title: Why this obfuscated code is malicious in JavaScript?
body: <p>A friend of mine's site was being listed as malicious, and we found some obfuscated code that had been injected into his index.php without him knowing. I deobfuscated the code down two levels and found this:</p>
  
  <p><a href="https://stackoverflow.com/revisions/13313287/2">(code can be viewed in the edit history)</a></p>
  
  <p>Can anyone tell me what it's trying to do and why it's malicious..?</p>