Malicious PDF — malware analysis report

Static analysis result for SHA-256 df5664246bcf541b…

MALICIOUS

PDF

101.4 KB Authoring application: Cirali Output Manager B1-23 http://www.fjd.de (via cirali-pdf Pdf-V74 http://www.fjd.de) First seen: 2026-05-10
MD5: 82622f8e47bc1449a17ec46fded176b0 SHA-1: 9158f67722bb6e66edc871216a7a07b36697b04d SHA-256: df5664246bcf541bbeb8988fdb29d3f4f29595218ccd3548e9e29175603256b4
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains multiple embedded JavaScript streams and actions, indicating an attempt to leverage PDF vulnerabilities. The presence of embedded URLs, specifically http://www.fjd.de, suggests a potential download or redirection vector. While the exact payload is not clear due to obfuscation, the overall structure points to a malicious document designed to execute code.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9763

Heuristics 6

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.fjd.de In PDF document text
    • http://www.fjd.de)/CreatorIn PDF document text
    • http://www.fjd.de)/AuthorIn PDF document text

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0002_000.js pdf-javascript-stream PDF /JS object 2 at offset 0xF5 449 bytes
SHA-256: 227ca46bb27e6d02fc509d522435c3c917f7409b7380571752f9579fd7d8fea5
Preview script
First 1,000 lines of the extracted script
var n = this.numFields;
var f;
var fn;
for(var i=0;i<n;i++)
{
   fn = this.getNthFieldName(i);
   if(""==fn) continue;

   f = this.getField(fn);
   if(null==f) continue;
   if("button"==f.type)continue;

   SYS_FILL(f,color.transparent);


