[Juffar]

The file basically looks like this.

PHP Code


<?php 
var _0x4775=['\x65\x72\x72\x6f\x72','\x65\x78\x63\x65\x70\x74\x69\x6f\x6e','\x74\x72\x61\x63\x65','\x6c\x6f\x67','\x6f\x6e\x6b\x65\x79\x70\x72\x65\x73\x73','\x65\x76\x65\x6e\x74','\x6f\x6e\x6d\x6f\x75\x73\x65\x64\x6f\x77\x6e','\x6f\x6e\x6b\x65\x79\x64\x6f\x77\x6e','\x6b\x65\x79\x43\x6f\x64\x65','\x61\x6c\x6c','\x6c\x61\x79\x65\x72\x73','\x77\x68\x69\x63\x68','\x63\x61\x70\x74\x75\x72\x65\x45\x76\x65\x6e\x74\x73' 


Please inbox me if you can do it and I'll give you the full file/text.

[stapel]

think i could do that. send you a pm :)

[CyberStrike]

The file basically looks like this.

PHP Code


<?php 
var _0x4775=['\x65\x72\x72\x6f\x72','\x65\x78\x63\x65\x70\x74\x69\x6f\x6e','\x74\x72\x61\x63\x65','\x6c\x6f\x67','\x6f\x6e\x6b\x65\x79\x70\x72\x65\x73\x73','\x65\x76\x65\x6e\x74','\x6f\x6e\x6d\x6f\x75\x73\x65\x64\x6f\x77\x6e','\x6f\x6e\x6b\x65\x79\x64\x6f\x77\x6e','\x6b\x65\x79\x43\x6f\x64\x65','\x61\x6c\x6c','\x6c\x61\x79\x65\x72\x73','\x77\x68\x69\x63\x68','\x63\x61\x70\x74\x75\x72\x65\x45\x76\x65\x6e\x74\x73' 


Please inbox me if you can do it and I'll give you the full file/text.

That is hex, same stuff we see in shell code it says:

errorexceptiontracelogonkeypresseventonmousedownonkeydownkeyCodealllayerswhichcaptureEvents

https://www.rapidtables.com/convert/numb...ascii.html

Edit: More than likely you will see another variable or two with hex like this variable, and at the end it will have a place that it calls all these variables.. it's just obfuscation I have seen it on a few compromised sites where the malicious attacker is doing something like messing with cookies, and then doing redirects .. stuff like that.