MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file is encrypted and contains JavaScript, indicating an attempt to obscure malicious content. The presence of CCITTFaxDecode related heuristics suggests exploitation of CVE-2010-0188 or a similar vulnerability. The document also contains elements of a fake invoice lure, commonly used to trick users into opening malicious attachments or clicking on links.
Machine Learning
- Nyx PDF Classifier malicious score 0.8394
Heuristics 5
-
JavaScript action low 2 related findings PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTERPDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JSPDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
-
AcroForm button with action trigger low PDF_ACROFORM_BUTTONPDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
Extracted artifacts 32
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
javascript_obj0320_001.js |
pdf-javascript-stream | PDF /JS object 320 at offset 0x14882 | 92 bytes |
SHA-256: 1df775bf985700cf126fe29ed88c94718b4f53896c7e8f74931667d45d4c090e |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(this.dirty){
getField('printlid').display = display.noView;
}
DoCalc();
|
|||
javascript_obj0323_004.js |
pdf-javascript-stream | PDF /JS object 323 at offset 0x149A4 | 64 bytes |
SHA-256: e7bae9be639676411fe5bcf4f65c25e2fd5e5524a379b7805feec663e6e79acd |
|||
Preview scriptFirst 1,000 lines of the extracted script
event.value=GPF(event.value,3) CheckLength(event.value,9) |
|||
javascript_obj0356_008.js |
pdf-javascript-stream | PDF /JS object 356 at offset 0x151C7 | 39 bytes |
SHA-256: a38c01daa8a2de78b2151ee01d1c69e81170452d881008dd1b45953b3c94a808 |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Format(0, 0, 0, 0, "", false); |
|||
javascript_obj0358_009.js |
pdf-javascript-stream | PDF /JS object 358 at offset 0x15258 | 42 bytes |
SHA-256: bf6e5cec6b360b670b6bd2c73336d76c35e5f2336d421386785389d70cf8237a |
|||
Preview scriptFirst 1,000 lines of the extracted script
AFNumber_Keystroke(0, 0, 0, 0, "", false); |
|||
javascript_obj0420_013.js |
pdf-javascript-stream | PDF /JS object 420 at offset 0x17136 | 100 bytes |
SHA-256: 34d2cdade289137c31b02c31ca8e9eac33bdd4c79a69294d9a864ce54f0d2d7b |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.value!="")event.value=Math.round(event.value) if(event.value=="NaN")event.value = "" |
|||
javascript_obj0424_014.js |
pdf-javascript-stream | PDF /JS object 424 at offset 0x1728E | 56 bytes |
SHA-256: 057613f95bc2a75cbd80e507807b79f2236af14d2cade23a1099a9f7007173fb |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.value!="")event.value=Math.round(event.value) |
|||
javascript_obj0471_017.js |
pdf-javascript-stream | PDF /JS object 471 at offset 0x17ED6 | 98 bytes |
SHA-256: 9f827be7af30adbb2fc2d5ee9e3e422fbc77cf6a204f6578f3d4f5e862a28141 |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.value!="")event.value=Math.round(event.value) if(event.value=="NaN")event.value = "" |
|||
javascript_obj0761_019.js |
pdf-javascript-stream | PDF /JS object 761 at offset 0x1CFCF | 82 bytes |
SHA-256: 232ec797ff29ad7a4e63c81def437244af84bb91345d362bb0938fa4fcff87ff |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.value!="")event.value = util.printx("999 999 9999",event.value)
|
|||
javascript_obj0764_020.js |
pdf-javascript-stream | PDF /JS object 764 at offset 0x1D0E6 | 136 bytes |
SHA-256: ce0d3ac93e44d7f195af21a8f0cfed50cd14bd9afebfc6dc2546d900aef9bb45 |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.value!=""){
if(event.value.replace("-","").length!=10){
app.alert("Please enter 10 digits")
event.rc = false
}
}
|
|||
javascript_obj0838_023.js |
pdf-javascript-stream | PDF /JS object 838 at offset 0x1F080 | 151 bytes |
SHA-256: 5945a9989c3f2d05668d9f1bd54f455df6724a9d0fd5678ad3c09f12f43306c7 |
|||
Preview scriptFirst 1,000 lines of the extracted script
CheckLength(event.value,9)
if(event.value!=""){
event.target.fillColor = color.white
}else{
event.target.fillColor = color.transparent
}
|
|||
javascript_obj0842_024.js |
pdf-javascript-stream | PDF /JS object 842 at offset 0x1F219 | 153 bytes |
SHA-256: 2edebca30dc0ae7d5998d514eadfde6e048f3c8b28a7068e5770a555e002a506 |
|||
Preview scriptFirst 1,000 lines of the extracted script
CheckLength(event.value,9)
if(event.value!=""){
event.target.fillColor = color.white
}else{
event.target.fillColor = color.transparent
}
|
|||
javascript_obj0909_025.js |
