Javascript encoded?

[anime]

what's encoding used in this code:

%PDF-1.5
%Ë?<ø
1 0 obj<</T#79p#65/#43at#61#6c#6f#67/O#75#74#6c#69n#65s 2 0 R/Pa#67e#73 3 0
R/Op#65n#41#63#74#69o#6e 5 0 R>>endobj
2 0 obj<</#54ype/O#75tl#69#6ee#73/C#6f#75n#74 0>>endobj
3 0 obj<</Type/#50ag#65#73/K#69ds[4 0 R]/Co#75#6e#74 1>>endobj
4 0 obj<</#54#79#70e/Pag#65/Pa#72e#6et 3 0 R/M#65#64i#61B#6fx[0 0 612
792]>>endobj
5 0 obj<</#54ype/#41cti#6fn/S/#4a#61#76a#53cr#69p#74/JS 6 0 R>>endobj
6 0 obj<</L#65#6egt#68
2709/#46#69l#74#65#72[/#46#6cat#65#44#65#63ode/#41SC#49IHe#78#44ecod#65]>>
stream

is this javascript encoded?

 

[Bwig Zomberi]

what's encoding used in this code:

%PDF-1.5
%к?<Ь
1 0 obj<</T#79p#65/#43at#61#6c#6f#67/O#75#74#6c#69n#65s 2 0 R/Pa#67e#733 0
R/Op#65n#41#63#74#69o#6e 5 0 R>>endobj
2 0 obj<</#54ype/O#75tl#69#6ee#73/C#6f#75n#74 0>>endobj
3 0 obj<</Type/#50ag#65#73/K#69ds[4 0 R]/Co#75#6e#74 1>>endobj
4 0 obj<</#54#79#70e/Pag#65/Pa#72e#6et 3 0 R/M#65#64i#61B#6fx[0 0 612
792]>>endobj
5 0 obj<</#54ype/#41cti#6fn/S/#4a#61#76a#53cr#69p#74/JS 6 0 R>>endobj
6 0 obj<</L#65#6egt#68
2709/#46#69l#74#65#72[/#46#6cat#65#44#65#63ode/#41SC#49IHe#78#44ecod#65]>>
stream

is this javascript encoded?

This is a PDF file.

Use a PDF library to process the JS, if it has any.

 

[Richard Cornford]

what's encoding used in this code:

%PDF-1.5

^^^
Something of Adobe's perhaps. Where did you get it from?

% ?<
1 0 obj<</T#79p#65/#43at#61#6c#6f#67/O#75#74#6c#69n#65s 2 0 R/Pa#67e#73 30
R/Op#65n#41#63#74#69o#6e 5 0 R>>endobj
2 0 obj<</#54ype/O#75tl#69#6ee#73/C#6f#75n#74 0>>endobj
3 0 obj<</Type/#50ag#65#73/K#69ds[4 0 R]/Co#75#6e#74 1>>endobj
4 0 obj<</#54#79#70e/Pag#65/Pa#72e#6et 3 0 R/M#65#64i#61B#6fx[0 0 612
792]>>endobj
5 0 obj<</#54ype/#41cti#6fn/S/#4a#61#76a#53cr#69p#74/JS 6 0 R>>endobj
6 0 obj<</L#65#6egt#68
2709/#46#69l#74#65#72[/#46#6cat#65#44#65#63ode/#41SC#49IHe#78#44ecod#65]>>
stream

is this javascript encoded?

What is "javascript encoded" supposed to mean? Do you mean javascript
that has been encoded (in some unspecified way, and you are asserting
that it is javascript), encoded using javascript (how could anyone
tell), or encoded using a built-in javascript encoding method such as
- encodeURIComponent - (or - encode -)? The latter case can be ruled
out as the text contains a percent symbol which is followed by a space
characters, and that is not permissible in URI encoding.

Richard.

