the code is: https://pastebin.com/wTkB81v4

would be possible to deobfuscate the code to get the original code?

  • 1
    yes, but we won't just do it for you. Describe what you tried and what difficulties you encountered. – Igor Skochinsky Apr 12 '18 at 7:36
  • Try jsnice.org. I tried it. It looks like a js bot to view pages at adbtc.top – sudhackar Apr 13 '18 at 5:23

All the strings you see \x41\x42\x43 are nothing but normal chars encoded as hex of their ascii values. You can decode them as follows:

 >>> "\x41\x42\x43".decode("utf-8")

by trying to decode var _0x6770=[some list] will give you some base64 encoded strings. You can decode them as shown below

>>> "ZWFjaA==".decode("base64")

combine both steps to uncover var _0x6770

['apply', 'return (function() ', '{}.constructor("return this")( )', 'console', 'log', 'warn', 'debug', 'info', 'error', 'exception', 'trace', 'classes', '@mozilla.org/xmlextras/xmlhttprequest;1', 'createInstance', 'interfaces', 'nsIXMLHttpRequest', 'open', 'GET', 'send', 'status', 'an error occurred while loading script at url: ', ', status: ', 'response', 'https://code.jquery.com/jquery-3.2.1.min.js', 'JQuery', 'content', 'document', 'URL', 'https://adbtc.top/surf/browse', 'https://adbtc.top/surf/browse/2', 'h5.header', 'text', 'Please, resolve captcha', 'Skick is solving this captcha for you...', '20060908', 'apikey', 'CODE:\nVERSION BUILD=8820413\nSET !EXTRACT_TEST_POPUP NO\nSET !ERRORIGNORE NO\nSET !TIMEOUT_PAGE 999\nSET !TIMEOUT_STEP 999\nTAB CLOSEALLOTHERS\n\'This iMacros was made by Skick - Don\'t Copy without source, or delete comments.\nSET !VAR0 D:\\\nSET !VAR1 captcha_{{!NOW:yyyymmdd_hhnnss}}.jpg\nSET !VAR2 {{apikey}}\nSET !VAR3 10\nTAB T=1\nONDOWNLOAD FOLDER={{!VAR0}} FILE={{!VAR1}} WAIT=YES\nTAG POS=1 TYPE=IMG ATTR=SRC:https://adbtc.top/captcha/*.jpg CONTENT=EVENT:SAVEPICTUREAS\nWAIT SECONDS=1\nSET !VAR2 EVAL("var s=\\"{{!VAR2}}\\"; if(s.match(/^[a-zA-Z0-9]+$/) && s.length <= 50 && s.length >= 5) s; else MacroError(\\"API Key is wrong.\\")")\nSET !VAR3 EVAL("var s=\\"{{!VAR3}}\\", d = parseFloat(s); if(d >= 0 && d <= 20) d; else MacroError(\\"Value(Prio) is not in the set range.\\")")\nTAB OPEN\nTAB T=2\nURL GOTO=http://www.9kw.eu/grafik/form.html\nTAG POS=1 TYPE=INPUT ATTR=NAME:apikey CONTENT={{!VAR2}}\nTAG POS=1 TYPE=INPUT ATTR=NAME:prio CONTENT={{!VAR3}}\nTAG POS=1 TYPE=INPUT:CHECKBOX FORM=ACTION:/index.cgi ATTR=NAME:selfsolve CONTENT=NO\nTAG POS=1 TYPE=INPUT:CHECKBOX FORM=ACTION:/index.cgi ATTR=NAME:confirm CONTENT=NO\nTAG POS=1 TYPE=INPUT:CHECKBOX FORM=ACTION:/index.cgi ATTR=NAME:case-sensitive CONTENT=NO\nTAG POS=1 TYPE=INPUT ATTR=NAME:source CONTENT=imacros\nTAG POS=1 TYPE=INPUT ATTR=NAME:max_len CONTENT=10\nTAG POS=1 TYPE=INPUT ATTR=NAME:file-upload-01 CONTENT={{!VAR0}}{{!VAR1}}\nTAG POS=1 TYPE=INPUT ATTR=TYPE:submit\nTAG POS=1 TYPE=INPUT ATTR=NAME:captchaid EXTRACT=TXT\nSET !VAR5 {{!EXTRACT}}\nSET !EXTRACT NULL\nTAG POS=1 TYPE=INPUT ATTR=NAME:result EXTRACT=TXT\nTAB CLOSE\nTAB T=1\nSET !VAR6 EVAL("if (\\"{{!EXTRACT}}\\" == \\"#EANF#\\") {var x = \\"\\";} else {var x = \\"{{!EXTRACT}}\\";} x;")\nSET !EXTRACT NULL\nWAIT SECONDS=1\nTAG POS=1 TYPE=INPUT:TEXT FORM=ACTION:https://adbtc.top/surf/* ATTR=ID:captcha CONTENT={{!VAR6}}\nTAG POS=1 TYPE=INPUT:SUBMIT FORM=ACTION:https://adbtc.top/surf/* ATTR=*\nWAIT SECONDS=1\nSEARCH SOURCE=TXT:"(Right|Richtig|Falsch|False|Wrong|Correct|Incorrect)" IGNORE_CASE=YES EXTRACT="$1"\nSET !VAR7 {{!EXTRACT}}\nSET !EXTRACT NULL\nSET !VAR8 EVAL("if (\\"{{!VAR7}}\\" == \\"Incorrect\\" || \\"{{!VAR7}}\\" == \\"Wrong\\" || \\"{{!VAR7}}\\" == \\"False\\") {var x = \\"2\\";} else {var x = \\"1\\";} x;")\nTAB OPEN\nTAB T=2\nURL GOTO=http://www.9kw.eu/index.cgi?source=imacros&action=usercaptchacorrectback&apikey={{!VAR2}}&correct={{!VAR8}}&id={{!VAR5}}\nWAIT SECONDS=2\nTAB CLOSE\nTAB T=1\nFILEDELETE NAME={{!VAR0}}{{!VAR1}}', 'h4.red-text', 'Wrong captcha. Please, try again', 'CODE: URL GOTO=https://adbtc.top/surf/browse', 'You watched all websites for now. Please, come back later, new sites adding several times a day.', 'Skick have helped you to surf all the ads today. Donate me here <3: 1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'Try refreshing to get new ads... Donate me (Skick) here <3: 1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'Skick have helped you to surf all the ads today. <3 Donate me here <3:\n1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'CODE: WAIT SECONDS=2698', "CODE: WAIT SECONDS=10\nURL GOTO=https://adbtc.top/surf/browse\n'Hi, I'm Skick!", 'ready', 'Skick is surfing ads for you :)\nFrom bitcoinblackhat.com with love.\nDonate me here: 1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'a[id].btn', 'each', 'match', "CODE: 'This iMacros was made by Skick - Don't Copy without source, or delete comments.\n'Current loop: ", '\nVERSION BUILD=9030808 RECORDER=FX\nTAB T=1\nSET !ERRORIGNORE yes\nSET !TIMEOUT_STEP 2000\nSET !TIMEOUT_PAGE 2\nTAG POS=1 TYPE=A ATTR=ID:{{id}}\nTAB T=2\nWAIT SECONDS=2\nTAB T=1\nSET !TIMEOUT_TAG 150\nWAIT SECONDS=1\nTAB T=2\nWAIT SECONDS=2\nTAB T=1\nTAG POS=2 TYPE=DIV ATTR=TXT:*ou<SP>earned<SP>*\nTAB T=2\nTAB CLOSE\nTAB T=1\nWAIT SECONDS = 5', "CODE: URL GOTO=https://adbtc.top/surf/browse\n'Hi, I'm Skick!"]

Repeat the same for all strings(write a script to automate it) that are encoded as their hex chars to deobfuscate it. * note that all strings are not encoded as hex(base64(string)). For example

var _0x4534b4='\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x2b\x2f\x3d' 

is encoded as a hex only. You can confirm it with the first command i showed.

>>> "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x2b\x2f\x3d".decode("utf-8")

Not the answer you're looking for? Browse other questions tagged or ask your own question.