MALICIOUS
250
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The PDF contains embedded JavaScript with eval() calls and uses String.fromCharCode, indicating obfuscated code execution. It also references CVE-related indicators for JPXDecode and U3D content, suggesting exploitation of known PDF vulnerabilities. The embedded JavaScript likely downloads and executes a second-stage payload, as suggested by the extracted JavaScript files and the overall malicious verdict.
Machine Learning
- Nyx PDF Classifier malicious score 0.6986
Heuristics 10
-
JPXDecode + active content — JPEG2000 CVE-family indicator high PDF_JPX_CVE_2018_4990_RELATEDPDF uses /JPXDecode (JPEG2000) alongside JavaScript, XFA, or RichMedia indicators. This matches the delivery pattern for Adobe Reader JPEG2000 parser exploit families, including CVE-2018-4990, but does not prove the exact malformed JP2/JPX primitive.
-
U3D/3D content in PDF — Adobe Reader 3D parser CVE-family indicator high PDF_U3D_CVE_RELATEDPDF contains U3D (Universal 3D) or 3D annotation content — CVE-2011-2462 and CVE-2009-3953 are critical vulnerabilities in Adobe Reader's U3D processing that allow arbitrary code execution. U3D content in PDFs is extremely rare in normal documents.
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.Matched line in script
var path = eval("IMAGE_PATH"); -
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
AcroForm button with action trigger low PDF_ACROFORM_BUTTONPDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.aladdin.com/etoken/cisco/ In PDF document text
- http://www.cisco.com)/S/URIIn PDF document text
- http://www.aladdin.com/etoken/cisco/)/S/URIIn PDF document text
- http://www.kaon.com/aboutPDFReferenced by PDF JavaScript
- http://www.monotype.comMonotypeReferenced by PDF JavaScript
- http://www.cisco.comPDF link annotation
- http://tools.cisco.com/cse/prdapp/jsp/externalsearch.do?action=externalsearch&page=EXTERNAL_SEARCH&moduleIn PDF document text
- http://www.cisco.com/en/US/products/hwithrouters/In PDF document text
- http://tools.cisco.com/cse/prdapp/jsp/externalsearch.do?action=externalsearch&page=EXTERNAL_SEARCH&module=EXTERNAL_SEARCH)/S/URIIn PDF document text
- http://www.cisco.com/public/sw-center/sw-ios.shtml)/S/URIIn PDF document text
- http://www.cisco.com/en/US/products/hwithrouters/)/S/URIIn PDF document text
- http://www.cisco.com/en/US/products/svcs/ps3034/serv_category_home.html)/S/URIIn PDF document text
- http://www.cisco.com/en/US/products/svcs/ps11/services_segment_category_home.html)/S/URIIn PDF document text
- http://www.cisco.com/go/offices)/S/URIIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
Extracted artifacts 8
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0121_014.js |
pdf-javascript-stream | PDF /JS object 121 at offset 0xD98 | 39494 bytes |
SHA-256: 9536363ba6ef54a3bfae83428030775c23cbaf9e8b0c761b2583d7bdb2a51f25 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 14 eval/decoder/string-building token(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
// Copyright 2005 Kaon Interactive Inc. Application-Level JavaScript
var BGCOLOR_3D = color.white; // Background color of the 3D window
var BULLET_CHARACTER = '\u2022';
var BULLET_COLOR = ["RGB", 240/255, 200/255, 20/255 ];
var COMPRESSION_JPEG_SUBSAMPLING = 411; // This property is export-time only
var COMPRESSION_TEXTURE_SIZE_LIMIT_MPELS = 6; // This property is export-time only. Using values larger than 6 can cause performance issues on some 32M graphic accelerators.
var COMPRESSION_USE_PRESET_SCALE = true; // This property is export-time only
var DYNAMIC_CONTENT_CLASSES = [ 'AppControlSection.Elevator', 'AppControlSection.Features', 'AppControlSection.Services', 'AppControlSection.Pricing', 'AppControlSection.HowToBuy', 'AppControlSection.Advantages' ]; // This property is export-time only.
var DYNAMIC_CONTENT_DEFAULT_ALIGNMENT = 'left';
var DYNAMIC_CONTENT_DEFAULT_FONT = ['Arial', 'sans-serif'];
var DYNAMIC_CONTENT_DEFAULT_FONT_SIZE = 9;
var DYNAMIC_CONTENT_DEFAULT_TEXT_COLOR = color.black;
var DYNAMIC_CONTENT_LINE_NUMBER = 20;
var EHL_IGNORE_FLATTEN = false; // Export-time property. Ignore flatten parameter of EHL to improve EHL appearance by the cost of slight discrepancy between PDF model and Master Model.
var EHL_SEGMENTS_RATIO = 1.0; // This property is export-time only. Decrease the number of EHL segments by this factor to improve performance and EHL appearance.
var HAS_DYNAMIC_CONTENT = true;
var HAS_ENHANCED_TOOLBAR = true;
var HAS_MENU = true;
var HAS_POPUPS = true;
var HAS_TITLE = true;
var HAS_TOOLBAR = true;
var HOTSPOT_COLOR = ['RGB', 247/255, 199/255, 67/255 ]; // Use 'null' not to change color of HOTSPOT_TEXTURE. Can't be changed at runtime
var HOTSPOT_KEEP_POPUP = false; // Keep hotspot's popup on the page after the mouse cursor moved off the hotspot
var HOTSPOT_RESCALING_POWER = 0.5; // 0.0 means hotspots are not rescaled, they will zoom-in/out accordingly to the entire model
// 0.5 means hotspots will become smaller and larger accordingly to the zoom level but not in the same degree as the entire model does
// 1.0 means hotspots will never change their visual size on the screen
var HOTSPOT_SCALE = 0.25; // Use this scale to change the initial hotspot size, generated according to the HOTSPOT_VISIBLE_RADIUS property
var HOTSPOT_TEXTURE = "HotspotTexture.png"; // Can't be changed at runtime
var HOTSPOT_TRANSPARENCY = 0.75; // 0.0 - entirely transparent, 1.0 - entirely opaque, null - use alpha channel of HOTSPOT_TEXTURE
var HOTSPOT_VISIBLE_RADIUS = 2.0; // Percent of the initial view's width. Can't be changed at runtime, use HOTSPOT_SCALE instead.
