I came across a website that was using a very strange piece of code with a lot of variables and recursive functions just to forward the user to the main website. The code was obfuscated. After deobfuscation, it is as follows. Note that the go() function is executed upon click of a button named 'Enter Site':
(function (paetynn, jaquez) {
var lyons = quetzali, payzli = paetynn();
while (!![]) {
try {
var kyona = parseInt(lyons(295)) / 1 + -parseInt(lyons(300)) / 2 + parseInt(lyons(299)) / 3 + -parseInt(lyons(301)) / 4 * (parseInt(lyons(304)) / 5) + -parseInt(lyons(294)) / 6 * (parseInt(lyons(298)) / 7) + parseInt(lyons(297)) / 8 * (-parseInt(lyons(303)) / 9) + parseInt(lyons(305)) / 10;
if (kyona === jaquez) break; else payzli.push(payzli.shift());
} catch (zulekha) {
payzli.push(payzli.shift());
}
}
}(niree, 850584));
function quetzali(winston, ikeshia) {
var hongan = niree();
return quetzali = function (khole, kysin) {
khole = khole - 294;
var zebulan = hongan[khole];
return zebulan;
}, quetzali(winston, ikeshia);
}
function go() {
var amey = quetzali, gracelee = amey(296);
document[amey(302)] = gracelee, window.location = "/";
}
function niree() {
var saana = ["604264sauqJi", "10214183nDqKAH", "2078325AmAiPo", "1206860TDYYcJ", "4VhIfuJ", "cookie", "45pazGrL", "380390DQkmbn", "12476230senONL", "6bRFHSG", "1426528LpTiXE", "session_keys=mycheck;"];
niree = function () {
return saana;
};
return niree();
}
I don't fully understand what the code does. Could some JS expert clarify on the piece?
Seems like the code is manipulating window.location. Also it was used inside a script tag inside the head tag of the page.
This code sets cookie session_keys=mycheck; and then redirects to /. The rest of code make permutation in the array of strings saana so analizyng code would be more difficult.