Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6c746c2f9b2ddd4…

MALICIOUS

PDF

176.2 KB Authoring application: Cirali Output Manager B1-23 http://www.fjd.de (via cirali-pdf Pdf-V70 http://www.fjd.de) First seen: 2026-05-11
MD5: 953d830a4e84bcc6c7657f37aee7516e SHA-1: db69381a3122467693c88f87f939a37885d83eb0 SHA-256: f6c746c2f9b2ddd4443727eb7d988d2ff4b5e3d74e179da740a638f06b67e022
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment T1071.001 Web Protocols

The PDF document contains embedded JavaScript and additional-actions dictionaries, indicating an attempt to execute code upon opening or interaction. The document body is formatted as a travel request form, a common lure for phishing attacks. The embedded URL 'http://www.fjd.de' is likely used to redirect the user to a malicious site. The presence of multiple JavaScript streams suggests a complex execution chain, possibly for downloading and executing further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9726

Heuristics 6

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.fjd.de In PDF document text
    • http://www.fjd.de)/CreatorIn PDF document text
    • http://www.fjd.de)/AuthorIn PDF document text

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0002_000.js pdf-javascript-stream PDF /JS object 2 at offset 0xF0 449 bytes
SHA-256: 227ca46bb27e6d02fc509d522435c3c917f7409b7380571752f9579fd7d8fea5
Preview script
First 1,000 lines of the extracted script
var n = this.numFields;
var f;
var fn;
for(var i=0;i<n;i++)
{
   fn = this.getNthFieldName(i);
   if(""==fn) continue;

   f = this.getField(fn);
   if(null==f) continue;
   if("button"==f.type)continue;

   SYS_FILL(f,color.transparent);


   if("checkbox"==f.type)
   { f.style=style.cr;
     f.strokeColor=getBorderColor(fn);
   }
   else
   {    if(""+f.strokeColor!=""+color.transparent)
   		{  f.strokeColor=color.transparent;
   		}
   }
}
javascript_obj0048_003.js pdf-javascript-stream PDF /JS object 48 at offset 0xAE46 1664 bytes
SHA-256: 87bb7b86363f62511cc9bdb6cd961a0bed8a38611193db474f675977bcf47d8b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
53 of 56 identifiers look randomly generated (e.g. 'SYS_CB_Obj12') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
if(event.source)
{ var n=event.source.name;
if(n=="Obj39")SYS_CB_Obj39();
if(n=="eintaegig")SYS_CB_eintaegig();
if(n=="OBJ5")SYS_CB_OBJ5();
if(n=="OBJ36")SYS_CB_OBJ36();
if(n=="OBJ42")SYS_CB_OBJ42();
if(n=="OBJ43")SYS_CB_OBJ43();
if(n=="OBJ44")SYS_CB_OBJ44();
if(n=="OBJ45")SYS_CB_OBJ45();
if(n=="OBJ46")SYS_CB_OBJ46();
if(n=="OBJ47")SYS_CB_OBJ47();
if(n=="OBJ48")SYS_CB_OBJ48();
if(n=="OBJ14")SYS_CB_OBJ14();
if(n=="OBJ50")SYS_CB_OBJ50();
if(n=="OBJ52")SYS_CB_OBJ52();
if(n=="OBJ53")SYS_CB_OBJ53();
if(n=="OBJ54")SYS_CB_OBJ54();
if(n=="OBJ55")SYS_CB_OBJ55();
if(n=="OBJ56")SYS_CB_OBJ56();
if(n=="OBJ57")SYS_CB_OBJ57();
if(n=="OBJ58")SYS_CB_OBJ58();
if(n=="Obj6")SYS_CB_Obj6();
if(n=="Obj7")SYS_CB_Obj7();
if(n=="Obj8")SYS_CB_Obj8();
if(n=="Obj9")SYS_CB_Obj9();
if(n=="Obj10")SYS_CB_Obj10();
if(n=="Obj11")SYS_CB_Obj11();
if(n=="Obj12")SYS_CB_Obj12();
if(n=="Obj13")SYS_CB_Obj13();
if(n=="Obj16")SYS_CB_Obj16();
if(n=="Obj17")SYS_CB_Obj17();
if(n=="Obj26")SYS_CB_Obj26();
if(n=="Obj30")SYS_CB_Obj30();
if(n=="Obj18")SYS_CB_Obj18();
if(n=="Obj20")SYS_CB_Obj20();
if(n=="Obj22")SYS_CB_Obj22();
if(n=="Obj24")SYS_CB_Obj24();
if(n=="Obj31")SYS_CB_Obj31();
if(n=="Obj19")SYS_CB_Obj19();
if(n=="Obj21")SYS_CB_Obj21();
if(n=="Obj23")SYS_CB_Obj23();
if(n=="Obj25")SYS_CB_Obj25();
if(n=="Obj32")SYS_CB_Obj32();
if(n=="Obj27")SYS_CB_Obj27();
if(n=="Obj28")SYS_CB_Obj28();
if(n=="Obj40")SYS_CB_Obj40();
if(n=="Obj33")SYS_CB_Obj33();
if(n=="Obj29")SYS_CB_Obj29();
if(n=="Obj41")SYS_CB_Obj41();
if(n=="Obj34")SYS_CB_Obj34();