var IMAGE_MeasureButtonOff = "MeasureOff.png";
var IMAGE_MeasureButtonOn = "MeasureOn.png";
var IMAGE_MoveButtonOff = "MoveOff.png";
var IMAGE_MoveButtonOn = "MoveOn.png";
var IMAGE_PATH = "";
var IMAGE_ResetButton = "Reset.png";
var IMAGE_TurnButtonOff = "TurnOff.png";
var IMAGE_TurnButtonOn = "TurnOn.png";
var IMAGE_ZoomInButton = "ZoomIn.png";
var IMAGE_ZoomOutButton = "ZoomOut.png";
var MEASURE_BUTTON_INDEX = 1;
var MEASURE_TOOL_FONT = font.HelvB;
var MEASURE_TOOL_FONT_SIZE = 10;
var MEASURE_TOOL_TEXT_COLOR = color.blue;
var MENU_CONTROL_CLASS = ['AppControl','AppControlColor']; // This property is export-time only.
var MENU_CONTROL_IGNORE_SUBGROUPS = ['AppControlColor']; // This property is export-time only.
var MENU_FONT = font.HelvB; // font.Times, font.Helv, font.Cour with B(bold) and/or I(italics) suffices
var MENU_FONT_SIZE = 9; // Font size in points
var MENU_INNER_GAP = 0; // Distance between menu items
var MENU_ITEM_BGCOLOR = ['T'];
var MENU_ITEM_COLOR = ["RGB", 0.6, 0.6, 0.6 ];
var MENU_ITEM_COLOR_DISABLED = ["RGB", 220/255, 220/255, 220/255 ];
var MENU_ITEM_HEIGHT = 18;
var MENU_ITEM_HIGHLIGHT = highlight.n; // highlight.n - None, highlight.i - Inverse color, highlight.o - Outline, highlight.p - Push
var MENU_LEFT_GAP = 0; // Distance from the left edge of the page to the menu item
var MENU_ON_THE_LEFT = true; // Is menu on the left or right side of the page
var MENU_UPPER_GAP = 50; // Distance from the left upper corner of the 3D field to the first menu item
var MOVE_BUTTON_INDEX = 2;
var MOVE_RATE = 0.02; // Portion of the screen-width per click
var MSG_ALERT_MESSAGE_1 = 'This document requires Adobe Reader 7.0 or later. Please upgrade to the latest version.';
var MSG_ALERT_MESSAGE_2 = 'To interact with this 3D PDF, visit www.adobe.com and upgrade to Adobe Reader 7 for FREE!';
var MSG_CENTIMETERS = 'Centimeters';
var MSG_CLICK_AND_DRAG_TO_MEASURE = 'Click and Drag to Measure';
var MSG_HOTSPOTS = 'Hotspots';
var MSG_INCHES = 'Inches';
var MSG_MEASURE = 'Measure';
var MSG_MEASURE_IN_CENTIMETERS = 'Measure in Centimeters';
var MSG_MEASURE_IN_INCHES = 'Measure in Inches';
var MSG_MOVE = 'Move';
var MSG_RESET = 'Reset';
var MSG_TURN = 'Turn';
var MSG_ZOOM_IN = 'Zoom In';
var MSG_ZOOM_OUT = 'Zoom Out';
var POPUP_ALIGNMENT = 'center';
var POPUP_BGCOLOR = ['RGB', 250/255, 240/255, 128/255 ];
var POPUP_BORDER_COLOR = color.black;
var POPUP_BORDER_WIDTH = 1;
var POPUP_COUNT = 24;
var POPUP_FONT = font.Helv;
var POPUP_FONT_SIZE = 10; // If set to 0, font size will be selected automatically to fit text into the box, but this works only for plain texts, not for the rich text content
var POPUP_HEIGHT = 50;
var POPUP_TEXT_COLOR = color.black;
var POPUP_WIDTH = 120;
var ROTATION_RATE = 5; // Degrees per click.
