javascript-malware-collection · Index

20161006_4684172862e7be872dac2d74dac13eb0.js Apr 24 javascript-malware-collection

53907e0d54f734dd170f00b32a817414dc941dce8a25eb673b425587d739db91 K(Li)O₂(As₆S)H₂(DbPo)Md

94% eval obfuscated payload

20161006_5c1e059ee24577b3b62e4d2e0a9c7f1c.js Apr 24 javascript-malware-collection

12099517e83c007377071f955d38bd6b19b1543adbc914a441ab0a8b8a08a4f0 K(Li)O₂(As₆S)H₂(DbPo)Md

94% eval obfuscated payload

20161006_53f7f206bc786a0f7eaab40ae4ec42fa.js Apr 24 javascript-malware-collection

e5512b3aa454515ec0d33a015be7fe0e339feae84d751cda95534031d3453080 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod obfuscated eval dropper

20160328_da967ec41411174b23fb72dca61e4d30.js Apr 24 javascript-malware-collection

0de13376a82c4cf591c729ef37d169b7a17207b98d0c98ee64299ba044bedcf3 K(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

100% Downloads and executes remote payload

20161006_d612fcaf9748b3cd2f869f8b2012e0b8.js Apr 24 javascript-malware-collection

bb71b5b909c4fa5d075535a3433b6478d8fdd1b823eb36c5911b58d8a62b26cc O(As₅)H₂(DbPo)Md₂(Pa)

99% Obfuscated eval execution

20160328_ce0e705bc211aaadbabde252ab4a26a1.js Apr 24 javascript-malware-collection

8c53eb74c3441da51207669512a5bfa4c8cf0b6345efb93d4c91d95747366a30 K(Li)O₃(As₃SXe)H₂(Db₅Po)

92% Obfuscated WScript payload execution

20161006_d00c42e5e22bbb3a70d83c3fab73a55f.js Apr 24 javascript-malware-collection

d9fc6885986d15b8820000948b9fb7084a4dea242fba7f8685eaf821900cc640 K(Li)O₂(As₆S)H₂(DbPo)Md

94% obfuscated eval payload

20160328_d57112bb62079847b3bfdcec192b3a17.js Apr 24 javascript-malware-collection

6ed0982928297635f0097963df971c6e4c9e75a82ebeb24782dc0c9f8e5bfd0c K(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

100% Downloads and executes remote payload

20160328_02575ef7a1fc0d0b796ad1d6bae4a15a.js Apr 24 javascript-malware-collection

7f16a10bb4be52abb5e11d3b18fde298b48207091d19df3924beaeb32670503c K(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

100% Downloads and executes remote payload

20160328_4af0f7f71363d8031066222f0b9851f0.js Apr 24 javascript-malware-collection

aacb2478f139559282636a6facfee6f427c09f84661243265fc5a922315d1f0b K(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

100% Downloads and executes remote payload

20160328_012624cd4a0dd5c22df5447c3cae99c2.js Apr 24 javascript-malware-collection

df04a168dcddebe91cef4bcdd28cfa83fbe2882f586146e2b645bd35d4797497 K(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

66% timing/evasionobfuscation/syntax

20161006_bfe05fc099152186f6fd3e18b5621564.js Apr 24 javascript-malware-collection

66beb86e20f8359c1077030e60eeda97b916674731c93a38843971b3712a801a K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod malware dropper

20160328_82da7ea8f0bf005a04d5027c78dcb646.js Apr 24 javascript-malware-collection

346bf5af9bbdac1a3378613aa4013961900db29ba3aa70d8dc71eaa3af88cb9c K(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

100% Downloads and executes remote payload

20160328_9d13ec328efcf798ff0e44cc83f71f26.js Apr 24 javascript-malware-collection

6ae88a6f596dca342ceac42a4ed4e444275edfbe214dec13d91188b66a5d229a K(Li₂)O₂(As₃Xe)H₂(Db₆Po₂)

93% Obfuscated PowerShell download cradle

20160328_66ebff5d08a04995e0be67110efe54eb.js Apr 24 javascript-malware-collection

0dc2a357953cda9c4741329b5e3214453d1ddc5a6749e518c77c0eecfd354bcc K(Li)O₃(As₃SXe)H₄(Db₄FPo₂U)Md