if(n=="Obj35")SYS_CB_Obj35();
if(n=="Obj37")SYS_CB_Obj37();
if(n=="Obj38")SYS_CB_Obj38();
if(n=="OBJ15")SYS_CB_OBJ15();
if(n=="OBJ51")SYS_CB_OBJ51();
}
javascript_obj0052_005.js pdf-javascript-stream PDF /JS object 52 at offset 0xB990 644 bytes
SHA-256: 0b401eac40a9c9c3720e414257d0f7fef1774335eb0f269bc330a6f628b884be
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
var FI=getField("Datum1"); 
var F1 = getField("Datum13"); F1.value = FI.valueAsString; 
var F2 = getField("Datum14"); F2.value = FI.valueAsString; 
var F3 = getField("Datum15"); F3.value = FI.valueAsString; 
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0052_006.js pdf-javascript-stream PDF /JS object 52 at offset 0xB990 264 bytes
SHA-256: 2ca5f896ddb524115f411b81705017d1a0ad72d3a2b4c8fc2ce2eb602ac69267
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
AFDate_FormatEx("dd.mm.yyyy");
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0052_007.js pdf-javascript-stream PDF /JS object 52 at offset 0xB990 294 bytes
SHA-256: 7097080df016f1b41747ea27659445277babb3bd57e084e959e7f0194ae386db
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
  var c=event.change;
   var success=1;
   if( ((c<"0") || (c>"9")) && (c!=".") )
   {       success=0;
   }
   if(event.value.length>9)
   {       success=0;
   }
   if(0==success)
   {       app.beep(0);
           event.rc=false;
   }       
}
javascript_obj0052_008.js pdf-javascript-stream PDF /JS object 52 at offset 0xB990 538 bytes
SHA-256: c533ed6f0b5474383de7e4c1d8737edc8bd94e0d78a6948f6f21ae2b6d5bc11b
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
var FI=getField("Datum1"); 
var F1 = getField("Datum13"); F1.value = FI.valueAsString; 
var F2 = getField("Datum14"); F2.value = FI.valueAsString; 
var F3 = getField("Datum15"); F3.value = FI.valueAsString; 
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}if(false==event.rc
javascript_obj0052_009.js pdf-javascript-stream PDF /JS object 52 at offset 0xB990 158 bytes
SHA-256: fb9d7ddc44b866c21e006f356fc29d6871b9d2c20382f8e84c0b557ce25b4057
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
AFDate_FormatEx("dd.mm.yyyy");
}if(false==event.rc
javascript_obj0054_010.js pdf-javascript-stream PDF /JS object 54 at offset 0xC0ED 383 bytes
SHA-256: db5aae9b5de27a8799c59639db0f7fc0dabffa5417734f4a6668d001a415df88
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
  var c=event.change;
   var success=1;
   if( (c<"0") || (c>"9"))
   {       success=0;
           if( (c==":")  && (-1==event.value.indexOf(':')) )
           {       success=1;
           }
   }
   if(event.value.length>4)
   {       success=0;
   }
   if(0==success)
   {       app.beep(0);
           event.rc=false;
   }       
}
javascript_obj0054_011.js pdf-javascript-stream PDF /JS object 54 at offset 0xC0ED 1481 bytes
SHA-256: 12722d06d990c24d21eae33d1a8ed4e6829e23286cd4d35e8a79ed33b3e326b0
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   var success=true;
   var pos=event.value.indexOf(':');
   if( ( (1==pos) || (2==pos) ) && (pos+1<event.value.length) )
   {                                       
           var strHours=event.value.substring(0,pos);
           var strMin=event.value.substring(pos+1,event.value.length);
           var dHour=new Number(strHours);
           var dMin=new Number(strMin);
           if( (dHour<0) || (dHour > 23) )
           {       success=false;                  
           }
           if( (dMin<0) || (dMin > 59) )
           {       success=false;                  
           }
           if(true==success)
           {                       
                   strHour=""+dHour;                     
                   if(dMin<10)
                   {       strMin="0"+dMin;                              