   if("checkbox"==f.type)
   { f.style=style.cr;
     f.strokeColor=getBorderColor(fn);
   }
   else
   {    if(""+f.strokeColor!=""+color.transparent)
   		{  f.strokeColor=color.transparent;
   		}
   }
}
javascript_obj0002_001.js pdf-javascript-stream PDF /JS object 2 at offset 0xF5 38 bytes
SHA-256: b2e38f438ed1e34f318d244186a1aea582b8a0caaa8ce2a5646ddcf16e0534b4
Preview script
First 1,000 lines of the extracted script
SYS_RESET_BG_COLORS_UPON_ALL_PAGES();
javascript_obj0012_002.js pdf-javascript-stream PDF /JS object 12 at offset 0x5149 172 bytes
SHA-256: 8cc2b8fed26bfd6bfd0e9390d61d0b1f0ddfa7085457fab06e3c2ebc31556cdb
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
  var strZiffern="0123456789";  
   if(-1 == strZiffern.indexOf(event.change))
   {       app.beep(0);event.rc=false;
   }
}
javascript_obj0014_003.js pdf-javascript-stream PDF /JS object 14 at offset 0x53EB 383 bytes
SHA-256: 5c2793e47ed93c663b7a3f6d30a48d644d952599bfb3287b36adfa8990b6bb2f
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
var str1= event.value.substring(0,3);
var str2= event.value.substring(3,6);
var str3= event.value.substring(6,8);
event.value=str1+" "+str2+" "+str3;
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0014_004.js pdf-javascript-stream PDF /JS object 14 at offset 0x53EB 182 bytes
SHA-256: ec999b72d989c5d75c8daf099c3634a7ca9160827e5673f75d4056ae2fdb9ced
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
var c= event.change;
if(c<"0" || c>"9" )
{ app.beep(0);
event.rc=false; }
if(event.value.length>7)
{ app.beep(0);
event.rc=false; } 
}
javascript_obj0014_005.js pdf-javascript-stream PDF /JS object 14 at offset 0x53EB 421 bytes
SHA-256: d5ef5f36cf6753cac87e0c0f333c1d9ab3740d15399ec0bbdd3e2593ce37ed26
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
var nettovalue=event.value;
nettovalue=nettovalue.replace(/ /g,"");
if(nettovalue.length!=8)
{ app.alert("Bitte geben Sie eine Bankleitzahl mit genau 8 Ziffern an.");
event.rc = false; } 
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0014_006.js pdf-javascript-stream PDF /JS object 14 at offset 0x53EB 277 bytes
SHA-256: d1c03959506bbd1350972231588ca5d32f8cb1d94f1bb5555eedc21fa0a56738
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
var str1= event.value.substring(0,3);
var str2= event.value.substring(3,6);
var str3= event.value.substring(6,8);
event.value=str1+" "+str2+" "+str3;
}if(false==event.rc
javascript_obj0014_007.js pdf-javascript-stream PDF /JS object 14 at offset 0x53EB 315 bytes
SHA-256: d28308bb7c8227f9512535b128a59026b46d551e291e2470db29b165f9641359
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
var nettovalue=event.value;
nettovalue=nettovalue.replace(/ /g,"");
if(nettovalue.length!=8)
{ app.alert("Bitte geben Sie eine Bankleitzahl mit genau 8 Ziffern an.");
event.rc = false; } 
}if(false==event.rc
javascript_obj0020_008.js pdf-javascript-stream PDF /JS object 20 at offset 0x5D86 264 bytes
SHA-256: 2ca5f896ddb524115f411b81705017d1a0ad72d3a2b4c8fc2ce2eb602ac69267
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
AFDate_FormatEx("dd.mm.yyyy");
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0020_009.js pdf-javascript-stream PDF /JS object 20 at offset 0x5D86 294 bytes
SHA-256: 7097080df016f1b41747ea27659445277babb3bd57e084e959e7f0194ae386db
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
  var c=event.change;
   var success=1;
   if( ((c<"0") || (c>"9")) && (c!=".") )
   {       success=0;
   }
   if(event.value.length>9)
   {       success=0;
   }
   if(0==success)
   {       app.beep(0);
           event.rc=false;
   }       
}
javascript_obj0020_010.js pdf-javascript-stream PDF /JS object 20 at offset 0x5D86 436 bytes
SHA-256: ccd06df5c7564a65249a403c0814d380ed6a98208bab9228b6d196de20494d9e
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0020_011.js pdf-javascript-stream PDF /JS object 20 at offset 0x5D86 158 bytes
SHA-256: fb9d7ddc44b866c21e006f356fc29d6871b9d2c20382f8e84c0b557ce25b4057
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
AFDate_FormatEx("dd.mm.yyyy");
}if(false==event.rc
javascript_obj0020_012.js pdf-javascript-stream PDF /JS object 20 at offset 0x5D86 330 bytes
SHA-256: aaae3ab489cd132eee2eee63d623ef1847a3dd91ccc6336b54458acb205dd966
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}if(false==event.rc
javascript_obj0034_013.js pdf-javascript-stream PDF /JS object 34 at offset 0x6FF8 271 bytes
SHA-256: 9b7492c273fc43e3844d0b6b7c6c631c485ca0c92ae7941958a1d32dbb6c378c
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   AFNumber_Format(2,2,0,0,'',false);
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0034_014.js pdf-javascript-stream PDF /JS object 34 at offset 0x6FF8 204 bytes
SHA-256: f8e422b4c2d1511eac19167be1bab2c1bdebc8f959058486dff878ad7cc95a0f
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
   AFNumber_Keystroke(2,2,0,0,'',false);
   var n=2;
   if( (0==n) && (","==event.change) )
   {       app.beep(0);
           event.rc=false;
   }       
}
javascript_obj0034_015.js pdf-javascript-stream PDF /JS object 34 at offset 0x6FF8 165 bytes
SHA-256: 8ae0e1d8cccba0af56742d343baa3534800b293045d23409c34fc48f38c2ae43
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   AFNumber_Format(2,2,0,0,'',false);
}if(false==event.rc
javascript_obj0040_016.js pdf-javascript-stream PDF /JS object 40 at offset 0x7E37 383 bytes
SHA-256: db5aae9b5de27a8799c59639db0f7fc0dabffa5417734f4a6668d001a415df88
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
  var c=event.change;
   var success=1;
   if( (c<"0") || (c>"9"))
   {       success=0;
           if( (c==":")  && (-1==event.value.indexOf(':')) )
           {       success=1;
           }
   }
   if(event.value.length>4)
   {       success=0;
   }
   if(0==success)
   {       app.beep(0);
           event.rc=false;
   }       
}
javascript_obj0040_017.js pdf-javascript-stream PDF /JS object 40 at offset 0x7E37 1481 bytes
SHA-256: 12722d06d990c24d21eae33d1a8ed4e6829e23286cd4d35e8a79ed33b3e326b0
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   var success=true;
   var pos=event.value.indexOf(':');
   if( ( (1==pos) || (2==pos) ) && (pos+1<event.value.length) )
   {                                       
           var strHours=event.value.substring(0,pos);
           var strMin=event.value.substring(pos+1,event.value.length);
           var dHour=new Number(strHours);
           var dMin=new Number(strMin);
           if( (dHour<0) || (dHour > 23) )
           {       success=false;                  
           }
           if( (dMin<0) || (dMin > 59) )
           {       success=false;                  
           }
           if(true==success)
           {                       
                   strHour=""+dHour;                     
                   if(dMin<10)
                   {       strMin="0"+dMin;                              
                   }
                   else
                   {       strMin=""+dMin;
                   }
                   event.target.value=strHour+":"+strMin;                                                
           }               
   }
   else
   {  success=false;
   }
   