92% Obfuscated WScript.Sleep and network calls

20161006_a53727d6be1b1df6ec444db2a38c0469.js Apr 24 javascript-malware-collection

073018db58716da588e43345d5ad492ef35a775ef49faa2feed3e3606dcbc562 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod malware dropper

20160328_d89bd540d8b2562c55e0ed8bed1748c7.js Apr 24 javascript-malware-collection

fda245b68f81f966910e91db530d66b562afa1ac94465f74a334df9db2d58f99 K(Li)O₄(AsCSXe)H₂(Db₅Po)Md(Pa)

92% Obfuscated dropper, MSXML C2, eval

20160328_63b2ffbef678c800ecc526724677e520.js Apr 24 javascript-malware-collection

4d8f631c3386d0017cc045a8eae3e18a057705fb6351be29468e8cb0d9046441 K(Li)O₂(As₂Xe)H₂(Db₄Po)

92% Obfuscated eval/unescape payload execution

20161006_6dcc2fa39f0aa0c0378e5069f07d9c2d.js Apr 24 javascript-malware-collection

2cf82fd9255f33a547b2d5e57d30b8f8e809bc839c6df7d63e4d45e63c358d7c O(As₅)H₂(DbPo)Md₂(Pa)

94% Obfuscated eval execution

20161006_c646d1519d46f9371de554d1fa9f2721.js Apr 24 javascript-malware-collection

7d8e9e6517ecc53c30fcbeb3faec1384b027d6a040af9a5ccb4072b8c8e4ed4a K(Li)O₂(As₆S)H₂(DbPo)Md

94% obfuscated eval payload

20161006_0d708d4c3c711967b362b8a84ad02e64.js Apr 24 javascript-malware-collection

f9486391191f82e1869035ad94567d60ddaf341ca21356117f449b79147fa1c5 K(Li)O₂(As₆S)H₂(DbPo)Md

94% Obfuscated eval execution

20161006_a138e83d132736e0e74c42c3ae909431.js Apr 24 javascript-malware-collection

5bc8cf92780dc662f8040520768aa94912e9d82fe436bb9cbccd0221babc9744 K(Li)O₂(As₆S)H₂(DbPo)Md

94% eval obfuscated payload

20160921_74a9afe189b59f0b8148a7f92f42b125.js Apr 24 javascript-malware-collection

5ce6bfd72ee0a8f8259b2cfbaa6f5b49ec72ab64b03caf4bd2a4f733ef96925b K(Li)O₂(As₂S)H₂(DbPo)

96% obfuscated eval execution

20161006_6f202aa04f4f4113f6eec399f42fa89c.js Apr 24 javascript-malware-collection

9430557cd46054c4a12d7ce3b2a21a126f02e83a6e4defc268761042eaa22460 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod malware obfuscation

20161006_79ad04e0a788051121dfe844a00bb245.js Apr 24 javascript-malware-collection

21c69e7da54117999520a87a95cda6688abd4e324f0f67a03bc4f7d5f843a18a K(Li)O₂(As₆S)H₂(DbPo)Md

94% obfuscated eval execution

20160328_38568260963d2c8325936dd6790d9d2c.js Apr 24 javascript-malware-collection

535b1fac38e850af8248159a475c44205feedb86d76a803c51422f4190d452f1 K(Li)O₃(As₂SXe)H₃(Db₄PoU)Md

94% Obfuscated WScript shell execution

20161006_8da8980d263025a86ce64ef20d43fb4b.js Apr 24 javascript-malware-collection

39741b1e06930909dfb6208be26eaa9389a531225ddea448db8a984496d8f615 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod eval obfuscation

20160921_aaf08d1a708106f9bd09a913767a56e1.js Apr 24 javascript-malware-collection

f9cc4d7e90450eb48dcdeb77c2c486f0893efd6ae609a5f1c7bdf6439f61bda7 K(Li)O₂(As₂S)H₂(DbPo)

97% obfuscated eval execution

20160921_bc3224e9a637b2113b3de820bcee66c0.js Apr 24 javascript-malware-collection

65d11827de99ef59cd2cc61d914e235dd2b16ac6b8f4f65f39b8a79dad86ed57 K(Li)O₂(As₂S)H₂(DbPo)

96% Obfuscated eval of decoded payload

20160921_2eacd3ef1ce6866325342ce8cba80e38.js Apr 24 javascript-malware-collection

