Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

russellxu's avatar

My server has been hacked, a js file is appended to the entry file, anyone know what's this js file do?

0 likes
3 replies
LaryAI's avatar
Level 58

The JavaScript code you've posted is obfuscated, which makes it difficult to read and understand directly. However, I can provide some insights into what this code is likely doing based on common patterns in obfuscated scripts.

Key Observations:

  1. Obfuscation: The code is heavily obfuscated using techniques like variable renaming, string encoding, and function wrapping. This is often done to hide the true purpose of the code.

  2. Redirection: The code contains logic to detect if the user is on a mobile device. If a mobile device is detected, it attempts to redirect the user to a specific URL (http://www.itseohack.com/index.html or https://www.9y1521.com/). This is a common tactic used in malicious scripts to drive traffic to certain websites.

  3. Tracking Script: The code includes a script from https://hm.baidu.com/hm.js, which is a tracking script from Baidu Analytics. This could be used to track user behavior on the site.

  4. Encoded Strings: The script uses encoded strings and a decoding function, which is a typical method to hide URLs or other sensitive data.

Recommended Actions:

  1. Remove the Malicious Code: Immediately remove this script from your server to prevent further damage or data leakage.

  2. Scan for Other Vulnerabilities: Conduct a thorough security audit of your server and application to identify and fix any vulnerabilities that allowed this script to be injected.

  3. Update and Patch: Ensure that all software, including your web server and any CMS or frameworks you are using, is up to date with the latest security patches.

  4. Monitor Traffic: Keep an eye on your server logs and traffic patterns for any unusual activity that might indicate further compromise.

  5. Educate Your Team: Make sure your development and operations teams are aware of security best practices to prevent future incidents.

If you need further assistance with cleaning up your server or securing your application, consider reaching out to a cybersecurity professional.

martinbean's avatar
Level 80

@russellxu It doesn’t really matter what the file does to be honest, because it’s there, it shouldn’t be, and you need to remove it, and find out how it got there to prevent it just being re-added again.

There’s no point spending time trying to work out what an obfuscated malicious file does, when you can instead spend that time fixing the problem and securing your app/server, because your app—and its users—are all compromised during any time you spend going, “I wonder what this does?”

Check your server access logs for suspicious requests, as it’s highly unlikely the bad actor will have crafted the perfect URL to inject this code first time; they’ll be a litany of other suspicious requests trying things like SQL injection attacks and whatnot until they found an attack vector that worked.

1 like
jlrdw's avatar

Also do you have file uploads? You need to safely upload if you do.

Please or to participate in this conversation.