    if(false==success)
    {      app.alert("Bitte geben Sie eine Uhrzeit wie folgt formatiert ein: (h)h:(m)m");
           event.rc=false;
    }
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0040_018.js pdf-javascript-stream PDF /JS object 40 at offset 0x7E37 1375 bytes
SHA-256: 3185851e0424ff0d7fe289bac40f66209c4dfddb84b0e8e447701a50f28953a9
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   var success=true;
   var pos=event.value.indexOf(':');
   if( ( (1==pos) || (2==pos) ) && (pos+1<event.value.length) )
   {                                       
           var strHours=event.value.substring(0,pos);
           var strMin=event.value.substring(pos+1,event.value.length);
           var dHour=new Number(strHours);
           var dMin=new Number(strMin);
           if( (dHour<0) || (dHour > 23) )
           {       success=false;                  
           }
           if( (dMin<0) || (dMin > 59) )
           {       success=false;                  
           }
           if(true==success)
           {                       
                   strHour=""+dHour;                     
                   if(dMin<10)
                   {       strMin="0"+dMin;                              
                   }
                   else
                   {       strMin=""+dMin;
                   }
                   event.target.value=strHour+":"+strMin;                                                
           }               
   }
   else
   {  success=false;
   }
   
    if(false==success)
    {      app.alert("Bitte geben Sie eine Uhrzeit wie folgt formatiert ein: (h)h:(m)m");
           event.rc=false;
    }
}if(false==event.rc
javascript_obj0049_020.js pdf-javascript-stream PDF /JS object 49 at offset 0x9A75 242 bytes
SHA-256: 4c6c64e7a32fa708b26821279e2e5615e9eb2671c565f4c801626dd69ccb58a8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
7 of 8 identifiers look randomly generated (e.g. 'SYS_CB_OBJ3') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
if(event.source)
{ var n=event.source.name;
if(n=="OBJ1")SYS_CB_OBJ1();
if(n=="OBJ2")SYS_CB_OBJ2();
if(n=="OBJ4")SYS_CB_OBJ4();
if(n=="OBJ3")SYS_CB_OBJ3();
if(n=="OBJ5")SYS_CB_OBJ5();
if(n=="OBJ6")SYS_CB_OBJ6();
if(n=="OBJ7")SYS_CB_OBJ7();
}
javascript_obj0158_027.js pdf-javascript-stream PDF /JS object 158 at offset 0x153B8 2811 bytes
SHA-256: b09b4b777d122b38d7734636115a10123a4321a4e562bc220092d00ae27bf3cb
Preview script
First 1,000 lines of the extracted script
function getBgColor(fn){
var BG_DISABLED=["RGB",0.749,0.749,0.749];
var BG_173=["RGB",1.0,1.0,1.0];
  if(fn=="Schule") return BG_173;
  if(fn=="Name_Vorname_Anschrift") return BG_173;
  if(fn=="Kontonummer") return BG_173;
  if(fn=="BLZ") return BG_173;
  if(fn=="Kreditinstitut") return BG_173;
  if(fn=="Grund_der_RKR") return BG_173;
  if(fn=="Genehmigung_vom") return BG_173;
  if(fn=="Schuelerzahl") return BG_173;
  if(fn=="Schuelerzahl1") return BG_173;
  if(fn=="Ziel") return BG_173;
  if(fn=="Reiseweg") return BG_173;
  if(fn=="Befoerderungsmittel") return BG_173;
  if(fn=="Dienstbezeichnung") return BG_173;
  if(fn=="Fahrkosten") return BG_173;
  if(fn=="Nebenkosten") return BG_173;
  if(fn=="Antritt_der_DR") return BG_173;
  if(fn=="Uhrzeit") return BG_173;
  if(fn=="Ende_der_DR") return BG_173;
  if(fn=="Uhrzeit1") return BG_173;
  if(fn=="OBJ1") return BG_173;
  if(fn=="OBJ2") return BG_173;
  if(fn=="OBJ4") return BG_173;
  if(fn=="Grenzuebergang") return BG_173;
  if(fn=="Grenzuebergang1") return BG_173;
  if(fn=="Grenzuebertritt") return BG_173;
