Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7bbc134f384c817…

MALICIOUS

PDF

3.02 MB Created: 2021-04-08 16:29:00 UTC Authoring application: Microsoft Office Word (via Aspose.Words for Java 17.6) First seen: 2021-07-13
MD5: cbbf7d6f3039b4160103d63b400f79d0 SHA-1: 8c41c66af63e3fe81b250251224bc02e3903b984 SHA-256: e7bbc134f384c8172834637b7ebba0a277cc82c84b167ecdf6f93d04ae49ff6c
148 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript that is flagged as an exploit cluster, indicating an attempt to leverage a vulnerability. The JavaScript's behavior is described as 'heap_spray', often used in exploit chains. While the document body is unreadable, the presence of JavaScript and exploit heuristics strongly suggests an attempt to execute malicious code. The extracted URLs, particularly the obfuscated 'https://)1(w)-1(ww.raiffeisen.ro/retea)-1(/', are suspicious and likely part of the attack chain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5392

Heuristics 8

  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
    2 0 obj
    <</Type/Catalog/Pages 3 0 R/Lang(en-US)/OpenAction<</S/JavaScript/JS(var libbcmath={PLUS:"+",MINUS:"-",BASE:10,scale:0,bc_num:function\(\){this.n_sign=null;this.n_len=null;this.n_scale=null;this.n_value=null;this.toString=function\(\){var b,a;a=this.n_value.join\(""\);b=\(\(this.n_sign==libbcmath.PLUS\)?"":this.n_sign\)+a.substr\(0,this.n_len\);if\(this.n_scale>0\){b+="."+a.substr\(this.n_len,this.n_scale\)}return b};this.setScale=function\(a\){while\(this.n_scale<a\){this.n_value.push\(0\);this …
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.raiffeisen.ro/imm/in-sprijinul-tau/informatii-utile/ PDF link annotation
    • http://www.raiffeisen.ro/despre-noi/politica-de-confidentialitate/In PDF document text
    • https://www.raiffeisen.ro/despre-noi/cine-suntem/raiffeisen-bank-international/In PDF document text
    • https://www.raiffeisen.ro/retea/In PDF document text
    • https://www.raiffeisen.ro/despre-In PDF document text
    • https://www.raiffeisen.ro/despre-noi/cine-In PDF document text
    • https://)1(w)-1(ww.raiffeisen.ro/retea)-1(/Referenced by PDF JavaScript
    • http://www.monotype.comMonotypeReferenced by PDF JavaScript
    • http://www.monotype.comHowardReferenced by PDF JavaScript
    • https://)1(w)-1(ww.raiffeisen.ro/imm/in)-1(-sprijinu)-1(l-tau/informatii-u)-1(t)1(i)-1(le/Referenced by PDF JavaScript
    • https://)1(w)-1(ww.raiffeisen.ro/de)-1(spre-Referenced by PDF JavaScript
    • https://)1(w)-1(ww.raiffeisen.ro/retea/Referenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_couriernew.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlReferenced by PDF JavaScript
    • http://en.wikipedia.org/wiki/MIT_LicenseReferenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XReferenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TReferenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0Referenced by PDF JavaScript
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aReferenced by PDF JavaScript
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0Referenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0Referenced by PDF JavaScript
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@Referenced by PDF JavaScript
    • http://www.microsoft.com/Typography/0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In PDF document text
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In PDF document text