                   }
                   else
                   {       strMin=""+dMin;
                   }
                   event.target.value=strHour+":"+strMin;                                                
           }               
   }
   else
   {  success=false;
   }
   
    if(false==success)
    {      app.alert("Bitte geben Sie eine Uhrzeit wie folgt formatiert ein: (h)h:(m)m");
           event.rc=false;
    }
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0054_012.js pdf-javascript-stream PDF /JS object 54 at offset 0xC0ED 1375 bytes
SHA-256: 3185851e0424ff0d7fe289bac40f66209c4dfddb84b0e8e447701a50f28953a9
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
   var success=true;
   var pos=event.value.indexOf(':');
   if( ( (1==pos) || (2==pos) ) && (pos+1<event.value.length) )
   {                                       
           var strHours=event.value.substring(0,pos);
           var strMin=event.value.substring(pos+1,event.value.length);
           var dHour=new Number(strHours);
           var dMin=new Number(strMin);
           if( (dHour<0) || (dHour > 23) )
           {       success=false;                  
           }
           if( (dMin<0) || (dMin > 59) )
           {       success=false;                  
           }
           if(true==success)
           {                       
                   strHour=""+dHour;                     
                   if(dMin<10)
                   {       strMin="0"+dMin;                              
                   }
                   else
                   {       strMin=""+dMin;
                   }
                   event.target.value=strHour+":"+strMin;                                                
           }               
   }
   else
   {  success=false;
   }
   
    if(false==success)
    {      app.alert("Bitte geben Sie eine Uhrzeit wie folgt formatiert ein: (h)h:(m)m");
           event.rc=false;
    }
}if(false==event.rc
javascript_obj0232_063.js pdf-javascript-stream PDF /JS object 232 at offset 0x18AA3 367 bytes
SHA-256: 55b8277075138346b187faf0369c326cf492693175873b3fe88a025298ef294a
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
AFDate_FormatEx("dd.mm.yyyy");
}
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
AFDate_FormatEx("dd.mm.yyyy");
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0232_064.js pdf-javascript-stream PDF /JS object 232 at offset 0x18AA3 588 bytes
SHA-256: 64af263d486e8f933fbb4006f684400c96f5b49bf3067d6fbc5ba586bd9dc5a9
Preview script
First 1,000 lines of the extracted script
if( (event.change!="") && (true==event.rc) ) {
  var c=event.change;
   var success=1;
   if( ((c<"0") || (c>"9")) && (c!=".") )
   {       success=0;
   }
   if(event.value.length>9)
   {       success=0;
   }
   if(0==success)
   {       app.beep(0);
           event.rc=false;
   }       
}
if( (event.change!="") && (true==event.rc) ) {
  var c=event.change;
   var success=1;
   if( ((c<"0") || (c>"9")) && (c!=".") )
   {       success=0;
   }
   if(event.value.length>9)
   {       success=0;
   }
   if(0==success)
   {       app.beep(0);
           event.rc=false;
   }       
}
javascript_obj0232_065.js pdf-javascript-stream PDF /JS object 232 at offset 0x18AA3 1754 bytes
SHA-256: 062b7eb58fa9b14a4b8c6e0f8891cdb194d6ec4d7a1e26d15e6e43d991837075
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var strFNReferenzDatum="Datum1"; // Variable
   var strReferenzDatum = getField(strFNReferenzDatum); 
   var isReferenzDatumValid=1;
   if(strReferenzDatum && (strReferenzDatum.value!=""))
   {    var dateReferenzDatum=AFParseDateEx(strReferenzDatum.value,"dd.mm.yyyy");
        if(dateReferenzDatum)
        {   var date = AFParseDateEx(event.value, "dd.mm.yyyy");  