128e4fae256d5c8ef6708fbd7f51b17e3da126d63b88361b0e92c9808a0c393f K(Li)O₂(As₂S)H₂(DbPo)

97% obfuscated eval execution

20161006_ebc3d885d6ad60781623518e7aa2bfe2.js Apr 24 javascript-malware-collection

3eb59c3b92a4b0a06aa6a02c94ab3a38e64ada3304a420c28662a585f824020f K(Li)O₂(As₆S)H₂(DbPo)Md

94% eval obfuscated payload

20161006_d07ee071233fe51e7ceadf5822c0adf6.js Apr 24 javascript-malware-collection

0c1f640bec17c6af9156be09cf9e4ec876b77237bd002d14d8bcacd723bcb2f9 K(Li)O₂(As₆S)H₂(DbPo)Md

94% Obfuscated eval-reconstructed payload, JScript activation

20160921_18eedffe02de43ba2ee494451deba790.js Apr 24 javascript-malware-collection

295460c559aa147e2ea748501c56677647c72b71ee7df9051801008304580029 K(Li)O₂(As₂S)H₂(DbPo)

96% Obfuscated eval payload, JScript activation

20161006_063be52bb6ef7b5151ac9c8936d57d61.js Apr 24 javascript-malware-collection

d4be6f28493f7976c3abb663f7e5ebcac6fa476837c18f98d7be5459ed0a9ce2 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod obfuscated eval dropper

20161006_c55061ed439d54f19ef7a3b25576d592.js Apr 24 javascript-malware-collection

15ff82fa210319070b69ea5b3c1091185ac4fd2a0d0158b5b4931668c3f52836 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod malware dropper

20161006_7c02ccf603ab3d96229e1b244ff1b305.js Apr 24 javascript-malware-collection

406e4ff3d6d990eceb5f3eb5f4306276f373734ffda44d55c019d0d0875fad83 K₂(McLi)O₂(As₆S)H₂(Db₂Po)

99% Nemucod malware dropper

20160328_7be7d1a64e68a7be99c221f02a6bedfe.js Apr 24 javascript-malware-collection

d380ae99ee893db5f00047f9f8260d9c2e6d27dbe9c64dbf3506185ff5ff4fc4 K(Li)O₃(As₂SXe)H₂(Db₄Po)

89% Obfuscated eval, hidden payload, evasion

20160328_6407f93a86a3f07b873cbfb55f5f6364.js Apr 24 javascript-malware-collection

2174c793fd795f76f7f4e1fe650b0de87f5268eab7e6ec3874a53dd832f9c0de O₂(AsXe)H₂(Db₃Po₂)Md

99% Downloads and executes remote malware

20161006_91db940d7e51b94cb8de3ba91d29b309.js Apr 24 javascript-malware-collection

bb88636ac3abc771ebe2dc70a620250f9034484161e15b76b88c3e600dd51b20 K(Li)O₂(As₆S)H₂(DbPo)Md

94% eval obfuscated payload

20161006_23229ecadae37d3b70c0a649493bfe3a.js Apr 24 javascript-malware-collection

4e56a91295fe1333b0cbbec2ae2ae7a84e1b1d2cf9ea9cfdfbf9e0f75988bba3 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod malware dropper

20161006_9569f4cbb779829044b97293d010408d.js Apr 24 javascript-malware-collection

98eba93aeb65bf83ca877fa0ca61a97621423187106cedef0a4fd3a44bbec35e K(Li)O₂(As₆S)H₂(DbPo)Md

94% eval obfuscated payload

20160921_b04f9fe7316d0e86c0046e130e905e37.js Apr 24 javascript-malware-collection

58df336ac7568c9f52fedec5d0b900480491f3e65f56c23426010ec745a6bddd K(Li)O₂(As₂S)H₂(DbPo)

96% Obfuscated token map feeding eval

20161006_5e526756535e95a6bbc51cbdf55cc5df.js Apr 24 javascript-malware-collection

52ce7925a0f8dd3bc3d179c19c7a9e6d38518932d1f15fcd0a611587b72a8f9e K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod malware dropper

20160328_a0f2ab1c250684f0c6bb82ad5e3ecfb8.js Apr 24 javascript-malware-collection

18d6a3cbc2559dd5881253ae92338430e81784db60254228f9542ca868ca7edd K(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