pdf-javascript-stream | PDF /JS object 909 at offset 0x21641 | 62 bytes |
SHA-256: 3b842b062bf6d6bd9e35e973ecd366817ed0114d79869aaa0ea890863431db3f |
|||
Preview scriptFirst 1,000 lines of the extracted script
event.value=GPF(event.value,3) CheckLength(event.value,9) |
|||
javascript_obj0993_030.js |
pdf-javascript-stream | PDF /JS object 993 at offset 0x23526 | 80 bytes |
SHA-256: 9f33b442a9d5838f800490616912b6d660cda7673a519b80f0128336f377c1cf |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.value!="")event.value = util.printx("999 999 9999",event.value)
|
|||
javascript_obj0996_031.js |
pdf-javascript-stream | PDF /JS object 996 at offset 0x2362D | 138 bytes |
SHA-256: ba9619f524a4181872ac92271ee646459375bfbc36bbed67f98b59724802e16c |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.value!=""){
if(event.value.replace("-","").length!=10){
app.alert("Please enter 10 digits")
event.rc = false
}
}
|
|||
javascript_obj1002_032.js |
pdf-javascript-stream | PDF /JS object 1002 at offset 0x23837 | 155 bytes |
SHA-256: a56ed3144615fa50a3f1f13036070c040cb363ae10643d065a245620e9ad9224 |
|||
Preview scriptFirst 1,000 lines of the extracted script
if((event.value<1 || event.value>99)&&event.value!=""){
app.alert("Please enter a value between 1 and 99 (or leave field empty)")
event.rc = false
}
|
|||
javascript_obj1023_033.js |
pdf-javascript-stream | PDF /JS object 1023 at offset 0x23F12 | 149 bytes |
SHA-256: 544b595be9e3ddddc8f4fc1169990f4b18f71a47760592987a36bc732ebb5023 |
|||
Preview scriptFirst 1,000 lines of the extracted script
CheckLength(event.value,9)
if(event.value!=""){
event.target.fillColor = color.white
}else{
event.target.fillColor = color.transparent
}
|
|||
javascript_obj1043_034.js |
pdf-javascript-stream | PDF /JS object 1043 at offset 0x249D7 | 39 bytes |
SHA-256: c858eda3bdf3bc5298b5d1377d2f35a914194621b2929ba1cc0a8d2176adea57 |
|||
Preview scriptFirst 1,000 lines of the extracted script
dotheDialog( dialog4, this ); |
|||
javascript_obj1226_035.js |
pdf-javascript-stream | PDF /JS object 1226 at offset 0x28E89 | 116 bytes |
SHA-256: 4440ceed79260584c0cf37f31a3336cc0913e784ab07d188e95bae2f390a370d |
|||
Preview scriptFirst 1,000 lines of the extracted script
var id = util.printx("9",event.target.name)
if(event.target.value=="Off")getField("DP_MEDINS"+id).value = "Off"
|
|||
javascript_obj1294_036.js |
pdf-javascript-stream | PDF /JS object 1294 at offset 0x2BB90 | 185 bytes |
SHA-256: c63ed285526efb75add31c7fb33f7ad9e1fb7ef62934372c6478c92faa0177fd |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.value!=""){
if(GV("CodeNumber1")==""){
app.alert("Please complete these fields in order from left to right. Thank you")
event.value = ""
SF("CodeNumber1")
}
}
|
|||
javascript_obj1039_037.js |
pdf-javascript-stream | PDF /JS object 1039 at offset 0x2463C | 374 bytes |
SHA-256: b6f8e895761b35811acaf5a4e6094a5b13e19eb6d8894f2666d727fdf77ead22 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var result = CheckRequired()
if(result!=false){
if(result!="blank"){
GATHER_A()
UFaxOOOOO();
GATHER_B()
UFaxOOOOO();
}
else resetBarcode();
GF("printlid").display = 1 //hidden
if (app.viewerVersion >=6){
var pp = this.getPrintParams();
pp.pageHandling = pp.constants.handling.none;
this.print(pp)
}
else this.print(true)
}
|
|||
javascript_obj1359_038.js |
pdf-javascript-stream | PDF /JS object 1359 at offset 0x3A7C1 | 269 bytes |
SHA-256: f70088d4853ad967e5b0a1dd9f78f6a1bdcf7168bc307ab2e87d42591d2cc797 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var msg = "The only values allowed in this field are: P,M,D,PM and Blank.\r\rThank you."
event.value=GPF(event.value,2)
if(event.value!="P" && event.value!="M"&& event.value!="D"&& event.value!="PM"&& event.value!=""){
app.alert(msg)
event.value = ""
}
|
|||
javascript_obj1365_039.js |
pdf-javascript-stream | PDF /JS object 1365 at offset 0x3ADD9 | 284 bytes |
SHA-256: c426f669da147c49f3b90407d59439a7d98d9bcb7e76c11a729a580425fa6105 |
|||
Preview scriptFirst 1,000 lines of the extracted script
if(event.value!=""){
if(GV("CodeNumber1")=="" || GV("CodeNumber2")==""){
app.alert("Please complete these fields in order from left to right. Thank you")
event.value = ""
if(GV("CodeNumber2")=="")SF("CodeNumber2")
if(GV("CodeNumber1")=="")SF("CodeNumber1")
}
}
|
|||
javascript_obj1366_040.js |
pdf-javascript-stream | PDF /JS object 1366 at offset 0x3AECC | 501 bytes |
SHA-256: 8a804bea2563c8064bf56a26e56ca56a69f8772b42ae3145d07ec14d2ca4fd46 |
|||