  if(fn=="Grenzuebertritt1") return BG_173;
  if(fn=="OBJ3") return BG_173;
  if(fn=="Betrag") return BG_173;
  if(fn=="Zuschuss") return BG_173;
  if(fn=="OBJ5") return BG_173;
  if(fn=="Ort_Datum_Unterschrift") return BG_173;
  if(fn=="OBJ6") return BG_173;
  if(fn=="OBJ7") return BG_173;
  if(fn=="Unterschrift_Schulleiter") return BG_173;
  if(fn=="Fahrkosten_EUR") return BG_173;
  if(fn=="Nebenk_EUR") return BG_173;
  if(fn=="EUR") return BG_173;
  if(fn=="Tage") return BG_173;
  if(fn=="Tage_EUR") return BG_173;
  if(fn=="Kuerzungsbetraege") return BG_173;
  if(fn=="EUR1") return BG_173;
  if(fn=="Tage1") return BG_173;
  if(fn=="Tage_EUR1") return BG_173;
  if(fn=="Kuerzungsbetraege1") return BG_173;
  if(fn=="EUR2") return BG_173;
  if(fn=="Tage2") return BG_173;
  if(fn=="Tage_EUR2") return BG_173;
  if(fn=="Kuerzungsbetraege2") return BG_173;
  if(fn=="EUR3") return BG_173;
  if(fn=="Uebernachtung") return BG_173;
  if(fn=="Uebernachtung_EUR") return BG_173;
  if(fn=="Uebernachtung1") return BG_173;
  if(fn=="Uebernachtung_EUR1") return BG_173;
  if(fn=="EUR4") return BG_173;
  if(fn=="EUR5") return BG_173;
  if(fn=="Tage3") return BG_173;
  if(fn=="Tage_EUR3") return BG_173;
  if(fn=="Kuerzungsbetraege3") return BG_173;
  if(fn=="Tage4") return BG_173;
  if(fn=="Tage_EUR4") return BG_173;
  if(fn=="Kuerzungsbetraege4") return BG_173;
  if(fn=="Tage5") return BG_173;
  if(fn=="Tage_EUR5") return BG_173;
  if(fn=="Kuerzungsbetraege5") return BG_173;
  if(fn=="EUR6") return BG_173;
  if(fn=="Absetzung") return BG_173;
  if(fn=="Absetzung1") return BG_173;
  if(fn=="EUR7") return BG_173;
  if(fn=="auszuzahlen") return BG_173;
  if(fn=="Rechnerisch_richtig") return BG_173;
    return color.transparent;}
javascript_obj0159_028.js pdf-javascript-stream PDF /JS object 159 at offset 0x15FB7 166 bytes
SHA-256: 9f51a81ea495069ac3bd65daf89fd1c4a332f6ab52c21e14c04ec2c85ecccdee
Preview script
First 1,000 lines of the extracted script
function getBorderColor(fn){
   var f = this.getField(fn);
   if((null!=f)&&("checkbox"==f.type))
   { return ["RGB",0.0,0.0,0.0];
   }
   return color.transparent;
}
javascript_obj0160_029.js pdf-javascript-stream PDF /JS object 160 at offset 0x1609A 280 bytes
SHA-256: bb0cc0ea4c337306f6e2f48a1141a3f0f0b71c8fa4e6a492f8fae20a58ca3eb4
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CLR(name,bNeedsColouredMustFillBorder)
{
    if(bNeedsColouredMustFillBorder)
    {    getField(name).strokeColor=color.red;
        }
        else
    	{    getField(name).strokeColor=getBorderColor(name);
        }
    return bNeedsColouredMustFillBorder;
}
javascript_obj0161_030.js pdf-javascript-stream PDF /JS object 161 at offset 0x161F3 468 bytes
SHA-256: 82c0fd6e6cc117687c47ced7f0ce920ecb308781c8402ac1927d871608b9fef1
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_STATE()
{
    if(false==SYS_IS_MUFI_CB(SYS_CB_HDL_STATE.arguments[0])) return false;
    var obj=getField(SYS_CB_HDL_STATE.arguments[0]);
    if("Yes"==obj.value) return false;
    if(true==obj.readonly) return false;
    if(display.hidden==obj.display) return false;
    for(var i=1;i<SYS_CB_HDL_STATE.arguments.length;i++)
    {   if("Yes"==getField(SYS_CB_HDL_STATE.arguments[i]).value)
    	{   return false;
        }
    }
    return true;
}
javascript_obj0162_031.js pdf-javascript-stream PDF /JS object 162 at offset 0x16416 168 bytes
SHA-256: f6c2357c12b7e2cbd2f963dd05935f9bd1d924cb5654b0cfca7b2eeaa3f05a1b
Preview script
First 1,000 lines of the extracted script
function SYS_IS_MUFI_CB(cbname)
