The function returns the decoded string on line 57. The eval() call will evaluate whatever is returned by the function that is defined inside the call. The decoded output is executed with the eval() call on line 2. This final part gave an impression to be garbage, for the exception of some artifacts (like the URL and JavaScript code).Īs can be observed, the encoded text on line 58 is stored as a string and is passed as a parameter to what appears to be the decoding function defined on line 3. The other one is embedded in the final part of code. The one used in the land variable is a tracker used to monitors a brand’s performance. In the above screenshot, there are two URLs that are readily identifiable (masked for this public release to preserve confidentiality of the affected party). The following screenshot shows the code that we received: As it turned out, the code was malicious in nature, and in the present article I would like to analyze it and show how obfuscated JavaScript code can reverse engineered. Recently, one of our partners sent us an interesting piece of obfuscated JavaScript code that was used to run ads on their network.

Deobfuscate js