var RT_10 = 'textSize = 10';
var RT_11 = 'textSize = 11';
var RT_12 = 'textSize = 12';
var RT_14 = 'textSize = 14';
var RT_16 = 'textSize = 16';
var RT_8 = 'textSize = 8';
var RT_9 = 'textSize = 9';
var RT_BLUE = 'textColor = color.blue';
var RT_BOLD = 'fontWeight = 700';
var RT_BULLET = '\u2022';
var RT_BULLET2 = '\u2022\n';
var RT_BULLET3 = '<indent><indent>\u2022';
var RT_CENTER = 'alignment="center"';
var RT_COPYRIGHT = '\00a9';
var RT_GREEN = 'textColor = color.green';
var RT_INDENT = 2;
var RT_ITALIC = 'fontStyle = "italic"';
var RT_LEFT = 'alignment="left"';
var RT_RED = 'textColor = color.red';
var RT_RIGHT = 'alignment="right"';
var RT_SUB = 'subscript=true';
var RT_SUP = 'superscript=true';
var RT_TM = '\u2122';
var SMOOTH_FADING = true; // Set this property to 'false' to improve performance of a heavily-textured models
var SMOOTH_FADING_MATERIALS_LIMIT = 8; // Don't apply smooth fading to objects having more than SMOOTH_FADING_MATERIALS_LIMIT materials to avoid performance degradation
var TITLE_ALIGNMENT = "center";
var TITLE_BGCOLOR = color.white;
var TITLE_COLOR = color.black;
var TITLE_CONTROL_CLASS = 'AppControlProductTitle';
var TITLE_FONT = font.HelvB;
var TITLE_FONT_SIZE = 0;
var TITLE_GAP = 10;
var TITLE_HEIGHT = 40;
var TOOLBAR_ICON_GAP = 0;
var TOOLBAR_ICON_HEIGHT = 36;
var TOOLBAR_ICON_WIDTH = 36;
var TURN_BUTTON_INDEX = 3;
var properReaderVersion = true;
var alertMessageName = "Alert Message";
var alertMessage = null;
var MSG_ALERT_MESSAGE_1 = "This document requires Adobe Reader 7.0 or later. Please upgrade to the latest version.";
var MSG_ALERT_MESSAGE_2 = "To interact with this 3D PDF, visit www.adobe.com and upgrade to Adobe Reader 7 for FREE!";
var VIEWER_TYPE = app.viewerType;
var POPULATE_FIELDS = true;
var CREATE_TEMPLATE_PDF = false;
var IN_TEMPLATE = false;
var FIRST_RUN_FLAG = true;
var upperLeftCornerX, upperLeftCornerY, lowerRightCornerX, lowerRightCornerY, toolbarButtonX, toolbarButtonY;
var menuItemX, menuItemY, menuItemWidth, menuItemHeight;
var toolbar = new Array(6);
var interval;
var annotation = null;
var annotationX = null;
var currentAnnotIndex = -1;
var currentAnnotID = "";
var pageNo;
var colr = null;
var menuItems = new Array();
var menuItemTextFields = new Array();
var menuItemNames = new Array();
var menuItemsCreated = false;
var currentItemNo;
var measurement = null;
var isRunning = false;
var RICH_CONTENT = new Array();
var dynamicContentPopulated = false;
var parametersSet = false;
var FPS = null;
var oldFPS = 0;
if ( app.viewerVersion != undefined && app.viewerVersion<7.0 )
{
properReaderVersion = false;
app.alert(MSG_ALERT_MESSAGE_1);
if ( app.viewerVersion>=6.0 )
app.execMenuItem("Updates");
else
app.execMenuItem("AdobeOnline");
}
if ( !properReaderVersion )
{
for( j=0; j<this.numFields; j++)
{
var fieldName = this.getNthFieldName(j);
if ( fieldName!="" && fieldName!=alertMessageName)
{
var field = this.getField(fieldName);
field.hidden = true;
}
}
alertMessage = this.getField(alertMessageName);
alertMessage.hidden = false;
}
if ( properReaderVersion )
{
for( pageNo=0; pageNo<this.numPages; pageNo++)
if ( this.getAnnots3D( pageNo )!= null ) break;
app.execMenuItem("ActualSize");
interval = app.setInterval("try { poll(); } catch(error) { }", 100);
FIRST_RUN_FLAG = (this.getField("ChangeLock")==null);
if ( FIRST_RUN_FLAG && VIEWER_TYPE!="Reader" )
{
var changeLockFlag = this.addField({
nPageNum:pageNo,
cName:"ChangeLock",
cFieldType:"text",
oCoords:[ 0, 1, 1, 0 ],
});
changeLockFlag.readOnly = true;
changeLockFlag.display = display.hidden;
}
}
function poll()
{
if (this.pageNum != pageNo) return;
isRunning = true;
var c3d = this.getAnnots3D( pageNo )[ 0 ].context3D;
if ( c3d != undefined )
{
if ( c3d.MESSAGE!=null )
{
app.alert(c3d.MESSAGE);
c3d.MESSAGE = null;
}
if ( !parametersSet )
{
c3d.ROTATION_RATE = ROTATION_RATE;
c3d.MOVE_RATE = MOVE_RATE;
c3d.MSG_RESET = MSG_RESET;
c3d.HOTSPOT_VISIBLE_RADIUS = HOTSPOT_VISIBLE_RADIUS;
c3d.HOTSPOT_RESCALING_POWER = HOTSPOT_RESCALING_POWER;
c3d.HOTSPOT_SCALE = HOTSPOT_SCALE;
c3d.SMOOTH_FADING = SMOOTH_FADING;
c3d.SMOOTH_FADING_MATERIALS_LIMIT = SMOOTH_FADING_MATERIALS_LIMIT;
c3d.HOTSPOT_KEEP_POPUP = HOTSPOT_KEEP_POPUP;
FPS = this.getField("FPS");
parametersSet = true;
}
if ( FPS!=null && c3d.FPS!=oldFPS )
{
FPS.value = "FPS "+c3d.FPS;
oldFPS = c3d.FPS;
}
if ( !menuItemsCreated )
createMenuItems();
if ( !dynamicContentPopulated )