100% Downloads and executes remote payload

20160328_518b3fc553d9e5bd1fc14eaed904072d.js Apr 24 javascript-malware-collection

100bec8e16065955d94682409e7ab1227cb3379e3c0d46170c91384dd286739d K(Li)O₃(As₃SXe)H₃(Db₅FPo)

90% Obfuscated ADODB and eval execution

20161006_848e3bd148d8d82d9b87a2f3a6e09aab.js Apr 24 javascript-malware-collection

e7366cfd2db8854004465b68a8dd501b715d7fd534d7312eb0aa028ac74f3f33 O(As₃)H₂(DbPo)

97% obfuscated eval, anti-analysis, b64 blob

20160328_4b6f2a35ef5f2b635e023ca88562e6c4.js Apr 24 javascript-malware-collection

e16b3401d06757e89585d7e0264951061784a06d0a726bce094422b01f8c5fce K(Li)O₃(As₂SXe)H₃(Db₅FPo)

90% Obfuscated WScript/ADODB execution

20161006_e7c2631eb2900d8f3afbc5bac39291d3.js Apr 24 javascript-malware-collection

2e0480733dab2829ec41a76e5d411a65e0a1f21a3e191d73d73cb2d7db64b63c K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod malware dropper

20161006_d01f0b61fc29a43bc5a8ec01a6c30e00.js Apr 24 javascript-malware-collection

c8a98320b9d9f9bab0d59fddf9eb1ba0be3e47cc319bdfcba72a0962a661922d K(Mc)O(As₃)H₂(DbPo)

99% Nemucod malware dropper

20161006_62f335e1a008ad9e359b86343d720f4a.js Apr 24 javascript-malware-collection

065f6c10d9e7bdc152209073fa80df05a3925ba4274abd726f364b32c1ea9650 K(Li)O₂(As₆S)H₂(DbPo)Md

94% Obfuscated JScript with @cc_on, dense token array, and eval of reconstructed source — classic evasive dropper pattern.

20160328_53bb996cd41b774c9a19b77cdb427f66.js Apr 24 javascript-malware-collection

a0b292f8c98225bfb1006adbed9af570b380746777644f1360639496a064c90d K(Li)O₃(As₂SXe)H₂(Db₅Po)

91% Obfuscated eval downloads executable

20161006_6410e57d2798f422b59afe1cf5a2cca5.js Apr 24 javascript-malware-collection

4352eb79d3de2d0bc12905b9417316b536fd25092f6865ba65558031675333de K(Li)O₂(As₆S)H₂(DbPo)Md

94% obfuscated eval execution

20161006_501410cf8d3e4a79f83cc378cc02885d.js Apr 24 javascript-malware-collection

184f3d4e3dd1824ee4ac6a8e601515d92778543c30b23c8a333c2e6f8ba75c3b K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod malware dropper

20160328_b4175c2afe9014cbef56004f46854028.js Apr 24 javascript-malware-collection

69a3f63dfa6b2382a8964ecd75d7a42f2c3f81a0961c8dcda540341f8de03267 K(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

100% Downloads and executes remote payload

20160328_604657379900f22298667d99ce66ee2d.js Apr 24 javascript-malware-collection

78a86c9382d1810127ec7c856ba57f3e03f08f162c77ae9eaadc3969d15d2479 K(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

100% HTTP dropper downloads and executes payload

20160328_54dbd271778a211b870408d3e2b1d408.js Apr 24 javascript-malware-collection

d84b717a6976cd23e44fd0e3b7bd41b22ea9cc33c6e572d615aa9d3ebe6dad15 K(Li)O₂(As₄Xe)H₃(Db₅FPo₂)

98% Obfuscated downloader builds URL to .exe and writes file

20160328_1f2e943279507eb858155f0ee1eb74d6.js Apr 24 javascript-malware-collection

7d944fb7b18e31eda598f1cd49616c6fb461089c6739ab15ab6961e32028296a K(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

100% Downloads and executes remote EXE dropper

20161006_d74904e67191d971f09a844eacbca76e.js Apr 24 javascript-malware-collection

8e58bc3cfa90c618cdbea13a6118dcf07a8641799293b019e4614b657b1a82d5 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod obfuscated eval dropper