Preview scriptFirst 1,000 lines of the extracted script
var response = app.alert("This action will erase all the form's data.\r\rDo you want to continue?",4,2)
if (response ==4){
var f = new Array("TP_SSN","TP_FIRSTNAME","TP_LASTNAME","ADDRESS","CITY","STATE","ZIP","MDCOUNTY","TAXINGAREA","ExemptTotal_D")
for(var i=0;i<f.length;i++) getField(f[i]).strokeColor = color.transparent;
getField("CB_FS").strokeColor= color.transparent;
getField("CB_DEDUCT_TYPE").strokeColor= color.transparent;
resetBarcode();
resetForm();
}
|
|||
javascript_obj1422_041.js |
pdf-javascript-stream | PDF /JS object 1422 at offset 0x3DC0E | 475 bytes |
SHA-256: 1667760a048dbbf328a2de0004f1b0b5b7bd4254bd6d25213b6d14c34e20f8eb |
|||
Preview scriptFirst 1,000 lines of the extracted script
function DoCalc(){
SV("TP_SSN_COPY",GVS("TP_SSN"))
SV("SP_SSN_COPY",GVS("SP_SSN"))
SV("TP_WHOLENAME_COPY",GV("TP_LASTNAME") + ", " + GV("TP_FIRSTNAME"))
SV("TP_FIRSTNAME_COPY",GV("TP_FIRSTNAME"))
SV("TP_LASTNAME_COPY",GV("TP_LASTNAME"))
SV("TP_MINIT_COPY",GV("TP_MINIT"))
SV("SP_FIRSTNAME_COPY",GV("SP_FIRSTNAME"))
SV("SP_LASTNAME_COPY",GV("SP_LASTNAME"))
SV("SP_MINIT_COPY",GV("SP_MINIT"))
GF("printlid").display = display.noView
}
|
|||
javascript_obj1423_042.js |
pdf-javascript-stream | PDF /JS object 1423 at offset 0x3DD16 | 5860 bytes |
SHA-256: c2dbd198f1466ed8e571a73e3a727834b6f8db59b713bf6af64d81ea7c481f23 |
|||
Preview scriptFirst 1,000 lines of the extracted script
function CP(val){/*console.println(val)*/}//Prints to the console
function GF(gfname){return getField(gfname);} //Returns a field object
function GV(gvname){CP("gv:"+gvname);return getField(gvname).value;} //Returns a field value
function GVS(gvsname){return getField(gvsname).valueAsString;} //Returns a field value as String
function SV(svname,val){/*console.println("sv" + svname)*/;getField(svname).value = val} //Sets the value for a field
function SF(fcname){getField(fcname).setFocus()} //Sets the focus to a field
function GN(gnname){return Number(getField(gnname).value)}//Returns a number; empty returns zero
//GET CENTS (GC)
function GC(fname){
var result = ""
var a = getField(fname).value
if(a>0)result = "." + a
return result
}
//ZPAD (Zero Pad)
//***************
function ZPAD(data,totalChars){
//This function adds leading zeros until length of data is the same as the parameter totalChars
data = String(data)
while(data.length<totalChars){data = '0' + data}
return data
}
//CBX (Check Box Xport value)
//****************************
function CBX(fname){
var val = GV(fname)
if(val=="Off")val = "";
return val;
}
//GPF (General Purpose Formatting)
//**********************************
function GPF(val,index){
//set up an array of Regular Expressions that filters unwanted values
val = String(val)
var re = new Array();
re[0] = /[\"]/gi; //Nothing happens
re[1] = /[^a-z]/gi; //Only Alpha Characters
re[2] = /[^a-z-]/gi; //Only Alpha Characters + Hyphen
re[3] = /[^\d]/gi;//Only digits
re[4] = /[^a-z\s]/gi;//Only Alpha Characters + Space
re[5] = /[^\d.]/gi;//Only digits AND periods, used for percentage fields
re[6] = /[^a-z\s\d]/gi;//Only Alpha Characters + Space + Digits
re[7] = /[^\d-]/gi;//Only digits + Hyphen (ZIP codes) and negative numbers
re[8] = /[^a-z\d]/gi;//Only Alpha Characters + Digits - Account Number
//replace in original string passed
val = val.replace(re[index],"")
//convert to UpperCase
val = val.toUpperCase()
return val
}
//NNG = No Negative
function NNG(id){
if(event.value>=.5){event.value = Math.round(event.value)}
if(id!=1){
if(event.value<0){
event.value=0;
if(getField(event.target.name).readonly!=true){
app.alert("Sorry, negative numbers are not allowed in this field.");
}
}
}
}
function showCalcFields(val){
var flds = new Array()
flds = ["Field1","Field2"] //mock data.
for(var j=0;j<flds.length;j++){
var f = getField(flds[j])
if(val){
f.fillColor = ["RGB",1,1,.6]
f.readonly = true
}else{
f.fillColor=color.transparent
f.readonly = false
}
}
}
function FD(val){
//This function filters known unwanted data
//NWV stands for Not Wanted Values
var NWV = new Array()
val=String(val)
NWV = ['000000','00000','0000','000000000']
for(var j=0;j<NWV.length;j++){
var f = NWV[j]
if(val==f) val='';
}
return val
}
//We check for the passed value to have a number of characters
function CheckLength(data,datalen){
if(data!=""){
if(data.length!=datalen){
app.alert("This field must be " + datalen + " characters long. Please enter the value again.\r\rThank you.")
