Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


Show other level

$_F=__FILE__;
$_X='Pz48P3BocA0KCSR7YjFzNW4xbTUoX19GSUxFX18pfT1kNHJuMW01KF9fRklMRV9fKTsNCglyNXEzNHI1XzJuYzUoJHtiMXM1bjFtNShfX0ZJTEVfXyl9LiIvNG5kNXhfMWJzMmwzdDUucGhwIik7DQoJJDRuZDV4MWJzMmwzdDU9bjV3IDRuZDV4XzFiczJsM3Q1Ow0KPz4NCjxzY3I0cHQgdHlwNT0idDV4dC9qMXYxc2NyNHB0Ij4NCmYzbmN0NDJuXyBuM21fMWJicjV2X3N0cihuM20pIHsNCgl2MXIgbDVuID0gbjNtLmw1bmd0aCwgbDFzdF9jaDFyID0gbjNtLmNoMXJBdChsNW4gLSA2KSwgMWJicjV2DQoJNGYgKGw1biA9PSBhICYmIG4zbS5jaDFyQXQoMCkgPT0gJzYnKSB7DQoJCTFiYnI1diA9ICc8Pz1sZ2F1Oz8+Jw0KCX0gNWxzNSB7DQoJCTRmIChsMXN0X2NoMXIgPT0gJzYnKSB7DQoJCQkxYmJyNXYgPSAnPD89bGdhNjs/PicNCgkJfSA1bHM1IDRmIChsMXN0X2NoMXIgPT0gJ2EnKSB7DQoJCQkxYmJyNXYgPSAnPD89bGdhYTs/PicNCgkJfSA1bHM1IDRmIChsMXN0X2NoMXIgPT0gJ28nKSB7DQoJCQkxYmJyNXYgPSAnPD89bGdhbzs/PicNCgkJfSA1bHM1IHsNCgkJCTFiYnI1diA9ICc8Pz1sZ2F1Oz8+Jw0KCQl9DQoJfQ0KCXI1dDNybiBuM20gKyAiPHMzcD4iKzFiYnI1disiPC9zM3A+IjsNCn0NCmYzbmN0NDJuXyA1bl9kMXQ1KCl7DQoJdjFyIDFycl9kMXk9bjV3IEFycjF5KCI8Pz1sZ2E7Pz4iLCI8Pz1sZ287Pz4iLCI8Pz1sZ3U7Pz4iLCI8Pz1sZ2k7Pz4iLCI8Pz1sZ2U7Pz4iLCI8Pz1sZzc7Pz4iLCI8Pz1sZzg7Pz4iKTsNCgl2MXIgMXJyX20ybnRoPW41dyBBcnIxeSgiPD89bGc5Oz8+IiwiPD89bGc2MDs/PiIsIjw/PWxnNjY7Pz4iLCI8Pz1sZzZhOz8+IiwiPD89bGc2bzs/PiIsIjw/PWxnNnU7Pz4iLCI8Pz1sZzZpOz8+IiwiPD89bGc2ZTs/PiIsIjw/PWxnNjc7Pz4iLCI8Pz1sZzY4Oz8+IiwiPD89bGc2OTs/PiIsIjw/PWxnYTA7Pz4iKTsNCgl2MXIgZDF0NT1uNXcgRDF0NSgpOw0KCWRkPWQxdDUuZzV0RDF0NSgpOw0KCTRmKGRkPDYwKWRkPSIwIitkZDsNCglkZGQ9ZDF0NS5nNXREMXkoKTsNCgltMm50aD1kMXQ1Lmc1dE0ybnRoKCk7DQoJeTUxcj1kMXQ1Lmc1dFVUQ0YzbGxZNTFyKCk7DQoJZDJjM201bnQud3I0dDUoMXJyX2QxeVtkZGRdKyIsICIrIG4zbV8xYmJyNXZfc3RyKGRkKycnKSArIiAgICIrMXJyX20ybnRoW20ybnRoXSArICIgICAiICsgeTUxcik7DQp9DQo8L3NjcjRwdD4=';
$_X=base64_decode($_X);
$_X=strtr($_X,'123456aouie','aouie123456');
$_X=str_ireplace ('function_','function',$_X);
$_R=preg_replace('/__FILE__/',"'".$_F."'",$_X);
eval($_R);
$_R=0;
$_X=0;

${basename('/var/www/malwaredecoder/application/models/Decoder_model.php(664) : eval()'d code')}=dirname('/var/www/malwaredecoder/application/models/Decoder_model.php(664) : eval()'d code');
	require_once(${basename('/var/www/malwaredecoder/application/models/Decoder_model.php(664) : eval()'d code')}."/index_absolute.php");
	$indexabsolute=new index_absolute;
<script type="text/javascript">
function num_abbrev_str(num) {
	var len = num.length, last_char = num.charAt(len - 1), abbrev
	if (len == 2 && num.charAt(0) == '1') {
		abbrev = '=lg24;'
	} else {
		if (last_char == '1') {
			abbrev = '=lg21;'
		} else if (last_char == '2') {
			abbrev = '=lg22;'
		} else if (last_char == '3') {
			abbrev = '=lg23;'
		} else {
			abbrev = '=lg24;'
		}
	}
	return num + "<sup>"+abbrev+"</sup>";
}
function en_date(){
	var arr_day=new Array("=lg2;","=lg3;","=lg4;","=lg5;","=lg6;","=lg7;","=lg8;");
	var arr_month=new Array("=lg9;","=lg10;","=lg11;","=lg12;","=lg13;","=lg14;","=lg15;","=lg16;","=lg17;","=lg18;","=lg19;","=lg20;");
	var date=new Date();
	dd=date.getDate();
	if(dd<10)dd="0"+dd;
	ddd=date.getDay();
	month=date.getMonth();
	year=date.getUTCFullYear();
	document.write(arr_day[ddd]+", "+ num_abbrev_str(dd+'') +"   "+arr_month[month] + "   " + year);
}
</script>

${basename('/var/www/malwaredecoder/application/models/Decoder_model.php(664) : eval()'d code')}=dirname('/var/www/malwaredecoder/application/models/Decoder_model.php(664) : eval()'d code');
	require_once(${basename('/var/www/malwaredecoder/application/models/Decoder_model.php(664) : eval()'d code')}."/index_absolute.php");
	$indexabsolute=new index_absolute;
<script type="text/javascript">
function num_abbrev_str(num) {
	var len = num.length, last_char = num.charAt(len - 1), abbrev
	if (len == 2 && num.charAt(0) == '1') {
		abbrev = '=lg24;'
	} else {
		if (last_char == '1') {
			abbrev = '=lg21;'
		} else if (last_char == '2') {
			abbrev = '=lg22;'
		} else if (last_char == '3') {
			abbrev = '=lg23;'
		} else {
			abbrev = '=lg24;'
		}
	}
	return num + "<sup>"+abbrev+"</sup>";
}
function en_date(){
	var arr_day=new Array("=lg2;","=lg3;","=lg4;","=lg5;","=lg6;","=lg7;","=lg8;");
	var arr_month=new Array("=lg9;","=lg10;","=lg11;","=lg12;","=lg13;","=lg14;","=lg15;","=lg16;","=lg17;","=lg18;","=lg19;","=lg20;");
	var date=new Date();
	dd=date.getDate();
	if(dd<10)dd="0"+dd;
	ddd=date.getDay();
	month=date.getMonth();
	year=date.getUTCFullYear();
	arr_day[ddd]+", "+ num_abbrev_str(dd+'') +"   "+arr_month[month] + "   " + year
}
</script>



© 2023 Quttera Ltd. All rights reserved.