populateDynamicContent();
// Tooltips can change according to the current model conditions
if ( c3d.REFRESH_TOOLTIPS )
{
for( j=0; j<currentItemNo; j++)
{
var tooltip = this.getAnnots3D( pageNo )[ 0 ].context3D.getCurrentTooltip( j+1 );
if ( tooltip!=undefined && tooltip!="" )
{
menuItems[j].userName = tooltip; // Sic! userName should be used to set tooltip
if ( menuItemTextFields[j]!=null )
menuItemTextFields[j].textColor = menuItems[j].textColor;
}
else
{
menuItems[j].userName = "";
if ( menuItemTextFields[j]!=null )
{
menuItemTextFields[j].textColor = MENU_ITEM_COLOR_DISABLED;
}
}
}
c3d.REFRESH_TOOLTIPS = false;
}
if ( colr==null ) initColor();
if ( HAS_TITLE) initTitle();
if ( annotation==null ) initAnnot();
if ( alertMessage==null ) initAlert();
if ( HAS_POPUPS && c3d.SHOW_ANNOTATION && (currentAnnotIndex==-1 || currentAnnotIndex!=c3d.ANNOTATION_INDEX))
{
if (currentAnnotIndex!=-1 && annotation[currentAnnotIndex]!=null )
annotation[currentAnnotIndex].display = display.hidden;
currentAnnotIndex = c3d.ANNOTATION_INDEX;
if ( currentAnnotIndex < 0 ) currentAnnotIndex = 0; // Index is undefined, use the first popup
currentAnnotIndex = currentAnnotIndex % POPUP_COUNT;
if ( annotation[currentAnnotIndex]==null )
app.alert("Popup Field not found");
else
{
if ( c3d.ANNOTATION_RICH_CONTENTS==undefined || c3d.ANNOTATION_RICH_CONTENTS=="" )
{
annotation[currentAnnotIndex].value = getStringValue(c3d); // Probably is a Unicode string
}
else
{
var richContent = getRichContent(c3d.ANNOTATION_ID, true);
annotation[currentAnnotIndex].richText = true;
annotation[currentAnnotIndex].richValue = richContent;
}
currentAnnotID = c3d.ANNOTATION_ID;
if ( c3d.ANNOTATION_SCRIPT!=null )
{
annotation[currentAnnotIndex].action = "c3d.startScript('"+c3d.ANNOTATION_SCRIPT+"');";
}
annotation[currentAnnotIndex].display = display.noPrint;
}
}
if ( HAS_POPUPS && !c3d.SHOW_ANNOTATION && currentAnnotIndex != -1)
{
if ( annotation[currentAnnotIndex]!=null )
annotation[currentAnnotIndex].display = display.hidden;
currentAnnotIndex = -1;
currentAnnotID = "";
}
if ( c3d.LAUNCH_URL!=null )
{
app.launchURL( c3d.LAUNCH_URL );
c3d.LAUNCH_URL = null;
}
if ( c3d.FPS_AVERAGE != null )
{
app.alert("Average FPS for the recent "+c3d.FPS_PERIOD+" seconds is "+c3d.FPS_AVERAGE);
c3d.FPS_AVERAGE = null;
}
if ( c3d.SWITCH_TO_ROTATE_MODE )
{
if ( toolbar[TURN_BUTTON_INDEX]!=undefined )
toolbar[TURN_BUTTON_INDEX].press();
c3d.SWITCH_TO_ROTATE_MODE = false;
}
if ( measurement!=null )
if ( c3d.CURRENT_MEASUREMENT != "" )
{
var dist = c3d.CURRENT_MEASUREMENT;
if ( isNaN(dist) )
measurement.value = c3d.CURRENT_MEASUREMENT;
else
{
if ( c3d.MEASUREMENT_UNIT=="inch" )
{
dist /= 25.41;
dist = Math.round( dist*10 )/10;
measurement.value = dist+" "+MSG_INCHES;
}
if ( c3d.MEASUREMENT_UNIT=="centimeter" )
{
dist /= 10;
dist = Math.round( dist*10 )/10;
measurement.value = dist+" "+MSG_CENTIMETERS;
}
}
measurement.display = display.noPrint;
}
else
{
measurement.display = display.hidden;
}
}
}
function initColor()
{
var c3d = this.getAnnots3D( pageNo )[ 0 ].context3D;
colr = color.convert( BGCOLOR_3D, "RGB" );
c3d.__DEFAULT_BGR_COLOR_R__ = colr[1]; // red
c3d.__DEFAULT_BGR_COLOR_G__ = colr[2]; // green
c3d.__DEFAULT_BGR_COLOR_B__ = colr[3]; // blue
c3d.SET_BGCOLOR = true;
}
function initAnnot()
{
if ( !HAS_POPUPS ) return;
if ( POPUP_COUNT<=0 ) return;
var c3d = this.getAnnots3D( pageNo )[ 0 ].context3D;
if ( !IN_TEMPLATE && !CREATE_TEMPLATE_PDF )
POPUP_COUNT = c3d.HOTSPOT_COUNT;
var x0 = this.getAnnots3D( pageNo )[ 0 ].rect[0];
var y0 = this.getAnnots3D( pageNo )[ 0 ].rect[1];
var x1 = this.getAnnots3D( pageNo )[ 0 ].rect[2];
var step;
var x;
if ( POPUP_COUNT==1 )
{
x = x1-POPUP_WIDTH;
step = 0;
}
else
{
step = (x1-x0-POPUP_WIDTH)/(POPUP_COUNT-1);
x = x0;
}
annotation = new Array(POPUP_COUNT);
annotationX = new Array(POPUP_COUNT);
for( j=0; j<POPUP_COUNT; j++)
{
var isNewField = IN_TEMPLATE;
var popupName = "Popup_"+j;
var ann = this.getField(popupName);
if ( ann == null && VIEWER_TYPE!="Reader" && FIRST_RUN_FLAG )
{
ann = this.addField({
nPageNum:pageNo,
cName:popupName,
cFieldType:"text",
oCoords:[ x, y0+POPUP_HEIGHT, x+POPUP_WIDTH, y0 ],
});
isNewField = true;
}
if ( isNewField && ann!=null )
{
ann.fillColor = POPUP_BGCOLOR;
ann.textSize = POPUP_FONT_SIZE; // Font size in points
ann.textFont = POPUP_FONT;
ann.readonly = true;
ann.multiline = true;
