Malicious PDF — malware analysis report

Static analysis result for SHA-256 e74b6971889bbeb6…

MALICIOUS

PDF

295.0 KB Created: º¾ðª“gN¡sʎÔà< Authoring application: «Cø²ûtÌ,åb¯ùªóf®èGL (via ‰Xûîï^×,ð-ŽÐ’ýT 9 ø) First seen: 2015-04-15
MD5: 6f8a31dfefab2ba3112f9bbc9ff44d67 SHA-1: a7d49eb7608d891756b0e4d0f0e22dac062f4eeb SHA-256: e74b6971889bbeb6a73d00514b86b2a06c9278b9d4d8e84cfe7e25ab0677388d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file is encrypted and contains JavaScript, indicating an attempt to obscure malicious content. The presence of CCITTFaxDecode related heuristics suggests exploitation of CVE-2010-0188 or a similar vulnerability. The document also contains elements of a fake invoice lure, commonly used to trick users into opening malicious attachments or clicking on links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8394

Heuristics 5

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Encrypted PDF carries /JavaScript — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/JavaScript). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0320_001.js pdf-javascript-stream PDF /JS object 320 at offset 0x14882 92 bytes
SHA-256: 1df775bf985700cf126fe29ed88c94718b4f53896c7e8f74931667d45d4c090e
Preview script
First 1,000 lines of the extracted script
if(this.dirty){
	getField('printlid').display = display.noView;
}
DoCalc();
javascript_obj0323_004.js pdf-javascript-stream PDF /JS object 323 at offset 0x149A4 64 bytes
SHA-256: e7bae9be639676411fe5bcf4f65c25e2fd5e5524a379b7805feec663e6e79acd
Preview script
First 1,000 lines of the extracted script
event.value=GPF(event.value,3)
CheckLength(event.value,9)
javascript_obj0356_008.js pdf-javascript-stream PDF /JS object 356 at offset 0x151C7 39 bytes
SHA-256: a38c01daa8a2de78b2151ee01d1c69e81170452d881008dd1b45953b3c94a808
Preview script
First 1,000 lines of the extracted script
AFNumber_Format(0, 0, 0, 0, "", false);
javascript_obj0358_009.js pdf-javascript-stream PDF /JS object 358 at offset 0x15258 42 bytes
SHA-256: bf6e5cec6b360b670b6bd2c73336d76c35e5f2336d421386785389d70cf8237a
Preview script
First 1,000 lines of the extracted script
AFNumber_Keystroke(0, 0, 0, 0, "", false);
javascript_obj0420_013.js pdf-javascript-stream PDF /JS object 420 at offset 0x17136 100 bytes
SHA-256: 34d2cdade289137c31b02c31ca8e9eac33bdd4c79a69294d9a864ce54f0d2d7b
Preview script
First 1,000 lines of the extracted script
if(event.value!="")event.value=Math.round(event.value)
if(event.value=="NaN")event.value = ""
javascript_obj0424_014.js pdf-javascript-stream PDF /JS object 424 at offset 0x1728E 56 bytes
SHA-256: 057613f95bc2a75cbd80e507807b79f2236af14d2cade23a1099a9f7007173fb
Preview script
First 1,000 lines of the extracted script
if(event.value!="")event.value=Math.round(event.value)
javascript_obj0471_017.js pdf-javascript-stream PDF /JS object 471 at offset 0x17ED6 98 bytes
SHA-256: 9f827be7af30adbb2fc2d5ee9e3e422fbc77cf6a204f6578f3d4f5e862a28141
Preview script
First 1,000 lines of the extracted script
if(event.value!="")event.value=Math.round(event.value)
if(event.value=="NaN")event.value = ""
javascript_obj0761_019.js pdf-javascript-stream PDF /JS object 761 at offset 0x1CFCF 82 bytes
SHA-256: 232ec797ff29ad7a4e63c81def437244af84bb91345d362bb0938fa4fcff87ff
Preview script
First 1,000 lines of the extracted script
if(event.value!="")event.value = util.printx("999 999 9999",event.value)
javascript_obj0764_020.js pdf-javascript-stream PDF /JS object 764 at offset 0x1D0E6 136 bytes
SHA-256: ce0d3ac93e44d7f195af21a8f0cfed50cd14bd9afebfc6dc2546d900aef9bb45
Preview script
First 1,000 lines of the extracted script
if(event.value!=""){
	if(event.value.replace("-","").length!=10){
		app.alert("Please enter 10 digits")
		event.rc = false
	}
}
javascript_obj0838_023.js pdf-javascript-stream PDF /JS object 838 at offset 0x1F080 151 bytes
SHA-256: 5945a9989c3f2d05668d9f1bd54f455df6724a9d0fd5678ad3c09f12f43306c7
Preview script
First 1,000 lines of the extracted script
CheckLength(event.value,9)
if(event.value!=""){
	event.target.fillColor = color.white
}else{
	event.target.fillColor = color.transparent
}
javascript_obj0842_024.js pdf-javascript-stream PDF /JS object 842 at offset 0x1F219 153 bytes
SHA-256: 2edebca30dc0ae7d5998d514eadfde6e048f3c8b28a7068e5770a555e002a506
Preview script
First 1,000 lines of the extracted script
CheckLength(event.value,9)
if(event.value!=""){
	event.target.fillColor = color.white
}else{
	event.target.fillColor = color.transparent
}
javascript_obj0909_025.js pdf-javascript-stream PDF /JS object 909 at offset 0x21641 62 bytes
SHA-256: 3b842b062bf6d6bd9e35e973ecd366817ed0114d79869aaa0ea890863431db3f
Preview script
First 1,000 lines of the extracted script
event.value=GPF(event.value,3)
CheckLength(event.value,9)
javascript_obj0993_030.js pdf-javascript-stream PDF /JS object 993 at offset 0x23526 80 bytes
SHA-256: 9f33b442a9d5838f800490616912b6d660cda7673a519b80f0128336f377c1cf
Preview script
First 1,000 lines of the extracted script
if(event.value!="")event.value = util.printx("999 999 9999",event.value)
javascript_obj0996_031.js pdf-javascript-stream PDF /JS object 996 at offset 0x2362D 138 bytes
SHA-256: ba9619f524a4181872ac92271ee646459375bfbc36bbed67f98b59724802e16c
Preview script
First 1,000 lines of the extracted script
if(event.value!=""){
	if(event.value.replace("-","").length!=10){
		app.alert("Please enter 10 digits")
		event.rc = false
	}
}
javascript_obj1002_032.js pdf-javascript-stream PDF /JS object 1002 at offset 0x23837 155 bytes
SHA-256: a56ed3144615fa50a3f1f13036070c040cb363ae10643d065a245620e9ad9224
Preview script
First 1,000 lines of the extracted script
if((event.value<1 || event.value>99)&&event.value!=""){
	app.alert("Please enter a value between 1 and 99 (or leave field empty)")
	event.rc = false
}
javascript_obj1023_033.js pdf-javascript-stream PDF /JS object 1023 at offset 0x23F12 149 bytes
SHA-256: 544b595be9e3ddddc8f4fc1169990f4b18f71a47760592987a36bc732ebb5023
Preview script
First 1,000 lines of the extracted script
CheckLength(event.value,9)
if(event.value!=""){
	event.target.fillColor = color.white
}else{
	event.target.fillColor = color.transparent
}
javascript_obj1043_034.js pdf-javascript-stream PDF /JS object 1043 at offset 0x249D7 39 bytes
SHA-256: c858eda3bdf3bc5298b5d1377d2f35a914194621b2929ba1cc0a8d2176adea57
Preview script
First 1,000 lines of the extracted script
dotheDialog( dialog4, this );
javascript_obj1226_035.js pdf-javascript-stream PDF /JS object 1226 at offset 0x28E89 116 bytes
SHA-256: 4440ceed79260584c0cf37f31a3336cc0913e784ab07d188e95bae2f390a370d
Preview script
First 1,000 lines of the extracted script
var id = util.printx("9",event.target.name)
if(event.target.value=="Off")getField("DP_MEDINS"+id).value = "Off"
javascript_obj1294_036.js pdf-javascript-stream PDF /JS object 1294 at offset 0x2BB90 185 bytes
SHA-256: c63ed285526efb75add31c7fb33f7ad9e1fb7ef62934372c6478c92faa0177fd
Preview script
First 1,000 lines of the extracted script
if(event.value!=""){
	if(GV("CodeNumber1")==""){
	app.alert("Please complete these fields in order from left to right. Thank you")
	event.value = ""
	SF("CodeNumber1")	
	}
}
javascript_obj1039_037.js pdf-javascript-stream PDF /JS object 1039 at offset 0x2463C 374 bytes
SHA-256: b6f8e895761b35811acaf5a4e6094a5b13e19eb6d8894f2666d727fdf77ead22
Preview script
First 1,000 lines of the extracted script
var result = CheckRequired()
if(result!=false){
	if(result!="blank"){
		GATHER_A()
		UFaxOOOOO();
		GATHER_B()
		UFaxOOOOO();
	}
	else resetBarcode();
	GF("printlid").display = 1 //hidden
	if (app.viewerVersion >=6){
		var pp = this.getPrintParams();
		pp.pageHandling = pp.constants.handling.none;
		this.print(pp)
	}
	else 	this.print(true)
}
javascript_obj1359_038.js pdf-javascript-stream PDF /JS object 1359 at offset 0x3A7C1 269 bytes
SHA-256: f70088d4853ad967e5b0a1dd9f78f6a1bdcf7168bc307ab2e87d42591d2cc797
Preview script
First 1,000 lines of the extracted script
var msg = "The only values allowed in this field are: P,M,D,PM and Blank.\r\rThank you."

