Suspicious ^80% javascript-malware-collection Download

20170429_44e48fdaf95ed83598d3f349bf9f725d.js

obfuscated eval, ActiveX, evasion

Builds ActiveX ProgID from fragmentseval() executing transformed code

SHA-25613e9f492095bed1e72f2f59c739e7c11af1818e1170f1bd37641bb8212d68a8e

Evidence

Many long string literals concatenated in source lines 1–48

1var IUySmZQNGTuAfhEYVKx = 
2'm'+
3'DOGX'+
4'RzIwCT'+
5'VjskvcxJ'+
6'AhWPqLM'+
7'Yt'+
8'lfv'+
9'amDOGXRzIw'+
10'CTV'+
11'j'+
12'skvcx'+
13'JAhWPq'+
14'L'+
15'MYtlfr bnmDOG'+
16'XRzIwC'+
17'TVjs'+
18'kvcxJAhWPqLMY'+
19'tlf'+
20'ymDOGXR'+
21'zIwCTV'+
22'js'+
23'kvcxJAh'+
24'WP'+
25'q'+
26'LM'+
27'Ytl'+
28'fzImDOG'+
29'XRz'+
30'IwCTV'+
31'jskvcxJAhWPqLMYt'+
32'lfmmDOGX'+
⋯10 lines
43'TVj'+
44'skvc'+
45'xJAhWPqL'+
46'MYtlfoDfmDOGXRzIwCTVjskvcx'+
47'JAhWPqLMY'+
48'tlfRmDOGXRzIwC'+

JavaScript massive string concatenation chain lines 64–96

64:4… PqLMYt'+
65'lf mDOGXR'+
66'zIw'+
67'CTVjskvcxJA'+
68'hWPqL'+
69'MYtlf= nm'+
70'D'+
71'OGXR'+
⋯25 lines

Builds ActiveX ProgID from fragments lines 1306–1330

⋯7 lines
1313'lvgB'+
1314'm'+
1315'tse'+
1316'UonG.HAdW'+
1317'XpbE'+
⋯13 lines