Time-locked SHA-1 XOR JavaScript loader

The PDF JavaScript embeds a full inline SHA-1 implementation and derives an XOR key from the victim's wall-clock minute (getHours()+''+getMinutes()); the digest decrypts a small ciphertext array that is then eval'd, with a catch{} block retrying the previous minute for clock-rollover tolerance. The wall-clock keying is a deliberate anti-static / anti-sandbox measure — the decryption key only exists at the victim's open time, so the encrypted stage cannot be recovered by static analysis (~1440 possible minute keys, no validation oracle). The loader construction is nonetheless conclusive: no legitimate PDF hashes the clock to eval code. This is a known pre-2011 PDF exploit-kit loader whose encrypted second stage is an Adobe Reader JavaScript exploit; attributed at related confidence as an exploit-kit family because the exact CVE trigger is time-locked out of view.