How can I de-obfuscate this JavaScript? I see it opens a new window at www.google.com, but what else does it do? I can't open it in debugger it just doesn't work then? And is it malicious? Here is the script: https://jsfiddle.net/hzqdty8e/ (It's to long to be posted here! It has 60000 characters) Post how you managed to de-obfuscate it!

Note: Debugging or deobfuscating this script breaks it!

  • 2
    Code analysis is off topic for this site. – schroeder Jul 8 '15 at 15:13
  • Obfuscating is part of cryptography which is part if this site. – Mark Jul 8 '15 at 20:07
  • That's quite a stretch on the intent. – schroeder Jul 8 '15 at 20:17
  • 2
    @Mark welcome to Information Security. Please note that obfuscation is very much NOT part of cryptography, in fact they are pretty much diametrically opposed. Moreover, this question isnt about obfuscation, it's about a random piece of code (which happens to be obfuscated). Finally, all our discussions here about obfuscation are how NOT to do it (and possibly very very rare situation where it might be allowed), we definitely do not encourage it as a concept. – AviD Jul 8 '15 at 20:27
  • I saw question about this answered here... That's why i posted it. Anyway got any suggestion where could i post this? – Mark Jul 8 '15 at 20:54

There are a few JavaScript deobfuscating services. http://jsbeautifier.org/ gives the best results for your particular script.

However even after deobfuscation this scripts contains several binary strings, encoded as text, from which script algorithm tries to pull individual bytes in defined order to create another script.

It would require further analysis to find out, what exactly does it do. However so deeply encoded scripts are almost always malicious. Especially that you wrote about opening new browser window. I bet that it replaces Google ads to some other ones.

| improve this answer | |
  • Thanks. What can i do to fully De-obfuscate it? I want to know what it does. – Mark Jul 8 '15 at 12:16
  • I just tried that and jsbeutifier breaks the code? Any other De-obfuscator does that as well and it sometimes breaks when i try to debug it!!! IDK whats going on.... – Mark Jul 8 '15 at 12:52

Most Obfuscated JS build a new string and eval(string) if you can override eval (with by example console.log or document.write) this isn't supossed possible in browser but apparently malzilla do it, you should be able to get a more readable version (you will maybe need to do this multiple time on the new output).

| improve this answer | |
  • The script breaks if i de-obfuscate it, debug or in this case, override eval. – Mark Jul 8 '15 at 13:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.