^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*(\$\w+)=\@\$_server\[['"]http_host['"]\];\1.{0,90}?if\(\@\$_get\[["']merdo["'\]\)\{\w\s'\<\!\-]+sysadmin.{0,180}?curl_setopt\(\$.{0,370}?file_get_contents\(\$.{0,150}?$\w{0,21}=\@json_decode\(str_rot13\(.{0,460}?\$\w.{0,21}\[["']html.{0,550}?\$myurl=rtrim\(\$\w.{0,21}\[['"]links.{0,110}header\(['"]location:\s*["']\.\$url.{0,100}?\)\.['"]\?merdo=.{0,140}?\);(?:[^>]+>\s*)?(?=\s*<\?(?:php)?)