event.value=GPF(event.value,2)
if(event.value!="P" && event.value!="M"&& event.value!="D"&& event.value!="PM"&& event.value!=""){
	app.alert(msg)
	event.value = ""
}
javascript_obj1365_039.js pdf-javascript-stream PDF /JS object 1365 at offset 0x3ADD9 284 bytes
SHA-256: c426f669da147c49f3b90407d59439a7d98d9bcb7e76c11a729a580425fa6105
Preview script
First 1,000 lines of the extracted script
if(event.value!=""){
	if(GV("CodeNumber1")=="" || GV("CodeNumber2")==""){
	app.alert("Please complete these fields in order from left to right. Thank you")
	event.value = ""
	if(GV("CodeNumber2")=="")SF("CodeNumber2")
	if(GV("CodeNumber1")=="")SF("CodeNumber1")	
	}
}
javascript_obj1366_040.js pdf-javascript-stream PDF /JS object 1366 at offset 0x3AECC 501 bytes
SHA-256: 8a804bea2563c8064bf56a26e56ca56a69f8772b42ae3145d07ec14d2ca4fd46
Preview script
First 1,000 lines of the extracted script
var response = app.alert("This action will erase all the form's data.\r\rDo you want to continue?",4,2)
if (response ==4){

	var f = new Array("TP_SSN","TP_FIRSTNAME","TP_LASTNAME","ADDRESS","CITY","STATE","ZIP","MDCOUNTY","TAXINGAREA","ExemptTotal_D")
	for(var i=0;i<f.length;i++) getField(f[i]).strokeColor = color.transparent;

	getField("CB_FS").strokeColor= color.transparent;
	getField("CB_DEDUCT_TYPE").strokeColor= color.transparent;
	
	resetBarcode();
	resetForm();
}
javascript_obj1422_041.js pdf-javascript-stream PDF /JS object 1422 at offset 0x3DC0E 475 bytes
SHA-256: 1667760a048dbbf328a2de0004f1b0b5b7bd4254bd6d25213b6d14c34e20f8eb
Preview script
First 1,000 lines of the extracted script
function DoCalc(){
	SV("TP_SSN_COPY",GVS("TP_SSN"))
	SV("SP_SSN_COPY",GVS("SP_SSN"))
	
