Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7fbf52ea48cfb19…

MALICIOUS

PDF

74.7 KB Authoring application: Cirali Output Manager B1-23 http://www.fjd.de (via cirali-pdf Pdf-V74 http://www.fjd.de) First seen: 2026-05-10
MD5: 07584c390f0a7c4ba4551ae30dacac09 SHA-1: a1a2693aef79428c4f8c1d1764c35976351de442 SHA-256: f7fbf52ea48cfb1982b469cea29d907582949724048955c58bd0584bb82cd9cc
66 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains multiple embedded JavaScript streams and actions, indicated by the PDF_JAVASCRIPT, PDF_JS, PDF_AA, and PDF_ACROFORM_BUTTON heuristics. The presence of embedded JavaScript suggests an attempt to execute code when the document is opened or interacted with. The document body appears to be a legitimate-looking form, which could be used to trick users into interacting with the malicious JavaScript. The embedded URL http://www.fjd.de is present but has an unknown reputation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9859

Heuristics 6

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Additional-actions dictionary low PDF_AA
    PDF defines /AA (Additional Actions) that references an executable action (JS/JavaScript/Launch/SubmitForm) — can auto-trigger on document or widget events. Form-field calc/format/validate/keystroke handlers in legitimate interactive forms commonly fire this, so it is reported as a low-weight signal; weaponised auto-execution is flagged by stronger rules (PDF_OPENACTION, encrypted-with-JS, etc.)
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.fjd.de In PDF document text
    • http://www.fjd.de)/CreatorIn PDF document text
    • http://www.fjd.de)/AuthorIn PDF document text

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0002_000.js pdf-javascript-stream PDF /JS object 2 at offset 0x10C 449 bytes
SHA-256: 227ca46bb27e6d02fc509d522435c3c917f7409b7380571752f9579fd7d8fea5
Preview script
First 1,000 lines of the extracted script
var n = this.numFields;
var f;
var fn;
for(var i=0;i<n;i++)
{
   fn = this.getNthFieldName(i);
   if(""==fn) continue;

   f = this.getField(fn);
   if(null==f) continue;
   if("button"==f.type)continue;

   SYS_FILL(f,color.transparent);