            if(date) 
            {   if(date.valueOf()<dateReferenzDatum.valueOf())
                {   app.alert("Bitte geben Sie ein Datum ab dem Stichtag "+strReferenzDatum.value+" ein.\rDas erste g�ltige Datum w�re das Datum: "+strReferenzDatum.value+".");
                    event.rc=false;
                }
            }
            else
            {   app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
                event.rc = false;       
             }
           }
           else
           {  isReferenzDatumValid=0;
           }
   }
   else
   {   isReferenzDatumValid=0;
   }
   if(0==isReferenzDatumValid)
   {  app.alert("Satzfehler:\rDas Feld mit dem Referenzdatum: "+strFNReferenzDatum+" enth�lt kein g�ltiges Datum.\rEvtl. ist in diesem Formular auch kein Feld mit dem Namen: "+strFNReferenzDatum+" enthalten.");
   }
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0232_066.js pdf-javascript-stream PDF /JS object 232 at offset 0x18AA3 261 bytes
SHA-256: 6433bef54212641a68919dff5732669b6ff7d5b1c2b76efd44b0c359fd15635c
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
AFDate_FormatEx("dd.mm.yyyy");
}
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
AFDate_FormatEx("dd.mm.yyyy");
}if(false==event.rc
javascript_obj0232_067.js pdf-javascript-stream PDF /JS object 232 at offset 0x18AA3 1648 bytes
SHA-256: 633ed6edb6718ac69a1cf46e9854b5fae8bbece0968ebe0982d710a6a0492e70
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var strFNReferenzDatum="Datum1"; // Variable
   var strReferenzDatum = getField(strFNReferenzDatum); 
   var isReferenzDatumValid=1;
   if(strReferenzDatum && (strReferenzDatum.value!=""))
   {    var dateReferenzDatum=AFParseDateEx(strReferenzDatum.value,"dd.mm.yyyy");
        if(dateReferenzDatum)
        {   var date = AFParseDateEx(event.value, "dd.mm.yyyy");  
            if(date) 
            {   if(date.valueOf()<dateReferenzDatum.valueOf())
                {   app.alert("Bitte geben Sie ein Datum ab dem Stichtag "+strReferenzDatum.value+" ein.\rDas erste g�ltige Datum w�re das Datum: "+strReferenzDatum.value+".");
                    event.rc=false;
                }
            }
            else
            {   app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
                event.rc = false;       
             }
           }
           else
           {  isReferenzDatumValid=0;
           }
   }
   else
   {   isReferenzDatumValid=0;
   }
   if(0==isReferenzDatumValid)
   {  app.alert("Satzfehler:\rDas Feld mit dem Referenzdatum: "+strFNReferenzDatum+" enth�lt kein g�ltiges Datum.\rEvtl. ist in diesem Formular auch kein Feld mit dem Namen: "+strFNReferenzDatum+" enthalten.");
   }
}if(false==event.rc
javascript_obj0234_068.js pdf-javascript-stream PDF /JS object 234 at offset 0x19823 1754 bytes
SHA-256: 5d640bc2accc140d63f6244b7f4c7b90266a9d6f66e55378fe474e681a984a1d
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var strFNReferenzDatum="Datum2"; // Variable
   var strReferenzDatum = getField(strFNReferenzDatum); 
   var isReferenzDatumValid=1;
   if(strReferenzDatum && (strReferenzDatum.value!=""))
   {    var dateReferenzDatum=AFParseDateEx(strReferenzDatum.value,"dd.mm.yyyy");
        if(dateReferenzDatum)
        {   var date = AFParseDateEx(event.value, "dd.mm.yyyy");  
            if(date) 
            {   if(date.valueOf()<dateReferenzDatum.valueOf())
                {   app.alert("Bitte geben Sie ein Datum ab dem Stichtag "+strReferenzDatum.value+" ein.\rDas erste g�ltige Datum w�re das Datum: "+strReferenzDatum.value+".");
                    event.rc=false;
                }
            }
            else
            {   app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
                event.rc = false;       
             }
           }
           else
           {  isReferenzDatumValid=0;
           }
   }
   else
   {   isReferenzDatumValid=0;
   }
   if(0==isReferenzDatumValid)
   {  app.alert("Satzfehler:\rDas Feld mit dem Referenzdatum: "+strFNReferenzDatum+" enth�lt kein g�ltiges Datum.\rEvtl. ist in diesem Formular auch kein Feld mit dem Namen: "+strFNReferenzDatum+" enthalten.");
   }
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0234_069.js pdf-javascript-stream PDF /JS object 234 at offset 0x19823 1648 bytes
SHA-256: dd99c52c978829914af2cbeabc50391f5d34f166e56a2fe7a64954f6ab617b2a
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var strFNReferenzDatum="Datum2"; // Variable
   var strReferenzDatum = getField(strFNReferenzDatum); 
   var isReferenzDatumValid=1;
   if(strReferenzDatum && (strReferenzDatum.value!=""))
   {    var dateReferenzDatum=AFParseDateEx(strReferenzDatum.value,"dd.mm.yyyy");
        if(dateReferenzDatum)
        {   var date = AFParseDateEx(event.value, "dd.mm.yyyy");  
            if(date) 
            {   if(date.valueOf()<dateReferenzDatum.valueOf())
                {   app.alert("Bitte geben Sie ein Datum ab dem Stichtag "+strReferenzDatum.value+" ein.\rDas erste g�ltige Datum w�re das Datum: "+strReferenzDatum.value+".");
                    event.rc=false;
                }
            }
            else
            {   app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
                event.rc = false;       
             }
           }
           else
           {  isReferenzDatumValid=0;
           }
   }
   else
   {   isReferenzDatumValid=0;
   }
   if(0==isReferenzDatumValid)
   {  app.alert("Satzfehler:\rDas Feld mit dem Referenzdatum: "+strFNReferenzDatum+" enth�lt kein g�ltiges Datum.\rEvtl. ist in diesem Formular auch kein Feld mit dem Namen: "+strFNReferenzDatum+" enthalten.");
   }
}if(false==event.rc
javascript_obj0236_070.js pdf-javascript-stream PDF /JS object 236 at offset 0x1A5A3 1754 bytes
SHA-256: a641829f91e99fa7847fd74f34ebae1273668c73e71086eb5b4105057f24efa2
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var strFNReferenzDatum="Datum3"; // Variable
   var strReferenzDatum = getField(strFNReferenzDatum); 
   var isReferenzDatumValid=1;
   if(strReferenzDatum && (strReferenzDatum.value!=""))
   {    var dateReferenzDatum=AFParseDateEx(strReferenzDatum.value,"dd.mm.yyyy");
        if(dateReferenzDatum)
        {   var date = AFParseDateEx(event.value, "dd.mm.yyyy");  
            if(date) 
            {   if(date.valueOf()<dateReferenzDatum.valueOf())
                {   app.alert("Bitte geben Sie ein Datum ab dem Stichtag "+strReferenzDatum.value+" ein.\rDas erste g�ltige Datum w�re das Datum: "+strReferenzDatum.value+".");
                    event.rc=false;
                }
            }
            else
            {   app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
                event.rc = false;       
             }
           }
           else
           {  isReferenzDatumValid=0;
           }
   }
   else
   {   isReferenzDatumValid=0;
   }
   if(0==isReferenzDatumValid)
   {  app.alert("Satzfehler:\rDas Feld mit dem Referenzdatum: "+strFNReferenzDatum+" enth�lt kein g�ltiges Datum.\rEvtl. ist in diesem Formular auch kein Feld mit dem Namen: "+strFNReferenzDatum+" enthalten.");
   }
}if(false==event.rc){    event.rc=true;      event.value=memorized_eventvalue;     app.beep(0);     event.target.setFocus();}
javascript_obj0236_071.js pdf-javascript-stream PDF /JS object 236 at offset 0x1A5A3 1648 bytes
SHA-256: bb2ae9ea32c16773a0b2e164bc8c78e8a12c3d252551d96482f303811bc5e78a
Preview script
First 1,000 lines of the extracted script
var memorized_eventvalue=event.value;