event.rc = false;
}
}
}
function UFilter(idx){
//Turns event value to caps
event.value = GPF(event.value,idx)
}
//function ds_ks(){
////Turns event value to caps
//event.change = event.change.replace(/[^a-z\'\r\d\s\(\).-]/gi,"").toUpperCase()
//}
function ds_ks(datatype){
//Used only in field keystroke events
if(event.change!=""){
switch (datatype){
case "num":
event.change = event.change.replace(/[^\d]/gi,"")
break;
case "numneg":
//if(event.value=="-")event.change = event.change.replace(/[^\d]/gi,"")
event.change = event.change.replace(/[^\d-]/gi,"")
break;
case "perc":
event.change = event.change.replace(/[^\d.]/gi,"")
break;
case "state":
event.change = event.change.replace(/[^a-z]/gi,"").toUpperCase()
break;
case "alpha":
event.change = event.change.replace(/[^a-z\s]/gi,"").toUpperCase()
break;
case "wth":
event.change = event.change.replace(/[^a-z\d]/gi,"").toUpperCase()
break;
case "T6":
event.change = event.change.replace(/[^a-z\s\d.,-]/gi,"").toUpperCase()
break;
case "cst_md":
event.change = event.change.replace(/[^a-z\s\d\'.-]/gi,"").toUpperCase()
break;
case "dt":
event.change = event.change.replace(/[^\d-]/gi,"") //use Hyphens
//event.change = event.change.replace(/[^\d\/]/gi,"") //use Dash
break;
case "email":
event.change = event.change.replace(/[^a-z_\d.@\-]/gi,"").toUpperCase()
break;
case "web":
event.change = event.change.replace(/[^a-z\_\d.:\-\/,]/gi,"").toUpperCase()
break;
case "phone":
event.change = event.change.replace(/[^\d\s\(\)x+]/gi,"").toLowerCase()
break;
}
}
}
function ds_format(datatype){
//Used only in field format events
switch (datatype){
case "ssn":
if(event.value!="" && event.value.length ==9){
event.value = util.printx("XXX-XX-XXXX",event.value)
}
case "fein":
if(event.value!="" && event.value.length ==9){
event.value = util.printx("XX-XXXXXXX",event.value)
}
case "wth":
if(event.value!="" && event.value.length ==9){
event.value = util.printx("XXXXXXX-AA",event.value)
}
break;
case "usphone":
if(event.value!="" && event.value.length ==10){
event.value = util.printx("(XXX) XXX-XXXX",event.value)
}
break;
case "zip54":
if(event.value!="" && event.value.length ==9){
event.value = util.printx("XXXXX-XXXX",event.value)
}
break;
}
}
|
|||
javascript_obj1424_043.js |
pdf-javascript-stream | PDF /JS object 1424 at offset 0x3E49B | 2740 bytes |
SHA-256: 3e43143246bb79ea4b6f69e4dfde751c936983a72a42405cf8db756090e1065d |
|||
Preview scriptFirst 1,000 lines of the extracted script
//CALL WITH: dotheDialog( dialog4, this );
function dotheDialog(dialog,doc){
dialog.doc = doc;
var retn = app.execDialog( dialog )
}
var txt1 = "\rMARYLAND FORM 502-502B : INSTRUCTIONS\r\r "
txt1 += "- As a service to you, this form along with all other forms available on our website are provided in a fill-in format. Just key in your data prior to printing the form.\r\r"
txt1 += "- When the form is printed, a two dimensional (2D) barcode is generated that includes the data entered on the form. The use of a 2D barcode vastly improves on the time it takes to process your form.\r\r"
txt1 += "- If you choose to use the fill-in option, please do not handwrite any other data on the form other than your signature.\r\r"
txt1 += "- Please use the print button above to print the form once filled. If you need a blank form, just print without entering any data.\r\r"
txt1 += "- If keyed data prints illegible, please update to the most recent version of Adobe Acrobat Reader.\r\r"
var dialog4 = {
initialize: function(dialog){
dialog.load
({
"sta2": txt1,
})
},
subl: function(dialog){
console.println("Selection Box Hit");
},
cncl: function (dialog)
{
dialog.end("cancel")
},
// Dialog box description
description:
{
name: "Maryland Form 502-502B Instructions",
first_tab: "cncl",
elements:[
{
type: "view",
align_children: "align_right",
elements:[
{
type: "view",
align_children: "align_right",
elements:[
{type: "button", item_id: "cncl",name: "Close window"},
//{type: "button",item_id: "butn",name: "Select"}
]
},
{
type: "cluster",
name: "Maryland Form 502-502B : Resident Income Tax Return",
elements:[
{type: "edit_text",
name: "hello",
item_id: "sta2",
height:400,
multiline: true,
readonly: true,
char_width: 60,
font: "dialog"
},
//{type: "hier_list_box",item_id: "subl",char_width: 100,height: 200}
]
}
]
}
]
}
};
var chk_once
if(!chk_once){
chk_once=true
dotheDialog( dialog4, this );
}
|
|||
javascript_obj1425_044.js |
pdf-javascript-stream | PDF /JS object 1425 at offset 0x3E8F5 | 6291 bytes |
SHA-256: a11122e84af5dba51cb5590b937133b0bfe5a8a0c0de7275c32f422e7cfde57a |
|||