	SV("TP_WHOLENAME_COPY",GV("TP_LASTNAME") + ", " + GV("TP_FIRSTNAME"))
	
	SV("TP_FIRSTNAME_COPY",GV("TP_FIRSTNAME"))
	SV("TP_LASTNAME_COPY",GV("TP_LASTNAME"))
	SV("TP_MINIT_COPY",GV("TP_MINIT"))

	SV("SP_FIRSTNAME_COPY",GV("SP_FIRSTNAME"))
	SV("SP_LASTNAME_COPY",GV("SP_LASTNAME"))
	SV("SP_MINIT_COPY",GV("SP_MINIT"))

	GF("printlid").display = display.noView
}
javascript_obj1423_042.js pdf-javascript-stream PDF /JS object 1423 at offset 0x3DD16 5860 bytes
SHA-256: c2dbd198f1466ed8e571a73e3a727834b6f8db59b713bf6af64d81ea7c481f23
Preview script
First 1,000 lines of the extracted script
function CP(val){/*console.println(val)*/}//Prints to the console
function GF(gfname){return getField(gfname);} //Returns a field object
function GV(gvname){CP("gv:"+gvname);return getField(gvname).value;} //Returns a field value
function GVS(gvsname){return getField(gvsname).valueAsString;} //Returns a field value as String
function SV(svname,val){/*console.println("sv" + svname)*/;getField(svname).value = val} //Sets the value for a field
function SF(fcname){getField(fcname).setFocus()} //Sets the focus to a field
function GN(gnname){return Number(getField(gnname).value)}//Returns a number; empty returns zero

//GET CENTS (GC)
function GC(fname){
	var result = ""
	var a = getField(fname).value
	if(a>0)result = "." + a
	return result
}

//ZPAD (Zero Pad)
//***************

function ZPAD(data,totalChars){
//This function adds leading zeros until length of data is the same as the parameter totalChars
	
	data = String(data)
	while(data.length<totalChars){data = '0' + data}
	return data
}

//CBX (Check Box Xport value)
//****************************

function CBX(fname){
var val = GV(fname)
if(val=="Off")val = "";
return val;
}

//GPF (General Purpose Formatting)
//**********************************

function GPF(val,index){

//set up an array of Regular Expressions that filters unwanted values
val = String(val)
var re = new Array();

re[0] = /[\"]/gi; //Nothing happens
re[1] = /[^a-z]/gi; //Only Alpha Characters
re[2] = /[^a-z-]/gi; //Only Alpha Characters + Hyphen
re[3] = /[^\d]/gi;//Only digits
re[4] = /[^a-z\s]/gi;//Only Alpha Characters + Space
re[5] = /[^\d.]/gi;//Only digits AND periods, used for percentage fields
re[6] = /[^a-z\s\d]/gi;//Only Alpha Characters + Space + Digits
re[7] = /[^\d-]/gi;//Only digits + Hyphen (ZIP codes) and negative numbers
re[8] = /[^a-z\d]/gi;//Only Alpha Characters + Digits - Account Number
//replace in original string passed

val = val.replace(re[index],"")

//convert to UpperCase
val = val.toUpperCase()

return val
}

//NNG = No Negative
function NNG(id){
	if(event.value>=.5){event.value = Math.round(event.value)}
	if(id!=1){
		if(event.value<0){
			event.value=0;
                        if(getField(event.target.name).readonly!=true){
        			app.alert("Sorry, negative numbers are not allowed in this field.");
                        }
		}
	}
}

function showCalcFields(val){
var flds = new Array()

flds = ["Field1","Field2"] //mock data.

	for(var j=0;j<flds.length;j++){
		var f = getField(flds[j])
		if(val){
			f.fillColor = ["RGB",1,1,.6]
			f.readonly = true
		}else{
			f.fillColor=color.transparent
			f.readonly = false
		}
	}
}

function FD(val){

//This function filters known unwanted data
//NWV stands for Not Wanted Values

var NWV = new Array()
val=String(val)
NWV = ['000000','00000','0000','000000000']

	for(var j=0;j<NWV.length;j++){
		var f = NWV[j]
		if(val==f) val='';
	}
return val
}

//We check for the passed value to have a number of characters
function CheckLength(data,datalen){
	if(data!=""){
		if(data.length!=datalen){
			app.alert("This field must be " + datalen + " characters long. Please enter the value again.\r\rThank you.")
			event.rc = false;
		}
	}
}

function UFilter(idx){
//Turns event value to caps
	event.value = GPF(event.value,idx)
}

//function ds_ks(){
////Turns event value to caps
//event.change = event.change.replace(/[^a-z\'\r\d\s\(\).-]/gi,"").toUpperCase()
//}

function ds_ks(datatype){
	//Used only in field keystroke events
	if(event.change!=""){
		switch (datatype){
			
			case "num":
				event.change = event.change.replace(/[^\d]/gi,"")
			break;
			
			case "numneg":
				//if(event.value=="-")event.change = event.change.replace(/[^\d]/gi,"")
				event.change = event.change.replace(/[^\d-]/gi,"")
			break;
			
			
			case "perc":
				event.change = event.change.replace(/[^\d.]/gi,"")
			break;
			
			case "state":
				event.change = event.change.replace(/[^a-z]/gi,"").toUpperCase()
			break;

			case "alpha":
				event.change = event.change.replace(/[^a-z\s]/gi,"").toUpperCase()
			break;

			case "wth":
				event.change = event.change.replace(/[^a-z\d]/gi,"").toUpperCase()
			break;
			
			case "T6":
				event.change = event.change.replace(/[^a-z\s\d.,-]/gi,"").toUpperCase()
			break;

			case "cst_md":
				event.change = event.change.replace(/[^a-z\s\d\'.-]/gi,"").toUpperCase()
			break;
		
