccdcb0a6177c9f7d06f11bef8f7f
Preview script
First 1,000 lines of the extracted script
if (typeof(this.ADBE) == "undefined")
   this.ADBE = new Object();
ADBE.LANGUAGE = "ENU";
ADBE.Viewer_string_Title = "Adobe Acrobat";
ADBE.Viewer_string_Update_Desc = "Adobe Interactive Forms Update";
ADBE.Viewer_string_Update_Reader_Desc = "Adobe Reader 7.0.5";
ADBE.Reader_string_Need_New_Version_Msg = "This PDF file requires a newer version of Adobe Reader. Press OK to download the latest version or see your system administrator.";
ADBE.Viewer_Form_string_Reader_601 = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Reader_Older = "This PDF form requires a newer version of Adobe Reader. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK for online download information or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_601 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. Press OK to initiate an online update or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_60 = "This PDF form requires a newer version of Adobe Acrobat. Although the form may appear to work properly, some elements may function improperly or may not appear at all. For more information please copy the following URL (CTRL+C on Win, Command-C on Mac) and paste into your browser or see your system administrator.";
ADBE.Viewer_Form_string_Viewer_Older = "This PDF requires a newer version of Acrobat. Copy this URL and paste into your browser or see your sys admin.";
ADBE.Viewer_Form_string_Reader_5x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will open your browser to a web page where you can obtain the latest version.";
ADBE.Viewer_Form_string_Reader_6_7x = "This PDF form requires a newer version of Adobe Reader. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
ADBE.Viewer_Form_string_Viewer = "This PDF form requires a newer version of Adobe Acrobat. Without a newer version, the form may be displayed, but it might not work properly. Some form elements might not be visible at all. If an internet connection is available, clicking OK will download and install the latest version.";
embedded_pdf_script_00003ab9.bin pdf-embedded-script PDF raw stream script payload at offset 0x3AB9 7720 bytes
SHA-256: 100feabaa79cba7cf3e856314f371ae53e1d7921b36bed211093f90e8b3460d4
Preview script
First 1,000 lines of the extracted script
<config xmlns:xfa="http://www.xfa.org/schema/xci/1.0/" xmlns="http://www.xfa.org/schema/xci/2.6/"
><present
><!--  [0..n]  --><common
><data
><adjustData
>1</adjustData
><!-- 0|1 --><attributes
>preserve</attributes
><!-- ignore|delegate|preserve --><outputXSL
><uri
/></outputXSL
><range
/><record
/><startNode
/><uri
/><window
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
></data
><log
><!--  [0..n]  --><uri
/><mode
>append</mode
><!-- append|overwrite --><threshold
>trace</threshold
><!-- trace|information|warning|error --><to
>memory</to
><!-- uri|memory|stdout|null|stderror|system --></log
><temp
><uri
>/var/tmp/</uri
></temp
><template
><base
>file:/Products_Grants_gov/adobe/temp_xdp_files/</base
><startPage
>0</startPage
><uri
/><relevant
/></template
><locale
>en_US</locale
></common
><copies
>1</copies
><destination
>pdf</destination
><!-- pdf|ps|pcl --><driver
><!--  [0..n]  --><fontInfo
><embed
>0</embed
><!-- 0|1 --><map
><equate
/><!-- [0..n] Attributes: from='', to='' [0..n]  --></map
><subsetBelow
>100</subsetBelow
