-1

I try to understand some syntax in javascript and i would like your help with that.

var _0xee6b68 = new XMLHttpRequest();
_0xee6b68[_0x4e1f('0x1b')]('GET', _0x4e1f('0x1c') + _0x54a092[_0x4e1f('0xf')](), !![]);
_0xee6b68[_0x4e1f('0x1d')]();

I don't understand what is the meaning in the second line: we see an array that executes a function called ox4e1f with argument 0x1b and then immediatly we have some get function. But i don't understand how you call that get function because usually if you configure some var to a new xmlhttp-request you need to use a function, for example:

0xee6b68.open('GET',...,)

But here i dont see it...

So i would like any help to understand the syntax here.

biberman
  • 5,606
  • 4
  • 11
  • 35
EVI FELDI
  • 9
  • 3
  • The *syntax* is normal JS syntax. The *underlying* issue is that you're trying to decipher obfuscated JS code. Remember that in JS this: `foo.bar` is the same as `foo['bar']`. – Dave Newton Jun 03 '21 at 16:18
  • https://stackoverflow.com/questions/4968406/javascript-property-access-dot-notation-vs-brackets – epascarello Jun 03 '21 at 16:41
  • This JavaScript is probably not written by a human, but generated. If you have access to a human readable source I would highly suggest taking a look at that instead. If not, the best course of action is probably to find the variable definitions of `_0x4e1f` and `_0x54a092`. – 3limin4t0r Jun 03 '21 at 16:47

1 Answers1

0

It's doing something like this:

let _0x4e1f = (key) => {
    switch(key) {
        case '0x1b': return 'open';
        case '0x1c': return 'https://';
        case '0xf': return 'google';
        case '0x1d': return 'send';
    }
}

let _0x54a092 = {
    'google': () => 'www.google.com'
}

let httpMethod = _0x4e1f('0x1b'); 
let url = _0x4e1f('0x1c') + _0x54a092[_0x4e1f('0xf')]()
let send = _0x4e1f('0x1d');
var _0xee6b68 = new XMLHttpRequest();
_0xee6b68[httpMethod]('GET', url, !![]);
_0xee6b68[send]();
dave
  • 62,300
  • 5
  • 72
  • 93