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var date = AFParseDateEx(event.value, "dd.mm.yyyy");
   if (!date) 
   {       app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
           event.rc = false;       
   }
}
  if(app.viewerVersion<6) event.rc = true;
if (event.value != "") { 
  var strFNReferenzDatum="Datum3"; // Variable
   var strReferenzDatum = getField(strFNReferenzDatum); 
   var isReferenzDatumValid=1;
   if(strReferenzDatum && (strReferenzDatum.value!=""))
   {    var dateReferenzDatum=AFParseDateEx(strReferenzDatum.value,"dd.mm.yyyy");
        if(dateReferenzDatum)
        {   var date = AFParseDateEx(event.value, "dd.mm.yyyy");  
            if(date) 
            {   if(date.valueOf()<dateReferenzDatum.valueOf())
                {   app.alert("Bitte geben Sie ein Datum ab dem Stichtag "+strReferenzDatum.value+" ein.\rDas erste g�ltige Datum w�re das Datum: "+strReferenzDatum.value+".");
                    event.rc=false;
                }
            }
            else
            {   app.alert("Bitte geben Sie ein Datum wie folgt formatiert ein: (T)T.(M)M.JJJJ");
                event.rc = false;       
             }
           }
           else
           {  isReferenzDatumValid=0;
           }
   }
   else
   {   isReferenzDatumValid=0;
   }
   if(0==isReferenzDatumValid)
   {  app.alert("Satzfehler:\rDas Feld mit dem Referenzdatum: "+strFNReferenzDatum+" enth�lt kein g�ltiges Datum.\rEvtl. ist in diesem Formular auch kein Feld mit dem Namen: "+strFNReferenzDatum+" enthalten.");
   }
}if(false==event.rc
javascript_obj0244_074.js pdf-javascript-stream PDF /JS object 244 at offset 0x1B8D7 307 bytes
SHA-256: 9e0934a9c2be8f4d8c2461307d6b4e6aad65b449e4c7e7e03bff512c0ea817e1
Preview script
First 1,000 lines of the extracted script
app.alert("Dieser Zusatz ist nur in den E-Forms enthalten. Die hier hinterlegte Logik funktioniert nur in der Java-Fassung und nicht in den PDF -Fassungen!\r\rDer Zusatz ist wirklich nur bei eint�gigen Dienstreisen und nicht bei mehrt�gigen Dienstreisen mit t�glicher Heimfahrt zu verwenden!!!!\r\r\r\r",3);
javascript_obj0253_075.js pdf-javascript-stream PDF /JS object 253 at offset 0x1CCC9 3587 bytes
SHA-256: 93ca6bd40155ca76781929afa69f8783ddac34314f01f9237753270e3c244450
Preview script
First 1,000 lines of the extracted script
function getBgColor(fn){
var BG_DISABLED=["RGB",0.749,0.749,0.749];
var BG_190=["RGB",1.0,1.0,1.0];
  if(fn=="Person.Name1") return BG_190;
  if(fn=="Person.Orga1") return BG_190;
  if(fn=="Person.Telefon1") return BG_190;
  if(fn=="Abfahrtsort") return BG_190;
  if(fn=="Reiseweg") return BG_190;
  if(fn=="Reiseziel") return BG_190;
  if(fn=="RueckkehrNach") return BG_190;
  if(fn=="Person.Name2") return BG_190;
  if(fn=="Person.Orga2") return BG_190;
  if(fn=="Person.Telefon2") return BG_190;
  if(fn=="Person.Name3") return BG_190;
  if(fn=="Person.Orga3") return BG_190;
  if(fn=="Person.Telefon3") return BG_190;
  if(fn=="Person.Name4") return BG_190;
  if(fn=="Person.Orga4") return BG_190;
  if(fn=="Person.Telefon4") return BG_190;
  if(fn=="Begruendung") return BG_190;
  if(fn=="Obj39") return BG_190;
  if(fn=="eintaegig") return BG_190;
  if(fn=="Datum1") return BG_190;
  if(fn=="Uhrzeit1") return BG_190;
  if(fn=="Datum13") return BG_190;
  if(fn=="Uhrzeit2") return BG_190;
  if(fn=="Datum14") return BG_190;
  if(fn=="Uhrzeit3") return BG_190;
  if(fn=="Datum15") return BG_190;
  if(fn=="Uhrzeit4") return BG_190;
  if(fn=="OBJ5") return BG_190;
  if(fn=="OBJ36") return BG_190;
  if(fn=="Genaue_Abfahrtsanschrift") return BG_190;
  if(fn=="Beginn_der_Rueckfahrt_Datum_Uhrzeit_Ort") return BG_190;
  if(fn=="Genaue_Ankunftsanschrift") return BG_190;
  if(fn=="OBJ42") return BG_190;
  if(fn=="OBJ43") return BG_190;