{   var all_mufi_cb= new Array();
	for(var i=0;i<all_mufi_cb.length;i++)
	{	if(cbname==all_mufi_cb[i]) return true;
	}
	return false;
}
javascript_obj0163_032.js pdf-javascript-stream PDF /JS object 163 at offset 0x164FA 70 bytes
SHA-256: 68582c3b030f7ce77460540a7ea21e899d133ef6ae8330fbbb6a5db8d1040ccb
Preview script
First 1,000 lines of the extracted script
function SYS_FILL(f,c){
  if(""+f.fillColor!=""+c)  {f.fillColor=c;}}
javascript_obj0164_033.js pdf-javascript-stream PDF /JS object 164 at offset 0x16573 251 bytes
SHA-256: 11a1bd3ed0d867a06a568a40ba9d93946c031e168697e359578f9ad5e75f7e59
Preview script
First 1,000 lines of the extracted script
function SYS_EWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0165_034.js pdf-javascript-stream PDF /JS object 165 at offset 0x166BA 251 bytes
SHA-256: b489e14c022670e263ade06b76d1f9a44446979ddfa4df58bed63e1e68ca6dfa
Preview script
First 1,000 lines of the extracted script
function SYS_AWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
 else
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
}
javascript_obj0166_035.js pdf-javascript-stream PDF /JS object 166 at offset 0x16801 220 bytes
SHA-256: f4379dc788b0345e77b7c62fb70b4743640256954408c64b71bb4e1d213b0ffe
Preview script
First 1,000 lines of the extracted script
function SYS_EWB(v1,f2){
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(""==v1)
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0167_036.js pdf-javascript-stream PDF /JS object 167 at offset 0x16926 1263 bytes
SHA-256: 2856e6304c394af10c1bf9c2627fd4c31d4605a8e9c743b15c91d5a1c90a0abe
Preview script
First 1,000 lines of the extracted script
function SYS_PA2_SUBMIT()
{
        var pflichtfelder_befuellt = SYS_CHECK_MF_FIELDS();
        var n = this.numFields;
        var f;
        var fn;
        for(var i=0;i<n;i++)
        {
                fn = this.getNthFieldName(i);
                if( (""!=fn) && ("SYS_SEND_BUTTON"==fn.substring(0,15)) )
                {
                        f = this.getField(fn);
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=false;
                        	 }
                        	 else
                        	 { f.readonly=true;
                        	 }
                        }
                        f = this.getField("SYS_SEND_BTN_SHADOW"+fn.substring(15,fn.length));
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=true;
                        	   f.display=display.hidden;
                        	 }
                        	 else
                        	 { f.readonly=false;
                        	   f.display=display.visible;
                        	 }
                        }
                }
        }
}
javascript_obj0168_037.js pdf-javascript-stream PDF /JS object 168 at offset 0x16E84 171 bytes
SHA-256: f953b4e209656e0e024dd8f67fe8f7d5964aa7f88f3c44320410cd2772618c7e
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_OBJ1(changecolor)
{   var retval=SYS_CB_HDL_STATE("OBJ1");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("OBJ1",retval);
    }
    return retval;
}
javascript_obj0169_038.js pdf-javascript-stream PDF /JS object 169 at offset 0x16F6B 171 bytes
SHA-256: 5894fd1bd40b9fc6caa0e3e8742be127a4f61d10df05c00855a3416b05029370
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_OBJ2(changecolor)
{   var retval=SYS_CB_HDL_STATE("OBJ2");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("OBJ2",retval);
    }
    return retval;
}

Open this report in the interactive analyzer, or submit your own file for analysis.