Extracted artifacts 30

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0101_000.js pdf-javascript-stream PDF /JS object 101 at offset 0x124858 819 bytes
SHA-256: a4828312f595fa69969f273c6f46600f08430243ae951e4639b991f59a997037
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 24;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {
	event.value = event.value.toUpperCase();
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters
				+ ' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
	if (event.value.length > 0) {
		var matching = event.value.match(alfanumericRegex);
		if (matching == null) {
			app.alert("Introduceti doar caractere alfanumerice!");
			field.strokeColor = color.red;
		} else {
			field.strokeColor = color.black;
			this.getField("documentProducer").value = "G";
		}
	} else {
		field.strokeColor = color.black;
		this.getField("documentProducer").value = "G";
	}
	generateBarcode();
}
javascript_obj0112_001.js pdf-javascript-stream PDF /JS object 112 at offset 0x24F702 818 bytes
SHA-256: 0e4e6a2409405cf53c3f7247d2e441f477b49e28a6bcdb70a105781376cb7084
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 6;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {
	event.value = event.value.toUpperCase();
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters
				+ ' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
	if (event.value.length > 0) {
		var matching = event.value.match(alfanumericRegex);
		if (matching == null) {
			app.alert("Introduceti doar caractere alfanumerice!");
			field.strokeColor = color.red;
		} else {
			field.strokeColor = color.black;
			this.getField("documentProducer").value = "G";
		}
	} else {
		field.strokeColor = color.black;
		this.getField("documentProducer").value = "G";
	}
	generateBarcode();
}
javascript_obj0133_002.js pdf-javascript-stream PDF /JS object 133 at offset 0x2526DF 656 bytes
SHA-256: 357ac1b8756a275aea839a1e41f2c02b52d9a22f215b82825e907a3ab2a2ef13
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 45;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0136_003.js pdf-javascript-stream PDF /JS object 136 at offset 0x252C83 655 bytes
SHA-256: 25e3c7a495fb2dfa3cc773ff68c3827b7d6c7a0315d02650f9c21e571fbb3c7a
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 6;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0142_004.js pdf-javascript-stream PDF /JS object 142 at offset 0x2537C3 655 bytes
SHA-256: 8f788739670419f56a746328549f6401093057413295cb0c9b2c38732fac2d07
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 3;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0145_005.js pdf-javascript-stream PDF /JS object 145 at offset 0x253D66 655 bytes
SHA-256: 55f8a09e6a6956aaa538de612595e62d0923831409e3a3963e606d63daa5a7bb
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 4;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0148_006.js pdf-javascript-stream PDF /JS object 148 at offset 0x254309 655 bytes
SHA-256: 0603f23604100bb5654893fad0e87ad35eb06b91760d2d57f3b142d9f8b42362
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 2;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0151_007.js pdf-javascript-stream PDF /JS object 151 at offset 0x2548AE 656 bytes
SHA-256: 19aabcd651111650b0647840faf699d8ad0d7d63bbbd9f038ba4aa1da770dd79
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 35;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0154_008.js pdf-javascript-stream PDF /JS object 154 at offset 0x254E54 656 bytes
SHA-256: 27356a0b68c50db86a649e362029115f4cf116e447eec5e903af561b7cc97d72
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 20;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0181_009.js pdf-javascript-stream PDF /JS object 181 at offset 0x258127 656 bytes
SHA-256: 5ed69f2faa45e6d80a1cbfbc3aa91eb1bcdd0649056ff5768879c7441757de9d
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 15;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0190_010.js pdf-javascript-stream PDF /JS object 190 at offset 0x259230 656 bytes