20160328_ebbed74bd004f2dfcc11b5bc8f038421.js Apr 24 javascript-malware-collection

ec18c6ec2582f88f5de22ce485cb462edbb276e4be15c558db98601309d0c397 O₃(As₂CXe)H₃(Db₆FPo₂)Md₂(Pa)

95% Downloads and executes remote executable

20161006_337eb6d1595a44592186473ffaea80fc.js Apr 24 javascript-malware-collection

b42981c19e4e50b8f0b0cdd77f52fd0435e35a2c6d8d2e10a251aa049a713161 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod obfuscated eval dropper

20160328_d01735a0924b81f8881e2f1560666579.js Apr 24 javascript-malware-collection

8cd1b87ca18105e754284022e53e8c1b9727ca5c89c6f49d6a0f2e952ca068a8 K(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

100% Downloads and executes remote payload

20160328_9f715526c890a78de1a13e6631f2d2b4.js Apr 24 javascript-malware-collection

909d715cda001dca76ffa7d59462d761270f8be5b12b356ff303938d1b06e795 K(Li)O₃(As₃CXe)H₂(Db₅Po₂)

88% Obfuscated payload execution

20161006_be5035fdeb80fd88be33997f76d431bf.js Apr 24 javascript-malware-collection

e33f3c4a6fac3a183df8caf8126cd6af2d3722ff463c8bfb8f2218c93519f908 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Obfuscated JScript eval dropper, Nemucod-like

20160328_1be4716763f0903c51cd0cf10c73fba1.js Apr 24 javascript-malware-collection

ace31aa1532256940ea48b2e95628990f56c4f03803ec816c8d0ba201760cc7b K(Li)O₃(As₃CXe)H₄(FDb₅PoU)Md

99% Obfuscated C2 and file drop

20161006_836f015554c4d2b4e09f1187595316da.js Apr 24 javascript-malware-collection

1716e9a346ab1b6eb5e3c2b17d0bd094486a982ef56ded8533ecdb0eb79b1cfd K(Li)O₂(As₆S)H₂(DbPo)Md

94% eval obfuscated payload

20161006_2fa8d34132661bf3bf016808ca593c64.js Apr 24 javascript-malware-collection

afca2ec8b616020a746f0b2ea8fdadf2c6220c840118f7378e9d18aaf2c3fa1f K(Li)O₂(As₆S)H₂(DbPo)Md

94% eval obfuscated payload

20161006_3a3d461bfe4d0c3e5c3a9955e5840edd.js Apr 24 javascript-malware-collection

bb0f75ace1f227c6a18e0d877d635bf2235ce8c821b536a6bbb7f0087fa6ad71 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod obfuscated JavaScript dropper

20161006_fa154b0bc77b0c9fd5a7d496ba9c7312.js Apr 24 javascript-malware-collection

69941721b17262d1591c89952566bd7a4d566650f8ca0c1e2b6dc502023d901a O(As₃)H₂(DbPo)

97% obfuscated eval execution

20161006_6cfbca770f1526d7739b314b945cbe54.js Apr 24 javascript-malware-collection

afbff07d1e0dd458737954c4297ea110563040389fd6689cee55215858c1239e K(Li)O₂(As₆S)H₂(DbPo)Md

94% obfuscated eval execution

20160328_8831580c1c850f38a4be7577bc087709.js Apr 24 javascript-malware-collection

0d531e499ac728bf1d79f60551757774e4e243742d524cc1de8c8e644a75ffaf K(Li)O₂(As₄Xe)H₃(Db₅Po₂U)Md

93% Obfuscated WScript payload execution

20160328_05b1d12bad702a77609d1d1d6b4d3c20.js Apr 24 javascript-malware-collection

ba06d5c5268e554c591b057f2d749f509775721d9aa8fb4fc50852a4ccd51025 K(Li)O₂(As₃Xe)H₃(Db₇FPo)

93% Obfuscated WScript download and execute

20161006_fa7dcffeb120139436436b9ae0d80eee.js Apr 24 javascript-malware-collection

9bb3fe00d9b220bbe1f3f4df561bbbd80f4abc48ba572adef2ef83e1c7b37574 K(Mc)O(As₃)H₂(DbPo)

99% Nemucod obfuscated dropper

20161006_1d2409fd6ed7a7f92e8751f3034bf3fb.js Apr 24 javascript-malware-collection