Preview scriptFirst 1,000 lines of the extracted script
function SY(){
calculate = true
GF("printlid").display = 3 //hidden + printable
// hideFieldColor(true)
var fld=GF(event.target.name)
var col = ['RGB',.7,.9,1]
switch(fld.type){
case 'checkbox':
fld.fillColor = col
break;
case 'radiobutton':
fld.fillColor = col
break;
case 'combobox':
fld.fillColor = col
break;
case 'text':
fld.fillColor = col
break;
case 'button':
fld.strokeColor = ['RGB',1,0,0]
break;
}
if(fld.strokeColor=="RGB,1,0,0")fld.strokeColor = ["T"]
}
function SN(){
//SN is 'Show No'
calculate = true
var fld=GF(event.target.name)
var col = ['T']//['G',.97]//['RGB',.9,0.9,.7]
switch(fld.type){
case 'checkbox':
fld.fillColor = col
break;
case 'radiobutton':
fld.fillColor = col
break;
case 'text':
fld.fillColor = col
break;
case 'combobox':
fld.fillColor = col
break;
case 'button':
fld.textColor = color.white
fld.strokeColor = color.transparent
break;
}
}
function myFields(){
var a = new Array()
a.push(["RTNUMBER"])
a.push(["ACCNUMBER"])
a.push(["502B_FEIN"])
a.push(["502B_TOTALBOXES"])
a.push(["ADDRESS"])
a.push(["AccountOutsideUSA"])
a.push(["AccountTypeChecking"])
a.push(["AddressTelephoneOfPreparer"])
a.push(["AuthorizeNotEfile"])
a.push(["AuthorizeToDiscuss"])
a.push(["AuthorizeToDiscussMedical"])
a.push(["CB_DEDUCT_TYPE"])
a.push(["CB_FS"])
a.push(["CITY"])
a.push(["CodeNumber1"])
a.push(["CodeNumber2"])
a.push(["CodeNumber3"])
a.push(["DP_65_1"])
a.push(["DP_65_2"])
a.push(["DP_65_3"])
a.push(["DP_65_4"])
a.push(["DP_65_5"])
a.push(["DP_CHILD1"])
a.push(["DP_CHILD2"])
a.push(["DP_CHILD3"])
a.push(["DP_CHILD4"])
a.push(["DP_CHILD5"])
a.push(["DP_FNAME1"])
a.push(["DP_FNAME2"])
a.push(["DP_FNAME3"])
a.push(["DP_FNAME4"])
a.push(["DP_FNAME5"])
a.push(["DP_LNAME1"])
a.push(["DP_LNAME2"])
a.push(["DP_LNAME3"])
a.push(["DP_LNAME4"])
a.push(["DP_LNAME5"])
a.push(["DP_MEDINS1"])
a.push(["DP_MEDINS2"])
a.push(["DP_MEDINS3"])
a.push(["DP_MEDINS4"])
a.push(["DP_MEDINS5"])
a.push(["DP_MINIT1"])
a.push(["DP_MINIT2"])
a.push(["DP_MINIT3"])
a.push(["DP_MINIT4"])
a.push(["DP_MINIT5"])
a.push(["DP_REG1"])
a.push(["DP_REG2"])
a.push(["DP_REG3"])
a.push(["DP_REG4"])
a.push(["DP_REG5"])
a.push(["DP_REL1"])
a.push(["DP_REL2"])
a.push(["DP_REL3"])
a.push(["DP_REL4"])
a.push(["DP_REL5"])
a.push(["DP_SSN1"])
a.push(["DP_SSN2"])
a.push(["DP_SSN3"])
a.push(["DP_SSN4"])
a.push(["DP_SSN5"])
a.push(["DayPhone"])
a.push(["ExemptSpouse"])
a.push(["ExemptTotal_A"])
a.push(["ExemptTotal_B"])
a.push(["ExemptTotal_C"])
a.push(["ExemptTotal_D"])
a.push(["ExemptYourself"])
a.push(["ExemptionAmount_A"])
a.push(["ExemptionAmount_B"])
a.push(["ExemptionAmount_C"])
a.push(["ExemptionAmount_D"])
a.push(["FiscalYearBeginning"])
a.push(["FiscalYearEnding"])
a.push(["ForLateFiling"])
a.push(["HomePhone"])
a.push(["InterestCharge"])
a.push(["Line1"])
a.push(["Line10"])
a.push(["Line10C"])
a.push(["Line11"])
a.push(["Line11C"])
a.push(["Line12"])
a.push(["Line12C"])
a.push(["Line13"])
a.push(["Line13C"])
a.push(["Line14"])
a.push(["Line14C"])
a.push(["Line15"])
a.push(["Line15C"])
a.push(["Line16"])
a.push(["Line16C"])
a.push(["Line17"])
a.push(["Line17A"])
a.push(["Line17AC"])
a.push(["Line17B"])
a.push(["Line17BC"])
a.push(["Line17C"])
a.push(["Line18"])
a.push(["Line18C"])
a.push(["Line19"])
a.push(["Line19C"])
a.push(["Line1A"])
a.push(["Line1AC"])
a.push(["Line1B"])
a.push(["Line1BC"])
a.push(["Line1C"])
a.push(["Line2"])
a.push(["Line20"])
a.push(["Line20C"])
a.push(["Line21"])
a.push(["Line21C"])
a.push(["Line22"])
a.push(["Line22C"])
a.push(["Line23"])
a.push(["Line23C"])
a.push(["Line24"])
a.push(["Line24C"])
a.push(["Line25"])
a.push(["Line25C"])
//a.push(["Line26"])
//a.push(["Line26C"])
a.push(["Line27"])
a.push(["Line27C"])
a.push(["Line28"])
a.push(["Line28C"])
a.push(["Line29"])
a.push(["Line29C"])
a.push(["Line2C"])
a.push(["Line3"])
a.push(["Line30"])
a.push(["Line30C"])
a.push(["Line31"])
a.push(["Line31C"])
a.push(["Line32"])
a.push(["Line32C"])
a.push(["Line33"])
a.push(["Line33C"])
a.push(["Line34"])
a.push(["Line34C"])
a.push(["Line35"])
a.push(["Line35C"])
a.push(["Line36"])
a.push(["Line36C"])
a.push(["Line37"])
a.push(["Line37C"])
a.push(["Line38"])
a.push(["Line38C"])
a.push(["Line39"])
a.push(["Line39C"])
a.push(["Line3C"])
a.push(["Line4"])
a.push(["Line40"])
a.push(["Line40C"])
a.push(["Line41"])
a.push(["Line41C"])
a.push(["Line42"])
a.push(["Line42C"])
a.push(["Line43"])
a.push(["Line43C"])
a.push(["Line44"])
a.push(["Line44C"])
a.push(["Line45"])
a.push(["Line45C"])
a.push(["Line46"])
a.push(["Line46C"])
a.push(["Line47"])
a.push(["Line47C"])