SHA-256: cdbd4749cd2853449a4ae5ede5d2ddb7a3e6efd294faa29ea3fcbb4de4974a42
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 50;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0196_011.js pdf-javascript-stream PDF /JS object 196 at offset 0x259D6D 656 bytes
SHA-256: 4161654d839d0faad9624000c06468fcb706e4e8538c855a49b021ba2f3d3a31
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 25;
var alfanumericRegex = "[0-9,a-z,A-Z\s]+";
if (event.value != null) {	
    if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim '+ maxCharacters +' (de) caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    var matching = event.value.match(alfanumericRegex);
    if (matching == null) {
    	app.alert("Introduceti doar caractere alfanumerice!");
    	field.strokeColor = color.red;
    } else{
    	field.strokeColor = color.black;
    	this.getField("documentProducer").value="G";
    }
    generateBarcode();
}
javascript_obj0202_012.js pdf-javascript-stream PDF /JS object 202 at offset 0x25A8C2 717 bytes
SHA-256: bd4b316e8cb960a5bb50b8c2f42a373607be4051769a0fb3b68b36b03078c274
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 40;
var lettersAndSpaces = /^[a-zA-Z\s]*$/;
if (event.value != null) {
	var valid = true;
	event.value = event.value.toUpperCase();
	if (field.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters
				+ ' de caractere!');
		field.value = event.value.substring(0, maxCharacters);
	}
	if (event.value.length > 0) {
		var matching = event.value.match(lettersAndSpaces);
		if (matching == null) {
			valid = false;
			app.alert('Campul trebuie sa contina doar litere!');
			field.strokeColor = color.red;
		}
	}
	if (valid == true) {
		field.strokeColor = color.black;
	}
	generateBarcode();
}
javascript_obj0238_013.js pdf-javascript-stream PDF /JS object 238 at offset 0x25F508 671 bytes
SHA-256: aa1b257dae128284ca8a236affc9eec8d0ac34d36cca63604684fc746a3453f0
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 20;
var lettersAndSpaces = /^[a-zA-Z\s]*$/;
if (event.value != null) {	
	var valid = true;
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters + ' de caractere!');
		event.value = event.value.substring(0, maxCharacters);
	} 
	if(event.value.length>0){
		var matching = event.value.match(lettersAndSpaces);
	    if (matching == null) {
	    	valid = false;
			app.alert('Campul trebuie sa contina doar litere!');
			field.strokeColor = color.red;
		}
	}
	if(valid == true){
		field.strokeColor = color.black;
	}
	generateBarcode();
}
javascript_obj0244_014.js pdf-javascript-stream PDF /JS object 244 at offset 0x260123 998 bytes
SHA-256: 78b099c02d2a467d0ca6ba37596043c8bb8f9ff30e3d9681fa333155f26c6456
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
function checkCnp() {
	if (event.value != null || event.value.length != 0) {
		var documentProducerField = this.getField("documentProducer");
		if (documentProducerField != null)
			documentProducerField.value = "G";
		var i = 0, year = 0, hashResult = 0, cnp = [], hashTable = [ 2, 7, 9,
				1, 4, 6, 3, 5, 8, 2, 7, 9 ];
		for (i = 0; i < 13; i++) {
			cnp[i] = parseInt(event.value.charAt(i), 10);
			if (isNaN(cnp[i])) {
				app.alert('CNP incorect!');
				field.strokeColor = color.red;
				return -1;
			} else {
				if (i < 12) {
					hashResult = hashResult + (cnp[i] * hashTable[i]);
				}
			}
		}
		hashResult = hashResult % 11;
		if (hashResult === 10) {
			hashResult = 1;
		}
		if (cnp[12] !== hashResult) {
			app.alert('CNP-ul introdus nu este valid!');
			field.strokeColor = color.red;
			return -1;
		} else {
			field.strokeColor = color.black;
			generateBarcode();
			return 0;
		}
	}
}
checkCnp();
javascript_obj0259_015.js pdf-javascript-stream PDF /JS object 259 at offset 0x262B4A 1459 bytes
SHA-256: 231e7a36238340427b73d5eada9e414bb6e58bfbabb4ec9b93d2cc7d7ff6173b
Preview script
First 1,000 lines of the extracted script
var field = event.target;
validareCIF(event.value);