5eb182f2cdd0106199403cb5084fc073f5309c8f0e3e3deceb1d9e090e50dbd4 O(As₃)H₂(DbPo)

97% obfuscated eval, JScript, b64 blob

20160328_25bd4dcb3f56b7f14bf62db1efc1b29c.js Apr 24 javascript-malware-collection

45644b0744c7ba023c2482a7eb4f81c1d419f1903d73f8127ccc4172396a7de1 O₃(AlAs₂Xe)H₄(Cm₃DbOs₂Po₃)

100% Downloads and executes remote payload

20160921_d72e05128386ec5185fa7c82a29fe618.js Apr 24 javascript-malware-collection

72502e65294651208a74590dc961703c09931d4341f59214d7303b271ca8abd5 O(As)H₂(DbPo)Md(Pa)

99% obfuscated eval execution

20160328_a4870181a24a1751643ae2d98bc8c7f7.js Apr 24 javascript-malware-collection

8682e09fca72d96f7af7158a772b64dc922fc7355e1eae57d49ea97223cf4432 K(Li)O₂(As₃Xe)H₂(Db₅Po₂)

94% obfuscated eval, network, file ops

20160328_1086260456aeac6c963d277541951b6a.js Apr 24 javascript-malware-collection

a28e6bdca6e182ac4e1f6802c631dd730b69d1b10f5c645234974014466e0a13 O(Xe)H₃(Db₃FPo)Md

91% Obfuscated WScript shellcode execution

20160328_55afa0c036d1eab4bc89ab3e6b40dace.js Apr 24 javascript-malware-collection

bd730ff39a05f0a4af48212296698668f07fb2ae7473207d4ae186cf4fa42237 K(Li)O₂(As₅Xe)H₂(Db₄Po₂)Md₂

91% Obfuscated eval, shell execution, evasion

20160921_acc098eb35e159f33783b155bb8929cb.js Apr 24 javascript-malware-collection

1f491f3a68df5684f7bb14dc15b8f6f3dea400dde990f144e6cf0792facdba6e O(As)H₂(DbPo)Md(Pa)

96% obfuscated eval execution

20160921_885a9e110f52f3ca103e4718673adb3b.js Apr 24 javascript-malware-collection

a777a2e324ff6d64746b42793d888cea6f2beec30ded4165b5b13eda473e58bf K(Li)O₂(As₂S)H₂(DbPo)

96% Obfuscated token remap then eval execution

20160328_6c89882a049f96e4b654935e29ec865d.js Apr 24 javascript-malware-collection

435250d7e2bb09fac2b8b91af9590baac92289cc80d9f11db5e06a16cf4c1d4e K(Li₂)O₂(As₂Xe)H₂(Db₆Po)Md

89% Obfuscated WScript.Sleep and URL

20161006_d4d9d1baca0b767d796d495a5371a531.js Apr 24 javascript-malware-collection

fa97ec0a3d784003a86a20a168905e276ab66f88d41f4ef5a0a48a84ade93ac8 K(Li)O₂(As₆S)H₂(DbPo)Md

94% eval obfuscated payload

20161006_d63375b6db663a249cc338de052dfe1f.js Apr 24 javascript-malware-collection

b1a70cf21d27f12d25d7531fa5f402919dea8a974830b3eb6e39f9d45c5933b6 O(As₃)H₂(DbPo)

97% obfuscated eval execution

20161006_469a9f18edc35edca2cdbfccd06adc91.js Apr 24 javascript-malware-collection

b6fbd71aa2871a9918e7467d117c255bf1685dc2035c68f69f7ec9999aa7c6b4 K(Li)O₂(As₆S)H₂(DbPo)Md

94% Obfuscated eval execution

20160921_d53637406b068b7f313912a4769e371e.js Apr 24 javascript-malware-collection

cafcf490b9e4364e16ee46f82e53896038b46a0b37f3fd7a33a363316965b400 K(Li)O₂(As₂S)H₂(DbPo)

97% obfuscated eval execution

20161006_4b02fc286818a0d10fe45a6fdebb0369.js Apr 24 javascript-malware-collection

093cff6965d6e7da498a52a4b6d3ae3005566f16dc3eeeebe24041d6e5fa6161 O(As₅)H₂(DbPo)Md₂(Pa)