ann.lineWidth = POPUP_BORDER_WIDTH; // Border width
ann.strokeColor = POPUP_BORDER_COLOR;
ann.alignment = POPUP_ALIGNMENT;
ann.textColor = POPUP_TEXT_COLOR;
}
if ( ann!=null )
ann.display = display.hidden;
annotation[j] = ann;
annotationX[j] = ((x-x0)+(POPUP_WIDTH/2))/(x1-x0);
x+=step;
}
}
function initAlert()
{
var isNewField = IN_TEMPLATE;
alertMessage = this.getField(alertMessageName);
var c3d = this.getAnnots3D( pageNo )[ 0 ].context3D;
if ( alertMessage == null && VIEWER_TYPE!="Reader" && FIRST_RUN_FLAG )
{
var x0 = this.getAnnots3D( pageNo )[ 0 ].rect[0];
var y0 = this.getAnnots3D( pageNo )[ 0 ].rect[3];
var x1 = this.getAnnots3D( pageNo )[ 0 ].rect[2];
var y1 = y0-40;
alertMessage = this.addField({
nPageNum:pageNo,
cName:alertMessageName,
cFieldType:"text",
oCoords:[ x0, y0, x1, y1 ],
});
isNewField = true;
}
if ( alertMessage==null ) return;
if ( isNewField )
{
alertMessage.textColor = color.red;
alertMessage.fillColor = color.yellow;
alertMessage.textSize = 12;
alertMessage.textFont = font.HelvB;
alertMessage.readonly = true;
alertMessage.multiline = true;
alertMessage.hidden = true;
}
alertMessage.value=MSG_ALERT_MESSAGE_2;
}
function initTitle()
{
var isNewField = IN_TEMPLATE;
if ( HAS_TITLE )
{
var c3d = this.getAnnots3D( pageNo )[ 0 ].context3D;
var titleField = this.getField("Model Title");
if ( titleField == null && VIEWER_TYPE!="Reader" && FIRST_RUN_FLAG )
{
var x0 = this.getAnnots3D( pageNo )[ 0 ].rect[0];
var y0 = this.getAnnots3D( pageNo )[ 0 ].rect[1];
var x1 = this.getAnnots3D( pageNo )[ 0 ].rect[2];
titleField = this.addField({
nPageNum:pageNo,
cName:"Model Title",
cFieldType:"text",
oCoords:[ x0, y0+TITLE_HEIGHT+TITLE_GAP, x1, y0+TITLE_GAP ],
});
isNewField = true;
}
if ( titleField==null ) return; // VIEWER_TYPE==="Reader" and there is no "Model Title" field in the document
if ( isNewField )
{
titleField.fillColor = TITLE_BGCOLOR;
titleField.textColor = TITLE_COLOR;
titleField.textSize = TITLE_FONT_SIZE; // Font size in points
titleField.textFont = TITLE_FONT;
titleField.readonly = true;
titleField.multiline = true;
titleField.lineWidth = 0;
if ( CREATE_TEMPLATE_PDF )
titleField.display = display.hidden;
else
titleField.display = display.visible;
titleField.alignment = TITLE_ALIGNMENT;
}
c3d.getProductTitle();
titleField.value = getStringValue(c3d);
HAS_TITLE = false;
}
}
function initMeasurement()
{
if ( !HAS_TOOLBAR ) return;
var isNewField = IN_TEMPLATE;
var x0 = toolbarButtonX;
var y0 = toolbarButtonY - TOOLBAR_ICON_HEIGHT*3/4;
var annotName = "Display Measurement";
var hideName = annotName+"_hide";
measurement = this.getField(annotName);
if ( VIEWER_TYPE!="Reader" && measurement==null && FIRST_RUN_FLAG )
{
measurement = this.addField({
nPageNum:pageNo,
cName:annotName,
cFieldType:"text",
oCoords:[ x0, y0+20, x0+130, y0 ],
});
overMeasurement = this.addField({ // This field is necessary only to hide the text field from user changes
nPageNum:pageNo,
cName:hideName,
cFieldType:"button",
oCoords:[ x0, y0+20, x0+130, y0 ],
});
isNewField = true;
}
if ( isNewField )
{
overMeasurement.fillColor = ["T"];
overMeasurement.highlight = highlight.n;
measurement.fillColor = [ "T" ];
measurement.textColor = MEASURE_TOOL_TEXT_COLOR;
measurement.textSize = MEASURE_TOOL_FONT_SIZE; // Font size in points
measurement.textFont = MEASURE_TOOL_FONT;
measurement.multiline = false;
measurement.lineWidth = 1; // Border width
measurement.alignment = "left";
measurement.display = display.hidden;
}
}
function startMenuItems()
{
upperLeftCornerX = this.getAnnots3D( pageNo )[ 0 ].rect[0];
upperLeftCornerY = this.getAnnots3D( pageNo )[ 0 ].rect[1];
menuItemY = upperLeftCornerY - MENU_UPPER_GAP;
menuItemHeight = Math.max( MENU_ITEM_HEIGHT, MENU_FONT_SIZE + 6 );
if ( MENU_ON_THE_LEFT )
{
menuItemX = MENU_LEFT_GAP;
menuItemWidth = upperLeftCornerX - MENU_LEFT_GAP;
}
else
{
lowerRightCornerX = this.getAnnots3D( pageNo )[ 0 ].rect[2];
pageWidth = this.getPageBox()[2];
menuItemX = lowerRightCornerX+MENU_LEFT_GAP;
menuItemWidth = pageWidth - lowerRightCornerX - MENU_LEFT_GAP;
}
currentItemNo = 0;
}
function createTemplateMenu( n )
{
for( j=0; j<n; j++ )
addMenuItem( j, "Control_"+j, false);
}
function addMenuItem( j, menuItem, visible )
{
POPULATE_FIELDS = IN_TEMPLATE;
if ( !HAS_MENU ) return;
var linkName = "Control_"+currentItemNo;
var itemName = linkName+"_text";
var bulletName = linkName+"_bullet";
var item = this.getField( itemName );