function validareCIF(s) {
	event.value = event.value.toUpperCase();
	var documentProducerField = this.getField("documentProducer");
	if (documentProducerField != null)
		documentProducerField.value = "G";
	if (parseInt(s) != s) // CIF is of form ROxxxxxxxxx
	{
		if (s.substring(0, 2).toUpperCase() != 'RO' || s.length > 12) {
			app.alert("CIF-ul nu este introdus intr-un format valid!");
			field.strokeColor = color.red;
			return false;
		}
		s = s.substring(2, s.length); // Extract only the numeric content
	} else // CIF is only numeric
	{
		if (s.length > 10) {
			app.alert("CIF-ul introdus contine mai mult de 10 caractere!");
			field.strokeColor = color.red;
			return false;
		}
	}
	var cifraControl = s.charAt(s.length - 1);
	var content = s.substring(0, s.length - 1);
	while (content.length < 9) {
		content = '0' + content;
	}
	suma = content.charAt(0) * 7 + content.charAt(1) * 5 + content.charAt(2)
			* 3 + content.charAt(3) * 2 + content.charAt(4) * 1
			+ content.charAt(5) * 7 + content.charAt(6) * 5 + content.charAt(7)
			* 3 + content.charAt(8) * 2;
	suma = suma * 10;
	rest = suma % 11;
	if (rest == 10)
		rest = 0;
	if (rest == cifraControl) {
		field.strokeColor = color.black;
		generateBarcode();
		return true;
	}
	app.alert("CIF-ul introdus nu este valid!");
	field.strokeColor = color.red;
	generateBarcode();
	return false;
}
javascript_obj0262_016.js pdf-javascript-stream PDF /JS object 262 at offset 0x26359C 660 bytes
SHA-256: eded7a262771e483d89dc0b8977aadbc3a6f781e102f717ab3a83e861997b3cf
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
if (event.value == null || event.value.length == 0) {
	app.alert('Campul trebuie completat');
	field.strokeColor = color.red;	
}
var maxCharacters = 12;
var num = /^[0-9]*$/; 
if (event.value != null) {	
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters + ' de caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    if (event.value.match(num)==null) {
		app.alert('Campul  trebuie sa contina doar date numerice!');
		field.strokeColor = color.red;
	}else{
		field.strokeColor = color.black;
	}
    generateBarcode();
}
javascript_obj0265_017.js pdf-javascript-stream PDF /JS object 265 at offset 0x263B69 525 bytes
SHA-256: a9b368c96b57e9600f1a70aa7d85a03a87ea12378d905b4c1ec79011987e25f5
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 6;
var num = /^[0-9]*$/;
if (event.value != null) {	
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters + ' de caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    if (event.value.match(num)==null) {
		app.alert('Campul  trebuie sa contina doar date numerice!');
		field.strokeColor = color.red;
	}else{
		field.strokeColor = color.black;
	}
    generateBarcode();
}
javascript_obj0268_018.js pdf-javascript-stream PDF /JS object 268 at offset 0x26408C 526 bytes
SHA-256: 8794072c3411ff3b4dce6ede72fb1787b0711876c0a4594ae9b78b400b4184a8
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 15;
var num = /^[0-9]*$/;
if (event.value != null) {	
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters + ' de caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    if (event.value.match(num)==null) {
		app.alert('Campul  trebuie sa contina doar date numerice!');
		field.strokeColor = color.red;
	}else{
		field.strokeColor = color.black;
	}
    generateBarcode();
}
javascript_obj0280_019.js pdf-javascript-stream PDF /JS object 280 at offset 0x265514 525 bytes
SHA-256: 029e47c8de2fab8e047abd7c44a03e35b2c95e242b90844df7a6ec0eef51f7d0
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;
var maxCharacters = 4;
var num = /^[0-9]*$/;
if (event.value != null) {	
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters + ' de caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
    if (event.value.match(num)==null) {
		app.alert('Campul  trebuie sa contina doar date numerice!');
		field.strokeColor = color.red;
	}else{
		field.strokeColor = color.black;
	}
    generateBarcode();
}
javascript_obj0289_020.js pdf-javascript-stream PDF /JS object 289 at offset 0x26648F 767 bytes
SHA-256: 646bb7f107d003b603ad7d8dabc4fc1d4eea2a168af9e75159a17e3af75bf906
Preview script
First 1,000 lines of the extracted script
var emailRegex = /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
event.rc = true;
var field = event.target;
var maxCharacters = 50;
if (event.value != null) {
	if (event.value.length > maxCharacters) {
		app.alert('Campul trebuie sa contina maxim ' + maxCharacters
				+ ' de caractere!');
		event.value = event.value.substring(0, maxCharacters);
	}
	if (event.value.length > 0) {
		var matching = event.value.match(emailRegex);
		if (matching == null) {
			app.alert('Campul trebuie sa contina un email valid!');
		} else {
			field.strokeColor = color.black;
		}
		this.getField("documentProducer").value = "G";
		generateBarcode();
	}
}
javascript_obj0298_021.js pdf-javascript-stream PDF /JS object 298 at offset 0x26783A 1616 bytes
SHA-256: 7c6a5acea904187d4d4ecdcff226670d5f779fed5d26846b46a38f58892d1759
Preview script
First 1,000 lines of the extracted script
event.rc = true;
var field = event.target;

