Javascript compiled or not? Check inside

Question

Note that I am not experienced with Javascript. If a javascript code starts like this:

javascript:var _0x89f8=[\"\\x69\\x6E\\x6E\\x65\\x72\\x48\\x54\\x4D\\x4         


        

Answer 1

No this javascript is not compiled, the "strange" text you see is encoded text. For example \x69 equals the letter i

It's a differant notation for normal letters and other characters (@,/ etc). And used to make text harder to read, or when using strange/unusual characters in strings for example.

The function escape() will go from i to \x69 .As where the function unescape() will go from \x69 back to the letter i.

The above code example is just an array of encoded strings.

Answer 2

It is an obfuscated JS code.

If something is a JS source code, it is never compiled, even if it looks unreadable.

There are many JS code obfuscators or minimizers exist.

Can you identify which program generated it?

Answer 3

This looks like obfuscated javascript - whoever put it up doesn't want it to be easily read. Without meaningful variable names, it will be difficult to understand (i.e. what does _0x89f8 mean?).

The string parameters are escaped strings - \x69 is the hex for the character i etc...

Enter the following to your browser address bar to see how it looks:

javascript:alert("\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C");

Chances are that the function being called builds up a javascript string from the parameters and then calls eval on them.

Answer 4

Well, I have to admit, I was curious enough that I opened a new facebook profile to find out what this thing does...

after reading the un-obfuscated code you can determine that this script will automatically open your Friend's list, and suggest just this Facebook page to all your friends (the amount allowed, of course). Therefor sending out invitations (unknowingly) to all of your friends, which some will undoubtedly continue...

Simply put, don't copy any JavaScript lines without knowing who posted them in the first place. :)

Answer 5

This code appears to be part of a facebook worm.

Answer 6

It's merely obfuscated. _0x89f8 is a normal variable, "\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C" is a normal string (except with all characters written in hexadecimal: \x69 is i and so on; it says "innerHTML").