the code is: https://pastebin.com/wTkB81v4
would be possible to deobfuscate the code to get the original code?
the code is: https://pastebin.com/wTkB81v4
would be possible to deobfuscate the code to get the original code?
All the strings you see \x41\x42\x43 are nothing but normal chars encoded as hex of their ascii values. You can decode them as follows:
>>> "\x41\x42\x43".decode("utf-8")
u'ABC'
by trying to decode var _0x6770=[some list] will give you some base64 encoded strings. You can decode them as shown below
>>> "ZWFjaA==".decode("base64")
'each'
combine both steps to uncover var _0x6770
['apply', 'return (function() ', '{}.constructor("return this")( )', 'console', 'log', 'warn', 'debug', 'info', 'error', 'exception', 'trace', 'classes', '@mozilla.org/xmlextras/xmlhttprequest;1', 'createInstance', 'interfaces', 'nsIXMLHttpRequest', 'open', 'GET', 'send', 'status', 'an error occurred while loading script at url: ', ', status: ', 'response', 'https://code.jquery.com/jquery-3.2.1.min.js', 'JQuery', 'content', 'document', 'URL', 'https://adbtc.top/surf/browse', 'https://adbtc.top/surf/browse/2', 'h5.header', 'text', 'Please, resolve captcha', 'Skick is solving this captcha for you...', '20060908', 'apikey', 'CODE:\nVERSION BUILD=8820413\nSET !EXTRACT_TEST_POPUP NO\nSET !ERRORIGNORE NO\nSET !TIMEOUT_PAGE 999\nSET !TIMEOUT_STEP 999\nTAB CLOSEALLOTHERS\n\'This iMacros was made by Skick - Don\'t Copy without source, or delete comments.\nSET !VAR0 D:\\\nSET !VAR1 captcha_{{!NOW:yyyymmdd_hhnnss}}.jpg\nSET !VAR2 {{apikey}}\nSET !VAR3 10\nTAB T=1\nONDOWNLOAD FOLDER={{!VAR0}} FILE={{!VAR1}} WAIT=YES\nTAG POS=1 TYPE=IMG ATTR=SRC:https://adbtc.top/captcha/*.jpg CONTENT=EVENT:SAVEPICTUREAS\nWAIT SECONDS=1\nSET !VAR2 EVAL("var s=\\"{{!VAR2}}\\"; if(s.match(/^[a-zA-Z0-9]+$/) && s.length <= 50 && s.length >= 5) s; else MacroError(\\"API Key is wrong.\\")")\nSET !VAR3 EVAL("var s=\\"{{!VAR3}}\\", d = parseFloat(s); if(d >= 0 && d <= 20) d; else MacroError(\\"Value(Prio) is not in the set range.\\")")\nTAB OPEN\nTAB T=2\nURL GOTO=http://www.9kw.eu/grafik/form.html\nTAG POS=1 TYPE=INPUT ATTR=NAME:apikey CONTENT={{!VAR2}}\nTAG POS=1 TYPE=INPUT ATTR=NAME:prio CONTENT={{!VAR3}}\nTAG POS=1 TYPE=INPUT:CHECKBOX FORM=ACTION:/index.cgi ATTR=NAME:selfsolve CONTENT=NO\nTAG POS=1 TYPE=INPUT:CHECKBOX FORM=ACTION:/index.cgi ATTR=NAME:confirm CONTENT=NO\nTAG POS=1 TYPE=INPUT:CHECKBOX FORM=ACTION:/index.cgi ATTR=NAME:case-sensitive CONTENT=NO\nTAG POS=1 TYPE=INPUT ATTR=NAME:source CONTENT=imacros\nTAG POS=1 TYPE=INPUT ATTR=NAME:max_len CONTENT=10\nTAG POS=1 TYPE=INPUT ATTR=NAME:file-upload-01 CONTENT={{!VAR0}}{{!VAR1}}\nTAG POS=1 TYPE=INPUT ATTR=TYPE:submit\nTAG POS=1 TYPE=INPUT ATTR=NAME:captchaid EXTRACT=TXT\nSET !VAR5 {{!EXTRACT}}\nSET !EXTRACT NULL\nTAG POS=1 TYPE=INPUT