></fontInfo
><xdc
><uri
/></xdc
></driver
><pdf
><!--  [0..n]  --><!-- Temporarily turned off until PDFUpdate is able to append with compression. --><compression
><compressLogicalStructure
>1</compressLogicalStructure
><!-- 0|1 --><level
>1</level
><!-- 0 - 9, 0=no compression 1=best speed 9=best compression --><type
>none</type
></compression
><encryption
><encrypt
>0</encrypt
><!-- 0|1 --><encryptionLevel
>40bit</encryptionLevel
><!-- 40bit|128bit --><permissions
><accessibleContent
>0</accessibleContent
><!-- 0|1 --><contentCopy
>0</contentCopy
><!-- 0|1 --><documentAssembly
>0</documentAssembly
><!-- 0|1 --><formFieldFilling
>0</formFieldFilling
><!-- 0|1 --><modifyAnnots
/><plaintextMetadata
>0</plaintextMetadata
><!-- 0|1 --><print
>1</print
><!-- 0|1 --><printHighQuality
/><change
>0</change
><!-- 0|1 --></permissions
></encryption
><fontInfo
><embed
>0</embed
><!-- 0|1 --><!--defaultTypeface>MyriadPro-Regular</defaultTypeface--><map
><!-- [0..n] Attributes: from='', to='' [0..n]  --><equate force="0" from="Courier_*_*" to="Courier New_*_*"
/><equate force="0" from="CourierNew_*_*" to="Courier New_*_*"
/><equate force="0" from="Courier-New_*_*" to="Courier New_*_*"
/><equate force="0" from="MyriadPro_*_*" to="Myriad Pro_*_*"
/><equate force="0" from="MyriadPro-Regular_*_*" to="Myriad Pro_*_*"
/><equate force="0" from="MyriadPro-It_*_*" to="Myriad Pro_*_italic"
/><equate force="0" from="MyriadPro-SemiboldSemiCn_*_*" to="Arial Narrow_bold_*"
/><equate force="0" from="MyriadPro-SemiboldCond_*_*" to="Arial Narrow_bold_*"
/><equate force="0" from="MinionPro_*_*" to="Minion Pro_*_*"
/><equate force="0" from="MinionPro-Regular_*_*" to="Minion Pro_*_*"
/><equate force="0" from="ArialNarrow_*_*" to="Arial Narrow_*_*"
/><equate force="0" from="Arial-Narrow_*_*" to="Arial Narrow_*_*"
/><equate force="0" from="ArialMT_*_*" to="Arial_*_*"
/><equate force="0" from="DTLDocumentaSansT_bold_*" to="Arial Narrow_bold_*"
/><equate force="0" from="DTLDocumentaSansST_bold_*" to="Arial Narrow_bold_*"
/><equate force="0" from="Helvetica Black_*_*" to="Myriad Pro Black_*_*"
/><equate force="0" from="HelveticaBlack_*_*" to="Myriad Pro Black_*_*"
/><equate force="0" from="Helvetica-Black_*_*" to="Myriad Pro Black_*_*"
/><equate force="0" from="Helvetica-Condensed-Black_*_*" to="Arial Narrow_bold_*"
/><equate force="0" from="Helvetica-Condensed_*_*" to="Arial Narrow_*_*"
/><equate force="0" from="HelveticaNeue-Roman_*_*" to="Myriad Pro_*_*"
/><equate force="0" from="HelveticaNeue-Light_*_*" to="Myriad Pro_*_*"
/><equate force="0" from="HelveticaNeue_*_*" to="Myriad Pro_*_*"
/><equate force="0" from="Helvetica_*_*" to="Myriad Pro_*_*"
/><equate force="0" from="Helv_*_*" to="Myriad Pro_*_*"
/><equate force="0" from="Cour_*_*" to="Courier New_*_*"
/><equate force="0" from="Times_*_*" to="Times New Roman_*_*"
/><equate force="0" from="Times-Roman_*_*" to="Times New Roman_*_*"
/><equate force="0" from="TimesNewRoman_*_*" to="Times New Roman_*_*"
/><equate force="0" from="GillSans_*_*" to="Arial Narrow_*_*"
/><equate force="0" from="HelvOut Blk" to="Myriad Pro"
/><equate force="0" from="PDP Helv_*_*" to="Myriad Pro_*_*"
/><equate force="0" from="CG Times_*_*" to="Minion Pro_*_*"
/><equate force="0" from="ZapfDingbats_*_*" to="WingDings_*_*"
/><equate force="0" from="FranklinGothic-Demi_*_*" to="Myriad Pro_bold_*"