a.push(["Line48"])
a.push(["Line48C"])
a.push(["Line49"])
a.push(["Line49C"])
a.push(["Line4C"])
a.push(["Line5"])
a.push(["Line5C"])
a.push(["Line6"])
a.push(["Line6C"])
a.push(["Line7"])
a.push(["Line7C"])
a.push(["Line8"])
a.push(["Line8C"])
a.push(["Line9"])
a.push(["Line9C"])
a.push(["LocalTaxRate2"])
a.push(["LocalTaxRate3"])
a.push(["LocalTaxRate4"])
a.push(["MDCOUNTY"])
a.push(["Other state of residence"])
a.push(["OtherAdditions1"])
a.push(["OtherAdditions2"])
a.push(["OtherAdditions3"])
a.push(["OtherAdditions4"])
a.push(["OtherSubstractions1"])
a.push(["OtherSubstractions2"])
a.push(["OtherSubstractions3"])
a.push(["OtherSubstractions4"])
a.push(["PartYearResFromDay"])
a.push(["PartYearResFromMonth"])
a.push(["PartYearResFromYear"])
a.push(["PartYearResToDay"])
a.push(["PartYearResToMonth"])
a.push(["PartYearResToYear"])
a.push(["PartYearResidentCheck"])
a.push(["Prefer_1099G"])
a.push(["PreparerSSN"])
a.push(["SP_FIRSTNAME"])
a.push(["SP_FS_SSN"])
a.push(["SP_LASTNAME"])
a.push(["SP_MINIT"])
a.push(["SP_SSN"])
a.push(["STATE"])
a.push(["Spouse65"])
a.push(["SpouseBlind"])
a.push(["SpouseDateSigned"])
a.push(["TAXINGAREA"])
a.push(["TP_FIRSTNAME"])
a.push(["TP_LASTNAME"])
a.push(["TP_MINIT"])
a.push(["TP_SSN"])
a.push(["YourDateSigned"])
a.push(["Yourself65"])
a.push(["YourselfBlind"])
a.push(["ZIP"])
a.push(["military"])
return a;
}
|
|||
javascript_obj1426_045.js |
pdf-javascript-stream | PDF /JS object 1426 at offset 0x3EE83 | 1337 bytes |
SHA-256: 5a16e6f25332f36744b04043546724a224c44001afd88d820e1d9071828dd3bb |
|||
Preview scriptFirst 1,000 lines of the extracted script
function CheckRequired(){
//If the function returns true, means success. It cleared all the validation controls
//else, it returns false
var result = true
var f = new Array()
f.push(["TP_SSN",""])
f.push(["TP_FIRSTNAME",""])
f.push(["TP_LASTNAME",""])
f.push(["ADDRESS",""])
f.push(["STATE",""])
f.push(["ZIP",""])
f.push(["CITY",""])
f.push(["ExemptTotal_D",""])
f.push(["CB_DEDUCT_TYPE","Off"])
f.push(["CB_FS","Off"])
//f.push(["MarylandCounty",""])
//f.push(["CityTownOrTaxingArea",""])
//Add here additional required fields. Make sure to increase the Array index.
//First, let us check if ALL of them are empty at once
var count = 0
for(var i=0;i<f.length;i++){
if(getField(f[i][0]).value==f[i][1]) count++
}
if(count == f.length) result = "blank"
//If count is equal to the array length means all fields are empty
//so.. we let the user print a blank form
else{
for(var i=0;i<f.length;i++){
if(getField(f[i][0]).valueAsString==f[i][1]){
getField(f[i][0]).strokeColor = color.red
result = false
}
else{
getField(f[i][0]).strokeColor = color.transparent
}
}
if(!result){
app.alert("Required fields have been marked with a red border. These fields must be filled prior to print the form. Thank you.")
}
}
return result;
}
|
|||
javascript_obj1427_046.js |
pdf-javascript-stream | PDF /JS object 1427 at offset 0x3F159 | 6095 bytes |
SHA-256: 542efef7619bbe544d6a0d1594c7058ee4871c956accfb54da27006c9b709afb |
|||
Preview scriptFirst 1,000 lines of the extracted script
//Source Code Copyright � 2001-2010 Dataintro Software - All rights reserved.
//Contact us at: info@dataintro.com. Ultraforms� Technology is Patent pending.
var gstream = ""
var glote = ""
function GATHER_A(){
var UF_Text = "" ;
//Choose Delimiter
//**************************
var UFs = "\r";
//**************************
UF_Text += "T1" + UFs; //Header Version
UF_Text += "1258" + UFs; //Dataintro Software Developers Code
UF_Text += "MD" + UFs; //Jurisdiction
UF_Text += "502" + UFs; //Form
UF_Text += "01" + UFs; //Spec
UF_Text += "00" + UFs; //Version (Year)
UF_Text += ZPAD(GVS('TP_SSN'),9) + UFs;
UF_Text += FD(ZPAD(GVS('SP_SSN'),9)) + UFs;
UF_Text += GVS('TP_LASTNAME') + UFs;
UF_Text += GVS('TP_FIRSTNAME') + UFs;
UF_Text += GVS('TP_MINIT') + UFs;
UF_Text += GVS('SP_LASTNAME') + UFs;
UF_Text += GVS('SP_FIRSTNAME') + UFs;
UF_Text += GVS('SP_MINIT') + UFs;
//Street Address: if longer than 30, separate it in two pieces of 30 char each
var a = GVS('ADDRESS')
if(a.length<31) UF_Text += a + UFs + UFs;
else {
UF_Text += a.substr(0,30) + UFs;
UF_Text += a.substr(30,a.length-30) + UFs;
}
UF_Text += GVS('CITY') + UFs;
UF_Text += GVS('STATE') + UFs;
UF_Text += GVS('ZIP') + UFs;
//Filing Status
for(var i=1;i<7;i++){
var val = GV('CB_FS')
if(val==i)UF_Text += val + UFs;
else UF_Text += "" + UFs;
}
UF_Text += GVS('SP_FS_SSN') + UFs;
UF_Text += GVS('PartYearResidentCheck') + UFs;
UF_Text += CBX('Yourself65') + UFs;
UF_Text += CBX('YourselfBlind') + UFs;