			case "dt":
				event.change = event.change.replace(/[^\d-]/gi,"") //use Hyphens
				//event.change = event.change.replace(/[^\d\/]/gi,"") //use Dash
			break;
			
			case "email":
				event.change = event.change.replace(/[^a-z_\d.@\-]/gi,"").toUpperCase()
			break;
			
			case "web":
				event.change = event.change.replace(/[^a-z\_\d.:\-\/,]/gi,"").toUpperCase()
			break;
			
			case "phone":
				event.change = event.change.replace(/[^\d\s\(\)x+]/gi,"").toLowerCase()
			break;
		}
	}
}

function ds_format(datatype){
	//Used only in field format events
	switch (datatype){
		
		case "ssn":
			if(event.value!="" && event.value.length ==9){
				event.value = util.printx("XXX-XX-XXXX",event.value)
			}

		case "fein":
			if(event.value!="" && event.value.length ==9){
				event.value = util.printx("XX-XXXXXXX",event.value)
			}

		case "wth":
			if(event.value!="" && event.value.length ==9){
				event.value = util.printx("XXXXXXX-AA",event.value)
			}	
	
		break;
		
		case "usphone":
			if(event.value!="" && event.value.length ==10){
				event.value = util.printx("(XXX) XXX-XXXX",event.value)
			}
		break;

		case "zip54":
			if(event.value!="" && event.value.length ==9){
				event.value = util.printx("XXXXX-XXXX",event.value)
			}
		break;
				
	}
}
javascript_obj1424_043.js pdf-javascript-stream PDF /JS object 1424 at offset 0x3E49B 2740 bytes
SHA-256: 3e43143246bb79ea4b6f69e4dfde751c936983a72a42405cf8db756090e1065d
Preview script
First 1,000 lines of the extracted script
//CALL WITH: dotheDialog( dialog4, this );

function dotheDialog(dialog,doc){
	dialog.doc = doc;
	var retn = app.execDialog( dialog )	
}

var txt1 = "\rMARYLAND FORM 502-502B : INSTRUCTIONS\r\r "
    txt1 += "- As a service to you, this form along with all other forms available on our website are provided in a fill-in format. Just key in your data prior to printing the form.\r\r"
    txt1 += "- When the form is printed, a two dimensional (2D) barcode is generated that includes the data entered on the form. The use of a 2D barcode vastly improves on the time it takes to process your form.\r\r"
    txt1 += "- If you choose to use the fill-in option, please do not handwrite any other data on the form other than your signature.\r\r"
    txt1 += "- Please use the print button above to print the form once filled. If you need a blank form, just print without entering any data.\r\r"
    txt1 += "- If keyed data prints illegible, please update to the most recent version of Adobe Acrobat Reader.\r\r"


var dialog4 = {

	initialize: function(dialog){
		dialog.load
		({
			 "sta2": txt1,
		})
	},
	
	subl: function(dialog){
		console.println("Selection Box Hit");
	},
				cncl: function (dialog)
				{ 
					dialog.end("cancel")
				},
				// Dialog box description
				description:
				{
					name: "Maryland Form 502-502B Instructions",
					first_tab: "cncl",
					elements:[
											{
												type: "view",
												align_children: "align_right",
												elements:[
																	{
																		type: "view",
																		align_children: "align_right",
																		elements:[
																								{type: "button", item_id: "cncl",name: "Close window"},
																								//{type: "button",item_id: "butn",name: "Select"}
																						 ]
																	},
																	{
																		type: "cluster",
																		name: "Maryland Form 502-502B : Resident Income Tax Return",
																		elements:[
																								{type: "edit_text",
																								 name: "hello",
																								 item_id: "sta2",
																								 height:400,
																								 multiline: true,
																								 readonly: true,
																								 char_width: 60,
																								 font: "dialog"																								 
																								},
																								//{type: "hier_list_box",item_id: "subl",char_width: 100,height: 200}
																						]
																	}
																	
															   ]
											}
									]
				}
	};


var chk_once
if(!chk_once){
	chk_once=true
		dotheDialog( dialog4, this );
}
javascript_obj1425_044.js pdf-javascript-stream PDF /JS object 1425 at offset 0x3E8F5 6291 bytes
SHA-256: a11122e84af5dba51cb5590b937133b0bfe5a8a0c0de7275c32f422e7cfde57a
Preview script
First 1,000 lines of the extracted script
function SY(){
	calculate = true
	GF("printlid").display = 3 //hidden + printable
//	hideFieldColor(true)
	
	var fld=GF(event.target.name)
	var col = ['RGB',.7,.9,1]	
	switch(fld.type){
		case 'checkbox':
		fld.fillColor = col
		break;
		case 'radiobutton':
		fld.fillColor = col
		break;
		case 'combobox':
		fld.fillColor = col
		break;
		case 'text':
		fld.fillColor = col
		break;
		case 'button':
		fld.strokeColor = ['RGB',1,0,0]
		break;
	}
	if(fld.strokeColor=="RGB,1,0,0")fld.strokeColor = ["T"]
}

function SN(){
//SN is 'Show No'
	calculate = true
	var fld=GF(event.target.name)
	var col =  ['T']//['G',.97]//['RGB',.9,0.9,.7]

	switch(fld.type){
		case 'checkbox':
		fld.fillColor = col
		break;
		case 'radiobutton':
		fld.fillColor = col
		break;
		case 'text':
		fld.fillColor = col
		break;
		case 'combobox':
		fld.fillColor = col
		break;
		case 'button':
		fld.textColor = color.white
		fld.strokeColor = color.transparent
		break;
	}
}

function myFields(){
	
var a = new Array()

