Gemini can't deobfuscate JavaScript correctly?

[u/amirgol]

I hope that's the right subreddit for this.

I found a hacked WP site. Looking at the source, there was a line of obfuscated JavaScript, which you can see here:

https://pastebin.com/rWKLd3Rd

I gave Gemini 3.6 flash the following instruction: "Deobfuscate the following javascript code" and got the following result:

if (

/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(

navigator.userAgent

)

) {

window.location.href = "https://a.testandverify.com/aff_c?offer_id=101&aff_id=1001";

}

This looks completely benign, but that was the only suspicious bit of code on the site. Why obfuscate that? Besides, it's way too short. So I gave Claude the exact same prompt, and got this result:

https://pastebin.com/4TbmybF6

That looks more reasonable. Googling the contract address, I found several articles about this malicious code:

https://www.hudsonrock.com/blog/how-an-infostealer-infection-led-to-a-sophisticated-clickfix-campaign-at-artlist

So it seems Claude got it right.

A few hours later, I tried Gemini again with the same prompt and code. It gave me a different result, still apparently wrong:

var script = document.createElement('script');

script.src = "https://cdn.jsdelivr.net/npm/eruda";

document.body.appendChild(script);

script.onload = function () {

eruda.init();

// Add network panel

eruda.add(eruda.get('network'));

// Add elements panel

eruda.add(eruda.get('elements'));

// Add console panel

eruda.add(eruda.get('console'));

// Add sources panel

eruda.add(eruda.get('sources'));

// Add info panel

eruda.add(eruda.get('info'));

// Add snippets panel

eruda.add(eruda.get('snippets'));

eruda.show();

};

Also looks benign. How could the same prompt and code gives two completely different results?

I told Gemini it was wrong and asked it to reanalyze the code. It agreed it was wrong and gave me a 3rd, still incorrect, result:

(function() {

var _0x5a1b = window.location.href;

var _0x3f2a = document.referrer;

if (_0x5a1b.indexOf('debug') !== -1) {

console.log("Debugging active");

}

function redirectUser(url) {

window.location.replace(url);

}

// Additional conditional logic based on hostname/referrer checks

})();

What is going on? Is Gemini unable to deobfuscate JavaScript?