   if("checkbox"==f.type)
   { f.style=style.cr;
     f.strokeColor=getBorderColor(fn);
   }
   else
   {    if(""+f.strokeColor!=""+color.transparent)
   		{  f.strokeColor=color.transparent;
   		}
   }
}
javascript_obj0002_001.js pdf-javascript-stream PDF /JS object 2 at offset 0x10C 38 bytes
SHA-256: b2e38f438ed1e34f318d244186a1aea582b8a0caaa8ce2a5646ddcf16e0534b4
Preview script
First 1,000 lines of the extracted script
SYS_RESET_BG_COLORS_UPON_ALL_PAGES();
javascript_obj0016_003.js pdf-javascript-stream PDF /JS object 16 at offset 0x9AF5 1008 bytes
SHA-256: c3057cc5d0f74eafffdd9e69b8c05955fd986b2af12928ef3b0419f184572ee0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
16 of 18 identifiers look randomly generated (e.g. 'SYS_CB_CHECKBOX_p1_x146_y229') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
if(event.source)
{ var n=event.source.name;
if(n=="CHECKBOX.p0.x20.y103")SYS_CB_CHECKBOX_p0_x20_y103();
if(n=="CHECKBOX.p0.x20.y120")SYS_CB_CHECKBOX_p0_x20_y120();
if(n=="CHECKBOX.p0.x20.y179")SYS_CB_CHECKBOX_p0_x20_y179();
if(n=="CHECKBOX.p0.x120.y208")SYS_CB_CHECKBOX_p0_x120_y208();
if(n=="CHECKBOX.p0.x144.y208")SYS_CB_CHECKBOX_p0_x144_y208();
if(n=="CHECKBOX.p1.x20.y40")SYS_CB_CHECKBOX_p1_x20_y40();
if(n=="CHECKBOX.p1.x20.y61")SYS_CB_CHECKBOX_p1_x20_y61();
if(n=="CHECKBOX.p1.x20.y81")SYS_CB_CHECKBOX_p1_x20_y81();
if(n=="CHECKBOX.p1.x20.y101")SYS_CB_CHECKBOX_p1_x20_y101();
if(n=="CHECKBOX.p1.x20.y125")SYS_CB_CHECKBOX_p1_x20_y125();
if(n=="CHECKBOX.p1.x20.y143")SYS_CB_CHECKBOX_p1_x20_y143();
if(n=="CHECKBOX.p1.x20.y158")SYS_CB_CHECKBOX_p1_x20_y158();
if(n=="CHECKBOX.p1.x20.y179")SYS_CB_CHECKBOX_p1_x20_y179();
if(n=="CHECKBOX.p1.x20.y192")SYS_CB_CHECKBOX_p1_x20_y192();
if(n=="CHECKBOX.p1.x120.y229")SYS_CB_CHECKBOX_p1_x120_y229();
if(n=="CHECKBOX.p1.x146.y229")SYS_CB_CHECKBOX_p1_x146_y229();
}
javascript_obj0023_006.js pdf-javascript-stream PDF /JS object 23 at offset 0xA631 32 bytes
SHA-256: efc42980ff0250b155bd6b079021054d02210130eb0b7c03514a3e06ef37d35c
Preview script
First 1,000 lines of the extracted script
SYS_CB_CHECKBOX_p0_x120_y208();
javascript_obj0026_007.js pdf-javascript-stream PDF /JS object 26 at offset 0xA92A 32 bytes
SHA-256: 99cedacfe910a8dc03552ffd3575b7bfd26baa217d3d48861006dc80f8ae34b9
Preview script
First 1,000 lines of the extracted script
SYS_CB_CHECKBOX_p0_x144_y208();
javascript_obj0062_017.js pdf-javascript-stream PDF /JS object 62 at offset 0xCC21 32 bytes
SHA-256: e16add8affd39876ee6ca2b435c9ead3c64414e71a16e0e2f7bd749ffeb50358
Preview script
First 1,000 lines of the extracted script
SYS_CB_CHECKBOX_p1_x120_y229();
javascript_obj0065_018.js pdf-javascript-stream PDF /JS object 65 at offset 0xCF19 32 bytes
SHA-256: 93d4f6ddee73055021be879ffac8c5e5a0e0ae96523061ad03a13a9412c01cdd
Preview script
First 1,000 lines of the extracted script
SYS_CB_CHECKBOX_p1_x146_y229();
javascript_obj0074_019.js pdf-javascript-stream PDF /JS object 74 at offset 0xDBDF 1170 bytes
SHA-256: ea5aaa3a426610b72ff3e8cc69761ce23e0c5a201cbc6325b9f47eadcda57492
Preview script
First 1,000 lines of the extracted script
function getBgColor(fn){
var BG_DISABLED=["RGB",0.749,0.749,0.749];
var BG_66=["RGB",1.0,1.0,1.0];
  if(fn=="TEXTFIELD.p0.x131.y52") return BG_66;
  if(fn=="CHECKBOX.p0.x20.y103") return BG_66;
  if(fn=="CHECKBOX.p0.x20.y120") return BG_66;
  if(fn=="CHECKBOX.p0.x20.y179") return BG_66;
  if(fn=="CHECKBOX.p0.x120.y208") return BG_66;
  if(fn=="CHECKBOX.p0.x144.y208") return BG_66;
  if(fn=="TEXTFIELD.p0.x20.y261") return BG_66;
  if(fn=="CHECKBOX.p1.x20.y40") return BG_66;
  if(fn=="TEXTFIELD.p1.x58.y55") return BG_66;
  if(fn=="CHECKBOX.p1.x20.y61") return BG_66;
  if(fn=="CHECKBOX.p1.x20.y81") return BG_66;
  if(fn=="CHECKBOX.p1.x20.y101") return BG_66;
  if(fn=="CHECKBOX.p1.x20.y125") return BG_66;
  if(fn=="CHECKBOX.p1.x20.y143") return BG_66;