a.push(["RTNUMBER"])
a.push(["ACCNUMBER"])
a.push(["502B_FEIN"])
a.push(["502B_TOTALBOXES"])
a.push(["ADDRESS"])
a.push(["AccountOutsideUSA"])
a.push(["AccountTypeChecking"])
a.push(["AddressTelephoneOfPreparer"])
a.push(["AuthorizeNotEfile"])
a.push(["AuthorizeToDiscuss"])
a.push(["AuthorizeToDiscussMedical"])
a.push(["CB_DEDUCT_TYPE"])
a.push(["CB_FS"])
a.push(["CITY"])
a.push(["CodeNumber1"])
a.push(["CodeNumber2"])
a.push(["CodeNumber3"])
a.push(["DP_65_1"])
a.push(["DP_65_2"])
a.push(["DP_65_3"])
a.push(["DP_65_4"])
a.push(["DP_65_5"])
a.push(["DP_CHILD1"])
a.push(["DP_CHILD2"])
a.push(["DP_CHILD3"])
a.push(["DP_CHILD4"])
a.push(["DP_CHILD5"])
a.push(["DP_FNAME1"])
a.push(["DP_FNAME2"])
a.push(["DP_FNAME3"])
a.push(["DP_FNAME4"])
a.push(["DP_FNAME5"])
a.push(["DP_LNAME1"])
a.push(["DP_LNAME2"])
a.push(["DP_LNAME3"])
a.push(["DP_LNAME4"])
a.push(["DP_LNAME5"])
a.push(["DP_MEDINS1"])
a.push(["DP_MEDINS2"])
a.push(["DP_MEDINS3"])
a.push(["DP_MEDINS4"])
a.push(["DP_MEDINS5"])
a.push(["DP_MINIT1"])
a.push(["DP_MINIT2"])
a.push(["DP_MINIT3"])
a.push(["DP_MINIT4"])
a.push(["DP_MINIT5"])
a.push(["DP_REG1"])
a.push(["DP_REG2"])
a.push(["DP_REG3"])
a.push(["DP_REG4"])
a.push(["DP_REG5"])
a.push(["DP_REL1"])
a.push(["DP_REL2"])
a.push(["DP_REL3"])
a.push(["DP_REL4"])
a.push(["DP_REL5"])
a.push(["DP_SSN1"])
a.push(["DP_SSN2"])
a.push(["DP_SSN3"])
a.push(["DP_SSN4"])
a.push(["DP_SSN5"])
a.push(["DayPhone"])
a.push(["ExemptSpouse"])
a.push(["ExemptTotal_A"])
a.push(["ExemptTotal_B"])
a.push(["ExemptTotal_C"])
a.push(["ExemptTotal_D"])
a.push(["ExemptYourself"])
a.push(["ExemptionAmount_A"])
a.push(["ExemptionAmount_B"])
a.push(["ExemptionAmount_C"])
a.push(["ExemptionAmount_D"])
a.push(["FiscalYearBeginning"])
a.push(["FiscalYearEnding"])
a.push(["ForLateFiling"])
a.push(["HomePhone"])
a.push(["InterestCharge"])
a.push(["Line1"])
a.push(["Line10"])
a.push(["Line10C"])
a.push(["Line11"])
a.push(["Line11C"])
a.push(["Line12"])
a.push(["Line12C"])
a.push(["Line13"])
a.push(["Line13C"])
a.push(["Line14"])
a.push(["Line14C"])
a.push(["Line15"])
a.push(["Line15C"])
a.push(["Line16"])
a.push(["Line16C"])
a.push(["Line17"])
a.push(["Line17A"])
a.push(["Line17AC"])
a.push(["Line17B"])
a.push(["Line17BC"])
a.push(["Line17C"])
a.push(["Line18"])
a.push(["Line18C"])
a.push(["Line19"])
a.push(["Line19C"])
a.push(["Line1A"])
a.push(["Line1AC"])
a.push(["Line1B"])
a.push(["Line1BC"])
a.push(["Line1C"])
a.push(["Line2"])
a.push(["Line20"])
a.push(["Line20C"])
a.push(["Line21"])
a.push(["Line21C"])
a.push(["Line22"])
a.push(["Line22C"])
a.push(["Line23"])
a.push(["Line23C"])
a.push(["Line24"])
a.push(["Line24C"])
a.push(["Line25"])
a.push(["Line25C"])
//a.push(["Line26"])
//a.push(["Line26C"])
a.push(["Line27"])
a.push(["Line27C"])
a.push(["Line28"])
a.push(["Line28C"])
a.push(["Line29"])
a.push(["Line29C"])
a.push(["Line2C"])
a.push(["Line3"])
a.push(["Line30"])
a.push(["Line30C"])
a.push(["Line31"])
a.push(["Line31C"])
a.push(["Line32"])
a.push(["Line32C"])
a.push(["Line33"])
a.push(["Line33C"])
a.push(["Line34"])
a.push(["Line34C"])
a.push(["Line35"])
a.push(["Line35C"])
a.push(["Line36"])
a.push(["Line36C"])
a.push(["Line37"])
a.push(["Line37C"])
a.push(["Line38"])
a.push(["Line38C"])
a.push(["Line39"])
a.push(["Line39C"])
a.push(["Line3C"])
a.push(["Line4"])
a.push(["Line40"])
a.push(["Line40C"])
a.push(["Line41"])
a.push(["Line41C"])
a.push(["Line42"])
a.push(["Line42C"])
a.push(["Line43"])
a.push(["Line43C"])
a.push(["Line44"])
a.push(["Line44C"])
a.push(["Line45"])
a.push(["Line45C"])
a.push(["Line46"])
a.push(["Line46C"])
a.push(["Line47"])
a.push(["Line47C"])
a.push(["Line48"])
a.push(["Line48C"])
a.push(["Line49"])
a.push(["Line49C"])
a.push(["Line4C"])
a.push(["Line5"])
a.push(["Line5C"])
a.push(["Line6"])
a.push(["Line6C"])
a.push(["Line7"])
a.push(["Line7C"])
a.push(["Line8"])
a.push(["Line8C"])
a.push(["Line9"])
a.push(["Line9C"])
a.push(["LocalTaxRate2"])
a.push(["LocalTaxRate3"])
a.push(["LocalTaxRate4"])
a.push(["MDCOUNTY"])