var link = this.getField( linkName );
var bullet = this.getField( bulletName );
if ( link==null && VIEWER_TYPE!="Reader" && FIRST_RUN_FLAG )
{
if ( item!=null )
this.removeField(itemName);
if ( bullet!=null )
this.removeField(bulletName);
var bulletRect = [ menuItemX, menuItemY, menuItemX+menuItemHeight, menuItemY-menuItemHeight ];
var rect = [ menuItemX+menuItemHeight, menuItemY, menuItemX+menuItemWidth, menuItemY-menuItemHeight ];
var linkRect = [ menuItemX, menuItemY, menuItemX+menuItemWidth, menuItemY-menuItemHeight ];
bullet = this.addField({
nPageNum:pageNo,
cName:bulletName,
cFieldType:"text",
oCoords:bulletRect,
});
item = this.addField({
nPageNum:pageNo,
cName:itemName,
cFieldType:"text",
oCoords:rect,
});
link = this.addField({
nPageNum:pageNo,
cName:linkName,
cFieldType:"button",
oCoords:linkRect,
});
POPULATE_FIELDS = true;
}
if ( POPULATE_FIELDS )
{
if ( item!=null )
{
if ( visible )
item.value = menuItem;
item.fillColor = MENU_ITEM_BGCOLOR;
item.textColor = MENU_ITEM_COLOR;
item.textSize = MENU_FONT_SIZE;
item.textFont = MENU_FONT;
item.fillColor = ["T"];
item.readonly = true;
item.multiline = true;
item.lineWidth = 0; // Border width
item.display = display.noPrint;
}
if ( link!=null )
{
var action = "execMenuItem("+j+");";
link.setAction("MouseUp", action);
link.fillColor = ["T"];
link.textColor = MENU_ITEM_COLOR;
link.highlight = MENU_ITEM_HIGHLIGHT;
}
if ( bullet!=null )
{
bullet.fillColor = ["T"];
bullet.value = BULLET_CHARACTER;
bullet.textColor = BULLET_COLOR;
bullet.textSize = MENU_FONT_SIZE+8;
bullet.readonly = true;
if ( visible )
bullet.display = display.noPrint;
else
bullet.display = display.hidden;
}
}
menuItems[currentItemNo] = link;
menuItemTextFields[currentItemNo] = item;
menuItemNames[currentItemNo] = menuItem;
menuItemY -= menuItemHeight + MENU_INNER_GAP;
currentItemNo++;
}
function createMenuItems()
{
var c3d = this.getAnnots3D( pageNo )[ 0 ].context3D;
var n = c3d.getMenuCount()
for( j=1; j<n; j++) // Skip the first Reset menu item
{
c3d.getMenuItem(j);
var item = getStringValue(c3d);
addMenuItem( j, item, true);
}
menuItemsCreated = true;
}
function createToolbar()
{
lowerRightCornerX = this.getAnnots3D( pageNo )[ 0 ].rect[2];
lowerRightCornerY = this.getAnnots3D( pageNo )[ 0 ].rect[3];
toolbarButtonY = lowerRightCornerY-3;
toolbarButtonX = (lowerRightCornerX+upperLeftCornerX)/2 - toolbar.length/2*(TOOLBAR_ICON_WIDTH + TOOLBAR_ICON_GAP);
var n = 0;
toolbar[n] = new ToolbarButton( this, n, "ResetButton", MSG_RESET, false,
"this.doc.getAnnots3D( "+pageNo+" )[ 0 ].context3D.resetUnconditionally();", 1 );
n++;
toolbar[n] = new ToolbarButton( this, n, "MeasureButton", MSG_MEASURE, true, "", 1 );
n++;
toolbar[n] = new ToolbarButton( this, n, "MoveButton", MSG_MOVE, true,
"this.doc.getAnnots3D( "+pageNo+" )[ 0 ].context3D.setCurrentTool('Pan');", 1 );
n++;
toolbar[n] = new ToolbarButton( this, n, "TurnButton", MSG_TURN, true,
"this.doc.getAnnots3D( "+pageNo+" )[ 0 ].context3D.setCurrentTool('Rotate');", 1 );
n++;
toolbar[n] = new ToolbarButton( this, n, "ZoomOutButton", MSG_ZOOM_OUT, false,
"this.doc.getAnnots3D( "+pageNo+" )[ 0 ].context3D.zoomOut();", 113/245 );
n++;
toolbar[n] = new ToolbarButton( this, n, "ZoomInButton", MSG_ZOOM_IN, false,
"this.doc.getAnnots3D( "+pageNo+" )[ 0 ].context3D.zoomIn();", 132/245 );
n++;
toolbar[TURN_BUTTON_INDEX].press(); // Turn button is ON by default
initMeasurement();
}
function ToolbarButton( doc, n, name, tooltip, switchIcon, actionOnPress, widthFactor )
{
var loadIcon = false;
this.doc = doc;
this.n = n;
this.name = name;
this.tooltip = tooltip;
this.switchIcon = switchIcon;
this.actionOnPress = actionOnPress;
var nameOn = name+"On";
this.button = doc.getField( name );
this.buttonOn = doc.getField( nameOn );
if ( VIEWER_TYPE=="Reader" ) return;
if ( this.button==null && VIEWER_TYPE!="Reader" && FIRST_RUN_FLAG )
{
if ( this.buttonOn!=null )
{
this.doc.removeField(nameOn);
this.buttonOn = null;
}
var rect = [ toolbarButtonX, toolbarButtonY,
toolbarButtonX+TOOLBAR_ICON_WIDTH*widthFactor, toolbarButtonY-TOOLBAR_ICON_HEIGHT ];
var path = eval("IMAGE_PATH");
this.button = doc.addField({
nPageNum:pageNo,
cName:name,
cFieldType:"button",
oCoords:rect,
});
if ( switchIcon )
this.buttonOn = doc.addField({
nPageNum:pageNo,
cName:nameOn,
cFieldType:"button",
oCoords:rect,
});
if ( switchIcon )
{
this.button.buttonImportIcon( path+eval("IMAGE_"+name+"Off") );
