-4

I was looking into the source code of blogger template xml file and there is something written in hex code. A small part is below..

var _0x4a00=["\x31\x64\x28\x72\x29\x2E\x53\x28\

Complete code is here - http://pastebin.com/4CHHxym1

Is this some kind of suspicious code? what does this code do?

closed as off-topic by serenesat, MrWhite, Alex, user79865, jonsca Apr 15 '16 at 22:23

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "It is a question about creating/developing a web application." – serenesat, MrWhite, Alex, Community, jonsca
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Could you edit the piece to include the complete declaration you're interested in? There's only a partial declaration here... – Peter David Carter Apr 13 '16 at 6:21
  • edited pastebin content – Anurag Rana Apr 13 '16 at 7:10
  • The code is heavily obfuscated, so yes, it is "suspicious". Whether it is malicious or not is another matter. Although on face value you would have to assume that it is. – MrWhite Apr 13 '16 at 9:49
2

What you pasted is only a partial section of a declaration, but what the full declaration you pasted seems to do is declare an array variable containing a string containing what could very plausibly be hex code...

Looking at the full code I would suggest that context will be key in this case, as it would seem unusual for a blog to need to be throwing about what is apparently hex code all over the place, but it is possible, particularly if the site is a tech site, that this is some sort of easter egg or hidden feature, or part of some underlying functionality of the site, and not directly malicious. On the other hand it is possible the code is malicious, though unless you have prior reason to suspect the website is doing something it shouldn't, there's no 'smoking-gun'. That is, there's nothing there which would prove the website was breaking the law or directly attempting to harm you or your computer.

Also it depends what you mean by suspicious. The code is definitely interesting...

  • edited the paste bin content. – Anurag Rana Apr 13 '16 at 7:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.