a.push(["Other state of residence"])

a.push(["OtherAdditions1"])
a.push(["OtherAdditions2"])
a.push(["OtherAdditions3"])
a.push(["OtherAdditions4"])

a.push(["OtherSubstractions1"])
a.push(["OtherSubstractions2"])
a.push(["OtherSubstractions3"])
a.push(["OtherSubstractions4"])

a.push(["PartYearResFromDay"])
a.push(["PartYearResFromMonth"])
a.push(["PartYearResFromYear"])

a.push(["PartYearResToDay"])
a.push(["PartYearResToMonth"])
a.push(["PartYearResToYear"])

a.push(["PartYearResidentCheck"])

a.push(["Prefer_1099G"])
a.push(["PreparerSSN"])
a.push(["SP_FIRSTNAME"])
a.push(["SP_FS_SSN"])
a.push(["SP_LASTNAME"])
a.push(["SP_MINIT"])
a.push(["SP_SSN"])
a.push(["STATE"])
a.push(["Spouse65"])
a.push(["SpouseBlind"])
a.push(["SpouseDateSigned"])
a.push(["TAXINGAREA"])
a.push(["TP_FIRSTNAME"])
a.push(["TP_LASTNAME"])
a.push(["TP_MINIT"])
a.push(["TP_SSN"])
a.push(["YourDateSigned"])
a.push(["Yourself65"])
a.push(["YourselfBlind"])
a.push(["ZIP"])
a.push(["military"])

return a;
	
}
javascript_obj1426_045.js pdf-javascript-stream PDF /JS object 1426 at offset 0x3EE83 1337 bytes
SHA-256: 5a16e6f25332f36744b04043546724a224c44001afd88d820e1d9071828dd3bb
Preview script
First 1,000 lines of the extracted script
function CheckRequired(){
//If the function returns true, means success. It cleared all the validation controls
//else, it returns false

var result = true
var f = new Array()

f.push(["TP_SSN",""])
f.push(["TP_FIRSTNAME",""])
f.push(["TP_LASTNAME",""])
f.push(["ADDRESS",""])
f.push(["STATE",""])
f.push(["ZIP",""])
f.push(["CITY",""])
f.push(["ExemptTotal_D",""])
f.push(["CB_DEDUCT_TYPE","Off"])
f.push(["CB_FS","Off"])

//f.push(["MarylandCounty",""])
//f.push(["CityTownOrTaxingArea",""])

//Add here additional required fields. Make sure to increase the Array index.

//First, let us check if ALL of them are empty at once
	var count = 0
	for(var i=0;i<f.length;i++){
		if(getField(f[i][0]).value==f[i][1]) count++
	}
	
	if(count == f.length) result = "blank"
	//If count is equal to the array length means all fields are empty
	//so.. we let the user print a blank form
	else{
		for(var i=0;i<f.length;i++){
			if(getField(f[i][0]).valueAsString==f[i][1]){
				getField(f[i][0]).strokeColor = color.red
				result = false
			}
			else{
				getField(f[i][0]).strokeColor = color.transparent
			}
		}
		
		if(!result){
			app.alert("Required fields have been marked with a red border. These fields must be filled prior to print the form. Thank you.")
		}
	}
return result;
}
javascript_obj1427_046.js pdf-javascript-stream PDF /JS object 1427 at offset 0x3F159 6095 bytes
SHA-256: 542efef7619bbe544d6a0d1594c7058ee4871c956accfb54da27006c9b709afb
Preview script
First 1,000 lines of the extracted script
//Source Code Copyright � 2001-2010 Dataintro Software - All rights reserved.
//Contact us at: info@dataintro.com. Ultraforms� Technology is Patent pending.

var gstream = ""
var glote = ""

function GATHER_A(){
	
var  UF_Text = "" ;

//Choose Delimiter
//**************************
	var UFs = "\r";
//**************************

UF_Text += "T1" + UFs; //Header Version
UF_Text += "1258" + UFs; //Dataintro Software Developers Code
UF_Text += "MD" + UFs; //Jurisdiction
UF_Text += "502" + UFs; //Form
UF_Text += "01" + UFs; //Spec
UF_Text += "00" + UFs; //Version (Year)

UF_Text += ZPAD(GVS('TP_SSN'),9) + UFs;
UF_Text += FD(ZPAD(GVS('SP_SSN'),9)) + UFs;

UF_Text += GVS('TP_LASTNAME') + UFs;
UF_Text += GVS('TP_FIRSTNAME') + UFs;
UF_Text += GVS('TP_MINIT') + UFs;

UF_Text += GVS('SP_LASTNAME') + UFs;
UF_Text += GVS('SP_FIRSTNAME') + UFs;
UF_Text += GVS('SP_MINIT') + UFs;

//Street Address: if longer than 30, separate it in two pieces of 30 char each
var a = GVS('ADDRESS')
if(a.length<31) UF_Text += a + UFs + UFs;
else {
	UF_Text += a.substr(0,30) + UFs;
	UF_Text += a.substr(30,a.length-30) + UFs;
}

UF_Text += GVS('CITY') + UFs;
UF_Text += GVS('STATE') + UFs;
UF_Text += GVS('ZIP') + UFs;

//Filing Status
for(var i=1;i<7;i++){
	var val = GV('CB_FS')
	if(val==i)UF_Text += val + UFs;
	else UF_Text += "" + UFs;
}	

UF_Text += GVS('SP_FS_SSN') + UFs;

UF_Text += GVS('PartYearResidentCheck') + UFs;

UF_Text += CBX('Yourself65') + UFs;
UF_Text += CBX('YourselfBlind') + UFs;
UF_Text += CBX('Spouse65') + UFs;
UF_Text += CBX('SpouseBlind') + UFs;
UF_Text += GV('ExemptTotal_D') + UFs;