UF_Text += CBX('Spouse65') + UFs;
UF_Text += CBX('SpouseBlind') + UFs;
UF_Text += GV('ExemptTotal_D') + UFs;
UF_Text += GV('Line1') + UFs;
UF_Text += GV('Line1A') + UFs;
UF_Text += GV('Line1B') + UFs;
UF_Text += GV('Line1C') + UFs;
UF_Text += GV('Line1D') + UFs;
UF_Text += CBX('CHK1E') + UFs;
UF_Text += GV('Line2') + UFs;
UF_Text += GV('Line3') + UFs;
UF_Text += GV('Line4') + UFs;
UF_Text += GVS('OtherAdditions1') + UFs;
UF_Text += GVS('OtherAdditions2') + UFs;
UF_Text += GVS('OtherAdditions3') + UFs;
UF_Text += GVS('OtherAdditions4') + UFs;
UF_Text += GV('Line5') + UFs;
UF_Text += GV('Line6') + UFs;
UF_Text += GV('Line8') + UFs;
UF_Text += GV('Line9') + UFs;
UF_Text += GV('Line10') + UFs;
UF_Text += GV('Line11') + UFs;
UF_Text += GV('Line12') + UFs;
UF_Text += GVS('OtherSubstractions1') + UFs;
UF_Text += GVS('OtherSubstractions2') + UFs;
UF_Text += GVS('OtherSubstractions3') + UFs;
UF_Text += GVS('OtherSubstractions4') + UFs;
UF_Text += GV('Line13') + UFs;
UF_Text += GV('Line14') + UFs;
UF_Text += GV('Line15') + UFs;
var a = CBX("CB_DEDUCT_TYPE")
if(a=="S")UF_Text += "S" + UFs + "" + UFs;
else if(a=="I")UF_Text += "" + UFs + "I" + UFs ;
else UF_Text += "" + UFs + "" + UFs ;
UF_Text += GV('Line17A') + UFs;
UF_Text += GV('Line17B') + UFs;
UF_Text += GV('Line17') + UFs;
//Page 2
UF_Text += GV('Line23') + UFs;
UF_Text += GV('Line24') + UFs;
UF_Text += GV('Line35') + UFs;
UF_Text += GV('Line36') + UFs;
UF_Text += GV('Line37') + UFs;
UF_Text += GV('Line39') + UFs;
UF_Text += GV('Line40') + UFs;
UF_Text += GV('Line41') + UFs;
UF_Text += GV('Line44') + UFs;
UF_Text += GV('Line45') + UFs;
UF_Text += GV('Line46') + UFs;
UF_Text += GV('Line47') + UFs;
UF_Text += GV('Line47C') + UFs;
UF_Text += GV('Line48') + UFs;
//FOREIGN
UF_Text += CBX('AccountOutsideUSA') + UFs;
// ACCTYPE
var a = CBX('AccountTypeChecking')
if(a=="C")UF_Text += "C" + UFs + "" + UFs; //CHECKING
else if(a=="S")UF_Text += "" + UFs + "S" + UFs; //SAVINGS
else UF_Text += "" + UFs + "" + UFs; //BLANK
//RT NUM
UF_Text += GVS("RTNUMBER") + UFs;
//ACC NUM
UF_Text += GVS("ACCNUMBER") + UFs;
UF_Text += GVS('DayPhone').replace("-","") + UFs;
var a = ZPAD(GVS('CodeNumber1'),3)
var b = ZPAD(GVS('CodeNumber2'),3)
var c = ZPAD(GVS('CodeNumber3'),3)
if (a=="000"){
a=""
b=""
c=""
}
if (b=="000"){
b=""
c=""
}
if (c=="000")c=""
var CodeNumber = a + b + c
UF_Text += CodeNumber + UFs
UF_Text += CBX('AuthorizeNotEfile') + UFs;
UF_Text += CBX('Prefer_1099G') + UFs;
UF_Text += GVS('PreparerSSN')+ UFs;
UF_Text += "*EOD*" + UFs;
gstream = UF_Text
glote = "A"
//UF_Text = UF_Text.replace(/[^a-z\'\r\d\s\(\).\*\-]/gi,"")
}
function GATHER_B(){
var UF_Text = "" ;
//Choose Delimiter
//**************************
var UFs = "\r";
//**************************
UF_Text += "T1" + UFs; //Header Version
UF_Text += "1258" + UFs; //Dataintro Software Developers Code
UF_Text += "MD" + UFs; //Jurisdiction
UF_Text += "502B" + UFs; //Form
UF_Text += "01" + UFs; //Spec
UF_Text += "00" + UFs; //Version (Year)
UF_Text += GV('502B_TOTALBOXES_REG')+ UFs;
UF_Text += GV('502B_TOTALBOXES_65')+ UFs;
for (var i=1;i<13;i++){
UF_Text += GV('DP_LNAME'+i) + UFs
UF_Text += GVS('DP_SSN'+i) + UFs
}
UF_Text += "*EOD*" + UFs;
gstream = UF_Text
glote = "B"
}
function UF_SetStream(){
var quest = "E" + app.viewerVersion
quest += "V" + app.formsVersion
quest += "P" + app.platform.substr(0,1)
quest += "T" + app.viewerType.length
quest += "L" + gstream.length
SV("count",quest)
//End of custom script
//Do not edit the script below this line
return gstream; //multibarcode
}
function UF_CodePage(){
//***************************
//*DO NOT EDIT THIS FUNCTION*
//***************************
UFG_byteChar1=" !\"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~";
UFG_byteChar2="������������.��������������������������������������������������������������������������������� ~";
}
//function resetBarcode(){
// var iconA = getField("UF_Reset").buttonGetIcon()
// var levels = 8
// for(var i=1;i<(levels+1);i++){getField("UF_L"+i).buttonSetIcon(iconA)}
//}
function resetBarcode(){
var iconA = getField("UF_Reset").buttonGetIcon();var levels = 8;
var lote = new Array("A","B")
for(var z=0;z<lote.length;z++){
for(var i=1;i<(levels+1);i++){getField("UF_L"+i+lote[z]).buttonSetIcon(iconA)}}
}
|
|||
javascript_obj1428_047.js |
pdf-javascript-stream | PDF /JS object 1428 at offset 0x3F92D | 545 bytes |
SHA-256: d5acb1b828a331ccc96ff6fa35c70f9e43749abbd5715377c5f7122a2356bd54 |
|||
Preview scriptFirst 1,000 lines of the extracted script
//Source Code Copyright � 2001-2006 Dataintro Software S.L. - All rights reserved.