  if(fn=="OBJ44") return BG_190;
  if(fn=="Mitfahrt_bei") return BG_190;
  if(fn=="OBJ45") return BG_190;
  if(fn=="OBJ46") return BG_190;
  if(fn=="OBJ47") return BG_190;
  if(fn=="OBJ48") return BG_190;
  if(fn=="OBJ14") return BG_190;
  if(fn=="OBJ50") return BG_190;
  if(fn=="Mitfahrt_bei1") return BG_190;
  if(fn=="Begruendung2") return BG_190;
  if(fn=="OBJ52") return BG_190;
  if(fn=="OBJ53") return BG_190;
  if(fn=="OBJ54") return BG_190;
  if(fn=="OBJ55") return BG_190;
  if(fn=="OBJ56") return BG_190;
  if(fn=="OBJ57") return BG_190;
  if(fn=="Strecke") return BG_190;
  if(fn=="OBJ58") return BG_190;
  if(fn=="Obj6") return BG_190;
  if(fn=="Obj7") return BG_190;
  if(fn=="Obj8") return BG_190;
  if(fn=="Obj9") return BG_190;
  if(fn=="Obj10") return BG_190;
  if(fn=="Obj11") return BG_190;
  if(fn=="Obj12") return BG_190;
  if(fn=="Obj13") return BG_190;
  if(fn=="Person.Unterschrift1") return BG_190;
  if(fn=="Person.Vertretung") return BG_190;
  if(fn=="Obj16") return BG_190;
  if(fn=="Anschrift1") return BG_190;
  if(fn=="Obj17") return BG_190;
  if(fn=="Obj26") return BG_190;
  if(fn=="Obj30") return BG_190;
  if(fn=="Obj18") return BG_190;
  if(fn=="Obj20") return BG_190;
  if(fn=="Obj22") return BG_190;
  if(fn=="Obj24") return BG_190;
  if(fn=="Obj31") return BG_190;
  if(fn=="Obj19") return BG_190;
  if(fn=="Obj21") return BG_190;
  if(fn=="Obj23") return BG_190;
  if(fn=="Obj25") return BG_190;
  if(fn=="Obj32") return BG_190;
  if(fn=="Obj27") return BG_190;
  if(fn=="Obj28") return BG_190;
  if(fn=="Obj40") return BG_190;
  if(fn=="Obj33") return BG_190;
  if(fn=="Obj29") return BG_190;
  if(fn=="Obj41") return BG_190;
  if(fn=="Obj34") return BG_190;
  if(fn=="Obj35") return BG_190;
  if(fn=="Obj37") return BG_190;
  if(fn=="Obj38") return BG_190;
  if(fn=="Datum2") return BG_190;
  if(fn=="Datum3") return BG_190;
  if(fn=="Datum4") return BG_190;
  if(fn=="OBJ15") return BG_190;
  if(fn=="OBJ51") return BG_190;
  if(fn=="Bemerkungen_der_anstragstellenden_Person") return BG_190;
  if(fn=="Bemerkungen_der_ueber_den_Antrag_entscheidenen_Stelle") return BG_190;
    return color.transparent;}
javascript_obj0254_076.js pdf-javascript-stream PDF /JS object 254 at offset 0x1DC18 166 bytes
SHA-256: 9f51a81ea495069ac3bd65daf89fd1c4a332f6ab52c21e14c04ec2c85ecccdee
Preview script
First 1,000 lines of the extracted script
function getBorderColor(fn){
   var f = this.getField(fn);
   if((null!=f)&&("checkbox"==f.type))
   { return ["RGB",0.0,0.0,0.0];
   }
   return color.transparent;
}
javascript_obj0255_077.js pdf-javascript-stream PDF /JS object 255 at offset 0x1DCFB 280 bytes
SHA-256: bb0cc0ea4c337306f6e2f48a1141a3f0f0b71c8fa4e6a492f8fae20a58ca3eb4
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CLR(name,bNeedsColouredMustFillBorder)
{
    if(bNeedsColouredMustFillBorder)
    {    getField(name).strokeColor=color.red;
        }
        else
    	{    getField(name).strokeColor=getBorderColor(name);
        }
    return bNeedsColouredMustFillBorder;
}
javascript_obj0256_078.js pdf-javascript-stream PDF /JS object 256 at offset 0x1DE54 468 bytes
SHA-256: 82c0fd6e6cc117687c47ced7f0ce920ecb308781c8402ac1927d871608b9fef1
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_STATE()
{
    if(false==SYS_IS_MUFI_CB(SYS_CB_HDL_STATE.arguments[0])) return false;
    var obj=getField(SYS_CB_HDL_STATE.arguments[0]);
    if("Yes"==obj.value) return false;
    if(true==obj.readonly) return false;
    if(display.hidden==obj.display) return false;
    for(var i=1;i<SYS_CB_HDL_STATE.arguments.length;i++)
    {   if("Yes"==getField(SYS_CB_HDL_STATE.arguments[i]).value)
    	{   return false;
        }
    }
    return true;
}
javascript_obj0257_079.js pdf-javascript-stream PDF /JS object 257 at offset 0x1E077 168 bytes