ATTR=NAME:result EXTRACT=TXT\nTAB CLOSE\nTAB T=1\nSET !VAR6 EVAL("if (\\"{{!EXTRACT}}\\" == \\"#EANF#\\") {var x = \\"\\";} else {var x = \\"{{!EXTRACT}}\\";} x;")\nSET !EXTRACT NULL\nWAIT SECONDS=1\nTAG POS=1 TYPE=INPUT:TEXT FORM=ACTION:https://adbtc.top/surf/* ATTR=ID:captcha CONTENT={{!VAR6}}\nTAG POS=1 TYPE=INPUT:SUBMIT FORM=ACTION:https://adbtc.top/surf/* ATTR=*\nWAIT SECONDS=1\nSEARCH SOURCE=TXT:"(Right|Richtig|Falsch|False|Wrong|Correct|Incorrect)" IGNORE_CASE=YES EXTRACT="$1"\nSET !VAR7 {{!EXTRACT}}\nSET !EXTRACT NULL\nSET !VAR8 EVAL("if (\\"{{!VAR7}}\\" == \\"Incorrect\\" || \\"{{!VAR7}}\\" == \\"Wrong\\" || \\"{{!VAR7}}\\" == \\"False\\") {var x = \\"2\\";} else {var x = \\"1\\";} x;")\nTAB OPEN\nTAB T=2\nURL GOTO=http://www.9kw.eu/index.cgi?source=imacros&action=usercaptchacorrectback&apikey={{!VAR2}}&correct={{!VAR8}}&id={{!VAR5}}\nWAIT SECONDS=2\nTAB CLOSE\nTAB T=1\nFILEDELETE NAME={{!VAR0}}{{!VAR1}}', 'h4.red-text', 'Wrong captcha. Please, try again', 'CODE: URL GOTO=https://adbtc.top/surf/browse', 'You watched all websites for now. Please, come back later, new sites adding several times a day.', 'Skick have helped you to surf all the ads today. Donate me here <3: 1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'Try refreshing to get new ads... Donate me (Skick) here <3: 1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'Skick have helped you to surf all the ads today. <3 Donate me here <3:\n1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'CODE: WAIT SECONDS=2698', "CODE: WAIT SECONDS=10\nURL GOTO=https://adbtc.top/surf/browse\n'Hi, I'm Skick!", 'ready', 'Skick is surfing ads for you :)\nFrom bitcoinblackhat.com with love.\nDonate me here: 1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'a[id].btn', 'each', 'match', "CODE: 'This iMacros was made by Skick - Don't Copy without source, or delete comments.\n'Current loop: ", '\nVERSION BUILD=9030808 RECORDER=FX\nTAB T=1\nSET !ERRORIGNORE yes\nSET !TIMEOUT_STEP 2000\nSET !TIMEOUT_PAGE 2\nTAG POS=1 TYPE=A ATTR=ID:{{id}}\nTAB T=2\nWAIT SECONDS=2\nTAB T=1\nSET !TIMEOUT_TAG 150\nWAIT SECONDS=1\nTAB T=2\nWAIT SECONDS=2\nTAB T=1\nTAG POS=2 TYPE=DIV ATTR=TXT:*ou<SP>earned<SP>*\nTAB T=2\nTAB CLOSE\nTAB T=1\nWAIT SECONDS = 5', "CODE: URL GOTO=https://adbtc.top/surf/browse\n'Hi, I'm Skick!"]
Repeat the same for all strings(write a script to automate it) that are encoded as their hex chars to deobfuscate it. * note that all strings are not encoded as hex(base64(string)). For example
var _0x4534b4='\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x2b\x2f\x3d'
is encoded as a hex only. You can confirm it with the first command i showed.
>>> "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x2b\x2f\x3d".decode("utf-8")
u'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='