//Contact us at: info@ultraforms.com. Ultraforms� Technology is Patent pending.
function UFOOOOOxa(UFxOOOOOb,UFOxOOOOb){var ufOOxOOOd=0;switch (UFxOOOOOb){case "ufxxOOOOa":if(UFOxOOOOb=="ufOOOxxxa"){ufOOxOOOd=865}break;case "ufxOOxOOa":if(UFOxOOOOb=="ufxxOOOOa"){ufOOxOOOd=868}else if(UFOxOOOOb=="ufOOOxxxa"){ufOOxOOOd=865}break;case "ufOOOxxxa":if(UFOxOOOOb=="ufxOOxOOa"){ufOOxOOOd=897}else if(UFOxOOOOb=="ufxOxOOOa"){ufOOxOOOd=898}break;}return ufOOxOOOd;}
|
|||
javascript_obj1429_048.js |
pdf-javascript-stream | PDF /JS object 1429 at offset 0x3FA94 | 962 bytes |
SHA-256: b19620c16ac59e504c60bcac849a796085b9f84d6873c4941946b644acdba16f |
|||
Preview scriptFirst 1,000 lines of the extracted script
//Source Code Copyright � 2001-2006 Dataintro Software S.L. - All rights reserved.
//Contact us at: info@ultraforms.com. Ultraforms� Technology is Patent pending.
function UFOOOOxOa(h){var ufxxOOOOa="ABCDEFGHIJKLMNOPQRSTUVWXYZ ";var ufxOOxOOa="abcdefghijklmnopqrstuvwxyz ";var ufxOxOOOa="0123456789&\r\t,:#-.$/+%*=^";var ufOOOxxxa=";<>@[\\]_`~!\r\t,:\n-.$/\"|*()?{}\'";var x;switch(ufga00x000){case "ufxxOOOOa" :x = ufxxOOOOa.indexOf(h);ufgOOxOxxa="ufxxOOOOa";break;case "ufxOOxOOa" :x = ufxOOxOOa.indexOf(h);ufgOOxOxxa="ufxOOxOOa";break;case "ufOOOxxxa" :x = ufOOOxxxa.indexOf(h);ufgOOxOxxa="ufOOOxxxa";break;case "ufxOxOOOa":x = ufxOxOOOa.indexOf(h);if(x==25){x=26}ufgOOxOxxa="ufxOxOOOa";break;}if(x==-1){ufgOOxOxxa= "ufxxOOOOa";x = ufxxOOOOa.indexOf(h);if(x==-1){x =ufxOOxOOa.indexOf(h);ufgOOxOxxa="ufxOOxOOa";if(x==-1){x = ufOOOxxxa.indexOf(h);ufgOOxOxxa="ufOOOxxxa";if(x==-1){x = ufxOxOOOa.indexOf(h);if(x==25){x=26}ufgOOxOxxa="ufxOxOOOa";}}}}return x;}
|
|||
javascript_obj1430_049.js |
pdf-javascript-stream | PDF /JS object 1430 at offset 0x3FCA8 | 1470 bytes |
SHA-256: 72b6c06aa287a340fd917c104d57b64d9b90a409c8d39281faa4c8fda6b33516 |
|||
Preview scriptFirst 1,000 lines of the extracted script
//Source Code Copyright � 2001-2006 Dataintro Software S.L. - All rights reserved.
//Contact us at: info@ultraforms.com. Ultraforms� Technology is Patent pending.
function UFOOOOxxa(){UFaOOOOOx();var xOOOxOa=String(UF_SetStream());xOOOxOa=xOOOxOa.substr(0,600);for(var i=0;i<xOOOxOa.length;i++){var temp ="";var temp1 ="";var u=0;var UFOOOxOOc=UFOOOxOOa(xOOOxOa.charAt(i+u));var UFOOxOOOc = false;while(UFOOOxOOc&&!UFOOxOOOc){temp=temp+xOOOxOa.charAt(i+u);u++;UFOOOxOOc=UFOOOxOOa(xOOOxOa.charAt(i+u));if(temp.length == 15){UFOOOxOOc=false}if(u==xOOOxOa.length){UFOOxOOOc = true}if((i+u)==xOOOxOa.length){UFOOxOOOc = true}}UFOOxOOOc = false;if(temp.length>5){UFOxOOOOa(temp);i=i+u-1;}else{var temp= "";var text= UFOOxOOOa(xOOOxOa.charAt(i));var u = 0;while(text&&!UFOOxOOOc){temp=temp + temp1;temp1 =xOOOxOa.charAt(i+u);if(UFaOxOOxx(xOOOxOa.substr(i+u,13))){u--;text=false}else if(!UFOOxOOOa(temp1)){u--;text=false}if(u==xOOOxOa.length){UFOOxOOOc = true}if((i+u)==xOOOxOa.length){UFOOxOOOc = true}u++;}var temp1="";UFOOxOOOc = false;if(temp.length>4){UFOOxOOxa(temp);i=i+u-1;}else{var bytechar= true;while(bytechar&&!UFOOxOOOc){temp=temp + temp1;temp1 =xOOOxOa.charAt(i+u);if(UFaOxOOxx(xOOOxOa.substr(i+u,13))){u--;bytechar=false}else if(UFaxOOOxx(xOOOxOa.substr(i+u,6))){u--;bytechar=false}if(u==xOOOxOa.length){UFOOxOOOc = true}if((i+u)==xOOOxOa.length){UFOOxOOOc = true}u++;}UFOOxOOOc = false;UFaOOxOOO(temp);i=i+u-1;if((i+u)==xOOOxOa.length){UFOOxOOOc = true}}}}}
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.