function validateDate() {
	var re = /^\d{2}.\d{2}.\d{4}$/;
	if (!event.value.match(re)) {
		app.alert("Format invalid data (zz.ll.aaaa): " + event.value);
		return;
	}
	var validDate = false;
	try {
		validDate = js_validate_date_dmyyyy(event.value);
	} catch (err) {
		app.alert(err);
	}
	if (validDate == false) {
		app.alert("Format invalid data (zz.ll.aaaa): " + event.value);
		field.strokeColor = color.red;
	} else if (validDate == true) {
		field.strokeColor = color.black;
	}
	generateBarcode();
}

validateDate();

// dd/mm/yyyy
function js_validate_date_dmyyyy(js_datestr) {
	var js_days_in_year = [ 0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 ];
	var js_datepattern = /^(\d{2})([\.])(\d{2})([\.])(\d{4})$/;

	if (!js_datepattern.test(js_datestr)) {
		return false;
	}

	var js_match = js_datestr.match(js_datepattern);
	var js_day = Number(js_match[1]);
	var js_delimiter1 = js_match[2];
	var js_month = Number(js_match[3]);
	var js_delimiter2 = js_match[4];
	var js_year = Number(js_match[5]);

	if (js_is_leap_year(js_year)) {
		js_days_in_year[2] = 29;
	}

	if (js_delimiter1 !== js_delimiter2) {
		return false;
	}
	if (js_month === 0 || js_month > 12) {
		return false;
	}
	if (js_day === 0 || js_day > js_days_in_year[js_month]) {
		return false;
	}

	return true;
}

function js_is_leap_year(js_year) {
	if (js_year % 4 === 0) {
		if (js_year % 100 === 0) {
			if (js_year % 400 === 0) {
				return true;
			} else
				return false;
		} else
			return true;
	}
	return false;
}
javascript_obj0307_022.js pdf-javascript-stream PDF /JS object 307 at offset 0x269B61 304 bytes
SHA-256: 3bb02f2f9ad4559d9ef842c728710173b52be1f971be7cd5ef4e8da2606fced8
Preview script
First 1,000 lines of the extracted script
var maxChars = 80;
var field = event.target;
if(field.value != null && field.value.length > 0){
	if(maxChars > 0){
		if(field.value.length > maxChars){
			app.alert('Campul trebuie sa contina maxim ' + maxChars + ' (de) caractere!');
			field.value = field.value.substring(0, maxChars);
		}
	}
}
javascript_obj0310_023.js pdf-javascript-stream PDF /JS object 310 at offset 0x269F8C 305 bytes
SHA-256: 71544809148308882997e04eb5e14fb050678264b200ffaaeb7046cfcbb0dc3a
Preview script
First 1,000 lines of the extracted script
var maxChars = 100;
var field = event.target;
if(field.value != null && field.value.length > 0){
	if(maxChars > 0){
		if(field.value.length > maxChars){
			app.alert('Campul trebuie sa contina maxim ' + maxChars + ' (de) caractere!');
			field.value = field.value.substring(0, maxChars);
		}
	}
}
javascript_obj3816_024.js pdf-javascript-stream PDF /JS object 3816 at offset 0x2DD2B5 153 bytes
SHA-256: 92cf70c866e749229a8a8125cc91ec4dd66f94472f686e0fe3186ea20b35ce8a
Preview script
First 1,000 lines of the extracted script
if(getField("documentProducer").value=='P'){
	getField("documentProducer").value = 'G';
}
console.println("Regenerating barcode");
generateBarcode();
javascript_obj3847_025.js pdf-javascript-stream PDF /JS object 3847 at offset 0x2E478C 2494 bytes
SHA-256: 1cb5ced1451ab595ebc611659095daeb9020ec520176b44ab0b9b4d715d7d6c3
Preview script
First 1,000 lines of the extracted script
var field = event.target;

if (event.value == null || event.value.length == 0) {
	field.strokeColor = color.red;
	app.alert('Campul trebuie completat');
}
if (event.value != null || event.value.length != 0) {	
	field.value = event.value.toUpperCase();
	this.getField("documentProducer").value = "G";
	if (event.value.length === 13) {
		validareCNP(event.value);
	} else if (event.value.length < 13) {
		validareCIF(event.value);
	}
	generateBarcode();
}