  if(fn=="CHECKBOX.p1.x20.y158") return BG_66;
  if(fn=="CHECKBOX.p1.x20.y179") return BG_66;
  if(fn=="CHECKBOX.p1.x20.y192") return BG_66;
  if(fn=="TEXTFIELD.p1.x20.y265") return BG_66;
  if(fn=="CHECKBOX.p1.x120.y229") return BG_66;
  if(fn=="CHECKBOX.p1.x146.y229") return BG_66;
  if(fn=="TEXTFIELD.p1.x141.y20") return BG_66;
  if(fn=="TEXTFIELD.p1.x118.y214") return BG_66;
    return color.transparent;}
javascript_obj0075_020.js pdf-javascript-stream PDF /JS object 75 at offset 0xE0E4 166 bytes
SHA-256: 9f51a81ea495069ac3bd65daf89fd1c4a332f6ab52c21e14c04ec2c85ecccdee
Preview script
First 1,000 lines of the extracted script
function getBorderColor(fn){
   var f = this.getField(fn);
   if((null!=f)&&("checkbox"==f.type))
   { return ["RGB",0.0,0.0,0.0];
   }
   return color.transparent;
}
javascript_obj0076_021.js pdf-javascript-stream PDF /JS object 76 at offset 0xE1C6 280 bytes
SHA-256: bb0cc0ea4c337306f6e2f48a1141a3f0f0b71c8fa4e6a492f8fae20a58ca3eb4
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CLR(name,bNeedsColouredMustFillBorder)
{
    if(bNeedsColouredMustFillBorder)
    {    getField(name).strokeColor=color.red;
        }
        else
    	{    getField(name).strokeColor=getBorderColor(name);
        }
    return bNeedsColouredMustFillBorder;
}
javascript_obj0077_022.js pdf-javascript-stream PDF /JS object 77 at offset 0xE31E 468 bytes
SHA-256: 82c0fd6e6cc117687c47ced7f0ce920ecb308781c8402ac1927d871608b9fef1
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_STATE()
{
    if(false==SYS_IS_MUFI_CB(SYS_CB_HDL_STATE.arguments[0])) return false;
    var obj=getField(SYS_CB_HDL_STATE.arguments[0]);
    if("Yes"==obj.value) return false;
    if(true==obj.readonly) return false;
    if(display.hidden==obj.display) return false;
    for(var i=1;i<SYS_CB_HDL_STATE.arguments.length;i++)
    {   if("Yes"==getField(SYS_CB_HDL_STATE.arguments[i]).value)
    	{   return false;
        }
    }
    return true;
}
javascript_obj0078_023.js pdf-javascript-stream PDF /JS object 78 at offset 0xE540 168 bytes
SHA-256: f6c2357c12b7e2cbd2f963dd05935f9bd1d924cb5654b0cfca7b2eeaa3f05a1b
Preview script
First 1,000 lines of the extracted script
function SYS_IS_MUFI_CB(cbname)
{   var all_mufi_cb= new Array();
	for(var i=0;i<all_mufi_cb.length;i++)
	{	if(cbname==all_mufi_cb[i]) return true;
	}
	return false;
}
javascript_obj0079_024.js pdf-javascript-stream PDF /JS object 79 at offset 0xE623 70 bytes
SHA-256: 68582c3b030f7ce77460540a7ea21e899d133ef6ae8330fbbb6a5db8d1040ccb
Preview script
First 1,000 lines of the extracted script
function SYS_FILL(f,c){
  if(""+f.fillColor!=""+c)  {f.fillColor=c;}}
javascript_obj0080_025.js pdf-javascript-stream PDF /JS object 80 at offset 0xE69B 251 bytes
SHA-256: 11a1bd3ed0d867a06a568a40ba9d93946c031e168697e359578f9ad5e75f7e59
Preview script
First 1,000 lines of the extracted script
function SYS_EWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0081_026.js pdf-javascript-stream PDF /JS object 81 at offset 0xE7E1 251 bytes
SHA-256: b489e14c022670e263ade06b76d1f9a44446979ddfa4df58bed63e1e68ca6dfa
Preview script
First 1,000 lines of the extracted script
function SYS_AWM(f1,f2){
 var v1=getField(f1);
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(v1.value=="Off")
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
 else
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
}
javascript_obj0082_027.js pdf-javascript-stream PDF /JS object 82 at offset 0xE927 220 bytes
SHA-256: f4379dc788b0345e77b7c62fb70b4743640256954408c64b71bb4e1d213b0ffe
Preview script
First 1,000 lines of the extracted script
function SYS_EWB(v1,f2){
 var v2=getField(f2);
 if((null==v1)||(null==v2)) return;
 if(""==v1)
 { v2.readonly=true;SYS_FILL(v2,["RGB",0.749,0.749,0.749]);
 }
 else
 {  v2.readonly=false;SYS_FILL(v2,getBgColor(f2));
