How To Understand This Javascript Code Consisting Kind Of Numbers

This is the javascript code. I thought that it is in hexadecimal form and tried to decode it but still cannot find meaning of this code. I am using this code in my blogger template

Solution 1:

Your code has been un-scrambled

document.write("
<link href='https://googledrive.com/host/0B-UFNCskEl7Qd25SMUNseFFPQkk' rel='stylesheet' ty
pe='text/css'/>");
$(document).ready(function (){
  $('#templateify').html('<a href="http://www.templateify.com">Templateify</a>');
  setInterval(function (){
    if (!$('#templateify:visible').length)window.location.href = 
    'http://www.templateify.com'
  }
  , 1000)
}
)$(document).ready(function (){
  $('#sponsorship').html(
  '<a href="http://www.templateify.com/p/sponsorship.html">Your Link Here</a>');
  setInterval(function (){
    if (!$('#sponsorship:visible').length)window.location.href = 
    'http://www.templateify.com'
  }
  , 1000)
}
)

http://wepawet.iseclab.org/view.php?hash=fac68b967bfb84d0d3e84ce0f6589015&type=js

I saved your code into a html file and uploaded it for analysing.

Solution 2:

The main thing to note here is that _2020 is eval. The code in function _2139 creates multiple aliases to eval:

_2020(_3054); => eval("_2139=_2020"); => _2139 = eval;
_2139(_7565); => eval("_7565=_2139"); => _7565 = eval;
_7565(_6610); => eval("_4599=_8636"); => _4599 =_8636;
_2139(_4599); => eval(_8636);

So what is _8636? If we run the code (and carefully omit the last five lines), we can see that it equals:

document.write("<link href='https://googledrive.com/host/0B-UFNCskEl7Qd25SMUNseFFPQkk' rel='stylesheet' type='text/css'/>");
$(document).ready(function () {
 $('#templateify').html('<a href="http://www.templateify.com">Templateify</a>');
 setInterval(function () {
     if (!$('#templateify:visible').length) window.location.href = 'http://www.templateify.com'
 }, 1000)
})
$(document).ready(function () {
 $('#sponsorship').html('<a href="http://www.templateify.com/p/sponsorship.html">Your Link Here</a>');
 setInterval(function () {
     if (!$('#sponsorship:visible').length) window.location.href = 'http://www.templateify.com'
 }, 1000)
})

The code adds an extensive stylesheet from https://googledrive.com/host/0B-UFNCskEl7Qd25SMUNseFFPQkk; I assume this is the main benefit sites enjoy from pasting this code into their site. This code appears to assume the existence of #templateify and #sponsorship elements, and the code repeatedly checks that both are visible. Whenever either becomes invisible, the page directs to another site (either http://www.templateify.com or http://www.templateify.com/p/sponsorship.html).

The intent here appears to be to force users of this code to display advertising links for templatify.com. Any attempt to hide the links will result in the page being redirected.

It is worth noting that this not a useful way to hide the location of a stylesheet, since any worthwhile Web development tool (such as Chrome's built-in dev tools) will show you the network origins of any stylesheets in use: