This is a VBScript exploit (CVE-2016-0189) stolen from RIG EK and a pattern of Sundown EK of reusing other EKs code. The infection chain starts with a compromised site that was injected with a link to a hacked OpenX ad server. The rest is pretty classic as it involves fast changing shadowed domains that generate the iframe to the exploit kit landing page. This may not be the latest and greatest exploit kit we were expecting, indeed the Flash exploit(s) are not new and overall we could call it a lite version.”]
Source: https://blog.malwarebytes.com/cybercrime/exploits/2016/10/yet-another-sundown-ek-variant/