2
\$\begingroup\$

I've got a bit of obfuscated javascript, and I'd like to find out what it does. I could read up on obfuscating in javascript, or I could ask some people who know their stuff.

Where would I post a question like this? It's not a code-golf question per se, but I think it's far more suited to find capable answerers on codegolf.stackexchange than on stackoverflow.

It was flagged as malware by a hoster which spiked my interest, so it might spike yours too. If anybody's interested, check revision history at your own risk.

\$\endgroup\$
3
  • \$\begingroup\$ maybe a popularity contest for the best de-obfuscated and commented version of the code? \$\endgroup\$
    – Sparr
    Oct 1, 2014 at 15:31
  • 7
    \$\begingroup\$ I don't think it's very advisable to post malware without big warnings about not running it. \$\endgroup\$ Oct 1, 2014 at 15:33
  • \$\begingroup\$ It's a JS/TrojanDownloader.Agent.NRL trojan: i.imgur.com/6epkJvy.png \$\endgroup\$
    – nyuszika7h
    Feb 21, 2015 at 23:37

2 Answers 2

1
\$\begingroup\$

I'm not sure that this is really a good fit for any site on the StackExchange network. It definitely doesn't fit here. The two closest fits are probably StackOverflow and Security, but I don't think either of them would want it either.

(FWIW you really don't need to do much reading at all to decipher your particular question. String.prototype.replace is all you need for it to make sense).

\$\endgroup\$
1
  • \$\begingroup\$ Pretty much what I thought. For future reference & people being in the same situation, is there another site (-network) which will help with these kinds of questions? \$\endgroup\$
    – SBoss
    Oct 2, 2014 at 6:28
1
\$\begingroup\$

This question would be much better suited for Super User or Stack Overflow than for Code Golf.

Deobfuscating the code is trivial: Just replace document.body.appendChild with return and execute the function. (To be on the safe side, disconnect from the internet first.)

This shows that the code injects the following:

<script type="text/javascript" src="http://URL-ELIDED-TO-AVOID-TRIGGERING-ANTIVIRUS/" defer="defer" id="Cbucwozzvh0t"></script>

The hostname doesn't resolve to an IP address, so – at least for now – the code won't be able to do any damage.

\$\endgroup\$
2
  • 1
    \$\begingroup\$ 'This question would be ... suited for ... Stack Overflow" -- I'm afraid not. It's not a specific programming question, it's not too useful and one might even claim it doesn't show any research effort. \$\endgroup\$ Oct 1, 2014 at 18:03
  • 1
    \$\begingroup\$ @JanDvorak I've seen questions on StackOverflow before asking to explain some obfuscated code and they were well received. \$\endgroup\$
    – hmatt1
    Oct 3, 2014 at 20:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .