Malware JS : meaning of a line of code : (_0x4f64, 550906), document[_0x35e70a(408)](atob(unescape(_0x35e70a(409))))

100 Views Asked by At

In an obfuscated js code, I have this line that I can't understand :

(_0x4f64, 550906), document[_0x35e70a(408)](atob(unescape(_0x35e70a(409))));

Could you explain me this code particularly ?
(_0x4f64, 550906), document[_0x35e70a(408)]

1

There are 1 best solutions below

0
Nicholas Tower On
_0x35e70a(408)

This is a function call, passing in 408.

document[_0x35e70a(408)]

This accesses a property on the document object.

(_0x4f64, 550906),

This is just a variable and a number, separated by the comma operator. The comma operator says to evaluate them both, and use the result of the last one. So this is just 550906. But then another comma operator connects it to the document access we saw before, so the 550906 gets ignored too. So basically, this does nothing.

Putting it all together: that code calls a function, then uses the return value to access a property on document.