 

[Erwin Moller]

anime schreef:

what's encoding used in this code:

%PDF-1.5
%Ë?<ø
1 0 obj<</T#79p#65/#43at#61#6c#6f#67/O#75#74#6c#69n#65s 2 0 R/Pa#67e#73 3 0
R/Op#65n#41#63#74#69o#6e 5 0 R>>endobj
2 0 obj<</#54ype/O#75tl#69#6ee#73/C#6f#75n#74 0>>endobj
3 0 obj<</Type/#50ag#65#73/K#69ds[4 0 R]/Co#75#6e#74 1>>endobj
4 0 obj<</#54#79#70e/Pag#65/Pa#72e#6et 3 0 R/M#65#64i#61B#6fx[0 0 612
792]>>endobj
5 0 obj<</#54ype/#41cti#6fn/S/#4a#61#76a#53cr#69p#74/JS 6 0 R>>endobj
6 0 obj<</L#65#6egt#68
2709/#46#69l#74#65#72[/#46#6cat#65#44#65#63ode/#41SC#49IHe#78#44ecod#65]>>
stream

is this javascript encoded?

Hi,

Your question is poorly formulated.
The reader wonders:
1) Where does that piece of code come from?
2) What did you post excactly? Are that linenumbers? Are they in the
code, or were they added by the program you use to open the file in
question?
3) What do you mean by JavaScript encoded?
If one encodes some file with C, Java, Perl or JavaScript, how can you
tell by the endresult (=output)?

Please be more clear and provide us with some context if you want a
reasonable response.

Erwin Moller

--
"There are two ways of constructing a software design: One way is to
make it so simple that there are obviously no deficiencies, and the
other way is to make it so complicated that there are no obvious
deficiencies. The first method is far more difficult."
-- C.A.R. Hoare

 

[anime]

well, poorly formulated
1) this is from pdf file. We know, pdf support javascript
2) its "header part", the next goes complete scrambled data like this

x?}ZýÍ£KE!ûZÎ?ê?-~ݼ0"
R">Ú?3S]WãB? Hêu?RJ?~'SëÀTR-Õ?Ñ/è{Àmeài\?Ü-g?&??%È????g?k?Æ9vi?<ÆÇ?íqJ[KUFê?*CùK?9giÙËÑ2?UL9WÍo?-?û?Þ4JËF1ë3]ÎB_yû_œfR<-?Etëæ>Í?|ÅsZæ8VfM?ãÃ
_)RMß'èZÞX;ÖŠ??2tvN2Ñ%Od%*?KãÀ?E0(7z?óÖ.UÚ'?ã\ò_Ö-ãÞ ?ÕÜr?'s"?RF-õMúÐÎìô$çÅ

3) I think, its contain a lot of obfuscated javascript code, may be in some
unspecified way. Perhaps something else.
OK, if it not an obfuscated javascript code, what is this?

Thank you.

-----------


"Erwin Moller"

anime schreef:

what's encoding used in this code:

%PDF-1.5
%Ë?<ø
1 0 obj<</T#79p#65/#43at#61#6c#6f#67/O#75#74#6c#69n#65s 2 0 R/Pa#67e#73 3
0
R/Op#65n#41#63#74#69o#6e 5 0 R>>endobj
2 0 obj<</#54ype/O#75tl#69#6ee#73/C#6f#75n#74 0>>endobj
3 0 obj<</Type/#50ag#65#73/K#69ds[4 0 R]/Co#75#6e#74 1>>endobj
4 0 obj<</#54#79#70e/Pag#65/Pa#72e#6et 3 0 R/M#65#64i#61B#6fx[0 0 612
792]>>endobj
5 0 obj<</#54ype/#41cti#6fn/S/#4a#61#76a#53cr#69p#74/JS 6 0 R>>endobj
6 0 obj<</L#65#6egt#68
2709/#46#69l#74#65#72[/#46#6cat#65#44#65#63ode/#41SC#49IHe#78#44ecod#65]>>
stream

is this javascript encoded?

Hi,

Your question is poorly formulated.
The reader wonders:
1) Where does that piece of code come from?
2) What did you post excactly? Are that linenumbers? Are they in the code,
or were they added by the program you use to open the file in question?
3) What do you mean by JavaScript encoded?
If one encodes some file with C, Java, Perl or JavaScript, how can you
tell by the endresult (=output)?

Please be more clear and provide us with some context if you want a
reasonable response.

Erwin Moller

--
"There are two ways of constructing a software design: One way is to make
it so simple that there are obviously no deficiencies, and the other way
is to make it so complicated that there are no obvious deficiencies. The
first method is far more difficult."
-- C.A.R. Hoare

 

[Erwin Moller]

anime schreef:

well, poorly formulated
Hi,

1) this is from pdf file. We know, pdf support javascript
2) its "header part", the next goes complete scrambled data like this

OK

3) I think, its contain a lot of obfuscated javascript code, may be in
some unspecified way. Perhaps something else.
OK, if it not an obfuscated javascript code, what is this?

Well, if you want to know how a PDF file is constructed you must dive
into the specification.
But the good news is that Adobe opened up the specs a few years ago.

If you want to learn more, try this:
http://en.wikipedia.org/wiki/Portable_Document_Format

Or more in-depth:
http://www.adobe.com/devnet/pdf/pdf_reference.html

Make sure you have a few days off to study that. ;-)

Good luck

Erwin Moller

Thank you.

-----------


"Erwin Moller"

anime schreef:

what's encoding used in this code:

%PDF-1.5
%Ë?<ø
1 0 obj<</T#79p#65/#43at#61#6c#6f#67/O#75#74#6c#69n#65s 2 0
R/Pa#67e#73 3 0
R/Op#65n#41#63#74#69o#6e 5 0 R>>endobj
2 0 obj<</#54ype/O#75tl#69#6ee#73/C#6f#75n#74 0>>endobj
3 0 obj<</Type/#50ag#65#73/K#69ds[4 0 R]/Co#75#6e#74 1>>endobj
4 0 obj<</#54#79#70e/Pag#65/Pa#72e#6et 3 0 R/M#65#64i#61B#6fx[0 0 612
792]>>endobj
5 0 obj<</#54ype/#41cti#6fn/S/#4a#61#76a#53cr#69p#74/JS 6 0 R>>endobj
6 0 obj<</L#65#6egt#68
2709/#46#69l#74#65#72[/#46#6cat#65#44#65#63ode/#41SC#49IHe#78#44ecod#65]>>

stream

is this javascript encoded?

Hi,

Your question is poorly formulated.
The reader wonders:
1) Where does that piece of code come from?
2) What did you post excactly? Are that linenumbers? Are they in the
code, or were they added by the program you use to open the file in
question?
3) What do you mean by JavaScript encoded?
If one encodes some file with C, Java, Perl or JavaScript, how can you
tell by the endresult (=output)?

Please be more clear and provide us with some context if you want a
reasonable response.

Erwin Moller

--
"There are two ways of constructing a software design: One way is to
make it so simple that there are obviously no deficiencies, and the
other way is to make it so complicated that there are no obvious
deficiencies. The first method is far more difficult."
-- C.A.R. Hoare

--
"There are two ways of constructing a software design: One way is to
make it so simple that there are obviously no deficiencies, and the
other way is to make it so complicated that there are no obvious
deficiencies. The first method is far more difficult."
-- C.A.R. Hoare

 

[Thomas 'PointedEars' Lahn]

1) this is from pdf file. We know, pdf support javascript

That depends on the viewer application, of course, but generally PDF
documents support a scripting language that is perhaps a conforming
implementation of ECMAScript (I haven't checked its grammar yet) and that
Adobe calls "JavaScript" (it isn't).

2) its "header part", the next goes complete scrambled data like this

x?}ZЩмёKE!ШZн?Й?-~щ╪0"
R">з?3S]WЦB?
HЙu?RJ?~│'SКÑŽTR-у?Ñ/Ð¥{ÑŽmeЮi\?Ñ-g?&??%Ñ…????g?k?Ñ„9v
i?<ф│г?ÐœqJ[KUFЙ?*CЫK?9giыкÑ2?UL9Wмo?-?Ш?ч4JкF1К3]нB_yШ_°fR<-?EtКФ>м?| еsZФ8VfM?Цц
_)RMÑŠ'Ð¥ZчX;ж┼??2tvN2Ñ%Od%*?KЦю?E0(7z?Сж.Uз'?Ц\Р_ж-Цч
?уÑr?'s"?RF-УMЗпнЛТ$Ге

3) I think, its contain a lot of obfuscated javascript code, may be in
some unspecified way.