 }
}
javascript_obj0083_028.js pdf-javascript-stream PDF /JS object 83 at offset 0xEA4B 1263 bytes
SHA-256: 2856e6304c394af10c1bf9c2627fd4c31d4605a8e9c743b15c91d5a1c90a0abe
Preview script
First 1,000 lines of the extracted script
function SYS_PA2_SUBMIT()
{
        var pflichtfelder_befuellt = SYS_CHECK_MF_FIELDS();
        var n = this.numFields;
        var f;
        var fn;
        for(var i=0;i<n;i++)
        {
                fn = this.getNthFieldName(i);
                if( (""!=fn) && ("SYS_SEND_BUTTON"==fn.substring(0,15)) )
                {
                        f = this.getField(fn);
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=false;
                        	 }
                        	 else
                        	 { f.readonly=true;
                        	 }
                        }
                        f = this.getField("SYS_SEND_BTN_SHADOW"+fn.substring(15,fn.length));
                        if(null!=f)
                        {
                             if(true==pflichtfelder_befuellt)
                        	 { f.readonly=true;
                        	   f.display=display.hidden;
                        	 }
                        	 else
                        	 { f.readonly=false;
                        	   f.display=display.visible;
                        	 }
                        }
                }
        }
}
javascript_obj0084_029.js pdf-javascript-stream PDF /JS object 84 at offset 0xEFA8 219 bytes
SHA-256: 18c7a0ee879972906f57e604098b8daf66bef5d7155d0898a80ad843d48ae424
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x20_y103(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x20.y103");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x20.y103",retval);
    }
    return retval;
}
javascript_obj0085_030.js pdf-javascript-stream PDF /JS object 85 at offset 0xF0BE 219 bytes
SHA-256: 40bfd517c8a16196ee04671f152966a2dd1bbf30b453230364a6497dc8813a6b
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x20_y120(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x20.y120");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x20.y120",retval);
    }
    return retval;
}
javascript_obj0086_031.js pdf-javascript-stream PDF /JS object 86 at offset 0xF1D4 219 bytes
SHA-256: c755f7757d4e77015f34d42d9d1c3b2af2cdb77e6c04008b7cc882a0b54e9fd0
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x20_y179(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x20.y179");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x20.y179",retval);
    }
    return retval;
}
javascript_obj0087_032.js pdf-javascript-stream PDF /JS object 87 at offset 0xF2EA 270 bytes
SHA-256: 2fef1ba9c7dc7c585fdffb8b227eca9d07102b35df061dc675651eed0d00b1ce
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x120_y208(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x120.y208","CHECKBOX.p0.x120.y208","CHECKBOX.p0.x144.y208");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x120.y208",retval);
    }
    return retval;
}
javascript_obj0088_033.js pdf-javascript-stream PDF /JS object 88 at offset 0xF433 270 bytes
SHA-256: 2c8cb96ad7079129c4fc1620804aa1e4653b18989dcc06d68a29c3852ed5d5e4
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p0_x144_y208(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p0.x144.y208","CHECKBOX.p0.x120.y208","CHECKBOX.p0.x144.y208");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p0.x144.y208",retval);
    }
    return retval;
}
javascript_obj0089_034.js pdf-javascript-stream PDF /JS object 89 at offset 0xF57C 216 bytes
SHA-256: dc81df32ccbfeef70a68d8d49edaf26c3abc201308bd35566d679904eda8d1ec
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p1_x20_y40(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p1.x20.y40");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p1.x20.y40",retval);