function validareCNP(s) {
	var i = 0, year = 0, hashResult = 0, cnp = [], hashTable = [ 2, 7, 9, 1, 4,
			6, 3, 5, 8, 2, 7, 9 ];
	if (event.value.length === 13) {
		for (i = 0; i < 13; i++) {
			cnp[i] = parseInt(event.value.charAt(i), 10);
			if (isNaN(cnp[i])) {
				app.alert('CNP-ul contine si alte caractere in afara de cifre!');
				field.strokeColor = color.red;
				return false;
			} else {
				if (i < 12) {
					hashResult = hashResult + (cnp[i] * hashTable[i]);
				}
			}
		}
		hashResult = hashResult % 11;
		if (hashResult === 10) {
			hashResult = 1;
		}
		if (cnp[12] !== hashResult) {
			app.alert('CNP-ul introdus nu este valid!');
			field.strokeColor = color.red;
			return false;
		} else {
			field.fieldstrokeColor = color.black;			
			return true;
		}
		return false;
	}
	return false;
}

function validareCIF(s) {
	if (parseInt(s) != s) // CIF is of form ROxxxxxxxxx
	{
		if (s.substring(0, 2).toUpperCase() != 'RO' || s.length > 12) {
			app.alert("CIF-ul nu este introdus intr-un format valid!");
			field.strokeColor = color.red;
			return false;
		}

		s = s.substring(2, s.length); // Extract only the numeric content
	} else // CIF is only numeric
	{
		if (s.length > 10) {
			app.alert("CIF-ul introdus contine mai mult de 10 cifre!");
			field.strokeColor = color.red;
			return false;
		}
	}
	var cifraControl = s.charAt(s.length - 1);
	var content = s.substring(0, s.length - 1);
	while (content.length < 9) {
		content = '0' + content;
	}
	suma = content.charAt(0) * 7 + content.charAt(1) * 5 + content.charAt(2)
			* 3 + content.charAt(3) * 2 + content.charAt(4) * 1
			+ content.charAt(5) * 7 + content.charAt(6) * 5 + content.charAt(7)
			* 3 + content.charAt(8) * 2;
	suma = suma * 10;
	rest = suma % 11;
	if (rest == 10)
		rest = 0;
	if (rest == cifraControl) {
		field.strokeColor = color.black;
		return true;
	}
	app.alert("CIF-ul introdus nu este valid!");
	field.strokeColor = color.red;
	return false;
}
javascript_obj3871_026.js pdf-javascript-stream PDF /JS object 3871 at offset 0x2ECC5F 975 bytes
SHA-256: c36896039647b90795e33972e724e793d22b6847c88b76e8c1c6cc9a786b9e1c
Preview script
First 1,000 lines of the extracted script
function format2Decimals() {
	if (event.value != null) {
		var content = event.value;
		content = content.replace(".", "");
		content = content.replace(",", ".");
		var parsedString = "";
		var floatingNumberRegex = "[-+]?[0-9]*,?[0-9]+";
		var matching = content.match(floatingNumberRegex);
		if (matching == null) {
			app.alert("Campul accepta doar numere!");
			return content;
		}
		var evtVal = content;
		//evtVal = evtVal.toString().replace(",", ".");
		parsedString = ""
				+ parseFloat(Math.round(evtVal * 100) / 100).toFixed(2);
		var splitted = parsedString.split(".");
		var beforePoint = splitted[0];
		var s0len = beforePoint.length;
		var sir = "";
		var counted = 0;
		for (var i = s0len - 1; i >= 0; i--) {
			sir = beforePoint[i] + sir;
			counted++;
			if (counted % 3 == 0 && counted < s0len)
				sir = "." + sir;
		}
		sir = sir + "," + splitted[1];
		return sir;
	}
}
event.value = format2Decimals();
generateBarcode();
stream_012_off00096d12.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x96D12 34276 bytes
SHA-256: fabcfde2b9af2db65753cb1b13a11f77da8a69c10684dd830151eb601cec2ae3
stream_026_off00124f74.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x124F74 1110940 bytes
SHA-256: 5eba94a47b790275719ccddd55d8f2bed63e8aec3cecfa275de4f55f14b1da41
font_00_sfnt_off0008745b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8745B 28924 bytes
SHA-256: f626de7376ff95aba70588a2324cc180985c4da1ca0deaaff72679bb50e5f430