I think you do not know what you are doing, or what you are talking about.

Perhaps something else.

Most certainly.

OK, if it not an obfuscated javascript code, what is this?

Binary data, interpreted as (in your case) KOI8-R encoded characters.
Any other file that would not be plain text would look similar.


PointedEars

 

[anime]

Thanks for clear and exhaustive answer. Now its clear.

The document contains javascript in object 6 - it's important, as we can

see, this two filters, FlateDecode and ASCIIHexDecode are both deprecated
lossy filters. What is better lossless filters (3-4 ones) for replacing this
old deprecated stuff?

Regards,
~~~~~~~~

what's encoding used in this code:

Simple hex encoding, e.g. #79 = y.

Decoded:

1 0 obj<</Type/Catalog/Outlines 2 0 R/Pages 3 0
R/OpenAction 5 0 R>>endobj
2 0 obj<</Type/Outlines/Count 0>>endobj
3 0 obj<</Type/Pages/Kids[4 0 R]/Count 1>>endobj
4 0 obj<</Type/Page/Parent 3 0 R/MediaBox[0 0 612
792]>>endobj
5 0 obj<</Type/Action/S/JavaScript/JS 6 0 R>>endobj
6 0 obj<</Length
2709/Filter[/FlateDecode/ASCIIHexDecode]>>
stream

is this javascript encoded?

The document contains javascript in object 6, if I'm remembering the
PDF format correctly, and that stream needs to have FlateDecode (gz
deflate) and ASCIIHexDecode (hexadecimal text to ASCII) applied so as
to be readable.

All this is typical of the kind of obfuscation you see in malicious
PDFs.

 

[Bwig Zomberi]

well, poorly formulated
1) this is from pdf file. We know, pdf support javascript
2) its "header part", the next goes complete scrambled data like this

x?}ZЩмёKE!ШZн?Й?-~щ╪0"
R">з?3S]WЦB?
HЙu?RJ?~│'SКÑŽTR-у?Ñ/Ð¥{ÑŽmeЮi\?Ñ-g?&??%Ñ…????g?k?Ñ„9vi?<ф│г?ÐœqJ[KUFЙ?*CЫK?9giыкÑ2?UL9Wмo?-?Ш?ч4JкF1К3]нB_yШ_°fR<-?EtКФ>м?|еsZФ�8VfM?Цц
_)RMÑŠ'Ð¥ZчX;ж┼??2tvN2Ñ%Od%*?KЦю?E0(7z?Сж.Uз'?Ц\Р_ж-Цч
?уÑr?'s"?RF-УMЗпнЛТ$Ге

3) I think, its contain a lot of obfuscated javascript code, may be in
some unspecified way. Perhaps something else.
OK, if it not an obfuscated javascript code, what is this?

A PDF file contains both text and binary data. So, it will be scrambled.
http://pdf.jpedal.org/java-pdf-blog/bid/30454/Why-can-t-I-just-open-and-edit-a-PDF-file

The code is not obfuscated. It is zipped using a loss-less compression
algorithm.

To process the JS, it is wiser to use a server-side PDF library - same
for adding the JS.

For more information on using JavaScript in your PDF documents, download:
Acrobat JavaScript Scripting Reference
http://partners.adobe.com/public/developer/en/acrobat/sdk/AcroJS.pdf

Acrobat JavaScript Scripting Guide
http://partners.adobe.com/public/developer/en/acrobat/sdk/AcroJSGuide.pdf

For help with PDF processing, go to comp.text.pdf newsgroup.

 

[anime]

How we can see the decoded Javascript in object 6?

Thanks.

 

[Thomas 'PointedEars' Lahn]

How we can see the decoded Javascript in object 6?

Well, by applying the specified decompression and decoding algorithms.
Unless you have a question about JavaScript/JScript/ECMAScript programming,
I strongly suggest you go elsewhere.

[Top post]

<http://jibbering.com/faq/#posting>


PointedEars