UF_Text += GV('Line1') + UFs;
UF_Text += GV('Line1A') + UFs;
UF_Text += GV('Line1B') + UFs;
UF_Text += GV('Line1C') + UFs;
UF_Text += GV('Line1D') + UFs;
UF_Text += CBX('CHK1E') + UFs;

UF_Text += GV('Line2') + UFs;
UF_Text += GV('Line3') + UFs;
UF_Text += GV('Line4') + UFs;
UF_Text += GVS('OtherAdditions1') + UFs;
UF_Text += GVS('OtherAdditions2') + UFs;
UF_Text += GVS('OtherAdditions3') + UFs;
UF_Text += GVS('OtherAdditions4') + UFs;
UF_Text += GV('Line5') + UFs;
UF_Text += GV('Line6') + UFs;
UF_Text += GV('Line8') + UFs;
UF_Text += GV('Line9') + UFs;
UF_Text += GV('Line10') + UFs;
UF_Text += GV('Line11') + UFs;
UF_Text += GV('Line12') + UFs;
UF_Text += GVS('OtherSubstractions1') + UFs;
UF_Text += GVS('OtherSubstractions2') + UFs;
UF_Text += GVS('OtherSubstractions3') + UFs;
UF_Text += GVS('OtherSubstractions4') + UFs;
UF_Text += GV('Line13') + UFs;
UF_Text += GV('Line14') + UFs;
UF_Text += GV('Line15') + UFs;

var a = CBX("CB_DEDUCT_TYPE")

if(a=="S")UF_Text += "S" + UFs + "" + UFs;
else if(a=="I")UF_Text += "" + UFs + "I" + UFs ;
else UF_Text += "" + UFs + "" + UFs ;

UF_Text += GV('Line17A') + UFs;
UF_Text += GV('Line17B') + UFs;
UF_Text += GV('Line17') + UFs;

//Page 2
UF_Text += GV('Line23') + UFs;
UF_Text += GV('Line24') + UFs;
UF_Text += GV('Line35') + UFs;
UF_Text += GV('Line36') + UFs;
UF_Text += GV('Line37') + UFs;
UF_Text += GV('Line39') + UFs;

UF_Text += GV('Line40')  + UFs;
UF_Text += GV('Line41')  + UFs;
UF_Text += GV('Line44')  + UFs;
UF_Text += GV('Line45')  + UFs;
UF_Text += GV('Line46')  + UFs;
UF_Text += GV('Line47')  + UFs;
UF_Text += GV('Line47C')  + UFs;
UF_Text += GV('Line48')  + UFs;

//FOREIGN
UF_Text += CBX('AccountOutsideUSA') + UFs;

// ACCTYPE
var a = CBX('AccountTypeChecking')

if(a=="C")UF_Text += "C" + UFs + "" + UFs; //CHECKING
else if(a=="S")UF_Text += "" + UFs + "S" + UFs; //SAVINGS
else 	UF_Text += "" + UFs + "" + UFs; //BLANK

//RT NUM

UF_Text += GVS("RTNUMBER") + UFs;

//ACC NUM
UF_Text += GVS("ACCNUMBER") + UFs;

UF_Text += GVS('DayPhone').replace("-","") + UFs;

var a = ZPAD(GVS('CodeNumber1'),3)
var b = ZPAD(GVS('CodeNumber2'),3)
var c = ZPAD(GVS('CodeNumber3'),3)

if (a=="000"){
	a=""
	b=""
	c=""
}

if (b=="000"){
	b=""
	c=""
}
if (c=="000")c=""

var CodeNumber = a + b + c
UF_Text += CodeNumber + UFs

UF_Text += CBX('AuthorizeNotEfile') + UFs;
UF_Text += CBX('Prefer_1099G') + UFs;
UF_Text += GVS('PreparerSSN')+ UFs;

UF_Text += "*EOD*" + UFs;

gstream = UF_Text
glote = "A"

//UF_Text = UF_Text.replace(/[^a-z\'\r\d\s\(\).\*\-]/gi,"")
}

function GATHER_B(){
	
var  UF_Text = "" ;

//Choose Delimiter
//**************************
	var UFs = "\r";
//**************************

UF_Text += "T1" + UFs; //Header Version
UF_Text += "1258" + UFs; //Dataintro Software Developers Code
UF_Text += "MD" + UFs; //Jurisdiction
UF_Text += "502B" + UFs; //Form
UF_Text += "01" + UFs; //Spec
UF_Text += "00" + UFs; //Version (Year)

UF_Text += GV('502B_TOTALBOXES_REG')+ UFs;
UF_Text += GV('502B_TOTALBOXES_65')+ UFs;

for (var i=1;i<13;i++){
	UF_Text += GV('DP_LNAME'+i) + UFs
	UF_Text += GVS('DP_SSN'+i) + UFs
}

UF_Text += "*EOD*" + UFs;

gstream = UF_Text
glote = "B"
}

function UF_SetStream(){



var quest =  "E" + app.viewerVersion 
quest += "V" + app.formsVersion 
quest += "P" + app.platform.substr(0,1)
quest += "T" + app.viewerType.length 
quest += "L" + gstream.length

SV("count",quest)

//End of custom script
//Do not edit the script below this line

return gstream; //multibarcode
}

function UF_CodePage(){
//***************************
//*DO NOT EDIT THIS FUNCTION*
//***************************
UFG_byteChar1=" !\"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~";
UFG_byteChar2="������������.��������������������������������������������������������������������������������� ~";
}