this.buttonOn.buttonImportIcon( path+eval("IMAGE_"+name+"On") );
}
else
{
this.button.buttonImportIcon( path+eval("IMAGE_"+name));
}
if ( HAS_ENHANCED_TOOLBAR )
{
if ( n==MOVE_BUTTON_INDEX )
createMoveMiniButtons( rect );
if ( n==TURN_BUTTON_INDEX )
createTurnMiniButtons( rect );
}
}
else
if ( this.button==null ) return;
var action = "toolbar["+n+"].press();"
this.button.lineWidth = 0; // Border width
this.button.highlight = highlight.n;
this.button.userName = tooltip;
this.button.buttonPosition = position.iconOnly;
this.button.buttonScaleHow = scaleHow.anamorphic;
this.button.buttonFitBounds = true;
this.button.strokeColor = ["T"];
this.button.setAction("MouseUp", action);
this.button.display = display.noPrint;
if ( HAS_ENHANCED_TOOLBAR )
{
if ( n==MOVE_BUTTON_INDEX )
{
this.doc.setButtonTooltip("Move Up",MSG_MOVE);
this.doc.setButtonTooltip("Move Right",MSG_MOVE);
this.doc.setButtonTooltip("Move Down",MSG_MOVE);
this.doc.setButtonTooltip("Move Left",MSG_MOVE);
}
if ( n==TURN_BUTTON_INDEX )
{
this.doc.setButtonTooltip("Turn Up",MSG_TURN);
this.doc.setButtonTooltip("Turn Right",MSG_TURN);
this.doc.setButtonTooltip("Turn Down",MSG_TURN);
this.doc.setButtonTooltip("Turn Left",MSG_TURN);
}
}
if ( switchIcon )
{
this.buttonOn.lineWidth = 0; // Border width
this.buttonOn.highlight = highlight.n;
this.buttonOn.userName = tooltip;
this.buttonOn.buttonPosition = position.iconOnly;
this.buttonOn.buttonScaleHow = scaleHow.anamorphic;
this.buttonOn.buttonFitBounds = true;
this.buttonOn.strokeColor = ["T"];
this.buttonOn.setAction("MouseUp", action);
this.buttonOn.display = display.hidden;
}
if ( widthFactor==1.0 )
toolbarButtonX += TOOLBAR_ICON_WIDTH + TOOLBAR_ICON_GAP;
else
toolbarButtonX += TOOLBAR_ICON_WIDTH*widthFactor;
}
ToolbarButton.prototype.press = function()
{
if ( isRunning && !this.doc.getAnnots3D( pageNo )[ 0 ].activated )
this.doc.getAnnots3D( pageNo )[ 0 ].activated = true;
var c3d = this.doc.getAnnots3D( pageNo )[ 0 ].context3D;
if ( this.switchIcon )
{
for( j=0; j<toolbar.length; j++)
if ( j!=this.n )
toolbar[j].setState( false );
this.setState(true);
if ( c3d!=undefined )
c3d.setMeasureMode( this.n==MEASURE_BUTTON_INDEX, !c3d.SWITCH_TO_ROTATE_MODE );
}
else
{
if ( c3d.isMeasureMode() && this.n!=MEASURE_BUTTON_INDEX) // Zoom-in/out pressed while in Measure mode
{
toolbar[TURN_BUTTON_INDEX].press(); // Switch to rotate mode
}
}
try
{
eval( this.actionOnPress );
}
catch( exception ) {};
}
ToolbarButton.prototype.setState = function( state )
{
if ( this.switchIcon && this.button!=null && this.buttonOn!=null )
{
if ( state )
{
this.buttonOn.display = display.noPrint;
this.button.display = display.hidden;
}
else
{
this.buttonOn.display = display.hidden;
this.button.display = display.noPrint;
}
}
}
function setButtonTooltip( name, tooltip )
{
var button = this.getField(name);
if ( button!=null )
button.userName = tooltip;
}
function createTurnMiniButtons( rect )
{
var step = ROTATION_RATE;
var x0 = rect[0];
var y0 = rect[1];
var x1 = rect[2];
var y1 = rect[3];
var w = rect[2]-rect[0];
var h = rect[1]-rect[3];
var dx = w/3;
var dy = h/3;
var rect = [x0+dx, y0, x0+2*dx, y0-dy];
createTurnMiniButton( rect, "Turn Up", MSG_TURN, "0,ROTATION_RATE" );
rect = [x0+2*dx, y0-dy, x1, y0-2*dy];
createTurnMiniButton( rect, "Turn Right", MSG_TURN, "-ROTATION_RATE,0" );
rect = [x0+dx, y0-2*dy, x0+2*dx, y1];
createTurnMiniButton( rect, "Turn Down", MSG_TURN, "0,-ROTATION_RATE" );
rect = [x0, y0-dy, x0+dx, y0-2*dy];
createTurnMiniButton( rect, "Turn Left", MSG_TURN, "ROTATION_RATE,0" );
}
function createTurnMiniButton( rect, name, tooltip, angles )
{
var mini = this.addField({
nPageNum:pageNo,
cName:name,
cFieldType:"button",
oCoords:rect,
});
mini.lineWidth = 0; // Border width
mini.highlight = highlight.n;
mini.userName = tooltip;
mini.strokeColor = ["T"];
mini.fillColor = ["T"];
mini.setAction("MouseUp", "rotateView("+angles+")" );
mini.display = display.noPrint;
}
function rotateView( dTheta, dPhi )
{
this.getAnnots3D( pageNo )[ 0 ].context3D.deleteMeasuringCursors();
this.getAnnots3D( pageNo )[ 0 ].context3D.rotateView(dTheta,dPhi);
toolbar[TURN_BUTTON_INDEX].press();
}
function createMoveMiniButtons( rect )
{
var x0 = rect[0];
var y0 = rect[1];
var x1 = rect[2];
var y1 = rect[3];
var w = rect[2]-rect[0];
var h = rect[1]-rect[3];
var dx = w/3;
var dy = h/3;
var rect = [x0+dx, y0, x0+2*dx, y0-dy];