/><equate force="0" from="FormataCondensed-Light_*_*" to="Arial Narrow_*_*"
/><equate force="0" from="FormataCondensed-Regular_*_*" to="Arial Narrow_*_*"
/><equate force="0" from="FormataCondensed-Medium_*_*" to="Arial Narrow_bold_*"
/><!--					
					<equate from='MS-PGothic_*_*' to='MS PGothic_*_*' force="0"/>
					<equate from='MS-PGothic+1_*_*' to='MS PGothic_*_*' force="0"/>
					<equate from='MS-PGothic+2_*_*' to='MS PGothic_*_*' force="0"/>
					<equate from='MS-PGothic+3_*_*' to='MS PGothic_*_*' force="0"/>
					<equate from='MS-PGothic+4_*_*' to='MS PGothic_*_*' force="0"/>
--><equate force="0" from="HGPSoeiKakugothicUB_*_*" to="MS Gothic_*_*"
/><equate force="0" from="GothicBBB-Medium-Identity-H_*_*" to="MS Gothic_*_*"
/></map
><subsetBelow
>100</subsetBelow
><!-- An integer value between 0-100 representing a percentage --></fontInfo
><interactive
>1</interactive
><!-- 0|1 --><openAction
><destination
>none</destination
><!-- none|pageFit --></openAction
><creator
>Adobe LiveCycle Forms 8.2</creator
><producer
>Adobe LiveCycle Forms 8.2</producer
><scriptModel
>XFA</scriptModel
><!-- XFA|none --><submitFormat
>pdf</submitFormat
><!-- html|fdf|xml|pdf --><tagged
>1</tagged
><!-- 0|1 --><xdc
><uri
>adobepdf.xdc</uri
></xdc
><version
>1.7</version
><!-- 1.2=acrobat 3|1.3=acrobat 4 --><renderPolicy
>client</renderPolicy
><adobeExtensionLevel
>1</adobeExtensionLevel
></pdf
><zpl
><fontInfo
><defaultTypeface writingScript="Roman"
>CG Triumvirate</defaultTypeface
><defaultTypeface writingScript="Japanese"
>Kozuka Mincho Pro-VI R</defaultTypeface
><defaultTypeface writingScript="SimplifiedChinese"
>Adobe Song Std L</defaultTypeface
><defaultTypeface writingScript="TraditionalChinese"
>Adobe Ming Std L</defaultTypeface
><defaultTypeface writingScript="Korean"
>Adobe Myungjo Std M</defaultTypeface
><map
><equate force="1" from="MS Gothic_*_*" to="Kozuka Gothic Pro M_*_*"
/></map
></fontInfo
></zpl
><webClient
><!--  [0..n]  --><fontInfo
><embed
>0</embed
><!-- 0|1 --><map
><equate
/><!-- [0..n] Attributes: from='', to='' [0..n]  --></map
><subsetBelow
>100</subsetBelow
></fontInfo
><xdc
><uri
/></xdc
></webClient
><xdp
><!--  [0..n]  --><embedRenderedOutput
>0</embedRenderedOutput
><!-- 0|1 --><packets
>*</packets
></xdp
><layout
>paginate</layout
><!-- paginate|panel --><output
><uri
/><to
>memory</to
><!-- uri|memory|stdout|null --><type
>native</type
><!-- native|xdp|mergedXDP --></output
><script
><currentPage
>0</currentPage
><exclude
>initialize ready calculate enter exit validate nullTest formatTest docClose</exclude
><runScripts
>server</runScripts
><!-- client|server|both --></script
><submitUrl
>http://localhost:7001/apply/ProcessForm</submitUrl
></present
><acrobat
><acrobat7
><dynamicRender
>required</dynamicRender
></acrobat7
><common
><versionControl sourceBelow="maintain"
/><locale
>en_US</locale
><data
><!-- 0|1 --><!-- ignore|delegate|preserve --><adjustData
>1</adjustData
><attributes
>preserve</attributes
><outputXSL
><uri
/></outputXSL
><range
/><record
/><startNode
/><uri
/><window
/><xsl
><debug
><uri
/></debug
><uri
/></xsl
></data
><template
><base
>file:/Products_Grants_gov/adobe/temp_xdp_files/</base
><startPage
>0</startPage
><uri
/><relevant
/></template
></common
></acrobat
><?originalXFAVersion http://www.xfa.org/schema/xci/1.0/?></config
>

Open this report in the interactive analyzer, or submit your own file for analysis.