99% obfuscated eval execution

20161006_1babddc952fc9b2499215a689bd361c1.js Apr 24 javascript-malware-collection

d5defb29802656bed924ade6634c3071c0a85e48f79f65ba310e162540c84873 O(As₃)H₂(DbPo)

97% Obfuscated eval, JScript evasion

20161006_a830ae14a626696b7ab05e36506fe0d4.js Apr 24 javascript-malware-collection

d524116f5fd43e4eb0005e473dc387b5a4d731f9467d6abc22cf1ea40ab158ce K(Li)O₂(As₆S)H₂(DbPo)Md

94% Obfuscated eval-reconstructed JScript payload

20161006_50b7f07a253f8d47f49c9617dc4e43b7.js Apr 24 javascript-malware-collection

e886fcb8123b7126728ab3b53c4113d318f01e81a0dc7f752bf4399b9a227439 K₂(McLi)O₂(As₆S)H₂(DbPo)

99% Nemucod malware dropper

20151208_9d0374966c57c1d5595e502d0872cf60.js Apr 24 javascript-malware-collection

03899904615ad63fb4a15639cc2613b74685b875b0bb7dd1245e608c93f15cdd O₂(AsXe)H₂(DbPo)

99% Obfuscated code with eval

20151208_9d8654a1752d98128ba732c89f85fba2.js Apr 24 javascript-malware-collection

0473c3b5eeef96d361a60e2580793b9cacb3a9150ceca6ad42ba67128383aad2 K(Li)O₂(As₃Xe)H₂(Db₃Po)Md

98% obfuscated eval execution

20151208_e8f45abb62958ff3c99f3a2532279729.js Apr 24 javascript-malware-collection

0c9f30d56385410b9a99abe42722e140c4ab09576c095053d8d19bf1c8c281fc O₂(As₃Xe)H₂(Db₃Po)Md

99% Obfuscated eval-driven charcode payload loader

20151208_bf69d9ca8a6ffb95eca55cc8bee2235e.js Apr 24 javascript-malware-collection

11555ff0e90cbe72aac3fcb72c894e4163fbd446a71d5fe0609b50c396c5041a O₂(As₃Xe)H₂(Db₃Po)Md

99% obfuscated eval execution

20151208_ef191654f97af7d9cc1d62986ae3590b.js Apr 24 javascript-malware-collection

1980574ee277b9aa511bc941c23b60678bff0d1b72cde4a7534d0cbfa4bc94ce O₂(As₃Xe)H₂(Db₃Po)Md

99% Obfuscated eval and string decoding

20151208_56e8649826bb862e27bc6a2eee8c93a0.js Apr 24 javascript-malware-collection

19e1833580227d49111a310e3b1c91aad4d9428e6f1e11520fdc00ac6bf3e1f2 O₂(As₃Xe)H₂(Db₃Po)Md

99% obfuscated eval execution

20151208_a1ca47e69aedf3b0a522b03586f43029.js Apr 24 javascript-malware-collection

1c9561d7df19092a8026462532b8ceaa7322d4e3bd8ef341afa4f2661e1a2ea5 O₂(As₃Xe)H₂(Db₃Po)Md

99% obfuscated eval execution

20151208_b624e1d16a985566ae2248a85434f35e.js Apr 24 javascript-malware-collection

2c3936b2c0b8cd5edcf5a39cb7b18cf6bf09a1e7ae225e101587cda6818985e0 O₂(As₂Xe)H₂(Db₃Po)Md₂(Pa)

100% obfuscated eval execution

20151208_2112cc76a10b9f0bc834c8ab3fe60343.js Apr 24 javascript-malware-collection

2f792a495650a58e475b2773ad8a6584142ba5ecd2b63f2ff0a207f51397d2aa K(Li)O₂(As₃Xe)H₂(Db₃Po)Md

98% Obfuscated eval execution

20151208_6634b26e3d9daa28de2794c3da164d06.js Apr 24 javascript-malware-collection

3175ebd3c4295881db63f02bbadb04e47823153309882cdf8ff75696be985e03 O₂(AsXe)H₂(DbPo)

99% obfuscated eval execution

20151208_66a3724e2b6147068613711456744b23.js Apr 24 javascript-malware-collection

51c7c041b8b08caf9e9587d8b3c4b08c353fe90e994de2e55052203a5458ad4a K(Li)O₂(As₃Xe)H₂(Db₃Po)Md

98% obfuscated eval execution