createMoveMiniButton( rect, "Move Up", MSG_MOVE, "0,-MOVE_RATE" );
rect = [x0+2*dx, y0-dy, x1, y0-2*dy];
createMoveMiniButton( rect, "Move Right", MSG_MOVE, "MOVE_RATE,0" );
rect = [x0+dx, y0-2*dy, x0+2*dx, y1];
createMoveMiniButton( rect, "Move Down", MSG_MOVE, "0,MOVE_RATE" );
rect = [x0, y0-dy, x0+dx, y0-2*dy];
createMoveMiniButton( rect, "Move Left", MSG_MOVE, "-MOVE_RATE,0" );
}
function createMoveMiniButton( rect, name, tooltip, steps )
{
var mini = this.addField({
nPageNum:pageNo,
cName:name,
cFieldType:"button",
oCoords:rect,
});
mini.lineWidth = 0; // Border width
mini.highlight = highlight.n;
mini.userName = tooltip;
mini.strokeColor = ["T"];
mini.fillColor = ["T"];
mini.setAction("MouseUp", "moveView("+steps+")" );
mini.display = display.noPrint;
}
function moveView( cx, cy )
{
this.getAnnots3D( pageNo )[ 0 ].context3D.deleteMeasuringCursors();
this.getAnnots3D( pageNo )[ 0 ].context3D.moveView(cx,cy);
toolbar[MOVE_BUTTON_INDEX].press();
}
function execMenuItem( name )
{
if ( isRunning && !this.getAnnots3D( pageNo )[ 0 ].activated )
this.getAnnots3D( pageNo )[ 0 ].activated = true;
this.getAnnots3D( pageNo )[ 0 ].context3D.execMenuItem(name);
}
if ( properReaderVersion )
{
startMenuItems();
if ( HAS_TOOLBAR ) createToolbar();
}
function getRichContent( id, popup )
{
var richContent = RICH_CONTENT[id];
if ( richContent!=undefined ) return richContent;
var c3d = this.getAnnots3D( pageNo )[ 0 ].context3D;
var spans = new Array();
var nSpans = c3d.getSpanCount(id);
for( j=0; j<nSpans; j++)
{
var span = new Object();
c3d.getSpanText( id, j );
span.text = getStringValue(c3d);
if ( popup!=undefined )
if ( popup )
{
span.alignment = POPUP_ALIGNMENT;
span.textColor = POPUP_TEXT_COLOR;
span.textSize = POPUP_FONT_SIZE;
}
else
{
span.alignment = eval("DYNAMIC_CONTENT_DEFAULT_ALIGNMENT");
span.textColor = eval("DYNAMIC_CONTENT_DEFAULT_TEXT_COLOR");
span.textSize = eval("DYNAMIC_CONTENT_DEFAULT_FONT_SIZE");
span.fontFamily = eval("DYNAMIC_CONTENT_DEFAULT_FONT");
}
var nTags = c3d.getSpanTagCount( id, j );
for( l=0; l<nTags; l++)
{
var tag = c3d.getSpanTag( id, j, l );
var prop = "RT_"+tag;
prop = prop.toUpperCase();
var propValue = "";
try
{
propValue = eval(prop);
}
catch ( exception ) { propValue = "undefined" };
if ( propValue=="undefined" )
span.text= tag + span.text;
else
{
var indentString = "";
while ( propValue.indexOf("<indent>")==0 ) // Starts with <indent>
{
var indent = eval("RT_INDENT");
if ( indent!=undefined )
for( sp=0; sp<indent; sp++)
indentString = " "+indentString;
propValue = propValue.substring(8);
}
if ( propValue.length<=2 ) // Just single Unicode character or two Unicode characters
{
if ( propValue.length==1 ) // Just single Unicode character
span.text = indentString + propValue+span.text;
else
span.text = indentString + propValue.charAt(0)+span.text+propValue.charAt(1);
}
else
{
eval( "span."+propValue );
}
}
}
spans[j] = span;
…
|
|||
stream_017_off00031d33.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x31D33 | 3483796 bytes |
SHA-256: a133af4b6c7eb944d20cde8767a2f52614bdb99f634c899c40bcfa1a394101bd |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact entropy is 7.89, consistent with packed or encrypted content.
|
|||
stream_018_off003716cf.js |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x3716CF | 183165 bytes |
SHA-256: 158bc21beca179b053859ad68b3f3871cc453e92f6a59c1aeb265f6ccc438105 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 eval/decoder/string-building token(s).
|
|||
icc_00_off00017aef.icc |
pdf-icc-profile | PDF ICC profile at offset 0x17AEF | 1320 bytes |
SHA-256: eb03db58ff1f226c83103a11f30b5520f9b68a7ced67daa78992723e3ea0411d |
|||
font_00_sfnt_off003c1ecb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3C1ECB | 9492 bytes |
SHA-256: 7307777da81d29c36edd40a7e2dcbf3a15c424105bcdc7150326b8ad0af32b9f |
|||
font_01_sfnt_off003c3bda.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3C3BDA | 18648 bytes |
SHA-256: 9175d2b1ce7d962926886c0ac7257180d26dde00afd2162e5d8d90eddeb37922 |
|||
font_02_sfnt_off003c72cb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3C72CB | 5508 bytes |
SHA-256: bdfc52e5de4276079aa65fa1f371e97602136fd6f67d9b4fc8c7882ec8d132b3 |
|||
font_03_sfnt_off003c83a2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3C83A2 | 47220 bytes |
SHA-256: 4280f5aefab702c09911b90430f1167ce26361d55d5192a40539b1da0837bc5f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.