    }
    return retval;
}
javascript_obj0090_035.js pdf-javascript-stream PDF /JS object 90 at offset 0xF68F 216 bytes
SHA-256: f44980f1a75763a8cc68760ccc491a7ce7b649c53ca5011707b9607735e1d120
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p1_x20_y61(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p1.x20.y61");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p1.x20.y61",retval);
    }
    return retval;
}
javascript_obj0091_036.js pdf-javascript-stream PDF /JS object 91 at offset 0xF7A2 216 bytes
SHA-256: f61f002d7e93d8fc12d80b346d6f536e272f9be332fccc412c96926ada4e43de
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p1_x20_y81(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p1.x20.y81");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p1.x20.y81",retval);
    }
    return retval;
}
javascript_obj0092_037.js pdf-javascript-stream PDF /JS object 92 at offset 0xF8B5 219 bytes
SHA-256: 47c8f98ff64e16b33d8b7c1a3fbd6990e68da33c7672149bdb3998a4e2305b98
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p1_x20_y101(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p1.x20.y101");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p1.x20.y101",retval);
    }
    return retval;
}
javascript_obj0093_038.js pdf-javascript-stream PDF /JS object 93 at offset 0xF9CB 219 bytes
SHA-256: 4580931fce47d441e7acd3f24c1cf7ccc9c66185f400658dd57aa78e3c6ba48b
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p1_x20_y125(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p1.x20.y125");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p1.x20.y125",retval);
    }
    return retval;
}
javascript_obj0094_039.js pdf-javascript-stream PDF /JS object 94 at offset 0xFAE1 219 bytes
SHA-256: 174cbaa0bf5576caa1fc39ee4482408c9f44bbf4fb02c10de71fd13d05848e84
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p1_x20_y143(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p1.x20.y143");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p1.x20.y143",retval);
    }
    return retval;
}
javascript_obj0095_040.js pdf-javascript-stream PDF /JS object 95 at offset 0xFBF7 219 bytes
SHA-256: b104566747de89e050363108b105bf6ed475b777066da7af3d7dcafbd9366385
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p1_x20_y158(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p1.x20.y158");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p1.x20.y158",retval);
    }
    return retval;
}
javascript_obj0096_041.js pdf-javascript-stream PDF /JS object 96 at offset 0xFD0D 219 bytes
SHA-256: 91ce87a84040cdb5825f2daa3f52756b84070c200be5a145e418191fb2a1c900
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p1_x20_y179(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p1.x20.y179");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p1.x20.y179",retval);
    }
    return retval;
}
javascript_obj0097_042.js pdf-javascript-stream PDF /JS object 97 at offset 0xFE23 219 bytes
SHA-256: e334b2c23841f48d587288ef265abcdd6d8c008e59d46cf65a67bf3f70df0865
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p1_x20_y192(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p1.x20.y192");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p1.x20.y192",retval);
    }
    return retval;
}
javascript_obj0098_043.js pdf-javascript-stream PDF /JS object 98 at offset 0xFF39 270 bytes
SHA-256: 82d339ea247bdf9c5f0dbdaca98f7b27e13989fd96f55a225428a96238d3f4ba
Preview script
First 1,000 lines of the extracted script
function SYS_CB_HDL_CHECKBOX_p1_x120_y229(changecolor)
{   var retval=SYS_CB_HDL_STATE("CHECKBOX.p1.x120.y229","CHECKBOX.p1.x120.y229","CHECKBOX.p1.x146.y229");
    if(true==changecolor)
    {   SYS_CB_HDL_CLR("CHECKBOX.p1.x120.y229",retval);
    }
    return retval;
}

Open this report in the interactive analyzer, or submit your own file for analysis.