//function resetBarcode(){
//	var iconA = getField("UF_Reset").buttonGetIcon()
//	var levels = 8
//	for(var i=1;i<(levels+1);i++){getField("UF_L"+i).buttonSetIcon(iconA)}
//}

function resetBarcode(){
	var iconA = getField("UF_Reset").buttonGetIcon();var levels = 8;
	var lote = new Array("A","B")
	for(var z=0;z<lote.length;z++){
		for(var i=1;i<(levels+1);i++){getField("UF_L"+i+lote[z]).buttonSetIcon(iconA)}}
	}
javascript_obj1428_047.js pdf-javascript-stream PDF /JS object 1428 at offset 0x3F92D 545 bytes
SHA-256: d5acb1b828a331ccc96ff6fa35c70f9e43749abbd5715377c5f7122a2356bd54
Preview script
First 1,000 lines of the extracted script
//Source Code Copyright � 2001-2006 Dataintro Software S.L. - All rights reserved.
//Contact us at: info@ultraforms.com. Ultraforms� Technology is Patent pending.
function UFOOOOOxa(UFxOOOOOb,UFOxOOOOb){var ufOOxOOOd=0;switch (UFxOOOOOb){case "ufxxOOOOa":if(UFOxOOOOb=="ufOOOxxxa"){ufOOxOOOd=865}break;case "ufxOOxOOa":if(UFOxOOOOb=="ufxxOOOOa"){ufOOxOOOd=868}else if(UFOxOOOOb=="ufOOOxxxa"){ufOOxOOOd=865}break;case "ufOOOxxxa":if(UFOxOOOOb=="ufxOOxOOa"){ufOOxOOOd=897}else if(UFOxOOOOb=="ufxOxOOOa"){ufOOxOOOd=898}break;}return ufOOxOOOd;}
javascript_obj1429_048.js pdf-javascript-stream PDF /JS object 1429 at offset 0x3FA94 962 bytes
SHA-256: b19620c16ac59e504c60bcac849a796085b9f84d6873c4941946b644acdba16f
Preview script
First 1,000 lines of the extracted script
//Source Code Copyright � 2001-2006 Dataintro Software S.L. - All rights reserved.
//Contact us at: info@ultraforms.com. Ultraforms� Technology is Patent pending.
function UFOOOOxOa(h){var ufxxOOOOa="ABCDEFGHIJKLMNOPQRSTUVWXYZ ";var ufxOOxOOa="abcdefghijklmnopqrstuvwxyz ";var ufxOxOOOa="0123456789&\r\t,:#-.$/+%*=^";var ufOOOxxxa=";<>@[\\]_`~!\r\t,:\n-.$/\"|*()?{}\'";var x;switch(ufga00x000){case "ufxxOOOOa" :x = ufxxOOOOa.indexOf(h);ufgOOxOxxa="ufxxOOOOa";break;case "ufxOOxOOa" :x = ufxOOxOOa.indexOf(h);ufgOOxOxxa="ufxOOxOOa";break;case "ufOOOxxxa" :x = ufOOOxxxa.indexOf(h);ufgOOxOxxa="ufOOOxxxa";break;case "ufxOxOOOa":x = ufxOxOOOa.indexOf(h);if(x==25){x=26}ufgOOxOxxa="ufxOxOOOa";break;}if(x==-1){ufgOOxOxxa= "ufxxOOOOa";x = ufxxOOOOa.indexOf(h);if(x==-1){x =ufxOOxOOa.indexOf(h);ufgOOxOxxa="ufxOOxOOa";if(x==-1){x = ufOOOxxxa.indexOf(h);ufgOOxOxxa="ufOOOxxxa";if(x==-1){x = ufxOxOOOa.indexOf(h);if(x==25){x=26}ufgOOxOxxa="ufxOxOOOa";}}}}return x;}
javascript_obj1430_049.js pdf-javascript-stream PDF /JS object 1430 at offset 0x3FCA8 1470 bytes
SHA-256: 72b6c06aa287a340fd917c104d57b64d9b90a409c8d39281faa4c8fda6b33516
Preview script
First 1,000 lines of the extracted script
//Source Code Copyright � 2001-2006 Dataintro Software S.L. - All rights reserved.
//Contact us at: info@ultraforms.com. Ultraforms� Technology is Patent pending.
function UFOOOOxxa(){UFaOOOOOx();var xOOOxOa=String(UF_SetStream());xOOOxOa=xOOOxOa.substr(0,600);for(var i=0;i<xOOOxOa.length;i++){var temp ="";var temp1 ="";var u=0;var UFOOOxOOc=UFOOOxOOa(xOOOxOa.charAt(i+u));var UFOOxOOOc = false;while(UFOOOxOOc&&!UFOOxOOOc){temp=temp+xOOOxOa.charAt(i+u);u++;UFOOOxOOc=UFOOOxOOa(xOOOxOa.charAt(i+u));if(temp.length == 15){UFOOOxOOc=false}if(u==xOOOxOa.length){UFOOxOOOc = true}if((i+u)==xOOOxOa.length){UFOOxOOOc = true}}UFOOxOOOc = false;if(temp.length>5){UFOxOOOOa(temp);i=i+u-1;}else{var temp= "";var text= UFOOxOOOa(xOOOxOa.charAt(i));var u = 0;while(text&&!UFOOxOOOc){temp=temp + temp1;temp1 =xOOOxOa.charAt(i+u);if(UFaOxOOxx(xOOOxOa.substr(i+u,13))){u--;text=false}else if(!UFOOxOOOa(temp1)){u--;text=false}if(u==xOOOxOa.length){UFOOxOOOc = true}if((i+u)==xOOOxOa.length){UFOOxOOOc = true}u++;}var temp1="";UFOOxOOOc = false;if(temp.length>4){UFOOxOOxa(temp);i=i+u-1;}else{var bytechar= true;while(bytechar&&!UFOOxOOOc){temp=temp + temp1;temp1 =xOOOxOa.charAt(i+u);if(UFaOxOOxx(xOOOxOa.substr(i+u,13))){u--;bytechar=false}else if(UFaxOOOxx(xOOOxOa.substr(i+u,6))){u--;bytechar=false}if(u==xOOOxOa.length){UFOOxOOOc = true}if((i+u)==xOOOxOa.length){UFOOxOOOc = true}u++;}UFOOxOOOc = false;UFaOOxOOO(temp);i=i+u-1;if((i+u)==xOOOxOa.length){UFOOxOOOc = true}}}}}