-4

I was looking into the source code of blogger template xml file and there is something written in hex code. A small part is below..

var _0x4a00=["\x31\x64\x28\x72\x29\x2E\x53\x28\

Complete code is here - http://pastebin.com/4CHHxym1

Is this some kind of suspicious code? what does this code do?

Improve this question
3
  • Could you edit the piece to include the complete declaration you're interested in? There's only a partial declaration here...
    – Peter David Carter
    Apr 13, 2016 at 6:21
  • edited pastebin content
    – Anurag Rana
    Apr 13, 2016 at 7:10
  • The code is heavily obfuscated, so yes, it is "suspicious". Whether it is malicious or not is another matter. Although on face value you would have to assume that it is.
    – MrWhite
    Apr 13, 2016 at 9:49

1 Answer 1

Reset to default
2

What you pasted is only a partial section of a declaration, but what the full declaration you pasted seems to do is declare an array variable containing a string containing what could very plausibly be hex code...

Looking at the full code I would suggest that context will be key in this case, as it would seem unusual for a blog to need to be throwing about what is apparently hex code all over the place, but it is possible, particularly if the site is a tech site, that this is some sort of easter egg or hidden feature, or part of some underlying functionality of the site, and not directly malicious. On the other hand it is possible the code is malicious, though unless you have prior reason to suspect the website is doing something it shouldn't, there's no 'smoking-gun'. That is, there's nothing there which would prove the website was breaking the law or directly attempting to harm you or your computer.

Also it depends what you mean by suspicious. The code is definitely interesting...

Improve this answer
1
  • edited the paste bin content.
    – Anurag Rana
    Apr 13, 2016 at 7:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.