SHA-256: f6c2357c12b7e2cbd2f963dd05935f9bd1d924cb5654b0cfca7b2eeaa3f05a1b
Preview script
First 1,000 lines of the extracted script
function SYS_IS_MUFI_CB(cbname)
{   var all_mufi_cb= new Array();
	for(var i=0;i<all_mufi_cb.length;i++)
	{	if(cbname==all_mufi_cb[i]) return true;
	}
	return false;
}
javascript_obj0258_080.js pdf-javascript-stream PDF /JS object 258 at offset 0x1E15B 70 bytes
SHA-256: 68582c3b030f7ce77460540a7ea21e899d133ef6ae8330fbbb6a5db8d1040ccb
Preview script
First 1,000 lines of the extracted script
function SYS_FILL(f,c){
  if(""+f.fillColor!=""+c)  {f.fillColor=c;}}
javascript_obj0259_081.js pdf-javascript-stream PDF /JS object 259 at offset 0x1E1D4 251 bytes
SHA-256: 11a1bd3ed0d867a06a568a40ba9d93946c031e168697e359578f9ad5e75f7e59
Preview script
First 1,000 lines of the extracted script
function SYS_EWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0260_082.js pdf-javascript-stream PDF /JS object 260 at offset 0x1E31B 251 bytes
SHA-256: b489e14c022670e263ade06b76d1f9a44446979ddfa4df58bed63e1e68ca6dfa
Preview script
First 1,000 lines of the extracted script
function SYS_AWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
 else
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
}
javascript_obj0261_083.js pdf-javascript-stream PDF /JS object 261 at offset 0x1E462 220 bytes
SHA-256: f4379dc788b0345e77b7c62fb70b4743640256954408c64b71bb4e1d213b0ffe
Preview script
First 1,000 lines of the extracted script
function SYS_EWB(v1,f2){
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(""==v1)
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0262_084.js pdf-javascript-stream PDF /JS object 262 at offset 0x1E587 1263 bytes
SHA-256: 2856e6304c394af10c1bf9c2627fd4c31d4605a8e9c743b15c91d5a1c90a0abe
Preview script
First 1,000 lines of the extracted script
function SYS_PA2_SUBMIT()
{
        var pflichtfelder_befuellt = SYS_CHECK_MF_FIELDS();
        var n = this.numFields;
        var f;
        var fn;
        for(var i=0;i<n;i++)
        {
                fn = this.getNthFieldName(i);
                if( (""!=fn) && ("SYS_SEND_BUTTON"==fn.substring(0,15)) )
                {
                        f = this.getField(fn);
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=false;
                        	 }
                        	 else
                        	 { f.readonly=true;
                        	 }
                        }
                        f = this.getField("SYS_SEND_BTN_SHADOW"+fn.substring(15,fn.length));
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=true;
                        	   f.display=display.hidden;
                        	 }
                        	 else
                        	 { f.readonly=false;
                        	   f.display=display.visible;
                        	 }
                        }
                }
        }
}
javascript_obj0263_085.js pdf-javascript-stream PDF /JS object 263 at offset 0x1EAE5 174 bytes
SHA-256: f1225af471c2257e75e7dc2709ac9078fdcc0b67011432469e2fb874490441ac
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_Obj39(changecolor)
{   var retval=SYS_CB_HDL_STATE("Obj39");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("Obj39",retval);
    }
    return retval;
}
javascript_obj0264_086.js pdf-javascript-stream PDF /JS object 264 at offset 0x1EBCF 186 bytes
SHA-256: dbf094f943f2ca68dc7bd2d16993e181e7a95e36514a3de484aa56217c425191
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_eintaegig(changecolor)
{   var retval=SYS_CB_HDL_STATE("eintaegig");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("eintaegig",retval);
    }
    return retval;
}

Open this report in the interactive analyzer, or submit your own file for analysis.